From vuln-scout
Traces user-controlled input from sources like $_GET, req.query to dangerous sinks in PHP, Java, Python, Node.js, .NET apps during whitebox pentesting to assess exploitability.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vuln-scout:data-flow-tracingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Guide the process of tracing user-controlled input from entry points (sources) through the application to security-sensitive functions (sinks). This is essential for confirming vulnerability exploitability.
Guide the process of tracing user-controlled input from entry points (sources) through the application to security-sensitive functions (sinks). This is essential for confirming vulnerability exploitability.
Activate this skill when:
HTTP Sources:
| Language | Common Sources |
|---|---|
| PHP | $_GET, $_POST, $_REQUEST, $_COOKIE, $_FILES, $_SERVER |
| Java | request.getParameter(), request.getHeader(), @RequestParam |
| Python | request.args, request.form, request.data, request.json |
| Node.js | req.query, req.body, req.params, req.headers |
| .NET | Request.QueryString, Request.Form, Request["param"] |
Other Sources:
Refer to the dangerous-functions skill for comprehensive sink lists.
Track how data changes between source and sink:
Start from the dangerous function identified during code review.
Identify what variables/parameters are passed to the sink.
Example: system($cmd);
Direct parameter: $cmd
Follow each parameter to its origin:
Determine where user input enters:
$cmd = $_GET['command']; // Direct source
$cmd = $row['command']; // Database (check how it was stored)
$cmd = $config['cmd']; // Config file (check if user-modifiable)
Document all changes to the data:
Source: $_GET['input']
-> urldecode()
-> str_replace(['../', '..\\'], '', $input)
-> escapeshellarg()
-> Sink: exec()
Consider:
Forward Tracing: Start from source, follow to sinks
$input = $_GET['x'];
$processed = process($input);
dangerous_function($processed);
Backward Tracing: Start from sink, trace to source
dangerous_function($var);
<- $var = transform($data);
<- $data = $_POST['param'];
# Find where variable is assigned
grep -rn "\$varname\s*=" --include="*.php"
# Find where variable is used
grep -rn "\$varname" --include="*.php"
# Find function calls
grep -rn "functionName\s*(" --include="*.php"
$input = $_GET['cmd'];
system($input); // Vulnerable
// Store
$db->insert(['cmd' => $_POST['cmd']]);
// Later, retrieve and execute
$row = $db->query("SELECT cmd FROM jobs")->fetch();
system($row['cmd']); // Vulnerable if original input wasn't sanitized
// Config loaded from user-modifiable file
$config = parse_ini_file('/var/www/config.ini');
system($config['backup_cmd']); // Vulnerable if config is modifiable
// file1.php
$_SESSION['cmd'] = $_GET['cmd'];
// file2.php
system($_SESSION['cmd']); // Vulnerable
$input = htmlspecialchars($_GET['x']); // XSS protection
$input = escapeshellarg($_GET['x']); // Command injection protection
$input = intval($_GET['x']); // Type casting
$input = preg_replace('/[^a-z]/', '', $_GET['x']); // Whitelist
| Sanitization | Bypass Considerations |
|---|---|
| Blacklist | Missing characters, encoding |
| Whitelist | Logic errors, regex flaws |
| Type casting | Depends on sink requirements |
| Encoding | Double encoding, context |
| Length limits | Truncation attacks |
When tracing, document findings:
## Finding: [Vulnerability Type]
### Sink
- File: path/to/file.php
- Line: 42
- Function: system($cmd)
### Source
- File: path/to/file.php
- Line: 35
- Source: $_GET['command']
### Data Flow
1. $_GET['command'] received (line 35)
2. Passed to sanitize() function (line 36)
3. Concatenated with prefix (line 38)
4. Passed to system() (line 42)
### Sanitization
- sanitize() removes semicolons and pipes
- Bypass: Use newline (%0a) or $() syntax
### Exploitability
- Confirmed exploitable
- Payload: `valid_command%0awhoami`
npx claudepluginhub allsmog/vuln-scout --plugin whitebox-pentestIdentifies security-sensitive functions (sinks) for command injection, SQL injection, code execution in PHP, Java, Python, JS, .NET, Go, Ruby, Rust during whitebox pentesting.
Tracks data flow between function parameters, calls, and arguments using VulHunt taint analysis. Detects vulnerabilities like command injection, buffer overflows, or traces user input to dangerous functions.
Traces execution paths, maps dependencies, follows data flows, and explores unfamiliar code systematically from entry points to build incremental understanding.