feat(modules): add active web-vuln probe modules - #271
Conversation
Add five active-probe modules to modules/http: ssti-reflected (arithmetic eval proof), command-injection (id output, not payload echo), and error-based xpath, nosql, and ldap injection. Each keys on a transformed response the payload cannot produce by reflection, so a benign echo cannot trigger it.
github-actions
Bot
added
size/l
pr summary5 files changed (+256 -0) |
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #271 +/- ##
=======================================
Coverage ? 54.75%
=======================================
Files ? 81
Lines ? 6874
Branches ? 0
=======================================
Hits ? 3764
Misses ? 2841
Partials ? 269 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
drop top-line comments that just restate the id/name fields already present in the same file
vmfunc
left a comment
vmfunc
left a comment
There was a problem hiding this comment.
consistent with the existing http modules and the executor already handles all of this (paths x payloads, word/regex, or-condition, extractors). the two eval-based ones are the strong ones: command-injection keys on the real uid=N(...) gid=N(...) shape and ssti on the 1787569 product, so a plain echo of the payload can't trip either. good.
one nit, doesn't block: in ldap-injection-error the Protocol error occurred matcher is weak on both ends. openldap emits "Protocol error", not "...occurred", so it probably misses the real signal, and it's generic enough to false-positive on any unrelated protocol error, and since the list is or'd it taints the whole module. drop it or tighten it, the rest carry the module fine.
approving.
3 participants
Five active-probe modules for
modules/http:ssti-reflected(arithmetic-eval proof, matches 1787569 = eval of 1337*1337),command-injection(matches id output shapeuid=N(...) gid=N(...), not the payload echo), and error-basedxpath,nosql,ldap.Each keys on a transformed response the payload cannot produce by reflection, so a benign echo of the input cannot trigger a finding. Verified with an eval-server vs echo-server pair: eval fires, echo stays silent for every module.