Template catalog
Every template in cert-x-gen-templates
at v1.2.0. Each id links to the file at that tag, so the code a reader
opens is the code the row describes.
Templates version separately from the engine. This page describes the
pinned tag v1.2.0 and not whatever cxg template update last pulled;
run cxg template list to see what is
installed on your machine.
What the registry reports
Section titled “What the registry reports”Written by the templates repository’s own indexer, which loads every template through the engine. Every number on this page is its number.
| Measure | Count |
|---|---|
files_on_disk |
162 — template files found in templates/ |
loadable |
162 — parsed by their engine without error |
runnable |
162 — executable by their engine |
engine_registered |
162 — registered with a unique id |
It reports no load failures and no id collisions.
By language
Section titled “By language”| Language | Templates |
|---|---|
c |
5 |
cpp |
1 |
go |
16 |
java |
4 |
javascript |
7 |
perl |
1 |
php |
1 |
python |
64 |
ruby |
1 |
rust |
5 |
shell |
8 |
yaml |
49 |
By category
Section titled “By category”| Category | Templates |
|---|---|
| ai | 20 |
| databases | 26 |
| devops | 26 |
| messaging | 7 |
| monitoring | 16 |
| network | 34 |
| recon | 1 |
| web | 32 |
Templates
Section titled “Templates”No template matches those filters.
| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
ai-assisted-fuzzing-sqli-seed-corpus |
AI-Assisted Fuzzing SQLi Seed Corpus | python |
info |
templates/ai/ai-assisted-fuzzing/ai-assisted-fuzzing-sqli-seed-corpus.py |
api-pull-access-check |
Unauthorized API Pull Access Check | yaml |
critical |
templates/ai/ollama/apipull-access-sending-post.yaml |
claude-code-sed-bypass-usage |
Claude Code sed DSL Bypass Indicators (Static Scan) | python |
medium |
templates/ai/claude/claude-code-sed-bypass-usage.py |
copilot-yolo-autoapprove-enabled |
GitHub Copilot YOLO Mode Enabled (Static Scan) | python |
high |
templates/ai/copilot/copilot-yolo-autoapprove-enabled.py |
cursor-mcpoison-config-risk |
Cursor MCP Config Command Risk (MCPoison) | python |
high |
templates/ai/cursor/cursor-mcpoison-config-risk.py |
exposed-ollama-api-version |
Exposed Ollama API Version Endpoint | yaml |
medium |
templates/ai/ollama/detect-exposed-ollama-sending.yaml |
flowise-custommcp-command-endpoint-exposed |
Flowise CustomMCP Command Endpoint Exposed | yaml |
critical |
templates/ai/flowise/flowise-custommcp-command-endpoint-exposed.yaml |
flowise-custommcp-js-eval-exposed |
Flowise CustomMCP JS Eval Endpoint Exposed | yaml |
critical |
templates/ai/flowise/flowise-custommcp-js-eval-exposed.yaml |
invokeai-model-install-exposed |
InvokeAI Unauthenticated Model Install Endpoint | yaml |
critical |
templates/ai/invokeai/invokeai-model-install-exposed.yaml |
mcp-broken-token-validation |
MCP Broken Token Validation (Accepts Forged Tokens) | python |
high |
templates/ai/mcp/mcp-broken-token-validation.py |
mcp-credential-exposure |
MCP Credential / Secret Exposure via Resources | python |
critical |
templates/ai/mcp/mcp-credential-exposure.py |
mcp-excessive-tool-permissions |
MCP Excessive Tool Permissions (Dangerous Capability Exposure) | python |
high |
templates/ai/mcp/mcp-excessive-tool-permissions.py |
mcp-rug-pull-detection |
MCP Rug Pull (Silent Tool Definition Mutation) | python |
high |
templates/ai/mcp/mcp-rug-pull-detection.py |
mcp-tool-poisoning |
MCP Tool Poisoning (Hidden Instructions in Tool Metadata) | python |
high |
templates/ai/mcp/mcp-tool-poisoning.py |
mcp-unauthenticated-access |
Unauthenticated MCP Server Exposure | python |
high |
templates/ai/mcp/mcp-unauthenticated.py |
ml-unsafe-deserialization-usage |
ML Unsafe Deserialization Usage (Static Scan) | python |
medium |
templates/ai/ml/unsafe-deserialization-usage.py |
ollama-unauth-api-generate |
Ollama Unauthenticated /api/generate Access | yaml |
high |
templates/ai/ollama/detect-unauthenticated-access-apigenerate.yaml |
pytorch-unsafe-load-usage |
PyTorch Unsafe torch.load Usage (Static Scan) | python |
high |
templates/ai/ml/torch-unsafe-load-usage.py |
torchserve-management-api-exposed |
TorchServe Management API Exposed | yaml |
high |
templates/ai/torchserve/torchserve-management-api-exposed.yaml |
triton-model-control-exposed |
NVIDIA Triton Model Repository Control Exposed | yaml |
high |
templates/ai/triton/triton-model-control-exposed.yaml |
databases
Section titled “databases”| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
clickhouse-auth-bypass |
ClickHouse Authentication Bypass | python |
high |
templates/databases/clickhouse/clickhouse-auth-bypass.py |
cockroachdb-unauthenticated-access |
CockroachDB Unauthenticated Access Detection | yaml |
critical |
templates/databases/cockroachdb/cockroachdb-unauthenticated.yaml |
couchdb-default-credentials |
CouchDB Default Credentials Detection | rust |
critical |
templates/databases/couchdb/couchdb_default_creds.rs |
elasticsearch-data-exposure |
Elasticsearch Cluster Data Exposure | python |
critical |
templates/databases/elasticsearch/elasticsearch-data-exposure.py |
elasticsearch-query-injection |
Elasticsearch Query DSL Injection Detector | python |
high |
templates/databases/elasticsearch/elasticsearch-query-injection.py |
elasticsearch-unauthenticated |
Elasticsearch Unauthenticated Access Detection | rust |
critical |
templates/databases/elasticsearch/elasticsearch_unauthenticated.rs |
influxdb-health-exposed |
InfluxDB Health Endpoint Exposed | yaml |
medium |
templates/databases/influxdb/influxdb-health-exposed.yaml |
memcached-unauthenticated-access |
Memcached Unauthenticated Access Detection | yaml |
critical |
templates/databases/memcached/memcached-unauthenticated.yaml |
mongodb-injection-deep |
MongoDB NoSQL Injection Deep Analysis | python |
high |
templates/databases/mongodb/mongodb-injection-deep.py |
mongodb-unauthenticated |
MongoDB Unauthenticated Access Detection | python |
critical |
templates/databases/mongodb/mongodb-unauthenticated.py |
mysql-default-credentials |
MySQL Default/Weak Credentials Detection | python |
critical |
templates/databases/mysql/mysql-default-credentials.py |
postgresql-default-credentials |
PostgreSQL Default Credentials Detection | go |
critical |
templates/databases/postgresql/postgresql-default-credentials.go |
postgresql-extension-rce |
postgresql extension rce | python |
medium |
templates/databases/postgresql/postgresql-extension-rce.py |
redis-cluster-takeover |
Redis Cluster Takeover Detection | go |
critical |
templates/databases/redis/redis-cluster-takeover.go |
redis-unauthenticated-access |
Redis Unauthenticated Access Detection | yaml |
critical |
templates/databases/redis/redis-unauthenticated.yaml |
redis-unauthenticated-c |
Redis Unauthenticated Access Detection (C) | c |
critical |
templates/databases/redis/redis-unauthenticated.c |
redis-unauthenticated-cpp |
Redis Unauthenticated Access Detection (C++) | cpp |
critical |
templates/databases/redis/redis-unauthenticated.cpp |
redis-unauthenticated-go |
Redis Unauthenticated Access Detection (Go) | go |
critical |
templates/databases/redis/redis-unauthenticated.go |
redis-unauthenticated-java |
Redis Unauthenticated Access Detection (Java) | java |
critical |
templates/databases/redis/RedisUnauthenticated.java |
redis-unauthenticated-javascript |
Redis Unauthenticated Access Detection (JavaScript) | javascript |
critical |
templates/databases/redis/redis-unauthenticated.js |
redis-unauthenticated-perl |
Redis Unauthenticated Access Detection (Perl) | perl |
critical |
templates/databases/redis/redis-unauthenticated.pl |
redis-unauthenticated-php |
Redis Unauthenticated Access Detection (PHP) | php |
critical |
templates/databases/redis/redis-unauthenticated.php |
redis-unauthenticated-python |
Redis Unauthenticated Access Detection (Python) | python |
critical |
templates/databases/redis/redis-unauthenticated.py |
redis-unauthenticated-ruby |
Redis Unauthenticated Access Detection (Ruby) | ruby |
critical |
templates/databases/redis/redis-unauthenticated.rb |
redis-unauthenticated-rust |
Redis Unauthenticated Access Detection (Rust) | rust |
critical |
templates/databases/redis/redis-unauthenticated.rs |
redis-unauthenticated-shell |
Redis Unauthenticated Access Detection (Shell) | shell |
critical |
templates/databases/redis/redis-unauthenticated.sh |
devops
Section titled “devops”| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
actions-injection-scanner |
GitHub Actions Injection Scanner | python |
high |
templates/devops/github/actions-injection-scanner.py |
ci-variable-exposure |
CI/CD Variable Exposure Detection | python |
critical |
templates/devops/ci/ci-variable-exposure.py |
docker-api-unauth |
Docker API Unauthenticated Access | go |
critical |
templates/devops/docker/docker-api-unauth.go |
docker-registry-unauthenticated |
Docker Registry Unauthenticated Access Detection | shell |
high |
templates/devops/docker/docker-registry-unauthenticated.sh |
etcd-auth-check |
Etcd Authentication Check | yaml |
info |
templates/devops/etcd/which-runs-etcdctl-command.yaml |
etcd-instead-http-request |
Etcd Member List Security Check | yaml |
medium |
templates/devops/etcd/etcd-instead-http-request.yaml |
etcd-running-unauthenticated-port |
Unauthenticated etcd Service Detection | shell |
critical |
templates/devops/etcd/etcd-running-unauthenticated-port.sh |
etcd-think-path-wrong |
Etcd Unauthenticated Access | yaml |
medium |
templates/devops/etcd/etcd-think-path-wrong.yaml |
etcd-unauth |
Etcd Unauthenticated Access - Members List | yaml |
high |
templates/devops/etcd/new-etcd-vulnerable-unauthenticated.yaml |
etcd-unauthenticated |
Etcd Unauthenticated Member List Detection | shell |
high |
templates/devops/etcd/etcd-unauthenticated.sh |
etcd-unauthenticated-access |
Etcd Unauthenticated Access - Version Endpoint | yaml |
medium |
templates/devops/etcd/think-wrong-able-validate.yaml |
ghes-version-fingerprint |
GitHub Enterprise Server Version Fingerprint | python |
info |
templates/devops/github/ghes-version-fingerprint.py |
git-history-secret-scan |
Git History Secret Scan | go |
critical |
templates/devops/git/git-history-secret-scan.go |
gitlab-version-fingerprint |
GitLab Version Fingerprint | python |
info |
templates/devops/gitlab/gitlab-version-fingerprint.py |
helm-chart-secrets-leak |
Helm Chart Secrets Leak Detection | python |
high |
templates/devops/kubernetes/helm-chart-secrets-leak.py |
istio-pilot-misconfiguration |
Istio Pilot Misconfiguration Detection | go |
high |
templates/devops/istio/istio-pilot-misconfiguration.go |
jenkins-unauth-rce |
Jenkins Unauthenticated Script Console RCE | go |
critical |
templates/devops/jenkins/jenkins-unauth-rce.go |
jupyter-unauth-rce |
Jupyter Notebook Unauthenticated RCE | python |
critical |
templates/devops/jupyter/jupyter-unauth-rce.py |
k8s-etcd-exposed |
Kubernetes etcd Secrets Exposure | go |
critical |
templates/devops/etcd/k8s-etcd-exposed.go |
k8s-rbac-misconfiguration |
Kubernetes RBAC Misconfiguration Detection | go |
critical |
templates/devops/kubernetes/k8s-rbac-misconfiguration.go |
kubelet-api-exposure |
Kubelet API Exposure Detection | go |
critical |
templates/devops/kubernetes/kubelet-api-exposure.go |
kubernetes-api-unauthenticated |
Kubernetes API Unauthenticated Access | yaml |
critical |
templates/devops/kubernetes/kubernetes-api-unauthenticated-default.yaml |
pwn-request-scanner |
GitHub Actions Pwn Request Scanner | python |
critical |
templates/devops/github/pwn-request-scanner.py |
runner-token-detection |
runner token detection | go |
medium |
templates/devops/github/runner-token-detection.go |
saml-sso-bypass-gitlab |
saml sso bypass gitlab | python |
medium |
templates/devops/gitlab/saml-sso-bypass-gitlab.py |
service-account-token-abuse |
Kubernetes Service Account Token Abuse | go |
critical |
templates/devops/kubernetes/service-account-token-abuse.go |
messaging
Section titled “messaging”| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
kafka-unauthenticated |
Apache Kafka Unauthenticated Access Detection | shell |
high |
templates/messaging/kafka/kafka-unauthenticated.sh |
kafka-unauthenticated-access |
Kafka Unauthenticated Access Detection | python |
critical |
templates/messaging/kafka/kafka-unauthenticated-access.py |
mqtt-unauthenticated |
MQTT Unauthenticated Access (CONNACK Accepted) | yaml |
high |
templates/messaging/mqtt/mqtt-unauthenticated.yaml |
nats-unauthenticated-banner |
NATS Banner Indicates No Authentication | yaml |
medium |
templates/messaging/nats/nats-unauthenticated-banner.yaml |
rabbitmq-default-credentials |
RabbitMQ Default Credentials Detection | python |
critical |
templates/messaging/rabbitmq/rabbitmq-default-credentials.py |
rabbitmq-management-exposed |
RabbitMQ Management UI Exposed | yaml |
medium |
templates/messaging/rabbitmq/rabbitmq-management-exposed.yaml |
zookeeper-unauthenticated-access |
Apache Zookeeper Unauthenticated Access | yaml |
critical |
templates/messaging/zookeeper/zookeeper-unauthenticated.yaml |
monitoring
Section titled “monitoring”| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
cadvisor-exposed-javascript |
cAdvisor Exposed Without Authentication | javascript |
critical |
templates/monitoring/cadvisor/cadvisor-exposed.js |
cadvisor-exposed-python |
cAdvisor Metrics Exposed | python |
medium |
templates/monitoring/cadvisor/cadvisor-exposed.py |
check-metrics-endpoint |
Check /metrics Endpoint Exposure | yaml |
medium |
templates/monitoring/metrics/which-checks-metrics-available.yaml |
kibana-api-status-exposed |
Kibana /api/status Exposed | yaml |
medium |
templates/monitoring/kibana/kibana-api-status-exposed.yaml |
mysql-exporter-exposed |
MySQL Exporter Metrics Exposed | python |
medium |
templates/monitoring/exporters/mysql/mysql-exporter-exposed.py |
node-exporter-exposed-javascript |
Node Exporter Exposed Without Authentication | javascript |
high |
templates/monitoring/exporters/node/node-exporter-exposed.js |
node-exporter-exposed-python |
Node Exporter Metrics Exposed | python |
medium |
templates/monitoring/exporters/node/node-exporter-exposed.py |
postgresql-exporter-exposed |
PostgreSQL Exporter Metrics Exposed | python |
medium |
templates/monitoring/exporters/postgresql/postgresql-exporter-exposed.py |
prometheus-node-exporter-exposed |
Prometheus Node Exporter Exposed Without Authentication | yaml |
high |
templates/monitoring/exporters/node/prometheus-node-exporter-exposed.yaml |
prometheus-server-exposed-https |
Prometheus Server Exposed (HTTPS) | python |
high |
templates/monitoring/prometheus/prometheus-server-exposed-https.py |
prometheus-server-exposed-javascript |
Prometheus Server Exposed Without Authentication | javascript |
high |
templates/monitoring/prometheus/prometheus-server-exposed.js |
prometheus-server-exposed-python |
Prometheus Server Exposed | python |
high |
templates/monitoring/prometheus/prometheus-server-exposed.py |
redis-exporter-exposed |
Redis Exporter Exposed Detection | yaml |
medium |
templates/monitoring/exporters/redis/redis-exporter-exposed.yaml |
redis-exporter-exposed-python |
Redis Exporter Metrics Exposed | python |
high |
templates/monitoring/exporters/redis/redis-exporter-exposed.py |
splunk-web-login-exposed |
Splunk Web Login Exposed | yaml |
medium |
templates/monitoring/splunk/splunk-web-login-exposed.yaml |
splunkd-server-info-exposed |
Splunkd Server Info Exposed | yaml |
high |
templates/monitoring/splunk/splunkd-server-info-exposed.yaml |
network
Section titled “network”| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
adb-exposed |
ADB Over TCP Exposed | yaml |
high |
templates/network/adb/adb-exposed.yaml |
dhcpv6-solicit-response |
DHCPv6 Solicit Response Probe | python |
info |
templates/network/dhcpv6/dhcpv6-solicit-response.py |
dns-rebinding-attack |
DNS Rebinding Attack Detection | go |
critical |
templates/network/dns/dns-rebinding-attack.go |
dns-udp-service-probe |
DNS UDP Service Probe | python |
info |
templates/network/dns/dns-udp-service-probe.py |
dns-zone-transfer |
DNS Zone Transfer (AXFR) Detection | python |
high |
templates/network/dns/dns-zone-transfer.py |
echo-service-exposed |
Echo Service Exposed | yaml |
low |
templates/network/echo/echo-service-exposed.yaml |
epmd-node-list-exposed |
EPMD Node List Exposed | yaml |
medium |
templates/network/epmd/epmd-node-list-exposed.yaml |
finger-service-exposed |
Finger Service Exposed | yaml |
low |
templates/network/finger/finger-service-exposed.yaml |
ftp-anonymous-access |
FTP Anonymous Access Detection | python |
high |
templates/network/ftp/ftp-anonymous-access.py |
grpc-reflection-abuse |
gRPC Reflection API Exposure Detection | go |
high |
templates/network/grpc/grpc-reflection-abuse.go |
http-service-responding |
HTTP Service Responding | yaml |
info |
templates/network/http/http-service-responding.yaml |
icmp-echo-reachable |
ICMP Echo Reachability | python |
info |
templates/network/recon/icmp-echo-reachable.py |
ident-exposed |
Ident Service Exposed | yaml |
low |
templates/network/ident/ident-exposed.yaml |
mdns-service-discovery-probe |
mDNS Service Discovery Probe | python |
info |
templates/network/mdns/mdns-service-discovery-probe.py |
nbns-name-query-probe |
NBNS Name Query Probe | python |
info |
templates/network/nbns/nbns-name-query-probe.py |
ndmp-service-exposed |
NDMP Service Exposed | yaml |
medium |
templates/network/ndmp/ndmp-service-exposed.yaml |
ntp-udp-service-probe |
NTP UDP Service Probe | python |
info |
templates/network/ntp/ntp-udp-service-probe.py |
port-scanner-async |
High-Speed Async TCP Port Scanner | rust |
info |
templates/network/scanning/port-scanner-async.rs |
rmi-service-enumeration |
RMI Service Enumeration | java |
high |
templates/network/rmi/RmiServiceEnumeration.java |
rsync-banner-exposed |
Rsync Daemon Banner Exposed | yaml |
medium |
templates/network/rsync/rsync-banner-exposed.yaml |
smart-install-exposed |
Cisco Smart Install Exposed | yaml |
high |
templates/network/cisco/smart-install-exposed.yaml |
smtp-open-relay |
SMTP Open Relay Detection | python |
high |
templates/network/smtp/smtp-open-relay.py |
snmp-default-community |
SNMP Default Community String Detection | shell |
high |
templates/network/snmp/snmp-default-community.sh |
socks5-no-auth |
SOCKS5 No-Authentication Proxy | yaml |
high |
templates/network/socks/socks5-no-auth.yaml |
ssdp-msearch-response |
SSDP M-SEARCH Response Probe | python |
info |
templates/network/ssdp/ssdp-msearch-response.py |
tacacs-service-exposed |
TACACS+ Service Exposed | yaml |
medium |
templates/network/tacacs/tacacs-service-exposed.yaml |
tcp-banner-probe |
TCP Banner Probe | python |
info |
templates/network/scanning/tcp-banner-probe.py |
tcp-port-reachability |
TCP Port Reachability | python |
info |
templates/network/scanning/tcp-port-reachability.py |
tftp-service-exposed |
TFTP Service Exposed | yaml |
medium |
templates/network/tftp/tftp-service-exposed.yaml |
tls-certificate-deep-analysis |
TLS Certificate Deep Analysis | rust |
high |
templates/network/tls/src/main.rs |
vnc-no-auth |
VNC No Authentication Detection | c |
critical |
templates/network/vnc/vnc-no-auth.c |
websocket-message-fuzzer |
websocket message fuzzer | javascript |
medium |
templates/network/websocket/websocket-message-fuzzer.js |
whois-service-exposed |
WHOIS Service Exposed | yaml |
low |
templates/network/whois/whois-service-exposed.yaml |
wsd-probe-response |
WSD Probe Response | python |
info |
templates/network/wsd/wsd-probe-response.py |
| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
system-context-recon |
System Context Reconnaissance | shell |
info |
templates/recon/system/system-context-recon.sh |
| Template | Name | Language | Severity | Path |
|---|---|---|---|---|
auth-bypass-flow |
Authentication Bypass with Session Flow | yaml |
critical |
templates/web/auth-bypass/auth-bypass-flow.yaml |
auth-token-logout-reuse |
Authentication Token Reuse After Logout | python |
high |
templates/web/session/auth-token-logout-reuse.py |
deserialization-gadget-scan |
Deserialization Gadget Scan | java |
critical |
templates/web/deserialization/DeserializationGadgetScan.java |
directory-listing-common-paths |
Directory Listing Exposure (Common Paths) | yaml |
medium |
templates/web/directory-listing/directory-listing-common-paths.yaml |
directory-traversal |
Directory Traversal Detection | c |
high |
templates/web/traversal/directory-traversal.c |
example-http-check |
Example HTTP Security Check | yaml |
info |
templates/web/http/example-http-check.yaml |
forced-browse-auth-bypass |
Forced Browse Auth Bypass — Protected Endpoints Without Auth | python |
high |
templates/web/auth-bypass/forced-browse-auth-bypass.py |
graphql-user-enumeration |
GraphQL User Enumeration (CVE-2021-4191) | python |
medium |
templates/web/graphql/graphql-user-enumeration.py |
http-header-injection |
HTTP Header Injection Detection | python |
medium |
templates/web/injection/http-header-injection.py |
http-service-detection |
HTTP Service Detection | yaml |
info |
templates/web/http/http-detection.yaml |
http2-rapid-reset |
HTTP/2 Rapid Reset Detection (CVE-2023-44487) | go |
critical |
templates/web/http/http2-rapid-reset.go |
idor-bola-horizontal |
IDOR / BOLA Horizontal Privilege Escalation | python |
high |
templates/web/idor/idor-bola-horizontal.py |
jwt-alg-confusion |
JWT Algorithm Confusion (RS256 → HS256 / none) | python |
critical |
templates/web/jwt/jwt-alg-confusion.py |
jwt-role-tampering |
JWT Role / Privilege Claim Tampering | python |
critical |
templates/web/jwt/jwt-role-tampering.py |
log4shell-detection |
Log4Shell (CVE-2021-44228) Vulnerability Detection | shell |
critical |
templates/web/log4shell/are-vulnerable-log4shell.sh |
mass-assignment-update |
Mass Assignment via Profile / Object Update Endpoint | python |
high |
templates/web/auth-bypass/mass-assignment-update.py |
password-reset-enum |
Password Reset User Enumeration via Response Differences | python |
medium |
templates/web/session/password-reset-enum.py |
password-reset-takeover |
password reset takeover | python |
medium |
templates/web/auth-bypass/password-reset-takeover.py |
prototype-pollution |
prototype pollution | javascript |
medium |
templates/web/injection/prototype-pollution.js |
race-condition-exploit |
Race Condition Detection (TOCTOU) | go |
critical |
templates/web/race-condition/race-condition-exploit.go |
rate-limit-auth-bypass |
Missing or Bypassable Rate Limit on Authentication Endpoint | python |
high |
templates/web/session/rate-limit-auth-bypass.py |
response-integrity-audit |
Response Integrity Audit (Cache Poisoning & HPP) | yaml |
medium |
templates/web/cache/response-integrity-audit.yaml |
sensitive-data-exposure |
Sensitive Data Exposure Detection | yaml |
medium |
templates/web/sensitive-data/sensitive-data-exposure.yaml |
server-side-js-injection |
server side js injection | javascript |
medium |
templates/web/injection/server-side-js-injection.js |
session-fixation-check |
Session Fixation — Token Unchanged After Login | python |
high |
templates/web/session/session-fixation-check.py |
spring4shell-detection |
Spring4Shell Detection (CVE-2022-22965) | java |
critical |
templates/web/injection/Spring4ShellDetection.java |
sql-injection-basic |
SQL Injection Detection (Basic) | yaml |
critical |
templates/web/injection/sql-injection-detection.yaml |
sql-injection-detection-c |
SQL Injection Detection | c |
critical |
templates/web/injection/sql-injection-detection.c |
ssti-engine-fingerprint |
Server-Side Template Injection Engine Fingerprint | python |
high |
templates/web/injection/ssti-engine-fingerprint.py |
timing-attack-detection |
Blind SQL Injection (Time-Based) | yaml |
high |
templates/web/injection/timing-attack-detection.yaml |
vertical-privesc-admin |
Vertical Privilege Escalation to Admin Endpoints | python |
critical |
templates/web/auth-bypass/vertical-privesc-admin.py |
xss-detection-c |
Cross-Site Scripting (XSS) Detection | c |
high |
templates/web/xss/xss-detection.c |