@cyberstrike-io/cyberstrike 1.1.10 → 1.1.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -7
- package/package.json +2 -2
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-00/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-99/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-auth-session/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-05.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-05.2/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-01.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-12/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-13/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-14/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-12/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-13/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-errh-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-errh-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-injection/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.2/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.3/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.4/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.5/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.6/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.7/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.8/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-11.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-12/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-13/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-14/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-15/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-16/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-17/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-18/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-19/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-20/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-logic-client-api/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-recon-config/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-11/SKILL.md +0 -6
- package/skill/ad-security/SKILL.md +0 -3
- package/skill/bun-file-io/SKILL.md +0 -3
- package/skill/kerberos-attacks/SKILL.md +0 -3
- package/skill/recon-methodology/SKILL.md +0 -3
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-840]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 66cc2aa24c906eaa30ff0cae773c7df1f82a48206ddb0b05a97e53177ac24fb3
|
|
15
|
-
signature: z1MB1AXKCVWZEjS8Tm7JYEkU7fQ/j1leI4TREwp7rQ22vFeEDefQFoHJmGdbEO1VESCLZvuFt+hfcSOq7XTkDA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-busl-05
|
|
@@ -650,9 +647,6 @@ class TieredLimiter:
|
|
|
650
647
|
- [OWASP API Security - Rate Limiting](https://owasp.org/API-Security/)
|
|
651
648
|
- [Rate Limiting Best Practices](https://cloud.google.com/architecture/rate-limiting-strategies-techniques)
|
|
652
649
|
|
|
653
|
-
sha256: 4e290ea298cf92490f9b8e083d5ebfef530873ff6ab7f057a905c4be24e568eb
|
|
654
|
-
signature: h11+5IzNnWv8+j/5xsjnfTd8vGkbDtvyNe4XXd5CD31whmslBs2bDLtF9xih7ugOKJQZ5BaMQh2oIKbJGIn/Dg==
|
|
655
|
-
signed_by: cyberstrike-official
|
|
656
650
|
|
|
657
651
|
---
|
|
658
652
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-840]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: fca8f01ada988025885901969c7dd272c355bdac219c0127a193229d9666c712
|
|
15
|
-
signature: nb8sfDC8bWBAxYClBOC0Og401Nn1ZLXXXpUwugSzYKno/JJNfBGMQgzDact+0y48aNKsdwor3foxYGrkPTPxBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-busl-06
|
|
@@ -614,9 +611,6 @@ class WorkflowTracker:
|
|
|
614
611
|
- [OWASP Business Logic Security](https://owasp.org/www-community/vulnerabilities/Business_logic_vulnerability)
|
|
615
612
|
- [State Machine Security Patterns](https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html)
|
|
616
613
|
|
|
617
|
-
sha256: 58161926bdfa7c835cacd5c7d152a00108eeb7ebac9b11903d6f79c52d132421
|
|
618
|
-
signature: rRoAIAoV4g4gQfAvuj2EpIrkT13Yw0r5gL8IdMRp1orp9g6Ojff2KQc/I9NXNDxDUTefu7b6PP+rhzi7WBGUDA==
|
|
619
|
-
signed_by: cyberstrike-official
|
|
620
614
|
|
|
621
615
|
---
|
|
622
616
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-840]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 6a8c3e274631071a64a21fd3b96b762d841405516a479daa176d7b43817c94fe
|
|
15
|
-
signature: NHM73Uregz03hgOl9EvyQn2zuduKMZg/LpmzaTq3hBuuda1sG8MnGOpWaOrClpFk7qP39DE1YqF88mv/J93PDw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-busl-07
|
|
@@ -666,9 +663,6 @@ class BehaviorAnalyzer:
|
|
|
666
663
|
- [OWASP Blocking Brute Force](https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks)
|
|
667
664
|
- [OWASP Credential Stuffing Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html)
|
|
668
665
|
|
|
669
|
-
sha256: 13125b58998fcde9a469cae2d7861c24612223f975b068a5eade94d5d7985dc2
|
|
670
|
-
signature: /ngg0KdJskT+bLmh1EsLr6hX+bFQO+eriXtRCvYFVtKXRCNe5d94oHgnyULxEug+BB3M3XlDwTHWHRc9eC+hCQ==
|
|
671
|
-
signed_by: cyberstrike-official
|
|
672
666
|
|
|
673
667
|
---
|
|
674
668
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-840]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: fa06650ac3cd5271e5ddfb402ebc53fd7ba2e0587441f4b00b92f7d76881b7c1
|
|
15
|
-
signature: 7OL7irat8t2XJsqrDqMyP9irlCnqqyuY2I7Q9pLAv08ahoneN9iKWWK9Xzznb6RX6E/hxAPih3gDpwmTok4GBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-busl-08
|
|
@@ -620,9 +617,6 @@ location /uploads {
|
|
|
620
617
|
- [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)
|
|
621
618
|
- [PayloadsAllTheThings - Upload Insecure Files](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files)
|
|
622
619
|
|
|
623
|
-
sha256: b93ee7b8299472123c62d88472f01f8a00e6823366952508827d8d8d840ca457
|
|
624
|
-
signature: 43FqEj0tqjc6WrVMhgonlVWBtRZ+sC3mKQ81z4rNCvPDL48zUc+6Q+AfQaSDTa5ExzhjBncf8C2PpCOuvWf8Ag==
|
|
625
|
-
signed_by: cyberstrike-official
|
|
626
620
|
|
|
627
621
|
---
|
|
628
622
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-840]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 1fcad116b3700cefe2a853bae95504c8a756033235d8b49a4b84a75736d80f8d
|
|
15
|
-
signature: 7+gq82buG/l+EC7GSK6JihjYxU8O9V2hFqEY80anf2L4nmPn1H/XAtfORcELTPYVNwb3mm56ZI83LFBTJsCwBQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-busl-09
|
|
@@ -625,9 +622,6 @@ def add_security_headers(response):
|
|
|
625
622
|
- [EICAR Test File](https://www.eicar.org/download-anti-malware-testfile/)
|
|
626
623
|
- [OWASP XXE Prevention](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)
|
|
627
624
|
|
|
628
|
-
sha256: 55e058ec1915742af566077403160490dfd64f1c12f56111e68e668d0c4fecf8
|
|
629
|
-
signature: EKNnGyEHbEv9ORmV9uiRNlFNmIdVqaZCM9KCfCdkVuFJLOSNa3c3Y69nTz6W7mkJD0UpjA8A/CIK3UKmBeMWAw==
|
|
630
|
-
signed_by: cyberstrike-official
|
|
631
625
|
|
|
632
626
|
---
|
|
633
627
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 6cb4b1de060079bd8dbe71209306b7371ca355239d89e45febac549019bdb111
|
|
15
|
-
signature: +EYYo++Bzf9b8+A9PJdcoC8KmAgZVFZjFus4SImY8whlGPXrEU0nU7f8Q/m1kgNm+ut4KEzm/mhlWttRNwGFCA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-busl-10
|
|
@@ -771,9 +768,6 @@ class RefundProcessor:
|
|
|
771
768
|
- [OWASP E-Commerce Security](https://owasp.org/www-project-web-security-testing-guide/)
|
|
772
769
|
- [PCI DSS Requirements](https://www.pcisecuritystandards.org/)
|
|
773
770
|
|
|
774
|
-
sha256: fcb07abb574974c9a50d56bc48d7f1918ff821a0ef4265f753cfc53aa5ae47ad
|
|
775
|
-
signature: xI6DzMQlIPOWUfqPzP0dBXVInS6IQF/GTxJlSCY/Ry3RYuzJqOXsc735XPLwo0eRGqkBBqydPFUlWvwR/8htCw==
|
|
776
|
-
signed_by: cyberstrike-official
|
|
777
771
|
|
|
778
772
|
---
|
|
779
773
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-79]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 3afb09d2e3ea52100efe2023bd11989a9d764031863a8d73072578b01a8c0ad0
|
|
15
|
-
signature: k9Uk3S1xWgGBZM3GMEAlPBEhC5RfuirL2iBGwSlEjORZQ2+9IjlGZawnA6Khf1/f8bjRiskvGktHI5qbsSfYBw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-01
|
|
@@ -349,9 +346,6 @@ element.textContent = userInput // For text
|
|
|
349
346
|
| ---------- | ----------------------------------------------------------- |
|
|
350
347
|
| **CWE-79** | Improper Neutralization of Input During Web Page Generation |
|
|
351
348
|
|
|
352
|
-
sha256: 71388098b2858a07ba7316ea7882e14bced150a0f047b7f7f636c1b49cb014fa
|
|
353
|
-
signature: Q3VAB+9Oy5QXndggFOPDftV+xwSuHFJTwlYJx8jPB+Ce42isPiVd2vL11nk8QAfQ192aQwUoaqdQWmRTinafAw==
|
|
354
|
-
signed_by: cyberstrike-official
|
|
355
349
|
|
|
356
350
|
---
|
|
357
351
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 517a0bc395f84a76e7146465458daca77dd51b0f5ed30b7dc935caeedcd48084
|
|
15
|
-
signature: j5u70j+JnWr23xN+xmWgVf3Yj1sc+qz9WFR3UW8e3cWKgN4R5WtPPA/Yc8qjeJyjsmmuXJ4XvXt+Ia8e2ltfBw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-01.1
|
|
@@ -89,9 +86,6 @@ if (typeof console !== "undefined") {
|
|
|
89
86
|
| ------------------- | ---- | -------- |
|
|
90
87
|
| No self-XSS warning | 3.5 | Low |
|
|
91
88
|
|
|
92
|
-
sha256: 2b88f7ecbef302ee6c97767f34994aac624d0832ea3b18cb83071f2c9180abe1
|
|
93
|
-
signature: GHnbrM+UxEmWiI4/R1dvrKa6/FyN53T4jos1U4FSknmmR0kzfYwUdrmBxqaOCjvdNjifMEofHrarB32i8WdPAw==
|
|
94
|
-
signed_by: cyberstrike-official
|
|
95
89
|
|
|
96
90
|
---
|
|
97
91
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-79]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: c38c2e84d4bf38fdcddfd38c340e452658a2d458cc2ac3bae91cba06f6e44c4a
|
|
15
|
-
signature: PT6eCBWxrUFIX3RDeQupC2k22otnfJvp1qizVg9WqjD9ZrjrV/hvLKH9DCwXBlcNFDqsNKvV4URhYOjrd+O+Bw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-02
|
|
@@ -132,9 +129,6 @@ if (allowedFunctions[functionName]) {
|
|
|
132
129
|
| ---------- | ------------------------------------------------------------------- |
|
|
133
130
|
| **CWE-95** | Improper Neutralization of Directives in Dynamically Evaluated Code |
|
|
134
131
|
|
|
135
|
-
sha256: 3b36acef1c1a6b880e018ae92c06ccbda9403bdc0f82d633567ace5e0b3f8417
|
|
136
|
-
signature: ADL18j8oBvWMmWtFEph9D9RFumRsfcIUzSM/G6LMUYv+rgGosRsBvMnDSeVZgMSzv0j0VKiXAmoTXauKSWN5BA==
|
|
137
|
-
signed_by: cyberstrike-official
|
|
138
132
|
|
|
139
133
|
---
|
|
140
134
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-94]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: a6247cd3932589b280aa00b2b160e133756cf3642369a0ba3a1705fb92187f28
|
|
15
|
-
signature: vL3NtlwWIvhONxZlRsrfCRCpr33bqgixZuEOEOiM9w/j/XfL+So/B4FlQ0FctvBK1AVBsUqea+EJx4kIZFfIAA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-03
|
|
@@ -161,9 +158,6 @@ element.textContent = userInput // Safe
|
|
|
161
158
|
| ---------- | --------------------------------------------------- |
|
|
162
159
|
| **CWE-80** | Improper Neutralization of Script-Related HTML Tags |
|
|
163
160
|
|
|
164
|
-
sha256: 46be4dfcb4d5e216e1ed2d1198086a6ef7b552c0811b9fa7ebab8d269a717040
|
|
165
|
-
signature: s1dAO260fyw1dUHI7dc0R8OU9E/T7Evwo5GjHGLHbFIKx9Rs1UsJLdfLbTWg6A4NNhtzWeFXkz++l1/1Z5PfAg==
|
|
166
|
-
signed_by: cyberstrike-official
|
|
167
161
|
|
|
168
162
|
---
|
|
169
163
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-601]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 468f0bd18a759b8ab74f0475a1d9e8f320b3fc6ba585b11ebdcc978315016e69
|
|
15
|
-
signature: zlwSwBLxBEzcPLMruYCNqpPyVl3qDxbcttZSNCv76NXYU8uyjRveTYFOY7vbVXsFM3hh0ySHqMjsWI1IMasMCQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-04
|
|
@@ -154,9 +151,6 @@ function safeRedirect(url) {
|
|
|
154
151
|
| ----------- | --------------------------------- |
|
|
155
152
|
| **CWE-601** | URL Redirection to Untrusted Site |
|
|
156
153
|
|
|
157
|
-
sha256: 64316285eaaf83d7ec00e3f8cadae230b55f492742f5bc8148bc8651c44c8c07
|
|
158
|
-
signature: TCudeyh3QfsIhD28QdOPDgnKppaCoJJWKemdg7erSKJqJxlEIQP/GIV6LeyyfoWGZaWinhbrf/AUejVt7z+8CQ==
|
|
159
|
-
signed_by: cyberstrike-official
|
|
160
154
|
|
|
161
155
|
---
|
|
162
156
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-94]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 6d39d0c74b3106697c22fdbb1a65ed6430cf428c9b9e8854988424236e8626b7
|
|
15
|
-
signature: IgwHdviBflpId8obaqNT0dLifgqpTubEus4djhoDCxnpxY/TTqWOUiElP1ylC+utT+s6rGHt7XPdw15IuO21Cg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-05
|
|
@@ -154,9 +151,6 @@ def sanitize_css(property_name, value):
|
|
|
154
151
|
| ---------- | ----------------------------------------------------- |
|
|
155
152
|
| **CWE-74** | Improper Neutralization of Special Elements in Output |
|
|
156
153
|
|
|
157
|
-
sha256: 7734171eed6aecdcb48474b8472eb336ba78752bdd167118492fd643199ccb86
|
|
158
|
-
signature: bwEy6mTaZ5RNCT9XHyC+6qReeQv21SWIl7xhy/+1CuHcBcyTDxsODEg6DN3RnY55fwGrtt9TNel2OSBGMuVRAQ==
|
|
159
|
-
signed_by: cyberstrike-official
|
|
160
154
|
|
|
161
155
|
---
|
|
162
156
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-200]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 92292a3a42b64099890068668a0bb7d983d0fda03b2c36a843e085f23d6c8d6b
|
|
15
|
-
signature: 8vZlnrwtcMexWdnAetHWM5MZI+OaNqORX178xKvsABGangjZAwNPOUT8WQ5lsLLuKZ/9fWfYi4YabrN3ydkMAg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-06
|
|
@@ -152,9 +149,6 @@ function loadScript(url) {
|
|
|
152
149
|
| External script loading | 8.6 | High |
|
|
153
150
|
| JSONP callback manipulation | 6.1 | Medium |
|
|
154
151
|
|
|
155
|
-
sha256: 3bd18be3e3dca410757c4a247814976f2469d2fb528d5f219efa68508d87db5c
|
|
156
|
-
signature: cFV2e901aGxFZSxXlZ6toqsoEOK1hVn6tCWzj3Q/ur41UQG6NoafhQ4CwlUPfI+Go8+6joA2zWBEthtijA3tCg==
|
|
157
|
-
signed_by: cyberstrike-official
|
|
158
152
|
|
|
159
153
|
---
|
|
160
154
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-942]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: f12f44d3182bc5891f6635603223ba0d9bc6ec819ce8b095d9d05504ce34adaa
|
|
15
|
-
signature: I9h3pJcprLElZPPfEZKlz2QaIzKq413ZAnBA30tM7PJ2M1EyKvjFRvtlR+NanB/lkaR7ZgS1YJgImACTT3ymBg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-07
|
|
@@ -186,9 +183,6 @@ def add_cors_headers(response):
|
|
|
186
183
|
| ----------- | ----------------------------------------------------- |
|
|
187
184
|
| **CWE-942** | Permissive Cross-domain Policy with Untrusted Domains |
|
|
188
185
|
|
|
189
|
-
sha256: 4a6dc4a0e00aec84842fde9a2f2ee43a15feed9fcbd2cc2a3eaec42e34808455
|
|
190
|
-
signature: 90PcBZdleUw3i4EBHIpA2txEKaSZvjDjCNjwc1o16NlatK5yrBCidoHfkhPwN80s5D784nxFAfjoxVQ6tSS/Cw==
|
|
191
|
-
signed_by: cyberstrike-official
|
|
192
186
|
|
|
193
187
|
---
|
|
194
188
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-1021]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: efe02f927f16d4fe8a0e816f3015f605b9e1379c4d9a0924b66ea56e0ff7d477
|
|
15
|
-
signature: bGWcflGWJSi9M7BCOJfF52fzf9kMSvbOR/GvBo+o0Px6swajC6Ec8SdaQ+PxFjpQGo9R7QLexfarLkOVXWxtBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-08
|
|
@@ -103,9 +100,6 @@ done
|
|
|
103
100
|
| Wildcard crossdomain.xml | 5.3 | Medium |
|
|
104
101
|
| XSF vulnerability | 6.1 | Medium |
|
|
105
102
|
|
|
106
|
-
sha256: 0549aa04ba90c7bbdb8dc0303bdef995da74f9a602312d31432327357bcd8365
|
|
107
|
-
signature: 2zZ65IR6e7YW2ZA3R/CXddw544sRz5y3QJdHJ8W62nfOhr1VI8wSTDkiGIwhR0fmUKLJOZJdXEqqZ1X84rSTDg==
|
|
108
|
-
signed_by: cyberstrike-official
|
|
109
103
|
|
|
110
104
|
---
|
|
111
105
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-922]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 995c36d60feaa854d9075a318bbbcd684a472cca98a2e12dd02385c2371227e5
|
|
15
|
-
signature: Fu/1PGr+ZtTgcqovpbhkKGriQ8TNsO7MYZVIhKkuXwFAz1AT/F/tcuEJ2IaqqGq1kj6SUPk9IWjaWHJlLkvsDA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-09
|
|
@@ -220,9 +217,6 @@ add_header Content-Security-Policy "frame-ancestors 'self'" always;
|
|
|
220
217
|
| ------------ | ------------------------------------------ |
|
|
221
218
|
| **CWE-1021** | Improper Restriction of Rendered UI Layers |
|
|
222
219
|
|
|
223
|
-
sha256: b768d13ee5dc5b3ed01ea08fda44578a628d1a30e185e4e168564518fda7d119
|
|
224
|
-
signature: ElX/iB97Gmnl6uuneTXQyJ4TPU4QQqZMb7xJm3KWqw71U4Q4N4lc0dsjlqZukQgetEkbOOV1rrBBp1YQSTSRBw==
|
|
225
|
-
signed_by: cyberstrike-official
|
|
226
220
|
|
|
227
221
|
---
|
|
228
222
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-200]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: a8fece499c32570df8b329c14f51f5a2fc51e351bba6a03123067a17ebf296e9
|
|
15
|
-
signature: zi7kqY0MzXludjqYorDddOB6gXirAyzGXYLcO0gH3ZEAXr38/gs9QHy5SOXMsQIglojTiIHnfw3v8imDUvizAQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-10
|
|
@@ -217,9 +214,6 @@ async def websocket_handler(ws):
|
|
|
217
214
|
| ------------ | --------------------------------------- |
|
|
218
215
|
| **CWE-1385** | Missing Origin Validation in WebSockets |
|
|
219
216
|
|
|
220
|
-
sha256: 87d2e7f7f61b00e878c4f725336cbc2dded880e08d734817da911680b2a906ca
|
|
221
|
-
signature: 4B7Z6pzi4vqhW4hfwYlgccBeuyjjl+FZkpr8NAoMLfvLzagr4L86tIYK73MwabYVhTvYemwuSAvsLF4UoP64BQ==
|
|
222
|
-
signed_by: cyberstrike-official
|
|
223
217
|
|
|
224
218
|
---
|
|
225
219
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-79]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 4a41b55e25ef6b0bf36964577979428a78187575c99ede1bd47d0bfc97bf9501
|
|
15
|
-
signature: F+TD/C5jRWKipU1Pvl1aPVgQLflquUqbi6t+gT+w5iGrSaCTePTH7xX2W57xJxcv2C6BRWfMGTyX4qHECeYkBw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-11
|
|
@@ -406,9 +403,6 @@ function processMessage(data) {
|
|
|
406
403
|
- [MDN - Window.postMessage()](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage)
|
|
407
404
|
- [HTML5 Security Cheatsheet](https://html5sec.org/)
|
|
408
405
|
|
|
409
|
-
sha256: 085a4c43e5d8a6ca7b5f263b006091197d181f24268769d6ba30fe905d55fd36
|
|
410
|
-
signature: aRGsUDTGZ0MXGUTzLp+du6ue7t4HrCDKGvh+cTIZe4Le0BJCuA3hTJrMZbsSOuoSCz8Bmu0IlcQqQgBMYLiYCQ==
|
|
411
|
-
signed_by: cyberstrike-official
|
|
412
406
|
|
|
413
407
|
---
|
|
414
408
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-79]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: a8b1eb93546c7fb29cd8cb3a0b47ba40d5f94aa76f105c769fa1d5ff309a4038
|
|
15
|
-
signature: vfQ/I/EPCklnpFv5NINL98+AU1oCSpG6JESAW5n8UfK8ud/auS7gYXhmUm5oWsvpqmrt3CFp9ojmCcleqGfyAw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-12
|
|
@@ -517,9 +514,6 @@ function secureLogout() {
|
|
|
517
514
|
- [MDN - Web Storage API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API)
|
|
518
515
|
- [MDN - IndexedDB API](https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API)
|
|
519
516
|
|
|
520
|
-
sha256: 9e50aac778c03e7e456a2458048780892ba1dfa25aa7dedb1df5654fae041fd6
|
|
521
|
-
signature: fVvRhMy/MWCC0U7RRuBIBfR32j1atdL4b6c8rU3nVqkCCjRlbBnQyQrmM23cpNfdBJK84a9cT0chDFVLBJNqDA==
|
|
522
|
-
signed_by: cyberstrike-official
|
|
523
517
|
|
|
524
518
|
---
|
|
525
519
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-942]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 38bf5c67ea12895a72f1e28c0dcd354ddf927e7d7bd3cb2bf60d71a12e5e7919
|
|
15
|
-
signature: RCT6a3+XLg8lGPC4yTWA3Q6Ub4Usz/qphE28HA1J+cGkbpbpSuWw+oe7SH2Wx2OQ38B+5dMTl9C01zSP8LQ3BQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-13
|
|
@@ -473,9 +470,6 @@ async function fetchSecure(url) {
|
|
|
473
470
|
- [Google - JSON Hijacking](https://security.googleblog.com/)
|
|
474
471
|
- [Sebastian Lekies - XSSI Research](https://www.mbsd.jp/Whitepaper/xssi.pdf)
|
|
475
472
|
|
|
476
|
-
sha256: 2529f6d6410eaae5f39789b09bc45a5869283bd1b59ef1a23e55529674f8540c
|
|
477
|
-
signature: Z5b7UQvg3XHXZDaAbUmtsGsYXkinj/tpwKnC4IPiLcBH2fyAlXS26MmBmX9VSCNU9O+G/GKU9uSMTtndEpTAAA==
|
|
478
|
-
signed_by: cyberstrike-official
|
|
479
473
|
|
|
480
474
|
---
|
|
481
475
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: fd555cb01c7c52ce857040f7c2ee1655e61a1339cc319c515f9fd354a820d2d6
|
|
15
|
-
signature: nAh3cpaIHfAh5EI2Bnpfq43nDPTZ/o5WNtSSVQ3FeulztkPiypx5f2vy4NkEKxNKdMwBmecLxSxAk8khszYPBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-clnt-14
|
|
@@ -490,9 +487,6 @@ document.addEventListener("DOMContentLoaded", function () {
|
|
|
490
487
|
- [MDN - Link types: noopener](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/noopener)
|
|
491
488
|
- [Mathias Bynens - Reverse Tabnabbing](https://mathiasbynens.github.io/rel-noopener/)
|
|
492
489
|
|
|
493
|
-
sha256: 9256c0147e2ebc69fdd3c397d67cc2f062e81bb44933f209a7dcee74fb06a3c6
|
|
494
|
-
signature: DywhkmUKBuyS5DTwCTa9QT9nfjBFFUyj1Q2oPKHQlIOaOSDGVrrvNao3VHpjvp2JEUaZAQG13TLg9XsqNU8sBA==
|
|
495
|
-
signed_by: cyberstrike-official
|
|
496
490
|
|
|
497
491
|
---
|
|
498
492
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-16]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: b476973ea88c36f8be486243f7e24481006e7c2ff5bc6d244a9253e697448271
|
|
15
|
-
signature: /rg203RVfBCe8XV9OX+gN/cg0ZxfGSjXDU4oU/HpK7T3cjnaTgKk9BMCeuXgmSsi2T4dET2VH5xwiK5lTHJ7Dg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-01
|
|
@@ -330,9 +327,6 @@ Variable based on findings. Common scenarios:
|
|
|
330
327
|
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
|
|
331
328
|
- [NIST Checklist Program](https://nvd.nist.gov/ncp/repository)
|
|
332
329
|
|
|
333
|
-
sha256: 0cd6fd9d10da14ad8cd8bb030969f94549277d74ad86f4004fb66bc9cc6f375d
|
|
334
|
-
signature: tRrNKbgcqf3ATj9Fpf+lYo/6vN+kgn2u8u7fbUkV94tqx/aEYEDJXYMT8hXlKh5paTwr9s/lfScEkkuz3iwxAw==
|
|
335
|
-
signed_by: cyberstrike-official
|
|
336
330
|
|
|
337
331
|
---
|
|
338
332
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-16]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 4e8e8c220efd971106b3065448f9540ceeeb30a0cdae701c5b5ce0d12ef430b1
|
|
15
|
-
signature: n5IEbY6jMCT9knDJv/TQiJ6BAEFEywxgqAs4xPChlWgKwJveEbKNQaVJj3HtfuAcmyo8E3DmDuWTRHBWTMIgAg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-02
|
|
@@ -447,9 +444,6 @@ CustomLog logs/access.log combined env=!dontlog
|
|
|
447
444
|
- [OWASP WSTG - Test Application Platform Configuration](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/02-Test_Application_Platform_Configuration)
|
|
448
445
|
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
|
|
449
446
|
|
|
450
|
-
sha256: 50b6f93f7b609117a758afb882519c687bcfc3bd97e99918b5ed3cad8eb68092
|
|
451
|
-
signature: qxpu6gFcRW9sUYlsrqSxjZEOagAN3q/uY13PHdg1zmdXMqTONyM5PEJ5xa2kTyRzEloXvmhIq+x1grsR7OnIDQ==
|
|
452
|
-
signed_by: cyberstrike-official
|
|
453
447
|
|
|
454
448
|
---
|
|
455
449
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-200]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: b54440e49e8386eac3e9781ca700a6dc84452983f9c1930f3cccca5f91ee773d
|
|
15
|
-
signature: hEO1Hc68eY8WNg3fDsL9oEPYYir6Ta/jbV39h+mYnIiklU+FXGetgUETht7kZLjrTQhxGUqawXZQ6m6gzW2rDA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-03
|
|
@@ -456,9 +453,6 @@ find /var/www/html -name "*.swp" -delete
|
|
|
456
453
|
- [OWASP WSTG - Test File Extensions Handling](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/03-Test_File_Extensions_Handling_for_Sensitive_Information)
|
|
457
454
|
- [Git Dumper](https://github.com/arthaud/git-dumper)
|
|
458
455
|
|
|
459
|
-
sha256: 0771669cd507b21573b225769cf58acf153b7efbabec8bb0948e4581ef27602c
|
|
460
|
-
signature: pXEEZIt7KnqXZ2/VQXaWCcN/29pKFmACoCoN7N9dr1ymdTi3S0+z81XReYmUKlI5h0wNss5QGBupqv5UjQeDDQ==
|
|
461
|
-
signed_by: cyberstrike-official
|
|
462
456
|
|
|
463
457
|
---
|
|
464
458
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-16]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 4d9c2f7eccf545348056021128663ffb4ce563061e64eb36dc4348e7037f3ed0
|
|
15
|
-
signature: lIOHNUw3zPL8Cln8EL5BszmRsB5GcJbgtczNiAYZg0wgCJ4YiNqFeJYDA8XGJm900H9iGp4tQlJZ+5jFP8NXDw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-04
|
|
@@ -393,9 +390,6 @@ location ~* \.(bak|backup|old|orig|save|swp|tmp|sql|tar|gz|zip|rar)$ {
|
|
|
393
390
|
- [OWASP WSTG - Review Old Backup and Unreferenced Files](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/04-Review_Old_Backup_and_Unreferenced_Files_for_Sensitive_Information)
|
|
394
391
|
- [SecLists Backup Filenames](https://github.com/danielmiessler/SecLists)
|
|
395
392
|
|
|
396
|
-
sha256: 18c354b8bf143f5d844d9e6dd2bda7db82203c5ae86fadd64d8b0af428d0bcb3
|
|
397
|
-
signature: 5YOEROzU4XT2ikNuSnXfkP1kQwYhNhnEdB7+r/96bImbI6AhrS4kzhdYllsrN+YP64hVKQ7kinUNG4kDL0eMBg==
|
|
398
|
-
signed_by: cyberstrike-official
|
|
399
393
|
|
|
400
394
|
---
|
|
401
395
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-548]
|
|
|
11
11
|
chains_with: [wstg-inpv-05, wstg-inpv-09, wstg-info-06]
|
|
12
12
|
prerequisites: [wstg-info-01]
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 1ad35b73fc619458603bd7c7583a50781414bb768be4fac761cffe63688fb226
|
|
15
|
-
signature: t0NmmZDuZVp0IG3GJLuE8CgY+3N8EJlAgU3z6cXl0h34sDm3Kt1od/wn21QFTuB2yStjUW4HZO3a5HE4szNWAg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-05
|
|
@@ -372,9 +369,6 @@ location /admin {
|
|
|
372
369
|
- [OWASP WSTG - Enumerate Admin Interfaces](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/05-Enumerate_Infrastructure_and_Application_Admin_Interfaces)
|
|
373
370
|
- [SecLists Admin Paths](https://github.com/danielmiessler/SecLists)
|
|
374
371
|
|
|
375
|
-
sha256: 4d580d3353a8d5788bca91ff452950cb99d0cbd7661f6236c9a2f33f33eddefb
|
|
376
|
-
signature: KqRjtvE5Ev6hVtxq9G8Q30SbYkAzZu4pap35TUwYYEW1R0ixActRVD2v2Uz+my5WY5iax6G29/BtDkF2iYcACQ==
|
|
377
|
-
signed_by: cyberstrike-official
|
|
378
372
|
|
|
379
373
|
---
|
|
380
374
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-200]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: b7c24b41c1ec21950a3b186dbe8797783a531979d4668f94c5e592b587cbe5d0
|
|
15
|
-
signature: F1CcMIRQHyK3Sbo4FS35Gp8iA2XYxRuOE7ldbKHoGxEsa6CwcC63GsEuV5RqANTC+P+qM+XzIsaeMU6zw0eHCA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-06
|
|
@@ -444,9 +441,6 @@ def resource():
|
|
|
444
441
|
- [OWASP WSTG - Test HTTP Methods](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods)
|
|
445
442
|
- [RFC 7231 - HTTP/1.1 Semantics](https://tools.ietf.org/html/rfc7231)
|
|
446
443
|
|
|
447
|
-
sha256: 452328bad9036818b4d67026db2849e5443f90a4d9c754a72b0f5ee56abc8a5a
|
|
448
|
-
signature: veFdV9nb33zI8d10SkOQMHa6G2txEycEAbZCeq2l7ixZTeZI/0jHF4rfvZrUf4krHKQCg4PJJVg0XY541PYfCg==
|
|
449
|
-
signed_by: cyberstrike-official
|
|
450
444
|
|
|
451
445
|
---
|
|
452
446
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-200]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 55eaad5c83511279403822e362475634cfdc4960503191ac245f9e55ee6b6456
|
|
15
|
-
signature: QTSNLgsdH9LBrZcWAmVKDIp+vEDQ4fDNEWrOds9XUF5EMAsbG46JrWRVWi//tINNWR6A/5ZSsfZqY6i9Kxg/CA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-07
|
|
@@ -320,9 +317,6 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; prelo
|
|
|
320
317
|
- [RFC 6797 - HSTS](https://tools.ietf.org/html/rfc6797)
|
|
321
318
|
- [HSTS Preload List](https://hstspreload.org/)
|
|
322
319
|
|
|
323
|
-
sha256: 2475e20bd344a72c40eb415125e59d9956e1c78c69d60204de136ad3413b3f22
|
|
324
|
-
signature: GnC+JhxZcYbwjzu6he/1vFvlMHIVGgBcfMdT1869x086PdrJZP27sVRvFS/lQUgAtrSaTVsQ26ZIY4oNDp+zDQ==
|
|
325
|
-
signed_by: cyberstrike-official
|
|
326
320
|
|
|
327
321
|
---
|
|
328
322
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-16]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: c4513b72dbda6b5ee9eb5920a1dc39f802e93bcc347d020b6e61e1a53ecf09ee
|
|
15
|
-
signature: feAhP/7CLZ3MhLg9flKf2DqtxiGRY/l0DNIzIjczw+/peW6lYyVlkAjqw/DWjz7nyHotApDlEm9DP+GEcY7CBQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-08
|
|
@@ -195,9 +192,6 @@ Access-Control-Allow-Headers: Content-Type
|
|
|
195
192
|
- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
|
|
196
193
|
- For modern cross-origin testing, see: **WSTG-CLNT-07: Test Cross Origin Resource Sharing (CORS)**
|
|
197
194
|
|
|
198
|
-
sha256: d2be051666b7056cc4541beccb657269a17c63e349e588df31c733c96bde37f2
|
|
199
|
-
signature: RbVROwnrt00DslFACj/z4ik8PeO3dgxw33Pl/AanmysAJJUCf3A2RL2y1AT+nhhrlCdB2bJKWARaL7LJlwKkDw==
|
|
200
|
-
signed_by: cyberstrike-official
|
|
201
195
|
|
|
202
196
|
---
|
|
203
197
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-434]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 372d1810272f5c4a36bb666be9725c743ce089c421084e9df010c73a5ab0c817
|
|
15
|
-
signature: Gti8G358DqZkmH15HCB5slaQOrSkZU8tYCdL9n0cacxumNOyIyi1x/pPxm9OFmp3VN9n2dZ8y0/t1rpMYOfCCw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-09
|
|
@@ -334,9 +331,6 @@ chown root:adm /var/log/apache2/*
|
|
|
334
331
|
- [OWASP WSTG - Test File Permission](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/09-Test_File_Permission)
|
|
335
332
|
- [Linux File Permissions](https://wiki.archlinux.org/title/File_permissions_and_attributes)
|
|
336
333
|
|
|
337
|
-
sha256: 717d372f4a4371dc43b1106418ddf799124a830325eb03ea0bae420375d6ae8b
|
|
338
|
-
signature: HxUt63imht612y1j8VWOW6gfzBAgTv+fB/bxHCUose2kkSsBuUP/h34AwX93EihbVm2Dc1qfIfNVpUyLedFiDw==
|
|
339
|
-
signed_by: cyberstrike-official
|
|
340
334
|
|
|
341
335
|
---
|
|
342
336
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-16]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 3f2d16f87e8db91076e011cd00a1dc01af3d38c68e3b730509de9894e4816b83
|
|
15
|
-
signature: OEN+3970U42/AfYf10x4VXACOdNdFH+5H7jDa/pSmzISGSNmbWIS7/dCrGcla24GUpcaEdThW5yrV0zrLlh7CQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-10
|
|
@@ -374,9 +371,6 @@ nuclei -l subdomains.txt -t http/takeovers/aws-bucket-takeover.yaml
|
|
|
374
371
|
- [Subjack](https://github.com/haccer/subjack)
|
|
375
372
|
- [OWASP Amass](https://github.com/owasp-amass/amass)
|
|
376
373
|
|
|
377
|
-
sha256: 807da040f4cc6699b6da68da4fd92ed0b5d2b2bcd60bed1e61ebef41815aed2d
|
|
378
|
-
signature: MZdL+Jo2wOgXETNLqB5wNvQ5WC98zqYHtXYEX61+sAa8gyEImrLPYN3WmMJ57e4s7luvWISghrA/lhnEZH/GDA==
|
|
379
|
-
signed_by: cyberstrike-official
|
|
380
374
|
|
|
381
375
|
---
|
|
382
376
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-16]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: bdc3b83f580e2115c0069b1372d67f92eca84437b17b8000a5fba72abc6093db
|
|
15
|
-
signature: dSPXCSiMMSqzkdW9PVRrGJ1Hgb5pO81eQoC2JCboJW3GiryG9p0Sa3lpzmkI3wt4lJLPVnvk5+nOfF5ERFSBBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-conf-11
|
|
@@ -419,9 +416,6 @@ gsutil uniformbucketlevelaccess set on gs://bucket-name
|
|
|
419
416
|
- [AWS S3 Security Best Practices](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)
|
|
420
417
|
- [Grayhat Warfare - Open S3 Buckets](https://buckets.grayhatwarfare.com/)
|
|
421
418
|
|
|
422
|
-
sha256: e9b5c17e9c7ab9cdd4baf55e063dc02eb1dbf890e854d23f7bc3abf8ee5544bc
|
|
423
|
-
signature: 6M3DL+lhyr+gqxSfOBowiUXI/jKCPoIYo42U6qS5bZVGQZJ5ClNqNisRkAHVOGvYwgjzZA5PCxoQmiqh4rT9DQ==
|
|
424
|
-
signed_by: cyberstrike-official
|
|
425
419
|
|
|
426
420
|
---
|
|
427
421
|
|