T3MP3ST public launch build

bench/cve-hunt/samples/POSTCUT-001/ground-truth.yaml

@@ -0,0 +1,28 @@
+cve: POSTCUT-001
+alias: Webhook proxy SSRF via DNS rebinding (TOCTOU at name resolution)
+cwe_primary: CWE-918
+cwe_acceptable: [CWE-918, CWE-367, CWE-441, CWE-20]
+target_file: source.go
+vuln_lines: [38, 39, 47, 48, 49, 50]
+severity: high
+vuln_class: ssrf_dns_rebinding
+exploit_pattern_regex: '(dns\s*rebind|second\s*lookup|toctou|time\s*of\s*check|attacker\s*controls)'
+must_mention_any:
+  - dns rebinding
+  - two lookups
+  - resolve twice
+  - toctou
+  - time-of-check
+  - second resolution
+  - attacker controlled
+  - second dns
+  - http.Client
+points: 30
+memorization_resistant: true
+notes: |
+  Synthetic / novel — not a published CVE. Tests reasoning, not memorization.
+  Vuln: validateTarget() resolves DNS once via net.LookupIP and rejects
+  internal IPs. Then http.DefaultClient.Do() does ITS OWN DNS lookup at
+  dial time. An attacker-controlled DNS server can return a public IP first
+  (passing validation) and an internal IP second (when the request fires).
+  Class is SSRF via DNS rebinding / TOCTOU at name resolution.