Data Flow Tracing

What problem does it solve?

This skill helps security professionals understand how user-controlled data moves through an application, which is critical for identifying and confirming vulnerabilities.

Core Features & Use Cases

• Source Identification: Pinpoints where external input enters the application (e.g., HTTP requests, database reads).
• Sink Identification: Locates security-sensitive functions where data could be misused (e.g., command execution, SQL queries).
• Data Transformation Tracking: Documents how data is modified, encoded, or filtered between source and sink.
• Use Case: A developer suspects that user input might be used in a system command. This skill guides them to trace that input from the web request parameters all the way to the system() function, verifying if it's controllable and exploitable.

Quick Start

Use the data flow tracing skill to follow user input from the $_GET parameter to the exec function in the provided PHP code.