Dastardly - free lightweight CI/CD DAST scanner from Burp Suite

Portswigger представили Dastardly - бесплатный DAST сканер веб уязвимостей, на базе того же scanning engine, который используется в Burp Suite Professional/Enterprise версиях.

Dastardly представляет собой docker контейнер, который можно легко интегрировать в любой CI/CD пайплайн или пайплан автоматизированного сканирования или просто использовать как отдельный инструмент.

docker run --user $(id -u) --rm -v $(pwd):/dastardly -e \
BURP_START_URL=https://target.com -e \
BURP_REPORT_FILE_PATH=/dastardly/dastardly-report.xml \
public.ecr.aws/portswigger/dastardly:latest

На данный момент умеет искать:
✅ Cross-site scripting (XSS) (reflected)
✅ Cross-origin resource sharing (CORS) issues
✅ Vulnerable JavaScript dependency
✅ Content type is not specified
✅ Multiple content types specified
✅ HTML does not specify charset
✅ Duplicate cookies set

На выходе получается отчет в JUnit XML, который содержит детали найденной уязвимости, уровень критичности (info, low, medium, high) и ссылки на рекомендации Web Security Academy

https://github.com/creacitysec/CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.

Chrome V8 Hole Exploit

🇰🇷 Research
🐞 Exploit