n0tepad-pro/code_audit_skills
Data science & MLThis page was translated automatically. Technical details may differ from the original. View the original
Large model technology is evolving rapidly, changing the traditional way CTF and code auditing work. Current models have mature understanding of source code, and many teams have integrated LLMs into CTF problem-solving, web code auditing, and vulnerability discovery processes.
Overview
Large model technology is evolving rapidly, changing the traditional way CTF and code auditing work. Current models have mature understanding of source code, and many teams have integrated LLMs into CTF problem-solving, web code auditing, and vulnerability discovery processes. 1. : The routing, call chains, configuration, and filtering logic of real projects cannot be fully presented in a single conversation. 2. Static rules or models often focus only on "dangerous functions," ignoring whether routes are reachable, pre-filtering is effective, and parameters are controllable. 3. Audit reports saying "SQL injection may exist" and "stable PoC exist" are two different things. CTF and practical use both require the latter. - Corresponding to detection rules in *_rules/ (should be hit) - Optional *_chain.md (routing and call chain, same directory or number as sample) - Corresponding to Skill in code_audit_skills/ (guides LLM in writing PoC) php_code_audit/vuln_examples/ already exists (organized from historical CTF questions), used for Semgrep/Psalm rules and skill development. Auxiliary files :Y29uZmln.php, class.php, f1aG.php, flag.txt, etc. (all at vuln_examples/). - [x] Build a directory skeleton by language module (PHP / Java / Python / Go / C++) - [x] Migrate PHP samples to php_code_audit/vuln_examples/ - [ ] Rename GitHub repository to Code_Audit_Skills - [ ] Complete 01_lfi full-link template (semgrep + psalm + skill + chain) - [ ] Java / Python: One CodeQL template each - [ ] CI: Rule hits vuln_examples, clean code without false positives - Sample code is sourced from the CTF platform or publicly adapted. - Do not use this code or PoC for unauthorized testing or production environments.
Overview (machine translated)
Maintainer: n0tepad Warehouse: n0tepad-pro/Code_Audit_Skills
Background
Large model technology is evolving rapidly, changing the traditional way CTF and code auditing work. Current models have mature understanding of source code, and many teams have integrated LLMs into CTF problem-solving, web code auditing, and vulnerability discovery processes.
But in practice, there’s a clear gap: **Relying solely on ‘Skill + throwing a piece of code to the model’ is far from enough. **
Common issues include:
- Insufficient Context: The routing logic, call chains, configuration, and filtering logic of real projects cannot be fully presented in a single conversation.
- False positives everywhere: Static rules or models often focus only on ‘danger functions,’ ignoring whether routes are reachable, pre-filtering is effective, and parameters are controllable.
- Lack of Verifiable Conclusions: The audit report states “possible SQL injection” and “stable PoC” are two different things. CTF and practical use both require the latter.
Therefore, this project explores a **classic audit methodology + rule engine + call chain + LLM skill’ combination path: first narrow the scope, then confirm precisely, and finally produce truly usable PoCs.
Core Approach
| Stage | What to do | Output |
|---|---|---|
| 1. Route Composition | Sort through HTTP routing, controllers, handlers, include relationships | Suspicious path candidates for entry → sink |
| 2. Rule scanning | PHP uses Semgrep + Psalm; Java/Python/Go/C/C++ uses CodeQL | Alert point + rule ID + source code location |
| 3. Link Analysis | Judging by combining call chains: whether routes are reachable, filtering is bypassable, and sinks are controllable | High-confidence ‘pending verification’ vulnerability chains |
| 4. LLM Skill | Assign context on the link + rule hits + skill templates to the model, generating exploit ideas and PoC | executable payload/script |
| 5. PoC Validation | Reproduce in vuln_examples or test range environments to confirm availability | Validation passed / false positive rejection |
Design Principles: Rules are responsible for Recall, the link handles Precision, and Skill + PoC handles Confirm.
Technical Solution
This repository selects different static analysis bases according to language. CodeQL officially does not support PHP, so PHP is combined differently with other languages:
| Language | Static Analysis Plan | Division of Labor Explanation |
|---|
This page was translated automatically. Technical details may differ from the original.
Recommended Tools
Try a different keyword or remove a filter.
Install
npx skillfish add n0tepad-pro/code_audit_skills