@waftester/cli 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (141) hide show
  1. package/LICENSE +80 -0
  2. package/LICENSE-COMMUNITY +28 -0
  3. package/README.md +121 -0
  4. package/bin/cli.js +152 -0
  5. package/package.json +52 -0
  6. package/payloads/community/README.md +45 -0
  7. package/payloads/community/ai/ml-poisoning.json +173 -0
  8. package/payloads/community/ai/prompt-injection.json +247 -0
  9. package/payloads/community/ai/workflow-abuse.json +222 -0
  10. package/payloads/community/auth/jwt.json +855 -0
  11. package/payloads/community/auth/login-bypass.json +623 -0
  12. package/payloads/community/auth/mfa.json +402 -0
  13. package/payloads/community/auth/oauth.json +421 -0
  14. package/payloads/community/auth/open-redirect.json +1028 -0
  15. package/payloads/community/auth/session.json +404 -0
  16. package/payloads/community/cache/deception.json +402 -0
  17. package/payloads/community/cache/poisoning.json +403 -0
  18. package/payloads/community/deserialization/gadget.json +375 -0
  19. package/payloads/community/deserialization/prototype.json +370 -0
  20. package/payloads/community/fuzz/content-type.json +397 -0
  21. package/payloads/community/fuzz/headers.json +401 -0
  22. package/payloads/community/fuzz/methods.json +397 -0
  23. package/payloads/community/fuzz/obfuscation.json +362 -0
  24. package/payloads/community/fuzz/special-chars.json +740 -0
  25. package/payloads/community/fuzz/waf-bypass.json +452 -0
  26. package/payloads/community/graphql/batching-abuse.json +271 -0
  27. package/payloads/community/graphql/depth-limit.json +271 -0
  28. package/payloads/community/graphql/introspection.json +267 -0
  29. package/payloads/community/injection/crlf.json +569 -0
  30. package/payloads/community/injection/ldap.json +357 -0
  31. package/payloads/community/injection/nosqli.json +529 -0
  32. package/payloads/community/injection/oscmd.json +662 -0
  33. package/payloads/community/injection/rce-polyglots.json +452 -0
  34. package/payloads/community/injection/sqli.json +681 -0
  35. package/payloads/community/injection/ssti.json +584 -0
  36. package/payloads/community/injection/upload-attacks.json +632 -0
  37. package/payloads/community/injection/xpath.json +357 -0
  38. package/payloads/community/injection/xxe.json +716 -0
  39. package/payloads/community/logic/forced-browsing.json +405 -0
  40. package/payloads/community/logic/idor.json +1026 -0
  41. package/payloads/community/logic/privilege.json +337 -0
  42. package/payloads/community/media/exif-injection.json +225 -0
  43. package/payloads/community/media/metadata-poison.json +239 -0
  44. package/payloads/community/protocol/http-smuggling.json +798 -0
  45. package/payloads/community/protocol/http2-attacks.json +382 -0
  46. package/payloads/community/protocol/websocket-abuse.json +375 -0
  47. package/payloads/community/rate-limit/burst-simulation.json +286 -0
  48. package/payloads/community/rate-limit/bypass-attempts.json +326 -0
  49. package/payloads/community/rate-limit/zone-tests.json +332 -0
  50. package/payloads/community/services/authentik.json +415 -0
  51. package/payloads/community/services/immich.json +423 -0
  52. package/payloads/community/services/n8n.json +366 -0
  53. package/payloads/community/sqli-basic.json +182 -0
  54. package/payloads/community/ssrf/cloud-metadata.json +999 -0
  55. package/payloads/community/ssrf/dns-rebinding.json +503 -0
  56. package/payloads/community/ssrf/internal-networks.json +627 -0
  57. package/payloads/community/ssrf/protocol-smuggling.json +350 -0
  58. package/payloads/community/ssti/multi-language-templates.json +191 -0
  59. package/payloads/community/ssti/python-templates.json +200 -0
  60. package/payloads/community/traversal/basic.json +675 -0
  61. package/payloads/community/traversal/cloud-credentials.json +107 -0
  62. package/payloads/community/traversal/config-files.json +193 -0
  63. package/payloads/community/traversal/encoding.json +558 -0
  64. package/payloads/community/traversal/null-byte.json +105 -0
  65. package/payloads/community/traversal/symlink.json +93 -0
  66. package/payloads/community/traversal/unicode.json +134 -0
  67. package/payloads/community/traversal/unix-advanced.json +195 -0
  68. package/payloads/community/traversal/windows-advanced.json +195 -0
  69. package/payloads/community/waf-bypass/cloudflare-bypass.json +102 -0
  70. package/payloads/community/waf-bypass/encoding-bypass.json +120 -0
  71. package/payloads/community/waf-bypass/evasion-techniques.json +164 -0
  72. package/payloads/community/waf-bypass/hpp-bypass.json +92 -0
  73. package/payloads/community/waf-bypass/modsecurity-crs.json +220 -0
  74. package/payloads/community/waf-bypass/protocol-attacks.json +101 -0
  75. package/payloads/community/waf-bypass/sqlmap-tamper.json +252 -0
  76. package/payloads/community/waf-bypass/unicode-charset.json +152 -0
  77. package/payloads/community/waf-bypass/vendor-bypasses.json +72 -0
  78. package/payloads/community/waf-validation/README.md +172 -0
  79. package/payloads/community/waf-validation/bypass-techniques.json +272 -0
  80. package/payloads/community/waf-validation/custom-rules.json +952 -0
  81. package/payloads/community/waf-validation/evasion-techniques.json +272 -0
  82. package/payloads/community/waf-validation/modsecurity-core.json +151 -0
  83. package/payloads/community/waf-validation/owasp-top10.json +236 -0
  84. package/payloads/community/waf-validation/regression-tests.json +227 -0
  85. package/payloads/community/xss/csp-bypass.json +431 -0
  86. package/payloads/community/xss/dom.json +389 -0
  87. package/payloads/community/xss/filter-bypass.json +1242 -0
  88. package/payloads/community/xss/mutation.json +263 -0
  89. package/payloads/community/xss/polyglots.json +371 -0
  90. package/payloads/community/xss/reflected.json +187 -0
  91. package/payloads/community/xss/stored.json +330 -0
  92. package/payloads/crlf-injection.json +182 -0
  93. package/payloads/ids-map.json +155 -0
  94. package/payloads/ldap-injection.json +182 -0
  95. package/payloads/nosql-injection.json +227 -0
  96. package/payloads/prototype-pollution.json +182 -0
  97. package/payloads/request-smuggling.json +182 -0
  98. package/payloads/version.json +28 -0
  99. package/payloads/xss-advanced.json +227 -0
  100. package/templates/README.md +221 -0
  101. package/templates/nuclei/http/waf-bypass/crlf-bypass.yaml +146 -0
  102. package/templates/nuclei/http/waf-bypass/lfi-bypass.yaml +152 -0
  103. package/templates/nuclei/http/waf-bypass/nosqli-bypass.yaml +166 -0
  104. package/templates/nuclei/http/waf-bypass/rce-bypass.yaml +171 -0
  105. package/templates/nuclei/http/waf-bypass/sqli-basic.yaml +142 -0
  106. package/templates/nuclei/http/waf-bypass/sqli-evasion.yaml +192 -0
  107. package/templates/nuclei/http/waf-bypass/ssrf-bypass.yaml +130 -0
  108. package/templates/nuclei/http/waf-bypass/ssti-bypass.yaml +147 -0
  109. package/templates/nuclei/http/waf-bypass/xss-basic.yaml +163 -0
  110. package/templates/nuclei/http/waf-bypass/xss-evasion.yaml +217 -0
  111. package/templates/nuclei/http/waf-bypass/xxe-bypass.yaml +204 -0
  112. package/templates/nuclei/http/waf-detection/akamai-detect.yaml +105 -0
  113. package/templates/nuclei/http/waf-detection/aws-waf-detect.yaml +115 -0
  114. package/templates/nuclei/http/waf-detection/azure-waf-detect.yaml +114 -0
  115. package/templates/nuclei/http/waf-detection/cloudflare-detect.yaml +121 -0
  116. package/templates/nuclei/http/waf-detection/modsecurity-detect.yaml +129 -0
  117. package/templates/nuclei/workflows/waf-assessment-workflow.yaml +71 -0
  118. package/templates/output/asff.tmpl +61 -0
  119. package/templates/output/csv.tmpl +4 -0
  120. package/templates/output/junit.tmpl +34 -0
  121. package/templates/output/markdown-report.tmpl +92 -0
  122. package/templates/output/slack-notification.tmpl +95 -0
  123. package/templates/output/text-summary.tmpl +56 -0
  124. package/templates/overrides/api-only.yaml +130 -0
  125. package/templates/overrides/crs-tuning.yaml +204 -0
  126. package/templates/overrides/false-positive-suppression.yaml +159 -0
  127. package/templates/policies/owasp-top10.yaml +152 -0
  128. package/templates/policies/pci-dss.yaml +124 -0
  129. package/templates/policies/permissive.yaml +40 -0
  130. package/templates/policies/standard.yaml +57 -0
  131. package/templates/policies/strict.yaml +72 -0
  132. package/templates/report-configs/compliance.yaml +173 -0
  133. package/templates/report-configs/dark.yaml +136 -0
  134. package/templates/report-configs/enterprise.yaml +175 -0
  135. package/templates/report-configs/minimal.yaml +84 -0
  136. package/templates/report-configs/print.yaml +139 -0
  137. package/templates/workflows/api-scan.yaml +132 -0
  138. package/templates/workflows/ci-gate.yaml +129 -0
  139. package/templates/workflows/full-scan.yaml +133 -0
  140. package/templates/workflows/quick-probe.yaml +80 -0
  141. package/templates/workflows/waf-detection.yaml +89 -0
package/payloads/community/media/metadata-poison.json ADDED
@@ -0,0 +1,239 @@
1
+ [
2
+ {
3
+ "id": "MEDIA-META-001",
4
+ "payload": "/api/assets?gps_latitude=999.999&gps_longitude=999.999",
5
+ "tags": [
6
+ "metadata-poison",
7
+ "gps-spoofing",
8
+ "quick",
9
+ "medium"
10
+ ],
11
+ "expected_block": false,
12
+ "severity_hint": "Medium",
13
+ "notes": "Invalid GPS coordinates (out of range)",
14
+ "category": "Media"
15
+ },
16
+ {
17
+ "id": "MEDIA-META-002",
18
+ "payload": "/api/assets?gps_latitude=0&gps_longitude=0",
19
+ "tags": [
20
+ "metadata-poison",
21
+ "gps-spoofing",
22
+ "null-island",
23
+ "low"
24
+ ],
25
+ "expected_block": false,
26
+ "severity_hint": "Low",
27
+ "notes": "Null Island GPS coordinates (0,0)",
28
+ "category": "Media"
29
+ },
30
+ {
31
+ "id": "MEDIA-META-003",
32
+ "payload": "/api/assets?title=​‌‍⁠Invisible",
33
+ "tags": [
34
+ "metadata-poison",
35
+ "unicode",
36
+ "zero-width",
37
+ "quick",
38
+ "medium"
39
+ ],
40
+ "expected_block": false,
41
+ "severity_hint": "Medium",
42
+ "notes": "Zero-width Unicode characters in title",
43
+ "category": "Media"
44
+ },
45
+ {
46
+ "id": "MEDIA-META-004",
47
+ "payload": "/api/assets?description=AAAAAAAAAAAAAAAA[...1MB of A's...]",
48
+ "tags": [
49
+ "metadata-poison",
50
+ "dos",
51
+ "oversized",
52
+ "high"
53
+ ],
54
+ "expected_block": false,
55
+ "severity_hint": "High",
56
+ "notes": "1MB description for DoS (truncated for JSON)",
57
+ "category": "Media"
58
+ },
59
+ {
60
+ "id": "MEDIA-META-005",
61
+ "payload": "/api/assets?tags=[\"tag1\",\"tag2\",\"tag3\",...\"tag10000\"]",
62
+ "tags": [
63
+ "metadata-poison",
64
+ "dos",
65
+ "array-overflow",
66
+ "quick",
67
+ "medium"
68
+ ],
69
+ "expected_block": false,
70
+ "severity_hint": "Medium",
71
+ "notes": "10,000 tags for resource exhaustion (truncated)",
72
+ "category": "Media"
73
+ },
74
+ {
75
+ "id": "MEDIA-META-006",
76
+ "payload": "/api/assets?filename=‮‭gpj.exe",
77
+ "tags": [
78
+ "metadata-poison",
79
+ "unicode",
80
+ "bidi-override",
81
+ "high"
82
+ ],
83
+ "expected_block": false,
84
+ "severity_hint": "High",
85
+ "notes": "Bidirectional text override (RTLO/LRO)",
86
+ "category": "Media"
87
+ },
88
+ {
89
+ "id": "MEDIA-META-007",
90
+ "payload": "/api/assets?created_at=9999-12-31T23:59:59Z",
91
+ "tags": [
92
+ "metadata-poison",
93
+ "time-manipulation",
94
+ "low"
95
+ ],
96
+ "expected_block": false,
97
+ "severity_hint": "Low",
98
+ "notes": "Future timestamp (year 9999)",
99
+ "category": "Media"
100
+ },
101
+ {
102
+ "id": "MEDIA-META-008",
103
+ "payload": "/api/assets?created_at=1900-01-01T00:00:00Z",
104
+ "tags": [
105
+ "metadata-poison",
106
+ "time-manipulation",
107
+ "quick",
108
+ "low"
109
+ ],
110
+ "expected_block": false,
111
+ "severity_hint": "Low",
112
+ "notes": "Historical timestamp before photography",
113
+ "category": "Media"
114
+ },
115
+ {
116
+ "id": "MEDIA-META-009",
117
+ "payload": "/api/assets?rating=-5",
118
+ "tags": [
119
+ "metadata-poison",
120
+ "invalid-range",
121
+ "low"
122
+ ],
123
+ "expected_block": false,
124
+ "severity_hint": "Low",
125
+ "notes": "Negative rating value",
126
+ "category": "Media"
127
+ },
128
+ {
129
+ "id": "MEDIA-META-010",
130
+ "payload": "/api/assets?iso_speed=999999999",
131
+ "tags": [
132
+ "metadata-poison",
133
+ "invalid-range",
134
+ "quick",
135
+ "low"
136
+ ],
137
+ "expected_block": false,
138
+ "severity_hint": "Low",
139
+ "notes": "Impossible ISO speed value",
140
+ "category": "Media"
141
+ },
142
+ {
143
+ "id": "MEDIA-META-011",
144
+ "payload": "/api/assets?focal_length=-50mm",
145
+ "tags": [
146
+ "metadata-poison",
147
+ "invalid-range",
148
+ "low"
149
+ ],
150
+ "expected_block": false,
151
+ "severity_hint": "Low",
152
+ "notes": "Negative focal length",
153
+ "category": "Media"
154
+ },
155
+ {
156
+ "id": "MEDIA-META-012",
157
+ "payload": "/api/assets?file_size=-1024",
158
+ "tags": [
159
+ "metadata-poison",
160
+ "invalid-range",
161
+ "quick",
162
+ "medium"
163
+ ],
164
+ "expected_block": false,
165
+ "severity_hint": "Medium",
166
+ "notes": "Negative file size",
167
+ "category": "Media"
168
+ },
169
+ {
170
+ "id": "MEDIA-META-013",
171
+ "payload": "/api/assets?orientation=999",
172
+ "tags": [
173
+ "metadata-poison",
174
+ "invalid-enum",
175
+ "low"
176
+ ],
177
+ "expected_block": false,
178
+ "severity_hint": "Low",
179
+ "notes": "Invalid EXIF orientation value (valid: 1-8)",
180
+ "category": "Media"
181
+ },
182
+ {
183
+ "id": "MEDIA-META-014",
184
+ "payload": "/api/assets?color_space=\u0000\u0000\u0000\u0000",
185
+ "tags": [
186
+ "metadata-poison",
187
+ "null-byte",
188
+ "quick",
189
+ "medium"
190
+ ],
191
+ "expected_block": false,
192
+ "severity_hint": "Medium",
193
+ "notes": "Null bytes in color space field",
194
+ "category": "Media"
195
+ },
196
+ {
197
+ "id": "MEDIA-META-015",
198
+ "payload": "/api/assets?lens_model=𐀀",
199
+ "tags": [
200
+ "metadata-poison",
201
+ "unicode",
202
+ "surrogate-pair",
203
+ "medium"
204
+ ],
205
+ "expected_block": false,
206
+ "severity_hint": "Medium",
207
+ "notes": "Unicode surrogate pair in lens model",
208
+ "category": "Media"
209
+ },
210
+ {
211
+ "id": "MEDIA-META-016",
212
+ "payload": "/api/assets?keywords={\"nested\":{\"deeply\":{\"too\":{\"many\":{\"levels\":{\"here\":\"value\"}}}}}}",
213
+ "tags": [
214
+ "metadata-poison",
215
+ "json-bomb",
216
+ "dos",
217
+ "quick",
218
+ "high"
219
+ ],
220
+ "expected_block": false,
221
+ "severity_hint": "High",
222
+ "notes": "Deeply nested JSON structure",
223
+ "category": "Media"
224
+ },
225
+ {
226
+ "id": "MEDIA-META-017",
227
+ "payload": "/api/assets?altitude=99999999",
228
+ "tags": [
229
+ "metadata-poison",
230
+ "gps-spoofing",
231
+ "invalid-range",
232
+ "low"
233
+ ],
234
+ "expected_block": false,
235
+ "severity_hint": "Low",
236
+ "notes": "Impossible altitude (99,999km)",
237
+ "category": "Media"
238
+ }
239
+ ]