Miroslav Štampar
c36d056481
Minor patch for shellExec (adding timeout)
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-25 17:01:07 +02:00
Miroslav Štampar
a3d29174fb
Fixes intermittent pypy-2.7 CI failure (kb.reportTaskId test leak)
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-25 11:32:30 +02:00
Miroslav Štampar
92b652177b
Fixes #6129
2026-09-25 11:00:58 +02:00
Miroslav Štampar
8ac458c6bc
Fixes #6128
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-23 09:25:22 +02:00
Miroslav Štampar
e1537fe809
Fixes #6127
2026-09-23 09:12:03 +02:00
Miroslav Štampar
2171eb123c
Fixes CI/CD issues
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-20 12:05:29 +02:00
Miroslav Štampar
31005fe4df
Fixing an TypeError issue with a crypto.crypt()
2026-09-20 11:59:21 +02:00
Miroslav Štampar
0c491b7551
Minor regex fix
2026-09-19 15:57:54 +02:00
Miroslav Štampar
5365c7e53d
Fixing broken CI/CD
2026-09-18 14:48:31 +02:00
Miroslav Štampar
ce01e65255
Patch related to #6124
2026-09-18 14:13:31 +02:00
Miroslav Štampar
7eb06ce635
Fixes #6122
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-18 00:53:16 +02:00
Miroslav Štampar
bda62dcf28
Fixes #6123
2026-09-18 00:41:57 +02:00
Miroslav Štampar
fa96906f76
Fixing CI/CD errors
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-15 11:36:10 +02:00
Miroslav Štampar
6224344224
Minor update regarding the #6120
2026-09-15 11:26:54 +02:00
Miroslav Štampar
7cbbbaf2a1
Patch related to the #6120
2026-09-15 09:50:39 +02:00
Miroslav Štampar
6c75ad64c4
Update related to #6117
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-14 13:02:11 +02:00
Miroslav Štampar
5f6c303f8a
Fixes #6108
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-09 00:59:57 +02:00
Miroslav Štampar
604c5bc111
Fixes #6109
2026-09-08 22:10:57 +02:00
Miroslav Štampar
d486742eec
Fixes #6106
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-07 12:06:22 +02:00
Miroslav Štampar
a56a6b1f25
Fixes #6107
2026-09-07 12:03:02 +02:00
Miroslav Štampar
1ee368f78a
Fixes #6105
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-04 09:47:33 +02:00
Miroslav Štampar
e10092efcd
Fixes #6104
2026-09-04 09:03:25 +02:00
Miroslav Štampar
691d2fa7ca
Update of docus
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-02 15:51:19 +02:00
Miroslav Štampar
3fc41ca370
Salvaging (verified) what's useful from #6103
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-02 07:53:32 +02:00
Ramachandran Thamarai Semmenian
3b8a8d3d09
Do not crash on a JWT with a non-base64url signature ( fixes #6101 ) ( #6102 )
...
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
JWT_REGEX accepts a signature segment of any length and parseJWT only
validates the header/payload, so a value that matches the JWT pattern but
carries a malformed/truncated signature (e.g. 41 base64url characters,
which is length % 4 == 1 and thus impossible base64) reached crackHMAC.
There decodeBase64(signature) let binascii.Error propagate, aborting the
whole run with an unhandled exception during checkJWT().
Guard the signature decode: a signature that is not valid base64url cannot
be an HMAC we could verify, so crackHMAC now treats it as not crackable
(returns None) instead of raising. The other auditJWT findings are
unaffected. Added a regression doctest.
Co-authored-by: chan770 <tsramachandran770@gmail.com>
2026-09-01 10:24:58 +02:00
Miroslav Štampar
1192d266c8
Update related to the #6099
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-08-28 09:44:22 +02:00
Miroslav Štampar
0a35b20e39
Update related to the #6098
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-08-26 13:46:08 +02:00
Miroslav Štampar
a184c89a6b
Minor patch for multiple-dbms tags
2026-08-23 17:35:54 +02:00
Miroslav Štampar
91239a3c10
Minor patch
2026-08-23 17:12:19 +02:00
Miroslav Štampar
0ee19bdf3d
Minor patch
2026-08-22 23:02:58 +02:00
Miroslav Štampar
cef41c7fa2
Adding semicolon-less MSSQL stacked-query detection payloads
2026-08-18 14:49:23 +02:00
Miroslav Štampar
973ab5ab88
Probe actual gadget executability instead of extension presence (avoids false success as non-superuser)
2026-08-18 12:04:51 +02:00
Miroslav Štampar
d424016742
Update of CHANGELOG
2026-08-18 11:53:51 +02:00
Miroslav Štampar
bec4dedbc9
Enabling PostgreSQL file write over a gadget when stacked queries are unavailable
2026-08-18 11:45:44 +02:00
Miroslav Štampar
529fc7aebb
Adding gadget fallback for non-query statement execution without stacked queries (PostgreSQL dblink)
2026-08-18 11:35:54 +02:00
Miroslav Štampar
8a3b312950
Implementing file read/write support for SQLite (fileio extension)
2026-08-18 11:07:00 +02:00
Miroslav Štampar
774c044519
Extending --procs with routine data-access and security type
2026-08-18 10:50:44 +02:00
Miroslav Štampar
848ba68ccf
Couple of fixes
2026-08-17 22:20:42 +02:00
Miroslav Štampar
77ee160875
Fixing CI/CD errors
2026-08-17 16:52:00 +02:00
Miroslav Štampar
49a774035f
Fixing some of WAF bypass bugs
2026-08-17 16:41:49 +02:00
Miroslav Štampar
dc42edc19f
Improving the auto WAF bypass feature
2026-08-17 15:24:18 +02:00
Miroslav Štampar
0ba9df2589
Adding new tamper scripts
2026-08-17 14:28:48 +02:00
Miroslav Štampar
cbe892410c
Adding more WAF friendly fingerprinting payloads
2026-08-17 14:25:46 +02:00
Miroslav Štampar
76ddd7a1b9
Fixes #6097
2026-08-16 23:52:22 +02:00
Miroslav Štampar
9f798873c4
Fixing CI/CD errors
2026-08-16 23:16:16 +02:00
Miroslav Štampar
bdf3e09315
Adding support for multi-bit boolean extraction
2026-08-16 23:11:49 +02:00
Miroslav Štampar
99367454c5
Adding a research link to READMEs
2026-08-16 00:17:28 +02:00
Miroslav Štampar
6770b2847b
Refresh of tamper docu
2026-08-14 23:21:00 +02:00
Miroslav Štampar
319910ccd8
Adding two new tamper scripts
2026-08-14 22:56:50 +02:00
Miroslav Štampar
ebf4b48337
Fixing CI/CD errors
2026-08-13 19:27:32 +02:00
