Coraza has Cookie Parser Confusion

Summary Coraza's cookie parser internal/cookies.ParseCookies does not strip ASCII control characters CTLs from the edges of a cookie name/value before they're matched against REQUESTCOOKIES / REQUESTCOOKIESNAMES. When a CTL sits directly next to the = separator, Coraza absorbs it into the adjacen...

GHSA-G4QM-M288-5CP9 Coraza has Cookie Parser Confusion

Summary Coraza's cookie parser internal/cookies.ParseCookies does not strip ASCII control characters CTLs from the edges of a cookie name/value before they're matched against REQUESTCOOKIES / REQUESTCOOKIESNAMES. When a CTL sits directly next to the = separator, Coraza absorbs it into the adjacen...

PatrowlHears

Codacy Badge PatrowlHears PatrOwl 提供可扩展、免费且开源的解决方案，用于编排安全运营和提供威胁情报源。PatrowlHears 是一个先进且实时的漏洞情报平台，包含 CVE、漏洞利用和威胁新闻。 立即尝试！ 要尝试 PatrowlHears，请阅读 安装指南 进行安装。 架构 PatrowlHears 完全使用 Python 开发，由基于出色 Django 框架的后端应用和基于 Vue.js + Vuetify 的前端组成。异步任务和引擎的可扩展性由 RabbitMQ 和 Celery 支持。 PatrowlHears 的功能和数据可通过内置的 WEB...

Smap

由 shodan.io 驱动的 nmap 替代品 Smap 是一款基于 shodan.io 免费 API 构建的被动端口扫描器。它接受与 Nmap 相同的命令行参数，并产生相同的输出，因此可以作为 Nmap 的直接替代品。 功能 每秒扫描 200 台主机 无需任何账户/API 密钥 漏洞检测 支持 nmap 的输出格式 服务与版本指纹识别 在被动模式下不与目标进行任何接触 可选：使用 Shodan 报告的端口加速 nmap 安装 二进制文件 你可以从 这里 下载预构建的二进制文件并立即使用。 手动安装 go install -v...

cottage

cott age is a GitOps tool for teams to manage age-encrypted secrets in git repositories. It provides a simple workflow to encrypt/decrypt secrets, manage recipients, and keep secrets out of the repo while still allowing for easy sharing via VCS. cottage also generates redacted previews of encrypt...

Malicious code in @kxafunc/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629c665fbfef767c56d24af935d38312f7aa88d1c71d9dfb8c427192e54add0b package.json aliases the libsignal dependency to npm:@bellaxchuu/libsignal-node@latest — a non-standard publisher pinned to the mutable latest dist-t...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

GHSA-X26Q-WVHG-FH4M Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Root Cause File: internal/corazawaf/transaction.go, lines 834–866. go parsedURL, err := url.ParseRequestURIuri query := "" if err != nil tx.variables.urlencodedError.Seterr.Error path = uri tx.variables.requestURI.Seturi / tx.Variables.VARIABLEURIPARSEERROR.Set"1" posRawQuery := strings.Indexuri,...

GHSA-PC5Q-QFXP-GGQV Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Summary The t:jsDecode transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing strconv.ParseInt to fail for every octal escape sequence and return a null byte instead of the...

seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Summary The t:jsDecode transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing strconv.ParseInt to fail for every octal escape sequence and return a null byte instead of the...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Summary The JSON body processor internal/bodyprocessors/json.go can be made to crash the whole process with an unrecoverable fatal error: stack overflow, using a request body that is well under the recommended SecRequestBodyLimit and the default SecArgumentsLimit. Root cause readJSON...

GHSA-6GCQ-WC29-5XF2 Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Summary The JSON body processor internal/bodyprocessors/json.go can be made to crash the whole process with an unrecoverable fatal error: stack overflow, using a request body that is well under the recommended SecRequestBodyLimit and the default SecArgumentsLimit. Root cause readJSON...

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGSPOST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious val...

GHSA-5GJ4-9GM7-2FX2 Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGSPOST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious val...

deadfinder

Find dead-links broken links Documentation • Installation • Github Action • Contributing • Changelog Dead link broken link means a link within a web page that cannot be connected. These links can have a negative impact to SEO and Security. This tool makes it easy to identify and modify. Looking f...

deadfinder

Find dead-links broken links Documentation • Installation • Github Action • Contributing • Changelog Dead link broken link means a link within a web page that cannot be connected. These links can have a negative impact to SEO and Security. This tool makes it easy to identify and modify. Looking f...

DNSHighJackMonitoring

Monitoreo de Secuestro de DNS Descripción general Scripts de trade craft para ayudar a detectar intentos de secuestro de DNS tras las revelaciones de enero de 2019 https://www.us-cert.gov/ncas/alerts/AA19-024A https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html...