Miroslav Štampar
559d6f4543
Increasing the GraphQL timeout in tests
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-10-18 22:37:59 +02:00
Miroslav Štampar
71af9b3d8a
Fixes CI/CD issues
2026-10-18 22:21:02 +02:00
Miroslav Štampar
516f55935c
Implements #4973
2026-10-18 22:14:12 +02:00
Miroslav Štampar
b208262c37
Fixes #4708
2026-10-18 21:54:21 +02:00
Miroslav Štampar
9a1660aa12
Minor cleaning after #6146
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-10-17 13:06:38 +02:00
Bharath Vemula
0cf2f6db07
Fix REST API multi-target scans returning only the last target's results ( #2503 ) ( #6146 )
...
A scan covering multiple targets inside a single API task (crawl,
'-m' bulk file, forms) ran every target through one StdDbOut keyed by
the single taskid, so _storeData()'s COMPLETE branch deleted each
earlier target's TARGET/TECHNIQUES rows - /scan/<id>/data returned
only the last target's results.
Mirror the --report-json fix for #6123 : controller.start() now sets
kb.reportTaskId per target for API scans too, StdDbOut.write() keys
data rows '<taskid>-<n>' per target, and scan_data() folds the
per-target rows back into the task's flat result in target order.
Single-target scans keep the exact same response shape.
Regression tests in tests/test_api.py (TestStdDbOutMultiTarget,
TestScanDataMultiTarget).
2026-10-17 13:02:34 +02:00
Miroslav Štampar
c94f6d0041
Update regarding #6145
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-10-16 12:15:59 +02:00
Miroslav Štampar
5b180533c1
Fixes #6143
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-10-11 21:20:29 +02:00
Miroslav Štampar
2c6e4d85b5
Fixes #6142
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-10-10 12:00:33 +02:00
Mr.X
1b1f93ae5c
Make test_ssti and test_xpath runnable standalone ( #6136 )
...
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
Every tests/test_*.py file provides an
if __name__ == "__main__":
unittest.main(...)
entrypoint so it can be run directly, except test_ssti.py and
test_xpath.py. Running either of those directly produced no output and
executed none of its tests; they only ran under `unittest discover`.
Add the missing entrypoint to both so they behave like the rest of the
suite. No test logic changed (62 and 48 tests respectively still pass).
2026-10-05 23:54:39 +02:00
Miroslav Štampar
65b6e7b4ac
Fixes #6137
2026-10-05 23:46:59 +02:00
Miroslav Štampar
1d9965d003
Fixes #6133
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-28 22:20:27 +02:00
Miroslav Štampar
4d518ff813
Fixes #6132
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-28 09:01:30 +02:00
Miroslav Štampar
a6e832bb8e
Fixes #6131
2026-09-28 08:54:38 +02:00
Miroslav Štampar
3cfba468d7
Dealing with ResourceWarning and DeprecationWarning
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-28 01:03:43 +02:00
Miroslav Štampar
8473e2edc6
Fixes CI/CD errors
2026-09-28 00:49:25 +02:00
Miroslav Štampar
0974a0d859
Fixes CI/CD errors
2026-09-28 00:43:00 +02:00
Miroslav Štampar
2e3e4385ca
Added shared Interactsh poller with DNS/HTTP OOB support
2026-09-28 00:38:03 +02:00
Miroslav Štampar
c36d056481
Minor patch for shellExec (adding timeout)
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-25 17:01:07 +02:00
Miroslav Štampar
a3d29174fb
Fixes intermittent pypy-2.7 CI failure (kb.reportTaskId test leak)
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-25 11:32:30 +02:00
Miroslav Štampar
92b652177b
Fixes #6129
2026-09-25 11:00:58 +02:00
Miroslav Štampar
8ac458c6bc
Fixes #6128
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-23 09:25:22 +02:00
Miroslav Štampar
e1537fe809
Fixes #6127
2026-09-23 09:12:03 +02:00
Miroslav Štampar
2171eb123c
Fixes CI/CD issues
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-20 12:05:29 +02:00
Miroslav Štampar
31005fe4df
Fixing an TypeError issue with a crypto.crypt()
2026-09-20 11:59:21 +02:00
Miroslav Štampar
0c491b7551
Minor regex fix
2026-09-19 15:57:54 +02:00
Miroslav Štampar
5365c7e53d
Fixing broken CI/CD
2026-09-18 14:48:31 +02:00
Miroslav Štampar
ce01e65255
Patch related to #6124
2026-09-18 14:13:31 +02:00
Miroslav Štampar
7eb06ce635
Fixes #6122
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-18 00:53:16 +02:00
Miroslav Štampar
bda62dcf28
Fixes #6123
2026-09-18 00:41:57 +02:00
Miroslav Štampar
fa96906f76
Fixing CI/CD errors
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-15 11:36:10 +02:00
Miroslav Štampar
6224344224
Minor update regarding the #6120
2026-09-15 11:26:54 +02:00
Miroslav Štampar
7cbbbaf2a1
Patch related to the #6120
2026-09-15 09:50:39 +02:00
Miroslav Štampar
6c75ad64c4
Update related to #6117
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-14 13:02:11 +02:00
Miroslav Štampar
5f6c303f8a
Fixes #6108
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-09 00:59:57 +02:00
Miroslav Štampar
604c5bc111
Fixes #6109
2026-09-08 22:10:57 +02:00
Miroslav Štampar
d486742eec
Fixes #6106
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-07 12:06:22 +02:00
Miroslav Štampar
a56a6b1f25
Fixes #6107
2026-09-07 12:03:02 +02:00
Miroslav Štampar
1ee368f78a
Fixes #6105
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-04 09:47:33 +02:00
Miroslav Štampar
e10092efcd
Fixes #6104
2026-09-04 09:03:25 +02:00
Miroslav Štampar
691d2fa7ca
Update of docus
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-02 15:51:19 +02:00
Miroslav Štampar
3fc41ca370
Salvaging (verified) what's useful from #6103
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-02 07:53:32 +02:00
Ramachandran Thamarai Semmenian
3b8a8d3d09
Do not crash on a JWT with a non-base64url signature ( fixes #6101 ) ( #6102 )
...
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
JWT_REGEX accepts a signature segment of any length and parseJWT only
validates the header/payload, so a value that matches the JWT pattern but
carries a malformed/truncated signature (e.g. 41 base64url characters,
which is length % 4 == 1 and thus impossible base64) reached crackHMAC.
There decodeBase64(signature) let binascii.Error propagate, aborting the
whole run with an unhandled exception during checkJWT().
Guard the signature decode: a signature that is not valid base64url cannot
be an HMAC we could verify, so crackHMAC now treats it as not crackable
(returns None) instead of raising. The other auditJWT findings are
unaffected. Added a regression doctest.
Co-authored-by: chan770 <tsramachandran770@gmail.com>
2026-09-01 10:24:58 +02:00
Miroslav Štampar
1192d266c8
Update related to the #6099
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-08-28 09:44:22 +02:00
Miroslav Štampar
0a35b20e39
Update related to the #6098
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-08-26 13:46:08 +02:00
Miroslav Štampar
a184c89a6b
Minor patch for multiple-dbms tags
2026-08-23 17:35:54 +02:00
Miroslav Štampar
91239a3c10
Minor patch
2026-08-23 17:12:19 +02:00
Miroslav Štampar
0ee19bdf3d
Minor patch
2026-08-22 23:02:58 +02:00
Miroslav Štampar
cef41c7fa2
Adding semicolon-less MSSQL stacked-query detection payloads
2026-08-18 14:49:23 +02:00
Miroslav Štampar
973ab5ab88
Probe actual gadget executability instead of extension presence (avoids false success as non-superuser)
2026-08-18 12:04:51 +02:00
