Documentation
¶
Overview ¶
Package filesig provides shared structural confirmation that a leaked server-side file's real content appears in a response. It is the single source of truth for the LFI / path-traversal / file-read scanner modules (lfi_path_traversal, mcp_resource_fuzz, mcp_tool_fuzz, …) so they don't each re-implement — and drift on — "does this body actually contain /etc/passwd?".
Every confirmer requires the file's actual structural shape (a real passwd account line, a bracketed win.ini section, an anchored nginx/apache directive) and subtracts the baseline, replacing the bare-word substring markers that modules historically used. Bare words ("root:", ":0:0:", "/bin/", "server", "location", "fonts", "extensions") are ordinary English / appear in CSP directives, JSON keys, error strings, and HTML, so they matched responses that contain no file content at all. The motivating false positive: a Cloudflare 403 "Blocked Content" page whose embedded cf-beacon JSON carried "server_timing" and "location_startswith" satisfied an LFI module's bare "server"/"location" nginx.conf markers and was reported as High/Firm LFI.
These confirmers do NOT inspect the response status — a caller that fronts a WAF/CDN must still reject blocked / challenge / 4xx-5xx responses before confirming (see infra.IsBlockedResponse). Structural confirmation and the status gate are complementary: the gate drops the edge talking, the confirmer drops everything that does not carry the file.
Index ¶
- func ConfirmAccessLog(data, baseline string) (bool, int)
- func ConfirmApacheConf(data, baseline string) (bool, int)
- func ConfirmBootIni(data, baseline string) (bool, int)
- func ConfirmDotenv(data, baseline string) (bool, int)
- func ConfirmEnviron(data, baseline string) (bool, int)
- func ConfirmGitHead(data, baseline string) (bool, int)
- func ConfirmHosts(data, baseline string) (bool, int)
- func ConfirmHtpasswd(data, baseline string) (bool, int)
- func ConfirmNginxConf(data, baseline string) (bool, int)
- func ConfirmPasswd(data, baseline string) (bool, int)
- func ConfirmProcVersion(data, baseline string) (bool, int)
- func ConfirmShadow(data, baseline string) (bool, int)
- func ConfirmWebXML(data, baseline string) (bool, int)
- func ConfirmWinIni(data, baseline string) (bool, int)
- type ConfirmFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConfirmAccessLog ¶
ConfirmAccessLog confirms a leaked access log by two distinct request lines.
func ConfirmApacheConf ¶
ConfirmApacheConf confirms a leaked Apache config by two distinct directives.
func ConfirmBootIni ¶
ConfirmBootIni confirms a leaked boot.ini by its two canonical sections.
func ConfirmDotenv ¶
ConfirmDotenv confirms a leaked .env by two distinct sensitive assignments.
func ConfirmEnviron ¶
ConfirmEnviron confirms a leaked /proc/self/environ by two distinct env vars.
func ConfirmGitHead ¶
ConfirmGitHead confirms a leaked .git/HEAD by its symbolic-ref line.
func ConfirmHosts ¶
ConfirmHosts confirms a leaked /etc/hosts by the localhost-mapping anchor.
func ConfirmHtpasswd ¶
ConfirmHtpasswd confirms a leaked .htpasswd by a hashed credential line.
func ConfirmNginxConf ¶
ConfirmNginxConf confirms a leaked nginx config by two distinct directives.
func ConfirmPasswd ¶
ConfirmPasswd confirms a leaked /etc/passwd: a root uid 0/gid 0 entry with a terminated shell field must appear that is absent from the baseline.
func ConfirmProcVersion ¶
ConfirmProcVersion confirms a leaked /proc/version by the kernel banner.
func ConfirmShadow ¶
ConfirmShadow confirms a leaked /etc/shadow by a new crypt-hash line.
func ConfirmWebXML ¶
ConfirmWebXML confirms a leaked web.xml by its open+close root element.
func ConfirmWinIni ¶
ConfirmWinIni confirms a leaked win.ini by two distinct bracketed sections.
Types ¶
type ConfirmFunc ¶
ConfirmFunc structurally corroborates that a leaked file's real content appears in data and was not already present in baseline. It returns whether the read is confirmed and a score (the number of distinct new, file-shaped matches) callers can use to grade confidence (e.g. >=3 ⇒ Certain).
Source Files