Miroslav Štampar
5b180533c1
Fixes #6143
2026-10-11 21:20:29 +02:00
Miroslav Štampar
2c6e4d85b5
Fixes #6142
2026-10-10 12:00:33 +02:00
Mr.X
1b1f93ae5c
Make test_ssti and test_xpath runnable standalone ( #6136 )
...
Every tests/test_*.py file provides an
if __name__ == "__main__":
unittest.main(...)
entrypoint so it can be run directly, except test_ssti.py and
test_xpath.py. Running either of those directly produced no output and
executed none of its tests; they only ran under `unittest discover`.
Add the missing entrypoint to both so they behave like the rest of the
suite. No test logic changed (62 and 48 tests respectively still pass).
2026-10-05 23:54:39 +02:00
Miroslav Štampar
65b6e7b4ac
Fixes #6137
2026-10-05 23:46:59 +02:00
Miroslav Štampar
1d9965d003
Fixes #6133
2026-09-28 22:20:27 +02:00
Miroslav Štampar
4d518ff813
Fixes #6132
2026-09-28 09:01:30 +02:00
Miroslav Štampar
a6e832bb8e
Fixes #6131
2026-09-28 08:54:38 +02:00
Miroslav Štampar
3cfba468d7
Dealing with ResourceWarning and DeprecationWarning
2026-09-28 01:03:43 +02:00
Miroslav Štampar
8473e2edc6
Fixes CI/CD errors
2026-09-28 00:49:25 +02:00
Miroslav Štampar
0974a0d859
Fixes CI/CD errors
2026-09-28 00:43:00 +02:00
Miroslav Štampar
2e3e4385ca
Added shared Interactsh poller with DNS/HTTP OOB support
2026-09-28 00:38:03 +02:00
Miroslav Štampar
c36d056481
Minor patch for shellExec (adding timeout)
2026-09-25 17:01:07 +02:00
Miroslav Štampar
a3d29174fb
Fixes intermittent pypy-2.7 CI failure (kb.reportTaskId test leak)
2026-09-25 11:32:30 +02:00
Miroslav Štampar
92b652177b
Fixes #6129
2026-09-25 11:00:58 +02:00
Miroslav Štampar
8ac458c6bc
Fixes #6128
2026-09-23 09:25:22 +02:00
Miroslav Štampar
e1537fe809
Fixes #6127
2026-09-23 09:12:03 +02:00
Miroslav Štampar
2171eb123c
Fixes CI/CD issues
2026-09-20 12:05:29 +02:00
Miroslav Štampar
31005fe4df
Fixing an TypeError issue with a crypto.crypt()
2026-09-20 11:59:21 +02:00
Miroslav Štampar
0c491b7551
Minor regex fix
2026-09-19 15:57:54 +02:00
Miroslav Štampar
5365c7e53d
Fixing broken CI/CD
2026-09-18 14:48:31 +02:00
Miroslav Štampar
ce01e65255
Patch related to #6124
2026-09-18 14:13:31 +02:00
Miroslav Štampar
7eb06ce635
Fixes #6122
2026-09-18 00:53:16 +02:00
Miroslav Štampar
bda62dcf28
Fixes #6123
2026-09-18 00:41:57 +02:00
Miroslav Štampar
fa96906f76
Fixing CI/CD errors
2026-09-15 11:36:10 +02:00
Miroslav Štampar
6224344224
Minor update regarding the #6120
2026-09-15 11:26:54 +02:00
Miroslav Štampar
7cbbbaf2a1
Patch related to the #6120
2026-09-15 09:50:39 +02:00
Miroslav Štampar
6c75ad64c4
Update related to #6117
2026-09-14 13:02:11 +02:00
Miroslav Štampar
5f6c303f8a
Fixes #6108
2026-09-09 00:59:57 +02:00
Miroslav Štampar
604c5bc111
Fixes #6109
2026-09-08 22:10:57 +02:00
Miroslav Štampar
d486742eec
Fixes #6106
2026-09-07 12:06:22 +02:00
Miroslav Štampar
a56a6b1f25
Fixes #6107
2026-09-07 12:03:02 +02:00
Miroslav Štampar
1ee368f78a
Fixes #6105
2026-09-04 09:47:33 +02:00
Miroslav Štampar
e10092efcd
Fixes #6104
2026-09-04 09:03:25 +02:00
Miroslav Štampar
691d2fa7ca
Update of docus
2026-09-02 15:51:19 +02:00
Miroslav Štampar
3fc41ca370
Salvaging (verified) what's useful from #6103
2026-09-02 07:53:32 +02:00
Ramachandran Thamarai Semmenian and chan770
3b8a8d3d09
Do not crash on a JWT with a non-base64url signature ( fixes #6101 ) ( #6102 )
...
JWT_REGEX accepts a signature segment of any length and parseJWT only
validates the header/payload, so a value that matches the JWT pattern but
carries a malformed/truncated signature (e.g. 41 base64url characters,
which is length % 4 == 1 and thus impossible base64) reached crackHMAC.
There decodeBase64(signature) let binascii.Error propagate, aborting the
whole run with an unhandled exception during checkJWT().
Guard the signature decode: a signature that is not valid base64url cannot
be an HMAC we could verify, so crackHMAC now treats it as not crackable
(returns None) instead of raising. The other auditJWT findings are
unaffected. Added a regression doctest.
Co-authored-by: chan770 <[email protected]
2026-09-01 10:24:58 +02:00
Miroslav Štampar
1192d266c8
Update related to the #6099
2026-08-28 09:44:22 +02:00
Miroslav Štampar
0a35b20e39
Update related to the #6098
2026-08-26 13:46:08 +02:00
Miroslav Štampar
a184c89a6b
Minor patch for multiple-dbms tags
2026-08-23 17:35:54 +02:00
Miroslav Štampar
91239a3c10
Minor patch
2026-08-23 17:12:19 +02:00
Miroslav Štampar
0ee19bdf3d
Minor patch
2026-08-22 23:02:58 +02:00
Miroslav Štampar
cef41c7fa2
Adding semicolon-less MSSQL stacked-query detection payloads
2026-08-18 14:49:23 +02:00
Miroslav Štampar
973ab5ab88
Probe actual gadget executability instead of extension presence (avoids false success as non-superuser)
2026-08-18 12:04:51 +02:00
Miroslav Štampar
d424016742
Update of CHANGELOG
2026-08-18 11:53:51 +02:00
Miroslav Štampar
bec4dedbc9
Enabling PostgreSQL file write over a gadget when stacked queries are unavailable
2026-08-18 11:45:44 +02:00
Miroslav Štampar
529fc7aebb
Adding gadget fallback for non-query statement execution without stacked queries (PostgreSQL dblink)
2026-08-18 11:35:54 +02:00
Miroslav Štampar
8a3b312950
Implementing file read/write support for SQLite (fileio extension)
2026-08-18 11:07:00 +02:00
Miroslav Štampar
774c044519
Extending --procs with routine data-access and security type
2026-08-18 10:50:44 +02:00
Miroslav Štampar
848ba68ccf
Couple of fixes
2026-08-17 22:20:42 +02:00
Miroslav Štampar
77ee160875
Fixing CI/CD errors
2026-08-17 16:52:00 +02:00
Miroslav Štampar