Protocol Analysis
Detection Workflow
- Identify protocol handlers: Find network socket handlers, locate packet parsing functions, identify protocol state machines, map protocol message types
- Analyze protocol messages: Identify message formats, parse message fields, check field validation, assess length handling
- Trace protocol state: Map state transitions, identify state variables, check state machine completeness, assess state corruption potential
- Assess security: Check authentication and authorization, verify input validation, assess exploitability, identify protocol-level attacks
Key Patterns
- Protocol parsing vulnerabilities: buffer overflows in packet parsing, integer overflow in length fields, format string in protocol handling, command injection in protocol commands
- State machine issues: out-of-order message handling, missing state transitions, state corruption attacks, protocol state confusion
- Authentication flaws: weak authentication mechanisms, missing authentication on critical operations, authentication bypass opportunities, session management issues
- Protocol logic errors: race conditions in protocol handling, TOCTOU in protocol operations, improper input validation, protocol downgrade attacks
Output Format
Report with: id, type, subtype, severity, confidence, location, protocol, vulnerability, packet_field (name, offset, size), overflow_scenario, attack_vector, exploitable, impact, mitigation.
Severity Guidelines
- CRITICAL: Remote code execution via protocol vulnerability
- HIGH: Remote DoS or information disclosure
- MEDIUM: Local protocol issues
- LOW: Minor protocol bugs
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: analyzing-protocols3description: Analyzes network protocol implementations to identify parsing vulnerabilities, state machine issues, and protocol-level security problems. Use when analyzing network servers, protocol handlers, or investigating protocol implementation bugs.4---5
6# Protocol Analysis
7
8## Detection Workflow
9
101. **Identify protocol handlers**: Find network socket handlers, locate packet parsing functions, identify protocol state machines, map protocol message types
112. **Analyze protocol messages**: Identify message formats, parse message fields, check field validation, assess length handling
123. **Trace protocol state**: Map state transitions, identify state variables, check state machine completeness, assess state corruption potential
134. **Assess security**: Check authentication and authorization, verify input validation, assess exploitability, identify protocol-level attacks
14
15## Key Patterns
16
17- Protocol parsing vulnerabilities: buffer overflows in packet parsing, integer overflow in length fields, format string in protocol handling, command injection in protocol commands
18- State machine issues: out-of-order message handling, missing state transitions, state corruption attacks, protocol state confusion
19- Authentication flaws: weak authentication mechanisms, missing authentication on critical operations, authentication bypass opportunities, session management issues
20- Protocol logic errors: race conditions in protocol handling, TOCTOU in protocol operations, improper input validation, protocol downgrade attacks
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, protocol, vulnerability, packet_field (name, offset, size), overflow_scenario, attack_vector, exploitable, impact, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: Remote code execution via protocol vulnerability
29- **HIGH**: Remote DoS or information disclosure
30- **MEDIUM**: Local protocol issues
31- **LOW**: Minor protocol bugs
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88