th-analyzer

drjones/th-analyzer

Fork 0

Commit Graph

Author	SHA1	Message	Date
drjones	d2bc52905d	The Analyzer v2.0 — 30 attack vectors, 9 new exploiters New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.	2026-06-21 07:20:21 -07:00
drjones	2627cfdff7	add daily batch scanner + top50 target list + cron job - targets/top50.txt — 50 most popular websites for daily scanning - scan-batch.sh — batch scanner that iterates through targets in quick mode, logs findings, tracks progress - cron job 'analyzer-daily-batch' runs at 2 AM daily - Uses perl-based timeout for macOS compat (no GNU timeout) - Shuffles targets each run for variety	2026-06-20 15:09:59 -07:00

Author

SHA1

Message

Date

drjones

d2bc52905d

The Analyzer v2.0 — 30 attack vectors, 9 new exploiters

New vectors added:
- 22: SSRF Proof — cloud metadata exfiltration (CRITICAL)
- 23: Prototype Pollution — Node.js client/server (HIGH)
- 24: WebSocket Hijack — WS origin bypass + injection (HIGH)
- 25: Mass Assignment — protected field modification (HIGH)
- 26: HTTP Parameter Pollution — WAF bypass (HIGH)
- 27: Insecure Deserialization — PHP/Java/Node (CRITICAL)
- 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL)
- 29: Web Cache Poisoning — unkeyed header injection (HIGH)
- 30: CRLF Injection — HTTP response splitting (CRITICAL)

All vectors PROVE exploitation by dumping data/credentials,
not just detecting config issues.

2026-06-21 07:20:21 -07:00

drjones

2627cfdff7

add daily batch scanner + top50 target list + cron job

- targets/top50.txt — 50 most popular websites for daily scanning
- scan-batch.sh — batch scanner that iterates through targets
  in quick mode, logs findings, tracks progress
- cron job 'analyzer-daily-batch' runs at 2 AM daily
- Uses perl-based timeout for macOS compat (no GNU timeout)
- Shuffles targets each run for variety

2026-06-20 15:09:59 -07:00

2 Commits