@waftester/cli 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (141) hide show
  1. package/LICENSE +80 -0
  2. package/LICENSE-COMMUNITY +28 -0
  3. package/README.md +121 -0
  4. package/bin/cli.js +152 -0
  5. package/package.json +52 -0
  6. package/payloads/community/README.md +45 -0
  7. package/payloads/community/ai/ml-poisoning.json +173 -0
  8. package/payloads/community/ai/prompt-injection.json +247 -0
  9. package/payloads/community/ai/workflow-abuse.json +222 -0
  10. package/payloads/community/auth/jwt.json +855 -0
  11. package/payloads/community/auth/login-bypass.json +623 -0
  12. package/payloads/community/auth/mfa.json +402 -0
  13. package/payloads/community/auth/oauth.json +421 -0
  14. package/payloads/community/auth/open-redirect.json +1028 -0
  15. package/payloads/community/auth/session.json +404 -0
  16. package/payloads/community/cache/deception.json +402 -0
  17. package/payloads/community/cache/poisoning.json +403 -0
  18. package/payloads/community/deserialization/gadget.json +375 -0
  19. package/payloads/community/deserialization/prototype.json +370 -0
  20. package/payloads/community/fuzz/content-type.json +397 -0
  21. package/payloads/community/fuzz/headers.json +401 -0
  22. package/payloads/community/fuzz/methods.json +397 -0
  23. package/payloads/community/fuzz/obfuscation.json +362 -0
  24. package/payloads/community/fuzz/special-chars.json +740 -0
  25. package/payloads/community/fuzz/waf-bypass.json +452 -0
  26. package/payloads/community/graphql/batching-abuse.json +271 -0
  27. package/payloads/community/graphql/depth-limit.json +271 -0
  28. package/payloads/community/graphql/introspection.json +267 -0
  29. package/payloads/community/injection/crlf.json +569 -0
  30. package/payloads/community/injection/ldap.json +357 -0
  31. package/payloads/community/injection/nosqli.json +529 -0
  32. package/payloads/community/injection/oscmd.json +662 -0
  33. package/payloads/community/injection/rce-polyglots.json +452 -0
  34. package/payloads/community/injection/sqli.json +681 -0
  35. package/payloads/community/injection/ssti.json +584 -0
  36. package/payloads/community/injection/upload-attacks.json +632 -0
  37. package/payloads/community/injection/xpath.json +357 -0
  38. package/payloads/community/injection/xxe.json +716 -0
  39. package/payloads/community/logic/forced-browsing.json +405 -0
  40. package/payloads/community/logic/idor.json +1026 -0
  41. package/payloads/community/logic/privilege.json +337 -0
  42. package/payloads/community/media/exif-injection.json +225 -0
  43. package/payloads/community/media/metadata-poison.json +239 -0
  44. package/payloads/community/protocol/http-smuggling.json +798 -0
  45. package/payloads/community/protocol/http2-attacks.json +382 -0
  46. package/payloads/community/protocol/websocket-abuse.json +375 -0
  47. package/payloads/community/rate-limit/burst-simulation.json +286 -0
  48. package/payloads/community/rate-limit/bypass-attempts.json +326 -0
  49. package/payloads/community/rate-limit/zone-tests.json +332 -0
  50. package/payloads/community/services/authentik.json +415 -0
  51. package/payloads/community/services/immich.json +423 -0
  52. package/payloads/community/services/n8n.json +366 -0
  53. package/payloads/community/sqli-basic.json +182 -0
  54. package/payloads/community/ssrf/cloud-metadata.json +999 -0
  55. package/payloads/community/ssrf/dns-rebinding.json +503 -0
  56. package/payloads/community/ssrf/internal-networks.json +627 -0
  57. package/payloads/community/ssrf/protocol-smuggling.json +350 -0
  58. package/payloads/community/ssti/multi-language-templates.json +191 -0
  59. package/payloads/community/ssti/python-templates.json +200 -0
  60. package/payloads/community/traversal/basic.json +675 -0
  61. package/payloads/community/traversal/cloud-credentials.json +107 -0
  62. package/payloads/community/traversal/config-files.json +193 -0
  63. package/payloads/community/traversal/encoding.json +558 -0
  64. package/payloads/community/traversal/null-byte.json +105 -0
  65. package/payloads/community/traversal/symlink.json +93 -0
  66. package/payloads/community/traversal/unicode.json +134 -0
  67. package/payloads/community/traversal/unix-advanced.json +195 -0
  68. package/payloads/community/traversal/windows-advanced.json +195 -0
  69. package/payloads/community/waf-bypass/cloudflare-bypass.json +102 -0
  70. package/payloads/community/waf-bypass/encoding-bypass.json +120 -0
  71. package/payloads/community/waf-bypass/evasion-techniques.json +164 -0
  72. package/payloads/community/waf-bypass/hpp-bypass.json +92 -0
  73. package/payloads/community/waf-bypass/modsecurity-crs.json +220 -0
  74. package/payloads/community/waf-bypass/protocol-attacks.json +101 -0
  75. package/payloads/community/waf-bypass/sqlmap-tamper.json +252 -0
  76. package/payloads/community/waf-bypass/unicode-charset.json +152 -0
  77. package/payloads/community/waf-bypass/vendor-bypasses.json +72 -0
  78. package/payloads/community/waf-validation/README.md +172 -0
  79. package/payloads/community/waf-validation/bypass-techniques.json +272 -0
  80. package/payloads/community/waf-validation/custom-rules.json +952 -0
  81. package/payloads/community/waf-validation/evasion-techniques.json +272 -0
  82. package/payloads/community/waf-validation/modsecurity-core.json +151 -0
  83. package/payloads/community/waf-validation/owasp-top10.json +236 -0
  84. package/payloads/community/waf-validation/regression-tests.json +227 -0
  85. package/payloads/community/xss/csp-bypass.json +431 -0
  86. package/payloads/community/xss/dom.json +389 -0
  87. package/payloads/community/xss/filter-bypass.json +1242 -0
  88. package/payloads/community/xss/mutation.json +263 -0
  89. package/payloads/community/xss/polyglots.json +371 -0
  90. package/payloads/community/xss/reflected.json +187 -0
  91. package/payloads/community/xss/stored.json +330 -0
  92. package/payloads/crlf-injection.json +182 -0
  93. package/payloads/ids-map.json +155 -0
  94. package/payloads/ldap-injection.json +182 -0
  95. package/payloads/nosql-injection.json +227 -0
  96. package/payloads/prototype-pollution.json +182 -0
  97. package/payloads/request-smuggling.json +182 -0
  98. package/payloads/version.json +28 -0
  99. package/payloads/xss-advanced.json +227 -0
  100. package/templates/README.md +221 -0
  101. package/templates/nuclei/http/waf-bypass/crlf-bypass.yaml +146 -0
  102. package/templates/nuclei/http/waf-bypass/lfi-bypass.yaml +152 -0
  103. package/templates/nuclei/http/waf-bypass/nosqli-bypass.yaml +166 -0
  104. package/templates/nuclei/http/waf-bypass/rce-bypass.yaml +171 -0
  105. package/templates/nuclei/http/waf-bypass/sqli-basic.yaml +142 -0
  106. package/templates/nuclei/http/waf-bypass/sqli-evasion.yaml +192 -0
  107. package/templates/nuclei/http/waf-bypass/ssrf-bypass.yaml +130 -0
  108. package/templates/nuclei/http/waf-bypass/ssti-bypass.yaml +147 -0
  109. package/templates/nuclei/http/waf-bypass/xss-basic.yaml +163 -0
  110. package/templates/nuclei/http/waf-bypass/xss-evasion.yaml +217 -0
  111. package/templates/nuclei/http/waf-bypass/xxe-bypass.yaml +204 -0
  112. package/templates/nuclei/http/waf-detection/akamai-detect.yaml +105 -0
  113. package/templates/nuclei/http/waf-detection/aws-waf-detect.yaml +115 -0
  114. package/templates/nuclei/http/waf-detection/azure-waf-detect.yaml +114 -0
  115. package/templates/nuclei/http/waf-detection/cloudflare-detect.yaml +121 -0
  116. package/templates/nuclei/http/waf-detection/modsecurity-detect.yaml +129 -0
  117. package/templates/nuclei/workflows/waf-assessment-workflow.yaml +71 -0
  118. package/templates/output/asff.tmpl +61 -0
  119. package/templates/output/csv.tmpl +4 -0
  120. package/templates/output/junit.tmpl +34 -0
  121. package/templates/output/markdown-report.tmpl +92 -0
  122. package/templates/output/slack-notification.tmpl +95 -0
  123. package/templates/output/text-summary.tmpl +56 -0
  124. package/templates/overrides/api-only.yaml +130 -0
  125. package/templates/overrides/crs-tuning.yaml +204 -0
  126. package/templates/overrides/false-positive-suppression.yaml +159 -0
  127. package/templates/policies/owasp-top10.yaml +152 -0
  128. package/templates/policies/pci-dss.yaml +124 -0
  129. package/templates/policies/permissive.yaml +40 -0
  130. package/templates/policies/standard.yaml +57 -0
  131. package/templates/policies/strict.yaml +72 -0
  132. package/templates/report-configs/compliance.yaml +173 -0
  133. package/templates/report-configs/dark.yaml +136 -0
  134. package/templates/report-configs/enterprise.yaml +175 -0
  135. package/templates/report-configs/minimal.yaml +84 -0
  136. package/templates/report-configs/print.yaml +139 -0
  137. package/templates/workflows/api-scan.yaml +132 -0
  138. package/templates/workflows/ci-gate.yaml +129 -0
  139. package/templates/workflows/full-scan.yaml +133 -0
  140. package/templates/workflows/quick-probe.yaml +80 -0
  141. package/templates/workflows/waf-detection.yaml +89 -0
package/payloads/community/ssrf/dns-rebinding.json ADDED
@@ -0,0 +1,503 @@
1
+ [
2
+ {
3
+ "id": "SSRF-DNS-001",
4
+ "payload": "http://127.0.0.1.nip.io/",
5
+ "tags": [
6
+ "dns-rebinding",
7
+ "nip.io",
8
+ "quick",
9
+ "critical"
10
+ ],
11
+ "expected_block": true,
12
+ "severity_hint": "Critical",
13
+ "notes": "nip.io DNS rebinding to localhost",
14
+ "category": "SSRF"
15
+ },
16
+ {
17
+ "id": "SSRF-DNS-002",
18
+ "payload": "http://169.254.169.254.nip.io/latest/meta-data/",
19
+ "tags": [
20
+ "dns-rebinding",
21
+ "nip.io",
22
+ "aws-imds",
23
+ "quick"
24
+ ],
25
+ "expected_block": true,
26
+ "severity_hint": "Critical",
27
+ "notes": "nip.io DNS rebinding to AWS IMDS",
28
+ "category": "SSRF"
29
+ },
30
+ {
31
+ "id": "SSRF-DNS-003",
32
+ "payload": "http://127.0.0.1.xip.io/",
33
+ "tags": [
34
+ "dns-rebinding",
35
+ "xip.io",
36
+ "quick"
37
+ ],
38
+ "expected_block": true,
39
+ "severity_hint": "Critical",
40
+ "notes": "xip.io DNS rebinding to localhost",
41
+ "category": "SSRF"
42
+ },
43
+ {
44
+ "id": "SSRF-DNS-004",
45
+ "payload": "http://169.254.169.254.xip.io/latest/meta-data/",
46
+ "tags": [
47
+ "dns-rebinding",
48
+ "xip.io",
49
+ "aws-imds"
50
+ ],
51
+ "expected_block": true,
52
+ "severity_hint": "Critical",
53
+ "notes": "xip.io DNS rebinding to AWS IMDS",
54
+ "category": "SSRF"
55
+ },
56
+ {
57
+ "id": "SSRF-DNS-005",
58
+ "payload": "http://localtest.me/",
59
+ "tags": [
60
+ "dns-rebinding",
61
+ "localtest",
62
+ "quick"
63
+ ],
64
+ "expected_block": true,
65
+ "severity_hint": "High",
66
+ "notes": "localtest.me DNS rebinding (resolves to 127.0.0.1)",
67
+ "category": "SSRF"
68
+ },
69
+ {
70
+ "id": "SSRF-DNS-006",
71
+ "payload": "http://localhost.localdomain/",
72
+ "tags": [
73
+ "dns-rebinding",
74
+ "localhost-variant"
75
+ ],
76
+ "expected_block": true,
77
+ "severity_hint": "High",
78
+ "notes": "localhost.localdomain variant",
79
+ "category": "SSRF"
80
+ },
81
+ {
82
+ "id": "SSRF-DNS-007",
83
+ "payload": "http://spoofed.burpcollaborator.net/",
84
+ "tags": [
85
+ "dns-rebinding",
86
+ "burp-collaborator"
87
+ ],
88
+ "expected_block": true,
89
+ "severity_hint": "High",
90
+ "notes": "Burp Collaborator DNS rebinding pattern",
91
+ "category": "SSRF"
92
+ },
93
+ {
94
+ "id": "SSRF-DNS-008",
95
+ "payload": "http://10.0.0.1.nip.io/",
96
+ "tags": [
97
+ "dns-rebinding",
98
+ "nip.io",
99
+ "private-network",
100
+ "quick"
101
+ ],
102
+ "expected_block": true,
103
+ "severity_hint": "Critical",
104
+ "notes": "nip.io DNS rebinding to RFC1918 10.x network",
105
+ "category": "SSRF"
106
+ },
107
+ {
108
+ "id": "SSRF-DNS-009",
109
+ "payload": "http://192.168.1.1.nip.io/",
110
+ "tags": [
111
+ "dns-rebinding",
112
+ "nip.io",
113
+ "private-network"
114
+ ],
115
+ "expected_block": true,
116
+ "severity_hint": "Critical",
117
+ "notes": "nip.io DNS rebinding to RFC1918 192.168.x network",
118
+ "category": "SSRF"
119
+ },
120
+ {
121
+ "id": "SSRF-DNS-010",
122
+ "payload": "http://172.16.0.1.nip.io/",
123
+ "tags": [
124
+ "dns-rebinding",
125
+ "nip.io",
126
+ "private-network"
127
+ ],
128
+ "expected_block": true,
129
+ "severity_hint": "Critical",
130
+ "notes": "nip.io DNS rebinding to RFC1918 172.16.x network",
131
+ "category": "SSRF"
132
+ },
133
+ {
134
+ "id": "SSRF-DNS-011",
135
+ "payload": "http://0x7f000001/",
136
+ "tags": [
137
+ "ip-obfuscation",
138
+ "hex",
139
+ "quick"
140
+ ],
141
+ "expected_block": true,
142
+ "severity_hint": "Critical",
143
+ "notes": "Hexadecimal IP representation of 127.0.0.1",
144
+ "category": "SSRF"
145
+ },
146
+ {
147
+ "id": "SSRF-DNS-012",
148
+ "payload": "http://2130706433/",
149
+ "tags": [
150
+ "ip-obfuscation",
151
+ "decimal",
152
+ "quick"
153
+ ],
154
+ "expected_block": true,
155
+ "severity_hint": "Critical",
156
+ "notes": "Decimal IP representation of 127.0.0.1",
157
+ "category": "SSRF"
158
+ },
159
+ {
160
+ "id": "SSRF-DNS-013",
161
+ "payload": "http://0177.0000.0000.0001/",
162
+ "tags": [
163
+ "ip-obfuscation",
164
+ "octal"
165
+ ],
166
+ "expected_block": true,
167
+ "severity_hint": "Critical",
168
+ "notes": "Octal IP representation of 127.0.0.1",
169
+ "category": "SSRF"
170
+ },
171
+ {
172
+ "id": "SSRF-DNS-014",
173
+ "payload": "http://127.1/",
174
+ "tags": [
175
+ "ip-obfuscation",
176
+ "shorthand",
177
+ "quick"
178
+ ],
179
+ "expected_block": true,
180
+ "severity_hint": "Critical",
181
+ "notes": "Shorthand IP notation for 127.0.0.1",
182
+ "category": "SSRF"
183
+ },
184
+ {
185
+ "id": "SSRF-DNS-015",
186
+ "payload": "http://0/",
187
+ "tags": [
188
+ "ip-obfuscation",
189
+ "zero",
190
+ "quick"
191
+ ],
192
+ "expected_block": true,
193
+ "severity_hint": "Critical",
194
+ "notes": "IP address 0 (can resolve to localhost)",
195
+ "category": "SSRF"
196
+ },
197
+ {
198
+ "id": "SSRF-DNS-016",
199
+ "payload": "http://[::1]/",
200
+ "tags": [
201
+ "ipv6",
202
+ "localhost",
203
+ "quick"
204
+ ],
205
+ "expected_block": true,
206
+ "severity_hint": "Critical",
207
+ "notes": "IPv6 localhost address",
208
+ "category": "SSRF"
209
+ },
210
+ {
211
+ "id": "SSRF-DNS-017",
212
+ "payload": "http://[::ffff:127.0.0.1]/",
213
+ "tags": [
214
+ "ipv6",
215
+ "ipv4-mapped",
216
+ "quick"
217
+ ],
218
+ "expected_block": true,
219
+ "severity_hint": "Critical",
220
+ "notes": "IPv4-mapped IPv6 address for 127.0.0.1",
221
+ "category": "SSRF"
222
+ },
223
+ {
224
+ "id": "SSRF-DNS-018",
225
+ "payload": "http://[0:0:0:0:0:ffff:169.254.169.254]/",
226
+ "tags": [
227
+ "ipv6",
228
+ "ipv4-mapped",
229
+ "aws-imds"
230
+ ],
231
+ "expected_block": true,
232
+ "severity_hint": "Critical",
233
+ "notes": "IPv4-mapped IPv6 for AWS IMDS",
234
+ "category": "SSRF"
235
+ },
236
+ {
237
+ "id": "SSRF-DNS-019",
238
+ "payload": "http://[::ffff:a9fe:a9fe]/",
239
+ "tags": [
240
+ "ipv6",
241
+ "ipv4-mapped",
242
+ "aws-imds"
243
+ ],
244
+ "expected_block": true,
245
+ "severity_hint": "Critical",
246
+ "notes": "IPv4-mapped IPv6 hex notation for AWS IMDS",
247
+ "category": "SSRF"
248
+ },
249
+ {
250
+ "id": "SSRF-DNS-020",
251
+ "payload": "http://make-127.0.0.1-rr.1u.ms/",
252
+ "tags": [
253
+ "dns-rebinding",
254
+ "custom-service"
255
+ ],
256
+ "expected_block": true,
257
+ "severity_hint": "High",
258
+ "notes": "Custom DNS rebinding service pattern",
259
+ "category": "SSRF"
260
+ },
261
+ {
262
+ "id": "SSRF-DNS-021",
263
+ "payload": "http://127.0.0.1.nip.io:8080/admin",
264
+ "tags": [
265
+ "dns-rebinding",
266
+ "nip.io",
267
+ "alt-port"
268
+ ],
269
+ "expected_block": true,
270
+ "severity_hint": "Critical",
271
+ "notes": "nip.io DNS rebinding with alternative port",
272
+ "category": "SSRF"
273
+ },
274
+ {
275
+ "id": "SSRF-DNS-022",
276
+ "payload": "http://169.254.169.254.xip.io:80/metadata",
277
+ "tags": [
278
+ "dns-rebinding",
279
+ "xip.io",
280
+ "metadata"
281
+ ],
282
+ "expected_block": true,
283
+ "severity_hint": "Critical",
284
+ "notes": "xip.io DNS rebinding to metadata endpoint",
285
+ "category": "SSRF"
286
+ },
287
+ {
288
+ "id": "SSRF-DNS-023",
289
+ "payload": "http://127.0.0.1.sslip.io/",
290
+ "tags": [
291
+ "dns-rebinding",
292
+ "sslip.io"
293
+ ],
294
+ "expected_block": true,
295
+ "severity_hint": "High",
296
+ "notes": "sslip.io DNS rebinding to localhost",
297
+ "category": "SSRF"
298
+ },
299
+ {
300
+ "id": "SSRF-DNS-024",
301
+ "payload": "http://127.0.0.1.trafficpeak.stream/",
302
+ "tags": [
303
+ "dns-rebinding",
304
+ "custom-service"
305
+ ],
306
+ "expected_block": true,
307
+ "severity_hint": "High",
308
+ "notes": "Alternative DNS rebinding service",
309
+ "category": "SSRF"
310
+ },
311
+ {
312
+ "id": "SSRF-DNS-025",
313
+ "payload": "http://customer1.app.localhost.run/",
314
+ "tags": [
315
+ "dns-rebinding",
316
+ "subdomain-bypass"
317
+ ],
318
+ "expected_block": true,
319
+ "severity_hint": "Medium",
320
+ "notes": "Subdomain-based localhost bypass attempt",
321
+ "category": "SSRF"
322
+ },
323
+ {
324
+ "id": "SSRF-DNS-026",
325
+ "payload": "http://make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms/",
326
+ "tags": ["dns-rebinding", "1u.ms", "rr"],
327
+ "expected_block": true,
328
+ "severity_hint": "Critical",
329
+ "notes": "1u.ms DNS rebinding round-robin to AWS IMDS",
330
+ "category": "SSRF"
331
+ },
332
+ {
333
+ "id": "SSRF-DNS-027",
334
+ "payload": "http://make-127-0-0-1-rebind-169-254-169-254.1u.ms/",
335
+ "tags": ["dns-rebinding", "1u.ms", "localhost-rebind"],
336
+ "expected_block": true,
337
+ "severity_hint": "Critical",
338
+ "notes": "1u.ms DNS rebinding localhost to metadata",
339
+ "category": "SSRF"
340
+ },
341
+ {
342
+ "id": "SSRF-DNS-028",
343
+ "payload": "http://0.0.0.0/",
344
+ "tags": ["dns-rebinding", "all-interfaces", "bypass"],
345
+ "expected_block": true,
346
+ "severity_hint": "Critical",
347
+ "notes": "0.0.0.0 all-interfaces bypass",
348
+ "category": "SSRF"
349
+ },
350
+ {
351
+ "id": "SSRF-DNS-029",
352
+ "payload": "http://0.0.0.0:80/",
353
+ "tags": ["dns-rebinding", "all-interfaces", "port"],
354
+ "expected_block": true,
355
+ "severity_hint": "Critical",
356
+ "notes": "0.0.0.0 with explicit port",
357
+ "category": "SSRF"
358
+ },
359
+ {
360
+ "id": "SSRF-DNS-030",
361
+ "payload": "http://0.0.0.0.nip.io/",
362
+ "tags": ["dns-rebinding", "nip.io", "all-interfaces"],
363
+ "expected_block": true,
364
+ "severity_hint": "Critical",
365
+ "notes": "nip.io 0.0.0.0 all-interfaces bypass",
366
+ "category": "SSRF"
367
+ },
368
+ {
369
+ "id": "SSRF-DNS-031",
370
+ "payload": "http://a]@127.0.0.1/",
371
+ "tags": ["dns-rebinding", "url-parsing", "bracket"],
372
+ "expected_block": true,
373
+ "severity_hint": "Critical",
374
+ "notes": "URL parser confusion with bracket",
375
+ "category": "SSRF"
376
+ },
377
+ {
378
+ "id": "SSRF-DNS-032",
379
+ "payload": "http://localhost#@evil.com/",
380
+ "tags": ["dns-rebinding", "url-parsing", "fragment"],
381
+ "expected_block": true,
382
+ "severity_hint": "Critical",
383
+ "notes": "URL parser confusion with fragment and @",
384
+ "category": "SSRF"
385
+ },
386
+ {
387
+ "id": "SSRF-DNS-033",
388
+ "payload": "http://127.0.0.1%0d%0a.evil.com/",
389
+ "tags": ["dns-rebinding", "crlf", "injection"],
390
+ "expected_block": true,
391
+ "severity_hint": "Critical",
392
+ "notes": "CRLF injection in hostname",
393
+ "category": "SSRF"
394
+ },
395
+ {
396
+ "id": "SSRF-DNS-034",
397
+ "payload": "http://127.0.0.1\\@evil.com/",
398
+ "tags": ["dns-rebinding", "backslash", "url-parsing"],
399
+ "expected_block": true,
400
+ "severity_hint": "Critical",
401
+ "notes": "Backslash URL parsing confusion",
402
+ "category": "SSRF"
403
+ },
404
+ {
405
+ "id": "SSRF-DNS-035",
406
+ "payload": "http://127.0.0.1%00.evil.com/",
407
+ "tags": ["dns-rebinding", "null-byte", "truncation"],
408
+ "expected_block": true,
409
+ "severity_hint": "Critical",
410
+ "notes": "Null byte hostname truncation",
411
+ "category": "SSRF"
412
+ },
413
+ {
414
+ "id": "SSRF-DNS-036",
415
+ "payload": "http://[::]",
416
+ "tags": ["dns-rebinding", "ipv6", "localhost"],
417
+ "expected_block": true,
418
+ "severity_hint": "Critical",
419
+ "notes": "IPv6 localhost shorthand",
420
+ "category": "SSRF"
421
+ },
422
+ {
423
+ "id": "SSRF-DNS-037",
424
+ "payload": "http://[::1]",
425
+ "tags": ["dns-rebinding", "ipv6", "loopback"],
426
+ "expected_block": true,
427
+ "severity_hint": "Critical",
428
+ "notes": "IPv6 loopback address",
429
+ "category": "SSRF"
430
+ },
431
+ {
432
+ "id": "SSRF-DNS-038",
433
+ "payload": "http://[0:0:0:0:0:0:0:1]/",
434
+ "tags": ["dns-rebinding", "ipv6", "full-loopback"],
435
+ "expected_block": true,
436
+ "severity_hint": "Critical",
437
+ "notes": "IPv6 full loopback notation",
438
+ "category": "SSRF"
439
+ },
440
+ {
441
+ "id": "SSRF-DNS-039",
442
+ "payload": "http://[0:0:0:0:0:ffff:127.0.0.1]/",
443
+ "tags": ["dns-rebinding", "ipv6", "mapped-ipv4"],
444
+ "expected_block": true,
445
+ "severity_hint": "Critical",
446
+ "notes": "IPv6 mapped IPv4 localhost",
447
+ "category": "SSRF"
448
+ },
449
+ {
450
+ "id": "SSRF-DNS-040",
451
+ "payload": "http://[::ffff:127.0.0.1]/",
452
+ "tags": ["dns-rebinding", "ipv6", "mapped-short"],
453
+ "expected_block": true,
454
+ "severity_hint": "Critical",
455
+ "notes": "IPv6 mapped IPv4 localhost short form",
456
+ "category": "SSRF"
457
+ },
458
+ {
459
+ "id": "SSRF-DNS-041",
460
+ "payload": "http://[::ffff:169.254.169.254]/",
461
+ "tags": ["dns-rebinding", "ipv6", "mapped-imds"],
462
+ "expected_block": true,
463
+ "severity_hint": "Critical",
464
+ "notes": "IPv6 mapped AWS IMDS",
465
+ "category": "SSRF"
466
+ },
467
+ {
468
+ "id": "SSRF-DNS-042",
469
+ "payload": "http://127.1/",
470
+ "tags": ["dns-rebinding", "shorthand", "localhost"],
471
+ "expected_block": true,
472
+ "severity_hint": "Critical",
473
+ "notes": "Shorthand localhost IP",
474
+ "category": "SSRF"
475
+ },
476
+ {
477
+ "id": "SSRF-DNS-043",
478
+ "payload": "http://127.0.1/",
479
+ "tags": ["dns-rebinding", "shorthand", "three-octet"],
480
+ "expected_block": true,
481
+ "severity_hint": "Critical",
482
+ "notes": "Three-octet localhost shorthand",
483
+ "category": "SSRF"
484
+ },
485
+ {
486
+ "id": "SSRF-DNS-044",
487
+ "payload": "http://127.127.127.127/",
488
+ "tags": ["dns-rebinding", "loopback-range"],
489
+ "expected_block": true,
490
+ "severity_hint": "Critical",
491
+ "notes": "Alternative loopback address",
492
+ "category": "SSRF"
493
+ },
494
+ {
495
+ "id": "SSRF-DNS-045",
496
+ "payload": "http://myservice.localhost/",
497
+ "tags": ["dns-rebinding", "localhost-subdomain"],
498
+ "expected_block": true,
499
+ "severity_hint": "Critical",
500
+ "notes": "Subdomain of localhost bypass",
501
+ "category": "SSRF"
502
+ }
503
+ ]