Taint Analysis
Detection Workflow
- Identify sources: Find recv, read, getenv, fgets, scanf, argv (input functions)
- Identify sinks: Find system, popen, strcpy, sprintf, execve, malloc (dangerous functions)
- Find taint paths: Use
xrefs_to to trace from sources to sinks
- Analyze sanitization: Check for input validation, length checks, character filtering, encoding/escaping
- Assess risk: Determine reachability, check if attacker controls critical parts, evaluate exploitability
Key Patterns
- Direct command injection: recv() -> buffer -> sprintf(cmd, "echo %s", buffer) -> system(cmd)
- Path traversal: fgets() -> filename -> fopen(filename, "r")
- Buffer overflow via tainted size: recv() -> size_buffer -> atoi(size_buffer) -> malloc(size)
Output Format
Report taint paths with: source (function, address, context), sink (function, address, context), path (list of functions), sanitizers_found, is_vulnerable, confidence, vulnerability_type.
Severity Guidelines
- CRITICAL: Direct injection with no sanitization (command injection, SQL injection)
- HIGH: Path traversal, buffer overflow via tainted size
- MEDIUM: Potential injection with partial sanitization
- LOW: Tainted data with limited impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: analyzing-taint-flow3description: Tracks untrusted input propagation from sources to sinks in binary code to identify injection vulnerabilities. Use when analyzing data flow, tracing user input to dangerous functions, or detecting command/SQL injection. Use when this capability is needed.4---56# Taint Analysis78## Detection Workflow9101. **Identify sources**: Find recv, read, getenv, fgets, scanf, argv (input functions)112. **Identify sinks**: Find system, popen, strcpy, sprintf, execve, malloc (dangerous functions)123. **Find taint paths**: Use `xrefs_to` to trace from sources to sinks134. **Analyze sanitization**: Check for input validation, length checks, character filtering, encoding/escaping145. **Assess risk**: Determine reachability, check if attacker controls critical parts, evaluate exploitability1516## Key Patterns1718- Direct command injection: recv() -> buffer -> sprintf(cmd, "echo %s", buffer) -> system(cmd)19- Path traversal: fgets() -> filename -> fopen(filename, "r")20- Buffer overflow via tainted size: recv() -> size_buffer -> atoi(size_buffer) -> malloc(size)2122## Output Format2324Report taint paths with: source (function, address, context), sink (function, address, context), path (list of functions), sanitizers_found, is_vulnerable, confidence, vulnerability_type.2526## Severity Guidelines2728- **CRITICAL**: Direct injection with no sanitization (command injection, SQL injection)29- **HIGH**: Path traversal, buffer overflow via tainted size30- **MEDIUM**: Potential injection with partial sanitization31- **LOW**: Tainted data with limited impact3233## See Also3435- `patterns.md` - Detailed detection patterns and exploitation scenarios36- `examples.md` - Example analysis cases and code samples37- `references.md` - CWE references and mitigation strategies3839---40> Converted and distributed by [TomeVault](https://tomevault.io/claim/waiwai24) — claim your Tome and manage your conversions.41<!-- tomevault:4.0:skill_md:2026-04-13 -->
tomevault-io