Automated Αll-in-One OS command injection exploitation tool.
This report summarizes scanner evidence for commixproject/commix, a Python project with 5,875 GitHub stars. SynthScan examined 87,232 lines of code across 232 source files, recording 976 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 22.9 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 505 finding(s).
Are imports declared and package/API names verified? 34 finding(s).
Are wrappers, guards, and repeated structures necessary? 594 finding(s).
Which changes need focused human review? 976 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 976 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | setup.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | commix.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/options.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/startup.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/compat.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/convert.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/main.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/testing.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/bind_tcp.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/session_relay.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/modes.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/shells/reverse_tcp.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/parse/openapi.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/parse/cmdline.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/parse/request.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/parse/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/oob/provider.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/oob/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/oob/crypto.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/oob/interactsh.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/shell_options.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/execution.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/controller.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/handler.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/enumeration.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/checks.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/injector.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/file_access.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/proof.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/controller/registry_access.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/cookies.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/stability.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/mining.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/reproduce.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/proxy.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/redirection.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/keepalive.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/chunked.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/tor.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/authentication.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/parameters.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/anticsrf.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/headers.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/requests.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/requests/pki.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/eb_injector.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/eb_handler.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/payloads/boolean_based.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/payloads/tempfile_based.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/payloads/__init__.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/payloads/time_based.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/payloads/classic.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/payloads/file_based.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| HIGH | src/core/eval/grammars/powershell.py | 0 | this file is part of commix project (https://commixproject.com). copyright (c) 2014-2026 anastasios stasinopoulos (@ancs | STRING |
| 114 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/core/options.py | 317 | except ValueError: | CODE |
| HIGH | src/core/main.py | 525 | except (Exception, SystemExit): | CODE |
| HIGH | src/core/main.py | 797 | except AttributeError: | CODE |
| HIGH | src/core/main.py | 786 | except (KeyError, AttributeError): | CODE |
| HIGH | src/core/main.py | 1150 | except (Exception, SystemExit): | CODE |
| HIGH | src/core/main.py | 1221 | except (Exception, SystemExit): | CODE |
| HIGH | src/core/shells/session_relay.py | 100 | except (OSError, socket.error): | CODE |
| HIGH | src/core/shells/session_relay.py | 155 | except Exception: | CODE |
| HIGH | src/core/shells/session_relay.py | 184 | except Exception: | CODE |
| HIGH | src/core/shells/session_relay.py | 188 | except Exception: | CODE |
| HIGH | src/core/shells/session_relay.py | 135 | except Exception: | CODE |
| HIGH | src/core/shells/session_relay.py | 139 | except Exception: | CODE |
| HIGH | src/core/parse/request.py | 147 | except Exception: | CODE |
| HIGH | src/core/oob/provider.py | 132 | except Exception: | CODE |
| HIGH | src/core/controller/controller.py | 896 | except Exception: | CODE |
| HIGH | src/core/controller/controller.py | 1137 | except settings.RetryTechniqueException: | CODE |
| HIGH | src/core/controller/controller.py | 1042 | except (settings.SkipTechniqueException, settings.RetryTechniqueException): | CODE |
| HIGH | src/core/controller/handler.py | 525 | except session_handler.StoredWebRootConflict: | CODE |
| HIGH | src/core/controller/handler.py | 795 | except session_handler.StoredWebRootConflict: | CODE |
| HIGH | src/core/controller/handler.py | 1084 | except session_handler.StoredWebRootConflict: | CODE |
| HIGH | src/core/controller/handler.py | 1487 | except session_handler.StoredWebRootConflict: | CODE |
| HIGH | src/core/controller/handler.py | 1180 | except Exception: | CODE |
| HIGH | src/core/controller/checks.py | 1030 | except Exception: | CODE |
| HIGH | src/core/controller/checks.py | 1459 | except Exception: | CODE |
| HIGH | src/core/controller/checks.py | 1706 | except IndexError: | CODE |
| HIGH | src/core/controller/checks.py | 4102 | except IndexError: | CODE |
| HIGH | src/core/controller/checks.py | 4402 | except Exception: | CODE |
| HIGH | src/core/controller/checks.py | 4631 | except TypeError: | CODE |
| HIGH | src/core/controller/checks.py | 4714 | except TypeError: | CODE |
| HIGH | src/core/controller/checks.py | 4090 | except TypeError: | CODE |
| HIGH | src/core/controller/injector.py | 121 | except Exception: | CODE |
| HIGH | src/core/controller/injector.py | 387 | except Exception: | CODE |
| HIGH | src/core/controller/injector.py | 1630 | except UnicodeDecodeError: | CODE |
| HIGH | src/core/controller/injector.py | 1659 | except IndexError: | CODE |
| HIGH | src/core/controller/injector.py | 1432 | except (Exception, SystemExit): | CODE |
| HIGH | src/core/requests/cookies.py | 166 | except (AttributeError, KeyError, TypeError): | CODE |
| HIGH | src/core/requests/proxy.py | 121 | except Exception: | CODE |
| HIGH | src/core/requests/keepalive.py | 58 | except Exception: | CODE |
| HIGH | src/core/requests/keepalive.py | 71 | except Exception: | CODE |
| HIGH | src/core/requests/tor.py | 37 | except socket.error: | CODE |
| HIGH | src/core/requests/tor.py | 43 | except socket.error: | CODE |
| HIGH | src/core/requests/parameters.py | 249 | except Exception: | CODE |
| HIGH | src/core/requests/parameters.py | 940 | except (AttributeError, IndexError): | CODE |
| HIGH | src/core/requests/headers.py | 156 | except Exception: | CODE |
| HIGH | src/core/requests/headers.py | 286 | except Exception: | CODE |
| HIGH | src/core/requests/headers.py | 284 | except Exception: | CODE |
| HIGH | src/core/requests/headers.py | 840 | except Exception: | CODE |
| HIGH | src/core/requests/requests.py | 1049 | except Exception: | CODE |
| HIGH | src/core/requests/requests.py | 1126 | except Exception: | CODE |
| HIGH | src/core/requests/requests.py | 715 | except Exception: | CODE |
| HIGH | src/core/requests/requests.py | 923 | except ValueError: | CODE |
| HIGH | src/core/requests/requests.py | 874 | except ValueError: | CODE |
| HIGH | src/utils/update.py | 161 | except Exception: | CODE |
| HIGH | src/utils/update.py | 59 | except Exception: | CODE |
| HIGH | src/utils/common.py | 314 | except Exception: | CODE |
| HIGH | src/utils/session_handler.py | 747 | except Exception: | CODE |
| HIGH | src/utils/session_handler.py | 790 | except (sqlite3.OperationalError, sqlite3.DatabaseError): | CODE |
| HIGH | src/utils/session_handler.py | 806 | except (sqlite3.OperationalError, sqlite3.DatabaseError): | CODE |
| HIGH | src/utils/session_handler.py | 850 | except (sqlite3.OperationalError, sqlite3.DatabaseError): | CODE |
| HIGH | src/utils/session_handler.py | 898 | except (sqlite3.OperationalError, sqlite3.DatabaseError): | CODE |
| 18 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/options.py | 180 | except Exception as err: | CODE |
| LOW | src/core/options.py | 434 | except Exception as e: | CODE |
| LOW | src/core/options.py | 459 | except Exception as e: | CODE |
| LOW | src/core/startup.py | 88 | except Exception as ex: | CODE |
| LOW | src/core/main.py | 165 | except Exception as err_msg: | CODE |
| LOW | src/core/main.py | 266 | except Exception as err_msg: | CODE |
| LOW | src/core/testing.py | 42 | except Exception as e: | CODE |
| LOW | src/core/shells/bind_tcp.py | 135 | except Exception: | CODE |
| LOW | src/core/shells/bind_tcp.py | 163 | except Exception: | CODE |
| LOW | src/core/shells/session_relay.py | 135 | except Exception: | CODE |
| LOW | src/core/shells/session_relay.py | 139 | except Exception: | CODE |
| LOW | src/core/shells/session_relay.py | 155 | except Exception: | CODE |
| LOW | src/core/shells/session_relay.py | 184 | except Exception: | CODE |
| LOW | src/core/shells/session_relay.py | 188 | except Exception: | CODE |
| MEDIUM | src/core/shells/session_relay.py | 146 | def _reader(): | CODE |
| LOW | src/core/shells/reverse_tcp.py | 224 | except Exception: | CODE |
| LOW | src/core/shells/reverse_tcp.py | 252 | except Exception: | CODE |
| LOW | src/core/parse/openapi.py | 58 | except Exception as err: | CODE |
| LOW | src/core/parse/openapi.py | 213 | except Exception: | CODE |
| LOW | src/core/parse/openapi.py | 266 | except Exception: | CODE |
| LOW | src/core/parse/openapi.py | 289 | except Exception: | CODE |
| LOW | src/core/parse/openapi.py | 396 | except Exception as err: | CODE |
| LOW | src/core/parse/openapi.py | 413 | except Exception as err: | CODE |
| MEDIUM | src/core/parse/openapi.py | 48 | def _load_spec(content): | CODE |
| LOW | src/core/parse/cmdline.py | 1463 | except Exception: | STRING |
| LOW | src/core/parse/cmdline.py | 1477 | except Exception: | STRING |
| MEDIUM | src/core/parse/cmdline.py | 1459 | def tab_completer(text, state): | CODE |
| LOW | src/core/parse/request.py | 147 | except Exception: | CODE |
| LOW | src/core/oob/provider.py | 132 | except Exception: | CODE |
| LOW | src/core/oob/provider.py | 154 | except Exception as err: | CODE |
| LOW | src/core/oob/interactsh.py | 101 | except Exception: | CODE |
| LOW | src/core/controller/shell_options.py | 97 | except Exception: | CODE |
| LOW | src/core/controller/shell_options.py | 116 | except Exception: | CODE |
| MEDIUM | src/core/controller/shell_options.py | 50 | def _execute_shell_launch(execute_cmd, cmd, filename, url): | CODE |
| MEDIUM | src/core/controller/controller.py | 1372 | def has_stored_session(check_param): | CODE |
| LOW | src/core/controller/controller.py | 708 | except Exception: | CODE |
| LOW | src/core/controller/controller.py | 806 | except Exception: | CODE |
| LOW | src/core/controller/controller.py | 896 | except Exception: | CODE |
| LOW | src/core/controller/controller.py | 902 | except Exception: | CODE |
| LOW | src/core/controller/controller.py | 1182 | except Exception: | CODE |
| LOW | src/core/controller/controller.py | 1375 | except Exception: | CODE |
| LOW | src/core/controller/handler.py | 450 | except Exception: | CODE |
| LOW | src/core/controller/handler.py | 605 | except Exception: | CODE |
| LOW | src/core/controller/handler.py | 912 | except Exception: | CODE |
| LOW | src/core/controller/handler.py | 1180 | except Exception: | CODE |
| LOW | src/core/controller/handler.py | 1310 | except Exception: | CODE |
| LOW | src/core/controller/handler.py | 1644 | except Exception: | CODE |
| MEDIUM | src/core/controller/checks.py | 882 | def tab_autocompleter(): | CODE |
| MEDIUM | src/core/controller/checks.py | 1448 | def process_page_content(response, action): | CODE |
| MEDIUM | src/core/controller/checks.py | 1700 | def remove_empty_lines(content): | CODE |
| MEDIUM | src/core/controller/checks.py | 3944 | def _apply_tamper(script_name, module, payload): | CODE |
| MEDIUM | src/core/controller/checks.py | 3960 | def perform_payload_modification(payload): | CODE |
| MEDIUM | src/core/controller/checks.py | 4052 | def json_data(data): | CODE |
| MEDIUM | src/core/controller/checks.py | 4324 | def is_GraphQL_check(parameter): | CODE |
| MEDIUM | src/core/controller/checks.py | 5470 | def shell_transfer_args(cmd, usage): | CODE |
| MEDIUM | src/core/controller/checks.py | 5766 | def target_serves_concurrently(url, http_request_method, workers): | CODE |
| MEDIUM | src/core/controller/checks.py | 6282 | def web_root_from_leaked_path(url): | CODE |
| LOW | src/core/controller/checks.py | 477 | except Exception: | CODE |
| LOW | src/core/controller/checks.py | 1030 | except Exception: | CODE |
| LOW | src/core/controller/checks.py | 1194 | except Exception: | CODE |
| 123 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/options.py | 35 | CODE | |
| LOW | src/core/main.py | 139 | CODE | |
| LOW | src/core/main.py | 194 | CODE | |
| LOW | src/core/main.py | 539 | CODE | |
| LOW | src/core/main.py | 847 | CODE | |
| LOW | src/core/testing.py | 22 | CODE | |
| LOW | src/core/shells/session_relay.py | 79 | CODE | |
| LOW | src/core/shells/session_relay.py | 121 | CODE | |
| LOW | src/core/shells/modes.py | 171 | CODE | |
| LOW | src/core/parse/openapi.py | 99 | CODE | |
| LOW | src/core/parse/openapi.py | 222 | CODE | |
| LOW | src/core/parse/openapi.py | 257 | CODE | |
| LOW | src/core/parse/cmdline.py | 1459 | CODE | |
| LOW | src/core/parse/request.py | 49 | CODE | |
| LOW | src/core/parse/request.py | 100 | CODE | |
| LOW | src/core/parse/request.py | 319 | CODE | |
| LOW | src/core/controller/shell_options.py | 166 | CODE | |
| LOW | src/core/controller/shell_options.py | 231 | CODE | |
| LOW | src/core/controller/shell_options.py | 302 | CODE | |
| LOW | src/core/controller/shell_options.py | 233 | CODE | |
| LOW | src/core/controller/execution.py | 25 | CODE | |
| LOW | src/core/controller/controller.py | 158 | CODE | |
| LOW | src/core/controller/controller.py | 232 | CODE | |
| LOW | src/core/controller/controller.py | 394 | CODE | |
| LOW | src/core/controller/controller.py | 651 | CODE | |
| LOW | src/core/controller/controller.py | 833 | CODE | |
| LOW | src/core/controller/controller.py | 1430 | CODE | |
| LOW | src/core/controller/controller.py | 1467 | CODE | |
| LOW | src/core/controller/controller.py | 1618 | CODE | |
| LOW | src/core/controller/handler.py | 48 | CODE | |
| LOW | src/core/controller/handler.py | 169 | CODE | |
| LOW | src/core/controller/handler.py | 236 | CODE | |
| LOW | src/core/controller/handler.py | 329 | CODE | |
| LOW | src/core/controller/handler.py | 694 | CODE | |
| LOW | src/core/controller/handler.py | 1001 | CODE | |
| LOW | src/core/controller/handler.py | 1377 | CODE | |
| LOW | src/core/controller/handler.py | 343 | CODE | |
| LOW | src/core/controller/checks.py | 251 | CODE | |
| LOW | src/core/controller/checks.py | 363 | CODE | |
| LOW | src/core/controller/checks.py | 389 | CODE | |
| LOW | src/core/controller/checks.py | 484 | CODE | |
| LOW | src/core/controller/checks.py | 676 | CODE | |
| LOW | src/core/controller/checks.py | 770 | CODE | |
| LOW | src/core/controller/checks.py | 989 | CODE | |
| LOW | src/core/controller/checks.py | 1152 | CODE | |
| LOW | src/core/controller/checks.py | 1206 | CODE | |
| LOW | src/core/controller/checks.py | 1377 | CODE | |
| LOW | src/core/controller/checks.py | 1419 | CODE | |
| LOW | src/core/controller/checks.py | 1598 | CODE | |
| LOW | src/core/controller/checks.py | 1876 | CODE | |
| LOW | src/core/controller/checks.py | 1895 | CODE | |
| LOW | src/core/controller/checks.py | 2039 | CODE | |
| LOW | src/core/controller/checks.py | 2078 | CODE | |
| LOW | src/core/controller/checks.py | 2137 | CODE | |
| LOW | src/core/controller/checks.py | 2181 | CODE | |
| LOW | src/core/controller/checks.py | 2223 | CODE | |
| LOW | src/core/controller/checks.py | 2309 | CODE | |
| LOW | src/core/controller/checks.py | 2434 | CODE | |
| LOW | src/core/controller/checks.py | 2518 | CODE | |
| LOW | src/core/controller/checks.py | 2715 | CODE | |
| 142 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/options.py | 84 | # Check if defined "--proxy" option. | COMMENT |
| LOW | src/core/options.py | 197 | # Check if defined Tor (--tor option). | COMMENT |
| LOW | src/core/options.py | 231 | # Check if defined "--auth-cred" and/or '--auth-type'. | COMMENT |
| LOW | src/core/options.py | 259 | # Check if defined "--abort-code" option. | COMMENT |
| LOW | src/core/options.py | 273 | # Check if defined "--ignore-code" option. | COMMENT |
| LOW | src/core/options.py | 285 | # Check if defined "--wizard" option. | COMMENT |
| LOW | src/core/options.py | 372 | # Check if defined "--timesec" option. | COMMENT |
| LOW | src/core/options.py | 393 | # Check if defined "--threads" option. | COMMENT |
| LOW | src/core/startup.py | 34 | # Check if defined "--version" option. | COMMENT |
| LOW | src/core/startup.py | 46 | # Check if specified wrong alternative interpreter | COMMENT |
| LOW⚡ | src/core/main.py | 881 | # Check if defined "--update" option. | COMMENT |
| LOW⚡ | src/core/main.py | 885 | # Check if defined "--install" option. | COMMENT |
| LOW⚡ | src/core/main.py | 890 | # Check if defined "--purge" option. | COMMENT |
| LOW⚡ | src/core/main.py | 912 | # Check if ".git" exists and check for updated version! | COMMENT |
| LOW⚡ | src/core/main.py | 916 | # Check if option is "--url" for single url test. | COMMENT |
| LOW⚡ | src/core/main.py | 924 | # Check if defined character used for splitting parameter values. | COMMENT |
| LOW⚡ | src/core/main.py | 928 | # Check if defined character used for splitting parameter values. | COMMENT |
| LOW | src/core/main.py | 301 | # Check if http / https | COMMENT |
| LOW | src/core/main.py | 634 | # Check if defined character used for splitting cookie values. | COMMENT |
| LOW | src/core/main.py | 740 | # Check if defined "--url" or "-m" option. | COMMENT |
| LOW | src/core/main.py | 858 | # Check if defined "--list-tampers" option. | COMMENT |
| LOW | src/core/main.py | 867 | # Check if defined "--ignore-dependencies" option. | COMMENT |
| LOW | src/core/main.py | 958 | # Check if option is "-m" for multiple urls test. | COMMENT |
| LOW | src/core/main.py | 989 | # Check if option "--crawl" is enabled. | COMMENT |
| LOW | src/core/controller/controller.py | 1202 | # Check if the session has stored data for this header | COMMENT |
| LOW | src/core/controller/controller.py | 1224 | # Check if the corresponding injection flag is already active | COMMENT |
| LOW | src/core/controller/controller.py | 1566 | # Check if the injection marker is set in either URL or POST data (but not both) | COMMENT |
| LOW | src/core/controller/controller.py | 1568 | # Check if no injection marker is set in either URL or POST data | COMMENT |
| LOW | src/core/controller/handler.py | 1024 | # Check if defined "--url-reload" option. | COMMENT |
| LOW | src/core/controller/handler.py | 1028 | # Check if defined "--maxlen" option. | COMMENT |
| LOW | src/core/controller/handler.py | 1233 | # Check if false positive fixation is True. | COMMENT |
| LOW | src/core/controller/enumeration.py | 177 | # Check if PowerShell is enabled. | COMMENT |
| LOW⚡ | src/core/controller/checks.py | 3042 | # Check if the current user have admin privileges. | COMMENT |
| LOW⚡ | src/core/controller/checks.py | 3047 | # Check if the current user have root privileges. | COMMENT |
| LOW⚡ | src/core/controller/checks.py | 4323 | # Check if a GraphQL document, which is a body that names an operation and carries a selection set. | COMMENT |
| LOW⚡ | src/core/controller/checks.py | 4330 | # Check if valid SOAP/XML | COMMENT |
| LOW⚡ | src/core/controller/checks.py | 4338 | #Check if INJECT_TAG is enclosed in quotes (in json data) | COMMENT |
| LOW⚡ | src/core/controller/checks.py | 4344 | # Check if valid JSON | COMMENT |
| LOW | src/core/controller/checks.py | 6006 | # Check if defined POST data | COMMENT |
| LOW | src/core/requests/authentication.py | 55 | # Check if defined extra headers. | COMMENT |
| LOW⚡ | src/core/requests/parameters.py | 849 | # Check if defined the INJECT_TAG | COMMENT |
| LOW⚡ | src/core/requests/parameters.py | 859 | # Check if multiple parameters are supplied. | COMMENT |
| LOW⚡ | src/core/requests/parameters.py | 864 | # Check if not defined the "INJECT_HERE" tag in parameter | COMMENT |
| LOW | src/core/requests/parameters.py | 184 | # Check if single parameter is supplied. | COMMENT |
| LOW | src/core/requests/parameters.py | 186 | # Check if defined the INJECT_TAG | COMMENT |
| LOW | src/core/requests/parameters.py | 208 | # Check if defined the "INJECT_HERE" tag | COMMENT |
| LOW | src/core/requests/parameters.py | 322 | # Check if parameters are empty or meaningless | COMMENT |
| LOW | src/core/requests/parameters.py | 413 | # Check if JSON Object. | COMMENT |
| LOW | src/core/requests/parameters.py | 424 | # Check if GraphQL document. | COMMENT |
| LOW | src/core/requests/parameters.py | 431 | # Check if XML Object. | COMMENT |
| LOW | src/core/requests/parameters.py | 600 | # Check if not defined the "INJECT_HERE" tag in parameter | COMMENT |
| LOW | src/core/requests/parameters.py | 668 | # Check if single parameter is supplied. | COMMENT |
| LOW | src/core/requests/parameters.py | 779 | # Check if defined "--prefix" option. | COMMENT |
| LOW | src/core/requests/parameters.py | 805 | # Check if defined "--suffix" option, the way a prefix is handled just above. | COMMENT |
| LOW | src/core/requests/parameters.py | 838 | # Check if single paramerter is supplied. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 687 | # Check if defined any Cookie HTTP header. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 695 | # Check if defined any User-Agent HTTP header. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 699 | # Check if defined any Referer HTTP header. | COMMENT |
| LOW⚡ | src/core/requests/headers.py | 703 | # Check if defined any Host HTTP header. | COMMENT |
| LOW | src/core/requests/headers.py | 738 | # Check if defined any HTTP Authentication credentials. | COMMENT |
| 23 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/main.py | 475 | def prompt_skip_vulnerable_host(target_url): | CODE |
| LOW | src/core/main.py | 531 | def check_value_inside_boundaries(url, http_request_method): | CODE |
| LOW | src/core/shells/bind_tcp.py | 142 | def gen_python_meterpreter_bind(): | CODE |
| LOW | src/core/shells/reverse_tcp.py | 206 | def gen_php_meterpreter_reverse(): | CODE |
| LOW | src/core/shells/reverse_tcp.py | 231 | def gen_python_meterpreter_reverse(): | CODE |
| LOW | src/core/parse/cmdline.py | 1420 | def _print_mobile_user_agents(devices, default_index): | STRING |
| LOW | src/core/parse/request.py | 240 | def _keep_command_line_options(): | CODE |
| LOW | src/core/controller/shell_options.py | 155 | def _maybe_prompt_for_handler(): | CODE |
| LOW | src/core/controller/shell_options.py | 231 | def reverse_tcp_config_generic(execute_cmd, cmd, go_back, go_back_again, filename, url, separator=""): | CODE |
| LOW⚡ | src/core/controller/controller.py | 131 | def init_http_header_injection_status(): | CODE |
| LOW⚡ | src/core/controller/controller.py | 140 | def init_cookie_injection_status(): | CODE |
| LOW⚡ | src/core/controller/controller.py | 146 | def check_for_stored_sessions(url, check_parameter, http_request_method): | CODE |
| LOW | src/core/controller/controller.py | 224 | def announce_heuristic_finding(detail): | CODE |
| LOW | src/core/controller/controller.py | 232 | def command_injection_heuristic_basic(url, http_request_method, check_parameter, place): | CODE |
| LOW | src/core/controller/controller.py | 394 | def code_injections_heuristic_basic(url, http_request_method, check_parameter, place): | CODE |
| LOW | src/core/controller/controller.py | 527 | def results_based_command_injection_technique(url, timesec, filename, http_request_method): | CODE |
| LOW | src/core/controller/controller.py | 542 | def dynamic_code_evaluation_technique(url, timesec, filename, http_request_method): | CODE |
| LOW | src/core/controller/controller.py | 594 | def filebased_command_injection_technique(url, timesec, filename, http_request_method, url_time_response): | CODE |
| LOW | src/core/controller/controller.py | 619 | def oob_command_injection_technique(url, timesec, filename, http_request_method): | CODE |
| LOW | src/core/controller/controller.py | 633 | def check_parameter_in_http_header(check_parameter, place): | CODE |
| LOW | src/core/controller/controller.py | 746 | def attempt_skip_testable_value(url, http_request_method, check_parameter): | CODE |
| LOW | src/core/controller/controller.py | 1086 | def _time_related_resume_redundant(): | CODE |
| LOW | src/core/controller/controller.py | 1288 | def filtered_testable_parameters(): | CODE |
| LOW | src/core/controller/handler.py | 115 | def _prioritize_confirmed_boundary(prefixes, suffixes, separators, whitespaces): | CODE |
| LOW | src/core/controller/handler.py | 159 | def _register_post_detection_action(action, time_related_attack=None): | CODE |
| LOW | src/core/controller/handler.py | 236 | def pseudo_terminal_shell_generic(url, filename, technique, no_result, execute_cmd, cleanup=lambda: None, on_found_decli | CODE |
| LOW | src/core/controller/handler.py | 390 | def probe_skip_testable_value_post_detection(separator, timesec, http_request_method, url, vuln_parameter, whitespace, u | CODE |
| LOW | src/core/controller/handler.py | 835 | def boolean_based_pseudo_terminal_shell(separator, prefix, suffix, whitespace, vuln_parameter, http_request_method, url, | CODE |
| LOW | src/core/controller/handler.py | 959 | def oob_pseudo_terminal_shell(separator, prefix, suffix, whitespace, vuln_parameter, http_request_method, url, filename, | CODE |
| LOW | src/core/controller/handler.py | 982 | def _confirm_threaded_time_retrieval(url, http_request_method, resuming_stored): | CODE |
| LOW⚡ | src/core/controller/checks.py | 1095 | def ignore_randomized_parameter(parameter): | CODE |
| LOW⚡ | src/core/controller/checks.py | 1105 | def ignore_stateful_parameter(parameter): | CODE |
| LOW⚡ | src/core/controller/checks.py | 1115 | def sanitize_payload_newlines(payload): | CODE |
| LOW⚡ | src/core/controller/checks.py | 3034 | def enable_all_enumeration_options(): | CODE |
| LOW | src/core/controller/checks.py | 132 | def injection_techniques_status(): | CODE |
| LOW | src/core/controller/checks.py | 172 | def final_false_positive_check(url, http_request_method, check_parameter, timesec, mark): | CODE |
| LOW | src/core/controller/checks.py | 363 | def process_custom_injection_data(data): | CODE |
| LOW | src/core/controller/checks.py | 389 | def custom_injection_marker_character(url, http_request_method): | CODE |
| LOW | src/core/controller/checks.py | 526 | def flush_os_shell_suggestion(): | CODE |
| LOW | src/core/controller/checks.py | 770 | def handle_detection_interrupt(filename, url): | CODE |
| LOW | src/core/controller/checks.py | 838 | def handle_exploitation_interrupt(filename, url): | CODE |
| LOW | src/core/controller/checks.py | 1079 | def ignore_anticsrf_parameter(parameter): | CODE |
| LOW | src/core/controller/checks.py | 1618 | def check_for_false_positive_result(false_positive_warning): | CODE |
| LOW | src/core/controller/checks.py | 1803 | def target_fingerprint_summary(): | CODE |
| LOW | src/core/controller/checks.py | 1825 | def _injection_points_summary(header_msg, rows, decode_payload=False): | CODE |
| LOW | src/core/controller/checks.py | 1845 | def resumed_injection_points_summary(rows): | CODE |
| LOW | src/core/controller/checks.py | 1852 | def confirmed_injection_points_summary(): | CODE |
| LOW | src/core/controller/checks.py | 1876 | def procced_with_file_based_technique(): | CODE |
| LOW | src/core/controller/checks.py | 2005 | def no_user_enumeration_permission(): | CODE |
| LOW | src/core/controller/checks.py | 2761 | def error_loading_session_file(): | CODE |
| LOW | src/core/controller/checks.py | 2807 | def time_delay_due_to_unstable_request(timesec): | CODE |
| LOW | src/core/controller/checks.py | 2868 | def record_probe_response_time(exec_time): | CODE |
| LOW | src/core/controller/checks.py | 2876 | def record_baseline_response_time(exec_time): | CODE |
| LOW | src/core/controller/checks.py | 2889 | def warm_up_response_baseline(url, http_request_method, close=True): | CODE |
| LOW | src/core/controller/checks.py | 3013 | def identified_http_auth_type(auth_type): | CODE |
| LOW | src/core/controller/checks.py | 3059 | def check_provided_parameters(): | CODE |
| LOW | src/core/controller/checks.py | 3216 | def tamper_dep_command_incompatible(tamper_name): | CODE |
| LOW | src/core/controller/checks.py | 3231 | def tamper_dep_eval_incompatible(tamper_name): | CODE |
| LOW | src/core/controller/checks.py | 3243 | def tamper_dep_time_related_only(tamper_name): | CODE |
| LOW | src/core/controller/checks.py | 3249 | def tamper_dep_interpreter_incompatible(tamper_name): | CODE |
| 87 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 61 | # eof | COMMENT |
| LOW | src/core/controller/injector.py | 141 | # Each model is filled from its own kind of request: the probes below cannot stand in for plain | COMMENT |
| LOW | src/core/techniques/oob/oob_payloads.py | 41 | # per boundary, and a target either has a client or it does not - which is not a thing a boundary | COMMENT |
| LOW | src/utils/settings.py | 1221 | OOB_HEURISTIC_TRANSPORT = "" | COMMENT |
| LOW | src/utils/settings.py | 1841 | # Whether the evasion getting a finding past the WAF/IPS has already been confirmed to the user. | COMMENT |
| LOW | src/thirdparty/chardet/mbcssm.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/compat.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/euckrprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/sjisprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/cp949prober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/__init__.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/euctwfreq.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/euctwfreq.py | 21 | # | COMMENT |
| LOW | src/thirdparty/chardet/chardistribution.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/latin1prober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/charsetprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/gb2312prober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/mbcharsetprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/euctwprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/codingstatemachine.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/escprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/universaldetector.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/utf8prober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/gb2312freq.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/gb2312freq.py | 21 | # | COMMENT |
| LOW | src/thirdparty/chardet/mbcsgroupprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/eucjpprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/jisfreq.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/jisfreq.py | 21 | # | COMMENT |
| LOW | src/thirdparty/chardet/escsm.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/sbcharsetprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/big5freq.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/big5freq.py | 21 | # | COMMENT |
| LOW | src/thirdparty/chardet/euckrfreq.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/euckrfreq.py | 21 | # | COMMENT |
| LOW | src/thirdparty/chardet/big5prober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 21 | # | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 41 | # | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 61 | # and spelled backwards] [first word of first line spelled backwards] | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 81 | # Logical Hebrew - "windows-1255" - normal, naturally ordered text. | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 101 | # The SBCSGroupProber is responsible for stripping the original text of HTML | COMMENT |
| LOW | src/thirdparty/chardet/hebrewprober.py | 181 | COMMENT | |
| LOW | src/thirdparty/chardet/hebrewprober.py | 201 | # 1) A word longer than 1 letter, ending with a final letter. This is | COMMENT |
| LOW | src/thirdparty/chardet/charsetgroupprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/sbcsgroupprober.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/chardet/jpcntx.py | 1 | ######################## BEGIN LICENSE BLOCK ######################## | COMMENT |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 741 | # we enclose it in single quotes. | COMMENT |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1441 | # reference or an HTML entity reference. Nonetheless, | COMMENT |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1741 | pass | COMMENT |
| LOW | src/thirdparty/six/__init__.py | 1 | # Copyright (c) 2010-2020 Benjamin Peterson | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/core/options.py | 497 | # Define the local path where Metasploit Framework is installed. | COMMENT |
| MEDIUM | src/core/startup.py | 56 | # Define the level of verbosity. | COMMENT |
| MEDIUM | src/core/main.py | 611 | # Define the level of tests to perform. | COMMENT |
| MEDIUM | src/core/requests/authentication.py | 140 | # Define the HTTP authentication type. | COMMENT |
| MEDIUM | src/core/requests/authentication.py | 146 | # Define the authentication wordlists for usernames / passwords. | COMMENT |
| MEDIUM⚡ | src/core/requests/parameters.py | 256 | # Define the vulnerable parameter | COMMENT |
| MEDIUM | src/utils/logs.py | 84 | # Create the logs filename | COMMENT |
| MEDIUM | src/utils/session_handler.py | 248 | # Create a comma-separated string of ids to keep | COMMENT |
| MEDIUM | src/utils/session_handler.py | 289 | # Create the table if it does not exist | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/options.py | 396 | CODE | |
| LOW | src/core/controller/checks.py | 59 | CODE | |
| LOW | src/core/controller/checks.py | 62 | CODE | |
| LOW | src/core/controller/checks.py | 2721 | CODE | |
| LOW | src/core/controller/checks.py | 66 | CODE | |
| LOW | src/core/controller/checks.py | 2733 | CODE | |
| LOW | src/core/controller/checks.py | 2740 | CODE | |
| LOW | src/core/controller/proof.py | 21 | CODE | |
| LOW | src/tamper/dashlesstest.py | 16 | CODE | |
| LOW | src/utils/sgmllib.py | 13 | CODE | |
| LOW | src/thirdparty/chardet/__init__.py | 21 | CODE | |
| LOW | src/thirdparty/chardet/__init__.py | 21 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 2 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 2 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 2 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 2 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 3 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 3 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 3 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 3 | CODE | |
| LOW | src/thirdparty/colorama/__init__.py | 4 | CODE | |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 79 | CODE | |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 80 | CODE | |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1768 | CODE | |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1772 | CODE | |
| LOW | src/thirdparty/odict/__init__.py | 6 | CODE | |
| LOW | src/thirdparty/odict/__init__.py | 8 | CODE | |
| LOW | src/thirdparty/odict/__init__.py | 9 | CODE | |
| LOW | src/thirdparty/socks/socks.py | 21 | CODE | |
| LOW | src/thirdparty/socks/socks.py | 24 | CODE | |
| LOW | src/thirdparty/six/__init__.py | 23 | CODE | |
| LOW | src/thirdparty/flatten_json/flatten_json.py | 12 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/utils/requirements.py | 26 | subprocess.Popen(requirement, stdout=null, stderr=null) | CODE |
| HIGH | src/utils/settings.py | 1533 | JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/controller/handler.py | 1723 | CODE | |
| LOW | src/core/controller/handler.py | 1358 | CODE | |
| LOW | src/core/requests/parameters.py | 42 | CODE | |
| LOW | src/utils/settings.py | 123 | CODE | |
| LOW | src/utils/settings.py | 211 | CODE | |
| LOW | src/utils/settings.py | 216 | CODE | |
| LOW | src/utils/settings.py | 221 | CODE | |
| LOW | src/utils/settings.py | 230 | CODE | |
| LOW | src/thirdparty/beautifulsoup/beautifulsoup.py | 1103 | CODE | |
| LOW | src/thirdparty/socks/socks.py | 194 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | data/txt/common-files.txt | 41 | # Container and orchestration signals - fixed paths regardless of which user the container runs | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/thirdparty/beautifulsoup/beautifulsoup.py | 1458 | # haven't already gone through a supposedly comprehensive | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/utils/sgmllib.py | 22 | __all__ = ["SGMLParser", "SGMLParseError"] | CODE |
| LOW | src/thirdparty/chardet/__init__.py | 24 | __all__ = ['UniversalDetector', 'detect', 'detect_all', '__version__', 'VERSION'] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/controller/checks.py | 4366 | def process_data(data_type, http_request_method): | CODE |