T3MP3ST public launch build

bench/obsidivm-evolution/gen-003/proposals.json

@@ -0,0 +1 @@
+[{"tactic": "When testing DVWA on port 4280, deliberately trigger SQL syntax errors (e.g., append single quote `'` to SQLi-vulnerable parameters) and malformed file inclusion paths (e.g., `page=../../../../../etc/nonexistent`) to extract verbose error messages. Grep responses for patterns like 'mysql_fetch', 'Warning:', 'Fatal error:', stack traces, or absolute filesystem paths\u2014these constitute information disclosure vulnerabilities even at low severity.", "confidence": 0.82, "rationale": "DVWA intentionally exposes PHP/MySQL error details in lower security modes. The tactic directly instructs triggering malformed inputs across known vuln classes (SQLi, LFI) to surface error verbosity, then validates via specific error patterns that hunters often overlook when focused on exploitability rather than disclosure.", "risk": "May slightly increase false positives if production apps use similar error formats intentionally in debug endpoints, but DVWA context makes this low-risk. Could add minor overhead from extra malformed requests.", "miss": {"target_id": "dvwa", "target_name": "DVWA", "finding_id": "DVWA-020", "title": "Verbose Error Messages", "severity": "low", "category": "disclosure"}}]