Auditing Open-Components: A Practitioner's Field Guide

Auditing Open-Source Components

Preface

Contents

Chapter 1: The Realpolitik of Open-Source Component Security

1. The arena: why open-source components specifically
2. Axis one: fixes are parameter-level
3. Axis two: what vendors choose not to fix is a signal
4. Axis three: severity grades an instance, magnitude grades a fleet
5. Axis four: attack-surface weight is the distance to the bug
6. The six-stage pipeline
7. The realpolitik, stated once

Chapter 2: Case Study — The Injection the Maintainers Missed Twice

1. Stage 1: The release note as a map of omissions
2. Stage 2: Pinning the root cause at two tags
3. Stage 3: Closing the chain
4. Stage 4: A graded proof
5. Stage 5: Drawing the boundary
6. Fifteen minutes of verification
7. Stage 6: What a real fix looks like
8. Twice, and why it matters

Chapter 3: Target Selection — The Scale-and-Surface Framework

1. Two axes, one map
2. Counting the fleet
3. Weighing the surface before reading a line
4. Reading the vendor before the code
5. Two public profiles, one comparison
6. The selection run
7. An hour of reconnaissance you can repeat

Chapter 4: Case Study — When the Fix Isn’t a Fix

1. Four gates between a fix and a fleet
2. Ghostcat: the fix that asked for configuration
3. Heartbleed: the fix that could not find its fleet
4. The radius rule, stated and used
5. Fifteen minutes of verification

Chapter 5: Static Chain Closure — From Entry to Sink

1. The direction of the walk
2. Enumerating the entries
3. Following the data
4. The four sink families
5. The toolchain, honestly
6. Reading a public chain end to end
7. Fifteen minutes of verification

Chapter 6: Proof Without a Lab — String-Level Simulation

1. Why pure static reports starve
2. The three grades
3. Building the harness
4. The DataEase replay, as method
5. Limits, stated plainly
6. Fifteen minutes of verification

Chapter 7: Scaling the Harness — Burp Extender Automation

1. The automation boundary
2. The host and its hooks
3. Pattern one: batch fingerprinting
4. Pattern two: tag-diff surveillance
5. Pattern three: regression re-fire
6. The BApp Store: when a tool outlives its finding
7. Limits, stated plainly
8. Fifteen minutes of verification

Chapter 8: The Disclosure Pipeline — From Finding to Payout

1. The channel map
2. Matching the finding to the channel
3. The six elements of a report that closes
4. Windows and tempo
5. Getting paid
6. Limits, stated plainly
7. Fifteen minutes of verification

Chapter 9: The Operating Cadence — Running This as a Practice

1. The week as the unit of work
2. The four days, one by one
3. The workbench
4. Energy, honestly
5. From the first hole to the tenth
6. Limits, stated plainly
7. Fifteen minutes of verification

Chapter 10: The Honest Ledger — What This Practice Is Worth

About the Author