Dangerous Functions

---
name: Dangerous Functions
description: This skill should be used when the user asks about "dangerous functions", "security sinks", "what functions are dangerous in PHP/Java/Python", "find vulnerable functions", "code execution functions", "command injection sinks", "SQL injection functions", or needs to identify security-sensitive functions in source code during whitebox security review.
version: 1.0.0
---

# Dangerous Functions Reference

## Purpose

Provide comprehensive knowledge of security-sensitive functions (sinks) across programming languages for whitebox penetration testing. These functions are common targets during code review because improper use leads to critical vulnerabilities.

## When to Use

Activate this skill during:
- Code review phase of whitebox security review
- Searching for potential vulnerability entry points
- Building grep patterns for sink identification
- Understanding language-specific security risks

## Core Concepts

### Sources vs Sinks

**Sources**: Entry points where user input enters the application
- HTTP parameters, headers, cookies
- File uploads, database reads
- Environment variables, command-line arguments

**Sinks**: Functions where malicious input causes damage
- Command execution, SQL queries
- File operations, deserialization
- Code evaluation, template rendering

### Risk Categories

| Category | Impact | Common Languages |
|----------|--------|------------------|
| Command Injection | Remote Code Execution | All |
| Code Injection | Remote Code Execution | PHP, Python, JS |
| SQL Injection | Data breach | All with databases |
| Deserialization | Remote Code Execution | Java, PHP, Python, .NET |
| File Operations | LFI/RFI/Arbitrary Write | All |
| SSRF | Internal network access | All |
| Template Injection | Remote Code Execution | Python, Java, JS |
| Reentrancy | Fund theft | Solidity |
| Flash Loan Attacks | Price/state manipulation | Solidity |
| Access Control | Privilege escalation | Solidity |

## Methodology

### Step 1: Identify Application Language

Determine the primary language(s) used:
- Check file extensions (.php, .java, .py, .js, .cs, .go, .rb)
- Review package managers (composer.json, pom.xml, requirements.txt, package.json)
- Check framework indicators

### Step 2: Load Language-Specific Reference

Consult the appropriate reference file for comprehensive sink lists:
- `references/php-sinks.md` for PHP applications
- `references/java-sinks.md` for Java applications
- `references/python-sinks.md` for Python applications
- `references/javascript-sinks.md` for Node.js/JavaScript
- `references/dotnet-sinks.md` for .NET/C# applications
- `references/go-ruby-sinks.md` for Go and Ruby
- `references/rust-sinks.md` for Rust applications
- `references/kotlin-sinks.md` for Kotlin/Android applications *(preview -- not in supported language list)*
- `references/swift-sinks.md` for Swift/iOS applications *(preview -- not in supported language list)*
- `references/solidity-sinks.md` for Solidity smart contracts

### Step 3: Search for Sinks

Use Grep tool to search for dangerous functions:
- Search one category at a time (command, code, SQL, file, etc.)
- Use case-insensitive search for better coverage
- Include all relevant file extensions

### Step 4: Catalog Findings

For each identified sink, document:
- File path and line number
- Function name and context
- Input sources (if visible)
- Initial risk assessment

### Step 5: Prioritize for Testing

Rank findings using this framework:

| Priority | Criteria |
|----------|----------|
| Critical | Direct user input reaches sink |
| High | Database/file data (user-controlled) reaches sink |
| Medium | Authenticated user input reaches sink |
| Low | Admin-only input reaches sink |
| Info | Hardcoded values only |

## Prioritization Framework

When reviewing identified sinks, consider:

1. **Input Proximity**: How close is user input to the sink?
2. **Authentication**: Does exploitation require authentication?
3. **Privilege Level**: What access level is needed?
4. **Impact**: What can an attacker achieve?
5. **Exploitability**: Are there filters or sanitization?

## Additional Resources

### Reference Files

For comprehensive function lists by language, consult:
- **`references/php-sinks.md`** - PHP dangerous functions with grep patterns
- **`references/java-sinks.md`** - Java dangerous functions with grep patterns
- **`references/python-sinks.md`** - Python dangerous functions with grep patterns
- **`references/javascript-sinks.md`** - JavaScript/Node.js dangerous functions
- **`references/dotnet-sinks.md`** - .NET/C# dangerous functions
- **`references/go-ruby-sinks.md`** - Go and Ruby dangerous functions
- **`references/rust-sinks.md`** - Rust dangerous functions (unsafe, FFI, etc.)
- **`references/kotlin-sinks.md`** - Kotlin/Android dangerous functions *(preview -- not in supported language list)*
- **`references/swift-sinks.md`** - Swift/iOS dangerous functions *(preview -- not in supported language list)*
- **`references/solidity-sinks.md`** - Solidity smart contract sinks (reentrancy, access control, flash loans)

### Integration with Other Skills

- Use **vuln-patterns** skill for exploitation techniques per vulnerability type
- Use **data-flow-tracing** skill to trace input from sources to identified sinks
- Use **exploit-techniques** skill to develop PoC for confirmed vulnerabilities