vrt 0.3.0 → 0.3.1.pre.rc1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (11) hide show
  1. checksums.yaml +4 -4
  2. data/lib/vrt.rb +8 -0
  3. data/lib/vrt/mapping.rb +69 -0
  4. data/lib/vrt/node.rb +9 -1
  5. data/lib/vrt/version.rb +1 -1
  6. metadata +4 -8
  7. data/lib/data/1.3/deprecated-node-mapping.json +0 -77
  8. data/lib/data/1.3/mappings/cvss_v3.json +0 -722
  9. data/lib/data/1.3/mappings/cvss_v3.schema.json +0 -59
  10. data/lib/data/1.3/vrt.schema.json +0 -63
  11. data/lib/data/1.3/vulnerability-rating-taxonomy.json +0 -1607
data/lib/data/1.3/mappings/cvss_v3.schema.json DELETED
@@ -1,59 +0,0 @@
1
- {
2
- "$schema": "http://json-schema.org/draft-04/schema#",
3
- "title": "VRT to CVSS v3 Mapping",
4
- "description": "Mapping from the Vulnerability Rating Taxonomy to CVSS v3",
5
- "definitions": {
6
- "MappingMetadata": {
7
- "type": "object",
8
- "properties": {
9
- "default": { "$ref": "#/definitions/CVSSv3" }
10
- },
11
- "required": ["default"]
12
- },
13
- "VRTid": { "type": "string", "pattern": "^[a-z_][a-z_0-9]*$" },
14
- "CVSSv3": { "type": "string", "pattern": "^AV:[NALP]/AC:[LH]/PR:[NLH]/UI:[NR]/S:[UC]/C:[NLH]/I:[NLH]/A:[NLH]$" },
15
- "Mapping": {
16
- "type": "object",
17
- "properties": {
18
- "id": { "$ref": "#/definitions/VRTid" },
19
- "cvss_v3" : { "$ref": "#/definitions/CVSSv3" }
20
- },
21
- "required": ["id", "cvss_v3"],
22
- "additionalProperties": false
23
- },
24
- "MappingParent": {
25
- "type": "object",
26
- "properties": {
27
- "id": { "$ref": "#/definitions/VRTid" },
28
- "children": {
29
- "type": "array",
30
- "items" : {
31
- "anyOf": [
32
- { "$ref": "#/definitions/MappingParent" },
33
- { "$ref": "#/definitions/Mapping" }
34
- ]
35
- }
36
- },
37
- "cvss_v3" : { "$ref": "#/definitions/CVSSv3" }
38
- },
39
- "required": ["id", "children"],
40
- "additionalProperties": false
41
- }
42
- },
43
- "type": "object",
44
- "required": ["metadata", "content"],
45
- "properties": {
46
- "metadata": {
47
- "$ref": "#/definitions/MappingMetadata"
48
- },
49
- "content": {
50
- "type": "array",
51
- "items" : {
52
- "anyOf": [
53
- { "$ref": "#/definitions/MappingParent" },
54
- { "$ref": "#/definitions/Mapping" }
55
- ]
56
- }
57
- }
58
- }
59
- }
data/lib/data/1.3/vrt.schema.json DELETED
@@ -1,63 +0,0 @@
1
- {
2
- "$schema": "http://json-schema.org/draft-04/schema#",
3
- "title": "Vulnerability Rating Taxonomy",
4
- "description": "A Taxonomy of potential vulnerabilities with suggested technical priority rating",
5
- "definitions": {
6
- "VRTmetadata": {
7
- "type": "object",
8
- "properties": {
9
- "release_date": { "type": "string", "format": "date-time" }
10
- }
11
- },
12
- "VRT": {
13
- "type": "object",
14
- "properties": {
15
- "id": { "type": "string", "pattern": "^[a-z_][a-z_0-9]*$" },
16
- "type": { "type": "string", "enum": [ "category", "subcategory", "variant" ] },
17
- "name": { "type": "string", "pattern": "^[ a-zA-Z0-9-+()\/,.<]*$" },
18
- "priority": {
19
- "anyOf": [
20
- { "type": "number", "minimum": 1, "maximum": 5 },
21
- { "type": "null" }
22
- ]
23
- }
24
- },
25
- "required": ["id", "name", "type", "priority"]
26
- },
27
- "VRTparent": {
28
- "type": "object",
29
- "properties": {
30
- "id": { "type": "string", "pattern": "^[a-z_][a-z_0-9]*$" },
31
- "name": { "type": "string", "pattern": "^[ a-zA-Z0-9-+()\/,.<]*$" },
32
- "type": { "type": "string", "enum": [ "category", "subcategory" ] },
33
- "children": {
34
- "type": "array",
35
- "items" : {
36
- "anyOf": [
37
- { "$ref": "#/definitions/VRTparent" },
38
- { "$ref": "#/definitions/VRT" }
39
- ]
40
- },
41
- "minItems": 1
42
- }
43
- },
44
- "required": ["id", "name", "type", "children"]
45
- }
46
- },
47
- "type": "object",
48
- "required": ["metadata", "content"],
49
- "properties": {
50
- "metadata": {
51
- "$ref": "#/definitions/VRTmetadata"
52
- },
53
- "content": {
54
- "type": "array",
55
- "items" : {
56
- "anyOf": [
57
- { "$ref": "#/definitions/VRTparent" },
58
- { "$ref": "#/definitions/VRT" }
59
- ]
60
- }
61
- }
62
- }
63
- }
data/lib/data/1.3/vulnerability-rating-taxonomy.json DELETED
@@ -1,1607 +0,0 @@
1
- {
2
- "metadata": {
3
- "release_date": "2017-09-22T00:00:00+00:00"
4
- },
5
- "content": [
6
- {
7
- "id": "server_security_misconfiguration",
8
- "name": "Server Security Misconfiguration",
9
- "type": "category",
10
- "children": [
11
- {
12
- "id": "unsafe_cross_origin_resource_sharing",
13
- "name": "Unsafe Cross-Origin Resource Sharing",
14
- "type": "subcategory",
15
- "priority": null
16
- },
17
- {
18
- "id": "path_traversal",
19
- "name": "Path Traversal",
20
- "type": "subcategory",
21
- "priority": null
22
- },
23
- {
24
- "id": "directory_listing_enabled",
25
- "name": "Directory Listing Enabled",
26
- "type": "subcategory",
27
- "children": [
28
- {
29
- "id": "sensitive_data_exposure",
30
- "name": "Sensitive Data Exposure",
31
- "type": "variant",
32
- "priority": null
33
- },
34
- {
35
- "id": "non_sensitive_data_exposure",
36
- "name": "Non-Sensitive Data Exposure",
37
- "type": "variant",
38
- "priority": 5
39
- }
40
- ]
41
- },
42
- {
43
- "id": "same_site_scripting",
44
- "name": "Same-Site Scripting",
45
- "type": "subcategory",
46
- "priority": 5
47
- },
48
- {
49
- "id": "ssl_attack_breach_poodle_etc",
50
- "name": "SSL Attack (BREACH, POODLE etc.)",
51
- "type": "subcategory",
52
- "priority": null
53
- },
54
- {
55
- "id": "using_default_credentials",
56
- "name": "Using Default Credentials",
57
- "type": "subcategory",
58
- "children": [
59
- {
60
- "id": "production_server",
61
- "name": "Production Server",
62
- "type": "variant",
63
- "priority": 1
64
- },
65
- {
66
- "id": "staging_development_server",
67
- "name": "Staging/Development Server",
68
- "type": "variant",
69
- "priority": 2
70
- }
71
- ]
72
- },
73
- {
74
- "id": "misconfigured_dns",
75
- "name": "Misconfigured DNS",
76
- "type": "subcategory",
77
- "children": [
78
- {
79
- "id": "subdomain_takeover",
80
- "name": "Subdomain Takeover",
81
- "type": "variant",
82
- "priority": 2
83
- },
84
- {
85
- "id": "zone_transfer",
86
- "name": "Zone Transfer",
87
- "type": "variant",
88
- "priority": 4
89
- },
90
- {
91
- "id": "missing_caa_record",
92
- "name": "Missing Certification Authority Authorization (CAA) Record",
93
- "type": "variant",
94
- "priority": 5
95
- }
96
- ]
97
- },
98
- {
99
- "id": "mail_server_misconfiguration",
100
- "name": "Mail Server Misconfiguration",
101
- "type": "subcategory",
102
- "children": [
103
- {
104
- "id": "missing_spf_on_email_domain",
105
- "name": "Missing SPF on Email Domain",
106
- "type": "variant",
107
- "priority": 3
108
- },
109
- {
110
- "id": "email_spoofable_via_third_party_api_misconfiguration",
111
- "name": "Email Spoofable Via Third-Party API Misconfiguration",
112
- "type": "variant",
113
- "priority": 3
114
- },
115
- {
116
- "id": "missing_spf_on_non_email_domain",
117
- "name": "Missing SPF on Non-Email Domain",
118
- "type": "variant",
119
- "priority": 5
120
- },
121
- {
122
- "id": "spf_uses_a_soft_fail",
123
- "name": "SPF Uses a Soft Fail",
124
- "type": "variant",
125
- "priority": 5
126
- },
127
- {
128
- "id": "spf_includes_10_lookups",
129
- "name": "SPF Includes More Than 10 Lookups",
130
- "type": "variant",
131
- "priority": 5
132
- },
133
- {
134
- "id": "missing_dmarc",
135
- "name": "Missing DKIM/DMARC",
136
- "type": "variant",
137
- "priority": 5
138
- }
139
- ]
140
- },
141
- {
142
- "id": "lack_of_password_confirmation",
143
- "name": "Lack of Password Confirmation",
144
- "type": "subcategory",
145
- "children": [
146
- {
147
- "id": "change_email_address",
148
- "name": "Change Email Address",
149
- "type": "variant",
150
- "priority": 4
151
- },
152
- {
153
- "id": "change_password",
154
- "name": "Change Password",
155
- "type": "variant",
156
- "priority": 4
157
- },
158
- {
159
- "id": "delete_account",
160
- "name": "Delete Account",
161
- "type": "variant",
162
- "priority": 4
163
- },
164
- {
165
- "id": "manage_two_fa",
166
- "name": "Manage 2FA",
167
- "type": "variant",
168
- "priority": 5
169
- }
170
- ]
171
- },
172
- {
173
- "id": "no_rate_limiting_on_form",
174
- "name": "No Rate Limiting on Form",
175
- "type": "subcategory",
176
- "children": [
177
- {
178
- "id": "registration",
179
- "name": "Registration",
180
- "type": "variant",
181
- "priority": 4
182
- },
183
- {
184
- "id": "login",
185
- "name": "Login",
186
- "type": "variant",
187
- "priority": 3
188
- },
189
- {
190
- "id": "email_triggering",
191
- "name": "Email-Triggering",
192
- "type": "variant",
193
- "priority": 4
194
- }
195
- ]
196
- },
197
- {
198
- "id": "unsafe_file_upload",
199
- "name": "Unsafe File Upload",
200
- "type": "subcategory",
201
- "children": [
202
- {
203
- "id": "no_antivirus",
204
- "name": "No Antivirus",
205
- "type": "variant",
206
- "priority": 4
207
- },
208
- {
209
- "id": "no_size_limit",
210
- "name": "No Size Limit",
211
- "type": "variant",
212
- "priority": 4
213
- },
214
- {
215
- "id": "file_extension_filter_bypass",
216
- "name": "File Extension Filter Bypass",
217
- "type": "variant",
218
- "priority": 5
219
- }
220
- ]
221
- },
222
- {
223
- "id": "cookie_scoped_to_parent_domain",
224
- "name": "Cookie Scoped to Parent Domain",
225
- "type": "subcategory",
226
- "priority": 5
227
- },
228
- {
229
- "id": "missing_secure_or_httponly_cookie_flag",
230
- "name": "Missing Secure or HTTPOnly Cookie Flag",
231
- "type": "subcategory",
232
- "children": [
233
- {
234
- "id": "session_token",
235
- "name": "Session Token",
236
- "type": "variant",
237
- "priority": 4
238
- },
239
- {
240
- "id": "non_session_cookie",
241
- "name": "Non-Session Cookie",
242
- "type": "variant",
243
- "priority": 5
244
- }
245
- ]
246
- },
247
- {
248
- "id": "clickjacking",
249
- "name": "Clickjacking",
250
- "type": "subcategory",
251
- "children": [
252
- {
253
- "id": "sensitive_action",
254
- "name": "Sensitive Action",
255
- "type": "variant",
256
- "priority": 4
257
- },
258
- {
259
- "id": "non_sensitive_action",
260
- "name": "Non-Sensitive Action",
261
- "type": "variant",
262
- "priority": 5
263
- }
264
- ]
265
- },
266
- {
267
- "id": "oauth_misconfiguration",
268
- "name": "OAuth Misconfiguration",
269
- "type": "subcategory",
270
- "children": [
271
- {
272
- "id": "missing_state_parameter",
273
- "name": "Missing State Parameter",
274
- "type": "variant",
275
- "priority": 4
276
- }
277
- ]
278
- },
279
- {
280
- "id": "captcha_bypass",
281
- "name": "Captcha Bypass",
282
- "type": "subcategory",
283
- "children": [
284
- {
285
- "id": "implementation_vulnerability",
286
- "name": "Implementation Vulnerability",
287
- "type": "variant",
288
- "priority": 4
289
- },
290
- {
291
- "id": "brute_force",
292
- "name": "Brute Force",
293
- "type": "variant",
294
- "priority": 5
295
- }
296
- ]
297
- },
298
- {
299
- "id": "exposed_admin_portal",
300
- "name": "Exposed Admin Portal",
301
- "type": "subcategory",
302
- "children": [
303
- {
304
- "id": "to_internet",
305
- "name": "To Internet",
306
- "type": "variant",
307
- "priority": 5
308
- }
309
- ]
310
- },
311
- {
312
- "id": "missing_dnssec",
313
- "name": "Missing DNSSEC",
314
- "type": "subcategory",
315
- "priority": 5
316
- },
317
- {
318
- "id": "fingerprinting_banner_disclosure",
319
- "name": "Fingerprinting/Banner Disclosure",
320
- "type": "subcategory",
321
- "priority": 5
322
- },
323
- {
324
- "id": "username_enumeration",
325
- "name": "Username Enumeration",
326
- "type": "subcategory",
327
- "children": [
328
- {
329
- "id": "brute_force",
330
- "name": "Brute Force",
331
- "type": "variant",
332
- "priority": 5
333
- }
334
- ]
335
- },
336
- {
337
- "id": "potentially_unsafe_http_method_enabled",
338
- "name": "Potentially Unsafe HTTP Method Enabled",
339
- "type": "subcategory",
340
- "children": [
341
- {
342
- "id": "options",
343
- "name": "OPTIONS",
344
- "type": "variant",
345
- "priority": 5
346
- },
347
- {
348
- "id": "trace",
349
- "name": "TRACE",
350
- "type": "variant",
351
- "priority": 5
352
- }
353
- ]
354
- },
355
- {
356
- "id": "insecure_ssl",
357
- "name": "Insecure SSL",
358
- "type": "subcategory",
359
- "children": [
360
- {
361
- "id": "lack_of_forward_secrecy",
362
- "name": "Lack of Forward Secrecy",
363
- "type": "variant",
364
- "priority": 5
365
- },
366
- {
367
- "id": "insecure_cipher_suite",
368
- "name": "Insecure Cipher Suite",
369
- "type": "variant",
370
- "priority": 5
371
- }
372
- ]
373
- },
374
- {
375
- "id": "rfd",
376
- "name": "Reflected File Download (RFD)",
377
- "type": "subcategory",
378
- "priority": 5
379
- },
380
- {
381
- "id": "lack_of_security_headers",
382
- "name": "Lack of Security Headers",
383
- "type": "subcategory",
384
- "children": [
385
- {
386
- "id": "x_frame_options",
387
- "name": "X-Frame-Options",
388
- "type": "variant",
389
- "priority": 5
390
- },
391
- {
392
- "id": "cache_control_for_a_non_sensitive_page",
393
- "name": "Cache-Control for a Non-Sensitive Page",
394
- "type": "variant",
395
- "priority": 5
396
- },
397
- {
398
- "id": "x_xss_protection",
399
- "name": "X-XSS-Protection",
400
- "type": "variant",
401
- "priority": 5
402
- },
403
- {
404
- "id": "strict_transport_security",
405
- "name": "Strict-Transport-Security",
406
- "type": "variant",
407
- "priority": 5
408
- },
409
- {
410
- "id": "x_content_type_options",
411
- "name": "X-Content-Type-Options",
412
- "type": "variant",
413
- "priority": 5
414
- },
415
- {
416
- "id": "content_security_policy",
417
- "name": "Content-Security-Policy",
418
- "type": "variant",
419
- "priority": 5
420
- },
421
- {
422
- "id": "public_key_pins",
423
- "name": "Public-Key-Pins",
424
- "type": "variant",
425
- "priority": 5
426
- },
427
- {
428
- "id": "x_content_security_policy",
429
- "name": "X-Content-Security-Policy",
430
- "type": "variant",
431
- "priority": 5
432
- },
433
- {
434
- "id": "x_webkit_csp",
435
- "name": "X-Webkit-CSP",
436
- "type": "variant",
437
- "priority": 5
438
- },
439
- {
440
- "id": "content_security_policy_report_only",
441
- "name": "Content-Security-Policy-Report-Only",
442
- "type": "variant",
443
- "priority": 5
444
- },
445
- {
446
- "id": "cache_control_for_a_sensitive_page",
447
- "name": "Cache-Control for a Sensitive Page",
448
- "type": "variant",
449
- "priority": 4
450
- }
451
- ]
452
- },
453
- {
454
- "id": "bitsquatting",
455
- "name": "Bitsquatting",
456
- "type": "subcategory",
457
- "priority": 5
458
- }
459
- ]
460
- },
461
- {
462
- "id": "server_side_injection",
463
- "name": "Server-Side Injection",
464
- "type": "category",
465
- "children": [
466
- {
467
- "id": "file_inclusion",
468
- "name": "File Inclusion",
469
- "type": "subcategory",
470
- "children": [
471
- {
472
- "id": "local",
473
- "name": "Local",
474
- "type": "variant",
475
- "priority": 1
476
- }
477
- ]
478
- },
479
- {
480
- "id": "parameter_pollution",
481
- "name": "Parameter Pollution",
482
- "type": "subcategory",
483
- "children": [
484
- {
485
- "id": "social_media_sharing_buttons",
486
- "name": "Social Media Sharing Buttons",
487
- "type": "variant",
488
- "priority": 5
489
- }
490
- ]
491
- },
492
- {
493
- "id": "remote_code_execution_rce",
494
- "name": "Remote Code Execution (RCE)",
495
- "type": "subcategory",
496
- "priority": 1
497
- },
498
- {
499
- "id": "sql_injection",
500
- "name": "SQL Injection",
501
- "type": "subcategory",
502
- "children": [
503
- {
504
- "id": "error_based",
505
- "name": "Error-Based",
506
- "type": "variant",
507
- "priority": 1
508
- },
509
- {
510
- "id": "blind",
511
- "name": "Blind",
512
- "type": "variant",
513
- "priority": 1
514
- }
515
- ]
516
- },
517
- {
518
- "id": "xml_external_entity_injection_xxe",
519
- "name": "XML External Entity Injection (XXE)",
520
- "type": "subcategory",
521
- "priority": 1
522
- },
523
- {
524
- "id": "http_response_manipulation",
525
- "name": "HTTP Response Manipulation",
526
- "type": "subcategory",
527
- "children": [
528
- {
529
- "id": "response_splitting_crlf",
530
- "name": "Response Splitting (CRLF)",
531
- "type": "variant",
532
- "priority": 3
533
- }
534
- ]
535
- },
536
- {
537
- "id": "content_spoofing",
538
- "name": "Content Spoofing",
539
- "type": "subcategory",
540
- "children": [
541
- {
542
- "id": "iframe_injection",
543
- "name": "iframe Injection",
544
- "type": "variant",
545
- "priority": 3
546
- },
547
- {
548
- "id": "external_authentication_injection",
549
- "name": "External Authentication Injection",
550
- "type": "variant",
551
- "priority": 4
552
- },
553
- {
554
- "id": "email_html_injection",
555
- "name": "Email HTML Injection",
556
- "type": "variant",
557
- "priority": 4
558
- },
559
- {
560
- "id": "text_injection",
561
- "name": "Text Injection",
562
- "type": "variant",
563
- "priority": 5
564
- },
565
- {
566
- "id": "homograph_idn_based",
567
- "name": "Homograph/IDN-Based",
568
- "type": "variant",
569
- "priority": 5
570
- }
571
- ]
572
- }
573
- ]
574
- },
575
- {
576
- "id": "broken_authentication_and_session_management",
577
- "name": "Broken Authentication and Session Management",
578
- "type": "category",
579
- "children": [
580
- {
581
- "id": "authentication_bypass",
582
- "name": "Authentication Bypass",
583
- "type": "subcategory",
584
- "priority": 1
585
- },
586
- {
587
- "id": "privilege_escalation",
588
- "name": "Privilege Escalation",
589
- "type": "subcategory",
590
- "priority": null
591
- },
592
- {
593
- "id": "weak_login_function",
594
- "name": "Weak Login Function",
595
- "type": "subcategory",
596
- "children": [
597
- {
598
- "id": "over_http",
599
- "name": "Over HTTP",
600
- "type": "variant",
601
- "priority": 3
602
- }
603
- ]
604
- },
605
- {
606
- "id": "session_fixation",
607
- "name": "Session Fixation",
608
- "type": "subcategory",
609
- "priority": 3
610
- },
611
- {
612
- "id": "failure_to_invalidate_session",
613
- "name": "Failure to Invalidate Session",
614
- "type": "subcategory",
615
- "children": [
616
- {
617
- "id": "on_logout",
618
- "name": "On Logout",
619
- "type": "variant",
620
- "priority": 4
621
- },
622
- {
623
- "id": "on_password_reset",
624
- "name": "On Password Reset",
625
- "type": "variant",
626
- "priority": 4
627
- },
628
- {
629
- "id": "on_password_change",
630
- "name": "On Password Change",
631
- "type": "variant",
632
- "priority": 4
633
- },
634
- {
635
- "id": "all_sessions",
636
- "name": "All Sessions",
637
- "type": "variant",
638
- "priority": 5
639
- },
640
- {
641
- "id": "on_email_change",
642
- "name": "On Email Change",
643
- "type": "variant",
644
- "priority": 5
645
- },
646
- {
647
- "id": "long_timeout",
648
- "name": "Long Timeout",
649
- "type": "variant",
650
- "priority": 5
651
- }
652
- ]
653
- },
654
- {
655
- "id": "concurrent_logins",
656
- "name": "Concurrent Logins",
657
- "type": "subcategory",
658
- "priority": 5
659
- },
660
- {
661
- "id": "weak_registration_implementation",
662
- "name": "Weak Registration Implementation",
663
- "type": "subcategory",
664
- "children": [
665
- {
666
- "id": "over_http",
667
- "name": "Over HTTP",
668
- "type": "variant",
669
- "priority": 4
670
- }
671
- ]
672
- }
673
- ]
674
- },
675
- {
676
- "id": "sensitive_data_exposure",
677
- "name": "Sensitive Data Exposure",
678
- "type": "category",
679
- "children": [
680
- {
681
- "id": "critically_sensitive_data",
682
- "name": "Critically Sensitive Data",
683
- "type": "subcategory",
684
- "children": [
685
- {
686
- "id": "password_disclosure",
687
- "name": "Password Disclosure",
688
- "type": "variant",
689
- "priority": 1
690
- },
691
- {
692
- "id": "private_api_keys",
693
- "name": "Private API Keys",
694
- "type": "variant",
695
- "priority": 1
696
- }
697
- ]
698
- },
699
- {
700
- "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
701
- "name": "EXIF Geolocation Data Not Stripped From Uploaded Images",
702
- "type": "subcategory",
703
- "children": [
704
- {
705
- "id": "automatic_user_enumeration",
706
- "name": "Automatic User Enumeration",
707
- "type": "variant",
708
- "priority": 3
709
- },
710
- {
711
- "id": "manual_user_enumeration",
712
- "name": "Manual User Enumeration",
713
- "type": "variant",
714
- "priority": 4
715
- }
716
- ]
717
- },
718
- {
719
- "id": "visible_detailed_error_page",
720
- "name": "Visible Detailed Error/Debug Page",
721
- "type": "subcategory",
722
- "children": [
723
- {
724
- "id": "detailed_server_configuration",
725
- "name": "Detailed Server Configuration",
726
- "type": "variant",
727
- "priority": 4
728
- },
729
- {
730
- "id": "full_path_disclosure",
731
- "name": "Full Path Disclosure",
732
- "type": "variant",
733
- "priority": 5
734
- },
735
- {
736
- "id": "descriptive_stack_trace",
737
- "name": "Descriptive Stack Trace",
738
- "type": "variant",
739
- "priority": 5
740
- }
741
- ]
742
- },
743
- {
744
- "id": "disclosure_of_known_public_information",
745
- "name": "Disclosure of Known Public Information",
746
- "type": "subcategory",
747
- "priority": 5
748
- },
749
- {
750
- "id": "token_leakage_via_referer",
751
- "name": "Token Leakage via Referer",
752
- "type": "subcategory",
753
- "children": [
754
- {
755
- "id": "trusted_3rd_party",
756
- "name": "Trusted 3rd Party",
757
- "type": "variant",
758
- "priority": 5
759
- },
760
- {
761
- "id": "untrusted_3rd_party",
762
- "name": "Untrusted 3rd Party",
763
- "type": "variant",
764
- "priority": 4
765
- },
766
- {
767
- "id": "over_http",
768
- "name": "Over HTTP",
769
- "type": "variant",
770
- "priority": 4
771
- }
772
- ]
773
- },
774
- {
775
- "id": "sensitive_token_in_url",
776
- "name": "Sensitive Token in URL",
777
- "type": "subcategory",
778
- "priority": 4
779
- },
780
- {
781
- "id": "non_sensitive_token_in_url",
782
- "name": "Non-Sensitive Token in URL",
783
- "type": "subcategory",
784
- "priority": 5
785
- },
786
- {
787
- "id": "weak_password_reset_implementation",
788
- "name": "Weak Password Reset Implementation",
789
- "type": "subcategory",
790
- "children": [
791
- {
792
- "id": "password_reset_token_sent_over_http",
793
- "name": "Password Reset Token Sent Over HTTP",
794
- "type": "variant",
795
- "priority": 4
796
- }
797
- ]
798
- },
799
- {
800
- "id": "mixed_content",
801
- "name": "Mixed Content (HTTPS Sourcing HTTP)",
802
- "type": "subcategory",
803
- "priority": 5
804
- },
805
- {
806
- "id": "sensitive_data_hardcoded",
807
- "name": "Sensitive Data Hardcoded",
808
- "type": "subcategory",
809
- "children": [
810
- {
811
- "id": "oauth_secret",
812
- "name": "OAuth Secret",
813
- "type": "variant",
814
- "priority": 5
815
- },
816
- {
817
- "id": "file_paths",
818
- "name": "File Paths",
819
- "type": "variant",
820
- "priority": 5
821
- }
822
- ]
823
- },
824
- {
825
- "id": "internal_ip_disclosure",
826
- "name": "Internal IP Disclosure",
827
- "type": "subcategory",
828
- "priority": 5
829
- },
830
- {
831
- "id": "xssi",
832
- "name": "Cross Site Script Inclusion (XSSI)",
833
- "type": "subcategory",
834
- "priority": null
835
- },
836
- {
837
- "id": "json_hijacking",
838
- "name": "JSON Hijacking",
839
- "type": "subcategory",
840
- "priority": 5
841
- }
842
- ]
843
- },
844
- {
845
- "id": "cross_site_scripting_xss",
846
- "name": "Cross-Site Scripting (XSS)",
847
- "type": "category",
848
- "children": [
849
- {
850
- "id": "stored",
851
- "name": "Stored",
852
- "type": "subcategory",
853
- "children": [
854
- {
855
- "id": "non_admin_to_anyone",
856
- "name": "Non-Admin to Anyone",
857
- "type": "variant",
858
- "priority": 2
859
- },
860
- {
861
- "id": "admin_to_anyone",
862
- "name": "Admin to Anyone",
863
- "type": "variant",
864
- "priority": 3
865
- },
866
- {
867
- "id": "self",
868
- "name": "Self",
869
- "type": "variant",
870
- "priority": 5
871
- }
872
- ]
873
- },
874
- {
875
- "id": "reflected",
876
- "name": "Reflected",
877
- "type": "subcategory",
878
- "children": [
879
- {
880
- "id": "non_self",
881
- "name": "Non-Self",
882
- "type": "variant",
883
- "priority": 3
884
- },
885
- {
886
- "id": "self",
887
- "name": "Self",
888
- "type": "variant",
889
- "priority": 5
890
- }
891
- ]
892
- },
893
- {
894
- "id": "cookie_based",
895
- "name": "Cookie-Based",
896
- "type": "subcategory",
897
- "priority": 5
898
- },
899
- {
900
- "id": "ie_only",
901
- "name": "IE-Only",
902
- "type": "subcategory",
903
- "children": [
904
- {
905
- "id": "older_version_ie_10_11",
906
- "name": "Older Version (IE 10/11)",
907
- "type": "variant",
908
- "priority": 4
909
- },
910
- {
911
- "id": "xss_filter_disabled",
912
- "name": "XSS Filter Disabled",
913
- "type": "variant",
914
- "priority": 5
915
- },
916
- {
917
- "id": "older_version_ie10",
918
- "name": "Older Version (< IE10)",
919
- "type": "variant",
920
- "priority": 5
921
- }
922
- ]
923
- },
924
- {
925
- "id": "referer",
926
- "name": "Referer",
927
- "type": "subcategory",
928
- "priority": 4
929
- },
930
- {
931
- "id": "trace_method",
932
- "name": "TRACE Method",
933
- "type": "subcategory",
934
- "priority": 5
935
- },
936
- {
937
- "id": "universal_uxss",
938
- "name": "Universal (UXSS)",
939
- "type": "subcategory",
940
- "priority": 4
941
- },
942
- {
943
- "id": "off_domain",
944
- "name": "Off-Domain",
945
- "type": "subcategory",
946
- "children": [
947
- {
948
- "id": "data_uri",
949
- "name": "Data URI",
950
- "type": "variant",
951
- "priority": 4
952
- }
953
- ]
954
- }
955
- ]
956
- },
957
- {
958
- "id": "broken_access_control",
959
- "name": "Broken Access Control (BAC)",
960
- "type": "category",
961
- "children": [
962
- {
963
- "id": "idor",
964
- "name": "Insecure Direct Object References (IDOR)",
965
- "type": "subcategory",
966
- "priority": null
967
- },
968
- {
969
- "id": "server_side_request_forgery_ssrf",
970
- "name": "Server-Side Request Forgery (SSRF)",
971
- "type": "subcategory",
972
- "children": [
973
- {
974
- "id": "internal",
975
- "name": "Internal",
976
- "type": "variant",
977
- "priority": 2
978
- },
979
- {
980
- "id": "external",
981
- "name": "External",
982
- "type": "variant",
983
- "priority": 4
984
- }
985
- ]
986
- },
987
- {
988
- "id": "username_enumeration",
989
- "name": "Username Enumeration",
990
- "type": "subcategory",
991
- "children": [
992
- {
993
- "id": "data_leak",
994
- "name": "Data Leak",
995
- "type": "variant",
996
- "priority": 4
997
- }
998
- ]
999
- },
1000
- {
1001
- "id": "exposed_sensitive_android_intent",
1002
- "name": "Exposed Sensitive Android Intent",
1003
- "type": "subcategory",
1004
- "priority": null
1005
- },
1006
- {
1007
- "id": "exposed_sensitive_ios_url_scheme",
1008
- "name": "Exposed Sensitive iOS URL Scheme",
1009
- "type": "subcategory",
1010
- "priority": null
1011
- }
1012
- ]
1013
- },
1014
- {
1015
- "id": "cross_site_request_forgery_csrf",
1016
- "name": "Cross-Site Request Forgery (CSRF)",
1017
- "type": "category",
1018
- "children": [
1019
- {
1020
- "id": "application_wide",
1021
- "name": "Application-Wide",
1022
- "type": "subcategory",
1023
- "priority": 2
1024
- },
1025
- {
1026
- "id": "action_specific",
1027
- "name": "Action-Specific",
1028
- "type": "subcategory",
1029
- "children": [
1030
- {
1031
- "id": "authenticated_action",
1032
- "name": "Authenticated Action",
1033
- "type": "variant",
1034
- "priority": null
1035
- },
1036
- {
1037
- "id": "unauthenticated_action",
1038
- "name": "Unauthenticated Action",
1039
- "type": "variant",
1040
- "priority": null
1041
- },
1042
- {
1043
- "id": "logout",
1044
- "name": "Logout",
1045
- "type": "variant",
1046
- "priority": 5
1047
- }
1048
- ]
1049
- }
1050
- ]
1051
- },
1052
- {
1053
- "id": "application_level_denial_of_service_dos",
1054
- "name": "Application-Level Denial-of-Service (DoS)",
1055
- "type": "category",
1056
- "children": [
1057
- {
1058
- "id": "critical_impact_and_or_easy_difficulty",
1059
- "name": "Critical Impact and/or Easy Difficulty",
1060
- "type": "subcategory",
1061
- "priority": 2
1062
- },
1063
- {
1064
- "id": "high_impact_and_or_medium_difficulty",
1065
- "name": "High Impact and/or Medium Difficulty",
1066
- "type": "subcategory",
1067
- "priority": 3
1068
- },
1069
- {
1070
- "id": "app_crash",
1071
- "name": "App Crash",
1072
- "type": "subcategory",
1073
- "children": [
1074
- {
1075
- "id": "malformed_android_intents",
1076
- "name": "Malformed Android Intents",
1077
- "type": "variant",
1078
- "priority": 5
1079
- },
1080
- {
1081
- "id": "malformed_ios_url_schemes",
1082
- "name": "Malformed iOS URL Schemes",
1083
- "type": "variant",
1084
- "priority": 5
1085
- }
1086
- ]
1087
- }
1088
- ]
1089
- },
1090
- {
1091
- "id": "unvalidated_redirects_and_forwards",
1092
- "name": "Unvalidated Redirects and Forwards",
1093
- "type": "category",
1094
- "children": [
1095
- {
1096
- "id": "open_redirect",
1097
- "name": "Open Redirect",
1098
- "type": "subcategory",
1099
- "children": [
1100
- {
1101
- "id": "get_based",
1102
- "name": "GET-Based",
1103
- "type": "variant",
1104
- "priority": 4
1105
- },
1106
- {
1107
- "id": "post_based",
1108
- "name": "POST-Based",
1109
- "type": "variant",
1110
- "priority": 5
1111
- },
1112
- {
1113
- "id": "header_based",
1114
- "name": "Header-Based",
1115
- "type": "variant",
1116
- "priority": 5
1117
- }
1118
- ]
1119
- },
1120
- {
1121
- "id": "tabnabbing",
1122
- "name": "Tabnabbing",
1123
- "type": "subcategory",
1124
- "priority": 5
1125
- },
1126
- {
1127
- "id": "lack_of_security_speed_bump_page",
1128
- "name": "Lack of Security Speed Bump Page",
1129
- "type": "subcategory",
1130
- "priority": 5
1131
- }
1132
- ]
1133
- },
1134
- {
1135
- "id": "external_behavior",
1136
- "name": "External Behavior",
1137
- "type": "category",
1138
- "children": [
1139
- {
1140
- "id": "browser_feature",
1141
- "name": "Browser Feature",
1142
- "type": "subcategory",
1143
- "children": [
1144
- {
1145
- "id": "plaintext_password_field",
1146
- "name": "Plaintext Password Field",
1147
- "type": "variant",
1148
- "priority": 5
1149
- },
1150
- {
1151
- "id": "save_password",
1152
- "name": "Save Password",
1153
- "type": "variant",
1154
- "priority": 5
1155
- },
1156
- {
1157
- "id": "autocomplete_enabled",
1158
- "name": "Autocomplete Enabled",
1159
- "type": "variant",
1160
- "priority": 5
1161
- },
1162
- {
1163
- "id": "autocorrect_enabled",
1164
- "name": "Autocorrect Enabled",
1165
- "type": "variant",
1166
- "priority": 5
1167
- },
1168
- {
1169
- "id": "aggressive_offline_caching",
1170
- "name": "Aggressive Offline Caching",
1171
- "type": "variant",
1172
- "priority": 5
1173
- }
1174
- ]
1175
- },
1176
- {
1177
- "id": "csv_injection",
1178
- "name": "CSV Injection",
1179
- "type": "subcategory",
1180
- "priority": 5
1181
- },
1182
- {
1183
- "id": "captcha_bypass",
1184
- "name": "Captcha Bypass",
1185
- "type": "subcategory",
1186
- "children": [
1187
- {
1188
- "id": "crowdsourcing",
1189
- "name": "Crowdsourcing",
1190
- "type": "variant",
1191
- "priority": 5
1192
- }
1193
- ]
1194
- },
1195
- {
1196
- "id": "system_clipboard_leak",
1197
- "name": "System Clipboard Leak",
1198
- "type": "subcategory",
1199
- "children": [
1200
- {
1201
- "id": "shared_links",
1202
- "name": "Shared Links",
1203
- "type": "variant",
1204
- "priority": 5
1205
- }
1206
- ]
1207
- },
1208
- {
1209
- "id": "user_password_persisted_in_memory",
1210
- "name": "User Password Persisted in Memory",
1211
- "type": "subcategory",
1212
- "priority": 5
1213
- }
1214
- ]
1215
- },
1216
- {
1217
- "id": "insufficient_security_configurability",
1218
- "name": "Insufficient Security Configurability",
1219
- "type": "category",
1220
- "children": [
1221
- {
1222
- "id": "weak_password_policy",
1223
- "name": "Weak Password Policy",
1224
- "type": "subcategory",
1225
- "priority": 5
1226
- },
1227
- {
1228
- "id": "no_password_policy",
1229
- "name": "No Password Policy",
1230
- "type": "subcategory",
1231
- "priority": 4
1232
- },
1233
- {
1234
- "id": "weak_password_reset_implementation",
1235
- "name": "Weak Password Reset Implementation",
1236
- "type": "subcategory",
1237
- "children": [
1238
- {
1239
- "id": "token_is_not_invalidated_after_use",
1240
- "name": "Token is Not Invalidated After Use",
1241
- "type": "variant",
1242
- "priority": 4
1243
- },
1244
- {
1245
- "id": "token_is_not_invalidated_after_email_change",
1246
- "name": "Token is Not Invalidated After Email Change",
1247
- "type": "variant",
1248
- "priority": 5
1249
- },
1250
- {
1251
- "id": "token_is_not_invalidated_after_password_change",
1252
- "name": "Token is Not Invalidated After Password Change",
1253
- "type": "variant",
1254
- "priority": 5
1255
- },
1256
- {
1257
- "id": "token_has_long_timed_expiry",
1258
- "name": "Token Has Long Timed Expiry",
1259
- "type": "variant",
1260
- "priority": 5
1261
- },
1262
- {
1263
- "id": "token_is_not_invalidated_after_new_token_is_requested",
1264
- "name": "Token is Not Invalidated After New Token is Requested",
1265
- "type": "variant",
1266
- "priority": 5
1267
- }
1268
- ]
1269
- },
1270
- {
1271
- "id": "lack_of_verification_email",
1272
- "name": "Lack of Verification Email",
1273
- "type": "subcategory",
1274
- "priority": 5
1275
- },
1276
- {
1277
- "id": "lack_of_notification_email",
1278
- "name": "Lack of Notification Email",
1279
- "type": "subcategory",
1280
- "priority": 5
1281
- },
1282
- {
1283
- "id": "weak_registration_implementation",
1284
- "name": "Weak Registration Implementation",
1285
- "type": "subcategory",
1286
- "children": [
1287
- {
1288
- "id": "allows_disposable_email_addresses",
1289
- "name": "Allows Disposable Email Addresses",
1290
- "type": "variant",
1291
- "priority": 5
1292
- }
1293
- ]
1294
- },
1295
- {
1296
- "id": "weak_2fa_implementation",
1297
- "name": "Weak 2FA Implementation",
1298
- "type": "subcategory",
1299
- "children": [
1300
- {
1301
- "id": "missing_failsafe",
1302
- "name": "Missing Failsafe",
1303
- "type": "variant",
1304
- "priority": 5
1305
- }
1306
- ]
1307
- }
1308
- ]
1309
- },
1310
- {
1311
- "id": "using_components_with_known_vulnerabilities",
1312
- "name": "Using Components with Known Vulnerabilities",
1313
- "type": "category",
1314
- "children": [
1315
- {
1316
- "id": "rosetta_flash",
1317
- "name": "Rosetta Flash",
1318
- "type": "subcategory",
1319
- "priority": 4
1320
- },
1321
- {
1322
- "id": "outdated_software_version",
1323
- "name": "Outdated Software Version",
1324
- "type": "subcategory",
1325
- "priority": 5
1326
- },
1327
- {
1328
- "id": "captcha_bypass",
1329
- "name": "Captcha Bypass",
1330
- "type": "subcategory",
1331
- "children": [
1332
- {
1333
- "id": "ocr_optical_character_recognition",
1334
- "name": "OCR (Optical Character Recognition)",
1335
- "type": "variant",
1336
- "priority": 5
1337
- }
1338
- ]
1339
- }
1340
- ]
1341
- },
1342
- {
1343
- "id": "insecure_data_storage",
1344
- "name": "Insecure Data Storage",
1345
- "type": "category",
1346
- "children": [
1347
- {
1348
- "id": "sensitive_application_data_stored_unencrypted",
1349
- "name": "Sensitive Application Data Stored Unencrypted",
1350
- "type": "subcategory",
1351
- "children": [
1352
- {
1353
- "id": "on_external_storage",
1354
- "name": "On External Storage",
1355
- "type": "variant",
1356
- "priority": 4
1357
- },
1358
- {
1359
- "id": "on_internal_storage",
1360
- "name": "On Internal Storage",
1361
- "type": "variant",
1362
- "priority": 5
1363
- }
1364
- ]
1365
- },
1366
- {
1367
- "id": "server_side_credentials_storage",
1368
- "name": "Server-Side Credentials Storage",
1369
- "type": "subcategory",
1370
- "children": [
1371
- {
1372
- "id": "plaintext",
1373
- "name": "Plaintext",
1374
- "type": "variant",
1375
- "priority": 4
1376
- }
1377
- ]
1378
- },
1379
- {
1380
- "id": "non_sensitive_application_data_stored_unencrypted",
1381
- "name": "Non-Sensitive Application Data Stored Unencrypted",
1382
- "type": "subcategory",
1383
- "priority": 5
1384
- },
1385
- {
1386
- "id": "screen_caching_enabled",
1387
- "name": "Screen Caching Enabled",
1388
- "type": "subcategory",
1389
- "priority": 5
1390
- }
1391
- ]
1392
- },
1393
- {
1394
- "id": "lack_of_binary_hardening",
1395
- "name": "Lack of Binary Hardening",
1396
- "type": "category",
1397
- "children": [
1398
- {
1399
- "id": "lack_of_exploit_mitigations",
1400
- "name": "Lack of Exploit Mitigations",
1401
- "type": "subcategory",
1402
- "priority": 5
1403
- },
1404
- {
1405
- "id": "lack_of_jailbreak_detection",
1406
- "name": "Lack of Jailbreak Detection",
1407
- "type": "subcategory",
1408
- "priority": 5
1409
- },
1410
- {
1411
- "id": "lack_of_obfuscation",
1412
- "name": "Lack of Obfuscation",
1413
- "type": "subcategory",
1414
- "priority": 5
1415
- },
1416
- {
1417
- "id": "runtime_instrumentation_based",
1418
- "name": "Runtime Instrumentation-Based",
1419
- "type": "subcategory",
1420
- "priority": 5
1421
- }
1422
- ]
1423
- },
1424
- {
1425
- "id": "insecure_data_transport",
1426
- "name": "Insecure Data Transport",
1427
- "type": "category",
1428
- "children": [
1429
- {
1430
- "id": "cleartext_transmission_of_sensitive_data",
1431
- "name": "Cleartext Transmission of Sensitive Data",
1432
- "type": "subcategory",
1433
- "priority": null
1434
- },
1435
- {
1436
- "id": "executable_download",
1437
- "name": "Executable Download",
1438
- "type": "subcategory",
1439
- "children": [
1440
- {
1441
- "id": "no_secure_integrity_check",
1442
- "name": "No Secure Integrity Check",
1443
- "type": "variant",
1444
- "priority": 4
1445
- },
1446
- {
1447
- "id": "secure_integrity_check",
1448
- "name": "Secure Integrity Check",
1449
- "type": "variant",
1450
- "priority": 5
1451
- }
1452
- ]
1453
- }
1454
- ]
1455
- },
1456
- {
1457
- "id": "insecure_os_firmware",
1458
- "name": "Insecure OS/Firmware",
1459
- "type": "category",
1460
- "children": [
1461
- {
1462
- "id": "command_injection",
1463
- "name": "Command Injection",
1464
- "type": "subcategory",
1465
- "priority": 1
1466
- },
1467
- {
1468
- "id": "hardcoded_password",
1469
- "name": "Hardcoded Password",
1470
- "type": "subcategory",
1471
- "children": [
1472
- {
1473
- "id": "privileged_user",
1474
- "name": "Privileged User",
1475
- "type": "variant",
1476
- "priority": 1
1477
- },
1478
- {
1479
- "id": "non_privileged_user",
1480
- "name": "Non-Privileged User",
1481
- "type": "variant",
1482
- "priority": 2
1483
- }
1484
- ]
1485
- }
1486
- ]
1487
- },
1488
- {
1489
- "id": "broken_cryptography",
1490
- "name": "Broken Cryptography",
1491
- "type": "category",
1492
- "children": [
1493
- {
1494
- "id": "cryptographic_flaw",
1495
- "name": "Cryptographic Flaw",
1496
- "type": "subcategory",
1497
- "children": [
1498
- {
1499
- "id": "incorrect_usage",
1500
- "name": "Incorrect Usage",
1501
- "type": "variant",
1502
- "priority": 1
1503
- }
1504
- ]
1505
- }
1506
- ]
1507
- },
1508
- {
1509
- "id": "privacy_concerns",
1510
- "name": "Privacy Concerns",
1511
- "type": "category",
1512
- "children": [
1513
- {
1514
- "id": "unnecessary_data_collection",
1515
- "name": "Unnecessary Data Collection",
1516
- "type": "subcategory",
1517
- "children": [
1518
- {
1519
- "id": "wifi_ssid_password",
1520
- "name": "WiFi SSID+Password",
1521
- "type": "variant",
1522
- "priority": 4
1523
- }
1524
- ]
1525
- }
1526
- ]
1527
- },
1528
- {
1529
- "id": "network_security_misconfiguration",
1530
- "name": "Network Security Misconfiguration",
1531
- "type": "category",
1532
- "children": [
1533
- {
1534
- "id": "telnet_enabled",
1535
- "name": "Telnet Enabled",
1536
- "type": "subcategory",
1537
- "children": [
1538
- {
1539
- "id": "credentials_required",
1540
- "name": "Credentials Required",
1541
- "type": "variant",
1542
- "priority": 4
1543
- }
1544
- ]
1545
- }
1546
- ]
1547
- },
1548
- {
1549
- "id": "mobile_security_misconfiguration",
1550
- "name": "Mobile Security Misconfiguration",
1551
- "type": "category",
1552
- "children": [
1553
- {
1554
- "id": "ssl_certificate_pinning",
1555
- "name": "SSL Certificate Pinning",
1556
- "type": "subcategory",
1557
- "children": [
1558
- {
1559
- "id": "absent",
1560
- "name": "Absent",
1561
- "type": "variant",
1562
- "priority": 5
1563
- },
1564
- {
1565
- "id": "defeatable",
1566
- "name": "Defeatable",
1567
- "type": "variant",
1568
- "priority": 5
1569
- }
1570
- ]
1571
- },
1572
- {
1573
- "id": "tapjacking",
1574
- "name": "Tapjacking",
1575
- "type": "subcategory",
1576
- "priority": 5
1577
- }
1578
- ]
1579
- },
1580
- {
1581
- "id": "client_side_injection",
1582
- "name": "Client-Side Injection",
1583
- "type": "category",
1584
- "children": [
1585
- {
1586
- "id": "binary_planting",
1587
- "name": "Binary Planting",
1588
- "type": "subcategory",
1589
- "children": [
1590
- {
1591
- "id": "privilege_escalation",
1592
- "name": "Privilege Escalation",
1593
- "type": "variant",
1594
- "priority": 4
1595
- },
1596
- {
1597
- "id": "no_privilege_escalation",
1598
- "name": "No Privilege Escalation",
1599
- "type": "variant",
1600
- "priority": 5
1601
- }
1602
- ]
1603
- }
1604
- ]
1605
- }
1606
- ]
1607
- }