Dangerous Functions

To find dangerous functions during a whitebox code review, you identify security sinks like command execution and deserialization across source code. This skill provides grep patterns and references for 9 languages to pinpoint these vulnerabilities.

Vulnerable functions and command injection sinks are covered across 11 programming environments: PHP, Java, Python, JavaScript, .NET, Go, Ruby, Rust, Swift, Kotlin, and Solidity.

Yes, it supports finding SQL injection and SSRF sinks in Go and Python source code. It provides language-specific references to detect file operations, code injection, and deserialization vulnerabilities during pentesting.

The best way to detect deserialization vulnerabilities across multiple codebases is by scanning for known security sinks using targeted grep patterns. This approach quickly highlights risky functions in languages like Java and Python.

To check for command injection in Python, you search for instances of os.system or subprocess.run. This skill identifies these dangerous functions as security sinks to help locate potential command execution vulnerabilities.

Yes, you can use this for Solidity smart contract security audits to find dangerous functions. Solidity is included in the language-specific references to help identify security sinks during whitebox penetration testing.