The Analyzer v2.0 — 30 attack vectors, 9 new exploiters

Browse Source

New vectors added:
- 22: SSRF Proof — cloud metadata exfiltration (CRITICAL)
- 23: Prototype Pollution — Node.js client/server (HIGH)
- 24: WebSocket Hijack — WS origin bypass + injection (HIGH)
- 25: Mass Assignment — protected field modification (HIGH)
- 26: HTTP Parameter Pollution — WAF bypass (HIGH)
- 27: Insecure Deserialization — PHP/Java/Node (CRITICAL)
- 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL)
- 29: Web Cache Poisoning — unkeyed header injection (HIGH)
- 30: CRLF Injection — HTTP response splitting (CRITICAL)

All vectors PROVE exploitation by dumping data/credentials,
not just detecting config issues.

...

This commit is contained in:

drjones

2026-06-21 07:20:21 -07:00

parent ab130a88c8

commit d2bc52905d

23 changed files with 2699 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

0

reports/autobounty_cve_1782046733.json Normal file

0

reports/autobounty_cve_1782046924.json Normal file

0

reports/hunt_cve_critical.json Normal file

0

reports/hunt_scan_1782046122.json Normal file

0

reports/nuclei_cve_scan.json Normal file

0

reports/uber_cve_scan.json Normal file