Ultimate Mode

1// Symbolic execution example
2function processPayment(amount: number, userId: string) {
3  if (amount > 10000) {
4    // Path A: Large transaction
5    if (isAdminUser(userId)) {
6      // Path A1: Admin bypass - vulnerability found!
7      transferFunds(amount);  // No validation
8    } else {
9      // Path A2: Normal user - requires approval
10      requireApproval(amount, userId);
11    }
12  } else {
13    // Path B: Small transaction
14    transferFunds(amount);
15  }
16}
17
18// Symbolic execution explores ALL paths:
19//
20// Path A1 Analysis:
21// ┌──────────────────────────────────────────────────────────┐
22// │ Symbolic Execution Result                                │
23// ├──────────────────────────────────────────────────────────┤
24// │ Path: amount > 10000 ∧ isAdminUser(userId) = true        │
25// │ Constraint: userId ∈ {"admin", "superuser", "root"}      │
26// │                                                          │
27// │ VULNERABILITY: Authorization Bypass                      │
28// │                                                          │
29// │ An admin user can transfer unlimited funds without       │
30// │ the approval check required for regular users.           │
31// │                                                          │
32// │ Proof of Concept:                                        │
33// │   processPayment(999999, "admin")                        │
34// │   // Transfers $999,999 without approval                 │
35// │                                                          │
36// │ Recommendation: Apply same approval rules to admins      │
37// └──────────────────────────────────────────────────────────┘

1// Graph analysis finds vulnerabilities that span multiple files
2// Example: Finding auth bypass through indirect calls
3
4// auth/middleware.ts
5export function requireAuth(handler: Handler) {
6  return (req, res) => {
7    if (!req.session?.user) {
8      return res.status(401).send('Unauthorized');
9    }
10    return handler(req, res);
11  };
12}
13
14// routes/api.ts
15import { requireAuth } from '../auth/middleware';
16import { getUser } from '../controllers/user';
17
18router.get('/user/:id', requireAuth(getUser));  // Protected ✓
19router.get('/user/:id/admin', getUser);         // UNPROTECTED! ✗
20
21// Graph query that finds this:
22// ┌──────────────────────────────────────────────────────────┐
23// │ Cypher Query                                             │
24// ├──────────────────────────────────────────────────────────┤
25// │ MATCH (route:RouteHandler)-[:CALLS]->(fn:Function)       │
26// │ WHERE NOT (route)-[:WRAPPED_BY]->(:AuthMiddleware)       │
27// │ AND fn.accessesSensitiveData = true                      │
28// │ RETURN route.path, fn.name, fn.file                      │
29// └──────────────────────────────────────────────────────────┘
30//
31// Result:
32// | path            | name    | file              |
33// |-----------------|---------|-------------------|
34// | /user/:id/admin | getUser | controllers/user  |

1# Run custom graph queries
2bloodhound query "MATCH (n:Function) WHERE n.name CONTAINS 'password' RETURN n"
3
4# Export graph for external analysis
5bloodhound scan . --mode ultimate --export-cpg ./code-graph.json
6
7# Interactive graph explorer
8bloodhound explore --mode graph
9
10# Built-in vulnerability queries
11bloodhound scan . --mode ultimate --graph-queries \
12  auth-bypass,\
13  privilege-escalation,\
14  data-exfiltration,\
15  injection-chains