Source Code Audit Skill (SAST & Whitebox Security)
Purpose
Simulate advanced whitebox penetration testing by inspecting source code repositories, extracting application routes, detecting insecure database queries, identifying weak authentication/authorization logic, and locating hardcoded secrets.
Core Capabilities
- Route & Controller Mapping: Map all public and internal API endpoints (Express, Django, Flask, FastAPI, Spring Boot, Laravel, Next.js).
- Injection Flaws Detection: Scan for unsanitized SQL, command execution (
eval, exec, os.system), template injection (Jinja2, Thymeleaf), and XPath/LDAP queries.
- Authorization & Access Control: Analyze middleware, RBAC checks, and missing object-level permission guards (IDOR).
- Secret & Key Hunting: Fast regex and entropy scanning for credentials, JWT secrets, and third-party API keys using
trufflehog and ripgrep.
Workflow
1. Codebase Profiling
Identify technology stack, framework, database connectors, and dependency manifests:
# Check dependencies and package configs
find . -maxdepth 3 -name "package.json" -o -name "requirements.txt" -o -name "pom.xml" -o -name "composer.json" -o -name "go.mod"
2. Secret & Sensitive Data Extraction
Run fast local entropy search for leaked credentials:
# Fast regex search with ripgrep
rg -i "(api_key|secret_key|private_key|password|jwt_secret|bearer)\s*[:=]\s*['\"][A-Za-z0-9_\-\.]{8,}['\"]" .
# Deep TruffleHog file scan
trufflehog filesystem . --only-verified --json 2>/dev/null
3. API Route & Attack Surface Mining
Extract declared HTTP routes:
- Python (Flask/FastAPI/Django):
rg "@(app|router)\.(get|post|put|delete|patch)|path\(" .
- Node.js (Express/NestJS):
rg "(app|router)\.(get|post|put|delete|use)\(" .
- PHP/Laravel:
rg "Route::(get|post|put|delete|any)\(" .
4. High-Risk Vulnerability Pattern Scanning
- Command Injection:
rg -n "(subprocess\.Popen|os\.system|exec\(|child_process\.exec|shell_exec)" .
- SQL Injection:
rg -n "(\.raw\(|\.execute\(|SELECT\s+.*\%s|f\"SELECT\s+|\.query\(\s*[\"']SELECT)" .`
- Server-Side Request Forgery (SSRF):
rg -n "(requests\.get\(|axios\.get\(|fetch\(|curl_exec|urllib\.request)" .
- Insecure Deserialization:
rg -n "(pickle\.loads|yaml\.load\(|unserialize\(|Marshal\.load)" .
5. Formulation of Working Proof-of-Concept
Translate identified code flaws into concrete HTTP test cases (URLs, headers, JSON body payloads) to verify exploitability against the live deployment.
Output Artifacts
/workspace/output/sast_findings.md - Identified code-level flaws, affected file lines, and actionable exploitation paths.
1---2name: source-code-audit3description: Performs whitebox static application security testing (SAST), code review, API route extraction, credential hunting, and vulnerability pattern detection in local repositories or GitHub codebases.4---56# Source Code Audit Skill (SAST & Whitebox Security)78## Purpose9Simulate advanced whitebox penetration testing by inspecting source code repositories, extracting application routes, detecting insecure database queries, identifying weak authentication/authorization logic, and locating hardcoded secrets.1011## Core Capabilities12- **Route & Controller Mapping**: Map all public and internal API endpoints (Express, Django, Flask, FastAPI, Spring Boot, Laravel, Next.js).13- **Injection Flaws Detection**: Scan for unsanitized SQL, command execution (`eval`, `exec`, `os.system`), template injection (Jinja2, Thymeleaf), and XPath/LDAP queries.14- **Authorization & Access Control**: Analyze middleware, RBAC checks, and missing object-level permission guards (IDOR).15- **Secret & Key Hunting**: Fast regex and entropy scanning for credentials, JWT secrets, and third-party API keys using `trufflehog` and `ripgrep`.1617## Workflow1819### 1. Codebase Profiling20Identify technology stack, framework, database connectors, and dependency manifests:21```bash22# Check dependencies and package configs23find . -maxdepth 3 -name "package.json" -o -name "requirements.txt" -o -name "pom.xml" -o -name "composer.json" -o -name "go.mod"24```2526### 2. Secret & Sensitive Data Extraction27Run fast local entropy search for leaked credentials:28```bash29# Fast regex search with ripgrep30rg -i "(api_key|secret_key|private_key|password|jwt_secret|bearer)\s*[:=]\s*['\"][A-Za-z0-9_\-\.]{8,}['\"]" .3132# Deep TruffleHog file scan33trufflehog filesystem . --only-verified --json 2>/dev/null34```3536### 3. API Route & Attack Surface Mining37Extract declared HTTP routes:38- **Python (Flask/FastAPI/Django)**: `rg "@(app|router)\.(get|post|put|delete|patch)|path\(" .`39- **Node.js (Express/NestJS)**: `rg "(app|router)\.(get|post|put|delete|use)\(" .`40- **PHP/Laravel**: `rg "Route::(get|post|put|delete|any)\(" .`4142### 4. High-Risk Vulnerability Pattern Scanning43- **Command Injection**: `rg -n "(subprocess\.Popen|os\.system|exec\(|child_process\.exec|shell_exec)" .`44- **SQL Injection**: `rg -n "(\.raw\(|\.execute\(|SELECT\s+.*\%s|f\"SELECT\s+|\.query\(\s*[\`\"']SELECT)" .`45- **Server-Side Request Forgery (SSRF)**: `rg -n "(requests\.get\(|axios\.get\(|fetch\(|curl_exec|urllib\.request)" .`46- **Insecure Deserialization**: `rg -n "(pickle\.loads|yaml\.load\(|unserialize\(|Marshal\.load)" .`4748### 5. Formulation of Working Proof-of-Concept49Translate identified code flaws into concrete HTTP test cases (URLs, headers, JSON body payloads) to verify exploitability against the live deployment.5051## Output Artifacts52- `/workspace/output/sast_findings.md` - Identified code-level flaws, affected file lines, and actionable exploitation paths.
zyrexnn