Skip to content

Rename GixyNG to Gixy-Next and use more stable URL #1730

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MegaManSec wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Rename GixyNG to Gixy-Next and use more stable URL #1730

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/network-services-pentesting/pentesting-web/nginx.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,7 +302,7 @@ The **`proxy_pass`** directive is utilized for redirecting requests to other ser
If the nginx server is configured to pass the Upgrade and Connection headers an [**h2c Smuggling attack**](../../pentesting-web/h2c-smuggling.md) could be performed to access protected/internal endpoints.

> [!CAUTION]
> This vulnerability would allow an attacker to **stablish a direct connection with the `proxy_pass` endpoint** (`http://backend:9999` in this case) that whose content is not going to be checked by nginx.
> This vulnerability would allow an attacker to **establish a direct connection with the `proxy_pass` endpoint** (`http://backend:9999` in this case) that whose content is not going to be checked by nginx.

Example of vulnerable configuration to steal `/flag` from [here](https://bishopfox.com/blog/h2c-smuggling-request):

Expand Down Expand Up @@ -387,9 +387,9 @@ Detectify has created a GitHub repository where you can use Docker to set up you

## Static Analyzer tools

### [GixyNG](https://github.com/megamansec/gixyng) & [GIXY](https://github.com/yandex/gixy)
### [Gixy-Next](https://gixy.io/) & [GIXY](https://github.com/yandex/gixy)

GixyNG (an updated fork of GIXY) is a tool to analyze Nginx configurations, with the goal of finding vulnerabilities, insecure directives, and risky misconfigurations. It also finds misconfigurations affecting performance, and detects missed hardening opportunities, allowing automated flaw detection.
Gixy-Next (an updated fork of GIXY) is a tool to analyze Nginx configurations, with the goal of finding vulnerabilities, insecure directives, and risky misconfigurations. It also finds misconfigurations affecting performance, and detects missed hardening opportunities, allowing automated flaw detection.

### [Nginxpwner](https://github.com/stark0de/nginxpwner)

Expand Down