162 matches found
gotestwaf
GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...
CRSprober
CRSprober Descripción Esta herramienta detecta de forma remota la versión del OWASP Core Rule Set CRS utilizado por un WAF ModSecurity. También identifica el nivel de paranoia PL configurado del CRS, proporcionando información sobre la postura de seguridad del WAF sin requerir acceso local...
log4shell-coraza
Log4Shell Security Lab — nginx + Coraza WAF Propósito educativo / defensivo : este laboratorio contiene una aplicación deliberadamente vulnerable Log4j 2.14.1 y un kit de exploits JNDI, SOLO para aprender a detectar y bloquear Log4Shell en un entorno aislado. No lo despliegues a Internet, no lo...
web-threat-mitigation
web-threat-mitigation Laboratorio práctico sobre detección y mitigación de amenazas web utilizando OWASP ZAP, Burp Suite y ModSecurity WAF con OWASP CRS. Caso de estudio: Spring4Shell CVE-2022-22965. Configuración local basada en Docker. Laboratorio de Mitigación de Amenazas Web – OWASP ZAP,...
Drupal-Exploit-Lab
Drupal-Exploit-Lab 演示在存在漏洞的Drupal 7.57（CVE-2018-7600）上，有无WAF（Web应用防火墙）情况下的利用过程 描述 本项目展示了在两种不同场景下对Drupal 7.57进行利用的方式： 1. 未受保护的服务器 → 通过Metasploit成功利用并获取Meterpreter shell。 2. 受保护的服务器 → 相同存在漏洞的版本，但应用了保护措施（ModSecurity + OWASP CRS）→ 利用失败。 技术与工具 操作系统： Ubuntu Server 16.04（未受保护）、Ubuntu Server...
owasp-modsecurity-crs
CRS migrated to a new 🏠 ! The OWASP ModSecurity Core Rule Set CRS has moved to https://github.com/coreruleset/coreruleset. A note on this change: This project started at Trustwave SpiderLabs over ten years ago, it was created with the idea of making a free ruleset that anyone can use to get start...
CVE-2026-21876
CVE-2026-21876 bypass del WAF de OWASP CRS Contenedor Docker de CVE-2026-21876 + PoC mínimo. Quiero agradecer por separado a @airween y a @fzipi por su rápida respuesta. La corrección de la vulnerabilidad estuvo lista en muy poco tiempo. PoC Ejecutar: root@kitploit: cd springbootundertowstand or...
CVE-2026-21876
CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC root@kitploit: POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0...
OPENSUSE-SU-2026:11632-1 owasp-modsecurity-crs-4.29.0-1.1 on GA media
These are all security issues fixed in the owasp-modsecurity-crs-4.29.0-1.1 package on the GA media of openSUSE Tumbleweed...
Debian: Security Advisory (DLA-4488-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DLA-4488-1 modsecurity-crs - security update
Bulletin has no description...
Amazon Linux 2023 : mod_security_crs (ALAS2023-2026-1399)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1399 advisory. The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when...
Debian: Security Advisory (DSA-6105-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DSA-6105-1 modsecurity-crs - security update
Bulletin has no description...
CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts
The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a...
GHSA-JQMR-2PG9-VFX7 Apache SIS has Improper Restriction of XML External Entity Reference vulnerability
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the...
CVE-2025-68280 Apache SIS: XML External Entity (XXE) vulnerability
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the...
CVE-2025-13888
A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources CRs that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged...
