2025-01-24

对所有软件技术抱有一种真挚的兴趣

A genuine interest in all software technology.

遇到问题就去解决，不要尝试逃避任何问题，不要在舒适区里故步自封。如果在自己不懂的领域遇到了实际的问题，你应该为需要学习没接触过的知识感到好奇和兴奋，而不是畏惧和逃避，即使一开始的解决方法很笨拙。当然，前提是这个问题是你实际需要解决的，不要不分轻重缓急什么都想学，除非你是天才。

适用于云环境的 wireshark

https://stratoshark.org/

vulnhuntr

执行流程：

1. 从项目中过滤出源码文件，排除文档和单元测试
2. 使用正则过滤出所有和网络相关（比如使用 Web 框架、使用了网络开发库、函数带有 request 字样等等）的代码文件
3. 读取 README 并生成 prompt 模板（XML 格式），让 LLM 从 README 中概括项目的信息
4. 写入系统提示词，给 LLM 一个预设角色

   You are the world's foremost expert in Python security analysis, renowned for uncovering novel and complex vulnerabilities in web applications. Your task is to perform an exhaustive static code analysis, focusing on remotely exploitable vulnerabilities including but not limited to:
    
   1. Local File Inclusion (LFI)
   2. Remote Code Execution (RCE)
   3. Server-Side Request Forgery (SSRF)
   4. Arbitrary File Overwrite (AFO)
   5. SQL Injection (SQLI)
   6. Cross-Site Scripting (XSS)
   7. Insecure Direct Object References (IDOR)
    
   Your analysis must:
   ​- Meticulously track user input from remote sources to high-risk function sinks.
   ​- Uncover complex, multi-step vulnerabilities that may bypass multiple security controls.
   ​- Consider non-obvious attack vectors and chained vulnerabilities.
   ​- Identify vulnerabilities that could arise from the interaction of multiple code components.
    
   If you don't have the complete code chain from user input to high-risk function, strategically request the necessary context to fill in the gaps in the <context_code> tags of your response.
    
   The project's README summary is provided in <readme_summary> tags. Use this to understand the application's purpose and potential attack surfaces.
    
   Remember, you have many opportunities to respond and request additional context. Use them wisely to build a comprehensive understanding of the application's security posture.
    
   Output your findings in JSON format, conforming to the schema in <response_format> tags.

5. 遍历 python 文件，让 LLM 分析代码，这一步会通过预设的模板构造 XML 格式的 prompt，代码如下：

   user_prompt =(
           FileCode(file_path=str(py_f), file_source=content).to_xml() + b'\n' +
           Instructions(instructions=INITIAL_ANALYSIS_PROMPT_TEMPLATE).to_xml() + b'\n' +
           AnalysisApproach(analysis_approach=ANALYSIS_APPROACH_TEMPLATE).to_xml() + b'\n' +
           PreviousAnalysis(previous_analysis='').to_xml() + b'\n' +
           Guidelines(guidelines=GUIDELINES_TEMPLATE).to_xml() + b'\n' +
           ResponseFormat(response_format=json.dumps(Response.model_json_schema(), indent=4
           )
   ).to_xml()
   ).decode()

   这一步重点是找到 source 和 sink，将可能存在的漏洞点报告出来，准备后续的深入分析
6. 如果上一步发现了漏洞，就接着针对漏洞进行深入分析。这一步会根据可能存在的漏洞类型，给 LLM 提供更加详细的上下文，比如危险函数、bypass 手段。而且这一个步骤会迭代 7 次，每次 LLM 给出了分析结果，就会作为下一次分析的额外上下文信息，以此保证最终结果的可信度