Documentation
¶
Index ¶
Constants ¶
View Source
const ( ModuleID = "nginx-path-escape" ModuleName = "Nginx Path Escape Detection" ModuleShort = "Diff-based Nginx path escape detection (alias traversal, encoding bypass, semicolon injection)" )
View Source
const ( SeverityLow = 3 SeverityMedium = 4 SeverityHigh = 5 )
Probe severity levels
Variables ¶
View Source
var ( ModuleDesc = `` /* 702-byte string literal not displayed */ ModuleConfirmation = "" /* 132-byte string literal not displayed */ // ModuleSeverity is Info: this diff-based detector compares response // fingerprints between a baseline and path-escape payloads, which is a // noisy, false-positive-prone heuristic. Every finding is surfaced as an // informational lead for a human to confirm rather than an actionable // issue. The per-probe severity remains in the report body for triage. // See ScanPerRequest. ModuleSeverity = severity.Info ModuleConfidence = severity.Tentative ModuleTags = []string{"nginx", "misconfiguration", "moderate"} )
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module implements Nginx Path Escape Detection for path-based vulnerabilities.
func (*Module) CanProcess ¶
func (m *Module) CanProcess(ctx *httpmsg.HttpRequestResponse) bool
CanProcess returns true for any URL with a non-root path.
func (*Module) IncludesBaseCanProcess ¶
IncludesBaseCanProcess returns false because this module uses a custom CanProcess that does not include the base URL/media/method checks.
func (*Module) ScanPerRequest ¶
func (m *Module) ScanPerRequest( ctx *httpmsg.HttpRequestResponse, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerRequest scans the request for Nginx path escape vulnerabilities.
type Options ¶
type Options struct {
// DiffScanOptions configures the differential analysis engine
DiffScanOptions *diffscan.Option
// BaselineRequests is the number of requests to send for baseline stabilization
BaselineRequests int
// MaxPathLevels limits how many path levels to test (0 = unlimited).
// For /a/b/c/d/e with MaxPathLevels=3:
// Tests: /a/b/c/d/e (level 0), /a/b/c/d (level 1), /a/b/c (level 2)
MaxPathLevels int
}
Options configures the Nginx Path Escape Detection module.
func DefaultOptions ¶
func DefaultOptions() *Options
DefaultOptions returns the default configuration.
type ProbeInfo ¶
type ProbeInfo struct {
ID string
Name string
Description string
Probe *diffscan.Probe
RedirectMeansSafe bool // true = 3xx redirect from break means server normalized path (not vulnerable)
IsACLBypass bool // true = ACL bypass probe (break accesses same resource, not parent)
TraversalLevels int // How many parent levels this probe traverses (0 = no traversal, e.g., ACL bypass)
}
ProbeInfo contains metadata about a probe for reporting.
Source Files
Click to show internal directories.
Click to hide internal directories.