class Maze

Defined in:

maze.cr

Constant Summary

SERVER_CHANNELS = ["query", "path", "body", "header", "cookie", "referer"] of ::String

Delivery channels a plain HTTP client can drive on its own. Anything else needs a real browser (or a driver) to place the payload.

VULN_CLASSES = ["unclassified", "reflected-html", "reflected-attr", "reflected-js", "dom", "stored", "prototype-pollution", "csti", "non-xss-control"] of ::String

Classification rule: classify by the injection context — where the bytes actually land — not by what the receiving API does with a well-formed argument. A value the server reflects raw into a JS string literal is reflected-js however inert the function it is passed to, because the breakout happens before that function is ever called. dom is for flows whose taint reaches a sink through client-side code (either from a client-side source, or from a server-reflected literal that a live DOM sink then executes without needing a breakout).

Closed set of #vuln values. "unclassified" is the default for endpoints that have not been triaged yet — deliberately distinct from "non-xss-control" so unreviewed and reviewed-as-safe never get conflated.

Constructors

Instance Method Summary

Constructor Detail

def self.new(name : String, url : String, desc : String, method : String = "GET", params : Array(String) = ["query"], vuln : String = "unclassified", sources : Array(String) = [] of String, sinks : Array(String) = [] of String, delivery : Array(String) = [] of String, exploitable : Bool = true, note : Nil | String = nil) #

[View source]

Instance Method Detail

def delivery : Array(String) #

Where the payload enters, e.g. "query", "fragment", "postmessage".


[View source]
def desc : String #

[View source]
def exploitable? : Bool #

False when the endpoint is a control / true negative.


[View source]
def method : String #

[View source]
def name : String #

[View source]
def note : String | Nil #

Free-form caveat: why it is a control, what interaction it needs, etc.


[View source]
def params : Array(String) #

[View source]
def reach : String #

"server" - the payload fits in the HTTP request (query/path/body/ header/cookie/referer), so a non-browser scanner can reach it. "client" - the payload only exists browser-side (fragment, postMessage, clipboard, drag-and-drop, window.name, ...); a request-only scanner cannot deliver it at all. "unknown" - not triaged.


[View source]
def sinks : Array(String) #

DOM taint sinks, e.g. "innerHTML", "eval", "location-nav", "srcdoc".


[View source]
def sources : Array(String) #

DOM taint sources, e.g. "location.hash", "postMessage", "localStorage".


[View source]
def to_json_object #

[View source]
def type : String #

Category, derived from the name prefix ("basic-level1" -> "basic"). Computed once: grouping, /map/json, /map/openapi and /stats each walk every maze, and the old split("-").first? allocated an array per call.


[View source]
def url : String #

[View source]
def vuln : String #

Vulnerability class; one of VULN_CLASSES.


[View source]