@waftester/cli 2.9.45 → 2.9.47

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/README.md +2 -2
  2. package/package.json +7 -7
  3. package/presets/gitlab.json +36 -0
  4. package/presets/grafana.json +30 -0
  5. package/presets/jenkins.json +30 -0
  6. package/presets/jira.json +31 -0
  7. package/presets/keycloak.json +32 -0
  8. package/presets/nextcloud.json +33 -0
  9. package/presets/sonarqube.json +30 -0
  10. package/presets/wordpress.json +31 -0
package/README.md CHANGED
@@ -111,7 +111,7 @@ waf-tester discover -u https://automation.example.com -service n8n
111
111
  WAF_TESTER_PRESET_DIR=./my-presets waf-tester auto -u https://target.com -service myapp
112
112
  ```
113
113
 
114
- Built-in presets: `authentik`, `n8n`, `immich`, `webapp`, `intranet`. Create custom presets by adding JSON files — see the [Examples Guide](https://github.com/waftester/waftester/blob/main/docs/EXAMPLES.md#service-presets).
114
+ Built-in presets: `authentik`, `gitlab`, `grafana`, `immich`, `intranet`, `jenkins`, `jira`, `keycloak`, `n8n`, `nextcloud`, `sonarqube`, `webapp`, `wordpress`. Create custom presets by adding JSON files — see the [Examples Guide](https://github.com/waftester/waftester/blob/main/docs/EXAMPLES.md#service-presets).
115
115
 
116
116
  ### Targeted Scanning
117
117
 
@@ -253,7 +253,7 @@ Use the official [WAFtester Action](https://github.com/marketplace/actions/wafte
253
253
 
254
254
  Also integrates with SonarQube, GitLab SAST, DefectDojo, Elasticsearch, Slack, Teams, PagerDuty, Jira, Azure DevOps, and OpenTelemetry.
255
255
 
256
- ## All 33 Commands
256
+ ## All 36 Commands
257
257
 
258
258
  | Command | Description |
259
259
  |---------|-------------|
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@waftester/cli",
3
- "version": "2.9.45",
3
+ "version": "2.9.47",
4
4
  "description": "WAFtester — the most comprehensive WAF testing CLI & MCP server",
5
5
  "license": "BUSL-1.1",
6
6
  "repository": {
@@ -44,11 +44,11 @@
44
44
  "node": ">=16"
45
45
  },
46
46
  "optionalDependencies": {
47
- "@waftester/darwin-x64": "2.9.45",
48
- "@waftester/darwin-arm64": "2.9.45",
49
- "@waftester/linux-x64": "2.9.45",
50
- "@waftester/linux-arm64": "2.9.45",
51
- "@waftester/win32-x64": "2.9.45",
52
- "@waftester/win32-arm64": "2.9.45"
47
+ "@waftester/darwin-x64": "2.9.47",
48
+ "@waftester/darwin-arm64": "2.9.47",
49
+ "@waftester/linux-x64": "2.9.47",
50
+ "@waftester/linux-arm64": "2.9.47",
51
+ "@waftester/win32-x64": "2.9.47",
52
+ "@waftester/win32-arm64": "2.9.47"
53
53
  }
54
54
  }
package/presets/gitlab.json ADDED
@@ -0,0 +1,36 @@
1
+ {
2
+ "name": "gitlab",
3
+ "description": "GitLab self-hosted DevOps platform — API v4, GraphQL, OAuth, container registry",
4
+ "endpoints": [
5
+ "/users/sign_in",
6
+ "/users/sign_up",
7
+ "/users/password/new",
8
+ "/api/v4/projects",
9
+ "/api/v4/users",
10
+ "/api/v4/groups",
11
+ "/api/v4/namespaces",
12
+ "/api/v4/runners",
13
+ "/api/v4/jobs",
14
+ "/api/v4/pipelines",
15
+ "/api/v4/snippets",
16
+ "/-/graphql",
17
+ "/oauth/authorize",
18
+ "/oauth/token",
19
+ "/admin/",
20
+ "/explore",
21
+ "/search",
22
+ "/uploads/",
23
+ "/v2/",
24
+ "/-/health",
25
+ "/-/readiness",
26
+ "/-/liveness"
27
+ ],
28
+ "attack_surface": {
29
+ "has_auth_endpoints": true,
30
+ "has_api_endpoints": true,
31
+ "has_file_upload": true,
32
+ "has_oauth": true,
33
+ "has_graphql": true,
34
+ "has_websockets": true
35
+ }
36
+ }
package/presets/grafana.json ADDED
@@ -0,0 +1,30 @@
1
+ {
2
+ "name": "grafana",
3
+ "description": "Grafana observability platform — dashboards, data sources, alerting API",
4
+ "endpoints": [
5
+ "/login",
6
+ "/logout",
7
+ "/api/login/ping",
8
+ "/api/org/",
9
+ "/api/orgs/",
10
+ "/api/users/",
11
+ "/api/dashboards/",
12
+ "/api/datasources/",
13
+ "/api/alerts/",
14
+ "/api/alert-notifications/",
15
+ "/api/annotations/",
16
+ "/api/search",
17
+ "/api/admin/",
18
+ "/api/plugins/",
19
+ "/api/folders/",
20
+ "/api/ruler/",
21
+ "/api/serviceaccounts/",
22
+ "/d/",
23
+ "/explore",
24
+ "/api/health"
25
+ ],
26
+ "attack_surface": {
27
+ "has_auth_endpoints": true,
28
+ "has_api_endpoints": true
29
+ }
30
+ }
package/presets/jenkins.json ADDED
@@ -0,0 +1,30 @@
1
+ {
2
+ "name": "jenkins",
3
+ "description": "Jenkins CI/CD server — Script Console, REST API, CLI, job management",
4
+ "endpoints": [
5
+ "/login",
6
+ "/j_security_check",
7
+ "/logout",
8
+ "/api/json",
9
+ "/api/xml",
10
+ "/script",
11
+ "/scriptText",
12
+ "/manage",
13
+ "/configSubmit",
14
+ "/cli",
15
+ "/job/",
16
+ "/queue/api/json",
17
+ "/computer/api/json",
18
+ "/credentials/",
19
+ "/pluginManager/",
20
+ "/securityRealm/",
21
+ "/administrativeMonitor/",
22
+ "/crumbIssuer/api/json",
23
+ "/whoAmI/api/json",
24
+ "/user/"
25
+ ],
26
+ "attack_surface": {
27
+ "has_auth_endpoints": true,
28
+ "has_api_endpoints": true
29
+ }
30
+ }
package/presets/jira.json ADDED
@@ -0,0 +1,31 @@
1
+ {
2
+ "name": "jira",
3
+ "description": "Jira project management — REST API v2/v3, Agile API, admin, attachments",
4
+ "endpoints": [
5
+ "/login.jsp",
6
+ "/rest/api/2/issue/",
7
+ "/rest/api/2/search",
8
+ "/rest/api/2/user",
9
+ "/rest/api/2/project",
10
+ "/rest/api/2/dashboard",
11
+ "/rest/api/2/filter",
12
+ "/rest/api/2/field",
13
+ "/rest/api/2/configuration",
14
+ "/rest/api/2/serverInfo",
15
+ "/rest/api/2/myself",
16
+ "/rest/api/2/permissions",
17
+ "/rest/agile/1.0/board",
18
+ "/rest/agile/1.0/sprint",
19
+ "/rest/auth/1/session",
20
+ "/secure/admin/",
21
+ "/secure/Dashboard.jspa",
22
+ "/secure/ManageFilters.jspa",
23
+ "/plugins/servlet/",
24
+ "/status"
25
+ ],
26
+ "attack_surface": {
27
+ "has_auth_endpoints": true,
28
+ "has_api_endpoints": true,
29
+ "has_file_upload": true
30
+ }
31
+ }
package/presets/keycloak.json ADDED
@@ -0,0 +1,32 @@
1
+ {
2
+ "name": "keycloak",
3
+ "description": "Keycloak IAM — OpenID Connect, SAML, user federation, admin console",
4
+ "endpoints": [
5
+ "/auth/",
6
+ "/auth/admin/",
7
+ "/auth/realms/master/",
8
+ "/auth/realms/master/protocol/openid-connect/auth",
9
+ "/auth/realms/master/protocol/openid-connect/token",
10
+ "/auth/realms/master/protocol/openid-connect/userinfo",
11
+ "/auth/realms/master/protocol/openid-connect/certs",
12
+ "/auth/realms/master/protocol/saml",
13
+ "/auth/realms/master/account/",
14
+ "/auth/realms/master/clients-registrations/",
15
+ "/auth/realms/master/.well-known/openid-configuration",
16
+ "/auth/admin/realms/",
17
+ "/auth/admin/serverinfo",
18
+ "/auth/resources/",
19
+ "/realms/master/",
20
+ "/realms/master/protocol/openid-connect/token",
21
+ "/admin/",
22
+ "/health",
23
+ "/health/ready",
24
+ "/health/live"
25
+ ],
26
+ "attack_surface": {
27
+ "has_auth_endpoints": true,
28
+ "has_api_endpoints": true,
29
+ "has_oauth": true,
30
+ "has_saml": true
31
+ }
32
+ }
package/presets/nextcloud.json ADDED
@@ -0,0 +1,33 @@
1
+ {
2
+ "name": "nextcloud",
3
+ "description": "Nextcloud file sharing and collaboration — WebDAV, OCS API, app ecosystem",
4
+ "endpoints": [
5
+ "/login",
6
+ "/index.php/login",
7
+ "/remote.php/dav/",
8
+ "/remote.php/webdav/",
9
+ "/ocs/v2.php/cloud/users",
10
+ "/ocs/v2.php/cloud/groups",
11
+ "/ocs/v2.php/apps/files_sharing/api/v1/shares",
12
+ "/ocs/v2.php/core/getapppassword",
13
+ "/ocs/v1.php/cloud/capabilities",
14
+ "/apps/",
15
+ "/apps/files/",
16
+ "/apps/gallery/",
17
+ "/status.php",
18
+ "/cron.php",
19
+ "/index.php/settings/admin",
20
+ "/index.php/settings/personal",
21
+ "/index.php/core/preview",
22
+ "/index.php/apps/files/ajax/upload.php",
23
+ "/public.php",
24
+ "/.well-known/caldav",
25
+ "/.well-known/carddav"
26
+ ],
27
+ "attack_surface": {
28
+ "has_auth_endpoints": true,
29
+ "has_api_endpoints": true,
30
+ "has_file_upload": true,
31
+ "has_websockets": true
32
+ }
33
+ }
package/presets/sonarqube.json ADDED
@@ -0,0 +1,30 @@
1
+ {
2
+ "name": "sonarqube",
3
+ "description": "SonarQube code quality platform — Web API, project analysis, admin",
4
+ "endpoints": [
5
+ "/sessions/new",
6
+ "/api/authentication/login",
7
+ "/api/authentication/logout",
8
+ "/api/authentication/validate",
9
+ "/api/system/status",
10
+ "/api/system/health",
11
+ "/api/system/info",
12
+ "/api/server/version",
13
+ "/api/users/search",
14
+ "/api/projects/search",
15
+ "/api/components/search",
16
+ "/api/issues/search",
17
+ "/api/rules/search",
18
+ "/api/qualityprofiles/search",
19
+ "/api/qualitygates/list",
20
+ "/api/settings/values",
21
+ "/api/plugins/installed",
22
+ "/api/webservices/list",
23
+ "/api/ce/activity",
24
+ "/api/measures/component"
25
+ ],
26
+ "attack_surface": {
27
+ "has_auth_endpoints": true,
28
+ "has_api_endpoints": true
29
+ }
30
+ }
package/presets/wordpress.json ADDED
@@ -0,0 +1,31 @@
1
+ {
2
+ "name": "wordpress",
3
+ "description": "WordPress CMS — login, REST API, XML-RPC, admin, uploads",
4
+ "endpoints": [
5
+ "/wp-login.php",
6
+ "/wp-admin/",
7
+ "/wp-admin/admin-ajax.php",
8
+ "/wp-admin/admin-post.php",
9
+ "/xmlrpc.php",
10
+ "/wp-json/",
11
+ "/wp-json/wp/v2/users",
12
+ "/wp-json/wp/v2/posts",
13
+ "/wp-json/wp/v2/pages",
14
+ "/wp-json/wp/v2/media",
15
+ "/wp-json/wp/v2/comments",
16
+ "/wp-json/wp/v2/settings",
17
+ "/wp-content/uploads/",
18
+ "/wp-includes/",
19
+ "/wp-cron.php",
20
+ "/wp-signup.php",
21
+ "/wp-trackback.php",
22
+ "/?author=1",
23
+ "/?rest_route=/",
24
+ "/feed/"
25
+ ],
26
+ "attack_surface": {
27
+ "has_auth_endpoints": true,
28
+ "has_api_endpoints": true,
29
+ "has_file_upload": true
30
+ }
31
+ }