@waftester/cli 2.8.0

package/payloads/community/traversal/symlink.json

@@ -0,0 +1,93 @@
+[
+  {
+      "id": "TRV-SYM-001",
+      "payload": "../../../tmp/symlink-to-etc/passwd",
+      "tags": [
+        "symlink",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Symlink traversal through /tmp",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-SYM-002",
+      "payload": "../../../proc/self/root/etc/passwd",
+      "tags": [
+        "symlink",
+        "proc",
+        "unix",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Symlink via /proc/self/root recursion",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-SYM-003",
+      "payload": "../../../var/www/uploads/../../../etc/passwd",
+      "tags": [
+        "symlink",
+        "chain",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Symlink chain through uploads directory",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-SYM-004",
+      "payload": "C:\\Users\\Public\\Documents\\junction\\..\\..\\..\\Windows\\System32\\config\\sam",
+      "tags": [
+        "symlink",
+        "junction",
+        "windows"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows junction point traversal",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-SYM-005",
+      "payload": "../../../proc/self/cwd/../../../etc/passwd",
+      "tags": [
+        "symlink",
+        "cwd",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Current working directory symlink",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-SYM-006",
+      "payload": "../../../proc/self/fd/3",
+      "tags": [
+        "symlink",
+        "fd",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "File descriptor symlink access",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-SYM-007",
+      "payload": "../../../var/lib/docker/overlay2/symlink/../../etc/passwd",
+      "tags": [
+        "symlink",
+        "docker",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Docker overlay filesystem symlink",
+      "category": "Traversal"
+  }
+]

package/payloads/community/traversal/unicode.json

@@ -0,0 +1,134 @@
+[
+  {
+      "id": "TRV-UNI-001",
+      "payload": "..․/.․./.․./etc/passwd",
+      "tags": [
+        "unicode",
+        "dots",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Unicode one dot leader (U+2024)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-002",
+      "payload": "..︒..︒..︒etc︒passwd",
+      "tags": [
+        "unicode",
+        "separator",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Unicode presentation form for vertical two dot leader (U+FE52)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-003",
+      "payload": "．．／．．／．．／etc／passwd",
+      "tags": [
+        "unicode",
+        "fullwidth",
+        "unix",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Full-width period and solidus (U+FF0E, U+FF0F)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-004",
+      "payload": "..\\u2216..\\u2216..\\u2216etc\\u2216passwd",
+      "tags": [
+        "unicode",
+        "escape",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Unicode escape sequence for division slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-005",
+      "payload": "‥‥⁄‥‥⁄‥‥⁄etc⁄passwd",
+      "tags": [
+        "unicode",
+        "dots",
+        "fraction",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Two dot leader (U+2025) and fraction slash (U+2044)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-006",
+      "payload": "..⁄..⁄..⁄etc⁄passwd",
+      "tags": [
+        "unicode",
+        "fraction",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Fraction slash character (U+2044)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-007",
+      "payload": "..%u2215..%u2215..%u2215etc%u2215passwd",
+      "tags": [
+        "unicode",
+        "division",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Division slash (U+2215) with %u encoding",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-008",
+      "payload": "．．∕．．∕．．∕etc∕passwd",
+      "tags": [
+        "unicode",
+        "mixed",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Mixed full-width periods and division slash",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-009",
+      "payload": "../../../etc/passwd\u0000.jpg",
+      "tags": [
+        "unicode",
+        "null",
+        "unix"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Unicode null character (U+0000) for extension bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNI-010",
+      "payload": "..%c0%2e%c0%2e%c0%2fetc%c0%2fpasswd",
+      "tags": [
+        "unicode",
+        "overlong",
+        "mixed"
+    ],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Mixed overlong and normal encoding",
+      "category": "Traversal"
+  }
+]

package/payloads/community/traversal/unix-advanced.json

@@ -0,0 +1,195 @@
+[
+  {
+      "id": "TRV-UNIX-006",
+      "payload": "../../../etc/hosts",
+      "tags": [
+        "unix",
+        "network",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Unix hosts file containing network mappings",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-007",
+      "payload": "../../../../../../../../proc/self/environ",
+      "tags": [
+        "unix",
+        "process",
+        "environment"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Current process environment variables (8-level deep)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-008",
+      "payload": "../../../var/log/auth.log",
+      "tags": [
+        "unix",
+        "logs",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Authentication log file",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-009",
+      "payload": "../../../var/www/html/.htaccess",
+      "tags": [
+        "unix",
+        "web",
+        "config"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Apache configuration file",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-033",
+      "payload": "../../../home/user/.bash_history",
+      "tags": [
+        "unix",
+        "history",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "User command history file",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-034",
+      "payload": "/proc/version",
+      "tags": [
+        "unix",
+        "absolute",
+        "system"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Kernel version information (absolute path)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-035",
+      "payload": "../../../etc/crontab",
+      "tags": [
+        "unix",
+        "schedule",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "System-wide cron jobs",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-036",
+      "payload": "../../../var/log/nginx/access.log",
+      "tags": [
+        "unix",
+        "logs",
+        "nginx"
+    ],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Nginx access log",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-037",
+      "payload": "../../../usr/local/etc/php/php.ini",
+      "tags": [
+        "unix",
+        "config",
+        "php"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "PHP configuration file",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-038",
+      "payload": "../../../opt/app/.env.production",
+      "tags": [
+        "unix",
+        "env",
+        "production"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Production environment configuration",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-039",
+      "payload": "/etc/mysql/my.cnf",
+      "tags": [
+        "unix",
+        "database",
+        "absolute"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "MySQL configuration file (absolute path)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-040",
+      "payload": "../../../proc/self/cmdline",
+      "tags": [
+        "unix",
+        "process"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Current process command line",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-041",
+      "payload": "../../../../../../../../../../etc/passwd",
+      "tags": [
+        "unix",
+        "deep"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Extremely deep traversal (10 levels)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-042",
+      "payload": "../../../root/.bashrc",
+      "tags": [
+        "unix",
+        "config",
+        "root"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Root user shell configuration",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-UNIX-043",
+      "payload": "../etc/../etc/../etc/passwd",
+      "tags": [
+        "unix",
+        "redundant",
+        "obfuscation"
+    ],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Redundant directory traversal",
+      "category": "Traversal"
+  }
+]

package/payloads/community/traversal/windows-advanced.json

@@ -0,0 +1,195 @@
+[
+  {
+      "id": "TRV-WIN-003",
+      "payload": "..\\..\\..\\Windows\\win.ini",
+      "tags": [
+        "windows",
+        "config",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Windows initialization file",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-004",
+      "payload": "..\\..\\..\\..\\..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts",
+      "tags": [
+        "windows",
+        "network",
+        "deep"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Windows hosts file (8-level deep)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-005",
+      "payload": "C:\\inetpub\\wwwroot\\web.config",
+      "tags": [
+        "windows",
+        "iis",
+        "absolute"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "IIS web.config (absolute path)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-006",
+      "payload": "..\\..\\..\\Windows\\System32\\config\\system",
+      "tags": [
+        "windows",
+        "registry",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows SYSTEM registry hive",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-007",
+      "payload": "\\\\?\\C:\\Windows\\System32\\config\\sam",
+      "tags": [
+        "windows",
+        "unc",
+        "bypass"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "UNC path prefix bypass",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-008",
+      "payload": "..\\..\\..\\Program Files\\MyApp\\config.xml",
+      "tags": [
+        "windows",
+        "config"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Application configuration in Program Files",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-009",
+      "payload": "..\\..\\..\\Users\\Administrator\\.ssh\\id_rsa",
+      "tags": [
+        "windows",
+        "ssh",
+        "quick"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Administrator SSH private key",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-033",
+      "payload": "..\\..\\..\\Windows\\Panther\\unattend.xml",
+      "tags": [
+        "windows",
+        "install",
+        "credentials"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows unattended installation file (may contain passwords)",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-034",
+      "payload": "file.txt::$DATA",
+      "tags": [
+        "windows",
+        "ads",
+        "alternate-stream"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "Alternate Data Stream (ADS) access",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-035",
+      "payload": "..\\..\\..\\PROGRA~1\\MyApp\\config.ini",
+      "tags": [
+        "windows",
+        "short-name",
+        "8.3"
+    ],
+      "expected_block": true,
+      "severity_hint": "High",
+      "notes": "8.3 short filename format",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-036",
+      "payload": "C:\\$Recycle.Bin\\S-1-5-21\\deleted_file.docx",
+      "tags": [
+        "windows",
+        "recycle-bin",
+        "absolute"
+    ],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "Recycle Bin file access",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-037",
+      "payload": "..\\..\\..\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
+      "tags": [
+        "windows",
+        "startup"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Windows startup folder",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-038",
+      "payload": "..\\..\\..\\Windows\\Temp\\.env",
+      "tags": [
+        "windows",
+        "temp",
+        "env"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Environment file in Windows temp",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-039",
+      "payload": "\\\\.\\C:\\Windows\\System32\\config\\sam",
+      "tags": [
+        "windows",
+        "device",
+        "unc"
+    ],
+      "expected_block": true,
+      "severity_hint": "Critical",
+      "notes": "Device namespace path",
+      "category": "Traversal"
+  },
+  {
+      "id": "TRV-WIN-040",
+      "payload": "..\\..\\..\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*.log",
+      "tags": [
+        "windows",
+        "iis",
+        "logs"
+    ],
+      "expected_block": true,
+      "severity_hint": "Medium",
+      "notes": "IIS log files with wildcard",
+      "category": "Traversal"
+  }
+]