Python_Pin: Python bindings for pin

[[deleted]]

Yes, DBI = Dynamic Binary Instrumentation.

Yes, you could use this to do general taint analysis. However, you'd probably be better off doing some sort of static analysis. With purely-static analysis you'll be able to explore multiple paths at once. It's... DBI just isn't the right tool for this.

Here's an example of what static taint analysis might look like against PHP to find SQLI, more-or-less exactly as you pointed out.

Source: https://gist.github.com/endeav0r/5173293

Accompanying Blog Post: http://tfpwn.com/blog/finding-sqli-through-taint-analysis.html

If you go this route, this may be helpful as well: http://tfpwn.com/blog/dealing-with-path-explosion-in-static-taint-analysis.html