{ "llm": { "conf": 0.93299997, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 25, "prob": 0.9, "class": "hostile" }, "outcome": "hostile", "interpretation": "Self-updating offensive security tool" }, "ml": { "v": "7", "eng": "2.9.1", "lvl": 12, "conf": 93, "mods": [ { "cls": 0, "raw": 0.97617275, "rte": "az", "prob": 0.97617275 }, { "cls": 0, "raw": 0.64751023, "rte": "az/zip", "prob": 0.64751023 } ], "prob": 0.9, "files": [ { "id": 0, "lvl": 12, "conf": 93, "prob": 0.8999999761581421, "type": "zip" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000009795029654924292, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.0001276532857446, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00001598397830093745, "type": "go" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000016868114471435547, "type": "go" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000015060107216413599, "type": "go" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000017434358596801758, "type": "go" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00001241763402504148, "type": "go" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000017603239029995166, "type": "go" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000022013982743374072, "type": "go" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000012944142326887231, "type": "go" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.000020891427993774414, "type": "go" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.0015555620193481445, "type": "go" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.000015527009963989258, "type": "go" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.0000222623348236084, "type": "go" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000017662843674770556, "type": "go" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.000013510386452253442, "type": "go" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.00002158681490982417, "type": "go" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.000014762083992536645, "type": "go" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.000012556712135847192, "type": "go" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.0000129242735056323, "type": "go" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.000018358230590820312, "type": "go" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000014543533325195312, "type": "go" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.000013887882232666016, "type": "go" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.00001193086336570559, "type": "go" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.000011215607628400903, "type": "go" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000014881293282087427, "type": "go" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.000014056761756364722, "type": "go" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.0030575990676879883, "type": "go" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.000027358531951904297, "type": "go" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.000015159447684709448, "type": "go" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.00001633167266845703, "type": "go" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.00001572569271957036, "type": "go" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.00001436471939086914, "type": "go" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.000015507141142734326, "type": "go" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.000013897816643293481, "type": "go" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.00001432498265785398, "type": "go" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.00002648433110152837, "type": "go" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.00001193086336570559, "type": "go" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.000014434258446271997, "type": "go" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.000010033448234025855, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-13T04:27:03Z" }, "path": "github.com-cc1a2b-hhunter-v0.1.1.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000001IH003UCBzb/ae[n*pfjOGDvkqpBxLqKaBy/FTB$+K6e?]1ixk8E4xkRTdwKIFKzTe$+G.EOjFO:fRq2gVoIz^Z#foQ:RZU2L3^j?L%*2RHN3(4KwAe2EB.egVBnL@\u003enyTGV\u0026i(QK[\u003e1^7bdc7!\u003eGXH:$::\u003eP", "ln": 0 } ], "mol": "K(Te₂)O₆(Er₂XeCaDyEuPr)H₆(Cm₂₄Cr₂Db₅F₆Os₅Po₃)Md₃(Pa₂)Th", "sha": "10f5973589d9031ba99946b86a14c81506ed77868803772838653edda32a5c8c", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip", "risk": 321, "size": 123801, "type": "zip", "facts": { "metrics": { "file": { "size": 123801, "entropy": 7.96 }, "binary": { "peak_region_bytes": 119808, "peak_region_entropy": 7.83 }, "archive": { "file_count": 44, "member_count": 44, "script_count": 0, "zip_bomb_ratio": 7.47, "compressed_size": 115409, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.26, "hidden_file_count": 1, "uncompressed_size": 451573, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 55, "rtlo_filename_count": 0, "format.regular_count": 44, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 44, "timing.sentinel_mtime_count": 44, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 44 } } }, "ident": { "name": { "value": "github.com-cc1a2b-hhunter", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "v0.1.1", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/fingerprint::browser-user-agent-string", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "Hardcoded browser User-Agent string", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-container-list-path", "conf": 0.9, "crit": 3, "desc": "Docker Engine container-list API path", "from": [ { "file": 41 } ] }, { "id": "third_party/SigBase/SUSP/EXPL/OBFUSC/Dec21", "conf": 0.9, "crit": 5, "desc": "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228" }, { "id": "micro-behaviors/communications/http/token-auth::jwt-rsa-algorithm-field", "conf": 0.9, "crit": 3, "desc": "RSA algorithm field", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/random/crypto::go-crypto-random-read-source", "conf": 0.95, "crit": 3, "desc": "Go cryptographic random byte read", "from": [ { "off": 10165, "file": 14, "line": 365 }, { "off": 1497, "file": 16, "line": 56 } ], "uses": [ 71, 101 ] }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/encode/hex::go-hex-encode-string", "mbc": "C0026", "conf": 0.85, "crit": 3, "desc": "Go hex string encoding", "from": [ { "file": 14 } ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/header/custom::x-forwarded-host", "conf": 0.9, "crit": 3, "desc": "X-Forwarded-Host proxy header", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/data/encode/base64::encoding-base64-import", "conf": 0.5, "crit": 3, "desc": "encoding/base64 package import", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/crypto/hash/digest::go-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs Go SHA-256 operation", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-multipart-boundary", "conf": 0.88, "crit": 3, "desc": "References a multipart/mixed MIME boundary", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/fs/file/delete::os-Remove", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Delete file (os.Remove)", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/fs/file/read::go-buffer-read-string", "conf": 0.88, "crit": 3, "desc": "Go reads a delimited line", "from": [ { "file": 11 } ] }, { "id": "metadata/package/testing/corpus::sqli-category-label", "conf": 0.9, "crit": 3, "desc": "SQL injection category label", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.7, "crit": 3, "desc": "Invokes PowerShell with command-line options", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/server/listener::http-server-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "References Go's http.Server type", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-flavor-header", "conf": 0.9, "crit": 3, "desc": "Sends the GCP Metadata-Flavor request header", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/serialize/json::go-json-unmarshal", "mbc": "C0032", "conf": 0.85, "crit": 3, "desc": "Go JSON unmarshal call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/info/selfpath::os-executable", "conf": 0.7, "crit": 3, "desc": "Go queries own executable path", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/container/namespace::k8s-pods-v1-str", "conf": 0.85, "crit": 3, "desc": "Kubernetes pods API", "from": [ { "file": 41 } ] }, { "id": "objectives/credential-access/theft/keywords::api-key-field-name", "conf": 0.96, "crit": 1, "desc": "API-key field name in structured data", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-release-api-latest", "atk": "T1105", "conf": 0.84, "crit": 3, "desc": "GitHub latest release API template", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/container/runtime::kubernetes-near-node-target", "conf": 0.86, "crit": 1, "desc": "Kubernetes marker near node target", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/encode/base64::go-base64-encode-call", "conf": 0.85, "crit": 3, "desc": "Go calls a base64 encoding method", "from": [ { "file": 33 } ] }, { "id": "objectives/credential-access/env/secrets/cloud-access::aws-secret-env-access", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "Reads AWS secret key from environment", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/build::go-read-http-response-body", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Go reads an HTTP response body", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/url/parse::go-url-parse", "conf": 0.9, "crit": 3, "desc": "Parses a URL with net/url", "from": [ { "file": 15 } ] }, { "id": "objectives/execution/exploit/command-injection::log4shell-jndi-lookup-payload", "atk": "T1190", "mbc": "E1190", "conf": 0.99, "crit": 4, "desc": "Log4Shell JNDI lookup payload", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/token-auth::jwt-unsecured-algorithm", "conf": 0.98, "crit": 3, "desc": "Unsecured alg none setting", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-endpoint-reference", "conf": 0.9, "crit": 3, "desc": "Google Cloud metadata host reference", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-environ", "conf": 0.92, "crit": 3, "desc": "References own process environment procfs path", "from": [ { "file": 41 } ] }, { "id": "objectives/discovery/cloud/metadata::go-gcp-metadata-header", "atk": "T1526", "conf": 0.94, "crit": 3, "desc": "Go GCP metadata header", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "raw.githubusercontent.com JSON URL", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/http/headers::form-data-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "HTTP multipart form-data header", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/communications/http/header/custom::custom-token-header", "conf": 0.9, "crit": 3, "desc": "Sets custom X-prefixed token header", "from": [ { "file": 11 } ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-429-status", "atk": "T1590", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source checks for HTTP 429 rate-limit response", "from": [ { "file": 11 } ] }, { "id": "metadata/package/testing/corpus::injection-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple injection attack-category labels", "from": [ { "file": 32 } ], "uses": [ 7, 14 ] }, { "id": "micro-behaviors/communications/http/response::http-absolute-location-header", "conf": 0.88, "crit": 3, "desc": "Emits an absolute HTTP Location header", "from": [ { "file": 27 } ] }, { "id": "micro-behaviors/communications/http/services/aws::ec2-imds-iam-credentials-endpoint", "conf": 0.9, "crit": 3, "desc": "EC2 instance-metadata IAM credentials endpoint", "from": [ { "file": 41 } ] }, { "id": "metadata/file/string/cloud::gcp-metadata-endpoint-go-source", "conf": 0.9, "crit": 3, "desc": "GCP metadata endpoint in Go source", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/socket/listen::listen-go", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Go net.Listen call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Go source imports the net/http standard package", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/os/container/namespace::k8s-api-paths", "conf": 0.85, "crit": 3, "desc": "Kubernetes API paths", "from": [ { "off": 10323, "file": 41, "line": 129 } ], "uses": [ 20, 70 ] }, { "id": "objectives/evasion/security-bypass/access-list::agent-skill-access-list-bypass-claim", "atk": "T1562", "conf": 0.99, "crit": 4, "desc": "Skill claims access-list bypass", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/user/account::administrator-role-field", "conf": 0.9, "crit": 3, "desc": "Sets an administrator role field", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/communications/http/services/aws::iam-credentials-path-reference", "conf": 0.7, "crit": 3, "desc": "AWS IAM credentials metadata path", "from": [ { "file": 41 } ] }, { "id": "well-known/tool/detection/sast::trufflehog-detector-source-path", "conf": 0.99, "crit": 3, "desc": "TruffleHog detector implementation path", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/format/html::markdown-remote-image-source", "conf": 0.9, "crit": 3, "desc": "Markdown references a remote image", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/file/write/direct::go-os-writefile", "conf": 0.9, "crit": 3, "desc": "Go writes data with os.WriteFile", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-remote-api-ports", "conf": 0.82, "crit": 3, "desc": "Docker remote API ports", "from": [ { "off": 11445, "file": 41, "line": 145 } ], "uses": [ 79, 86 ] }, { "id": "objectives/command-and-control/trigger/activation::trigger-keyword-lower-prefix", "conf": 0.3, "crit": 1, "desc": "trigger keyword (lowercase prefix)", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/auth::sharepoint-auth-session-cookie", "conf": 0.94, "crit": 3, "desc": "SharePoint or ASP.NET auth session cookie", "from": [ { "file": 25 } ] }, { "id": "objectives/evasion/security-bypass/waf::imperva-name-reference", "conf": 0.9, "crit": 1, "desc": "References Imperva or Incapsula", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/http/sniff::cookie-request-header-token", "atk": "T1040", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Cookie request header token", "from": [ { "file": 27 } ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-injection-mutations-fn", "conf": 0.98, "crit": 3, "desc": "HHunter GetInjectionMutations function", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-cmdline", "conf": 0.66, "crit": 3, "desc": "References own command-line procfs path", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/webdav::mkcol-method", "conf": 0.95, "crit": 3, "desc": "References the WebDAV MKCOL method", "from": [ { "file": 34 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd user database access", "from": [ { "file": 32 } ], "uses": [ 63 ] }, { "id": "micro-behaviors/communications/http/lib/netlib::go-http-client-construction", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Constructs a Go HTTP client", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd-cat", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd read via cat command", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/lib/netlib::go-http-newrequest", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Creates a new HTTP request", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/http/get::http-get", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Go http.Get call", "from": [ { "file": 43 } ] }, { "id": "objectives/discovery/cloud/metadata::go-aws-metadata-endpoints", "atk": "T1526", "conf": 0.94, "crit": 3, "desc": "Go AWS metadata endpoints", "from": [ { "file": 41 } ] }, { "id": "objectives/privilege-escalation/token-manipulation::go-jwt-none-algorithm", "atk": "T1134", "conf": 0.94, "crit": 3, "desc": "Go creates JWT none algorithm", "from": [ { "file": 33 } ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/Soft", "conf": 0.9, "crit": 5, "desc": "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228" }, { "id": "metadata/package/testing/corpus::server-attack-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple server-side attack-category labels", "from": [ { "off": 6078, "file": 9, "line": 209 }, { "off": 7975, "file": 14, "line": 297 }, { "off": 1431, "file": 15, "line": 59 }, { "off": 1379, "file": 19, "line": 45 }, { "off": 3372, "file": 24, "line": 69 }, { "off": 2950, "file": 32, "line": 39 }, { "off": 389, "file": 41, "line": 10 }, { "off": 4384, "file": 43, "line": 159 } ], "uses": [ 72, 92 ] }, { "id": "micro-behaviors/os/container/namespace::k8s-apps-v1-str", "conf": 0.85, "crit": 3, "desc": "Kubernetes apps/v1 API", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/random/generator::go-rand-read-call", "conf": 0.86, "crit": 3, "desc": "Go fills bytes from rand.Read", "from": [ { "file": 14 } ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/fingerprint::browser-fetch-metadata-header", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "Browser Sec-Fetch metadata header", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/container/runtime::kubernetes-node-target-context", "conf": 0.9, "crit": 3, "desc": "References a Kubernetes node target", "from": [ { "off": 9236, "file": 41, "line": 118 } ], "uses": [ 23, 96 ] }, { "id": "micro-behaviors/fs/file/write/direct::os-write-file", "conf": 0.8, "crit": 3, "desc": "Write file via os.WriteFile", "from": [ { "file": 17 } ] }, { "id": "objectives/evasion/security-bypass/waf::aws-waf-name-reference", "conf": 0.9, "crit": 1, "desc": "References AWS WAF", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::armored-named-private-key-header", "conf": 0.95, "crit": 3, "desc": "References named armored private-key header", "from": [ { "file": 13 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "micro-behaviors/os/container/runtime::docker-api-port-2375", "conf": 0.78, "crit": 1, "desc": "Docker unauthenticated API port", "from": [ { "file": 41 } ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/port::loopback-endpoint-with-port", "conf": 0.9, "crit": 3, "desc": "Loopback socket endpoint with explicit port", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/data/string/search::go-credential-keyword-contains", "conf": 0.92, "crit": 3, "desc": "Go string search for credential-related keywords", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 26 } ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-mutation-category-impact", "conf": 0.98, "crit": 3, "desc": "HHunter mutation Category Impact fields", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/services/azure-keyvault::resource-url", "conf": 0.9, "crit": 3, "desc": "Azure Key Vault resource URL", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-port-2376", "conf": 0.72, "crit": 1, "desc": "Docker TLS API port", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-release-api", "conf": 0.6, "crit": 3, "desc": "GitHub REST releases endpoint", "from": [ { "file": 43 } ] }, { "id": "metadata/lang/source::automatically-generated-source-marker", "conf": 0.85, "crit": 1, "desc": "Generated source provenance marker", "from": [ { "file": 17 } ] }, { "id": "objectives/evasion/security-bypass/waf::multi-vendor-antibot-solvers", "conf": 0.95, "crit": 3, "desc": "Package lists multiple anti-bot solver vendors", "from": [ { "off": 20944, "file": 3, "line": 480 }, { "off": 411, "file": 9, "line": 13 }, { "off": 13887, "file": 11, "line": 457 }, { "off": 8041, "file": 13, "line": 263 }, { "off": 4631, "file": 23, "line": 59 } ], "uses": [ 56, 76, 93 ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::native-json-content-type", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Native HTTP JSON content type", "from": [ { "file": 14 } ] }, { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "from": [ { "file": 14 } ] }, { "id": "objectives/evasion/security-bypass/waf::akamai-name-reference", "conf": 0.9, "crit": 1, "desc": "References Akamai", "from": [ { "file": 3 } ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/OBFUSC", "conf": 0.9, "crit": 5, "desc": "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228" }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/container/runtime::node-target-near-kubernetes", "conf": 0.86, "crit": 1, "desc": "Node target near Kubernetes marker", "from": [ { "file": 41 } ] }, { "id": "objectives/credential-access/theft/keywords::password-field-name", "conf": 0.96, "crit": 1, "desc": "Password field name in structured data", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/webdav::propfind-method", "conf": 0.95, "crit": 3, "desc": "References the WebDAV PROPFIND method", "from": [ { "file": 34 } ] }, { "id": "objectives/exfiltration/oob/endpoint::burpcollaborator", "conf": 0.85, "crit": 3, "desc": "Burp Collaborator OOB service", "from": [ { "file": 41 } ] }, { "id": "objectives/exfiltration/oob/endpoint::interact-sh-pro-live", "conf": 0.85, "crit": 3, "desc": "interact.sh OOB service (pro/live)", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/random/crypto::go-crypto-rand-import", "conf": 0.9, "crit": 3, "desc": "Imports Go crypto/rand", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/file/rename::go-os-rename", "conf": 0.94, "crit": 3, "desc": "Go renames a file with os.Rename", "from": [ { "file": 43 } ] }, { "id": "metadata/package/manager::go-module-source-archive", "conf": 0.99, "crit": 3, "desc": "Go module source archive layout" } ] }, { "id": 3, "mol": "H(Db)", "sha": "bc4f809359faba41a516e4346025e9c3b598b868fa3af6de440d9ede9af88d48", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/README.md", "risk": 1, "size": 23812, "type": "markdown", "depth": 1 }, { "ctx": [ { "b": "boPJFB-8qjAV!w6vp%c]m%eJRwEn+?boP\u003cax\u003e7{3q/(C*Bp5v.u%)CLB7+[9avpi+y?aVgxK@r9A=kY7v@@5/wftM0B-8qjATDC$ayYFcy?aUuzY\u0026.bB-8qjATAc#awW22B-Rapo\u003c}*G3t\u003ci!wGUD8x(4q!3l{V\u003eB-5sgayX=2x\u003e5obv{%lZe?Z)KB-8qjAV+", "ln": 0, "col": 1, "line": 1 }, { "b": "e*9D5Bzbl6Bzkk[BzkVhavpu)vrlGjraQb)x(mL\u003c3sEmHvQTs\u003e3l{V)wPI@ow]zYjvrDW9azts{wmY^7C6dRswPzi*x(4H9x\u003eqt)e?Z)KB-8qjAV/BkvqWhtBS+vtBz#pZfe3:Mx!BHoA+w%9e[n*pfjwydx(k4#3lQDyeN-^zxDQK!arSl/wnbS", "ln": 225, "col": 6, "line": 19 }, { "b": "raQb)aAhvtCZgABwNPaXA=Svnz/M%(p+uc+B7F(8vpJ!UB8@Elz/fVqz!]+kfkb3wzGGDgaAI43zxHJNazt\u003esAc15[fjw*le{7JxxjVfqv@Diqx(n37A=br4ay2l@at0", "ln": 538, "col": 3, "line": 36 }, { "b": "A+cvYwPRG[BzkVh3jpfGu$9L=xBk$bnN#yIBzkujay/kaBZ#RlA=lbnwmY^7vqYP#By/JnavwK(azts{wmY!53n9#BxMXimwPw]mv{%l$eP\u0026gHBAzFyiXJddvrc0(Bs}6wz6i6\u003carSl/v@c7awc@U*axh][BAoFIboOMXlU{W-wm/T^A+cvwlQ\u0026T", "ln": 1518, "col": 26, "line": 88 }, { "b": "LZ}+TFz#/z\u0026/[#MLZ}+TFz#/z3r[VVavZ6.wnb{]ar@PFarTi^vpS}\u0026iV}JRmSir\u003evrb)\u0026wgZn?ATA{ip*[S=z^^fqatCSge?![ie?)XQaw3A?vpKyuaw2xLs7(q\u0026wO=74BrA[}Aa9*e3lQDUvru6[z/Qa:aw^8%CZfSsax8\u0026{wPzHbC@^6nA+PSfv{%fXarT3\u0026zF0P[wO#0?iV{$cxj}R{avQD/wmYT*wJyevarR^UaAITkBAIUiv}Yp*xjTaDg+ZTb\u0026!AQsgb7x?arR^HeG!FABzb2\u003cD2NhkB2\u003eB=A=\u003e}2u%)vH3l{=uawbNdp9rtPBz#wAax9x5BZ]JoA+bN+u%)wSB8L}6tm8F}DKp(rarR\u003ewwNPaXAW0K!b3lA^", "ln": 3188, "col": 104, "line": 179 }, { "b": "eIhf+A+/lbB09s.tNzO@eIh0KBy=NHfFCf/u%)vH3l{=rnP5SYxl4B5x(v(iCwhejawW8)wPw[)z/oDk3jn15boQ64Bz8^-B-IBzq/#!@wEn=Lu%)CLB7+[9ax0c2By=OpxMw3lxj@zOB-IBzw]zYjzdds8vqE6fwPzG%x\u003e7N[x(v\u003e@e?Z)KB-8qj", "ln": 4855, "col": 3, "line": 252 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 8544, "entropy": 5.24 }, "text": { "lines": 399, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.04, "space_count": 1042, "char_entropy": 5.24, "unique_chars": 99, "top_char_null": 0, "top_char_ratio": 0.06, "ascii_art_lines": 1, "avg_line_length": 20.41, "max_line_length": 123, "non_ascii_ratio": 0.02, "empty_line_ratio": 0.21, "last_line_length": 45, "long_token_count": 1, "whitespace_ratio": 0.17, "line_length_stddev": 18.95, "repeated_char_sequences": 3 }, "binary": { "peak_region_bytes": 8544, "peak_region_entropy": 5.26 } } }, "id": 4, "mol": "O(Er)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/USAGE.md", "pid": 0, "risk": 40, "sha": "e690c81ccb625115f89a4a477112cc7ceb7823d52ce70bf2ad906a5a16fef798", "size": 8544, "traits": [ { "id": "objectives/evasion/security-bypass/access-list::agent-skill-access-list-bypass-claim", "atk": "T1562", "conf": 0.99, "crit": 4, "desc": "Skill claims access-list bypass", "spans": [ [ 3284, 16 ] ] } ], "type": "markdown" }, { "id": 5, "mol": "K(Te₂)H(Db)", "sha": "88bdde5f40da6a092d51a29012935656f695d1bc0512bc129a660a05109fa251", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/detectors/body.go", "risk": 3, "size": 2435, "type": "go", "depth": 1 }, { "id": 6, "mol": "K(Te₂)H(Db)", "sha": "fcc5278af0972f9cc9dad305e6dd58f16112c3c3bdb85b84424699be6d1270aa", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/detectors/privilege.go", "risk": 3, "size": 3175, "type": "go", "depth": 1 }, { "id": 7, "mol": "K(Te₂)H(Cm)", "sha": "ca23f687c5f19880d432117d5519d68092f2186c31850b97e7d8a983a814cd6c", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/detectors/status.go", "risk": 3, "size": 1341, "type": "go", "depth": 1 }, { "id": 8, "mol": "K(Te₂)", "sha": "4dce72002630202099c8b5064645609fd47865f8c9506ad757c9b563c7acc67f", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/detectors/timing.go", "risk": 2, "size": 1430, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]wO#c{zE\u003cdZx(d*cA=-AL3jd[$BAh8kxlbm7dgcznfcBk9v}XXVz!rZ1wGV28Ab]JhwO#QhaARpday]59wN/*[wft#9v}Y:#y\u0026r%iaAITkv@0i9w/$I8Byxi5wPOo3D2NsqraPMMp\u0026ZF^x(4u6B98CBv@@\u0026u3jfTxA=#2marR^HaAITBx(mMaarSr\u003caz$?azG)YPvq]T+xK@.qnL8\u0026iaz2U8e^.[UvqY.2vp%c]arU-EA+PA7arR^WfcB7Zp+i.YvrM6gaw^u9xM4=tatczTr4Gd!z!9Aiyi7{GwPRAm3jfgxvqPO1z/PRoaAE", "ln": 0, "col": 1, "line": 1 }, { "b": "B1wCBByM{g2$5JEBZ#QqarR^HB98CpzF77matkw\u003cl03#oavgr@A+c^Am)*97avx%-B.292vrb{gaz2U8e^.[^k$h$tarR^HarU-EA+PA7arR^WfcAR#z/]P5y*?u}efEkWqY]dcmL2VFyHI6*x!gxrByM{g2#\u003eFCxL}:8z!A=}B0aW)B98CpzF77BfcAL%y-)n1By!%7wN({9wN/y\u003ez!%u8x\u003eqt)Ef{rmf8", "ln": 300, "col": 56, "line": 11 }, { "b": "DKp5=A+funA=91qx(1a.Ef{q/Ab](ex(4u6iZ1PjraPMMp\u0026ZF^x(4vcEf{q/w]zYjuO0siA3dh8aAy[dxjSh]B.2ide(Vy(xHVYNxjVa5A+PAkB0b/p2)\u003eY+v}V#CjS[//A+PA7B1QBgoMbb^AWUKse(Vy(xL}:8z!BtA3jd2TA=kM7y?kj#wN/x", "ln": 635, "col": 18, "line": 19 }, { "b": "z!rZ1wEr?)3nj4Pp\u0026Zn*A+PSfDsY/[Byxo9z/fR=z/O/*v}W09wP8Q1wPz\u0026mvqYP#vrDj1wO#Qhaz(myvruj4zGu}fvrl0\u003caA8cuwmY\u003c]v@#o)aARg8xL}:8z!Bt5w{503aw^8)z/PMlx)Kt+B-.5lx(v)gmSirDwN/y4zfo@eBzkVhB0aW)o)7K", "ln": 2810, "col": 11, "line": 90 }, { "b": "2)*]UwPS6nzxHcpx\u003eI963jd2!3jd1(fcB7Zp-%E[aA?)zzE)\u0026%vR/P#Bz\u0026o?qCoLhay/tdyIvu5zddr@Ack#9BzkVh3jd2Mw/$}ylT+7Fxk.*oau.\u003egb12m4mJ@$5D)0nUlT+7F", "ln": 4058, "col": 1, "line": 133 }, { "b": "Ab]JhB0r4QDKp5=336Q0B-Ivxb4$X6xD^=\u002634ic!2})}Oph:VOazC)tz!s95zxKaBy\u0026i*8vpB4:aARJAq=uN-3jd2Mw/$}ylT+7Fxk.*oau.\u003egb2.ArmJ@$43jd1BA+funA=90zxLz9)a{[R.Ef{pe3jm7)fcAR#z/]OxB8UY2x\u003ez6?aAhvnz/PMlx\u003eqt)329#]By!@}e\u003c\u003cC[BZ#QrjS\u003e{)aBsC42})}OlU{W-wft-2BywY*Byuq9", "ln": 6014, "col": 38, "line": 206 }, { "b": "A+5:4a{[T83jm8WwPS6nzxHb?wmoC0x)a5gB7nS@aAR4jxjVg0zF80Ma%nxUB98CpzFa2yn]FAYc#-QnBAn#Qa%qmQa$i\u003eE3i", "ln": 8926, "col": 59, "line": 315 } ], "depth": 1, "facts": { "imp": [ [ "", "strings.ToLower" ], [ "", "append" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "categorizeMutationPriority" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "make" ], [ "", "len" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "strings.ToLower" ], [ "", "strings.ToLower" ], [ "", "strings.ToLower" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "strings" ] ], "mbr": [ "audit.TechFingerprints", "audit.WAFDetected", "fp.Technology", "m.Category", "m.Header", "m.Impact", "m.Value", "profile.Cloud", "profile.Framework", "profile.Language", "profile.Server", "profile.Technologies", "profile.WAF", "strings.Contains", "strings.Join", "strings.ToLower", "tech.Cloud", "tech.Framework", "tech.Language", "tech.Server", "tech.WAF" ], "tgt": [ "append", "categorizeMutationPriority", "len", "make", "strings.Contains", "strings.Join", "strings.ToLower" ], "funcs": [ [ "BuildTechProfile", 559 ], [ "PrioritizeMutationsForTech", 2910 ], [ "categorizeMutationPriority", 3721 ], [ "GetAdaptiveSummary", 8293 ] ], "metrics": { "ast": { "op.eq": 37, "op.ne": 7, "op.add": 6, "op.lor": 22, "op.band": 1, "op.land": 8, "op.lnot": 1, "max_depth": 16, "call_count": 77, "node_count": 2865, "member_count": 21, "max_array_len": 2, "op_density.eq": 0.01, "op_density.ne": 0, "op_density.add": 0, "op_density.lor": 0.01, "op_density.band": 0, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 2, "member_depth_max": 2 }, "file": { "size": 9003, "entropy": 5.05 }, "text": { "lines": 319, "top_char": 101, "tab_count": 511, "max_ws_run": 8, "digit_ratio": 0, "space_count": 805, "char_entropy": 5.05, "unique_chars": 79, "top_char_null": 0, "string_density": 0.51, "top_char_ratio": 0.07, "avg_line_length": 27.22, "max_line_length": 116, "non_ascii_ratio": 0, "empty_line_ratio": 0.1, "last_line_length": 1, "whitespace_ratio": 0.18, "identifier_density": 1.42, "line_length_stddev": 25.29, "normalized_string_count": 9.13, "suspicious_comment_ratio": 0.04, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 5.41 }, "binary": { "peak_region_bytes": 9003, "peak_region_entropy": 5.05 }, "source": { "class_count": 1, "function_count": 4 }, "imports": { "count": 1, "stdlib_count": 1, "stdlib_ratio": 1 }, "strings": { "bytes": 983, "count": 163, "avg_length": 6.03, "max_length": 68, "avg_entropy": 2.11, "empty_count": 7, "domain_count": 5, "entropy_stddev": 0.65 }, "comments": { "chars": 1767, "count": 51, "lines": 51, "base64": 2, "to_code_ratio": 0.19 }, "functions": { "count": 5, "density": 1.25, "avg_params": 1.5, "code_ratio": 0.92, "max_params": 2, "length_stddev": 55.93, "over_100_lines": 1, "avg_name_length": 21.5, "avg_length_lines": 73.75, "max_length_lines": 165, "min_length_lines": 28, "high_entropy_names": 4, "single_char_params": 1, "avg_param_name_length": 4.5 }, "identifiers": { "count": 454, "unique": 45, "avg_length": 8.69, "max_length": 26, "min_length": 1, "avg_entropy": 2.56, "reuse_ratio": 0.1, "length_stddev": 5.38, "sequential_names": 1, "single_char_count": 2, "single_char_ratio": 0.04, "high_entropy_count": 4, "high_entropy_ratio": 0.09, "all_lowercase_ratio": 0.36, "all_uppercase_ratio": 0.04, "underscore_prefix_count": 1 } } }, "id": 9, "mol": "Md(Pa)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/adaptive.go", "pid": 0, "risk": 1, "sha": "100c05e30b0da55cdfddbe88c7bbae328c1295a777e7fcd18d09add13c44086a", "size": 9003, "traits": [ { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 6078, 4 ] ] }, { "id": "objectives/evasion/security-bypass/waf::akamai-name-reference", "conf": 0.9, "crit": 1, "desc": "References Akamai", "spans": [ [ 411, 0 ] ] }, { "id": "objectives/evasion/security-bypass/waf::aws-waf-name-reference", "conf": 0.9, "crit": 1, "desc": "References AWS WAF", "spans": [ [ 402, 0 ] ] } ], "type": "go" }, { "id": 10, "mol": "K(Te)H(Cm)Md(Pa)", "sha": "e0cf12ed416aaeea57daf317776a54e999d5d4d5b9515d29aeffd20e7debee74", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/chain.go", "risk": 3, "size": 12381, "type": "go", "depth": 1 }, { "id": 11, "mol": "O(Er)H₃(Cm₄CrF)Md(Pa)", "sha": "da5232e5bad5263670fba00b00d60191f2e72ed9364ed7328efecef5ab5f21df", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/context.go", "risk": 5, "size": 18972, "type": "go", "depth": 1 }, { "id": 12, "mol": "H(Db)", "sha": "efbeca1900b0fc751b691cca1c5a2e6a1f3a11140566abf9a003afb6a692abe1", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/dedup.go", "risk": 1, "size": 7951, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]wO#c{zE\u003cdZx(d*cA=-AL3jd[/zEWP}x(mMpyiarha{[S2zddK1a{[S2A+e({CYj\u0026l2{KCjA+PA7B0p@u3jp)2AaHdXC4\u003eF#zEWlHBy/qiB98CBv@@\u0026u3jfWSAaHdmarR^HarU-EA+PA7arSr\u003caz0fre*8uVByxolB6\u0026A\u003cvqYY", "ln": 0, "col": 1, "line": 1 }, { "b": "gZTKRz/fSgB97#hBvY$KwmY!5az\u003eLatxs[bx(mM?vScg3atkw\u003cxK$Q.wPz\u0026mBzb98ayPkdwNPQ4x(k54y?$k6vrl0@x(mH63jf4cB7Gf4zE(ELD2\u003e8JarR!hu2$adx(mMaarR^HarR^WfcA\u003e=pFJ3FwQettw].*bayX=2wO=6#wEn-gvrl0@x(mGX", "ln": 1506, "col": 25, "line": 60 }, { "b": "arR!EwPI*ezGxxged8Yi3jm7)fcAR}wN/G#B97\u0026jB-OWnz/fSgB97#hv%Fy/w]zYjuO0suauzUdA:-\u0026#wGV28B8V5nB7GznDKp5=x\u003ewGde(M\u003e2BAIT(z!9A4aW3@SA4U7hvruTklVlHDaBsC42)\u003e6We(M\u003e2BAIT(z/fSgB97#hBrAZ?w)]H%wEn.I31v{^vquhR34ic!Ef{q/fe1Cnz!%l3v@@\u00265z!aboxKL%}wPF#5zE:(1xK$W?ay/tcB7]YqwO#163jgxOB7!G-BrARcaz\u003eL5wHIz7A9Ey9A+PA7u1d.\u003cy:/X$w]zYjuO0suauzUdA:-\u0026#wGV28B8V5nB7GznDKp5=vSi}^z!ab:vrh", "ln": 2051, "col": 19, "line": 76 }, { "b": "z!0i$x(v(uay/tcBy/YsdiJ?FwPzu8v@DmbwQ5qtwmY*(A+O#]B0bge3nj4PBzbkdA+e\u003c0wN/*@z/cXiB0bgmayMy6vqYZ?A=l8waAhmux([6czy#odB-7XilUH4vyE\u00262BwmY^VwOb:\u0026v@#B6zyxvAByxo9z/cW(B-.5lx(v(uaAz4mA3cSdwPI!", "ln": 6988, "col": 25, "line": 240 }, { "b": "B0bpkyH[RjBAhIna$K\u0026XzGP=ia$K\u0026XBy/Jna$K\u0026XvpTj?zxYz]x\u003ewG7wO@]tvqH6$diH.}i3rLP2)\u003eS-BAIRwazb4#B7D)Ba%Ev2Ef{q/fe1CDyIv-gC42ifwPF#oxA", "ln": 7392, "col": 55, "line": 249 }, { "b": "vqH0@a$K\u0026XzGP=ia$K\u0026XB-7-3w[=c]wfJMEb4k20x(kaCar\u003e]sB95PS3jd1.y\u0026r/(y?N:dBrSmUa#7\u0026ie?![ie?[L3ar\u003elkAbok#vruj4zzb:Cz/c:Iar\u003elkAbok#vruj4zzclKy:7zq2)?!$wQ5qIxMO9ca$K\u0026XBy/Ysfk$-ox(kaCar\u003e@Iw?t$^efDcHDtdsxefDcEwOb:!By+", "ln": 7614, "col": 13, "line": 256 }, { "b": "B7DKDar\u003eYweN@j0xK@wsar\u003eYwePV2LA+cBC3jd1.m[3x3efDckpG7jpefDckrA7d[ar\u003cixoHR]Ha$K\u0026XpF+1ZpFK?jefDckk#Zixa$K6c2})}OlQTV(fcCsEA=#2mazCv$zGGP8x\u003eqsaaARp9BrCEfBAIRjy\u00261wtvq{f%vr9G8zxJ$hB8V5nB7DFcwNPaXA=RM]2{J\u003e}z/]P5y*?u}a$K\u0026Xvqxp*vqc]par\u003eAaB98kza$K\u0026XC42Aex(^@iefDcOxk8mda$K\u0026Xvq]T+xK@ws3jd1.v@c7awm/\u003e2zGE6Nar\u003eJqv{%s$B.\u003eFgefDcTBZ]Mmx^b8Jb6d\u003cmv@33(Bz8\u003cHar\u003eJpAaK6kviNlf2)?!wmn\u003e%0hx\u003cW{b57}pwPzV%y:7zMb4Ll", "ln": 7803, "col": 21, "line": 259 }, { "b": "iZ1QbBAh8kxdd!iB8S-#z!abx3jm7)fcAR}wN/G#vSb!5aAz49y?m9#x(v(iCwhejay/tcBy/YsayPd@y\u003cy8oA%-j/w/#epA+PA7B1P*#zGGr3zGvjnz!abAaA?gfB.90ADKp5=v@#@riZ1P]zEEvbDsY#=w]83*BzkVhlVl\u003c:wQ5qBvSb!5efGaA", "ln": 8268, "col": 7, "line": 273 }, { "b": "B-FVSar\u003e-wB9g@ex(\u003eKIar\u003eGtwOa7HefDcTA:}lRefDcBv@#B6zAPf{ar\u003eAoA=2k{BzkVhjT8A:2)?!^vrt{fvRGZ\u003ca$K\u0026XzF7KBefDcWeN\u0026BiwfJMEb6CLRzxZRs34ic!w]v", "ln": 12686, "col": 8, "line": 418 }, { "b": "zE\u003c@8B0bgmv@Dmax(!xczGE1nzxK1xvruTkay/t2wPGyBwn=ukBrCWCB-RTEBzbxf3jgAUaAhvtw[=6)ar-(\u003czFr]fcmf\u0026UAb](ex(4ukq/(C\u0026B-P]*zGxJkBy/uiaBsC4336Q0B-Ivxw)]H%wEn-(3jm7)fcAR\u003cB7DEGiV{mkf!UvqgA+XiK@#J8", "ln": 13244, "col": 28, "line": 438 }, { "b": "clKZMz!0i$x(v(ijV%]ifcRJ^D(%*XB98CpzFa2ylVl\u003c:vqfR2c#r*ivruj4zy=[Oy\u0026r%2zxZILcmf\u0026UB98CpzFa2ylVl\u003c:vqfR2c#r*ivruj4zy=[OvrDW9a$j@\u0026aBsC42)*]LB3T}\u003cxI@zLx(W={BrAZ?BAhIn3jd1BEf{n!Ef{pe3jm7)fcAR\u003cB7DEIiV{mkgA+XiK@#Ilg:2Liavy6+By/uiasIqNv}f7\u003eB7PMhaA8jgA::67z/cXwx([3bB-X:DwPI*ezGxwivSb!5dgcw}", "ln": 14595, "col": 24, "line": 469 }, { "b": "Cv+!yB98CpzF7wmB-.5lwN)zWz!abxdgcy*vrDW9l$HmYp*[D/wPzWfauzUdtu#q(A+PA7DKp5=b6v^iB-.qnA+P\u0026hwfJMEb4++lvRGv-wO@Xyar\u003el7v}x.5ay]53x\u003ep*0efDcO", "ln": 15191, "col": 29, "line": 489 }, { "b": "wN(#oar\u003eSuxk8laA+flkx(W=}a$K\u0026Xx(n95y?WA5Bz\u003e@azxZRs2)?!$z!\u0026{4az2!px(W=}a$K\u0026XB7GAlx(v(iwQ5fdA+e=9efDcQwPzT4B8#5lzxJF3zFrV)a$K6c2(", "ln": 15342, "col": 25, "line": 493 }, { "b": "zfo@eBy!#Nvrj?FzH0u/aARTDwEn.I31v{^vquhR34ic!Ef{q/fe1CxB-RTExKM6}iV})uB7Gf4zE\u003c@7vriM4wO#i\u003cy-(2sl)ct?Byxo5wftA3wPF$?pGeDIvrMi8wmYT)vqDnSx\u003ewFhvQTs?y?W=#nmuNcwO#=oDKp5=fe1Cmvrl0@x(mG8x(+yN", "ln": 15939, "col": 4, "line": 512 }, { "b": "ed8Z\u003c2})}OlVND\u003eBz\u003e/jvq])]v\u003c2\u00267v@=d5A%-iWb5?NpC42G7uU:j#b03??arR^HaAz4awQ5eDo)7J0lVl*Xx(4ueu[A@ZeIfpTm[DC#c{G:\u003cq:zKNmmehBl@Mw]D@0Ncpe+7Zao", "ln": 19556, "col": 76, "line": 623 }, { "b": "ktUlHrZxXNawkdaeIeLaeNQ1U3jd1.Ab]Vovru6/yH}=#wO#04iV]K/A+e({CYkofB-RT(z/6Dcy?k25eIeLaeKz(@nLQx%pd4]Zp/G\u003eKaw+%crZxXNawkdaeIeLaeNQ1U3jm7Cfe1Cnz/fD7v@#B6zxK1xA+PA7A%-iWb4CLezE)s1x(v(@B98CpzF7dOaAz4awQ5eDo)7J0lVl*Xx(4ueu)[l2zeTr8z!9r9krr41B8(BMkyvr[B8=2zAbP/txl4N8c{G+jy:?O@A+e=}B9}zkAD3qxA@", "ln": 19671, "col": 86, "line": 626 }, { "b": "t}oqied8Z\u003c2})}OolBYPA=bDgwPFg+2{KdAB6\u003c3cyH}xciV]K/arR^HarUYoxjVsbe\u003e{FfBvf$-Aa%c1c$3Rin[.W7v}!.Mn(F-onIJ$OnPNEvqz?@KnJ6dQA9cddn\u0026ZcewQc)!v(3?[pIABwwlhxtv@j8twjGWDu[0Sl2)?!\u003eiceCFwN/:(BrS:*arR^HarR!EwOkO0A4T\u003ecB96=/ze:i9wHH}mkwqMZBZ!{5zE){3B6Htiz.DfyA=#ebwI4t2v@DHcBs?PMyH}x\u003edj+/k2)\u0026mravQr\u003e", "ln": 21105, "col": 93, "line": 646 }, { "b": "z/6Dcy?k25c{Iz{a$bVpAa9*eCw?IjD#JInB9zexB7F\u003c4wPSrdAa@V{wQeViAa%90D3\u003c4gv}x.5uVZj4wO#)mA+PY9By!/{wQbZGtYRwQtYRwstv5HVDPiN8b48\u0026J3jm7Cfe1CtzGC", "ln": 22936, "col": 36, "line": 674 }, { "b": "33fV}B7]-gC4z^VayPkdwO#3bB7Glgx([6jwH[@FB7GxnwPzd3wPz\u003caz/dPWd%ruG2)*[A31v{^vquhR2)*]^3jd1BEf{n!Ef{pe3jm8WwPS6nzxK1izGxJlx)a4{Ef{r[B-7XiwmU", "ln": 23737, "col": 5, "line": 694 }, { "b": "b6UXFB8V2dBs?VEA=U@kzx.a:arR^HBAhIned8W\u0026b6UXFB8V2dBzVhheP$YCB7]Mgb03??BAhIned8W\u0026b6UXIwNY^{eP+]DwO@XMarR^HarR^HBAhIned8W\u0026b6UXIwNY^{eP+]DwO%8ox(mYgiV]K/BAhIned8W\u0026b6UXGvpK7:zE+tuwPz%9AW0K!arR^HBAhIned8W\u0026b6UXWB-8qnzdK[LarR^HarR^HarR^HBAhIned8W\u0026b6UXLwO#71vruBdb03??", "ln": 28000, "col": 3, "line": 817 }, { "b": "ax@bXD30QDax@b)BAh8kxcqKd33G-$ay[]5vixz}A9Ey9A+PA7u1[g#wPzx\u003ev}y1n3jgAUaz2OlauzUdyiarhe(=!avrcB5vqEu3z!abAaspScByuQWaz2Olar-(\u003czFr]fDKp5=A+funA=917u2$adx(mNgEf{pe3jg-:BAIRwaz2!tA:-E1oj-x\u0026qE%uXA=U@rwHI7$ByuZya%FDyEf{r[B-7XiwQ5rqvpKyLwQet{wN/\u003e6B7]/ec$D+dvixz}A9A", "ln": 33378, "col": 26, "line": 1008 } ], "depth": 1, "facts": { "imp": [ [ "", "len" ], [ "", "make" ], [ "", "make" ], [ "", "append" ], [ "", "len" ], [ "", "make" ], [ "", "len" ], [ "", "float64" ], [ "", "mean" ], [ "", "stddev" ], [ "", "make" ], [ "", "len" ], [ "", "float64" ], [ "", "mean" ], [ "", "stddev" ], [ "", "len" ], [ "", "strings.ToLower" ], [ "", "len" ], [ "", "make" ], [ "", "strings.ToLower" ], [ "", "delete" ], [ "", "make" ], [ "", "extractJSONKeys" ], [ "", "append" ], [ "", "make" ], [ "", "detectSensitiveDataRaw" ], [ "", "append" ], [ "", "CalculateDiffWithProfile" ], [ "", "float64" ], [ "", "float64" ], [ "", "extractJSONKeys" ], [ "", "extractJSONKeys" ], [ "", "len" ], [ "", "findNewKeys" ], [ "", "findNewHeaders" ], [ "", "findRemovedHeaders" ], [ "", "detectAuthBypassStrict" ], [ "", "detectPrivilegeElevationStrict" ], [ "", "detectSensitiveDataDelta" ], [ "", "detectCORSMisconfigStrict" ], [ "", "detectInfoDisclosureStrict" ], [ "", "detectTimingAnomalyStrict" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "strings.EqualFold" ], [ "", "make" ], [ "", "strings.EqualFold" ], [ "", "append" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "checkHeaderReflectionStrict" ], [ "", "len" ], [ "", "strings.ToLower" ], [ "", "string" ], [ "", "strings.Contains" ], [ "", "analyzeReflectionContext" ], [ "", "strings.ToLower" ], [ "", "strings.HasPrefix" ], [ "", "strings.HasPrefix" ], [ "", "strings.HasPrefix" ], [ "", "strings.HasPrefix" ], [ "", "strings.Index" ], [ "", "len" ], [ "", "len" ], [ "", "len" ], [ "", "strings.ToLower" ], [ "", "isInsideJSONString" ], [ "", "isInsideHTMLTag" ], [ "", "containsDangerousAttr" ], [ "", "strings.LastIndex" ], [ "", "strings.LastIndex" ], [ "", "strings.ContainsAny" ], [ "", "strings.TrimRight" ], [ "", "len" ], [ "", "len" ], [ "", "len" ], [ "", "strings.TrimRight" ], [ "", "strings.HasSuffix" ], [ "", "strings.HasSuffix" ], [ "", "strings.HasSuffix" ], [ "", "strings.HasSuffix" ], [ "", "strings.LastIndex" ], [ "", "strings.LastIndex" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "getHeaderValue" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "string" ], [ "", "strings.ToLower" ], [ "", "string" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "float64" ], [ "", "float64" ], [ "", "extractJSONKeys" ], [ "", "extractJSONKeys" ], [ "", "len" ], [ "", "len" ], [ "", "extractJSONKeys" ], [ "", "extractJSONKeys" ], [ "", "len" ], [ "", "countPrivilegeKeys" ], [ "", "countPrivilegeKeys" ], [ "", "strings.ToLower" ], [ "", "string" ], [ "", "strings.ToLower" ], [ "", "string" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "si.regex.MatchString" ], [ "", "si.regex.MatchString" ], [ "", "strings.ToLower" ], [ "", "strings.Contains" ], [ "", "string" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "regexp.MustCompile" ], [ "", "pattern.MatchString" ], [ "", "append" ], [ "", "strings.ToLower" ], [ "", "len" ], [ "", "regexp.MustCompile.MatchString" ], [ "", "append" ], [ "", "detectSensitiveDataRaw" ], [ "", "detectSensitiveDataRaw" ], [ "", "make" ], [ "", "append" ], [ "", "getHeaderValue" ], [ "", "strings.EqualFold" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "getHeaderValue" ], [ "", "strings.Contains" ], [ "", "strings.ToUpper" ], [ "", "strings.Contains" ], [ "", "strings.ToUpper" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "strings.ToLower" ], [ "", "len" ], [ "", "append" ], [ "", "len" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "append" ], [ "", "detectSensitiveDataDelta" ], [ "", "append" ], [ "", "float64" ], [ "", "strings.ToLower" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "len" ], [ "", "len" ], [ "", "len" ], [ "", "math.Abs" ], [ "", "len" ], [ "", "strings.EqualFold" ], [ "", "len" ], [ "", "json.Unmarshal" ], [ "", "extractKeysRecursive" ], [ "", "make" ], [ "", "append" ], [ "", "append" ], [ "", "extractKeysRecursive" ], [ "", "make" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "len" ], [ "", "float64" ], [ "", "len" ], [ "", "len" ], [ "", "mean" ], [ "", "math.Sqrt" ], [ "", "float64" ], [ "", "len" ], [ "", "encoding/json" ], [ "", "math" ], [ "", "regexp" ], [ "", "strings" ] ], "mbr": [ "baseline.Body", "baseline.BodyHash", "baseline.ContentLength", "baseline.Headers", "baseline.StatusCode", "baseline.TimingMS", "bp.AvgSize", "bp.AvgTiming", "bp.BaselineKeys", "bp.BaselineSensitive", "bp.BodyConsistent", "bp.BodyHashes", "bp.ConsistentHeaders", "bp.SizeStdDev", "bp.StatusCode", "bp.StatusConsistent", "bp.TimingStdDev", "d.AuthBypass", "d.AuthChallengeGone", "d.BodyHashChanged", "d.CORSMisconfigured", "d.HeaderReflection", "d.InfoDisclosure", "d.LocationChanged", "d.LocationHeader", "d.NewJSONKeys", "d.PrivilegeElevate", "d.ReflectedValue", "d.SensitiveDataFound", "d.SizeChangeRatio", "d.StatusChanged", "d.TimingAnomaly", "diff.AuthBypass", "diff.AuthChallengeGone", "diff.BodyHashChanged", "diff.CORSDetails", "diff.CORSMisconfigured", "diff.ContentTypeChanged", "diff.HeadersAdded", "diff.HeadersRemoved", "diff.InfoDisclosure", "diff.LocationChanged", "diff.LocationHeader", "diff.NewJSONKeys", "diff.PrivilegeElevate", "diff.SensitiveDataFound", "diff.SetCookiePresent", "diff.SetCookieValues", "diff.SizeChangeRatio", "diff.StatusChanged", "diff.TimingAnomaly", "diff.TimingDeltaMS", "json.Unmarshal", "math.Abs", "math.Sqrt", "mutated.Body", "mutated.BodyHash", "mutated.ContentLength", "mutated.Headers", "mutated.StatusCode", "mutated.TimingMS", "mutation.Value", "pattern.MatchString", "profile.BaselineKeys", "profile.BaselineSensitive", "profile.ConsistentHeaders", "profile.StatusConsistent", "profile.TimingStdDev", "r.Body", "r.BodyHash", "r.ContentLength", "r.StatusCode", "r.TimingMS", "regexp.MustCompile", "regexp.MustCompile().MatchString", "resp.Body", "resp.Headers", "si.regex", "si.regex.MatchString", "strings.Contains", "strings.ContainsAny", "strings.EqualFold", "strings.HasPrefix", "strings.HasSuffix", "strings.Index", "strings.LastIndex", "strings.ToLower", "strings.ToUpper", "strings.TrimRight" ], "tgt": [ "CalculateDiffWithProfile", "analyzeReflectionContext", "append", "checkHeaderReflectionStrict", "containsDangerousAttr", "countPrivilegeKeys", "delete", "detectAuthBypassStrict", "detectCORSMisconfigStrict", "detectInfoDisclosureStrict", "detectPrivilegeElevationStrict", "detectSensitiveDataDelta", "detectSensitiveDataRaw", "detectTimingAnomalyStrict", "extractJSONKeys", "extractKeysRecursive", "findNewHeaders", "findNewKeys", "findRemovedHeaders", "float64", "getHeaderValue", "isInsideHTMLTag", "isInsideJSONString", "json.Unmarshal", "len", "make", "math.Abs", "math.Sqrt", "mean", "pattern.MatchString", "regexp.MustCompile", "regexp.MustCompile().MatchString", "si.regex.MatchString", "stddev", "string", "strings.Contains", "strings.ContainsAny", "strings.EqualFold", "strings.HasPrefix", "strings.HasSuffix", "strings.Index", "strings.LastIndex", "strings.ToLower", "strings.ToUpper", "strings.TrimRight" ], "funcs": [ [ "NewBaselineProfile", 1760 ], [ "CalculateDiff", 3864 ], [ "CalculateDiffWithProfile", 3993 ], [ "CheckHeaderReflection", 7079 ], [ "checkHeaderReflectionStrict", 7220 ], [ "analyzeReflectionContext", 10020 ], [ "isInsideJSONString", 11354 ], [ "isInsideHTMLTag", 12338 ], [ "containsDangerousAttr", 12551 ], [ "detectAuthBypassStrict", 12938 ], [ "detectPrivilegeElevationStrict", 16853 ], [ "countPrivilegeKeys", 18545 ], [ "detectSensitiveDataRaw", 18971 ], [ "detectSensitiveDataDelta", 23840 ], [ "detectCORSMisconfigStrict", 24538 ], [ "detectInfoDisclosureStrict", 27662 ], [ "detectTimingAnomalyStrict", 29703 ], [ "IsSignificant", 30546 ], [ "getHeaderValue", 33160 ], [ "extractJSONKeys", 33353 ], [ "extractKeysRecursive", 33549 ], [ "findNewKeys", 33923 ], [ "findNewHeaders", 34208 ], [ "findRemovedHeaders", 34438 ], [ "mean", 34660 ], [ "stddev", 34827 ] ], "metrics": { "ast": { "op.eq": 29, "op.ge": 2, "op.gt": 34, "op.lt": 5, "op.ne": 30, "op.add": 20, "op.div": 5, "op.lor": 24, "op.mod": 1, "op.mul": 1, "op.sub": 13, "op.band": 4, "op.land": 39, "op.lnot": 21, "max_depth": 22, "call_count": 238, "node_count": 9203, "member_count": 89, "max_array_len": 2, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.band": 0, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 3, "self_compare_count": 1 }, "file": { "size": 35052, "entropy": 5.24 }, "text": { "lines": 1088, "top_char": 101, "tab_count": 1492, "max_ws_run": 16, "digit_ratio": 0.02, "space_count": 3482, "char_entropy": 5.24, "unique_chars": 100, "top_char_null": 0, "string_density": 0.34, "top_char_ratio": 0.08, "avg_line_length": 31.22, "max_line_length": 150, "non_ascii_ratio": 0, "empty_line_ratio": 0.13, "last_line_length": 1, "long_token_count": 3, "whitespace_ratio": 0.17, "identifier_density": 1.42, "line_length_stddev": 29.22, "normalized_string_count": 11.16, "repeated_char_sequences": 8, "suspicious_string_ratio": 0, "suspicious_comment_ratio": 0.02, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 23.99 }, "binary": { "peak_region_bytes": 7168, "peak_region_entropy": 5.65 }, "source": { "class_count": 3, "function_count": 26 }, "imports": { "count": 4, "stdlib_count": 4, "stdlib_ratio": 1 }, "strings": { "bytes": 5306, "count": 368, "ip_count": 1, "avg_length": 14.42, "max_length": 104, "path_count": 18, "avg_entropy": 2.95, "empty_count": 26, "domain_count": 5, "entropy_stddev": 0.89, "high_entropy_count": 1, "embedded_code_candidates": 1 }, "comments": { "chars": 6920, "count": 131, "lines": 131, "base64": 2, "high_entropy": 1, "to_code_ratio": 0.14 }, "functions": { "count": 29, "density": 2.39, "avg_params": 1.38, "code_ratio": 0.9, "max_params": 2, "length_stddev": 33.69, "over_100_lines": 1, "avg_name_length": 18.77, "no_params_count": 1, "avg_length_lines": 37.58, "max_length_lines": 112, "min_length_lines": 3, "high_entropy_names": 16, "single_char_params": 1, "avg_param_name_length": 6.56 }, "identifiers": { "count": 1541, "unique": 242, "avg_length": 10.07, "max_length": 30, "min_length": 1, "avg_entropy": 2.68, "reuse_ratio": 0.16, "length_stddev": 5.7, "has_digit_ratio": 0.01, "sequential_names": 7, "single_char_count": 8, "single_char_ratio": 0.03, "high_entropy_count": 26, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.34, "all_uppercase_ratio": 0, "numeric_suffix_count": 2, "keyboard_pattern_names": 1, "underscore_prefix_count": 1 } } }, "id": 13, "mol": "H₃(Cm₂CrDb₂)Md", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/diff.go", "pid": 0, "risk": 5, "sha": "417af45b222f6f4cd65a8ff0ef0b0e36ca87192ccaab10349ecf63d6d61108ee", "size": 35052, "traits": [ { "id": "micro-behaviors/communications/http/header/custom::custom-token-header", "conf": 0.9, "crit": 3, "desc": "Sets custom X-prefixed token header", "spans": [ [ 28064, 16 ] ] }, { "id": "micro-behaviors/communications/http/token-auth::jwt-rsa-algorithm-field", "conf": 0.9, "crit": 3, "desc": "RSA algorithm field", "spans": [ [ 21169, 36 ] ] }, { "id": "micro-behaviors/data/serialize/json::go-json-unmarshal", "mbc": "C0032", "conf": 0.85, "crit": 3, "desc": "Go JSON unmarshal call", "spans": [ [ 33442, 14 ] ] }, { "id": "micro-behaviors/data/string/search::go-credential-keyword-contains", "conf": 0.92, "crit": 3, "desc": "Go string search for credential-related keywords", "spans": [ [ 14659, 32 ] ] }, { "id": "objectives/evasion/security-bypass/waf::akamai-name-reference", "conf": 0.9, "crit": 1, "desc": "References Akamai", "spans": [ [ 7975, 0 ] ] }, { "id": "objectives/evasion/security-bypass/waf::imperva-name-reference", "conf": 0.9, "crit": 1, "desc": "References Imperva or Incapsula", "spans": [ [ 8041, 0 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/key::armored-named-private-key-header", "conf": 0.95, "crit": 3, "desc": "References named armored private-key header", "spans": [ [ 19735, 37 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 21169, 36 ] ] } ], "type": "go" }, { "ctx": [ { "b": "Aa9l(vp%c]wO#c{zE\u003cdZx(d*cA=-AL3jd[^z/fVdCYUbp2{J(1D2N\u003ezflgGswfIu!b4UU4z!9N1xd)}fCP)F3b4UU4z!9N1xd[1vz/c:a2{J$#BrR4#b5Q$la{[S2zE)]yxMOuna{[S2B98CpzFa2m3jd[$D2vao3jd[#x(dA93mMq?fe1CzpEm#\u003eA=#2mazC)tvqWiaB-YiNw?vF2zE:(1vqG:?vpK6}B7GxnwPw]9z/M$gz/ff3A=2JdxcpV1x(mD7C6dRswPzi*x(4H9x\u003equr3nj4PnPV7}B-8myvqWhUr8=Wpy?W%jwO#71aARp9BrC74AcckywPF#dzEWQ4x(mMaA+flkwPI%mazbUjz6iLgygQ)%wN({5vr(WcvpTBg3nj4Pv@DydwO+^%x(mMaBzbl5ayX+?yAN.qaAIHkv}/K?v\u003c2ShByxo9zV", "ln": 0, "col": 1, "line": 1 }, { "b": "v@@\u0026u3jgcKwo5!narR^HarU-EA+PA73jgo*By/GgvqF}woDXy#A+PA7atkw\u003cra]?=rz(HkByxi5wPR#oCwg(fay!?@y-)g}v@0iezY*Dte[V^/azt\u003esA5]T9D2E?CeP#8OiYG8Ui4kgvB7GxnwPw[oarR^HdRJ{CA4U72A=#2m3jgJ.B97#hwPw[oarUMkBs{m3B97#hwPwa+32K/carR^HarR^HarU-JzEUp%s50*VwQ1K*x(n37A:-E1x(v)gaz\u003eLatxs[bx(mM?dO\u0026\u0026bnP5SYA:-E1x(v(ife1CZzGGDgvpKy[z/ecmat2=1x(n37A:-E1x(v(i", "ln": 403, "col": 20, "line": 19 }, { "b": "u$%+3zAn$XA=l5rv@Dfcu)49Qar\u003eGvBz@ADz/M%AwnVDj3vJl*fe1CywP{{Clq}DoC4CXpv@=c?By/IovixD0CoxWSllG=Dy\u00260M?v@0idwPz%9ATDA3zET!:wP{]", "ln": 1676, "col": 34, "line": 52 }, { "b": "x(dB1B-YU!f!:.1aARsmwIc[)v@Dl}ed8Yi3jm8.vr9G4A=JplA=M8s3jg=ay?W%jwO#71efFIAAV^H/zE)]xoLFM\u0026wO@[uByPnlefG0^vpS[?dgcw}w/$V9AV=I*az$[faBsC4336Q0B-Ivxw]hSxmriA!A+lZzz/o8cB7GxnwPw]fx(!xczxJL1x(4u\u003eiV].)a$K\u003cFA=JPo34ic/33d.oBUlvav@0Fw3jg=aA=(nqx(mMajS[\u0026!B.7)^B1RrLe(=!9z!0Mhdgcy*xkX]8B-7XqdiJ%A2)\u003erTaz2OlauzUdB1RJBA=#2me(Mt4C4A7ye]klyBy/u3AW:6)wPz/laW3@=x(1[sclM(uAV=I*", "ln": 2447, "col": 9, "line": 80 }, { "b": "lVl^SwN/*Hz/ff3A=2w#aA}mdBAnNpz/M$eaAIHkv}/K?wN(]]B-H]jx(v(ivqYP#A+funA=b}vvqG:5v@Dl%x(X64wftP7By/G3v@#B6zGud%B-7Xid03HXpFTqQwPz%9AW-a#z!%l3v@$7RzF0Q6zdNlaCvticm0iJUBzkVhaARsmwIcw[A::4", "ln": 4219, "col": 4, "line": 152 }, { "b": "s7b/+x(mMac37hvz/M$gvqG:?vpK7]e?O+YzxZROCvticm0iJUBzkVhdgcv/BzkP6e(MN$wPf5wvqf*KB-H]jx(v(r3jha/3jg=azfmEeoMaARc[bGfwmYv:AV/AQzfmEerC(R\u003ev@0Fw3jm8.vr9G2z/ff3A=2w#ax@b3pFTqGzGGDgvpKy[z/b)*w]zYjuN#", "ln": 4451, "col": 38, "line": 155 }, { "b": "zE+epe[nsay*{*.yJz3Hv{%g\u0026vQS+Zdgcy*fe1CEA^n^HzY\u0026LdA=L-cvru66CwhejayMykwOkZ#By/G7wftP7By/G3v@#B6zvcX:w/$/9By/G3v@#B6zy=]wCXIkvB09IbaAGeHzGGDgvpKy[z/fS2x(n37A:-E1x(v(Xl%R\u003e%wQ4{gBAnNK3jd2M", "ln": 6268, "col": 20, "line": 237 }, { "b": "x(X64wfuja2)*]Fz/ff3A=2w#d\u003ep@k34ic!Ef{p4e]t.-qDmQJz!0Mhdgcy*Cp(A$vpS}\u0026c[c=EwPPsAlVl\u003c:wO#Pwrc-B]a$K\u0026Xvq{g4x\u003e7N[x(v(xyiarha$i\u003c9yiarhe(2#4mq=QNwmY^fCptdkzEWP}wHIz7A9Ey9A+PA7u1[g#wPzx\u003ev}y1nDKp5=b6d\u003cmBAITGiV]K/arR^JA=(nqx(mMced8W\u0026b6m:BvqEbGarR^HarR!Gz//A7ed8W\u0026b4CLew[=p5wN(#CarR!pz/ff3", "ln": 7079, "col": 12, "line": 261 }, { "b": "a{[R.v@Dl%x\u003eg^)v}u=zjS(Bhiw?cJ2)\u003eV%x()\u0026#azC.nwPzi?BzkVhe\u003c\u003c5?wOk}4C{4Cv2)\u003e9IB7DErq=uN-b035q2)\u003eV:C4CYdBA[#(ar\u003cf[x([60vqEa{2)*]FC5}ZEjS(:qi0]@#31Ff\u003cauZ?\u003elSVYdiwAGq3jd1Bv@Dl%x\u003eg^)v}u=CattAdh3%S@v{%B\u0026ar\u003cx{ygQ)%x(v(kiTMf133fW3wPzHbC{2l)b13x+Bzkk[y:6h)", "ln": 7911, "col": 18, "line": 293 }, { "b": "wPz%9AXhuDwmWwoltQNIyANUeADL\u0026lBAnNDzY\u0026+iBy/GgvqE5Tp\u0026!fgzdN/$wmoN*az2C3AbPDdBAnMMf/z3AgbQ)vf/z3AgbQ)qefFwswftYbv{%g!z/Z1MaxrF]ayP85z*c2iB98ECw]zYjAaK6bx([Ddwftz]B98blvruj4zGvAO3jgiJB7DErnP5oOv@#B6zx.aG2)\u003eS-BAIRwar\u003c-)zFsibDsXjcy?$kcwNPaXAV/Kly\u0026%rgayX[]z/PziAb]\u003c", "ln": 9547, "col": 49, "line": 354 }, { "b": "x(mL\u003cw{503azkn6wPzj3wL3=YwPzi?BzkVhnKK%QaAITBx(mMaDKp6*auzUdzddi\u003ec%G$^D30QGatCS23jgAUayuVxwPz/liZ1QavqYQdqE%oEc$jR!az2Olar-(\u003czFr]fDKp5=A+funA=91izfdyeAb]VgBy({BxLnY5a$K\u003cUx(dAlph+t8dk1Rrx)rxYzF{{Ldgcxf3jg-:BAIRwar\u003eGja%nxUxK#Avmq=QNwmX.Uq/)4]zF7wbdggFg3nj4PnP5oOv@$HxlqR9oy\u0026r-)B0babzE)\u0026%By/IopFTqewO#f\u0026zEWl*aA?spB7]MgB0bykaz(myvruj4zGu}AxK#67pFTq1B7GxnwPw]cB0a[3Bzk]f3taA#v\u003c1uXygQ)%pFTqNvr(WcvpTBcz/o8cdO*", "ln": 10086, "col": 59, "line": 362 }, { "b": "z/c:Iar\u003cc*x(mD7oMaM2q!P-Uy-(ztk#nX1pEllO3jd1B31X0/vqYN^wfs2Tvq{f%zE+ebzFiD@v}xg4awE02vruj4zHhY%2)*[Anm=juwPx*OarUINnm=juwPxse2)*[A307FJB.9PRarR!szfdyeAb]VgBy({BbZTozwna8vwmoBrfe1R)fc$W/a$K\u003cIz/Z1KazCvvdj+/j2)*[AlT+7Fxk.*oiV@n(lT+7Fxk.*oed8W\u00262)*]fze-][BugJ!ar\u003cc*x(mD7oMaM2q!P-Uy-(ztk#nX1pEllR3jd1B34jlf2)*[Afe1Cwl{TTFawU^13jd1B329{9auzUdz/o8qm}DNHA::63nP5SYA:-E1x(v(qz7Xv\u003cvpS}\u0026efF^Zr://!wH[@FnP5oOv@#B6zxZROb0{9WzE:\u003e-z!y[9xK#0@awtf?p/wGjpEllO3jd1B31X0/vqYN^wfs2Tvq{f%zE+ebzFiD@v}xg4awE02vruj4zHhY%2)*[Anm=juwPx*OarUINnm=juwPxse2)*[A307FJB.9PRarR!szfdyeAb]VgBy({BbZTozwna8vwmoB#iXJcjB1X?XEiHi+xM4%lefFUqgas:Y2)*[A2$5cywOk}4C@^6+e\u003c\u003c5?wOk}4C}ope2)*[AnO@APv@%:OarR\u003c{y?W=$awuY^g/F70y?$j/l{TTFawU^1a$K6c2)*]^dgcv/2)\u0026mravF$6awU^13jd1B329{aauzUdz/o8qm}DNHA::63nP5SYA:-E1x(v(qz7Xv\u003cvpS}\u0026efF^Zr://!wH[@FnP5oOv@#B6zxZROb0{9WzE:\u003e-z!y[9xK#0@avF$6awU^1a$i\u003c92)*]HzFiD@v}xf[jS[fLAaJ]$c$NpfvqYN^wgO\u0026$B-.5lx(v)o3jd1B2)\u003cdlvpS}\u0026iV]K/z7Xv\u003cvpS}\u0026ed8W\u00262)*]svqH6$iV]K/azbFje(M.fx(n38c)x{-yhNM@i+ibHiXJcjB1X?XEiHi+xM4%lefFUqgBT\u003cZ2)*[A2$5cywOk}4C@^6+e\u003c\u003c5?wOk}4C}ope2)*[AnO@APv@%:OarR\u003c{y?W=$awuY^g/F70y?$jZpe-ohpEllR3jd1B34jlf2)*[Afe1CCo?uE6pEkx{2)*]LwhCz\u0026jS[VYvLgeZzE)\u0026%By!3YBy/G3v@#B6zyxuOnm=juwPxsAz7X\u003c$y\u0026%quar\u003cx{ygQ)%x(v(kefDc6y?W=$awuY^g/F70y?$j(o?uE6pEllO3jd1B31X0/vqYN^wfs2Tvq{f%zE+ebzFiD@v}xg4awE02vruj4zHhY%2)*[Anm=juwPx*OarUINnm=juwPxse2)*[A307FJB.9PRarR!szfdyeAb]VgBy({BbZTozwna8Bzd#3:fc$V)c3aFUefFRAB95@Qx\u003ef4Hed8W\u00262)*]9vru6[z/Qa:az\u0026.#vru6[z/QaO3jd1B2)\u003cguAa9l#iV]K/b0{9WzE:\u003e-z!y[9xK#0@aw${9awU^1a$K6c2)*]^dgcv/2)\u0026mrawVDUB-R53By!#9oHIfyawU^1asHqSmJ=e=Aa9*edgcv/2)\u003erRh6s}yaA8gce\u003eoF\u003cwPzj3wL3=YwPzi?BzkVhc#yOcwNPaXAX5tIe((y%B.99Db1VV!wN/*@z/c:Iar\u003cc*x(mD7oMaM2q!P-Uy-(I.w{5f8vru6\u003eawU^1a$i\u003c92)*]HzFiD@v}xf[jS[fLAaJ]$c$NpfvqYN^wgO\u0026$B-.5lx(v)o3jd1B2)\u003cdlvpS}\u0026iV]K/z7Xv\u003cvpS}\u0026ed8W\u00262)*]svqH6$iV]K/azbFje(M.fx(n38c)x{-bZTuCCv+!Qyjf#gx/WI^y\u0026sJeAYO2+wmoBrfe1R)fc$W/a$K\u003cIz/Z1KazCvzdj+/j2)*[AlT+7Fxk.*oiV@n(lT+7Fxk.*oed8W\u00262)*]fze-][BugJ!ar\u003cc*x(mD7oMaM2q!P-Uy-(I.w{5f8vru6\u003eawU^1a$K6c2)*]^dgcv/2)\u003erRhxU4zaA8gce\u003eoF\u003cwPzj3wL3=YwPzi?BzkVhc#yOcwNPaXAX5tIe((y%B.99Db1VV!wN/*@z/c:Iar\u003cc*x(mD7oMaM2q!P-Uy-(F:B97#7awU^1a$i\u003c92)*]HzFiD@v}xf[jS[fLAaJ]$c$NpfvqYN^wgO\u0026$B-.5lx(v)o3jd1B2)\u003cdl", "ln": 12647, "col": 63, "line": 439 }, { "b": "wNPaXAX4L72)*[Ar://!wJy}RarR\u003cNDUNCex/Z6vvq[mXfcRI?aztXmBrA7Ra$\u003eb.d\u003ceLphY%Q[a$\u003ei*wO#VLl03#(q:\u003c5Kmo0RWlQKpvq^Sf^s:+Yxed8W\u00262)*]9vru6[z/Qa:az\u0026.#vru6[z/QaO3jd1B2)\u003cguAa9l#iV]K/b1#]/g/F70y?$jWs5QkmwQby!CXgVaawU^1a$K6c2)*]^dgcv/34ic/2)*[\u003efcBw0miCx4llLorLPT*=y\u0026\u003cxgy?j-hwN/y\u003ex(OobA@", "ln": 14718, "col": 19, "line": 488 }, { "b": "aA8gce\u003eoF\u003cwPzj3wL3=YwPzi?BzkVhc#yOcwNPaXAX5tIe((y%B.99Db1VV!wN/*@z/c:Iar\u003cc*x(mD7qBr\u003e}v%8*dawU^1a$i\u003c92)*]HzFiD@v}xf[jS[fLAaJ]$c$NpfvqYN^wgO\u0026$B-.5lx(v)o3jd1B2)\u003cdlvpS}\u0026iV]K/z7Xv\u003cvpS}\u0026ed8W\u00262)*]svqH6$iV]K/azbFje(M.fx(n38c)B3Yv%8*dash7Zc37mYay!?@y*{*.yGjnaefFUqf!1TX2)*[A2$5cywOk}4C@^6+e\u003c\u003c5?wOk}4C}ope2)*[AnO@APv/", "ln": 17281, "col": 11, "line": 546 }, { "b": "wPxse2)*[A307FJB.9PRarR!szfdyeAb]VgBy({BD)0SCwPP4DAuD\u0026eeG=uXfc$V-efFChy\u00260M?v@27xoE}r2whkO+3jd1B2)\u0026$cBy/96A^oX*z7Xg:By/96A^ohy2)*[", "ln": 17712, "col": 22, "line": 555 }, { "b": "wmY^xarR!ze\u003exLZwmY^j3jd1B2)\u003cTvy\u0026%qIarR^Hw]hSxq/D+\u003ezGGFsb77IJB8k=kyJTOsc37W+B0rdTx\u003ef1JaztXmBsw:F2)*[A2$5cywOk}4C@^6+e\u003c\u003c5?wOk}4C}ope2)*[AnO@APv@%:OarR\u003c{y?W=$ao", "ln": 17999, "col": 9, "line": 562 }, { "b": "wPxse2)*[A307FJB.9PRarR!szfdyeAb]VgBy(}ebQ^eBA+(\u003cAB1X?Xfc?@\u0026xM4r@x^\u003eGsefFChy\u00260M?v@27xoE}r2whC.^3jd1B2)\u0026$cBy/96A^oX*z7Xg:By/96A^ohy2)*[A2$X#MvpKyuarQ", "ln": 18310, "col": 22, "line": 569 }, { "b": "awE02vruj4zHhY%2)*[Anm=juwPx*OarUINnm=juwPxse2)*[A307FJB.9PRarR!szfdyeAb]VgBy(}eclNnCCv+/oxK#0@at47Cb1U\u003clat3Plx=[Zyfc$V-u[rBgvqG:?vpK7MqCnR:x\u003ef7Ied8W\u00262)*]9vru6[z/Qa:az\u0026.#vru6[z/QaO3jd1B2)\u003cguAa9l#iV]K/b0{9WzE:\u003e/lQ-a]z*b=kq!P-Uy-(IHllEWTx(mE1CxkhSed8W\u00262)(2e3jd1BEf{q/2)\u0026mravo)UzE:\u003e(q=s/mpElfLAaK6hx(!xczGE16q=s/HwPRG[BzkVhdgcv/329#]B98CpzFa2ylVl\u003c:vqfR2c#0KqvpKyMz*b=kefDcYB8@JOaBFLVB98CpzFa2ylVl\u003c:vqfR2c#yOqvqH6$efDc0B7ol8Ac9oMaBFLz2)*[AB98CpzF5", "ln": 18597, "col": 32, "line": 575 }, { "b": "B8\u003e+kpFTq3ed8W\u00262)(2e3jd1B329{9auzUdz/o8qm}DNHA::63nP5SYA:-E1x(v(qz7Xv\u003cvpS}\u0026efF^Zr://!wH[@FnP5oOv@#B6zxZROb0{9WzE:\u003e(q=s/qv@=p5BrBvPllW\u0026=2)*[AwO#f\u0026zEWl*auZ\u0026QAbYxawgh2bxKL^*wN)tmo)7L^BzkVhDKp5=2)*]ewNPaXAYLr=ao", "ln": 19298, "col": 31, "line": 591 } ], "depth": 1, "facts": { "imp": [ [ "", "strings.TrimRight" ], [ "", "make" ], [ "", "http.NewServeMux" ], [ "", "mux.HandleFunc" ], [ "", "mux.HandleFunc" ], [ "", "mux.HandleFunc" ], [ "", "net.Listen" ], [ "", "fmt.Errorf" ], [ "", "s.mu.Lock" ], [ "", "s.mu.Unlock" ], [ "", "s.server.Serve" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "s.mu.Lock" ], [ "", "s.mu.Unlock" ], [ "", "context.WithTimeout" ], [ "", "context.Background" ], [ "", "cancel" ], [ "", "s.server.Shutdown" ], [ "", "s.mu.RLock" ], [ "", "s.mu.RUnlock" ], [ "", "generateInteractionID" ], [ "", "s.mu.Lock" ], [ "", "time.Now" ], [ "", "s.mu.Unlock" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Printf" ], [ "", "time.Sleep" ], [ "", "s.mu.RLock" ], [ "", "s.mu.RUnlock" ], [ "", "append" ], [ "", "s.mu.RLock" ], [ "", "s.mu.RUnlock" ], [ "", "make" ], [ "", "len" ], [ "", "copy" ], [ "", "s.mu.RLock" ], [ "", "s.mu.RUnlock" ], [ "", "s.mu.RLock" ], [ "", "s.mu.RUnlock" ], [ "", "strings.TrimPrefix" ], [ "", "strings.SplitN" ], [ "", "w.WriteHeader" ], [ "", "make" ], [ "", "len" ], [ "", "time.Now" ], [ "", "s.mu.Lock" ], [ "", "append" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "s.mu.Unlock" ], [ "", "w.WriteHeader" ], [ "", "s.mu.RLock" ], [ "", "len" ], [ "", "s.mu.RUnlock" ], [ "", "w.Header.Set" ], [ "", "w.Header" ], [ "", "json.NewEncoder.Encode" ], [ "", "json.NewEncoder" ], [ "", "len" ], [ "", "s.mu.RLock" ], [ "", "s.mu.RUnlock" ], [ "", "w.Header.Set" ], [ "", "w.Header" ], [ "", "json.NewEncoder.Encode" ], [ "", "json.NewEncoder" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "interaction.Callback.ReceivedAt.Format" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "getOOBRemediation" ], [ "", "time.Now" ], [ "", "time.Now" ], [ "", "make" ], [ "", "rand.Read" ], [ "", "fmt.Sprintf" ], [ "", "time.Now.UnixNano" ], [ "", "time.Now" ], [ "", "hex.EncodeToString" ], [ "", "oob.IsRunning" ], [ "", "append" ], [ "", "oob.GenerateInteraction" ], [ "", "oob.GetCallbackURL" ], [ "", "extractHost" ], [ "", "append" ], [ "", "append" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "append" ], [ "", "append" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "oob.GenerateInteraction" ], [ "", "oob.GetCallbackURL" ], [ "", "extractHost" ], [ "", "strings.ToLower" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "oob.GenerateInteraction" ], [ "", "oob.GetCallbackURL" ], [ "", "append" ], [ "", "oob.GenerateInteraction" ], [ "", "oob.GetCallbackURL" ], [ "", "append" ], [ "", "strings.TrimPrefix" ], [ "", "strings.TrimPrefix" ], [ "", "strings.SplitN" ], [ "", "context" ], [ "", "crypto/rand" ], [ "", "encoding/hex" ], [ "", "encoding/json" ], [ "", "fmt" ], [ "", "net" ], [ "", "net/http" ], [ "", "strings" ], [ "", "sync" ], [ "", "time" ] ], "mbr": [ "context.Background", "context.WithTimeout", "evidence.callback_from", "evidence.callback_method", "evidence.callback_path", "evidence.callback_time", "fmt.Errorf", "fmt.Printf", "fmt.Sprintf", "hex.EncodeToString", "http.ErrServerClosed", "http.NewServeMux", "http.StatusOK", "i.Confirmed", "interaction.Callback", "interaction.Callback.Method", "interaction.Callback.Path", "interaction.Callback.ReceivedAt", "interaction.Callback.ReceivedAt.Format", "interaction.Callback.RemoteAddr", "interaction.Category", "interaction.Confirmed", "interaction.Header", "interaction.ID", "interaction.Impact", "interaction.Payload", "json.NewEncoder", "json.NewEncoder().Encode", "m.Category", "m.Header", "m.Impact", "m.Value", "mux.HandleFunc", "net.Listen", "oob.GenerateInteraction", "oob.GetCallbackURL", "oob.IsRunning", "r.Header", "r.Method", "r.RemoteAddr", "r.URL", "r.URL.Path", "rand.Read", "s.addr", "s.callbacks", "s.externalURL", "s.handleCallback", "s.handleHealth", "s.handleListInteractions", "s.interactions", "s.listener", "s.mu", "s.mu.Lock", "s.mu.RLock", "s.mu.RUnlock", "s.mu.Unlock", "s.running", "s.server", "s.server.Serve", "s.server.Shutdown", "strings.Contains", "strings.SplitN", "strings.ToLower", "strings.TrimPrefix", "strings.TrimRight", "time.Now", "time.Now().UnixNano", "time.RFC3339", "time.Second", "time.Sleep", "w.Header", "w.Header().Set", "w.WriteHeader" ], "tgt": [ "append", "cancel", "context.Background", "context.WithTimeout", "copy", "extractHost", "fmt.Errorf", "fmt.Printf", "fmt.Sprintf", "generateInteractionID", "getOOBRemediation", "hex.EncodeToString", "http.NewServeMux", "interaction.Callback.ReceivedAt.Format", "json.NewEncoder", "json.NewEncoder().Encode", "len", "make", "mux.HandleFunc", "net.Listen", "oob.GenerateInteraction", "oob.GetCallbackURL", "oob.IsRunning", "rand.Read", "s.mu.Lock", "s.mu.RLock", "s.mu.RUnlock", "s.mu.Unlock", "s.server.Serve", "s.server.Shutdown", "strings.Contains", "strings.SplitN", "strings.ToLower", "strings.TrimPrefix", "strings.TrimRight", "time.Now", "time.Now().UnixNano", "time.Sleep", "w.Header", "w.Header().Set", "w.WriteHeader" ], "funcs": [ [ "NewOOBServer", 1766 ], [ "Start", 2153 ], [ "Stop", 3032 ], [ "IsRunning", 3307 ], [ "GenerateInteraction", 3483 ], [ "GetCallbackURL", 3890 ], [ "GetDNSHostname", 4096 ], [ "CollectConfirmed", 4306 ], [ "GetAllCallbacks", 4797 ], [ "PendingCount", 5054 ], [ "ConfirmedCount", 5297 ], [ "handleCallback", 5529 ], [ "handleHealth", 6897 ], [ "handleListInteractions", 7446 ], [ "OOBToFindings", 7733 ], [ "getOOBRemediation", 9417 ], [ "generateInteractionID", 10090 ], [ "InjectOOBPayloads", 10379 ], [ "extractHost", 20372 ] ], "metrics": { "ast": { "op.eq": 4, "op.gt": 2, "op.ne": 6, "op.add": 28, "op.lor": 15, "op.mul": 3, "op.sub": 1, "op.band": 4, "op.land": 1, "op.lnot": 2, "max_depth": 26, "call_count": 182, "node_count": 6294, "member_count": 73, "max_array_len": 2, "op_density.eq": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.band": 0, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 5, "member_depth_max": 4 }, "file": { "size": 20570, "entropy": 5.26 }, "text": { "lines": 633, "top_char": 101, "tab_count": 1371, "max_ws_run": 14, "digit_ratio": 0.02, "space_count": 2150, "char_entropy": 5.26, "unique_chars": 94, "top_char_null": 0, "escape_density": 0.06, "string_density": 0.35, "top_char_ratio": 0.07, "avg_line_length": 31.5, "max_line_length": 191, "non_ascii_ratio": 0, "empty_line_ratio": 0.1, "last_line_length": 1, "whitespace_ratio": 0.2, "identifier_density": 2.12, "line_length_stddev": 28.27, "octal_escape_count": 12, "normalized_string_count": 8.74, "repeated_char_sequences": 15, "suspicious_string_ratio": 0.1, "suspicious_comment_ratio": 0.1, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 18.7 }, "binary": { "peak_region_bytes": 18432, "peak_region_entropy": 5.41 }, "source": { "class_count": 3, "function_count": 19 }, "imports": { "count": 10, "stdlib_count": 10, "stdlib_ratio": 1 }, "strings": { "bytes": 3754, "count": 220, "shell": 18, "url_count": 5, "avg_length": 17.06, "max_length": 180, "path_count": 4, "avg_entropy": 2.9, "empty_count": 2, "entropy_stddev": 1.16, "embedded_code_candidates": 3 }, "comments": { "chars": 2235, "count": 52, "lines": 52, "base64": 3, "high_entropy": 2, "to_code_ratio": 0.09, "url_in_comments": 1 }, "functions": { "count": 22, "density": 3, "avg_params": 0.84, "code_ratio": 0.86, "max_params": 2, "length_stddev": 55.25, "over_100_lines": 1, "avg_name_length": 13.74, "no_params_count": 7, "avg_length_lines": 28.58, "max_length_lines": 254, "min_length_lines": 3, "high_entropy_names": 4, "single_char_params": 6, "avg_param_name_length": 5.94 }, "identifiers": { "count": 1343, "unique": 174, "avg_length": 7.3, "max_length": 22, "min_length": 1, "avg_entropy": 2.35, "reuse_ratio": 0.13, "length_stddev": 4.08, "has_digit_ratio": 0.05, "sequential_names": 7, "single_char_count": 8, "single_char_ratio": 0.05, "high_entropy_count": 5, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.37, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 8, "keyboard_pattern_names": 1, "underscore_prefix_count": 1 } } }, "id": 14, "mol": "O₂(XeCa)H₄(Cm₃DbOs₂Po₂)Md₂(Pa)Th", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/oob.go", "pid": 0, "risk": 263, "sha": "656119792733de53f128109012b756082e9b6182a655edc4de967b47d7f6dea1", "size": 20570, "traits": [ { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "spans": [ [ 17345, 3 ] ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 7975, 4 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 18820, 3 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::native-json-content-type", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Native HTTP JSON content type", "spans": [ [ 7143, 32 ] ] }, { "id": "micro-behaviors/communications/http/server/listener::http-server-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "References Go's http.Server type", "spans": [ [ 528, 11 ] ] }, { "id": "micro-behaviors/data/encode/hex::go-hex-encode-string", "mbc": "C0026", "conf": 0.85, "crit": 3, "desc": "Go hex string encoding", "spans": [ [ 10262, 18 ] ] }, { "id": "micro-behaviors/os/random/crypto::go-crypto-rand-import", "conf": 0.9, "crit": 3, "desc": "Imports Go crypto/rand", "spans": [ [ 37, 11 ] ] }, { "id": "micro-behaviors/os/random/generator::go-rand-read-call", "conf": 0.86, "crit": 3, "desc": "Go fills bytes from rand.Read", "spans": [ [ 10165, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "spans": [ [ 18663, 13 ] ] }, { "id": "objectives/credential-access/env/secrets/cloud-access::aws-secret-env-access", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "Reads AWS secret key from environment", "spans": [ [ 14782, 25 ] ] }, { "id": "objectives/execution/exploit/command-injection::log4shell-jndi-lookup-payload", "atk": "T1190", "mbc": "E1190", "conf": 0.99, "crit": 4, "desc": "Log4Shell JNDI lookup payload", "spans": [ [ 12775, 14 ], [ 13095, 15 ], [ 13413, 13 ], [ 13727, 13 ] ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "spans": [ [ 9611, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Go source imports the net/http standard package", "spans": [ [ 99, 8 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen-go", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Go net.Listen call", "spans": [ [ 2511, 10 ] ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.7, "crit": 3, "desc": "Invokes PowerShell with command-line options", "spans": [ [ 18661, 15 ] ] }, { "id": "metadata/package/testing/corpus::server-attack-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple server-side attack-category labels", "uses": [ 0, 1 ], "spans": [ [ 7975, 4 ], [ 17345, 3 ] ] }, { "id": "micro-behaviors/os/random/crypto::go-crypto-random-read-source", "conf": 0.95, "crit": 3, "desc": "Go cryptographic random byte read", "uses": [ 6, 7 ], "spans": [ [ 37, 11 ], [ 10165, 9 ] ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/Soft", "conf": 0.9, "crit": 5, "desc": "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228", "spans": [ [ 12775, 13 ], [ 13095, 14 ], [ 13413, 12 ], [ 13727, 12 ] ] }, { "id": "third_party/SigBase/SUSP/EXPL/OBFUSC/Dec21", "conf": 0.9, "crit": 5, "desc": "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228", "spans": [ [ 14075, 10 ], [ 14089, 10 ] ] } ], "type": "go" }, { "ctx": [ { "b": "Aa9l(vp%c]wO#c{zE\u003cdZx(d*cA=-AL3jd[^A^qRCz.DiGB0p}$b4+Xla{[S2zE)]yxMOuna{[S2zE)]yB-Ipx3jd[$BAh8kxlbm72{KCozET\u003c$2{KCozEUtdBz(2gv\u003chl^b6mKowG?Eg3jp@+AV=+q2$FMGl3mo.o)7L^BzkVhB08OFarR^Hazb+lv\u003c\u0026=Gtu%%CByxo9z/b)*m}D^sA=lhFo)7L^BzkVhB08O", "ln": 0, "col": 1, "line": 1 }, { "b": "arUoszEU7zax@bCB-.5lx(v\u003e@2$FMGq/cU\u0026xkzp1xh9I\u003cvruj4zGu{yazb+lv\u003c\u0026=Gtu%%CByxo9z/b)*m}D^lzFA-)BzkVho)7L^BzkVhB08OFw{503c[coyt$]D-vruj4zvcXuwPQ\u003cHqBTx6Byxo9z/fRsarR^HarR!sB-7XqdiI\u00262o)7L^BzkVh3jfjlBvZs?lu#auA7$E%vruj4zGu{yarUoszEU7zax@bCB-.5lx(v\u003e@2$FMGqEKVUoLFuTBwl[1vruj4zu", "ln": 401, "col": 24, "line": 21 }, { "b": "arR^HvScg33jfaivS=raarR^HarUciz!]:!q/cU\u0026xkzp1xcnrtvScg33jfpwygQ)%x(v(iarUciz!]:!q=uN-arR^HarR^HvScg33jfmwA6!?vz/u*warUciz!]:!qEKVUoLFuTBrzXGvScg33jfTxv%8*aBA[#KarUciz!]:!s7L\u0026tz!0M]BrzXGvScg33jfsar3iqaarR^HarUciz!]:!lScPEarR^HarR^HvScg33jf7rz!\u003c5#", "ln": 1367, "col": 10, "line": 55 }, { "b": "C42Daz/cWuvScg33jf1vwnccdarR^HarUciz!]:!qE%uRzxH5AarR^HvScg33jf:AA+PcharR^HarUciz!]:!p\u0026ZG0C#W:oarR^HB98CpzF6p.s8Sa{wPz\u0026marR^Hx-", "ln": 1726, "col": 6, "line": 75 }, { "b": "B9RUke\u003e{FgwQ1K*Ab](fA+frkarR^Hx(n2Jg:1C8ayPwgze0G5v@DHcBy/Fnw]zYjAb](fA+frkay]hcAbn%d3jg/)Byw#WB-.WEarUxoBt+@#fe1C\u0026z//A7az(myvruj4zGu}xzY\u003cdkB94+q3jpx/zET!:wP{{\u003cv}YB{BAg/iz/Nmoz/ff3xcnV", "ln": 3480, "col": 14, "line": 130 }, { "b": "x(v(IarUo8y\u0026:es3jha/3jgAUay/tcw[+)gp\u0026ZG0C#W:oar-(\u003ca%FdR3jd2TA=lhFrz(Hwaz2OlauzUdB-IpJp*[x=wHI5bzF0P}e(lObCZip!oEQqP329#]wPz/ljV%{9x(1]s3jd1BBAg/cB8V5rBs{ygz*lKIjS[AWBz@\u003ceA=lhFrz(HsAb](wC#W:odgcv/Ef{pe3jm8WwN]H}wN/*Uz!%b$C{2dhazb+lv\u003c(weAuD-ABAzEOqE%\u0026\u003cwD", "ln": 3861, "col": 18, "line": 141 }, { "b": "x(W={BwM)(x\u003e8AhjS[SRy-\u003ew:axrF]ay]4}vrDydaAz47x(W={BrCKvy?Wy83jha/3jgiUx\u003eqg7auzUdctmHyA4TH]x\u003eqg7DKp5=rb#z+B8V5rBugJ!arR!GA:-\u003cbAbP=sed8W\u0026rb3hXz/{d.arR^HarR!pz/ff3xd^d$zdNTdBsW+92$5xqv@1$Nwnc6}v@%:OA+e=}A+e:5p\u0026ye:v%GQj34ic/336Q0B-IvxcqOU(xK#mbA::6dA^Fc131E)\u003ew=", "ln": 4165, "col": 6, "line": 155 }, { "b": "wPI*ezGxxgefF$AB8SMn2)\u003erTazz@XayX=2wO=6#wM92OAbo9beIOw{3jd1BBzkP6e(MN$wPf4LfFBR0aARsmwIcX\u003ey\u00260*bwN/T@wgm\u0026(34ic!Ef{q/z.tHcB7Gf4zE\u003c}NayX=2wO=6#wM08XAbPSnwPI6ft)Z)Re]U\u0026Hw[=6)auZ\u0026xwP{EHB7Gf4zE(T+z!n", "ln": 5230, "col": 39, "line": 195 }, { "b": "z/PS8A=Su^atUXU34ic/2})}OlVl\u003cLB-IIlzGE1rB-.5lx(v(iBy/Jnx(mMaCwhejaAhvtxl4N8A%-jZBz(2gv\u003eHY4z/PzXzGE=[c)\u0026\u003c+Bz(nfy!Y4]B1wCFzGE=[c#rEjc#B9Gvruj4zGvlQdgcw\u0026Bz(2gv\u003eHY4z/PzXzGE=[c)\u0026\u003c+Ab](fA+frk", "ln": 7759, "col": 13, "line": 279 }, { "b": "xd=FXwgfeY3jd2WwO\u0026LLeG/aRA=\u003e(lDWQl?3jm7CxkX]8B-7Xqx\u003ehDhx(n2zaz(myawE02vruj4zyDYP3jd1BwmYv:AV/Nse\u003c%R}wHF#m2)*]GwObH]azb+lv\u003c\u0026=GDMUB5", "ln": 8024, "col": 4, "line": 290 }, { "b": "y?k452)\u0026mraw3e/zF%MjvqGU7wN({8x(dN2vrc77C{3*xaA?spC{3^mxj@?sBzbkdvSb!5ay/7[zF9J6x(+ziB-RTEwo\u002663ze0G5v@DmbwO#O%2)\u003erTaAImle(3t9zddl{DsZRNz!ab(x(dN2vrc77C{2o[fFkvyasnATB7]Fzq/)55v@#\u003clvqF\u003c", "ln": 11423, "col": 66, "line": 424 }, { "b": "z/ff3wmYT*wM98SA+cvSattAaaBsC42)*]Lw/#1AC4CYdw{D\u003cWzE^E0xdb9sx(mD}zF7Hyzfo@eBzkVhdiJ%A2)*[A32.CkBUlvav@0Fw3jd1B2)\u003eJ5C4CYdw[+*!d\u003ep@k2)*[Az.q", "ln": 11883, "col": 35, "line": 440 }, { "b": "Ef{pe3jm7)fcA$$ByO#bB7]@iiV@uUy\u003cvdxA=kD0B8@EAwPI*ezGxxgaA7\u003cmBzbxfaAImywGSyBx([2hf!:)@Bz\u003e#bA:-\u0026}wHN@)x\u003ewGae[n*qw[+)go\u003c@cNxJ5R\u003ewGTeVfD+YH2)\u003eY(y?mS}zEWl2iZ1P$y\u0026r:7hz=?2e[n*qw[+)go\u003c@cNxJ5R\u003e", "ln": 12707, "col": 3, "line": 476 }, { "b": "lv0JUB8@EJ3jd2JzfdybA+PAkc)z[IgC-k\u0026j2nQdk#*(PuQv)(k#QY!fF+H?fL}{Rdgcxf3jgAUay]g#w?D]2x)aibwOkNyy?m=#By=Ow3jd2JzfdybA+PAkc)z[IgC-k\u0026j2nO", "ln": 13910, "col": 14, "line": 515 }, { "b": "l$7gCmSiA!wgnS+ats{+3jd2IC4\u003eF#zEWlZb6dskB7]-gC4C2\u003evrt{4t{8oMB98CpzFa2yn]FAYc$E47w?E1[zGxJlx)a5Qvrt{Ez/]@defDb/ar\u0026lw34ic!x\u003ewG7wO@]bx\u003ey%fnP5cUl${ZLy\u0026sxqA+cWxj%hK4DKp5=wP?=#wO#0?toW^0w]z3!x(^^2z/Z5w", "ln": 15903, "col": 23, "line": 579 }, { "b": "lv0JUB8@EJ3jd2Gz/ff3wmYT*wGT2%attAb3jd2Mw/$L\u003eB7Gf4zE\u003eC0ByxolB3\u003c\u003eRwGTc0at+=basnATA+frhe(M\u003e2BAIT(z!9A4jV%]yfFBR@3jd1Bv@Dl%x\u003eg^)v}u=CattAch3%S@Ef{n!x\u003ewF%vrl0@x(mGmq/(C\u0026B-P]*wmV(DjS(NngAX1\u003eaAz4mA4U7hvruTklVlHDau.\u003eggb7y8DKp5=31E)\u003ew[+^!zEWl2jS(Bhi0]@#Ef{n!x\u003ewF#x\u003ey%fq!ZL?lUD", "ln": 17553, "col": 14, "line": 632 }, { "b": "aBsC42)\u003erTaAFU*jS\u003e}SCxmbbwQbExE0^5Tau.\u003egb5?NpC42G7uU:j#a%qnXaAFU*jS\u003e}Uz/fD7v@#B6zEmEbA+PA7a%qjt2)*[AA+funA=90zlVM).x\u003e7N/a$K\u0026%e?!?0b12B2eD", "ln": 19664, "col": 44, "line": 716 }, { "b": "xM53naAhvtAaK5jwO#0@wnb{]e*9-5Abo95wO#Pjz/{evB-X:qzEWP}x(mMavqYP#lSl/7xK$Q.wPz\u0026Aa{[T83jm8WwO(0?x\u003c(9$z/fRsiZ1Q5vq]B(BAh8kxi/O2A+PA7DKp5=b0*u[xD/FWarR^Har\u003c\u0026{y?WA*By=O6y?$k5B-.qdzGGP5vruh", "ln": 21205, "col": 69, "line": 766 }, { "b": "wPz\u0026mw]zYjvrDW9e*aenwGUG6D2N\u003ezxl4B1xLy%0Bz\u003e@azxKahy?WA*BzkVhe*q?N2)?!LA=lhFb03??arR^Jq/)4]A3f7tazCFaz/PziB-8qwB-RUowft\u0026iz*lKIxA", "ln": 21387, "col": 77, "line": 770 }, { "b": "BrCTDA+P39aA8pmxk8laC42i3wmoN]z/dfIrDzZ]vqG:#CwH#mBrCHlaARTDB97#7aA8pmxk8m8e*9]2C4CXpA+e\u003c0wN/*8vrb*\u003eBAg/gC{43Cx\u003eIc$B1OT/3jd1.lT:FrwD", "ln": 21599, "col": 25, "line": 772 }, { "b": "B7]XraW3@=x(1[sclM-twnccrlR*PUl2HaED2)Xve()ahzE)\u0026%vR/P#DKp5=w]hSxp\u0026Zn/By({BtRE@\u0026tqeb{f(pbXryxzTu0G6tgG#LIavw}5qY]{\u003eB7ocaw[+[2A::67z/dPU", "ln": 29346, "col": 20, "line": 998 }, { "b": "aAy[dwn=s0DsYDLB7D+vaAITBx(mMjaAITBx(mMaDKp71wPJ0gBrARcar\u00260p31!9@azAwHv\u003c0/}aAy[dxjSibaBsC4329#]x^CISjV%]waBsC42)\u003eS-B9hqvas/O$B98CpzF7u", "ln": 29499, "col": 5, "line": 1003 } ], "depth": 1, "facts": { "imp": [ [ "", "url.Parse" ], [ "", "http.ProxyURL" ], [ "", "time.Now" ], [ "", "fmt.Printf" ], [ "", "NewRequestContext" ], [ "", "baselineCtx.AddHeader" ], [ "", "len" ], [ "", "baselineCtx.SetBody" ], [ "", "fmt.Printf" ], [ "", "baselineCtx.Execute" ], [ "", "fmt.Errorf" ], [ "", "append" ], [ "", "time.Sleep" ], [ "", "NewBaselineProfile" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "RunSecurityAudit" ], [ "", "o.printAuditSummary" ], [ "", "BuildTechProfile" ], [ "", "GetAdaptiveSummary" ], [ "", "fmt.Printf" ], [ "", "RunRecon" ], [ "", "ReconToFindings" ], [ "", "o.addFinding" ], [ "", "o.generateMutations" ], [ "", "PrioritizeMutationsForTech" ], [ "", "o.prioritizeMutations" ], [ "", "o.config.OOBServer.IsRunning" ], [ "", "InjectOOBPayloads" ], [ "", "fmt.Printf" ], [ "", "o.config.OOBServer.PendingCount" ], [ "", "GenerateChains" ], [ "", "ChainedToMutations" ], [ "", "len" ], [ "", "append" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "o.countActiveCategories" ], [ "", "atomic.StoreInt64" ], [ "", "int64" ], [ "", "len" ], [ "", "atomic.StoreInt64" ], [ "", "make" ], [ "", "wg.Add" ], [ "", "wg.Done" ], [ "", "maxInt" ], [ "", "time.Sleep" ], [ "", "time.Duration" ], [ "", "o.testMutation" ], [ "", "len" ], [ "", "atomic.AddInt64" ], [ "", "wg.Wait" ], [ "", "o.config.OOBServer.IsRunning" ], [ "", "o.config.OOBServer.CollectConfirmed" ], [ "", "len" ], [ "", "OOBToFindings" ], [ "", "o.addFinding" ], [ "", "fmt.Printf" ], [ "", "fmt.Println" ], [ "", "o.mu.Lock" ], [ "", "DeduplicateFindings" ], [ "", "o.mu.Unlock" ], [ "", "time.Since" ], [ "", "o.calculateStats" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "duration.Round" ], [ "", "len" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "fmt.Println" ], [ "", "o.reconResult.ToSummary" ], [ "", "NewRequestContext" ], [ "", "ctx.AddHeader" ], [ "", "len" ], [ "", "ctx.SetBody" ], [ "", "strings.Contains" ], [ "", "strings.Split" ], [ "", "strings.Index" ], [ "", "randomizeCase" ], [ "", "ctx.AddHeader" ], [ "", "randomizeCase" ], [ "", "ctx.AddHeader" ], [ "", "ctx.Execute" ], [ "", "o.matchesFilters" ], [ "", "CalculateDiffWithProfile" ], [ "", "CheckHeaderReflection" ], [ "", "CalculateSimilarityWithProfile" ], [ "", "diff.IsSignificant" ], [ "", "diff.IsSignificant" ], [ "", "o.createFinding" ], [ "", "o.verifyFinding" ], [ "", "o.mu.Lock" ], [ "", "o.mu.Unlock" ], [ "", "o.printMutationResult" ], [ "", "o.addFinding" ], [ "", "len" ], [ "", "len" ], [ "", "float64" ], [ "", "float64" ], [ "", "float64" ], [ "", "float64" ], [ "", "float64" ], [ "", "float64" ], [ "", "float64" ], [ "", "float64" ], [ "", "atomic.LoadInt64" ], [ "", "atomic.LoadInt64" ], [ "", "float64" ], [ "", "float64" ], [ "", "fmt.Printf" ], [ "", "truncate" ], [ "", "fmt.Printf" ], [ "", "fmt.Print" ], [ "", "fmt.Print" ], [ "", "fmt.Printf" ], [ "", "fmt.Print" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Println" ], [ "", "make" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "calculateSeverityStrict" ], [ "", "getRemediation" ], [ "", "time.Now" ], [ "", "len" ], [ "", "len" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.ContainsAny" ], [ "", "strings.Contains" ], [ "", "len" ], [ "", "len" ], [ "", "strings.Contains" ], [ "", "strings.ToLower" ], [ "", "len" ], [ "", "NewRequestContext" ], [ "", "ctx.AddHeader" ], [ "", "len" ], [ "", "ctx.SetBody" ], [ "", "strings.Contains" ], [ "", "strings.Split" ], [ "", "strings.Index" ], [ "", "ctx.AddHeader" ], [ "", "ctx.AddHeader" ], [ "", "ctx.Execute" ], [ "", "CalculateDiffWithProfile" ], [ "", "CheckHeaderReflection" ], [ "", "diff.IsSignificant" ], [ "", "time.Now" ], [ "", "confidenceLabel" ], [ "", "o.reconResult.ReflectedHeaderSet" ], [ "", "len" ], [ "", "strings.ToLower" ], [ "", "append" ], [ "", "append" ], [ "", "append" ], [ "", "o.mu.Lock" ], [ "", "o.mu.Unlock" ], [ "", "append" ], [ "", "append" ], [ "", "src.getter" ], [ "", "int64" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "append" ], [ "", "append" ], [ "", "fmt.Printf" ], [ "", "strings.Join" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "string" ], [ "", "string" ], [ "", "string" ], [ "", "string" ], [ "", "crypto/tls" ], [ "", "fmt" ], [ "", "net/http" ], [ "", "net/url" ], [ "", "strings" ], [ "", "sync" ], [ "", "sync/atomic" ], [ "", "time" ] ], "mbr": [ "atomic.AddInt64", "atomic.LoadInt64", "atomic.StoreInt64", "audit.CORSAnalysis", "audit.CORSAnalysis.Details", "audit.CORSAnalysis.Vulnerable", "audit.InformationLeaks", "audit.MissingHeaders", "audit.ServerInfo", "audit.TechFingerprints", "audit.WAFDetected", "baseline.StatusCode", "baselineCtx.AddHeader", "baselineCtx.Execute", "baselineCtx.SetBody", "config.FollowRedirects", "config.ProxyURL", "config.Timeout", "ctx.AddHeader", "ctx.Execute", "ctx.SetBody", "diff.AuthBypass", "diff.AuthChallengeGone", "diff.BodyHashChanged", "diff.CORSDetails", "diff.CORSMisconfigured", "diff.ContentTypeChanged", "diff.HeaderReflection", "diff.HeadersAdded", "diff.HeadersRemoved", "diff.InfoDisclosure", "diff.IsSignificant", "diff.LocationChanged", "diff.LocationHeader", "diff.NewJSONKeys", "diff.PrivilegeElevate", "diff.ReflectedValue", "diff.SensitiveDataFound", "diff.SetCookieValues", "diff.SizeChangeRatio", "diff.StatusChanged", "diff.TimingAnomaly", "diff.TimingDeltaMS", "duration.Round", "evidence.auth_bypass", "evidence.auth_challenge_gone", "evidence.body_hash_changed", "evidence.content_type_changed", "evidence.cors_misconfigured", "evidence.header_reflected", "evidence.headers_added", "evidence.headers_removed", "evidence.info_disclosure", "evidence.location_changed", "evidence.new_cookies", "evidence.new_json_keys", "evidence.privilege_elevation", "evidence.sensitive_data", "evidence.size_change", "evidence.status_change", "evidence.timing_anomaly", "evidence.timing_delta_ms", "f.ConfidenceScore", "f.Severity", "finding.Confidence", "finding.ConfidenceScore", "finding.Evidence", "finding.Evidence.verified", "finding.Verified", "finding.VerifiedAt", "fmt.Errorf", "fmt.Print", "fmt.Printf", "fmt.Println", "fmt.Sprintf", "fp.Technology", "fp.Version", "http.ErrUseLastResponse", "http.ProxyURL", "m.Header", "mutation.Category", "mutation.Header", "mutation.Impact", "mutation.Value", "o.addFinding", "o.baseline", "o.baseline.Body", "o.baseline.StatusCode", "o.baseline.TimingMS", "o.calculateStats", "o.client", "o.config", "o.config.Audit", "o.config.Auth", "o.config.Body", "o.config.CORS", "o.config.CRLF", "o.config.Cache", "o.config.Chain", "o.config.Cloud", "o.config.ContentType", "o.config.ContentTypeCat", "o.config.Cookie", "o.config.Debug", "o.config.DiffOnly", "o.config.Encoding", "o.config.FilterSize", "o.config.FilterStatus", "o.config.Gateway", "o.config.Headers", "o.config.HopByHop", "o.config.Injection", "o.config.JWT", "o.config.MatchSize", "o.config.MatchStatus", "o.config.Method", "o.config.OOBServer", "o.config.OOBServer.CollectConfirmed", "o.config.OOBServer.IsRunning", "o.config.OOBServer.PendingCount", "o.config.OOBWait", "o.config.Override", "o.config.Protocol", "o.config.Proxy", "o.config.RateDelay", "o.config.RateLimit", "o.config.Recon", "o.config.Redirect", "o.config.SSRF", "o.config.Security", "o.config.Smuggling", "o.config.Stealth", "o.config.URL", "o.config.Verify", "o.config.WAFEvasion", "o.config.WebSocket", "o.config.Workers", "o.countActiveCategories", "o.createFinding", "o.findings", "o.generateMutations", "o.matchesFilters", "o.mu", "o.mu.Lock", "o.mu.Unlock", "o.printAuditSummary", "o.printMutationResult", "o.prioritizeMutations", "o.profile", "o.profile.BodyConsistent", "o.profile.StatusConsistent", "o.profile.TimingStdDev", "o.progress", "o.reconResult", "o.reconResult.ReflectedHeaderSet", "o.reconResult.ToSummary", "o.reconResult.TotalRequests", "o.techProfile", "o.testMutation", "o.totalMuts", "o.verified", "o.verifyFinding", "resp.ContentLength", "resp.StatusCode", "result.Recon", "sim.NormalizedBodySimilarity", "sim.StructuralSimilarity", "src.enabled", "src.getter", "stats.BaselineSize", "stats.BaselineStatus", "stats.BaselineTime", "stats.ChainsTested", "stats.Critical", "stats.High", "stats.Info", "stats.Low", "stats.Medium", "stats.OOBConfirmed", "stats.ReconRequests", "stats.VerifiedFindings", "strings.Contains", "strings.ContainsAny", "strings.Index", "strings.Join", "strings.Split", "strings.ToLower", "time.Duration", "time.Millisecond", "time.Now", "time.Second", "time.Since", "time.Sleep", "transport.Proxy", "url.Parse", "wg.Add", "wg.Done", "wg.Wait" ], "tgt": [ "BuildTechProfile", "CalculateDiffWithProfile", "CalculateSimilarityWithProfile", "ChainedToMutations", "CheckHeaderReflection", "DeduplicateFindings", "GenerateChains", "GetAdaptiveSummary", "InjectOOBPayloads", "NewBaselineProfile", "NewRequestContext", "OOBToFindings", "PrioritizeMutationsForTech", "ReconToFindings", "RunRecon", "RunSecurityAudit", "append", "atomic.AddInt64", "atomic.LoadInt64", "atomic.StoreInt64", "baselineCtx.AddHeader", "baselineCtx.Execute", "baselineCtx.SetBody", "calculateSeverityStrict", "confidenceLabel", "ctx.AddHeader", "ctx.Execute", "ctx.SetBody", "diff.IsSignificant", "duration.Round", "float64", "fmt.Errorf", "fmt.Print", "fmt.Printf", "fmt.Println", "fmt.Sprintf", "getRemediation", "http.ProxyURL", "int64", "len", "make", "maxInt", "o.addFinding", "o.calculateStats", "o.config.OOBServer.CollectConfirmed", "o.config.OOBServer.IsRunning", "o.config.OOBServer.PendingCount", "o.countActiveCategories", "o.createFinding", "o.generateMutations", "o.matchesFilters", "o.mu.Lock", "o.mu.Unlock", "o.printAuditSummary", "o.printMutationResult", "o.prioritizeMutations", "o.reconResult.ReflectedHeaderSet", "o.reconResult.ToSummary", "o.testMutation", "o.verifyFinding", "randomizeCase", "src.getter", "string", "strings.Contains", "strings.ContainsAny", "strings.Index", "strings.Join", "strings.Split", "strings.ToLower", "time.Duration", "time.Now", "time.Since", "time.Sleep", "truncate", "url.Parse", "wg.Add", "wg.Done", "wg.Wait" ], "funcs": [ [ "NewOrchestrator", 3598 ], [ "Scan", 4435 ], [ "testMutation", 9927 ], [ "matchesFilters", 12196 ], [ "printMutationResult", 13357 ], [ "createFinding", 14846 ], [ "calculateSeverityStrict", 17378 ], [ "getRemediation", 20533 ], [ "verifyFinding", 24065 ], [ "prioritizeMutations", 25323 ], [ "addFinding", 25837 ], [ "generateMutations", 25969 ], [ "countActiveCategories", 27249 ], [ "calculateStats", 27810 ], [ "printAuditSummary", 28435 ], [ "randomizeCase", 29495 ], [ "truncate", 29809 ], [ "maxInt", 29921 ] ], "metrics": { "ast": { "op.eq": 19, "op.ge": 10, "op.gt": 40, "op.le": 4, "op.lt": 6, "op.ne": 20, "op.add": 21, "op.div": 1, "op.lor": 4, "op.mod": 1, "op.mul": 8, "op.sub": 5, "op.band": 11, "op.land": 16, "op.lnot": 6, "max_depth": 21, "call_count": 221, "node_count": 9222, "member_count": 198, "max_array_len": 2, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.le": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.band": 0, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 4, "member_depth_max": 4 }, "file": { "size": 29987, "entropy": 5.24 }, "text": { "lines": 1033, "top_char": 101, "tab_count": 1468, "max_ws_run": 14, "digit_ratio": 0.04, "space_count": 3050, "char_entropy": 5.24, "unique_chars": 90, "top_char_null": 0, "escape_density": 0.24, "string_density": 0.22, "top_char_ratio": 0.07, "avg_line_length": 28.03, "max_line_length": 161, "empty_line_ratio": 0.11, "last_line_length": 1, "whitespace_ratio": 0.19, "identifier_density": 1.87, "line_length_stddev": 27.51, "octal_escape_count": 72, "normalized_string_count": 7.06, "repeated_char_sequences": 21, "suspicious_string_ratio": 0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 35.56 }, "binary": { "peak_region_bytes": 18432, "peak_region_entropy": 5.45 }, "source": { "class_count": 5, "function_count": 18 }, "imports": { "count": 8, "stdlib_count": 8, "stdlib_ratio": 1 }, "strings": { "bytes": 5602, "count": 227, "avg_length": 24.68, "max_length": 138, "avg_entropy": 3, "empty_count": 9, "entropy_stddev": 1.05, "embedded_code_candidates": 1 }, "comments": { "chars": 1071, "count": 29, "lines": 29, "to_code_ratio": 0.03 }, "functions": { "count": 23, "density": 1.74, "avg_params": 1.56, "code_ratio": 0.85, "max_params": 4, "length_stddev": 46.49, "over_100_lines": 2, "avg_name_length": 14, "no_params_count": 3, "avg_length_lines": 48.94, "max_length_lines": 196, "min_length_lines": 5, "high_entropy_names": 2, "single_char_params": 3, "avg_param_name_length": 6.07 }, "identifiers": { "count": 1927, "unique": 356, "avg_length": 9.74, "max_length": 30, "min_length": 1, "avg_entropy": 2.67, "reuse_ratio": 0.18, "length_stddev": 5.45, "has_digit_ratio": 0.01, "sequential_names": 12, "base64_like_names": 3, "single_char_count": 13, "single_char_ratio": 0.04, "high_entropy_count": 45, "high_entropy_ratio": 0.13, "all_lowercase_ratio": 0.25, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 5, "underscore_prefix_count": 1 } } }, "id": 15, "mol": "K(Te)H(Cm₃)Md(Pa)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/orchestrator.go", "pid": 0, "risk": 4, "sha": "2bbf1188aed2f0e6470d33846ab9287faf6e82514e29060236f6f71896a7dafa", "size": 29987, "traits": [ { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 1431, 4 ] ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "spans": [ [ 17617, 22 ] ] }, { "id": "micro-behaviors/communications/url/parse::go-url-parse", "conf": 0.9, "crit": 3, "desc": "Parses a URL with net/url", "spans": [ [ 3925, 9 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-injection-mutations-fn", "conf": 0.98, "crit": 3, "desc": "HHunter GetInjectionMutations function", "spans": [ [ 465, 21 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::go-http-client-construction", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Constructs a Go HTTP client", "spans": [ [ 4229, 13 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Go source imports the net/http standard package", "spans": [ [ 47, 8 ] ] } ], "type": "go" }, { "id": 16, "mol": "H₃(Cm₂DbOs₂)", "sha": "f10706340026415702991a9626db63bf57a3e2e3cfaadab2008761778e997a0c", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/probes.go", "risk": 3, "size": 21775, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]wO#c{zE\u003cdZx(d*cA=-AL3jd[/zEWP}x(mMpyiarha{[S2w]hSl3jd[\u0026BzU?r3jd[{B0p}$b6d\u003cDx(mN8a{[S2BzkP6a{]+a3nj4Pm}DNHA::63nk@qSqE%/=A=-BlA+eW3wPF#5aAhvtw[u48x(v($y+cYIwO+%gv@DmbvqfQ\u003cwb", "ln": 0, "col": 1, "line": 1 }, { "b": "diJhxA=k$vDKp71wPhNdBrARcayYFcy?c7oo?XC@AbP=sc#@)uB.(dJaAR4jxjVf+qCnID336Q0B-Ivxz/WKjA+PSbmRMWIc$WgfwO${[wH[%du1e83wHIOgAbP=sdj=O}hz^lt3vJl*fe1CrwO#71vru6Vk#Hozay/C6vru74ayMx\u003ek#HozatLM7e?!z*wPhNdBrCglAV^.vfgebIx(n37xl4B5x(v\u003e@w{503av*0XwPzj3wM7()nK+aGwPJ0gBrA5iv{%mMwPJ0gBsXLRvrc0(Bx8jjaAITBx(mMmazbt7wO${[wGV5oA+PA7diJhxAS", "ln": 235, "col": 78, "line": 13 }, { "b": "Bz(nfy^@bRwnb{]B09IbaAz4mB.(dLq/(C\u0026B1QBgByw#Px(mD}zFa1$3jg=.e)07cBy!x)A+PA7c$2dXl@cfHsX}KfxMO9cj{\u003cz=BzU?py*?i]jTaDPb0Dt@xK$Q.j{\u003cz?wPRu6v}Yp\u003eB7GCRb2}PieJs}r3oSfpByuqfvqPNsb6EWiCw}FvBrR\u0026qz/fVdzGF2=", "ln": 970, "col": 2, "line": 36 }, { "b": "x(mMnc1Fh-3lQDNwncifv@bN{B3gZVx(mD}zF7LmwNPaXAV#SAzEWG%v@1jKBzbxfe]UltwO#PUy?mD{zGEHvy*?yaoLFM\u0026e{82AxkzcccVr%nzyl\u003eSj{\u0026zParS^Sx)8VEarR^HarS^/Aa9Sbv@bN{B3gZ?z!AZ0wI4Raz/c:.cl\u003eJeh8ExSflq8v", "ln": 8078, "col": 30, "line": 163 }, { "b": "x()]+BAh8kxdddIfjX^uk42/D2)(1!34ic/2})}OqE%uRzvcX:w/#b9B9hqve(Dm\u003cz/cWvjS[SRy-[6i2)\u003eVZe)07cBy!x)A+PA7c$2eFx)7Rey*?yajTa@Uv@#B6zu", "ln": 12043, "col": 9, "line": 252 }, { "b": "wmY!5iY]6pBAhqqxfEB:B389^x)8WFed8W\u00262)\u003eo!zep*[B7nS$wM9X\u003ex(mMiB98CpzFa2yn]FAYc#@)uB.(dLqE%uRzz1*#w]83*By!#NwNPaXA=S=Oa$K\u0026XdjDX{3jd2!3jd2Mw/$]3zyxKpB9hqve(Dm\u003cz/df[y\u002613lwN[IDBzbP6B15j}ats{+3jd1BB7c+6", "ln": 12345, "col": 77, "line": 261 }, { "b": "A+PSbq/)4]zF7wfzfdyeAb]VgBy(}e3oR\u003ckB%7phvrlGMb4++iBy/Fpj{\u0026zPm}DNHA::63wftubav]4CzGGDgaA/N]fD/w9LPSH@r8sYdwNPaXAV!p(v%8*aBA]0dwPI%czF77XzF9W3wJTBxj{\u0026zPlVM:DBy!#9vTf8av\u003e?yEvJZ4vc36zQfjX^uj{\u003cz9wnciJ3jn[pv@=p5BuQ3+fcAM6Bz\u0026:HAaJ]fv@=p9x\u003e7N/ayPd#aztF4xDQ]3zE^E0xlaz\u003cz!0{bwO#PxADL\u0026kC#Fo\u003cwN/?2AZsITc){SVx(mD}zF7sCe[P3xmpxXtc$NiqjW70n3lQE3z/fSrayX+\u0026xjShGaz2vwADL\u0026kC#Fo\u003c", "ln": 13438, "col": 6, "line": 283 }, { "b": "AaJ]$c#%DDwLu/VBsXLPdgcxf3jm8WwPS6nzxHoEvrc6]qE%/=A==Tn2)\u003cKuxK#3?iV]K?xMOunB2\u003e%cA::eAxk8E3BZ/GmwPzp0zGGDcBs}6wz7/*oB7]XEByPwBB7696w?w7ywN^xgvrlK4AXyv3xK#3?Byu?zvrc6]ePUAnwO\u003e\u003ccga\u003eplfFm9Yz/c:I3jd2twPz\u003caz/dPUa#g=9e?!F23jd2pB-8mYax@b)vrc6]qGV(73jd1BDKp5=2)\u003cNHz!}DSB7696w(JX!y\u003cMG}2)*[Al#)0+wPx*OB7696w\u003c*VNC4CYv3jd1B2)*]kvqPNparR^HarR^HarR^JnjW(vBy/Fped8W\u00262)*[Ar+lq)x(v(IarR^HarR^Ha#y]aa$K6c2)*[A2$Y2Dz/PY6BzkVhrz(yHar\u003eGvBz#pZfe3%LBzb/ae[n*pfjOGDvkqpBnjW(vBy/Fped8W\u00262)*[AqGV!!B2\u003eA^arR^HarR^HA=(hfoLFM\u0026ed8W\u00262)*]^ed8W\u00262)(2h3jd1B2#UtQB.(eviV@DOB9hqvB1vU82)(2h3jd2!ed8Yi3vJl", "ln": 16932, "col": 16, "line": 423 } ], "depth": 1, "facts": { "imp": [ [ "", "buildHTMLReport" ], [ "", "os.WriteFile" ], [ "", "buildSARIF" ], [ "", "json.MarshalIndent" ], [ "", "fmt.Errorf" ], [ "", "os.WriteFile" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "time.Now.Format" ], [ "", "time.Now" ], [ "", "result.Stats.Duration.Round.String" ], [ "", "result.Stats.Duration.Round" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "len" ], [ "", "sb.WriteString" ], [ "", "strings.ToLower" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "len" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "len" ], [ "", "sb.WriteString" ], [ "", "sb.WriteString" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "sb.WriteString" ], [ "", "len" ], [ "", "sb.WriteString" ], [ "", "strings.ToLower" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "html.EscapeString" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "strings.Join" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "strings.Join" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "strings.Join" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "html.EscapeString" ], [ "", "strings.Join" ], [ "", "fmt.Sprintf" ], [ "", "time.Now.Format" ], [ "", "time.Now" ], [ "", "sb.String" ], [ "", "make" ], [ "", "strings.ReplaceAll" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "append" ], [ "", "encoding/json" ], [ "", "fmt" ], [ "", "html" ], [ "", "os" ], [ "", "strings" ], [ "", "time" ] ], "mbr": [ "audit.InformationLeaks", "audit.MissingHeaders", "audit.TechFingerprints", "audit.WAFDetected", "f.CVSS", "f.CWE", "f.Category", "f.Confidence", "f.ConfidenceScore", "f.Evidence", "f.Evidence.oob_confirmed", "f.Header", "f.Impact", "f.Payload", "f.Remediation", "f.Severity", "f.Verified", "fmt.Errorf", "fmt.Sprintf", "fp.Confidence", "fp.Technology", "fp.Version", "html.EscapeString", "json.MarshalIndent", "leak.Header", "leak.Severity", "leak.Type", "leak.Value", "mh.Header", "mh.Impact", "mh.Severity", "os.WriteFile", "result.Findings", "result.Recon", "result.Recon.AllowedMethods", "result.Recon.DangerousMethods", "result.Recon.HostInjectable", "result.Recon.ReflectedHeaders", "result.Recon.VerbTamperBypasses", "result.SecurityAudit", "result.Stats", "result.Stats.Critical", "result.Stats.Duration", "result.Stats.Duration.Round", "result.Stats.Duration.Round().String", "result.Stats.High", "result.Stats.Info", "result.Stats.Low", "result.Stats.Medium", "result.Stats.TotalFindings", "result.Stats.TotalMutations", "sb.String", "sb.WriteString", "strings.Join", "strings.ReplaceAll", "strings.ToLower", "time.Millisecond", "time.Now", "time.Now().Format" ], "tgt": [ "append", "buildHTMLReport", "buildSARIF", "fmt.Errorf", "fmt.Sprintf", "html.EscapeString", "json.MarshalIndent", "len", "make", "os.WriteFile", "result.Stats.Duration.Round", "result.Stats.Duration.Round().String", "sb.String", "sb.WriteString", "strings.Join", "strings.ReplaceAll", "strings.ToLower", "time.Now", "time.Now().Format" ], "funcs": [ [ "GenerateHTMLReport", 158 ], [ "GenerateSARIF", 415 ], [ "buildHTMLReport", 706 ], [ "buildSARIF", 15644 ] ], "metrics": { "ast": { "op.eq": 2, "op.ge": 2, "op.gt": 11, "op.ne": 7, "op.add": 8, "op.mul": 2, "op.band": 2, "op.lnot": 1, "max_depth": 30, "call_count": 129, "node_count": 3181, "member_count": 59, "max_array_len": 2, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.mul": 0, "op_density.band": 0, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 5 }, "file": { "size": 17383, "entropy": 5.36 }, "text": { "lines": 443, "top_char": 101, "tab_count": 609, "max_ws_run": 15, "digit_ratio": 0.04, "space_count": 1447, "char_entropy": 5.36, "mixed_indent": 1, "unique_chars": 92, "top_char_null": 0, "string_density": 0.29, "top_char_ratio": 0.06, "avg_line_length": 38.24, "max_line_length": 197, "non_ascii_ratio": 0, "empty_line_ratio": 0.11, "last_line_length": 1, "whitespace_ratio": 0.14, "identifier_density": 1.47, "line_length_stddev": 40.24, "normalized_string_count": 6.03, "repeated_char_sequences": 10, "suspicious_string_ratio": 0.01, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 15.81 }, "binary": { "peak_region_bytes": 16359, "peak_region_entropy": 5.24 }, "source": { "class_count": 12, "function_count": 4 }, "imports": { "count": 6, "stdlib_count": 6, "stdlib_ratio": 1 }, "strings": { "bytes": 9539, "count": 127, "url_count": 2, "very_long": 1, "avg_length": 75.11, "max_length": 4888, "avg_entropy": 3.22, "empty_count": 8, "entropy_stddev": 1.2, "high_entropy_count": 2, "embedded_code_candidates": 1 }, "comments": { "chars": 231, "count": 12, "lines": 12, "to_code_ratio": 0.03 }, "functions": { "count": 16, "density": 0.9, "avg_params": 2.5, "code_ratio": 0.82, "max_params": 3, "length_stddev": 110.65, "over_100_lines": 1, "avg_name_length": 14, "avg_length_lines": 90.5, "max_length_lines": 276, "min_length_lines": 4, "high_entropy_names": 2, "avg_param_name_length": 7.6 }, "identifiers": { "count": 652, "unique": 139, "avg_length": 8.12, "max_length": 21, "min_length": 1, "avg_entropy": 2.47, "reuse_ratio": 0.21, "length_stddev": 4.65, "sequential_names": 5, "single_char_count": 6, "single_char_ratio": 0.04, "high_entropy_count": 7, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.25, "all_uppercase_ratio": 0.04, "underscore_prefix_count": 1 } } }, "id": 17, "mol": "K(Te)H₂(CmF)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/engine/report.go", "pid": 0, "risk": 3, "sha": "2ba7804b1d95e113919010eed55f6f51fc34d5b0a72b57328d07c226cf019520", "size": 17383, "traits": [ { "id": "metadata/lang/source::automatically-generated-source-marker", "conf": 0.85, "crit": 1, "desc": "Generated source provenance marker", "spans": [ [ 13486, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "raw.githubusercontent.com JSON URL", "spans": [ [ 16996, 86 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::go-os-writefile", "conf": 0.9, "crit": 3, "desc": "Go writes data with os.WriteFile", "spans": [ [ 299, 12 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::os-write-file", "conf": 0.8, "crit": 3, "desc": "Write file via os.WriteFile", "spans": [ [ 299, 12 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 17270, 25 ] ] } ], "type": "go" }, { "ctx": [ { "b": "Aa9l(vp%c]zddc@3jpG:AbP=sasEN6b4UU4z!9N1xd[1vz/c:a2{J$#BrR4#b5.JD3jd[#x(dA93jm7-xk8E3BZ=$kz/4dqv\u003e?yEvLpnyB-8qjAXz0wxk8l{a{[S2xk8E3BZ=$kz/4dqv\u003e?yEvLpnyB-8qjAXz9qvpS}\u0026B0p@u3jpx/zET/avqfQcdiJ%A2})}OqE%GPB97#laz(myvruj4zxJLlzEW^5z/fR631X0!x(mGmm}D^dB-.p\u003eB-.5lx(v)gauZ\u0026XwNPaXA=S\u003c6wPQjX", "ln": 0, "col": 1, "line": 1 }, { "b": "wIcF:Bw)40xj(3{zF8W^Byxo9z/fRsjS[AHvpS}\u0026B1P%]Bw)40xj(3{zF8W^Byxo9z/fR631X0!x(mGmm}D^lzFA-)BzkVho)7L^BzkVhB09Q*xK$Q.wPz\u0026Am}D^lzFA-)BzkVho)7L^BzkVhA%-j+zF9W3wIcF:Bw(aomOO2Evruj4zGu{-azts{wmY!5e\u003eoF{q=uN-o)7L^BzkVhA%-j+zF9W3wIcF:BvZs?lu#auA7$E%vruj4zGu{-azts{wmY!5e\u003eoF{nb", "ln": 570, "col": 7, "line": 22 }, { "b": "x(kLwA+v4swNPaXA=SAQ3jd2kwPRQ7wi7?QarR^Jm[3x3ed8W\u0026nm=juwPz\u0026MarR^Hzddi\u003ec#Ayitxs[bx(mM?B98CpzF7yH3jd28B-.pTarR^HarR!GA=\u003e}A3jd1", "ln": 1113, "col": 29, "line": 33 }, { "b": "2$eulB.r-TarR^Hazb4#B7D)f2)\u003cKEB.tu6x(mMAarUo8y\u0026:es3jd2gzFA-)BzkVhiV]LSvqH0@ed8W\u0026q=uN-iV]K/arR^Hw)]H%wH[e{2$O#Nlu#auA5]9:azb4#B7D)f2)\u003cHrBy!cWze18MarUo8y\u0026:es3jd2qwN/\u003e6x([RYarR!svqH0@ed8W\u0026s7L\u0026tz!0M]BugJ!w)]H%wH[e{2$!n#iV]K/arR^Hazb4#B7D)f2)\u0026$jvqfQu", "ln": 1315, "col": 2, "line": 42 }, { "b": "aA?)zzE)\u0026%vRGT)Bzkrci:uMczxZROy?mGjA+frmy\u0026?p0x(mD}zFa2tdgcy*w]zYjx!gxsx(mD}zF77MjS[=NzF9J6A+frmy\u0026?p0x(mD}zFa2kDKp5=w]hSxp\u0026Zn/By({BmRM:Jx(mMabpc\u003eYtY7-pazAtXdgcv/w]hSxp\u0026Zn/By({BarTi^vpS{", "ln": 2000, "col": 34, "line": 75 }, { "b": "ax8Y(wGV8kawbNdp6}qrvrt{eayulLjS[GXz/dg4vrcB5vqFIMwmYU2c#@)uB.(dJar\u00260Xar?{Ja$i\u003c9z/WKjA+PSbmRMWIc)A.xvqYB)wPJ0gBAo6HB8L}uefFFiByuZyfG7:Adgcw[zfdybA+PAky\u0026gTBqE%](y\u0026\u003c.vB76l6wft#jaAI43zEmA}B9hqvB1RiGz/c:F3vJl", "ln": 2889, "col": 4, "line": 105 } ], "depth": 1, "facts": { "imp": [ [ "", "make" ], [ "", "engine.NewOrchestrator" ], [ "", "fmt.Println" ], [ "", "orchestrator.Scan" ], [ "", "fmt.Printf" ], [ "", "os.Exit" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "fmt.Println" ], [ "", "fmt.Printf" ], [ "", "fmt.Println" ], [ "", "fmt.Printf" ], [ "", "json.MarshalIndent" ], [ "", "os.WriteFile" ], [ "", "fmt.Println" ], [ "", "encoding/json" ], [ "", "fmt" ], [ "", "github.com/cc1a2b/HHunter/engine" ], [ "", "github.com/cc1a2b/HHunter/headers" ], [ "", "os" ], [ "", "time" ] ], "mbr": [ "engine.GetAuthMutations", "engine.GetCORSMutations", "engine.GetCacheMutations", "engine.GetCloudMutations", "engine.GetDebugMutations", "engine.GetHopByHopMutations", "engine.GetInjectionMutations", "engine.GetJWTMutations", "engine.GetOverrideMutations", "engine.GetProxyMutations", "engine.GetRateLimitMutations", "engine.GetSSRFMutations", "engine.GetSecurityMutations", "engine.GetSmugglingMutations", "engine.GetWebSocketMutations", "engine.NewOrchestrator", "finding.CVSS", "finding.CWE", "finding.Confidence", "finding.Evidence", "finding.Header", "finding.Impact", "finding.Payload", "finding.Severity", "fmt.Printf", "fmt.Println", "headers.GetAuthMutations", "headers.GetCORSMutations", "headers.GetCacheMutations", "headers.GetCloudMutations", "headers.GetDebugMutations", "headers.GetHopByHopMutations", "headers.GetInjectionMutations", "headers.GetJWTMutations", "headers.GetOverrideMutations", "headers.GetProxyMutations", "headers.GetRateLimitMutations", "headers.GetSSRFMutations", "headers.GetSecurityMutations", "headers.GetSmugglingMutations", "headers.GetWebSocketMutations", "json.MarshalIndent", "orchestrator.Scan", "os.Exit", "os.WriteFile", "result.Findings", "result.Stats", "result.Stats.Critical", "result.Stats.High", "result.Stats.Info", "result.Stats.Low", "result.Stats.Medium", "time.Second" ], "tgt": [ "engine.NewOrchestrator", "fmt.Printf", "fmt.Println", "json.MarshalIndent", "len", "make", "orchestrator.Scan", "os.Exit", "os.WriteFile" ], "funcs": [ [ "main", 138 ] ], "metrics": { "ast": { "op.gt": 2, "op.ne": 2, "op.add": 1, "op.mul": 1, "op.band": 1, "max_depth": 17, "call_count": 24, "node_count": 956, "member_count": 53, "max_array_len": 2, "op_density.gt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.mul": 0, "op_density.band": 0, "max_concat_chain": 2, "member_depth_max": 3 }, "file": { "size": 3052, "entropy": 5.09 }, "text": { "lines": 109, "top_char": 116, "tab_count": 151, "max_ws_run": 8, "digit_ratio": 0.01, "space_count": 281, "char_entropy": 5.09, "unique_chars": 75, "top_char_null": 0, "string_density": 0.26, "top_char_ratio": 0.07, "avg_line_length": 27, "max_line_length": 78, "empty_line_ratio": 0.1, "last_line_length": 1, "whitespace_ratio": 0.18, "identifier_density": 1.83, "line_length_stddev": 19.88, "normalized_string_count": 2.68, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 12.85 }, "binary": { "peak_region_bytes": 3052, "peak_region_entropy": 5.04 }, "source": { "function_count": 1 }, "imports": { "count": 6, "stdlib_count": 4, "stdlib_ratio": 0.67, "third_party_count": 2, "third_party_ratio": 0.33 }, "strings": { "bytes": 428, "count": 28, "url_count": 1, "avg_length": 15.29, "max_length": 56, "avg_entropy": 2.98, "empty_count": 3, "entropy_stddev": 1.03 }, "comments": { "chars": 115, "count": 7, "lines": 7, "to_code_ratio": 0.07 }, "functions": { "count": 1, "density": 0.92, "code_ratio": 0.89, "avg_name_length": 4, "no_params_count": 1, "avg_length_lines": 97, "max_length_lines": 97, "min_length_lines": 97 }, "identifiers": { "count": 200, "unique": 87, "avg_length": 8.16, "max_length": 21, "min_length": 1, "avg_entropy": 2.46, "reuse_ratio": 0.44, "length_stddev": 5.37, "sequential_names": 3, "single_char_count": 4, "single_char_ratio": 0.05, "high_entropy_count": 12, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.23, "all_uppercase_ratio": 0.08, "underscore_prefix_count": 1 } } }, "id": 19, "mol": "K(Te)H(F)Md(Pa)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/examples/basic_scan.go", "pid": 0, "risk": 3, "sha": "13326ebf41376c8c649547b0eae12bec7e12b065cc67cec38489a79734adf04f", "size": 3052, "traits": [ { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 1379, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::go-os-writefile", "conf": 0.9, "crit": 3, "desc": "Go writes data with os.WriteFile", "spans": [ [ 2953, 12 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::os-write-file", "conf": 0.8, "crit": 3, "desc": "Write file via os.WriteFile", "spans": [ [ 2953, 12 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "spans": [ [ 64, 32 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-injection-mutations-fn", "conf": 0.98, "crit": 3, "desc": "HHunter GetInjectionMutations function", "spans": [ [ 634, 21 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 64, 25 ] ] } ], "type": "go" }, { "id": 21, "mol": "K(Te)H₃(CmFOs)Md", "sha": "6910928a89ec05720634959a1f3b8f975dcd99a7d21973df92cc4e852a33f662", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/auth.go", "risk": 5, "size": 22116, "type": "go", "depth": 1 }, { "id": 22, "mol": "K(Te)H(Cm)", "sha": "195be78e3bdf22fc6d525b1a58e5e2d3efd066220bacc00fb07e53b358d5c1e1", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/cache.go", "risk": 2, "size": 6200, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]xK$Q.wPz\u002603tBu@z/P}xb4\u003eRixMW=pv@Diqv}dl4ggz[cnoF/(wPxCnzF9W3wG?D*w{503av*0+lU{W-wkdh*vruj4zGviPax@b.zF9W3wIcY1Byxo9z/cXA3jg-:BAIRwax@b.zF9W3wIcY1Byxo9z/f[e2)\u0026mravx%-B.292vrb]^2)\u003e@HwNPaXAYLr!lQ\u0026T{z/fD7v@#B5xdVXKa$K\u003cqvqH6$iV]R3gb**te?![ja$K\u003c7vru6[z/Qa:ar\u003cf?z/]OmefEJ3Aa9l#iV]Rly\u0026sDbw]7)@wGTMvavpu)vrlGjeG^-9z/xe]v@0oped8W\u0026DQ}ZRwmY^xar\u003cfxeKKC]zE)s1x(mMnnL*PZaxz]!B.9PRa#7#oe\u00262pve?]mAe\u00262pva$K\u003c7vru6[z/Qa:ar\u003cf?z/]OmefEJ3Aa9l#iV]Rly\u0026sDbw]7)@wGTMvavpu)vrlGjeG^=0BywY*Byuwwed8W\u0026DQ}ZRwmY^xar\u003cfxeKKC]zE)s1x(mMnnL*PZaxz]!B.9PRa#7=7fFk4if^nd\u003elT+7Fxk.*oiV]Rly\u0026sDba$K\u003cdze-][BugJ*lU{W-wm/T^A+cv+p-@8IAa9*eat1ZczGGDgzEEu9EjLZi342iOvpS}\u0026iV]RCA=\u003e}BlU{EFzGEE4p:dCkrS", "ln": 0, "col": 1, "line": 1 }, { "b": "BugJ*lQTV(oMa\u0026*avG^.wN/*@z/c+Eed8Z\u003c2})}Ol03$(2)\u003e@HwNPaXAYLr!ss(*QDm-6bA=#2meMlv]wI3t*v@=\u003clBzkVha$K\u003cqvqH6$iV]Rjmn\u003e%0hx\u003cW{lT+6", "ln": 1384, "col": 69, "line": 19 }, { "b": "zx:GW3jd2=nm=juwPx*Ob3lA.zf^^jwN/\u003e6x([RLrbVL-zxZROr://!wJy}TBy/Jna$K\u003c7vru6[z/Qa:ar\u003cf?z/]OmefEJ3Aa9l#iV]Rjs5QkuwN/\u003e6x([RyrbVL-zu", "ln": 1643, "col": 108, "line": 23 }, { "b": "vqP{JllGloA+w%9aw3D=wN/*@z/c+Eed8Z\u003c2})}Ol3^V]wEn.IDQ}ZRwmY^xar\u003c]tl3^V]wI3!\u003ew*e=Gr://!wJy}TBy/JneN\u003c0AvrlGlefEq*By/96A^oX*b13f+BP", "ln": 2288, "col": 102, "line": 29 }, { "b": "avX:wnm=jCBz8^[A=kz#ax9k$z!phwed8Z\u003c2})}Om)*8W2)\u003e@HwNPaXAYLr!ss)3Yz!A($eKA(QyH}x]a$K\u003cqvqH6$iV]R*wPI@Bx(n37A=br4a$K\u003c7vru6[z/Qa", "ln": 3037, "col": 77, "line": 38 }, { "b": "AbPVbb7h0H2)\u003e@HwNPaXAYLr!ss(*TA7aUSx(mGlraf\u0026-pgn0Ja$K\u003cqvqH6$iV]R*wPI@qefEq*By/96A^oX*b13f+BZ#WEaw3A?vpKyuar\u003crwmiCMrB88)[vqPM#q/DU[w*hTO3jm7Cfe1CqvrlKbC)T\u0026:DQ}ZRwmY^xar\u003co-B98kzeKKt*wO#PwnL*PZaxz]!B.9PRa#7\u0026ie?![ie?[L3avxNVwOk}4C@^5(lJ", "ln": 4001, "col": 99, "line": 49 }, { "b": "mRc1IB-I4omR(HCaw3D=wN/*@z/c+Eed8Z\u003c2})}Ol2f[Cvqc5P342iOvpS}\u0026iV]RGeKseXzddcgmpZ4xB7nS$wG\u0026VFr://!wJy}TBy/JneOP9AwPzV%y:7zMlT+7FxkW", "ln": 4599, "col": 75, "line": 57 }, { "b": "BZ#WEaw3A?vpKyuar\u003c^9vp:4+yAL@Lv@2T[wfsV\u003ewPz*9wmV%ked8Z\u003c2})}Opg[oUCP.6DwN/B^x\u003e4FR342iOvpS}\u0026iV]RGeKr(RwO-}@wN]H}wN/*aefE#4y\u0026%qIar\u0026EMzGGDgzEEumvpTj?zxZROlT+7Fxk.*oiV]Rly\u0026sDba$K\u003cdze-][BugJ*pg[oUCPZ9ul1szoy+nK@wnc6}v@@?WD2NhkB0u2-3i", "ln": 7213, "col": 66, "line": 89 } ], "depth": 1, "facts": { "imp": [ [ "", "github.com/cc1a2b/HHunter/engine" ] ], "funcs": [ [ "GetCloudMutations", 60 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 0, "node_count": 3140, "max_array_len": 2 }, "file": { "size": 7705, "entropy": 5.16 }, "text": { "lines": 97, "top_char": 101, "tab_count": 162, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 709, "char_entropy": 5.16, "unique_chars": 80, "top_char_null": 0, "string_density": 2.9, "top_char_ratio": 0.08, "avg_line_length": 78.43, "max_line_length": 126, "empty_line_ratio": 0.11, "last_line_length": 1, "whitespace_ratio": 0.13, "identifier_density": 2.95, "line_length_stddev": 43.4, "normalized_string_count": 28.53, "normalized_unique_identifiers": 1.21 }, "binary": { "peak_region_bytes": 7705, "peak_region_entropy": 5.19 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 3711, "count": 281, "ip_count": 10, "avg_length": 13.21, "max_length": 32, "path_count": 1, "avg_entropy": 2.9, "entropy_stddev": 0.98 }, "comments": { "chars": 116, "count": 10, "lines": 10, "to_code_ratio": 0.11 }, "functions": { "count": 1, "density": 1.03, "code_ratio": 0.96, "avg_name_length": 17, "no_params_count": 1, "avg_length_lines": 93, "max_length_lines": 93, "min_length_lines": 93, "high_entropy_names": 1 }, "identifiers": { "count": 286, "unique": 8, "avg_length": 7.88, "max_length": 17, "min_length": 5, "avg_entropy": 2.62, "reuse_ratio": 0.03, "length_stddev": 3.59, "high_entropy_count": 1, "high_entropy_ratio": 0.13, "all_lowercase_ratio": 0.25 } } }, "id": 23, "mol": "K(Te)Md", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/cloud.go", "pid": 0, "risk": 2, "sha": "29287cef2e78cd0d9290d8a598d6286b1a4b2b97332afd22ec6d4c339794084e", "size": 7705, "traits": [ { "id": "objectives/evasion/security-bypass/waf::akamai-name-reference", "conf": 0.9, "crit": 1, "desc": "References Akamai", "spans": [ [ 4631, 0 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "spans": [ [ 25, 32 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 25, 25 ] ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "spans": [ [ 301, 15 ] ] } ], "type": "go" }, { "id": 24, "mol": "K(Te)H(Cm)Md(Pa)", "sha": "d6d9b00c9c31f84e4e33ced2c00e8fbc91a0ea852dc909fdf6095182e140fb38", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/contenttype.go", "risk": 4, "size": 6543, "type": "go", "depth": 1 }, { "id": 25, "mol": "K(Te)H(Cm₂)Md", "sha": "81de67c58a53eaca3cd676ad11d0bcb88c5528b71745bba2dd3a0e7507eddf43", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/cookie.go", "risk": 3, "size": 5585, "type": "go", "depth": 1 }, { "id": 26, "mol": "K(Te)H(Cm₂)", "sha": "b27d1cdb2392e27119c7076377c09231684ae95dc6030e4fb45bd2a619df257c", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/cors.go", "risk": 2, "size": 5215, "type": "go", "depth": 1 }, { "id": 27, "mol": "K(Te)H(Cm₃)Md(Pa)", "sha": "7615ef31938b031ae2a2fc0f1b9afe5081e4516c0309ca741966b2119b1e0271", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/crlf.go", "risk": 3, "size": 3628, "type": "go", "depth": 1 }, { "id": 28, "mol": "K(Te)", "sha": "728b772c4d709bbf8ad095250b0dd419d4b3be396ea37da802ebb113be6da063", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/debug.go", "risk": 1, "size": 7931, "type": "go", "depth": 1 }, { "id": 29, "mol": "K(Te)Md(Pa)", "sha": "8814eea521efa5e940422151dbee935341fcbe6cee6eac07d1bd222cc6bfe9e4", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/encoding.go", "risk": 2, "size": 6796, "type": "go", "depth": 1 }, { "id": 30, "mol": "K(Te)H₂(Cm₃F)Md(Pa)", "sha": "7bb006cbf265dc0225641c392da7bc1084a5154150eb062e56b9623ad6520d9d", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/gateway.go", "risk": 5, "size": 6871, "type": "go", "depth": 1 }, { "id": 31, "mol": "K(Te)H(Cm)", "sha": "6b70d4c1743ea46170ea9ba58308f2ca806a69d3b59f74413571d6be1a79b2ae", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/hopbyhop.go", "risk": 2, "size": 3903, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]xK$Q.wPz\u002603tBu@z/P}xb4\u003eRixMW=pv@Diqv}dl4ggz[cnoF/(wPxCnzF9W3wG?D*w{503av*0+nP5oOv@#B6zCtm}vruj4zGviPax@b.zF9W3wIcY1Byxo9z/cXA3jg-:BAIRwax@b.zF9W3wIcY1Byxo9z/f[e2)\u0026mrau.\u003eJjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003e3jd1(fcBv}qY$7ILPS\u003enw]83*By!#9C4\u003ewcnm=juwPw[]vqH6$A%-iWfe1ChjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV%bU342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRu{5HuA+PGmk4ensA=-Y:dlGn8v@=p5BuT7-avxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@APv@%:Ob2R#:y?m9#wN(]=q=s/Zx\u003c\u0026bPwNPaXAW2].3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV}/Tb0Fb6zd:#jA:}mSaA8deA=M8sjZ\u0026erA=-Y:dl.b\u003cavxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@z", "ln": 0, "col": 1, "line": 1 }, { "b": "z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]RBq=Dshr+l8=v}*4gavg6\u0026x\u003eIrcEjLZj2)\u0026mrawcu=yge\u003euqBr\u003e}c@thhxM4=q3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV]R[DT*#iw[+)guTEqVvrlG%uOkX)x(mTbuTCA)uUsg[vQT7]uTE1+z/Wpie]U-FwO@[zx\u003eeOue]\u003eJiwge)PEiHi+lT+7Fxk.*oiV]Q", "ln": 2886, "col": 61, "line": 37 }, { "b": "y?m6:A=RM]342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRv0^kBCwhejar\u003e\u003eJayPslD#\u003cyIx(mNhEslD?bx)\u003czxDOHgb7j(^DN0-GBz8!rAbolgayPslD$d8jB8kMiBBnH+DWx\u003cFx(+[Cz/ybMDWx\u003cFx(+[CB-Rjsc#r*uyJTOsB98CpzF7OyBZ=Eqv@DmaBAhIlBz(gzdsDR\u003eDVS}nB1RAIAd9dYDN0-GBz8!rBAh8kxd!mAy?W#lvriMsv@C)?y?S", "ln": 5679, "col": 10, "line": 70 }, { "b": "b2.AtnG-g\u003cviwM\u003ewPxv*xjU$5b7h0H2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6mSiq\u003eefE#4y\u0026%qIar(eVh.3+mEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*q=uT!aA?EcaxR95b7h0H2)\u003e@HwNPaXAYLr!l1szoAc9W9vqY.2vp%c", "ln": 6392, "col": 75, "line": 75 }, { "b": "wN/*@z/c:Iaw3A?vpKyuar\u003cT5z//]tD2Nsqp\u0026ye^B-.tozxKapviw9LvpS}\u0026b7h0H2)\u003e@HwNPaXAYLr!lVl\u003c:wO#Pwrc-B]a$K\u003cqvqH6$iV]RPAbYScv{%E[z/djyB8L}TuTE+)z//]8uT4F/y\u00261lowN]7fBAhIna$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]RyA=l5rBA}?paw=#)y\u0026%\u0026lz/cW+z/fVdzGEEfD2NssEjLZi342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz[", "ln": 6913, "col": 100, "line": 82 }, { "b": "av{6LwmY^7nP5oOv@#B6zx:GW3jd2=nm=juwPx*Ob1MS[BrSmUr://!wJy}Ty\u0026r/(y?N:dBrSmUlT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*nn\u0026M\u003eav{6LwmY^7oMaAHy?N:dBrVb:3jd2=nm=juwPx*Ob1MS[BrSmUr://!wJy}Tf!$WufFk4if-", "ln": 7658, "col": 75, "line": 90 }, { "b": "fe1ChjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV%bU2})}OlsB}Hv\u003c2-hz//]cz!%F42)\u003e@HwNPaXAYLr!ss(*Tx!rv%A=U@kzxZROr://!wJy}TbZTozwna8vwmoBrfe3)Wx(2ziz/4doEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-(ztk#nXEx\u003c\u0026bPwNPaXAW2].3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eK\u003cV0a$K\u003cqvqH6$iV]Q(DUNCex/Z6vvq[mXfj/rvy+xjoz7/sCa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ruz!y[9xK#0@aA?EcaxR95b7h0H2)\u003e@HwNPaXAYLr!l1szoAc9W9vqY.2vp%c}efE#4y\u0026%qIar\u00267TyhNM@i=5tnA5]T9wP?^7e[n*pf8", "ln": 8668, "col": 3, "line": 102 }, { "b": "a%.IIzE^Dxy?c%[iXJc$C4\u003e+Bv@DiqvsosJavxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@APv@%:Ob1#]/g/F70y?$kqx\u003c\u0026bZwPq\u003c7B9609l)v4g3jd2=nm=juwPx*Ob3lA:z/P(fy*?B1z/dc#wfJMEr://!wJy}TbZTozwna8nzGv\u0026(fj/rvy+xjoz7/sCa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ruz!y[9xK#0@avF$6aA?Ecavy6/A+f5}BzkVheLetOEjLZi342iOvpS}\u0026iV]RjB-.qnA+P\u0026dBzkVha$K\u003cqvqH6$iV]RkwNPQ\u003cAV=SOyhNM@i=5tnA5]T9wP?^7e[n*pfjxnMefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9C4\u003ewcl3mo.av{6LwmY^9EjLZi342iOvpS}\u0026iV]RDB7Gwzl1:+DBrSmUr://!wJy}TbZTozwna8v", "ln": 9169, "col": 35, "line": 107 }, { "b": "fjxnMefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9C4\u003ewcrDz.(eKs2XzGE7Jed8Z\u003c2})}Op\u0026ZF@z!0Z4aA?glx\u003c\u003e[3A%-iWDQ}ZRwmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}TbZTozwna8Bzd#3:fj/rvy+xjoz7/sCa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ruz!y[9xK#0@aw${9aw^8%Bz\u003eVcy:aoU3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV]Q(DUNCex/Z6vvq{oGfe3)Wx(2ziz/4doEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-(ztk#pG5p\u0026ZF@z!0Z4b7h0H2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u00267TyhNM@i+ibHiXJc$C4\u003e+Bv@DiqvsosJavxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@APv@%:Ob1#]/g/F70y?$jZpe-oiA=l5rv@DfcEjLZi342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRa%.IIzE^Dxx\u003e.H8iXJc$C4\u003e+Bv@DiqvsosJavxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@APv@%:Ob1#]/g/F70y?$j=nL-e9p\u0026ZF@z!0Z4b7h0H2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u00267TyhNM@i+98GvQRqJfj/rvy+xjoz7/sCa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ruz!y[9xK#0@avw}5lo#.\u003cA=l5rv@DfcEjLZi342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRa%.IIzE^DxzE^/Hfe3)Wx(2ziz/4doEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-(FvqY[[Sz//]cz!{RCed8Z\u003c2})}Os3Yp#vTh{3B8@ExvRf+7v{%E[z/b)*342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRa%.HXDU^RAwPx?DEqSOfi=5tnA5]T9wP?^7e[n*pfjxnMefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9y\u0026sJeAV^X]Aa9*eb7h0H2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u00267Ty9Xc!iXtk$wna8vwmoBrfe3)Wx(2ziz/4doEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-(F:B97#7avG^MvrDydavpu)vrlGlEjLZi342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRa%.HXDV:pDwPx?DEqSOfi=5tnA5]T9wP?^7e[n*pfjxnMefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9B-qqhAV^X]Aa9*eb7h0H2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u00267Ty9XdGAbYxei.\u003e9lx/Z6vvq[mXfj/rvy+xjoz7/sCa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ruz!y[9xK#0@awDM{wN(]Jvrl05lv0JUB8@KNed8W\u0026DQ}ZRwmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}TbZQ!-y\u0026sJeAYN@-bZTuCCv+!QzHA^Sy\u0026sJeAYN-VbZTuCCv+!Qx)\u00263UwmoBrfe3)Wx(2ziz/4doEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-(h\u0026y?$j/z*b=kavpu)vrlGlEjLZi342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRa%.HXDPBhtyjdvOiYX\u003cgEi:e2iXs(\u003cbZRNkeOPR]y?c%[iXJc$C4\u003e+Bv@DiqvsosJavxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@APv@%:Ob1#]/g/F70y?$j-B.\u003e\u003epl$G$sB.(dxlv0JUB8@KNed8W\u0026DQ}ZRwmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}TbZTnKDPBhtzHD4vDPBhtx)\u00263UwmoBrfe3)Wx(2ziz/4doEiHi+lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-(L.A==27y-(bSw)]*#BrA[}Aa9*eb7h0H2)\u003e@H", "ln": 9579, "col": 56, "line": 110 }, { "b": "3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV]Q(DUNCex/Z6vvq[mXfj/rvy+xjoz7^eYwO#VLl03#(q:\u003c5Kmo0RWlQKpvq^Sf^s:+YxefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9l03#coj-w\u003emr\u0026AUy:aoU3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV]Q(DUNCex/Z6vvq[mXfj/rvy+xjoz7^eYwD", "ln": 11807, "col": 49, "line": 131 }, { "b": "b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9nn\u0026M\u003ezEEx[avQJ!x(1#wed8Z\u003c2})}OoMaM2q!P-Uy-)[nvixc8wPA5sv@Dj3z/cXlz!AY]wftL%vpS}\u00263jd2=nm=ju", "ln": 12606, "col": 87, "line": 137 }, { "b": "xk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*oMaM2q!P-Uy-)[nviv{Qz!\u003c5#b7h0H2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6nn\u0026M\u003ea$K\u003cqvqH6$iV]Q(DUNCex/Z6vvq[mXfj/rvy+xjoz7/sCa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ruz!y[9xK#0@aA?EcaxQi+z/Q5gA+5-(eL6/3BrVb:3jd2=nm=juwPx*Ob2rk[xk8lcefE#4y\u0026%qIar\u00267TyhNM@i=5tnA5]T9wP?^7e[n*pfjxnMefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cG$xeAL2wO=f9C4\u003ewcpJyeZx(kbyed8W\u0026DQ}ZRwmY^xao", "ln": 12764, "col": 62, "line": 140 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV%bU2})}Oq=ck5aA?Ecav{6LwmY!5aMv{oavo)UzE:\u003e?x(dAkvQTs?wc@RHfe1ChjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV%bU2})}Om}DNHA+P2aq=ck5aAhvt", "ln": 13569, "col": 15, "line": 148 }, { "b": "eN\u0026dfwN(])y?W=$3jd2=nm=juwPx*Ob2@X}AXfN\u0026wO#PlefE#4y\u0026%qIar\u0026fQk#6/\u003cq+PRGp:!gIeIe7%a$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Rky?W=$ax8chx={b}q=cjhq+PRGp-%{}viwMob7h0H2)\u003e@HwNPaXAYLr!ss(#", "ln": 14004, "col": 16, "line": 155 }, { "b": "wO#PlefE#4y\u0026%qIar\u0026fQk#6/\u003cf*d]\u003eo\u0026Cy}nL?\u0026dqBJ@wnMFn!o*}#Vk$su(cT!wNh7paea$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Rky?W=$ax8chx={h(vpKa+avFJ", "ln": 15642, "col": 20, "line": 173 }, { "b": "wmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}Tj0nlFa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Rlz/6u1zE:\u003eYzFA-)BzkVhax8\u0026*x\u003e86$z/c+E", "ln": 17606, "col": 7, "line": 196 }, { "b": "wmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}TD)0cla$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Ryx(ESalVl*UvqYP#nP5oOv@#B6zx:GW3jd2=", "ln": 17714, "col": 7, "line": 197 }, { "b": "vpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRb4ba}u)mcAlT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*lsBwtBzkl2avy6:zddr)aw3D=wN/*@z/c+Eed8", "ln": 17816, "col": 6, "line": 198 }, { "b": "wmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}TbQ^wqdiZq=lT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*q/#L\u003cxK#0@avy6:zddr)aw3D=wN/*@z/c+Eec", "ln": 17924, "col": 7, "line": 199 }, { "b": "wmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}Tcmf\u003cHwfJMElT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*k#6/\u003clVl*UvqYP#nP5oOv@#B6zx:GW3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV]Rday!\u00264atmqFv\u003eR!fB8#Loa$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Rlz/6u1zE:\u003eYzFA-)BzkVhatmqFv\u003eR!fB8#Lob7h0H2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar(gQv%8*dazt\u003esA5]T9wP?^7e[n*pfc?@\u0026xM4r@x^\u003ekSavxNVwOk}4C@^5(nP5oOv@#B6zxZROnO@APv@%:Ob13o=zddr)aw3D=wN/*@z/cW[pElglB-IpxEjLZi342iOvpS}\u0026iV]RGeKKV4Bz(1Fnm=juwPw$Caxz]!B.9PRb77ISxjVfcxMOuniXJc$C4\u003e+Bv@DiqbQ^wqD$3J9wI#v]a$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]Rlz/6u1zE:\u003eYzFA-)BzkVhawU^1aA}EfBrVb:3jd2=nm=juwPx*Ob3lA:B-RUyz7Op\u0026vpS}\u0026a$K\u003cqvqH6$iV]R]az#mpz/oAlA3czOCw7]6", "ln": 18134, "col": 7, "line": 201 }, { "b": "wmY^xar\u003c]tpJyeZx(mu}eMCXxa$K\u003cqvqH6$iV]R1e?O!fe?X?ffj/lnfk$uvB9zdsefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cS\u003cBz8^@A::c5A=UV9aA?EcaxqrkawWe(A=L(8wG(KN3jd2=nm=juwPx*Ob3lA{wP@feBy^47qCnn=axz]!B.9PRa$\u003eM3b@f6+e*Sn+e?OC9w[u6]fk$uvB9zdsefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cl(v@C)?wfsYSBz8^@A::c5A=UV9b7h0H2)\u003e@HwNPaXAYLr!ss)r?x\u003eIc$vqEI}qCnn=axz]!B.9P", "ln": 19174, "col": 7, "line": 212 }, { "b": "342iOvpS}\u0026iV]RDB7Gwzl1:+DBrSmUr://!wJy}Te?O!fe?X?ffd[\u003ege?O!*ByM$yvrlHlwfJMElT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*p*[DVaxiw\u0026C4CYnvqE6fx\u003c\u0026b:B7Gwzl1:+DBn", "ln": 20112, "col": 2, "line": 219 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}n2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u003e]sB97VifFD{Cze0(iefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003cN6y?$jXD30QunP5oOv@#B6zx:GW3jd2=nm=juwPx*Ob3lA^x(4u#vqPN1efE#4y\u0026%qIar\u0026A\u003cfd[\u003egwPRAnAa9*eCvS0NfFm9VxcF(HlT+7Fxk.*oiV]RrzFA-)BzkVha$K\u003cdze-][BugJ*piyw?avpu}wGTDRy?j.XzEWH9B7\u003e", "ln": 20361, "col": 26, "line": 223 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}n2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u003e6kw[A\u003eOtY\u003cT\u003cg=eDWw[A(gtY\u003cT\u003cg=X/-w[A(ha$K\u003c7vru6[z/Qa:ar\u003cx{ygQ)%x(v(kefEJ3Aa9l#iV]RDzFrQ0wmV(MB.\u003e(rx\u003ehs0ayO!$x(kbyed8W\u0026DQ}ZRwmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}TvpTj?zD}rtfFD@WefEq*By/96A^oX*b1VV!wN/*@z/c:Iaw3A?vpKyuar\u003e02A=i74x\u003ehs0ax9k/v}u=OzFA-)BzkVhb7h0H2)\u003e@HwNPaXAYLr!ss().B98tqeL6CYwmY^9efE#4y\u0026%qIar\u003ej", "ln": 20771, "col": 26, "line": 229 }, { "b": "wmY^xar\u003c]tlV)D(z/46%wNPaXAW04Sr://!wJy}Tc3}3+v@k:tcUW9sdk01[x(!GjzAPykygho]e]j%lxd^bdB97#gkXBUIp\u0026ZF[wPz)rc)@}Oe]C9mwHw]VBz\u003c\u0026\u003eCv+!Zvrl0ddk2aGzGGr3zGviNCwg}xdjDX#c)Jkswof)Zbwzjyx(ldZcU417cOcR#v\u003c-/Lv@k+8i^SkcvRGZkB7={LcOn*Qef!Uwwpk)Qe*}@-j-j?PazLtdvj(w8zF7N#A=kD0B8%V\u003cx(4r\u003eAWSexzdEYp", "ln": 23173, "col": 7, "line": 259 } ], "depth": 1, "facts": { "imp": [ [ "", "github.com/cc1a2b/HHunter/engine" ] ], "funcs": [ [ "GetInjectionMutations", 60 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 0, "node_count": 6636, "max_array_len": 2 }, "file": { "size": 23715, "entropy": 5.36 }, "text": { "lines": 262, "top_char": 61, "tab_count": 438, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 1786, "char_entropy": 5.36, "unique_chars": 98, "top_char_null": 0, "escape_density": 0.03, "lines_over_200": 5, "string_density": 2.26, "top_char_ratio": 0.09, "ascii_art_lines": 30, "avg_line_length": 89.52, "max_line_length": 485, "non_ascii_ratio": 0, "empty_line_ratio": 0.15, "hex_escape_count": 1, "last_line_length": 1, "long_token_count": 3, "whitespace_ratio": 0.1, "identifier_density": 2.28, "line_length_stddev": 63.37, "encoded_string_ratio": 0.01, "unicode_escape_count": 7, "normalized_string_count": 36.64, "repeated_char_sequences": 30, "suspicious_string_ratio": 0.06, "suspicious_comment_ratio": 0.01, "normalized_unique_identifiers": 1 }, "binary": { "peak_region_bytes": 17571, "peak_region_entropy": 5.51 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "sql": 18, "bytes": 12252, "count": 593, "shell": 7, "ip_count": 1, "url_count": 4, "avg_length": 20.66, "max_length": 380, "path_count": 12, "avg_entropy": 3.46, "email_count": 2, "url_encoded": 3, "domain_count": 1, "entropy_stddev": 0.61, "embedded_code_candidates": 12 }, "comments": { "chars": 3097, "count": 70, "lines": 70, "high_entropy": 1, "to_code_ratio": 0.36 }, "functions": { "count": 1, "density": 0.38, "code_ratio": 0.98, "over_100_lines": 1, "avg_name_length": 21, "no_params_count": 1, "avg_length_lines": 258, "max_length_lines": 258, "min_length_lines": 258 }, "identifiers": { "count": 598, "unique": 8, "avg_length": 8.38, "max_length": 21, "min_length": 5, "avg_entropy": 2.61, "reuse_ratio": 0.01, "length_stddev": 4.87, "all_lowercase_ratio": 0.25 } } }, "id": 32, "mol": "K(Te)O₂(XeCa)H₂(Cm₃F)Md(Pa)Th", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/injection.go", "pid": 0, "risk": 261, "sha": "e96d45cd21e40800cbd004f8257778995034f7b1121a2a98d2f91e83559da6cb", "size": 23715, "traits": [ { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "spans": [ [ 2950, 3 ] ] }, { "id": "metadata/package/testing/corpus::sqli-category-label", "conf": 0.9, "crit": 3, "desc": "SQL injection category label", "spans": [ [ 13633, 4 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 214, 3 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::native-json-content-type", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Native HTTP JSON content type", "spans": [ [ 6977, 39 ] ] }, { "id": "micro-behaviors/communications/http/header/custom::x-forwarded-host", "conf": 0.9, "crit": 3, "desc": "X-Forwarded-Host proxy header", "spans": [ [ 12828, 16 ], [ 12915, 30 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "spans": [ [ 18275, 11 ] ] }, { "id": "objectives/credential-access/env/secrets/cloud-access::aws-secret-env-access", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "Reads AWS secret key from environment", "spans": [ [ 11871, 25 ] ] }, { "id": "objectives/execution/exploit/command-injection::log4shell-jndi-lookup-payload", "atk": "T1190", "mbc": "E1190", "conf": 0.99, "crit": 4, "desc": "Log4Shell JNDI lookup payload", "spans": [ [ 8796, 14 ], [ 9297, 13 ], [ 9707, 13 ], [ 9830, 15 ], [ 10080, 14 ], [ 10205, 15 ], [ 10332, 13 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "spans": [ [ 25, 32 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-injection-mutations-fn", "conf": 0.98, "crit": 3, "desc": "HHunter GetInjectionMutations function", "spans": [ [ 65, 21 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 25, 25 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-mutation-category-impact", "conf": 0.98, "crit": 3, "desc": "HHunter mutation Category Impact fields", "spans": [ [ 389, 30 ], [ 19295, 30 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 18399, 25 ], [ 18534, 20 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd-cat", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd read via cat command", "spans": [ [ 18269, 17 ] ] }, { "id": "metadata/package/testing/corpus::injection-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple injection attack-category labels", "uses": [ 1, 2 ], "spans": [ [ 214, 3 ], [ 13633, 4 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd user database access", "uses": [ 13 ], "spans": [ [ 18269, 17 ] ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/Soft", "conf": 0.9, "crit": 5, "desc": "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228", "spans": [ [ 8796, 13 ], [ 9297, 12 ], [ 9707, 12 ], [ 9830, 14 ], [ 10080, 13 ], [ 10205, 14 ], [ 10332, 12 ] ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/OBFUSC", "conf": 0.9, "crit": 5, "desc": "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228", "spans": [ [ 11194, 9 ] ] }, { "id": "third_party/SigBase/SUSP/EXPL/OBFUSC/Dec21", "conf": 0.9, "crit": 5, "desc": "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228", "spans": [ [ 10486, 10 ], [ 10758, 10 ], [ 10892, 10 ], [ 11039, 10 ], [ 11049, 10 ], [ 11059, 10 ] ] } ], "type": "go" }, { "ctx": [ { "b": "Aa9l(vp%c]xK$Q.wPz\u002603tBu@z/P}xc\u003c*n8wO#0@wnb{]fjFvhwI#v?3jm7-xk8E3BZ=$kz/4dqv\u003e?yEvLpnyB-8qjAXz0wxk8l{a{]+a3taA#v\u003c1oMBv]Rlo)7L^BzkVhB0@EWtu$/Txk8l{e\u003e{Fgvruj4zxKok2})}OvqGNqzF%A7awbZmauZ\u0026UC$I:Vm}lmex?AISgbS(tx)jo4nnJGwyhW/+y?cKqzziXOC$Jx[s4Na4x?rLvx)jo3z8(Vvq+n(szanqIs8r1Jx)jo1s4j(nyhXt(r7eMpye3MWl}IVoq7-gZvqGNKz/fbSwNPaXAV^zaayX=2wI#v$qEK=HqCoI%v@C)(zF7N\u003czEWP}wMiODBAh8kxdc$\u0026vTi6bc$4xCvqGN2iWeDWzE\u003e1yb6n9Hb03]us5Zw(u[0Ji31mT.ph+2Yp*[S=z^^f0iZ1P{vrl0rg+IWmCu4Kmmq=QNwnb{]e\u003e6U/z!9AUz=p:#x(mMitu$Y-By=\u003edDM)JNvJ)\u0026Sf^nd)A=k=9b03]RwnM3#a$K{LvrrXOf/pWzgby{Agbsn=djCPgvqGNKz/fbUs5Zq6jS[fHxhiw.wK{xvwmY^7d\u003cc2*a%nxUvqGNK", "ln": 0, "col": 1, "line": 1 }, { "b": "d\u003cenpxhiw.wL=/Xy\u0026r-)as!MUe*pSf2})}OmqW0=C{4fxxkRd1B-I4on([$mCwhejav]A^h8U^FvqGNEq.*i*nm=juwPw[OjS[ixB7El^e(Db4rz(HVzEWP}x(mMomq=QNwmX.Uq/)4]zF7w4u1e83wHH@kb4kq2b03]sq.*i*a$K{WD2K@*b1+{o", "ln": 1007, "col": 40, "line": 25 }, { "b": "xdc$\u0026vTi6bc$4xCB9g}oiWeP.z/^fOb64QrwG\u003ceVB9hCkA:-G}x(kaCb57Fcb04Cof/y^yiwrizEpaGM3jg-\u003ez/!PMr3jj+ayP80ph+2Ynm=juwPw[zar\u0026AZas!NPz/o.]vr?", "ln": 1492, "col": 52, "line": 36 }, { "b": "zGE1mwNPaXA=RM]342iOvpS}\u0026iV]RGeKr(RwPI]ArbVL-zxZROr://!wJy@xy?DHYzE(Bwr4GdVvru6[z/Qa:ar\u003cAVr3A\u003eonO@APv@%:Ob1+{oayP80i=n\u003eNwGVegve", "ln": 2855, "col": 21, "line": 58 }, { "b": "n([$oefEJ3Aa9l#iV]Rss5ZqJy?C!Dz/fbeC4\u003ewcq!p2\u003ex(v(ilVl)Ux\u003enGped8W\u0026DQ}ZRwmY^xar\u003cf\u003ez!\u003c5#a$K\u003cqvqH6$iV]RYCxt$(as!Nyy?DHYzE(Bwr4GdVvru6[z/Qa:ar*", "ln": 3449, "col": 65, "line": 64 }, { "b": "y?vQazdNl2p*[x^B0aq1z^)o4EjLZi342iOvpS}\u0026iV]RjB-.qnA+P\u0026dBzkVha$K\u003cqvqH6$iV]RkwNPQ\u003cAV!}sn[.W7v}!.Mn\u003eA3enIJ$OnPNEvqz?@KnJ6dQA9cddn\u0026XIngCyB9efEq*By/96A^oX*b1+{oa$K\u003cdze-][BugJ*n([$mmqW0=C{2{(D2dzcwfMBM3jm7Cfe1Cus5ZqTwQbzdz/fffB7]MgasHb^gbQ%jeJ$pFq.*i*dgcv/DQ}ZRwmY^xar\u003c]tn([$zl2pgLA+PSez6yIN", "ln": 4149, "col": 84, "line": 72 } ], "depth": 1, "facts": { "imp": [ [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "base64.RawURLEncoding.EncodeToString" ], [ "", "encoding/base64" ], [ "", "github.com/cc1a2b/HHunter/engine" ] ], "mbr": [ "base64.RawURLEncoding", "base64.RawURLEncoding.EncodeToString" ], "tgt": [ "base64.RawURLEncoding.EncodeToString" ], "funcs": [ [ "GetJWTMutations", 85 ] ], "metrics": { "ast": { "op.add": 36, "max_depth": 14, "call_count": 9, "node_count": 1774, "member_count": 2, "max_array_len": 2, "op_density.add": 0.02, "max_concat_chain": 4, "member_depth_max": 3 }, "file": { "size": 5269, "entropy": 5.36 }, "text": { "lines": 89, "top_char": 101, "tab_count": 103, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 472, "char_entropy": 5.36, "unique_chars": 78, "top_char_null": 0, "string_density": 1.55, "top_char_ratio": 0.07, "avg_line_length": 58.2, "max_line_length": 133, "empty_line_ratio": 0.2, "last_line_length": 1, "long_token_count": 1, "whitespace_ratio": 0.13, "identifier_density": 2.34, "line_length_stddev": 46.73, "normalized_string_count": 14.63, "suspicious_comment_ratio": 0.13, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 4.48 }, "binary": { "peak_region_bytes": 4245, "peak_region_entropy": 5.44 }, "source": { "function_count": 1 }, "imports": { "count": 2, "stdlib_count": 1, "stdlib_ratio": 0.5, "third_party_count": 1, "third_party_ratio": 0.5 }, "strings": { "bytes": 1845, "count": 138, "url_count": 2, "avg_length": 13.37, "max_length": 62, "avg_entropy": 2.6, "entropy_stddev": 1.31 }, "comments": { "chars": 440, "count": 16, "lines": 16, "base64": 1, "high_entropy": 1, "to_code_ratio": 0.22 }, "functions": { "count": 1, "density": 1.12, "code_ratio": 0.91, "avg_name_length": 15, "no_params_count": 1, "avg_length_lines": 81, "max_length_lines": 81, "min_length_lines": 81, "high_entropy_names": 1 }, "identifiers": { "count": 208, "unique": 29, "avg_length": 10.31, "max_length": 15, "min_length": 4, "avg_entropy": 3.03, "reuse_ratio": 0.14, "length_stddev": 3.4, "has_digit_ratio": 0.07, "base64_like_names": 1, "high_entropy_count": 7, "high_entropy_ratio": 0.24, "all_lowercase_ratio": 0.1, "numeric_suffix_count": 1 } } }, "id": 33, "mol": "K(Te)O(Pr)H₂(CmDb)Md", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/jwt.go", "pid": 0, "risk": 5, "sha": "34aabc35017c0b251133976eb70cf22692fb290e50e1610b28bec88b93abbd45", "size": 5269, "traits": [ { "id": "micro-behaviors/communications/http/token-auth::jwt-unsecured-algorithm", "conf": 0.98, "crit": 3, "desc": "Unsecured alg none setting", "spans": [ [ 307, 12 ] ] }, { "id": "micro-behaviors/data/encode/base64::go-base64-encode-call", "conf": 0.85, "crit": 3, "desc": "Go calls a base64 encoding method", "spans": [ [ 261, 36 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "spans": [ [ 48, 32 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 48, 25 ] ] }, { "id": "micro-behaviors/data/encode/base64::encoding-base64-import", "conf": 0.5, "crit": 3, "desc": "encoding/base64 package import", "spans": [ [ 28, 15 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::go-jwt-none-algorithm", "atk": "T1134", "conf": 0.94, "crit": 3, "desc": "Go creates JWT none algorithm", "spans": [ [ 307, 12 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 4213, 36 ] ] } ], "type": "go" }, { "id": 34, "mol": "K(Te)H₂(CmF)", "sha": "b6be12a2537abd71fc0af68251996db477bd54f13c38a3fed86ee14e02e3ddc3", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/override.go", "risk": 3, "size": 7161, "type": "go", "depth": 1 }, { "id": 35, "mol": "K(Te)H(F)", "sha": "88a82572d06bc5691620de56a1a75dcc476a5e8e4f2b1c7def0c1082fd371831", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/protocol.go", "risk": 2, "size": 6324, "type": "go", "depth": 1 }, { "id": 36, "mol": "K(Te)H(Cm₂)Md", "sha": "226408ae79e21c02fa6e467b6efe438e6a2a4af531928f56c0dba3705f66de7b", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/proxy.go", "risk": 4, "size": 8490, "type": "go", "depth": 1 }, { "id": 37, "mol": "K(Te)H(Cm₂)", "sha": "626fe1e23e1337e99d5be779748dc235e79b6ea99590a23967d32ccb8f0a7ad4", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/ratelimit.go", "risk": 2, "size": 4408, "type": "go", "depth": 1 }, { "id": 38, "mol": "K(Te)H(Cm)", "sha": "6817c269968a474858f49d36cad87e7001b2c1c02d2f0c1dc521e4dc52b43374", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/redirect.go", "risk": 2, "size": 5652, "type": "go", "depth": 1 }, { "id": 39, "mol": "K(Te)H(Cm)", "sha": "4fef39bcd0fe68ea9f1f89c512dfb6ef8515c75ddffb4e0caf507f22afedf0a7", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/security.go", "risk": 2, "size": 5595, "type": "go", "depth": 1 }, { "id": 40, "mol": "K(Te)Md", "sha": "f3ae0b152d704fb92080b73b0bfed20a1949dcba0277fd28714a8a4c87918ff3", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/smuggling.go", "risk": 2, "size": 5015, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]xK$Q.wPz\u002603tBu@z/P}xb4\u003eRixMW=pv@Diqv}dl4ggz[cnoF/(wPxCnzF9W3wG?D*w{503av*0+q=uN-o)7L^BzkVhB0@EWtu$/Txk8l{e\u003e{Fgvruj4zxKok336Q0B-Ivxtu$/Txk8l{e\u003e{Fgvruj4zHhY%2})}OjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}n2)\u0026mravf7caw2o}q*6(r\u0026^^molU{gLB7]bbzdN/$wmoN*ayO+\u0026wPI]12)\u0026mrau.\u003eJjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003e3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Tf/z3AgbQ)vf/z3AgbQ)jefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob0/peaw2o}q*6(ro\u003ewAPwmoN*ax8ipmK0mi3jd2=nm=juwPx*Ob3lA/z/Z1AefE#4y\u0026%qIar\u0026J#iw96Ag+HHviw96Ag:jE[lT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]Rjs5Qkko*?{6f^6h4Bn", "ln": 0, "col": 1, "line": 1 }, { "b": "A=L(8wG(KN3jd2=nm=juwPx*Ob3lA)A+Pf2zEEukrz(HmefE#4y\u0026%qIar\u0026EPvru74Bt4GxByu+ivrt{hx\u003c\u003e\u003ciB7F\u003c7A+PSveN@*jwmYU2x\u003c\u003e?0fcR}\u0026lT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]Rjs5Qkkk$@E?A+e=)zGGP3y\u0026ZZ}vruf9pJ*q\u0026A+P5}b7h0H2)\u003e@HwNPaXAYLr!ss)r?x\u003eIc$vqEI}qCnn=axz]!B.9PRa$)+vBy/JnflItEAXg*gByuvAavxNV", "ln": 1250, "col": 107, "line": 19 }, { "b": "jV$}\u003ejV$}\u003ejV$}n2)\u0026mravf7caw2o}q*6]s\u0026^^morbVL-zy]saB7F(8vpJ!UB8@DLBzbkdA+eV}atLSahxVBIBywV{aA?saBz(gG3jd1(fcA?Xl@Om:aAz4kB.L(cB0apVr3ly0Bz8!0eN-\u003cAeOeAEeP26vvpS!*vj=OtyH}xnBAzsJB7F\u003c1zE^/hxK$Q.wPwa:2})}OnOf8?wGUF\u003ezxJLfA+w@aBzblbwGUU$vpS}\u0026B1wCTwGUF\u003ezxJzlAa9*eav#", "ln": 1721, "col": 62, "line": 24 }, { "b": "s5QkglSkabvrlibo\u003ewAPwmoN*asH-rzGGr3zE)\u0026hv@=c\u003ewO#Q7vqE6dxK$^$dgcv/DQ}ZRwmY^xar\u003c]tmSir\u003evrb)\u0026wgZt\u003cB95PSaxz]!B.9PRa#7#oe\u00262pve?]pse\u00261R4avxNVwOk}4", "ln": 2436, "col": 7, "line": 33 }, { "b": "fcALZqY[+xzdm3:ax0u1BzkP6ave*}3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Tf!$WufFk4if/?rGfFK+5avxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*l03#coKR^EwmlPUB-8qnzdK?Qp!q^dq=l7eEjLZi342iOvpS}\u0026iV]Rqz/Z1AefE#4y\u0026%qIar\u0026J}h.D^pfFk7viwrcwa$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpG", "ln": 2921, "col": 4, "line": 39 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003e3jd1(fcA+Lp-@FzBywY*ByurKFrRfOwPq\u003cbA+fqmo\u003ewAPwmoN*eK\u003cL+C5IyZav*u*xkzc4xK$Q.wPwa:2})}OjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}n2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6nn\u0026M\u003ea$K\u003cqvqH6$iV]R-wPRu\u003evrt{gxk.Z3y?kkkzGGDgzEEu9efEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1C0%awDA?vpS!*viwGEqBR\u003cUed8W\u0026DQ}ZRwmY^xar\u003cu{B95PSaxz]!B.9PRb5H[kvpS!*vj(hhz!A($e[]iBwPzV%y:7zMlT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]RplR[[1wPRu\u003evrt{2C4\u003ewcnn\u0026M\u003eb7h0H2)\u003e@HwNPaXAYLr!ss)6ZB95PSaxz]!B.9PRb5H[kvpS!*vj(hhz!A($e[]iBwPzV%y:7zMlT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]RplR[[1wPRu\u003evrt{2C4\u003ewcss)6ZB95QOed8W\u0026DQ}ZRwmY^xar\u003cJ\u003eBywY*Byu:\u003cy*?H9AW04Sr://!wJy}Tm@JrUy?j!wavxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*m)*8}o\u003ewAPwmoN*avZfQC5Iyznm=juwPw#yed8W\u0026DQ}ZRwmY^xar\u003c]tm@JrUy?kg)wPRu\u003evrt{fqE%\u0026\u003cwPI@qefE#4y\u0026%qIar\u003c^9BP", "ln": 3482, "col": 41, "line": 45 }, { "b": "mJ%xanO@APv@%:Ob1C0%awDA?vpS!*viwGZz/P}xnn\u0026M\u003ezEEx[b7h0H3jd1(fcAzvjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejQIG4fe1ClDuBmtaw2o}qY$7ILPSLnB97\u0026dv}u=SwPRu\u003evrt{2q!o#)x\u003e7YY2)\u0026mrau.\u003eJjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003e", "ln": 4839, "col": 53, "line": 61 }, { "b": "a$)!ABywY*Byu?pwmYU2x([RNz^^^gxFIk.z!\u0026{4kvFIBeP$YCB7]MgjU!YCi4V*teIF[aA+frgB-H#6j.O}VAc15[fkUcnvp%d*wO#Pxvs06pwIdFhz7^7:avxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*l3^V]wGTYQzEEf?wb", "ln": 5362, "col": 37, "line": 70 }, { "b": "l3^V]wGTMZB97\u0026dv}u=SwPRu\u003evrt{4EjLZi342iOvpS}\u0026iV]RGeL*z3xk8l(y+nT+oD(2gr://!wJy}TfkUoxvpS!*vj#t9wO#Q7BA]JTvrDW9gb0-/yH}xFvq]{jC4CYnx(v(Lgb7BxeIF}ifFK[{wPI^jA:@VzxMOunB2\u003e%cC42JfBs}0FB-I4CzE)]lefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob0*J$A+cv^wQbz0vrDydaxin{wO@R\u0026xK$^$b7h0H2)\u003e@HwNPaXAYLr!ss)r?x\u003eIc$vqEI}qCnn=axz]!B.9PRa$)!ABywY*Byu?pwmYU2x([RNz^^^gxFIk.z!\u0026[", "ln": 5632, "col": 109, "line": 71 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}n2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6nn\u0026M\u003ea$K\u003cqvqH6$iV]RZBZ!{5zE){3B1R0mw)]*#Bs}STv\u003ciDDlT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]Rticcidp!q^dwPz%9AV!pVqBR\u003cUed8W\u0026DQ}ZRwmY^xar\u003cu{B95PSaxz]!B.9PRb5qsgwPzW1By/ICwmYvYB.(dLB9q4qefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1\u003c[pave*}ax8\u0026(C4CXpC4\u003ewcnn\u0026M\u003eb7h0H2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6nn\u0026M\u003ea$K\u003cqvqH6$iV]RZBZ!{5zE){3B1R0mw)]*#Bs}STv\u003eIncB-RUoAXqfDv{%f$efEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1\u003c[pave*}avYi@p9rFlqBR\u003cU", "ln": 9055, "col": 34, "line": 116 }, { "b": "BrBH[A=#ebwGTuil@Cdaq=l7eEjLZj2)\u0026mrawjXnaAIHkv}/K?v\u003c2-0Bzb.rw]zYjB7F\u003c4wPPOEz!\u0026{4aARpdw][v^342iOvpS}\u0026iV]RGeL*z3xk8l(y+nT+oD(2gr://!wJy}Tfjw*lflP66zEEx[B8UL$wPGInwObv[y\u0026?sKwN/:(BAnSSavxM", "ln": 9741, "col": 89, "line": 122 }, { "b": "wO\u0026L*wN/:(BAnM[zGP/cA::67z/c+Eed8W\u0026DQ}ZRwmY^xar\u003c]tpJyeZx(mu}eMCXxa$K\u003cqvqH6$iV]R1vq]{lB$\u003eT?z!9]kefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1\u003c[paw=#!avQf\u003czdN-@BzkVhb7h0H2)\u003e@HwNPaXAYLr!ss)r?x\u003eIc$vqEI}qCnn=axz]!B.9PRa$)wzx!KS:fk+YswPG4DavxNVwOk}4C@^5(q=uN-a$K\u003cdze-[", "ln": 10053, "col": 114, "line": 126 }, { "b": "ar\u003cDrB0aj@wmV(LzGP/cA::67z/c+Eed8W\u0026DQ}ZRwmY^xar\u003c]tpJyeZx(mu}eMCXxa$K\u003cqvqH6$iV]R1vq]}4fjw*sB1.X\u003efjXTky\u0026sPowO#Qha$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cDrB09\u003eZAboDrzdNQbavQf\u003czdN-@BzkVhb7h0H2)\u003e@HwNPaXAYLr!ss)r?x\u003eIc$vqEI}qCnn=axz]!B.9PRa$)RvvqH40DlK).lT+7Fxk.*o", "ln": 10259, "col": 79, "line": 128 }, { "b": "fcA[EB0b4ov}lY)x(W={BrC14v}x.53jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Ty\u0026r/(y?N:dBuhfkh-S6kavxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*oe{#nwPRA)avG{:wN/*8l1szoB8@KNed8W\u0026DQ}ZRwmY^xar\u003c]tmSir\u003evrb)\u0026wgZt\u003cB95PSaxz]!B.9PRb4U\u003eawg?UuvR4cjD2[7sz7Y)Mv(=w3h-S6kavxNVwOg", "ln": 10612, "col": 4, "line": 133 }, { "b": "ave*}asIbCwmWuewP?T3ayO+\u0026wPI]w3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Ty\u0026r/(y?N:dBuhcggbQ:fefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1)5/wO+}1ave*}ax8ipmK0mi3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Ty\u0026r/(y?N:dBuhcggbQ{kefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1)5/wO+}1aw#=VwgZO{y\u003cvc?p!q^dq=l7eEjLZj2)\u0026mrau.\u003eJjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}", "ln": 10882, "col": 17, "line": 137 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003e3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Ty\u0026r/(y?N:dBuhfkh-h^gavxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*l#MNJwPw[Vp!q^fzEEWfxDQkLqBR\u003cUed8W\u0026DQ}ZRwmY^xar\u003c]tmSir\u003evrb)\u0026wgZt\u003cB95PSaxz]!B.9PRb5zgcvqGQ}B96C#gDdioefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1cuVyH}Jek#pb}r7{jkq=uN-b7h0H2)\u003e@HwNPaXAYLr!ss)r?x\u003eIc$vqEI}qCnn=axz]!B.9PRa$[9]e\u0026kpov@DmbvqfQ\u003cA=S)GB8L}uefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1cuVyH}JelVl\u003c:vqfQ\u003cAV!4\u0026B95QOed8W\u0026DQ}ZRwmY^xar\u003c]tpJyeZx(mu}eMCXxa$K\u003cqvqH6$iV]R1B$\u003eQaf!WlTvp%d)fktMDzxZROlT+7Fxk.*oiV]RBq=l6", "ln": 11263, "col": 49, "line": 143 }, { "b": "x\u003e7Y%l${ZLz*2YjC{89%LPStize:JbxK#75x)a5gAbP=saAI43zxKapvixk{vpS}\u0026A%-iWfe1ChjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejP", "ln": 11815, "col": 19, "line": 150 }, { "b": "wNV^6wPz%9A=SuRavf%=aAIamC4CYn3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Ty\u0026r/(y?N:dBuhxna$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cx{By/GgvqE5Sr8=Wpq=uN-b7h0H2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6nn\u0026M\u003ea$K\u003cqvqH6$iV]R.z!0i(xM4%liY5VHa$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cx{By/GgvqE5Sr8=W)ax8ipmK0mi3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Ty\u0026r/(y?N:dBuhxni4#KcavxNVwOk}4C@^5(q=uN-a$K\u003cd", "ln": 11948, "col": 7, "line": 152 }, { "b": "vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cl(C5ITGl1B?DzxI\u003eRqBR\u003cUed8W\u0026DQ}ZRwmY^xar\u003c]tmSir\u003evrb)\u0026wgZt\u003cB95PSaxz]!B.9PRb5zgcvqGQ}B96C$h83Zsa]", "ln": 15680, "col": 59, "line": 194 }, { "b": "wnb{]avf7cax8ipmK0mi3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}TB8V5ow[tH9vS=Zgv@Dg1vpBd}vruBde]Clxa$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cPSllGi9qBR=%wPRG[BzkVhb7h0H2)\u003e@HwNPaXAYLr!ss)0XA^7@jwmYp6nn\u0026M\u003ea$K\u003cqvqH6$iV]R\u0026v{%sezdK[xavxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*", "ln": 20972, "col": 101, "line": 259 }, { "b": "w[=3kzdK?-z!0i(xM4%lax8ipmK0mi3jd2=nm=juwPx*Ob3lA^z/Q5gA+5-(eL6/3BrSmUr://!wJy}Tz^^Zee]U\u0026Ha$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cT5z!-\u0026[Bvo?:v@DK4A^n^6pElg5q=l7eEjLZi342iOvpS}\u0026iV]RGeK\u003cV0CvtJ5wN)w-z/Z1AefE#4y\u0026%qIar\u003e-jB963Jx)a5iefEq*By/96A^oX*b2.ArmJ%xa", "ln": 21415, "col": 98, "line": 263 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejQIG4DQ}ZRwmY^xar\u003cY{w[u0]AW04Sr://!wJy}TxMOuniXJcvhArxBh8D{uhArxBh8D$5vru74Bt4GxByu+ivrt{ha$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cY{w[u0]AV!pVqBR^JzY?tEqY[!CBywY*Byuwwed8W\u0026DQ}ZRwmY^xar\u003cY{w[u0]AW04Sr://!wJy}TxMOuniXJcvhArxBh8D{uhArxBh8D$5vru74Bt4GxByu+ivrt{hx\u003c\u003e\u003ciB7F\u003c7A+PSveN@*jwmYU2x\u003c\u003e?0fcR}\u0026lT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]RAwObH]wPw[(q=l7cBz\u0026o/s5Qkkk$@E?A+e^5b7h0H2)\u003e@HwNPaXAYLr!qE%DKA+fnnefE#4y\u0026%qIar\u003eGvBz%n]fkUoxvpS!*vj(hhz!A($e[]iBwPzV%y+Gppze:StwLD-TvpS!*vj#^UfcR}\u0026lT+7Fxk.*oiV]RBq=l7eefEJ3Aa9l#iV]RAwObH]wPw[(q=l7cBz\u0026o(lR[[1wPRu\u003evrt{4EjLZi342iOvpS}\u0026iV]RAwObH]wPw$Caxz]!B.9PRb4#7uA5]T9f/z3AgbQ)vf/z3AgbQ)wzdN/$wmoN*fkj%dzGGPmC}T8AB-.pLflzbFwO%.vAa{[EwPz\u003caz/dY[fFLKsfFUjlf^Z{LB8Mhwv}v/pBAzFyiXJd6vqYH^wO(0@Bs}0FB-I4Cv@Diqa$K\u003c7vru6[z/Qa:ar\u003c-.qBR\u0026Yaw3A?vpKyuar\u003cY{w[u0]AV!pVqBR^JzY?t(B-I4orbVL-zx:GW3jd2=nm=juwPx*Ob2R#:wPzv5a$K\u003cqvqH6$iV]RWBAzE.fe4cWv{%g!z/Z1Yi50rCfjwydx(kaCavxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*qE%DKA+fnlq=uN-aARJAnP5SYA=br4avfKPx(kbyed8W\u0026DQ}ZRwmY^xar\u003cY{w[u0]AW04Sr://!wJy}TxMOuniXJcvgb**te?![jiYO(OfFvn", "ln": 21823, "col": 40, "line": 269 }, { "b": "b2R#:wPzv5ax8ipmJ=!\u003eaxz][y\u0026*^#wN/:(BAnTOed8W\u0026DQ}ZRwmY^xar\u003cY{w[u0]AW04Sr://!wJy}TxMOuniXJd4BZ!{5zE){3B1R0mw)]*#Bs}STv\u003eRnfx!KS:fk+inwPI*0v}xZmwmYvYB.(dMB7F\u003c4wPR#qefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob2R#:wPzv5ax8ipmJ=!\u003eawjXnax8\u0026YA+fulb7h0H3jd1(fcAzvjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejQIG4fe1CHwNYs\u003ez!?0[vqG:?vpK6}q=uN-aMv{oavf%=y?Wx/BzkVhaz+FiwPwa:2})}OjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV@", "ln": 22832, "col": 97, "line": 276 }, { "b": "x\u003ez6?vruj4zxIqPy\u00260M?v@0h=q=l7eEjLZi342iOvpS}\u0026iV]RGeMcd\u003cx(W={Bs*G\u003coD(2gr://!wJy}TxMOuniXJcvhArxBh8D{uhArxBh8D%gefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob2R#.x(W={BrBHXqBR\u003cUed8W\u0026DQ}ZRwmY^xar\u003ci+B98blvruj4zxZROr://!wJy}TxMOuniXJcvhArxBh8D{uhArxBh8D%gefEq*By/96A^oX*b2.ArmJ%xanO@z", "ln": 23584, "col": 97, "line": 284 }, { "b": "jV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejQIG4DQ}ZRwmY^xar\u003c]tmSir\u003evrb)\u0026wgZt\u003cB95PSaxz]!B.9PRb4+L9wJzE$fj/lnfk$uvB9zdsefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob1uo.wGT/\u0026z//]cz!{K{q=l7eEjLZi342iOvpS}\u0026iV]RGeK\u003cV0CvtJ5wN)w-z/Z1AefE#4y\u0026%qIar\u003eDpAa\u0026*6iXJcvgb**te?![jiYn=Miwj-hpdw26efEq*By/7", "ln": 24766, "col": 56, "line": 297 }, { "b": "qE%xMB0aL8x()]eq=uN-b7h0H2)\u003e@HwNPaXAYLr!ss()Gy\u00260M?v@0U@qCnn=axz]!B.9PRb4+L9wJzE$fk$@Iv\u003eR[my?ttizGY-mz/c:IavxNVwOk}4C@^5(q=uN-a$K\u003cdze-][BugJ*p\u0026ZF:avQf\u003ex(Xcfax8ipmK0mi3jd2=nm=juwPx*Ob3lA:vqG:?vpK78rz(HmefE#4y\u0026%qIar\u003eAiy?kTXfe4o+z^$CwwO+%iv@k:)x(mGaefEq*By/96A^oX*b2.ArmJ%xanO@APv@%:Ob2Aq#v\u003c1cQwnC%$wGT]IqBR\u003cUed8Z\u003c2})}OjV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}\u003ejV$}n2)\u0026l", "ln": 25468, "col": 118, "line": 303 } ], "depth": 1, "facts": { "imp": [ [ "", "github.com/cc1a2b/HHunter/engine" ] ], "funcs": [ [ "GetSSRFMutations", 60 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 0, "node_count": 8831, "max_array_len": 2 }, "file": { "size": 26834, "entropy": 5.27 }, "text": { "lines": 319, "top_char": 61, "tab_count": 552, "max_ws_run": 1, "digit_ratio": 0.07, "space_count": 2117, "char_entropy": 5.27, "unique_chars": 92, "top_char_null": 0, "lines_over_200": 1, "string_density": 2.49, "top_char_ratio": 0.09, "ascii_art_lines": 36, "avg_line_length": 83.12, "max_line_length": 205, "non_ascii_ratio": 0, "empty_line_ratio": 0.12, "last_line_length": 1, "long_token_count": 1, "whitespace_ratio": 0.11, "identifier_density": 2.5, "line_length_stddev": 44.07, "encoded_string_ratio": 0.01, "normalized_string_count": 44.4, "repeated_char_sequences": 36, "suspicious_string_ratio": 0, "suspicious_comment_ratio": 0.03, "normalized_unique_identifiers": 0.96 }, "binary": { "peak_region_bytes": 24786, "peak_region_entropy": 5.34 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "hex": 4, "bytes": 11980, "count": 793, "ip_count": 32, "url_count": 24, "avg_length": 15.11, "max_length": 115, "path_count": 35, "avg_entropy": 2.93, "email_count": 2, "domain_count": 4, "entropy_stddev": 0.95, "embedded_code_candidates": 2 }, "comments": { "chars": 3835, "count": 77, "lines": 77, "high_entropy": 2, "to_code_ratio": 0.32 }, "functions": { "count": 1, "density": 0.31, "code_ratio": 0.99, "over_100_lines": 1, "avg_name_length": 16, "no_params_count": 1, "avg_length_lines": 315, "max_length_lines": 315, "min_length_lines": 315, "high_entropy_names": 1 }, "identifiers": { "count": 798, "unique": 8, "avg_length": 7.75, "max_length": 16, "min_length": 5, "avg_entropy": 2.62, "reuse_ratio": 0.01, "length_stddev": 3.27, "high_entropy_count": 1, "high_entropy_ratio": 0.13, "all_lowercase_ratio": 0.25 } } }, "id": 41, "mol": "K(Te)O₂(DyEu)H₃(Cm₇F₂Os₂)Md₂(Pa)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/ssrf.go", "pid": 0, "risk": 10, "sha": "a7fb20f3f740dba165dc36d6b87c019e6fb7e8cebd69024f3050cf980007d33f", "size": 26834, "traits": [ { "id": "metadata/file/string/cloud::gcp-metadata-endpoint-go-source", "conf": 0.9, "crit": 3, "desc": "GCP metadata endpoint in Go source", "spans": [ [ 3689, 24 ] ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 389, 4 ] ] }, { "id": "micro-behaviors/communications/http/header/custom::x-forwarded-host", "conf": 0.9, "crit": 3, "desc": "X-Forwarded-Host proxy header", "spans": [ [ 333, 16 ] ] }, { "id": "micro-behaviors/communications/http/services/aws::ec2-imds-iam-credentials-endpoint", "conf": 0.9, "crit": 3, "desc": "EC2 instance-metadata IAM credentials endpoint", "spans": [ [ 22026, 57 ] ] }, { "id": "micro-behaviors/communications/http/services/azure-keyvault::resource-url", "conf": 0.9, "crit": 3, "desc": "Azure Key Vault resource URL", "spans": [ [ 5696, 87 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-endpoint-reference", "conf": 0.9, "crit": 3, "desc": "Google Cloud metadata host reference", "spans": [ [ 3689, 24 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-flavor-header", "conf": 0.9, "crit": 3, "desc": "Sends the GCP Metadata-Flavor request header", "spans": [ [ 3546, 15 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "spans": [ [ 24830, 11 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-environ", "conf": 0.92, "crit": 3, "desc": "References own process environment procfs path", "spans": [ [ 25532, 18 ] ] }, { "id": "micro-behaviors/os/container/namespace::k8s-apps-v1-str", "conf": 0.85, "crit": 3, "desc": "Kubernetes apps/v1 API", "spans": [ [ 10323, 12 ] ] }, { "id": "micro-behaviors/os/container/namespace::k8s-pods-v1-str", "conf": 0.85, "crit": 3, "desc": "Kubernetes pods API", "spans": [ [ 10117, 11 ] ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-container-list-path", "conf": 0.9, "crit": 3, "desc": "Docker Engine container-list API path", "spans": [ [ 11540, 22 ] ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-port-2375", "conf": 0.78, "crit": 1, "desc": "Docker unauthenticated API port", "spans": [ [ 11336, 0 ] ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-port-2376", "conf": 0.72, "crit": 1, "desc": "Docker TLS API port", "spans": [ [ 11445, 0 ] ] }, { "id": "micro-behaviors/os/container/runtime::kubernetes-near-node-target", "conf": 0.86, "crit": 1, "desc": "Kubernetes marker near node target", "spans": [ [ 9236, 0 ] ] }, { "id": "micro-behaviors/os/container/runtime::node-target-near-kubernetes", "conf": 0.86, "crit": 1, "desc": "Node target near Kubernetes marker", "spans": [ [ 9119, 0 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::interact-sh-pro-live", "conf": 0.85, "crit": 3, "desc": "interact.sh OOB service (pro/live)", "spans": [ [ 21479, 8 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "spans": [ [ 25, 32 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 25, 25 ] ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "spans": [ [ 360, 15 ] ] }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "spans": [ [ 22526, 16 ] ] }, { "id": "micro-behaviors/communications/http/services/aws::iam-credentials-path-reference", "conf": 0.7, "crit": 3, "desc": "AWS IAM credentials metadata path", "spans": [ [ 1314, 24 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 21887, 40 ], [ 22019, 65 ], [ 22177, 51 ], [ 22320, 53 ], [ 22896, 63 ], [ 23648, 23 ] ] }, { "id": "micro-behaviors/communications/socket/port::loopback-endpoint-with-port", "conf": 0.9, "crit": 3, "desc": "Loopback socket endpoint with explicit port", "spans": [ [ 2985, 14 ], [ 10676, 14 ], [ 10946, 15 ], [ 11050, 15 ], [ 11327, 14 ], [ 11436, 14 ], [ 12012, 12 ], [ 12115, 13 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-cmdline", "conf": 0.66, "crit": 3, "desc": "References own command-line procfs path", "spans": [ [ 25645, 18 ] ] }, { "id": "objectives/discovery/cloud/metadata::go-aws-metadata-endpoints", "atk": "T1526", "conf": 0.94, "crit": 3, "desc": "Go AWS metadata endpoints", "spans": [ [ 21887, 40 ] ] }, { "id": "objectives/discovery/cloud/metadata::go-gcp-metadata-header", "atk": "T1526", "conf": 0.94, "crit": 3, "desc": "Go GCP metadata header", "spans": [ [ 3689, 318 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::burpcollaborator", "conf": 0.85, "crit": 3, "desc": "Burp Collaborator OOB service", "spans": [ [ 21036, 20 ] ] }, { "id": "micro-behaviors/os/container/namespace::k8s-api-paths", "conf": 0.85, "crit": 3, "desc": "Kubernetes API paths", "uses": [ 9, 10 ], "spans": [ [ 10117, 11 ], [ 10323, 12 ] ] }, { "id": "micro-behaviors/os/container/runtime::docker-remote-api-ports", "conf": 0.82, "crit": 3, "desc": "Docker remote API ports", "uses": [ 12, 13 ], "spans": [ [ 11336, 5 ], [ 11445, 5 ] ] }, { "id": "micro-behaviors/os/container/runtime::kubernetes-node-target-context", "conf": 0.9, "crit": 3, "desc": "References a Kubernetes node target", "uses": [ 14, 15 ], "spans": [ [ 9119, 25 ], [ 9236, 75 ] ] } ], "type": "go" }, { "id": 42, "mol": "K(Te)", "sha": "ffcf68caea9ae4b23c8aad41d8191719448ba86bd01c211d8a5396ec5d9d6564", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/headers/websocket.go", "risk": 1, "size": 2711, "type": "go", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]zddc@3jpG:AbP=sasEN6b4tXbx(tg52{J}#v@C)(zF7RqB8L}u3jd[*y**%23jd[*zfc%e2{K84a{[S2zE)]yxMOuna{[S2z/W9f2{KzjzGGPfwG?D/b6d\u003cDv@Dmda{[S2B98CpzFa2m3jd[#x(dA93jm7-xk8E3BZ=$kz/4dqv\u003e?yEvLpnyB-8qjAXz0wxk8l{a{[S2xk8E3BZ=$kz/4dqv\u003e?yEvLpnyB-8qjAXz9qvpS}\u0026B0p@u3jp@+AV/KpA=U@kzxI7+b6CT)f^l@iBA}?payPqhvr\u003esUvp%T7tu#q(A+PA73jpx/zET!qx=[)lA=LPlmR(HCB15kgBAh8kxdbhKB98CpzF78s3jg-:BAIRwaAITBx(mN8e\u003eQ4@zyu#GefDb/ar\u0026lwEf{r[B-7Xic$%!Nvrcx%C$8QUxlbHAq!p50C42ifwGV5oA+PA7diJhxA=k$vDKp6ex=]LYvq{f%zE+dBx!gxIvqH6$dgcx4wPS6nzxJ?hyY", "ln": 0, "col": 1, "line": 1 }, { "b": "wNPy%xDOAuayYncyZHFSB.2idarR^HarUciz!]:!A+e:0zxH5AarR!oz/oC033G)2x\u003ezSkarR^HvScg33jgr!y?$jparR^HayYncyZHHQfe1Csr8=Wpv@Dl%x\u003eINeve", "ln": 1065, "col": 4, "line": 71 }, { "b": "wIcF:Bw)40xj(3{zF8W^Byxo9z/fRsjS[AHvpS}\u0026B1P%]Bw)40xj(3{zF8W^Byxo9z/fR631X0!x(mGmm}D^lzFA-)BzkVho)7L^BzkVhB09Q*xK$Q.wPz\u0026Am}D^lzFA-)BzkVho)7L^BzkVhA%-j+zF9W3wIcF:Bw(aomOO2Evruj4zGu{-azts{wmY!5e\u003eoF{q=uN-o)7L^BzkVhA%-j+zF9W3wIcF:BvZs?lu#auA7$E%vruj4zGu{-azts{wmY!5e\u003eoF{nb", "ln": 2022, "col": 7, "line": 117 }, { "b": "3jgrXvp}h\u003eBAh8kxi5CYc)\u0026!xBzbP6efDcNa$K\u0026Xm[3x3efDccr8=WpzdN*5z!74v3jgrXvp}h\u003eBAh8kxi5CYc)\u0026!xBzbP6efDcNwPRQ7wfJMEb1C73a$K\u0026Xnk@K", "ln": 3196, "col": 85, "line": 139 }, { "b": "q/)4]zF90UAWSnAz/fVdzGF\u003c6AaHNyb4CZsefDbXefDc7z/fVdzGEEfD2Nsqw]zYjA+flkwPI@ovSb!5a$i\u003c9w]7)*e(M\u003ejx(mM:vr9+yA::e\u0026wPq\u003c7B95@Qb64aoa$K\u0026Xa$K\u0026XmRMWIay/tcByw)3x(mMaA::emnk@L+aAz4kB.bSoasGN0A=rc", "ln": 3435, "col": 7, "line": 144 }, { "b": "lt{^Ur:*1%ctvvjwN/*@z/d9Gb57}fwN/*@z/c:Iazb4#B7D)Bb2\u0026b{BrCmdvpS}\u0026azC.dwN/*@z/cWCsw@cHax8irnH$#Tz!y[9xK#0@efE\u003e*oLC}1dgcw[y**%elt{^Ur:*1%cuBlGw?k5GB8#wla$K\u003cGvqH0@efDcowPI@oq=uN-aA?Ecazts{wmY^7zddr@Ack#9BzkVha$i\u003c9w]7)*e\u003c:F{y/T$+c)\u0026RCAaj9az/vlIb4$[lvThT9A3u?Qw)]H%wH[@FraQb)aztXjeN\u0026#SxM4\u0026jxK$Q.wPw]4vS=:6a$i\u003c9w]7)*e\u003c:F{y/T$+c)\u0026$yBy/o5ze18y", "ln": 4248, "col": 7, "line": 158 }, { "b": "vp}h\u003eBAh8kxi5CYc)\u0026[Nz*lLcqCnR:b5?NvCZg(-A+({Jar\u00260Xar\u003cuQr8sYRA=lhFaxqrkasH!Nxd+.TxMOuniXJcvgb**te?![jiYF/MfEXg{3jgrXvp}h\u003eBAh8kxi5CYc)\u0026\u003ePBz#wAefDcPa$K\u0026Xa$K\u0026XpJZ+#B-X:rx(4u6c}WAlpamwo3jgrXvp}h\u003eBAh8kxi5CYc)\u0026\u003ePBz#wAefDcPB-.OBBrSmUa%FMXb2ru6AclmBw[=6)asG\u0026XpFJt.dgcw[", "ln": 6408, "col": 4, "line": 185 }, { "b": "B98CpzF77uwIdQFefFgwB7GAlx(v(LvpA.3gbz0mBz\u003e@azASk\u0026Dr.Tya$i\u003c9w]7)*e(M\u003ejx(mM:vr9+yv@Dp3x\u003epj+AX5sSv@Dp3x\u003equfefDbXefDc7z/oA9wGV5oAS", "ln": 7221, "col": 46, "line": 196 }, { "b": "c)\u0026\u003eJvPur1efDcPz^\u003eqvA+({Jar\u00260Xar\u003cm0By/GgvqE5^qCniBz/M%@pElglvqG:?vpK7]asH!Nxd+.TxMOuniXJdiz/{7LC5RH-i5\u0026(SdiZhF31!0Zxd=+[Bxh*\u003cc)\u0026\u003eJvPM#LBsXKUz/o8pCvtica$K\u0026\u003efF1s\u003cq!oDSzE^/hBz\u0026pCvqf*aw]zYjpFTq1v{%g\u0026vQS+ZB0a[6By/FnB7nS@a$i\u003ca2})}Oo\u003c@cNxK#j9fgGU(By/Gl3jgrXvp}h\u003eBAh6", "ln": 7736, "col": 16, "line": 204 }, { "b": "34ic/2})}OnmuyDy?j-fvrS\u0026mwPq\u003c7B95Kpx(4t/33G-$aAy[mlt{yWax@bXD30Q8329#]A::e\u0026wPq\u003c7B95JFjS\u003e{)aBsC4336D#l$7gCefFIAAV^zaaA8rNqE%oEmRMWIc#@:uqE%\u0026\u003cwPI@x3jd2Mw/$V9AV=I*az$[faBsC42)\u003eiXBs{ygx(n38c)z[IgC-k?j2nQdtszB/pF$F6fF+H?fL}}4vqfK?wft#jaAz44wft]3Coy{qADL\u0026l", "ln": 11109, "col": 1, "line": 327 }, { "b": "wO${[wGV5oA+PA7diH3yu2$adx(mMmaz2Olz/NoHDKp6\u003ex(4uiaz2OlauzUdz/WKbAaJ]nw[=6)zEEx[dgcw}w/$V9AV=I*az$[faBsC4336Q0B-IvxzFr]raz2Ol3jha/31NQVwPw]9x(4uklU{WZwHF#m3jg(:AV/HBy\u0026Z.6u2$adx(mL\u003c33fP+zF\u003c1", "ln": 16741, "col": 26, "line": 547 }, { "b": "x(c^/vpJ\u003c%Aa9^edgcv/x\u003ewF$z!9Agaz2OlauzUdB98Cjz/f.Jl3d3Vc#-QnBsxo]wPz/ljV%{9x(1]s3jd1Bv@C)?B09Q*vq{f%zE+e9z!9B2efFCvwmWg%2)(1!34ic!A+fun", "ln": 17256, "col": 20, "line": 571 }, { "b": "raQq@efDcwfF+H?fL@0.3vJl*w{503azkncr+lq)x(v(/ByxolB0@EWB98CpzF78s3jgiUx\u003eqg7auzUdctmHyA4TH]x\u003eqg7DSjY@wP8ZkiV{j3dJ\u0026?EzdLs#wN/T@wpj^\u003eA+frhefFIAAV^zaay/k4wO#Pxm}D=\u003cb4#7uAc15[fjw*le[X)uxMW=pv@DiqA+fidB1.3kf\u003c#?DfgXSRzGGDgflgSuwNPT\u003eB1.urBy/Jna$i\u003c9x\u003ewG0A=JoCjS[SRy-[6i2)\u003eS-BAIRwar\u003c*6yI[6mzxYz]Ef{o\u003ewObH]aAz4mA4TE}wo/^{y\u0026sxac[bGg329#]A+frhe(M\u003e2BAIT(z!9A4aW3@6fFBR@3jd2VwPS6nzxHc6zFKcdCwXPi34ic/31v*-C}p7HA=Jo-jS[DSe(Dm?wi\u003e3Fc#@)uA4TE}wo/Qh329#]wPz/laW3@=x(1]s3jd2VwPS6nzxHc6zFKcdCwXPi34ic/33G-$aAz4fwNPT\u003eaAITBBZ]IoDKp5=rafAmvqPM#B98CpzF781yiarhiWeVOxj2K+zdK]03jha/3jgAUaz2OlauzUdyiarhe(=!avrcB5vqEu3z!abAasqbuy?m3@wHPX-wPz/laW3@=x(1]s3jd2VwPS6nzxHc6zFKcdCwXPi34ic/329#]A+f5#vrl0jrafAmvqPM#jV%{hwPz\u003caz/cXA3jd2VwPS6nzxHctvru74BrR4#Ef{p3wPS6nzxHcwB-.e5By!#b3vI", "ln": 19022, "col": 32, "line": 635 }, { "b": "B7]@iavojgmn\u003erKarR^HarR^HarTD$y\u003cvdxA=kD0B8@EAwPI*ezGxxgaA7\u003cmBzbxfaAImywG\u0026Mg31!3@e(lO5zGGYjc)x=ReIgNGy\u0026\u003cleePUSLwGTrxr7f.darR^HarR^HarT9$v@co#wGV28B8V5nB7Gznz!pblxLzJgB7]@ia$i\u003c9w]hSxp\u0026Zn/", "ln": 24539, "col": 25, "line": 746 }, { "b": "B-8qjAV=@Razt\u003esAc15[fjw*le{7JxxjVfqv@DiqvpTj?zxHI.vrDW9at2fWCxt2T3jgrYBs{ygx(n3ezyu}v31!3@e(lO5zGGYjc)x=RboPD#y?$kjw[CQ(B7]/eaAI43zxKdqBz8^)pElgmwPRG[BzkVha$i\u003c9w]hSxp\u0026Zn/BzL?ya%n1wxMXimwPw[BBS+vtBz#pZfe4AQA+w%9e[n*pfjw*lat2fSB.\u003e\u003epeIg)VvJWlOz/o8pB-IpvxMOuniXJdfAc161i5\u0026(uePh+LwPJ0gBAo6HB8L}udgcw[zfdybA+PAky\u0026gTI3jgrYBs{ygx(n3ezyuXKar@16B.(eleP+AwxjVfcB7nS@azbUjz6iC8y?j-kx([2hnk@qSaAz4jz/P}zdgcw[zfdybA+PAky\u0026gTBarUuhB-8qjAV=@IaA.ZvB1RMV", "ln": 25244, "col": 19, "line": 761 }, { "b": "31!3@e(lO5zGGYjc)x=RboP{bwNPy%xDRwavqWiix([2hs3Yp#wP?H6x(v(ivqYP#w[=76wPz\u0026odgcw[zfdybA+PAky\u0026gTBarUuhB-8qjAV=@Razt\u003esAc15[flySyxjVfqv@DibeIgNSy?$jCeQ7SneOf9lB7]Mgat2f^By!(%Bz8^Gw]/7KfF+l", "ln": 26129, "col": 1, "line": 778 }, { "b": "w[=c[x(mN8djCPh31!9@azAwHw[=c[x(mMaiZ1QavqYZ?azbt9wnb{]B0b/p2)\u003eiXBs{ygx(n3ezyuYlfF+H?fGR6Dz6y8MaAITBx(mN8e(Dn1wNPWeb3YmCh83ZdefD\u00268diHb-b3V/TgG#LIa$i\u003c931!3@e(lO5zGGFsb3V/TgG#K{gCJ-JaZFtbgC-k?z6hqZzE^E0xcnABwl:0@efFTSf!0Co31!3@e(lO5zGGFsa%n1kfF+H?fGR6Gz2", "ln": 26712, "col": 105, "line": 793 }, { "b": "31!3@e(lO5zGGFsa%n1kfF+H?fGR6Gzb$7=x\u003c\u003e[3B6HyPgG#LIiV]K/ash7KAaa3dz^^f$aARTrxj\u003e^@aARphB6JPbefFLszE^E0xd=R@x\u003eg^)v}w\u003c*Bz(nfy*Ru]A+O%1BAnTidgcv/Ef{q/329#]w[=c[x(mMolSNb:au*]4aBsC42)\u003eiXBs{ygx(n38c)x=RtRE@\u0026", "ln": 27804, "col": 3, "line": 815 }, { "b": "B14C5329#]vrD9{Bw=W\u003eB.(dLlR*PUl2HaED2)Xve()ahzE)\u0026%vR/P#DKp5=31!3@e(lO5zGGFsa%n0Jay3PRgG#K{gCJ-ErzldRqB9SymlhLqB6HyPgG#LItY7-payPz6x()l:", "ln": 32881, "col": 85, "line": 955 }, { "b": "gG#K{gC\u0026@MnLR-Ju0G6tgG#LIavx*Nv@2^@xcp/8AV/HzwmoN\u003eB1P6$tY7-m3jm8WwPI/waz2OlauzUdxMOune\u003eoF{c)AtDBz#pZfe3:Mx!B4jBzb/ae[n*pflgSyz/WNwv\u003e?yEvLpnyB-8qjAXzDAy?m3@wPGIvvru74BrSdv329#]wPz/laW3@=x(1]s3jd2JzfdybA+PAkw*!\u003cdfF+H?fGR6BzcGCbqCQg@tRE@\u0026tqf[pmQZ1EwN({9", "ln": 34439, "col": 17, "line": 1017 }, { "b": "tRE@\u0026tqeb{ghQk!pdw2+tRE@\u0026tqf[ps-nB9vrb{4vqG%}vpTTaA=(nqx(mMaBzbkdy*?A%B95KFwPz\u003caz/dPUc39sea$K\u003cWwPz\u003caz/d0h2)\u003eS-BAIRw3jha/3jgrYBs{ygx(n38c)z[IgC-k?j2nWfts?NVpHdiVgC-k?z6hO+Coz6uA=U@kzxJu", "ln": 35611, "col": 15, "line": 1053 }, { "b": "vqPNbaA?spB7]Mgdgcy*C42zlwn=Wfy\u0026r-)rz(HkB98CpzF6p.xk.ZfauzUdA=(nwx(dAlm]8]V3jgu-vrb\u003c\u003eauzUdA=(nwx(dAlm]8AGlR4K\u003e31!9@ayuVxvrlH3BrARcaAy[dxjSiawO+{^B7D%\u0026B8$]mB0b/p2)\u003erTaAITBx(mN8e\u003c\u003cL{Byw)3B0$ErB7GCCpgn0JefFOzz/WuIcmf\u003cRBAh8kxlbW)z/b", "ln": 35801, "col": 94, "line": 1057 }, { "b": "A+eV\u0026ayY55vrcSowmoN*iV].(tY7-paz2Oldgcv/A+funA=8i\u003cEf{q/v%8*jwO#P^vruflaz2OlauzUdz/WK1CX7xcBywS{wHF#m329#]wPz/laW3@=x(1]s3jd2JzfdybA+PAkw*!\u003cdfF+H?fGR6BzcGCbqCQg@tRE@\u0026tqf[pmQZ1EwN({9zY\u0026X7BrC7oA=L-eBrCdtwN/\u003e8vpB4:aAg+hxGvmZC3F]eefFIAAW.t4336Q0B-Ivb34ic/31vsMyJTO)vruf9iZ1P}B-IIlzGFY-Bz8^Ear\u0026BEvpK7}A3tR}x\u003ewG0A=Jo-jS[V:e(Dm#vqPN7v%8*jwO#P^vruflayX+?yJTO)vrufij0n9PAV=I*az$[faBsC431!3@e(lO5zGGFsb3V/TgG#K{gCJ-Jmn^2VqE9JYgC-k?z6hqRx(4u\u003eaARJAv@=c?By=O7vpK7}A5]9/C3F]eefFIAAW.t4336Q0B-Ivb34ic/329#]wPz/liZ1Q7B1QKmx()]Qx(4uev%8*jwO#P^vruflayY55vrcSYvrt{eatt-ih7pQfwPz/laW3@=x(1]s3jd2JzfdybA+PAkw*!\u003cdfF+H?fGR6BzcGCbqCQg@tRE@\u0026tqf[pmQZ1EwN({9zY\u003cmAx()]ezE[2mvRGZ*A^oX*c3AKha$K\u003cFA=JPo2)\u003eJ\u003ee(Dm#vqPN7vQS+ZB-pe=Bz9iFv%8*jwO#P^vrufi3jd2VwPS6nzvcX#3jm8TB1Qv4zeTPec$lQ{yJTO)vrufi3jm8KzfdybA+PAkw*!\u003cdfF+H?fGR6CzcG}slQKpvq^ASZgC-k?z6h=1v}f7\u003eB7PMhy\u003cvdCAaAy0wN({9zY*uEaZw[eefF$Ay?m3@wIc}\u003cxhh(LwHN@)w]hSxp\u0026Zn/By({BtRE@\u0026tqeb{g\u0026lC*", "ln": 37214, "col": 50, "line": 1112 } ], "depth": 1, "facts": { "imp": [ [ "", "strings.Join" ], [ "", "append" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.BoolVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.IntVar" ], [ "", "flag.IntVar" ], [ "", "flag.IntVar" ], [ "", "flag.IntVar" ], [ "", "flag.IntVar" ], [ "", "flag.IntVar" ], [ "", "flag.Var" ], [ "", "flag.Var" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.BoolVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.IntVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.Int64Var" ], [ "", "flag.Int64Var" ], [ "", "flag.StringVar" ], [ "", "flag.StringVar" ], [ "", "flag.Parse" ], [ "", "printBanner" ], [ "", "printHelp" ], [ "", "os.Exit" ], [ "", "printBanner" ], [ "", "updateTool" ], [ "", "collectTargetURLs" ], [ "", "len" ], [ "", "printBanner" ], [ "", "printHelp" ], [ "", "os.Exit" ], [ "", "printBanner" ], [ "", "fmt.Println" ], [ "", "make" ], [ "", "strings.SplitN" ], [ "", "len" ], [ "", "strings.TrimSpace" ], [ "", "strings.TrimSpace" ], [ "", "parseStatusCodes" ], [ "", "parseStatusCodes" ], [ "", "engine.NewOOBServer" ], [ "", "oobServer.Start" ], [ "", "fmt.Printf" ], [ "", "os.Exit" ], [ "", "oobServer.Stop" ], [ "", "os.ReadFile" ], [ "", "fmt.Printf" ], [ "", "os.Exit" ], [ "", "engine.ParseRawRequest" ], [ "", "string" ], [ "", "strings.HasPrefix" ], [ "", "fmt.Printf" ], [ "", "os.Exit" ], [ "", "len" ], [ "", "len" ], [ "", "strings.Contains" ], [ "", "string" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "fmt.Println" ], [ "", "strings.Repeat" ], [ "", "time.Duration" ], [ "", "time.Duration" ], [ "", "engine.NewOrchestrator" ], [ "", "orchestrator.Scan" ], [ "", "fmt.Printf" ], [ "", "append" ], [ "", "printReconSummary" ], [ "", "printFindings" ], [ "", "printStats" ], [ "", "printSecurityAudit" ], [ "", "len" ], [ "", "len" ], [ "", "saveResults" ], [ "", "saveMultiResults" ], [ "", "len" ], [ "", "combineResults" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "engine.GenerateHTMLReport" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "combineResults" ], [ "", "len" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "engine.GenerateSARIF" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "os.Exit" ], [ "", "append" ], [ "", "readURLsFromFile" ], [ "", "fmt.Printf" ], [ "", "os.Exit" ], [ "", "append" ], [ "", "os.Stdin.Stat" ], [ "", "stat.Mode" ], [ "", "bufio.NewScanner" ], [ "", "scanner.Scan" ], [ "", "strings.TrimSpace" ], [ "", "scanner.Text" ], [ "", "strings.HasPrefix" ], [ "", "strings.HasPrefix" ], [ "", "append" ], [ "", "make" ], [ "", "append" ], [ "", "os.Open" ], [ "", "file.Close" ], [ "", "bufio.NewScanner" ], [ "", "scanner.Scan" ], [ "", "strings.TrimSpace" ], [ "", "scanner.Text" ], [ "", "strings.HasPrefix" ], [ "", "append" ], [ "", "scanner.Err" ], [ "", "strings.Split" ], [ "", "strings.TrimSpace" ], [ "", "strconv.Atoi" ], [ "", "append" ], [ "", "len" ], [ "", "append" ], [ "", "getVersionStatus" ], [ "", "fmt.Printf" ], [ "", "client.Get" ], [ "", "resp.Body.Close" ], [ "", "io.ReadAll" ], [ "", "json.Unmarshal" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "strings.Repeat" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "truncateStr" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "getSeverityColor" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "truncateStr" ], [ "", "fmt.Printf" ], [ "", "strings.Repeat" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "fmt.Printf" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "append" ], [ "", "fmt.Sprintf" ], [ "", "strings.Join" ], [ "", "stats.Duration.Round" ], [ "", "strings.Repeat" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "len" ], [ "", "strings.Join" ], [ "", "strings.Repeat" ], [ "", "strings.Repeat" ], [ "", "len" ], [ "", "len" ], [ "", "len" ], [ "", "getSeverityColor" ], [ "", "len" ], [ "", "len" ], [ "", "getSeverityColor" ], [ "", "strings.Repeat" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Sprintf" ], [ "", "fmt.Sprintf" ], [ "", "len" ], [ "", "pr.reader.Read" ], [ "", "int64" ], [ "", "time.Since" ], [ "", "float64" ], [ "", "float64" ], [ "", "int" ], [ "", "float64" ], [ "", "strings.Repeat" ], [ "", "strings.Repeat" ], [ "", "int" ], [ "", "float64" ], [ "", "float64" ], [ "", "time.Now" ], [ "", "http.Get" ], [ "", "resp.Body.Close" ], [ "", "io.ReadAll" ], [ "", "json.Unmarshal" ], [ "", "strings.Contains" ], [ "", "strings.Contains" ], [ "", "strings.HasPrefix" ], [ "", "http.Get" ], [ "", "resp.Body.Close" ], [ "", "io.ReadAll" ], [ "", "io.ReadAll" ], [ "", "os.Executable" ], [ "", "os.Rename" ], [ "", "os.WriteFile" ], [ "", "os.Rename" ], [ "", "os.Remove" ], [ "", "json.MarshalIndent" ], [ "", "os.WriteFile" ], [ "", "json.MarshalIndent" ], [ "", "os.WriteFile" ], [ "", "len" ], [ "", "bufio" ], [ "", "encoding/json" ], [ "", "flag" ], [ "", "fmt" ], [ "", "github.com/cc1a2b/HHunter/engine" ], [ "", "github.com/cc1a2b/HHunter/headers" ], [ "", "io" ], [ "", "net/http" ], [ "", "os" ], [ "", "runtime" ], [ "", "strconv" ], [ "", "strings" ], [ "", "time" ] ], "mbr": [ "asset.BrowserDownloadURL", "asset.Name", "auditResult.CORSAnalysis", "auditResult.CORSAnalysis.AllowCredentials", "auditResult.CORSAnalysis.AllowOrigin", "auditResult.CORSAnalysis.Details", "auditResult.CORSAnalysis.Vulnerable", "auditResult.InformationLeaks", "auditResult.MissingHeaders", "auditResult.ServerInfo", "auditResult.TechFingerprints", "auditResult.WAFDetected", "bufio.NewScanner", "client.Get", "combined.Findings", "combined.Recon", "combined.SecurityAudit", "combined.Stats", "combined.Stats.Critical", "combined.Stats.Duration", "combined.Stats.High", "combined.Stats.Info", "combined.Stats.Low", "combined.Stats.Medium", "combined.Stats.OOBConfirmed", "combined.Stats.ReconRequests", "combined.Stats.TotalFindings", "combined.Stats.TotalMutations", "combined.Stats.VerifiedFindings", "engine.GenerateHTMLReport", "engine.GenerateSARIF", "engine.GetAuthMutations", "engine.GetCORSMutations", "engine.GetCRLFMutations", "engine.GetCacheMutations", "engine.GetCloudMutations", "engine.GetContentTypeMutations", "engine.GetCookieMutations", "engine.GetDebugMutations", "engine.GetEncodingMutations", "engine.GetGatewayMutations", "engine.GetHopByHopMutations", "engine.GetInjectionMutations", "engine.GetJWTMutations", "engine.GetOverrideMutations", "engine.GetProtocolMutations", "engine.GetProxyMutations", "engine.GetRateLimitMutations", "engine.GetRedirectMutations", "engine.GetSSRFMutations", "engine.GetSecurityMutations", "engine.GetSmugglingMutations", "engine.GetWebSocketMutations", "engine.NewOOBServer", "engine.NewOrchestrator", "engine.ParseRawRequest", "file.Close", "finding.CVSS", "finding.CWE", "finding.Category", "finding.Confidence", "finding.ConfidenceScore", "finding.Evidence", "finding.Evidence.oob_confirmed", "finding.Evidence.total_variants", "finding.Header", "finding.Impact", "finding.Payload", "finding.ReconSource", "finding.Remediation", "finding.Severity", "finding.Verified", "flag.BoolVar", "flag.Int64Var", "flag.IntVar", "flag.Parse", "flag.StringVar", "flag.Var", "fmt.Printf", "fmt.Println", "fmt.Sprintf", "fp.Confidence", "fp.Technology", "fp.Version", "headerMap.Cookie", "headers.GetAuthMutations", "headers.GetCORSMutations", "headers.GetCRLFMutations", "headers.GetCacheMutations", "headers.GetCloudMutations", "headers.GetContentTypeMutations", "headers.GetCookieMutations", "headers.GetDebugMutations", "headers.GetEncodingMutations", "headers.GetGatewayMutations", "headers.GetHopByHopMutations", "headers.GetInjectionMutations", "headers.GetJWTMutations", "headers.GetOverrideMutations", "headers.GetProtocolMutations", "headers.GetProxyMutations", "headers.GetRateLimitMutations", "headers.GetRedirectMutations", "headers.GetSSRFMutations", "headers.GetSecurityMutations", "headers.GetSmugglingMutations", "headers.GetWebSocketMutations", "http.Get", "io.ReadAll", "json.MarshalIndent", "json.Unmarshal", "leak.Header", "leak.Severity", "leak.Type", "leak.Value", "mh.Header", "mh.Impact", "mh.Remediation", "mh.Severity", "oobServer.Start", "oobServer.Stop", "orchestrator.Scan", "os.Executable", "os.Exit", "os.ModeCharDevice", "os.Open", "os.ReadFile", "os.Remove", "os.Rename", "os.Stdin", "os.Stdin.Stat", "os.WriteFile", "pr.current", "pr.lastUpdate", "pr.reader", "pr.reader.Read", "pr.total", "r.Findings", "r.Recon", "r.SecurityAudit", "r.Stats", "r.Stats.Critical", "r.Stats.Duration", "r.Stats.High", "r.Stats.Info", "r.Stats.Low", "r.Stats.Medium", "r.Stats.OOBConfirmed", "r.Stats.ReconRequests", "r.Stats.TotalFindings", "r.Stats.TotalMutations", "r.Stats.VerifiedFindings", "rc.Body", "rc.Headers", "rc.Method", "rc.URL", "recon.AllowedMethods", "recon.DangerousMethods", "recon.HostInjectable", "recon.ReflectedHeaders", "recon.TraceEnabled", "recon.VerbTamperBypasses", "release.Assets", "release.TagName", "resp.Body", "resp.Body.Close", "resp.ContentLength", "resp.StatusCode", "result.Findings", "result.Recon", "result.SecurityAudit", "result.Stats", "runtime.GOARCH", "runtime.GOOS", "scanner.Err", "scanner.Scan", "scanner.Text", "stat.Mode", "stats.ChainsTested", "stats.Critical", "stats.Duration", "stats.Duration.Round", "stats.High", "stats.Info", "stats.Low", "stats.Medium", "stats.OOBConfirmed", "stats.ReconRequests", "stats.TotalFindings", "stats.TotalMutations", "stats.VerifiedFindings", "strconv.Atoi", "strings.Contains", "strings.HasPrefix", "strings.Join", "strings.Repeat", "strings.Split", "strings.SplitN", "strings.TrimSpace", "time.Duration", "time.Millisecond", "time.Now", "time.Second", "time.Since" ], "tgt": [ "append", "bufio.NewScanner", "client.Get", "collectTargetURLs", "combineResults", "engine.GenerateHTMLReport", "engine.GenerateSARIF", "engine.NewOOBServer", "engine.NewOrchestrator", "engine.ParseRawRequest", "file.Close", "flag.BoolVar", "flag.Int64Var", "flag.IntVar", "flag.Parse", "flag.StringVar", "flag.Var", "float64", "fmt.Printf", "fmt.Println", "fmt.Sprintf", "getSeverityColor", "getVersionStatus", "http.Get", "int", "int64", "io.ReadAll", "json.MarshalIndent", "json.Unmarshal", "len", "make", "oobServer.Start", "oobServer.Stop", "orchestrator.Scan", "os.Executable", "os.Exit", "os.Open", "os.ReadFile", "os.Remove", "os.Rename", "os.Stdin.Stat", "os.WriteFile", "parseStatusCodes", "pr.reader.Read", "printBanner", "printFindings", "printHelp", "printReconSummary", "printSecurityAudit", "printStats", "readURLsFromFile", "resp.Body.Close", "saveMultiResults", "saveResults", "scanner.Err", "scanner.Scan", "scanner.Text", "stat.Mode", "stats.Duration.Round", "strconv.Atoi", "string", "strings.Contains", "strings.HasPrefix", "strings.Join", "strings.Repeat", "strings.Split", "strings.SplitN", "strings.TrimSpace", "time.Duration", "time.Now", "time.Since", "truncateStr", "updateTool" ], "funcs": [ [ "String", 254 ], [ "Set", 327 ], [ "init", 1622 ], [ "main", 2901 ], [ "collectTargetURLs", 15817 ], [ "readURLsFromFile", 16716 ], [ "parseStatusCodes", 17104 ], [ "combineResults", 17376 ], [ "printBanner", 18403 ], [ "getVersionStatus", 19042 ], [ "printHelp", 19622 ], [ "printFindings", 26422 ], [ "printStats", 28597 ], [ "printReconSummary", 29989 ], [ "printSecurityAudit", 31148 ], [ "getSeverityColor", 33097 ], [ "truncateStr", 33511 ], [ "Read", 33738 ], [ "updateTool", 34403 ], [ "saveResults", 37998 ], [ "saveMultiResults", 38451 ] ], "metrics": { "ast": { "op.eq": 22, "op.gt": 33, "op.le": 1, "op.ne": 49, "op.add": 31, "op.div": 3, "op.lor": 5, "op.mul": 12, "op.sub": 1, "op.band": 81, "op.land": 31, "op.lnot": 25, "max_depth": 28, "call_count": 458, "node_count": 11588, "member_count": 204, "max_array_len": 2, "op_density.eq": 0, "op_density.gt": 0, "op_density.le": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.band": 0.01, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 3, "self_compare_count": 2 }, "file": { "size": 38939, "entropy": 5.26 }, "text": { "lines": 1168, "top_char": 116, "tab_count": 1524, "max_ws_run": 25, "digit_ratio": 0.05, "space_count": 4905, "char_entropy": 5.26, "mixed_indent": 1, "unique_chars": 91, "top_char_null": 0, "escape_density": 0.5, "string_density": 0.4, "top_char_ratio": 0.06, "ascii_art_lines": 1, "avg_line_length": 32.34, "max_line_length": 139, "empty_line_ratio": 0.12, "last_line_length": 1, "whitespace_ratio": 0.2, "identifier_density": 1.85, "line_length_stddev": 30.36, "octal_escape_count": 188, "unicode_escape_count": 6, "normalized_string_count": 13.84, "repeated_char_sequences": 75, "suspicious_string_ratio": 0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 35.72 }, "binary": { "peak_region_bytes": 27648, "peak_region_entropy": 5.35 }, "source": { "class_count": 1, "function_count": 21 }, "imports": { "count": 13, "stdlib_count": 11, "stdlib_ratio": 0.85, "third_party_count": 2, "third_party_ratio": 0.15 }, "strings": { "sql": 1, "bytes": 13298, "count": 473, "url_count": 4, "avg_length": 28.11, "max_length": 246, "avg_entropy": 3.14, "empty_count": 44, "entropy_stddev": 1.19, "embedded_code_candidates": 1 }, "comments": { "chars": 763, "count": 40, "lines": 40, "to_code_ratio": 0.04 }, "functions": { "count": 22, "density": 1.8, "avg_params": 0.76, "code_ratio": 0.89, "max_params": 2, "length_stddev": 77.68, "over_100_lines": 3, "avg_name_length": 11.52, "no_params_count": 8, "avg_length_lines": 49.57, "max_length_lines": 368, "min_length_lines": 3, "high_entropy_names": 4, "single_char_params": 3, "avg_param_name_length": 5.81 }, "identifiers": { "count": 2165, "unique": 364, "avg_length": 8.36, "max_length": 23, "min_length": 1, "avg_entropy": 2.54, "reuse_ratio": 0.17, "length_stddev": 4.55, "has_digit_ratio": 0.01, "sequential_names": 9, "base64_like_names": 1, "single_char_count": 10, "single_char_ratio": 0.03, "high_entropy_count": 29, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.3, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 2, "underscore_prefix_count": 1 } } }, "id": 43, "mol": "K(Te)H₄(Cm₆DbF₃Po)Md(Pa)", "path": "github.com-cc1a2b-hhunter-v0.1.1.zip!!github.com/cc1a2b/hhunter@v0.1.1/main.go", "pid": 0, "risk": 7, "sha": "62c757a6ba04d75951afc4e2daa7d231892e5751fa186671be84aad33efc5bcd", "size": 38939, "traits": [ { "id": "metadata/package/testing/corpus::sqli-category-label", "conf": 0.9, "crit": 3, "desc": "SQL injection category label", "spans": [ [ 4334, 4 ] ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 4384, 4 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 4312, 3 ] ] }, { "id": "micro-behaviors/communications/http/url/build::go-read-http-response-body", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Go reads an HTTP response body", "spans": [ [ 19344, 21 ] ] }, { "id": "micro-behaviors/data/serialize/json::go-json-unmarshal", "mbc": "C0032", "conf": 0.85, "crit": 3, "desc": "Go JSON unmarshal call", "spans": [ [ 19478, 14 ] ] }, { "id": "micro-behaviors/fs/file/delete::os-Remove", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Delete file (os.Remove)", "spans": [ [ 37801, 9 ] ] }, { "id": "micro-behaviors/fs/file/rename::go-os-rename", "conf": 0.94, "crit": 3, "desc": "Go renames a file with os.Rename", "spans": [ [ 37464, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::go-os-writefile", "conf": 0.9, "crit": 3, "desc": "Go writes data with os.WriteFile", "spans": [ [ 37613, 12 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::os-write-file", "conf": 0.8, "crit": 3, "desc": "Write file via os.WriteFile", "spans": [ [ 37613, 12 ] ] }, { "id": "micro-behaviors/process/info/selfpath::os-executable", "conf": 0.7, "crit": 3, "desc": "Go queries own executable path", "spans": [ [ 37278, 13 ] ] }, { "id": "objectives/command-and-control/trigger/activation::trigger-keyword-lower-prefix", "conf": 0.3, "crit": 1, "desc": "trigger keyword (lowercase prefix)", "spans": [ [ 27852, 0 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-engine-import", "conf": 0.98, "crit": 3, "desc": "Imports HHunter engine package", "spans": [ [ 132, 32 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-injection-mutations-fn", "conf": 0.98, "crit": 3, "desc": "HHunter GetInjectionMutations function", "spans": [ [ 2086, 21 ] ] }, { "id": "well-known/tool/offensive/hhunter::hhunter-module-path", "conf": 0.98, "crit": 3, "desc": "HHunter Go module path", "spans": [ [ 132, 25 ] ] }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "spans": [ [ 6472, 16 ] ] }, { "id": "micro-behaviors/communications/http/get::http-get", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Go http.Get call", "spans": [ [ 34503, 8 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::go-http-client-construction", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Constructs a Go HTTP client", "spans": [ [ 19086, 13 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Go source imports the net/http standard package", "spans": [ [ 71, 8 ] ] }, { "id": "micro-behaviors/communications/http/services/github::github-release-api", "conf": 0.6, "crit": 3, "desc": "GitHub REST releases endpoint", "spans": [ [ 19159, 44 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 7800, 15 ], [ 25444, 10 ] ] }, { "id": "micro-behaviors/communications/url/external/github::github-release-api-latest", "atk": "T1105", "conf": 0.84, "crit": 3, "desc": "GitHub latest release API template", "spans": [ [ 19159, 51 ] ] }, { "id": "metadata/package/testing/corpus::injection-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple injection attack-category labels", "uses": [ 0, 2 ], "spans": [ [ 4312, 3 ], [ 4334, 4 ] ] } ], "type": "go" }, { "id": 44, "sha": "cd630af1d0b5badc1d7fcff0467266984c5c35cfeb1ff2fc1d5fec554858dfae", "path": "github.com_cc1a2b_hhunter@v0.1.1.registry.json", "size": 789, "type": "registry", "depth": 1 } ], "omitted_files": 28, "rev": "c7f7e", "v": "8" } }