@cyberstrike-io/cyberstrike 1.1.10 → 1.1.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -7
- package/package.json +2 -2
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-00/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-apit-99/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-athn-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-auth-session/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-05.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-authz-05.2/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-busl-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-01.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-12/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-13/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-clnt-14/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-12/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-conf-13/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-cryp-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-errh-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-errh-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-idnt-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-info-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-injection/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.2/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.3/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.4/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.5/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.6/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.7/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-05.8/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-11/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-11.1/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-12/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-13/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-14/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-15/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-16/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-17/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-18/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-19/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-inpv-20/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-logic-client-api/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-recon-config/SKILL.md +0 -3
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-01/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-02/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-03/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-04/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-05/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-06/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-07/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-08/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-09/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-10/SKILL.md +0 -6
- package/skill/WEB/OWASP_WSTG_4.2/wstg-sess-11/SKILL.md +0 -6
- package/skill/ad-security/SKILL.md +0 -3
- package/skill/bun-file-io/SKILL.md +0 -3
- package/skill/kerberos-attacks/SKILL.md +0 -3
- package/skill/recon-methodology/SKILL.md +0 -3
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 9616a8a75d0f18aa1de5273deb5ebd74cc44aac2b4e9cf4bd599e1d5565f56ca
|
|
15
|
-
signature: JmFG6rMfCd1jUq6SA5l1d+HDiqJrUx+qSmdmFa2jTksoiUIzQiolUzQfDExPDJnATpNsFpSJp+al89tOfhoFBQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-05.4
|
|
@@ -385,9 +382,6 @@ pool.query("SELECT * FROM users WHERE id = $1", [userId])
|
|
|
385
382
|
| ---------- | ------------- |
|
|
386
383
|
| **CWE-89** | SQL Injection |
|
|
387
384
|
|
|
388
|
-
sha256: f1290a31c7be678a9ecf04a90276f0c882aef0b5e4ba87eb3499b3f92ba2427b
|
|
389
|
-
signature: dYRaVd6jS83nDsvXPC4nbIazLn16r4FRCG1u0Q7WMoufvwKk2yqgCecxWozZp1t/xZnhtAJmC+WzPEU6gWcXBA==
|
|
390
|
-
signed_by: cyberstrike-official
|
|
391
385
|
|
|
392
386
|
---
|
|
393
387
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: faa8ab41cf52f6002a2e35f2b66b387f50f4b09bf14bb26c932ae10767dff7ac
|
|
15
|
-
signature: l3Cu7V8iCOf48UnCVuuuIfcqlAYYuoVxl6wV7YZS7vPK8MhuP0oenvHf64oWbPhMxqoNAxUQ955j6i2lxHDkBw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-05.5
|
|
@@ -236,9 +233,6 @@ Set rs = cmd.Execute()
|
|
|
236
233
|
| ---------- | ------------- |
|
|
237
234
|
| **CWE-89** | SQL Injection |
|
|
238
235
|
|
|
239
|
-
sha256: 9cabd889c9532dff23b9c5a19f82a32a27b4591cc3ad02e9111f69eb7406b1ec
|
|
240
|
-
signature: uMXqKXuNCRVD0VlftOAL3HqaR8kcFW1t2EITHw21rUtZQvZkYaDLmm3j9rESYy12q38lo4njTE3OEAUYGV7tBQ==
|
|
241
|
-
signed_by: cyberstrike-official
|
|
242
236
|
|
|
243
237
|
---
|
|
244
238
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 3a53e5891dc451e5454e79d651accef372d4f74b81ca7e73a3b7ec2155184700
|
|
15
|
-
signature: 9XdYWDQL/ZNLsIOoc8pB8aKBC3Ji8Os19w31wXRqdIxaQsbrjSXFSj/jN08rHqMzpeE+bzHpTdwiZDhujhJFBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-05.6
|
|
@@ -448,9 +445,6 @@ def sanitize_input(data):
|
|
|
448
445
|
- [MongoDB Security](https://docs.mongodb.com/manual/security/)
|
|
449
446
|
- [PayloadsAllTheThings - NoSQL](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection)
|
|
450
447
|
|
|
451
|
-
sha256: 6618bc5711907596ead2a2a3faac3646c14145d6796fd8fe34d481653ae4eac3
|
|
452
|
-
signature: yah1PKBTe62jRW8azTP1N+wQ6Kv8bosXI+V27mJFSVor4VM5yb3QevEfon2nEpw4c45zMkUDsNEppODvKEyLDg==
|
|
453
|
-
signed_by: cyberstrike-official
|
|
454
448
|
|
|
455
449
|
---
|
|
456
450
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 273bfb5603799316503e127e4441fc9a5a3352967809e8511066e305cd493d36
|
|
15
|
-
signature: jM4yMd+38wqVT8SmrMgG5o6lfm3/779KZU3yC0hzXdW7UbTGR7nMnkTFsTLEkxgs+wliyBoYYc6Sc0dIHWnjBg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-05.7
|
|
@@ -381,9 +378,6 @@ cq.select(root).where(cb.equal(root.get("name"), name));
|
|
|
381
378
|
| **CWE-89** | SQL Injection |
|
|
382
379
|
| **CWE-943** | Improper Neutralization in Data Query Logic |
|
|
383
380
|
|
|
384
|
-
sha256: 8715848076407ee2506593441296ca68885980bfa22af6fed26c1adf9be68c0f
|
|
385
|
-
signature: JkXfD4d0LuNWDDbQ7wTyF6+ZimlphrjgAEt87U+HNOQsUnB94FwnlDxXvBGVBHkiQPi9Im6n7BJHsJfsJdn7AA==
|
|
386
|
-
signed_by: cyberstrike-official
|
|
387
381
|
|
|
388
382
|
---
|
|
389
383
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: b9a1640396efbff9ea289b5f87be2ab21537489211b41ec8647dbdc415a421c2
|
|
15
|
-
signature: QmaK56hkvoV6wEex4npEjkc28Nc5X4SlKgAR1H4lc6GkZYevpolXN/KezFHLs2F8IwNDyZN1ExreK3PVmPmxDw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-05.8
|
|
@@ -364,9 +361,6 @@ function sanitizeForLocalSQL(input) {
|
|
|
364
361
|
| ---------- | ------------- |
|
|
365
362
|
| **CWE-89** | SQL Injection |
|
|
366
363
|
|
|
367
|
-
sha256: 7df292015d1a63be8f60ef5bfcb65517f48c35e4e1901cbba6969736b7c4fe2e
|
|
368
|
-
signature: H19an5cbrCMc82fiKtxDXaAMgCtisfc+fhTS4xJOio9RhI7Tkj0IJhaWHz3Fg8BPBiFcEqWOyHRSr8Y6HkZtDg==
|
|
369
|
-
signed_by: cyberstrike-official
|
|
370
364
|
|
|
371
365
|
---
|
|
372
366
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-90]
|
|
|
11
11
|
chains_with: [wstg-athn-05, wstg-authz-02]
|
|
12
12
|
prerequisites: [wstg-info-06]
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: b8ac60cee963064af21d03b5dbc38e47f9f962b665619123355591cb7b91a37a
|
|
15
|
-
signature: eKOJsJfhOTTbRqHq4JJiXfSxeQEvOmSWzqo9mDM3nJfMidAwfALynK3T6VfSWeSJKG7ZGYCE/TWya8imN36mBQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-06
|
|
@@ -423,9 +420,6 @@ $filter = "(&(uid=$safe_username)(objectClass=user))";
|
|
|
423
420
|
- [OWASP LDAP Injection](https://owasp.org/www-community/attacks/LDAP_Injection)
|
|
424
421
|
- [OWASP LDAP Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html)
|
|
425
422
|
|
|
426
|
-
sha256: 1c9db46f208c396216c0b99c33b8b6634a8f5a3859f34e8b6186eda1b672fc22
|
|
427
|
-
signature: ILB9DAZKM2VurS9BRO4aSsgLsljMMmygpTt2eGxQI+JsyybhJZ8ygfgAlYXM9eIUzECHSaukkDDtXmF3fto5Cg==
|
|
428
|
-
signed_by: cyberstrike-official
|
|
429
423
|
|
|
430
424
|
---
|
|
431
425
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-91]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: a3800e1f0f47e8fc042a9888b1988180464c38a49e335a2a8a92e676b19acbc7
|
|
15
|
-
signature: mQLJEXUyJI9RUsIU9cxRSYpGk07KGl+yt5UJrjxDRKutV+1Vq+c/yUerxoH+IToqNnkAlvf6eS5xWYUBkx83BQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-07
|
|
@@ -447,9 +444,6 @@ $dom->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
|
|
|
447
444
|
| **CWE-611** | Improper Restriction of XML External Entity Reference |
|
|
448
445
|
| **CWE-91** | XML Injection |
|
|
449
446
|
|
|
450
|
-
sha256: b8c0a23148deaef682d4d9d2c4bf41b80607b4633ba5ba59b59a369a8f7a7e0a
|
|
451
|
-
signature: tOtzS1BWLM/TJb/LQYJnyDw8uy6podICJtZ1LNc8EIVVtBeTSAQUdI9Ph5DqcB4/oiBEVc4y2L19MTaKSFEMBA==
|
|
452
|
-
signed_by: cyberstrike-official
|
|
453
447
|
|
|
454
448
|
---
|
|
455
449
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-90]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: fe2cfdd8c9668874f9e64d7b6d88113159458fe089269309415323b776129b73
|
|
15
|
-
signature: XSUn48hoR2kjsN1Euy6RTbRHHRa5I+oVxvF9aJcoHc+O09+BlKER4UxtCnTx+Ly7FMaxqkOYDdchwjo2Ko2MCQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-08
|
|
@@ -335,9 +332,6 @@ ssi_types text/html;
|
|
|
335
332
|
| ---------- | ----------------------------------------------------- |
|
|
336
333
|
| **CWE-97** | Improper Neutralization of Server-Side Includes (SSI) |
|
|
337
334
|
|
|
338
|
-
sha256: edcc23088c21c25a0d6f604a7e52db8e92c7d327edad7e7fc372a68f1f01ec23
|
|
339
|
-
signature: c8X6N0GVd6zHaeR5gOjtN+d4jEjGQww18rlwb+/+QRjcqryj57egUJXDuutZxre0Ke2pes9nyAgGN9NiC4OOBg==
|
|
340
|
-
signed_by: cyberstrike-official
|
|
341
335
|
|
|
342
336
|
---
|
|
343
337
|
|
|
@@ -12,9 +12,6 @@ chains_with: [wstg-inpv-05, wstg-conf-05]
|
|
|
12
12
|
prerequisites: [wstg-info-01, wstg-info-06]
|
|
13
13
|
severity_boost:
|
|
14
14
|
wstg-inpv-05: "Command Injection + SQLi = Full System Compromise (Critical)"
|
|
15
|
-
sha256: ede40c8930a915c0b1a368ec3dc3b29e1e5772156fcddd50edb17c2ecd9eddbb
|
|
16
|
-
signature: V8WlolwXQioYNkI/fzmJhqkaZcjfHSRHCo3HAz6eJTC+ar3uhVb84gqkc8HoCfcw+BQgJREsXE3oaA2uEeeSAQ==
|
|
17
|
-
signed_by: cyberstrike-official
|
|
18
15
|
---
|
|
19
16
|
|
|
20
17
|
# wstg-inpv-09
|
|
@@ -374,9 +371,6 @@ $xpath = "//user[username='$username']";
|
|
|
374
371
|
| ----------- | -------------------------------------------------------- |
|
|
375
372
|
| **CWE-643** | Improper Neutralization of Data within XPath Expressions |
|
|
376
373
|
|
|
377
|
-
sha256: 10a218105e9a860dfe5687261e54e8e53a39a99f5347ca2c576a0db5a3ca0e42
|
|
378
|
-
signature: YfIXH7OiTn3PlD+WvKXPLRhpoeapjLE3/+bsLXWMEojralo0MeyC/H/6sp0EBVtzE3Rqvs0Yjuuw5eFozfB4Dg==
|
|
379
|
-
signed_by: cyberstrike-official
|
|
380
374
|
|
|
381
375
|
---
|
|
382
376
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-601]
|
|
|
11
11
|
chains_with: [wstg-inpv-02, wstg-sess-05]
|
|
12
12
|
prerequisites: [wstg-info-01]
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 031586d2c4b36053ca0638f3b0321f08be948642cc3be60a5b665e0b330d673f
|
|
15
|
-
signature: bHS79y4RpSodQRUGZgFgqNzbMRn/chlLiKON2DbHXExsarTcK5D/nD21Q4546+PTFUnieSel8aZdH1OSL0ZbAQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-10
|
|
@@ -398,9 +395,6 @@ $headers .= "Reply-To: " . sanitize_email_header($email) . "\r\n";
|
|
|
398
395
|
| **CWE-93** | Improper Neutralization of CRLF Sequences |
|
|
399
396
|
| **CWE-88** | Improper Neutralization of Argument Delimiters in a Command |
|
|
400
397
|
|
|
401
|
-
sha256: 4317939de3b32f71a344fff4d56c7bad62302a584a99af31a641f6756af08771
|
|
402
|
-
signature: orVlPvHv9yMSli+cghDBIgvo5DPEh+We3Gc7MgUpfd9Y/Hw6g/1TjryAmH2tu3+oiM4N7feuW4EIW76lbxPfBA==
|
|
403
|
-
signed_by: cyberstrike-official
|
|
404
398
|
|
|
405
399
|
---
|
|
406
400
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-94, CWE-95]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: e42a3b36dc54c6e3af7ec6cbdbf22ec811a0431e18c4f3b134f8a4b07eb5c1cc
|
|
15
|
-
signature: CBjInp/LJPOx1m4ERCim+79Sni7Nh612czwgVZ3vssNX50VabYozlzKMQeVCGsbTqQetqeXnQ8a6uY4z31MZCg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-11
|
|
@@ -444,9 +441,6 @@ const result = vm.run(userInput)
|
|
|
444
441
|
| ---------- | -------------------------------------- |
|
|
445
442
|
| **CWE-94** | Improper Control of Generation of Code |
|
|
446
443
|
|
|
447
|
-
sha256: c5b2498b9d2a0fe1df55124540df08d74dd8ae2f6672198d033ecb9c880e8a5e
|
|
448
|
-
signature: WNv1M0ez0uKWhAs84dLfwvgGInreaYjrXK6tLWnJxVfMOj3wBT6Pyj54hzKEaghkjlZyjJ6O/2EdKnyz217wCQ==
|
|
449
|
-
signed_by: cyberstrike-official
|
|
450
444
|
|
|
451
445
|
---
|
|
452
446
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: ea39592f13a31440d1cccb5807807f77c43e0318ba3ae3f5279176702fc99f02
|
|
15
|
-
signature: J5+1CY00ntHXXNGj1mKq8Ibv3Jo8N13sWbaSrDAZk6YVumzDjLUmG1gC2DPW+ItoFcQha1wEeS2Z/1Ka5zb4Bg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-11.1
|
|
@@ -448,9 +445,6 @@ def safe_include(filename):
|
|
|
448
445
|
| ---------- | ------------------------------------------------ |
|
|
449
446
|
| **CWE-98** | Improper Control of Filename for Include/Require |
|
|
450
447
|
|
|
451
|
-
sha256: 0c78b08bd1031743d7b847e7579f8588e3f75ee20ba61cf0f3e6ba55ebf0a97c
|
|
452
|
-
signature: GWHnfED6ljxbmvjr3LzKITWdEsPpquHCIroeKIaQtYfFjApnlAOGIVvUz/mMApsspp2GY6raV+0A9q7uC14jCQ==
|
|
453
|
-
signed_by: cyberstrike-official
|
|
454
448
|
|
|
455
449
|
---
|
|
456
450
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 7b1f975c00a35caf9b5dbe52320f4af12eebda5c5f4d348cef4b8e0e64795a78
|
|
15
|
-
signature: Ctxgy43w7hIE4EBMyqpvyeQHAFUlT9NWPC0WIaiqWgUrVKFWAtLhxvkSJDnqWPa4pd5D/epPWqK14LrlQPRRCw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-12
|
|
@@ -435,9 +432,6 @@ if (preg_match('/^[a-zA-Z0-9.-]+$/', $_GET['host'])) {
|
|
|
435
432
|
| ---------- | ----------------------------------------------------------------- |
|
|
436
433
|
| **CWE-78** | Improper Neutralization of Special Elements used in an OS Command |
|
|
437
434
|
|
|
438
|
-
sha256: 9d6b07fcb8a62ce8d32b6b32dd8a9d75f468d755c730036c3b678a04922882fd
|
|
439
|
-
signature: ZGOQ651itCfoimhfcKU9nrgfnFbh1DB3SgrgyAp7U0pPS5hsfoqGh15N4Pne2GvkNVrrhmNSbdq3PeGjI9SOBQ==
|
|
440
|
-
signed_by: cyberstrike-official
|
|
441
435
|
|
|
442
436
|
---
|
|
443
437
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 9d0ea5100ab388659d61f605766fd58168189b55aa1378713307e0661e9db4c1
|
|
15
|
-
signature: zdQP9yHR1yxmqJHDCta4l0KvioFkjzBBUizTTekUPGUgTCpwqch9sT7gp8NSCCBKsdCERSVUUZiGg4+DqUdBAg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-13
|
|
@@ -349,9 +346,6 @@ print(f"{user_input}")
|
|
|
349
346
|
| ----------- | ------------------------------------------ |
|
|
350
347
|
| **CWE-134** | Use of Externally-Controlled Format String |
|
|
351
348
|
|
|
352
|
-
sha256: 53fd26e9ce258c52ca40c05e81b2b99be9bdfbfd8bc024e04de319a0cfe43447
|
|
353
|
-
signature: mp9Bjql7gAJ3TJztSAZXMpdH3PYe+pNKeFGtoJwBu/zTRNAn3m/pJXy8Tix1u5lA8k4gHUMpRkGQbmypi9daDQ==
|
|
354
|
-
signed_by: cyberstrike-official
|
|
355
349
|
|
|
356
350
|
---
|
|
357
351
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 618cc4c5b582b579e3b374fae36f4982e2b7a7b343b71a1d7b97875aabae37de
|
|
15
|
-
signature: yqztzgxK9uCWianHyGAhFKtNU4WRB59nf50m5SibizDhpFlv5Gaha+CZ6hVmsZL+3JJhh6F47n/UWHRGR+ZcAQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-14
|
|
@@ -405,9 +402,6 @@ cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))
|
|
|
405
402
|
| **CWE-79** | Cross-Site Scripting |
|
|
406
403
|
| **CWE-89** | SQL Injection |
|
|
407
404
|
|
|
408
|
-
sha256: 4a30ff7caa71b1724f797f4ae67f1b91995d5a65d61549a43446961199c6b41e
|
|
409
|
-
signature: nWD0hCOuTsCD635396sCQEPutf15lm7GqDZxeiuQ0cCrgdDHDOgD8YY1srNcwhQdwx8vpYHuU1oFvIMevf5pDg==
|
|
410
|
-
signed_by: cyberstrike-official
|
|
411
405
|
|
|
412
406
|
---
|
|
413
407
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 37f69cbb0195f23c4cac91080163ab58188d65edaccdaad9b24ebb1757c6adce
|
|
15
|
-
signature: yIMuSuGHNCUxTKORvvHw4oNNh2JDh238mjQ/v1qrlneOcrjlS8WWbf7QgiD/S2Fbeb0wMvZm5TTlqFV14EGjBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-15
|
|
@@ -376,9 +373,6 @@ HttpProtocolOptions Strict
|
|
|
376
373
|
| **CWE-444** | Inconsistent Interpretation of HTTP Requests |
|
|
377
374
|
| **CWE-113** | Improper Neutralization of CRLF Sequences |
|
|
378
375
|
|
|
379
|
-
sha256: b44774c366bab764e59526fd2199bf5b1cd04cb1ee62bd8a6896fa89d04b0553
|
|
380
|
-
signature: 5SjgcwlubU0nynOxMbgSubk7zLYRPtobs8h8mEPfkZneOoDXmBo5OjAe7fLbR9zphvZAKunTLGx+pjZ4AnfyBA==
|
|
381
|
-
signed_by: cyberstrike-official
|
|
382
376
|
|
|
383
377
|
---
|
|
384
378
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 7304ea3fdb5fa7b93c67bc8e61e859bee2d5e7a242d3b6fccb69b9d5b786dcfa
|
|
15
|
-
signature: qnKzbtHM3ZI+1EkaPfJMs+miAP2T+BPYWd9jhlcuLoiYBd1i0zMP5MJqiqnqWJLDPlOeLqVIOcMYPYQH/oIQDQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-16
|
|
@@ -376,9 +373,6 @@ Timeout 60
|
|
|
376
373
|
| ----------- | --------------------------------- |
|
|
377
374
|
| **CWE-400** | Uncontrolled Resource Consumption |
|
|
378
375
|
|
|
379
|
-
sha256: 64e6cd87a6f136b211d722395dc5e9b0b425937c5ad02f4d5916697047e41cae
|
|
380
|
-
signature: oCnaKhl9nvDcf764gS5l3DjEuzOreetPQ/LWXYhmjC6FcifieajgpgUdens0WygbqxhzH+2twCSKW0C7nbKDBw==
|
|
381
|
-
signed_by: cyberstrike-official
|
|
382
376
|
|
|
383
377
|
---
|
|
384
378
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: e9a44c8eea563b2a6fd878363362f8ea6e054ffe3ae6855e5cbed99543accfe7
|
|
15
|
-
signature: fjw/vafeqRGxLv12o0bZE/hcDjhFTws81jNcl2bZJgr71D9ibVqTXKDajXB4JVbF9KNIh3c7TTN8Z+Se2ZSOBg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-17
|
|
@@ -366,9 +363,6 @@ server {
|
|
|
366
363
|
| ---------- | ------------------------- |
|
|
367
364
|
| **CWE-20** | Improper Input Validation |
|
|
368
365
|
|
|
369
|
-
sha256: 7cf4aeb741c83a0ec918a94b7369719362857f4b8bf82393cab162c4a2492382
|
|
370
|
-
signature: 1CHbhCHbl3wfbSifULVVycKFsRQA9wXCsaqQo86XkfRB90bAiMMZ36SvR4lCAxNeet6hVKFL5HvKa2rel+lFCg==
|
|
371
|
-
signed_by: cyberstrike-official
|
|
372
366
|
|
|
373
367
|
---
|
|
374
368
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 3d6247f5988333e3ae1cad5dcf2f42dd31771bc239281e6c6eb65b357a221646
|
|
15
|
-
signature: L+NHGldNVC+z5ZbWHOdYPyRgUzicj7mHjbsb9/lZGwrJo3EVkRCqImalVPyLLVwVn5BxXi1s3POSc+niXoH/Bg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-18
|
|
@@ -368,9 +365,6 @@ cfg.setNewBuiltinClassResolver(TemplateClassResolver.ALLOWS_NOTHING_RESOLVER);
|
|
|
368
365
|
| ------------ | --------------------------------------------------------------------- |
|
|
369
366
|
| **CWE-1336** | Improper Neutralization of Special Elements Used in a Template Engine |
|
|
370
367
|
|
|
371
|
-
sha256: f1f3f78b933a47b8ac053a60d6f45090b30dcebf8135a61d78dffaac25cfe666
|
|
372
|
-
signature: yUk3vZPU8dREb+Xbj5cn/ZpscpjNAfGs3x50bynHZWG03NxFyCilZIu/k/m0NoeWLHGFWNYT+6ITWBYS6D/tCA==
|
|
373
|
-
signed_by: cyberstrike-official
|
|
374
368
|
|
|
375
369
|
---
|
|
376
370
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 63fa1b2384d7324539742d51249860d3ebc5210447c110b5205c3d7798e1c7ca
|
|
15
|
-
signature: xIaztbC5Cf0B8FpnNpQmsaa905NaT7vPu/AUVWvZcMFuAcnL7UyqK9D80qt3WzWEBXvtG2aJHvI7hp5CfBgbBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-19
|
|
@@ -456,9 +453,6 @@ def is_safe_url(url):
|
|
|
456
453
|
| ----------- | ---------------------------------- |
|
|
457
454
|
| **CWE-918** | Server-Side Request Forgery (SSRF) |
|
|
458
455
|
|
|
459
|
-
sha256: 42591dd5bc8bbf0aa0446e6e74b967b1a936e2264c3e563baf9df5def24e49b6
|
|
460
|
-
signature: 8Ab37VYOIce+DHhEJIMzCbu5MD9p0v3BXzBnsTwnbCNmK1ZpYiY+k1uxUkeXlFDWbK51pAyGSWOgOdMIxs23BQ==
|
|
461
|
-
signed_by: cyberstrike-official
|
|
462
456
|
|
|
463
457
|
---
|
|
464
458
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 035dcbdc20cc032d82598f4c154a1f8f52463b504580f77bcacde19941fac001
|
|
15
|
-
signature: mtJdckUSIhfJSgK2rcUnb9t9kS8z9bNCu7o/bu5YzfxAeUB4WkApYFwMwXQPgCsyaq9puIfa2Z7oQFx1981zDw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-inpv-20
|
|
@@ -476,9 +473,6 @@ end
|
|
|
476
473
|
| ----------- | ------------------------------------------------------------------------------ |
|
|
477
474
|
| **CWE-915** | Improperly Controlled Modification of Dynamically-Determined Object Attributes |
|
|
478
475
|
|
|
479
|
-
sha256: a35aeed607fba2149ff027b0fe5ea27e54e993193864f3609128c221e296d425
|
|
480
|
-
signature: kjWgKZBDbslqueG0GjZ2fJbX6f6Pc1cW807vZqS3WdMLP6IVmN8jEgvrho6n/aOSLjD5bIARgyj4Y/gyYpIABA==
|
|
481
|
-
signed_by: cyberstrike-official
|
|
482
476
|
|
|
483
477
|
---
|
|
484
478
|
|
|
@@ -3,9 +3,6 @@ name: wstg-logic-client-api
|
|
|
3
3
|
description: WSTG business logic, client-side, and API security testing
|
|
4
4
|
tags: [logic, client-side, api, graphql, cors, websocket, wstg]
|
|
5
5
|
version: "1.0"
|
|
6
|
-
sha256: 5eb9d669b85a22d5e6b21da71a4ce7dae085e7c739fc96b35ac56768989c79d9
|
|
7
|
-
signature: /L06L2rgR7Nv9WTBY4jXV8yr2b93OREaJsdinHv9mKgklj8kr7JeJUShTpQQ+znwmc85cSTBbyuyp80/EqyVDA==
|
|
8
|
-
signed_by: cyberstrike-official
|
|
9
6
|
---
|
|
10
7
|
|
|
11
8
|
# Business Logic, Client-Side & API Testing (WSTG-BUSL + CLNT + APIT)
|
|
@@ -3,9 +3,6 @@ name: wstg-recon-config
|
|
|
3
3
|
description: WSTG reconnaissance, configuration, error handling, and cryptography testing techniques
|
|
4
4
|
tags: [recon, config, headers, tls, wstg]
|
|
5
5
|
version: "1.0"
|
|
6
|
-
sha256: f241b7b16139c7e3d7b8e1f04514519c292d3e105023c48ecc84e40c5b233ea2
|
|
7
|
-
signature: HFvIzsEVw5FpR6lpbhOCsnbuRQlMRZJ4KofYeWfXQzM05CDitpBjwkj6r9bcO4CCC4exYG16amplHlMn55U5Bg==
|
|
8
|
-
signed_by: cyberstrike-official
|
|
9
6
|
---
|
|
10
7
|
|
|
11
8
|
# Recon & Configuration Testing (WSTG-INFO + CONF + ERRH + CRYP)
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-539]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 0bf4e3ff740d319bf652b58d874438016a01efd402ca56446dcf50eb6f3d7bb2
|
|
15
|
-
signature: uCKthDXrXPkaFsL7zt3TjKRjCFXcvU2nwi0fTWXEH84edhEV3eJR1XzFt541iKg4rbG+K7lL9edYrpE2QDS/AQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-01
|
|
@@ -632,9 +629,6 @@ class SessionValidator:
|
|
|
632
629
|
- [OWASP WSTG - Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/)
|
|
633
630
|
- [RFC 6265 - HTTP State Management](https://tools.ietf.org/html/rfc6265)
|
|
634
631
|
|
|
635
|
-
sha256: 19398feeed24ab27a59372a2023935015254afa1b66b289eb3ea35b85c4b8a76
|
|
636
|
-
signature: NZFEfEBMH7c4wDuNz+REqtOXJpfsTBTguhpMDw9bbS3cx7v/Y00JV0YqFjmA65S9U6qYeA9cyK2GCNQMYfXDCQ==
|
|
637
|
-
signed_by: cyberstrike-official
|
|
638
632
|
|
|
639
633
|
---
|
|
640
634
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-384]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: b7c67f771381032da15e56c7e92601f363e7c435cd5317b6c9153b189a32933e
|
|
15
|
-
signature: Ms0E1qwQW5fyKHr19pRort39YSaaNAeATFPZ3eQ3ex5HAUrMUpH79fqXg66Th09xT0B/F8fxJ8KYKwEUFAzDCw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-02
|
|
@@ -550,9 +547,6 @@ location / {
|
|
|
550
547
|
- [RFC 6265 - HTTP State Management](https://tools.ietf.org/html/rfc6265)
|
|
551
548
|
- [Cookie Prefixes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Cookie_prefixes)
|
|
552
549
|
|
|
553
|
-
sha256: 788101ada7d864d3f038079525288700f5d5cf64ec058d8cecb9ae1a219719fa
|
|
554
|
-
signature: sCf9+JvW0TYGy8GmdelOL/fHWBj9jyVzFqWJKySfWUb8uxQSmF+VMpSK8ESRavvUSD7IsL7xF4/k76HsBEtECg==
|
|
555
|
-
signed_by: cyberstrike-official
|
|
556
550
|
|
|
557
551
|
---
|
|
558
552
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-613]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 56de8f955d0f0e079a5be1cc9035bdcda10f08ea7c60c36debd6e48b543a7065
|
|
15
|
-
signature: eyvDl46WZRrHPumR0xs0K6F0y/MFKU/JCbCCas6dWR4aKhjETnvPu+AFIvzZd4xq6a259s/vVvUd+QgeytZxDw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-03
|
|
@@ -414,9 +411,6 @@ public String login(HttpServletRequest request, @RequestParam String username,
|
|
|
414
411
|
- [OWASP Session Fixation](https://owasp.org/www-community/attacks/Session_fixation)
|
|
415
412
|
- [OWASP WSTG - Session Fixation](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/03-Testing_for_Session_Fixation)
|
|
416
413
|
|
|
417
|
-
sha256: 50bf9ba2befc0960d2fcb6fbdef6edb92ba934b1a54c0e36aa89ff0cc03c0582
|
|
418
|
-
signature: WgS9tHmM/hkYDBU21n9L14AVjiBWSxBcrp5HCHRMs/7VBdSOk3k8F2nEXm0RpbcMnhHt1SeGT16mjRgxddGjCQ==
|
|
419
|
-
signed_by: cyberstrike-official
|
|
420
414
|
|
|
421
415
|
---
|
|
422
416
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-614]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 072a55163c98cc0cd1eff25c7386066dfbad9789217fe9742ab8587dac0d4bbc
|
|
15
|
-
signature: fEy/1zkqNQjRsyhDzcov/XmWxJq/gC2fQL0SLoHfUTWPdVnMghI4dOjcxA9KM98h8rZKCPFK5rol7gzC2Rp5DA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-04
|
|
@@ -374,9 +371,6 @@ location /dashboard {
|
|
|
374
371
|
| **CWE-200** | Exposure of Sensitive Information |
|
|
375
372
|
| **CWE-532** | Insertion of Sensitive Info into Log File |
|
|
376
373
|
|
|
377
|
-
sha256: 38c1559a38767fc49a54ea2827d9796e37e14d5c9d4646752b770d06d0f4b121
|
|
378
|
-
signature: OuV493pP6SOFsvWj4D7dzQvMBJR6foGHlTQWRsT+hA5FxVNJ7lp+gLa2wf204ht3NWysEVW/K96MCJJCG+rxDg==
|
|
379
|
-
signed_by: cyberstrike-official
|
|
380
374
|
|
|
381
375
|
---
|
|
382
376
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-352]
|
|
|
11
11
|
chains_with: [wstg-inpv-02, wstg-athn-05]
|
|
12
12
|
prerequisites: [wstg-sess-01]
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 37ed56b3517d6a0448d8e2f5f12f39d9925e0c2624faef252771051481192ac9
|
|
15
|
-
signature: RIpCnyZLmUoJx6halELTnXWWD0KXJGv6HTCiXLHW3566HU6ndLBkO6Xyf2SqOLthhS8IjxP0ftck+SqyKmxuCA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-05
|
|
@@ -363,9 +360,6 @@ def validate_origin():
|
|
|
363
360
|
| ----------- | --------------------------------- |
|
|
364
361
|
| **CWE-352** | Cross-Site Request Forgery (CSRF) |
|
|
365
362
|
|
|
366
|
-
sha256: f158501d96049db0d040a4b19374da59f1ad1247f6a32a09379a7d7c76e2125e
|
|
367
|
-
signature: RN5w4t7bfRcYA4u3rvNyfoQCtaGcBXzTp5nPloSFc48y3C78hIIHrJmzUptF9zeAEjOoqzZooSrk/I5XPWT7Cw==
|
|
368
|
-
signed_by: cyberstrike-official
|
|
369
363
|
|
|
370
364
|
---
|
|
371
365
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-613]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 7b8eba4ae71cdcdf0497fbac9b6fd8f321dcaf00d3be36574d73699fb477bdeb
|
|
15
|
-
signature: Gw3eMY0Exhpfy8hguDh3buEwhFMN+/usshkEjv8f3ySZWUdMNskG5bBYY2/hxsVqB4HpNOTyDyPAu2Mf93RgBA==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-06
|
|
@@ -215,9 +212,6 @@ def logout():
|
|
|
215
212
|
| ----------- | ------------------------------- |
|
|
216
213
|
| **CWE-613** | Insufficient Session Expiration |
|
|
217
214
|
|
|
218
|
-
sha256: b79ace15255e6c6a4dbf9c6040e2f144c4a5707377e703239d489606c74a86bb
|
|
219
|
-
signature: kVZaTlwn7ZRXxZv4BwEpB7qEuLLeJqmtOXkQy38ra4DKgceAS6kAPWOfkA+b3bh1fHVtc8iaGYcZCxTkcUOqDw==
|
|
220
|
-
signed_by: cyberstrike-official
|
|
221
215
|
|
|
222
216
|
---
|
|
223
217
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-384]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 8a27faf8b1879ce88e0aae91a2ad840088f2c26bf78c60bd50dfd99633c492b7
|
|
15
|
-
signature: mBd6m5ax4L6TtNaCWLrISCJuez0vFmM41tAW9C+RS0RUBZHIzrbrWq9d6NUuNmBUq9NvWyCX6/knjQ2mq7LFAg==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-07
|
|
@@ -235,9 +232,6 @@ def login():
|
|
|
235
232
|
| ----------- | ------------------------------- |
|
|
236
233
|
| **CWE-613** | Insufficient Session Expiration |
|
|
237
234
|
|
|
238
|
-
sha256: 64fb198891916e8a473532d42668bc84381ca6bca5926ce54a91d484899d4b0c
|
|
239
|
-
signature: 9e704dUUK/dmb/grygVrTEu9WkcqQnDWMvBEn+coFNGhyhspuVrcJgPb5+YJwKXzmO/P4EFCeqrRDkoim7WjDQ==
|
|
240
|
-
signed_by: cyberstrike-official
|
|
241
235
|
|
|
242
236
|
---
|
|
243
237
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-200]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 18a6579db17f7b88ff22b5145618cd00f58bbd8c57fbe796bb07f80f79fcb6f9
|
|
15
|
-
signature: ZSl2r4jg2AA0/qD0u81Zgv7FK43VeDlbsGcb8gS5913VvCOiUsQ1U2Lz3HNdAfvsWISPZr3sIkTtUzHybBzqCw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-08
|
|
@@ -167,9 +164,6 @@ session['password_reset'] = {
|
|
|
167
164
|
| ----------- | ----------------------------------------- |
|
|
168
165
|
| **CWE-488** | Exposure of Data Element to Wrong Session |
|
|
169
166
|
|
|
170
|
-
sha256: 206d02162f6aadd22fe16537aed13bf4236b8e4d70462fc9f0f822ccfbcfdd13
|
|
171
|
-
signature: 7JVwygJkN2XLaVoBGL10J1ocflLgCrDxYY+K2FWBMO4kB3JAwVGt38IsBnMMjzBVTxHNWXphUVNyXTz/iHE5Aw==
|
|
172
|
-
signed_by: cyberstrike-official
|
|
173
167
|
|
|
174
168
|
---
|
|
175
169
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: [CWE-384]
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: ae4e4ed1ef9e8720f48e868f25e0b9b8182ed3258a3771d04f6b3192f325eefa
|
|
15
|
-
signature: w0mbfilsQC5r9KmdC7wrSttBM3Mf4+7qXHsRHa7Z4iJgBbpQNDCJD5Nuom3Wdr4zbMN91MbDQ/de+b7pgwwTCQ==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-09
|
|
@@ -231,9 +228,6 @@ def change_password():
|
|
|
231
228
|
| **CWE-384** | Session Fixation |
|
|
232
229
|
| **CWE-287** | Improper Authentication |
|
|
233
230
|
|
|
234
|
-
sha256: 63ab7c604202fe3f2d1339410b4a07b431923f100dc95e5530c7cbf0ea4bf71c
|
|
235
|
-
signature: Mtm+yKn0VZPjgJVhcjX1vW9R6/DPby7rVNrWQLXYERIWiba+nso0BYURXNCoKd5zbrVsv3rTGSK9b7vV58AgBA==
|
|
236
|
-
signed_by: cyberstrike-official
|
|
237
231
|
|
|
238
232
|
---
|
|
239
233
|
|
|
@@ -11,9 +11,6 @@ cwe_ids: []
|
|
|
11
11
|
chains_with: []
|
|
12
12
|
prerequisites: []
|
|
13
13
|
severity_boost: {}
|
|
14
|
-
sha256: 7c94f5c978970202661d2080e37c620edc3f19625a5871e5a04a54b276ed6da7
|
|
15
|
-
signature: qrZKPeQ7EQJiLy3Tf89NGdnWqaEyk5b/ZftvH1kFeLpVI35xIJtHa99TF0cYjYB+hmnlziuMNJoihiWPiyMpDw==
|
|
16
|
-
signed_by: cyberstrike-official
|
|
17
14
|
---
|
|
18
15
|
|
|
19
16
|
# wstg-sess-10
|
|
@@ -309,9 +306,6 @@ def verify_token(token):
|
|
|
309
306
|
| **CWE-347** | Improper Verification of Cryptographic Signature |
|
|
310
307
|
| **CWE-757** | Selection of Less-Secure Algorithm During Negotiation |
|
|
311
308
|
|
|
312
|
-
sha256: 0d28fb4a46e452c84fed13e735e62deb30fc9f82524b49297938eab9550aaee9
|
|
313
|
-
signature: ZAxZNMiWaSOMcskyZPll80rB0UhnYiqHyPlVZ3CxzbrzMyW8KY94+9eu4EV2T2rF45w7m5yC1IgSrKP7OU+qDw==
|
|
314
|
-
signed_by: cyberstrike-official
|
|
315
309
|
|
|
316
310
|
---
|
|
317
311
|
|