Skip to content
This repository was archived by the owner on Nov 8, 2023. It is now read-only.

Conversation

@kkadosh
Copy link
Contributor

@kkadosh kkadosh commented Dec 6, 2018

Hello,

Here is an update of some core rules such as:

  • Adding more sql keyword that are not prone to FP
  • Adding wrappers (zip://, expect:// , input)
  • Adding directory traversal bypass (cf. this presentation)
  • Adding .jsp extension for file upload

TODO: Test \b(select|union|update|delete|insert|table|from|ascii|hex|unhex|drop)\b from #337

@kkadosh kkadosh changed the title Update core rules [WIP] Update core rules Dec 6, 2018
maddingue added a commit to oscaro/naxsi that referenced this pull request Sep 28, 2020
+ add more SQL keywords
+ add wrappers for `zip://`, `expect://`, `input://`
+ add `.jsp` extension for file upload
maddingue added a commit to oscaro/naxsi that referenced this pull request Oct 9, 2020
+ add more SQL keywords
+ add wrappers for `zip://`, `expect://`, `input://`
+ add `.jsp` extension for file upload
@wargio wargio changed the title [WIP] Update core rules Update core rules Oct 26, 2020
Copy link
Contributor

@wargio wargio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. no need to wait for this

@wargio wargio merged commit e6fbcd6 into master Oct 26, 2020
@wargio wargio deleted the update_core_rules branch October 26, 2020 19:57
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants