sj

sj Swagger Jacker sj 是一款命令行工具，旨在通过检查关联的 API 端点是否存在弱身份验证，来协助审计暴露的 Swagger/OpenAPI 定义文件。它还提供用于手动漏洞测试的命令模板。 它通过解析定义文件中的路径、参数和可接受的方法，然后将结果用于以下五个子命令之一： automate - 构造一系列请求并分析响应的状态码。 prepare - 生成用于手动测试的命令列表。 endpoints - 生成原始 API 路由列表。 路径值不会替换为测试数据 。 brute - 向目标发送一系列请求，以基于常用文件路径查找操作定义。 convert -...

BIT-ELASTICSEARCH-2025-37727 Elasticsearch Insertion of sensitive information in log file

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex...

Cloud Native Application Development Enables New Levels of Security Visibility and Control

We are in unique times and it’s important to support each other through unique ways. Snyk is providing a community effort to make a difference through AllTheTalks.online, and Trend Micro is proud to be a sponsor of their virtual fundraiser and tech conference. In today’s threat landscape new clou...