blitzstrike 2.4.67 → 2.4.69
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +39 -0
- package/dist/index.js +423 -103
- package/intelligence/cwe_map.json +321 -63
- package/intelligence/patterns.json +511 -100
- package/intelligence/variants.json +28 -1
- package/package.json +1 -1
|
@@ -1,67 +1,325 @@
|
|
|
1
1
|
{
|
|
2
2
|
"_comment": "Technique class -> CWE mapping (standard weakness IDs, for grounding + professional reporting). Each entry maps a techniques.json class id to its CWE ID(s) and name.",
|
|
3
3
|
"mapping": [
|
|
4
|
-
{
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
{
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
{
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
{
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
{
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
{
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
{
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
{
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
{
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
{
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
{
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
{
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
{
|
|
65
|
-
|
|
4
|
+
{
|
|
5
|
+
"id": "ssrf",
|
|
6
|
+
"cwe": "CWE-918",
|
|
7
|
+
"name": "Server-Side Request Forgery (SSRF)"
|
|
8
|
+
},
|
|
9
|
+
{
|
|
10
|
+
"id": "request_smuggling",
|
|
11
|
+
"cwe": "CWE-444",
|
|
12
|
+
"name": "Inconsistent Interpretation of HTTP Requests (Request Smuggling)"
|
|
13
|
+
},
|
|
14
|
+
{
|
|
15
|
+
"id": "cache_poisoning",
|
|
16
|
+
"cwe": "CWE-524",
|
|
17
|
+
"name": "Use of Cache Containing Sensitive Information"
|
|
18
|
+
},
|
|
19
|
+
{
|
|
20
|
+
"id": "race_condition",
|
|
21
|
+
"cwe": "CWE-362",
|
|
22
|
+
"name": "Concurrent Execution using Shared Resource (TOCTOU)"
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"id": "ssti",
|
|
26
|
+
"cwe": "CWE-1336",
|
|
27
|
+
"name": "Improper Neutralization of Special Elements Used in a Template Engine (SSTI)"
|
|
28
|
+
},
|
|
29
|
+
{
|
|
30
|
+
"id": "deserialization",
|
|
31
|
+
"cwe": "CWE-502",
|
|
32
|
+
"name": "Deserialization of Untrusted Data"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "prototype_pollution",
|
|
36
|
+
"cwe": "CWE-1321",
|
|
37
|
+
"name": "Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)"
|
|
38
|
+
},
|
|
39
|
+
{
|
|
40
|
+
"id": "mass_assignment",
|
|
41
|
+
"cwe": "CWE-915",
|
|
42
|
+
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
|
|
43
|
+
},
|
|
44
|
+
{
|
|
45
|
+
"id": "sql_injection",
|
|
46
|
+
"cwe": "CWE-89",
|
|
47
|
+
"name": "SQL Injection"
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"id": "nosql_injection",
|
|
51
|
+
"cwe": "CWE-943",
|
|
52
|
+
"name": "Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)"
|
|
53
|
+
},
|
|
54
|
+
{
|
|
55
|
+
"id": "xss",
|
|
56
|
+
"cwe": "CWE-79",
|
|
57
|
+
"name": "Cross-site Scripting"
|
|
58
|
+
},
|
|
59
|
+
{
|
|
60
|
+
"id": "cors",
|
|
61
|
+
"cwe": "CWE-942",
|
|
62
|
+
"name": "Permissive Cross-domain Policy with Untrusted Domains (CORS)"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "csrf",
|
|
66
|
+
"cwe": "CWE-352",
|
|
67
|
+
"name": "Cross-Site Request Forgery"
|
|
68
|
+
},
|
|
69
|
+
{
|
|
70
|
+
"id": "jwt",
|
|
71
|
+
"cwe": "CWE-347",
|
|
72
|
+
"name": "Improper Verification of Cryptographic Signature"
|
|
73
|
+
},
|
|
74
|
+
{
|
|
75
|
+
"id": "oauth",
|
|
76
|
+
"cwe": "CWE-287",
|
|
77
|
+
"name": "Improper Authentication"
|
|
78
|
+
},
|
|
79
|
+
{
|
|
80
|
+
"id": "host_header",
|
|
81
|
+
"cwe": "CWE-644",
|
|
82
|
+
"name": "Improper Neutralization of HTTP Headers for Scripting Syntax (Host Header)"
|
|
83
|
+
},
|
|
84
|
+
{
|
|
85
|
+
"id": "open_redirect",
|
|
86
|
+
"cwe": "CWE-601",
|
|
87
|
+
"name": "URL Redirection to Untrusted Site (Open Redirect)"
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
"id": "subdomain_takeover",
|
|
91
|
+
"cwe": "CWE-350",
|
|
92
|
+
"name": "Reliance on Reverse DNS Resolution for a Security-Critical Action"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "idor",
|
|
96
|
+
"cwe": "CWE-639",
|
|
97
|
+
"name": "Authorization Bypass Through User-Controlled Key (IDOR/BOLA)"
|
|
98
|
+
},
|
|
99
|
+
{
|
|
100
|
+
"id": "graphql",
|
|
101
|
+
"cwe": "CWE-862",
|
|
102
|
+
"name": "Missing Authorization"
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
"id": "websocket",
|
|
106
|
+
"cwe": "CWE-345",
|
|
107
|
+
"name": "Insufficient Verification of Data Authenticity (WebSocket Hijacking)"
|
|
108
|
+
},
|
|
109
|
+
{
|
|
110
|
+
"id": "file_upload",
|
|
111
|
+
"cwe": "CWE-434",
|
|
112
|
+
"name": "Unrestricted Upload of File with Dangerous Type"
|
|
113
|
+
},
|
|
114
|
+
{
|
|
115
|
+
"id": "path_traversal_lfi",
|
|
116
|
+
"cwe": "CWE-22",
|
|
117
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"
|
|
118
|
+
},
|
|
119
|
+
{
|
|
120
|
+
"id": "command_injection",
|
|
121
|
+
"cwe": "CWE-78",
|
|
122
|
+
"name": "OS Command Injection"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "xxe",
|
|
126
|
+
"cwe": "CWE-611",
|
|
127
|
+
"name": "Improper Restriction of XML External Entity Reference (XXE)"
|
|
128
|
+
},
|
|
129
|
+
{
|
|
130
|
+
"id": "crlf_injection",
|
|
131
|
+
"cwe": "CWE-93",
|
|
132
|
+
"name": "Improper Neutralization of CRLF Sequences (CRLF Injection)"
|
|
133
|
+
},
|
|
134
|
+
{
|
|
135
|
+
"id": "ldap_injection",
|
|
136
|
+
"cwe": "CWE-90",
|
|
137
|
+
"name": "Improper Neutralization of Special Elements in LDAP Queries"
|
|
138
|
+
},
|
|
139
|
+
{
|
|
140
|
+
"id": "xpath_injection",
|
|
141
|
+
"cwe": "CWE-643",
|
|
142
|
+
"name": "Improper Neutralization of Data within XPath Expressions"
|
|
143
|
+
},
|
|
144
|
+
{
|
|
145
|
+
"id": "xslt_injection",
|
|
146
|
+
"cwe": "CWE-91",
|
|
147
|
+
"name": "XML Injection (XSLT)"
|
|
148
|
+
},
|
|
149
|
+
{
|
|
150
|
+
"id": "ssi_injection",
|
|
151
|
+
"cwe": "CWE-97",
|
|
152
|
+
"name": "Improper Neutralization of Server-Side Includes (SSI)"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "xssi",
|
|
156
|
+
"cwe": "CWE-200",
|
|
157
|
+
"name": "Exposure of Sensitive Information to an Unauthorized Actor (XSSI)"
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
"id": "email_injection",
|
|
161
|
+
"cwe": "CWE-74",
|
|
162
|
+
"name": "Improper Neutralization of Special Elements in Output (Email Header Injection)"
|
|
163
|
+
},
|
|
164
|
+
{
|
|
165
|
+
"id": "formula_csv_injection",
|
|
166
|
+
"cwe": "CWE-1236",
|
|
167
|
+
"name": "Improper Neutralization of Formula Elements in a CSV File"
|
|
168
|
+
},
|
|
169
|
+
{
|
|
170
|
+
"id": "orm_injection",
|
|
171
|
+
"cwe": "CWE-89",
|
|
172
|
+
"name": "SQL Injection (via ORM)"
|
|
173
|
+
},
|
|
174
|
+
{
|
|
175
|
+
"id": "rsql_injection",
|
|
176
|
+
"cwe": "CWE-89",
|
|
177
|
+
"name": "SQL Injection (RSQL/FIQL)"
|
|
178
|
+
},
|
|
179
|
+
{
|
|
180
|
+
"id": "unicode_injection",
|
|
181
|
+
"cwe": "CWE-180",
|
|
182
|
+
"name": "Incorrect Behavior Order: Validate Before Canonicalize"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"id": "dangling_markup",
|
|
186
|
+
"cwe": "CWE-79",
|
|
187
|
+
"name": "Cross-site Scripting (Dangling Markup)"
|
|
188
|
+
},
|
|
189
|
+
{
|
|
190
|
+
"id": "account_takeover",
|
|
191
|
+
"cwe": "CWE-287",
|
|
192
|
+
"name": "Improper Authentication (Account Takeover)"
|
|
193
|
+
},
|
|
194
|
+
{
|
|
195
|
+
"id": "two_fa_bypass",
|
|
196
|
+
"cwe": "CWE-308",
|
|
197
|
+
"name": "Use of Single-factor Authentication"
|
|
198
|
+
},
|
|
199
|
+
{
|
|
200
|
+
"id": "rate_limit_bypass",
|
|
201
|
+
"cwe": "CWE-799",
|
|
202
|
+
"name": "Improper Control of Interaction Frequency (Rate Limit)"
|
|
203
|
+
},
|
|
204
|
+
{
|
|
205
|
+
"id": "password_reset_bypass",
|
|
206
|
+
"cwe": "CWE-640",
|
|
207
|
+
"name": "Weak Password Recovery Mechanism for Forgotten Password"
|
|
208
|
+
},
|
|
209
|
+
{
|
|
210
|
+
"id": "captcha_bypass",
|
|
211
|
+
"cwe": "CWE-804",
|
|
212
|
+
"name": "Guessable CAPTCHA"
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"id": "registration_vulnerabilities",
|
|
216
|
+
"cwe": "CWE-799",
|
|
217
|
+
"name": "Improper Control of Interaction Frequency"
|
|
218
|
+
},
|
|
219
|
+
{
|
|
220
|
+
"id": "payment_bypass",
|
|
221
|
+
"cwe": "CWE-841",
|
|
222
|
+
"name": "Improper Enforcement of Behavioral Workflow (Business Logic)"
|
|
223
|
+
},
|
|
224
|
+
{
|
|
225
|
+
"id": "timing_attacks",
|
|
226
|
+
"cwe": "CWE-208",
|
|
227
|
+
"name": "Observable Timing Discrepancy"
|
|
228
|
+
},
|
|
229
|
+
{
|
|
230
|
+
"id": "uuid_insecurities",
|
|
231
|
+
"cwe": "CWE-330",
|
|
232
|
+
"name": "Use of Insufficiently Random Values"
|
|
233
|
+
},
|
|
234
|
+
{
|
|
235
|
+
"id": "reverse_tab_nabbing",
|
|
236
|
+
"cwe": "CWE-1022",
|
|
237
|
+
"name": "Use of Web Link to Untrusted Target with window.opener Access (Reverse Tabnabbing)"
|
|
238
|
+
},
|
|
239
|
+
{
|
|
240
|
+
"id": "iframe_traps",
|
|
241
|
+
"cwe": "CWE-1021",
|
|
242
|
+
"name": "Improper Restriction of Rendered UI Layers or Frames (Clickjacking)"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "cookie_hacking",
|
|
246
|
+
"cwe": "CWE-565",
|
|
247
|
+
"name": "Reliance on Cookies without Validation and Integrity Checking"
|
|
248
|
+
},
|
|
249
|
+
{
|
|
250
|
+
"id": "postmessage_vulnerabilities",
|
|
251
|
+
"cwe": "CWE-345",
|
|
252
|
+
"name": "Insufficient Verification of Data Authenticity (postMessage)"
|
|
253
|
+
},
|
|
254
|
+
{
|
|
255
|
+
"id": "web_vulnerabilities_methodology",
|
|
256
|
+
"cwe": "CWE-1057",
|
|
257
|
+
"name": "Improper Inventory / Methodology"
|
|
258
|
+
},
|
|
259
|
+
{
|
|
260
|
+
"id": "missing_authz",
|
|
261
|
+
"cwe": "CWE-862",
|
|
262
|
+
"name": "Missing Authorization"
|
|
263
|
+
},
|
|
264
|
+
{
|
|
265
|
+
"id": "missing_nonce",
|
|
266
|
+
"cwe": "CWE-352",
|
|
267
|
+
"name": "Cross-Site Request Forgery (Missing Nonce)"
|
|
268
|
+
},
|
|
269
|
+
{
|
|
270
|
+
"id": "priv_esc",
|
|
271
|
+
"cwe": "CWE-269",
|
|
272
|
+
"name": "Improper Privilege Management"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "hardcoded_secret",
|
|
276
|
+
"cwe": "CWE-798",
|
|
277
|
+
"name": "Use of Hard-coded Credentials"
|
|
278
|
+
},
|
|
279
|
+
{
|
|
280
|
+
"id": "type_juggling",
|
|
281
|
+
"cwe": "CWE-697",
|
|
282
|
+
"name": "Incorrect Comparison"
|
|
283
|
+
},
|
|
284
|
+
{
|
|
285
|
+
"id": "path_confusion",
|
|
286
|
+
"cwe": "CWE-22",
|
|
287
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"
|
|
288
|
+
},
|
|
289
|
+
{
|
|
290
|
+
"id": "wrong_sanitizer",
|
|
291
|
+
"cwe": "CWE-20",
|
|
292
|
+
"name": "Improper Input Validation"
|
|
293
|
+
},
|
|
294
|
+
{
|
|
295
|
+
"id": "llm_injection",
|
|
296
|
+
"cwe": "CWE-77",
|
|
297
|
+
"name": "Improper Neutralization of Special Elements used in a Command (LLM Prompt Injection)"
|
|
298
|
+
},
|
|
299
|
+
{
|
|
300
|
+
"id": "graphql_exposure",
|
|
301
|
+
"cwe": "CWE-200",
|
|
302
|
+
"name": "Exposure of Sensitive Information"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"id": "oauth_misconfig",
|
|
306
|
+
"cwe": "CWE-601",
|
|
307
|
+
"name": "URL Redirection to Untrusted Site (Open Redirect)"
|
|
308
|
+
},
|
|
309
|
+
{
|
|
310
|
+
"id": "grpc_reflection",
|
|
311
|
+
"cwe": "CWE-200",
|
|
312
|
+
"name": "Exposure of Sensitive Information"
|
|
313
|
+
},
|
|
314
|
+
{
|
|
315
|
+
"id": "dependency_confusion",
|
|
316
|
+
"cwe": "CWE-427",
|
|
317
|
+
"name": "Uncontrolled Search Path Element"
|
|
318
|
+
},
|
|
319
|
+
{
|
|
320
|
+
"id": "ml_supply_chain",
|
|
321
|
+
"cwe": "CWE-502",
|
|
322
|
+
"name": "Deserialization of Untrusted Data"
|
|
323
|
+
}
|
|
66
324
|
]
|
|
67
|
-
}
|
|
325
|
+
}
|