Black-Box Approximate Taint Tracking by Utilizing Data Partitioning
summary
Proposes a black-box system that observes HTTP inputs and parsed outputs (SQL, JSON, CSV, shell) and flags cases where input partitions appear in multiple output partitions, interpreting that as injection or exfiltration. Implementation uses segment-based substring matching (tunable, author reports window size 5 as a practical default) plus format-specific parsers and optional hooks (e.g., process builder, DB queries). Code is available as a gist; demo on stage failed but approach claims low overhead and practical detection.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:09Runtime AppSec Technologies
- 2:40What is RASP?
- 5:44The Dangers of User Input
- 7:53Escape
- 9:36History of Taint Tracking
- 11:34How would you do it?
- 16:06Approximations
- 18:38Hooking the app server
- 21:51Window Size Tuning
- 25:06Questions
- 26:01Taint Tracking Tools
- 30:07Data Partitioning
- 33:21Sliding window
related talks
52mTrust No Input: Taint Analysis at Compile Time
34mHacking the Blackbox
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
44mApplied Machine Learning for Data Exfil and Other Fun Topics
41mServer Side Prototype Pollution
13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...
22mTechnical Tracks
28mTypes, Deeper Static Analysis, and you