Dynamic Analysis Testing: Techniques Beyond DAST

User HTTP Request → Parameter value tagged as "tainted"
                           │
                           ▼
                  Application processes parameter
                           │
                    ┌──────┴──────┐
                    │             │
              Sanitized     Not sanitized
                    │             │
              Tag removed    Tag preserved
                    │             │
              Safe to use   Dangerous sink?
                                  │
                               Vulnerability
                               flagged

# Example: demonstrating taint flow manually
from flask import Flask, request
import sqlite3

app = Flask(__name__)

@app.route('/user')
def get_user():
    user_id = request.args.get('id')  # TAINTED: comes from HTTP parameter

    # UNSAFE: tainted data directly in SQL query
    # Runtime taint analysis flags this
    query = f"SELECT * FROM users WHERE id = {user_id}"
    conn = sqlite3.connect('app.db')
    result = conn.execute(query).fetchall()
    return str(result)

// This function has a vulnerability only reachable with a specific input
void process_packet(char *data, int len) {
    if (len > 100) {
        // Rarely reached in normal testing
        if (data[50] == 0x41) {
            // Even more rarely reached
            if (data[51] == 0x42) {
                // Buffer overflow — only KLEE/concolic testing finds this
                memcpy(buffer, data, 200);  // buffer is 150 bytes
            }
        }
    }
}

# Build with LLVM IR
clang -emit-llvm -c -g -O0 program.c -o program.bc

# Run KLEE
klee --posix-runtime program.bc

# Examine generated test cases
ls klee-out-0/
# test000001.ktest  test000002.ktest  ...

# Replay a specific test case
klee-replay ./program klee-out-0/test000001.ktest

// Mark inputs as symbolic for SPF
import gov.nasa.jpf.symbc.Debug;

public class TestTarget {
    public static void main(String[] args) {
        int x = Debug.makeSymbolicInteger("x");
        int y = Debug.makeSymbolicInteger("y");
        testFunction(x, y);
    }
}

# Compile with ASan
gcc -fsanitize=address -g -o myapp myapp.c

# Or with clang
clang -fsanitize=address -g -o myapp myapp.c

# Run—ASan instruments the binary automatically
./myapp

# Example output when a bug is found:
# ==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000010
# READ of size 4 at 0x603000000010 thread T0
#     #0 0x401234 in process_data myapp.c:47
#     #1 0x402345 in handle_request myapp.c:123

valgrind --tool=memcheck \
         --leak-check=full \
         --show-leak-kinds=all \
         --track-origins=yes \
         ./myapp

# Compile with TSan
clang -fsanitize=thread -g -o myapp myapp.c

./myapp
# ==12345==WARNING: ThreadSanitizer: data race
# Write of size 4 at 0x7f9d8c0027f0 by thread T2:
#     #0 increment counter.c:15
# Previous read of size 4 at 0x7f9d8c0027f0 by thread T1:
#     #0 read_counter counter.c:10

clang -fsanitize=undefined -g -o myapp myapp.c

# falco-rules.yaml — custom rule to detect unexpected outbound connections
- rule: Unexpected outbound connection from application
  desc: Application made an outbound connection to an unexpected destination
  condition: >
    outbound and
    container.image.repository = "myapp" and
    not fd.sip in (allowed_ips)
  output: >
    Unexpected connection from myapp (user=%user.name
    command=%proc.cmdline connection=%fd.name)
  priority: WARNING

# Trace all system calls from a suspicious binary
strace -f -e trace=network,file ./suspicious_binary 2>&1 | \
  grep -E "connect|open|write" | head -50

# Watch for file system writes to sensitive paths
strace -e trace=openat,write ./myapp 2>&1 | grep -E "(/etc/passwd|/etc/shadow|\.ssh)"

// Minimal eBPF program to trace execve calls
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(struct trace_event_raw_sys_enter *ctx) {
    char filename[256];
    bpf_probe_read_user_str(filename, sizeof(filename), (void *)ctx->args[0]);
    bpf_printk("execve: %s", filename);
    return 0;
}

Development
    ├── Memory sanitizers (ASan/TSan/UBSan) in debug builds
    └── Run test suite with sanitizers enabled

CI/CD
    ├── Fuzzing (short runs — 60–300 seconds per fuzz target)
    ├── DAST against ephemeral staging environment
    └── IAST with regression test suite

Staging
    ├── Extended fuzzing (hours per target)
    ├── Concolic testing for critical parsers
    └── Behavioral monitoring to detect unexpected activity

Production
    └── Behavioral monitoring (eBPF/Falco) for anomaly detection