[pull] master from swisskyrepo:master

.github/.markdownlint.json

@@ -2,10 +2,13 @@
     "default": true,
     "MD013": false,
     "MD033": false,
+    "MD060": {
+      "style": "aligned"
+    },
     "no-duplicate-heading": {
       "siblings_only": true
     },
     "ul-indent": {
       "indent": 4
     }
-}
+}

.github/workflows/check-markdown.yml

@@ -15,7 +15,7 @@ jobs:
         files: '**/*.md'
         separator: ","
 
-    - uses: DavidAnson/markdownlint-cli2-action@v20
+    - uses: DavidAnson/markdownlint-cli2-action@v24
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         globs: ${{ steps.changed-files.outputs.all_changed_files }}

.pre-commit-config.yaml

@@ -0,0 +1,12 @@
+repos:
+  - repo: local
+    hooks:
+      - id: markdownlint
+        name: Verify Markdown
+        entry: >-
+          sh -c 'docker run --rm -v "$PWD:/workdir"
+          davidanson/markdownlint-cli2:latest "**/*.md"
+          --config .github/.markdownlint.json'
+        language: system
+        files: '(\.md$|^\.github/\.markdownlint\.json$)'
+        pass_filenames: false

API Key Leaks/IIS-Machine-Keys.md

@@ -19,11 +19,11 @@
 
 ViewState in IIS is a technique used to retain the state of web controls between postbacks in ASP.NET applications. It stores data in a hidden field on the page, allowing the page to maintain user input and other state information.
 
-| Format | Properties |
-| --- | --- |
-| Base64 | `EnableViewStateMac=False`,  `ViewStateEncryptionMode=False` |
-| Base64 + MAC | `EnableViewStateMac=True` |
-| Base64 + Encrypted | `ViewStateEncryptionMode=True` |
+| Format             | Properties                                                   |
+| ------------------ | ------------------------------------------------------------ |
+| Base64             | `EnableViewStateMac=False`,  `ViewStateEncryptionMode=False` |
+| Base64 + MAC       | `EnableViewStateMac=True`                                    |
+| Base64 + Encrypted | `ViewStateEncryptionMode=True`                               |
 
 By default until Sept 2014, the `enableViewStateMac` property was to set to `False`.
 Usually unencrypted viewstate are starting with the string `/wEP`.

CRLF Injection/README.md

@@ -119,12 +119,12 @@ Inject a `Location` header to force a redirect for the user.
 
 Firefox followed the spec by stripping off any out-of-range characters when setting cookies instead of encoding them.
 
-| UTF-8 Character | Hex | Unicode | Stripped |
-| --------- | --- | ------- | -------- |
-| `嘊` | `%E5%98%8A` | `\u560a` | `%0A` (\n) |
-| `嘍` | `%E5%98%8D` | `\u560d` | `%0D` (\r) |
-| `嘾` | `%E5%98%BE` | `\u563e` | `%3E` (>)  |
-| `嘼` | `%E5%98%BC` | `\u563c` | `%3C` (<)  |
+| UTF-8 Character | Hex         | Unicode  | Stripped   |
+| --------------- | ----------- | -------- | ---------- |
+| `嘊`            | `%E5%98%8A` | `\u560a` | `%0A` (\n) |
+| `嘍`            | `%E5%98%8D` | `\u560d` | `%0D` (\r) |
+| `嘾`            | `%E5%98%BE` | `\u563e` | `%3E` (>)  |
+| `嘼`            | `%E5%98%BC` | `\u563c` | `%3C` (<)  |
 
 The UTF-8 character `嘊` contains `0a` in the last part of its hex format, which would be converted as `\n` by Firefox.
 

Denial of Service/README.md

@@ -29,14 +29,14 @@ Be very careful as this is most likely **out-of-scope** and can have a high impa
 
 When a process is writing a file on the server, try to reach the maximum number of files allowed by the filesystem format. The system should output a message: `No space left on device` when the limit is reached.
 
-| Filesystem | Maximum Inodes |
-| ---        | --- |
-| BTRFS      | 2^64 (~18 quintillion) |
-| EXT4       | ~4 billion |
-| FAT32      | ~268 million files |
+| Filesystem | Maximum Inodes             |
+| ---------- | -------------------------- |
+| BTRFS      | 2^64 (~18 quintillion)     |
+| EXT4       | ~4 billion                 |
+| FAT32      | ~268 million files         |
 | NTFS       | ~4.2 billion (MFT entries) |
-| XFS        | Dynamic (disk size) |
-| ZFS        | ~281 trillion |
+| XFS        | Dynamic (disk size)        |
+| ZFS        | ~281 trillion              |
 
 An alternative of this technique would be to fill a file used by the application until it reaches the maximum size allowed by the filesystem, for example it can occur on a SQLite database or a log file.
 

Directory Traversal/README.md

@@ -50,10 +50,10 @@ We can use the `..` characters to access the parent directory, the following str
 ### URL Encoding
 
 | Character | Encoded |
-| --- | -------- |
-| `.` | `%2e` |
-| `/` | `%2f` |
-| `\` | `%5c` |
+| --------- | ------- |
+| `.`       | `%2e`   |
+| `/`       | `%2f`   |
+| `\`       | `%5c`   |
 
 **Example:** IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion
 
@@ -66,10 +66,10 @@ We can use the `..` characters to access the parent directory, the following str
 Double URL encoding is the process of applying URL encoding twice to a string. In URL encoding, special characters are replaced with a % followed by their hexadecimal ASCII value. Double encoding repeats this process on the already encoded string.
 
 | Character | Encoded |
-| --- | -------- |
-| `.` | `%252e` |
-| `/` | `%252f` |
-| `\` | `%255c` |
+| --------- | ------- |
+| `.`       | `%252e` |
+| `/`       | `%252f` |
+| `\`       | `%255c` |
 
 **Example:** Spring MVC Directory Traversal Vulnerability (CVE-2018-1271)
 
@@ -80,11 +80,11 @@ Double URL encoding is the process of applying URL encoding twice to a string. I
 
 ### Unicode Encoding
 
-| Character | Encoded |
-| --- | -------- |
-| `.` | `%u002e` |
-| `/` | `%u2215` |
-| `\` | `%u2216` |
+| Character | Encoded  |
+| --------- | -------- |
+| `.`       | `%u002e` |
+| `/`       | `%u2215` |
+| `\`       | `%u2216` |
 
 **Example**: Openfire Administration Console - Authentication Bypass (CVE-2023-32315)
 
@@ -96,11 +96,11 @@ Double URL encoding is the process of applying URL encoding twice to a string. I
 
 The UTF-8 standard mandates that each codepoint is encoded using the minimum number of bytes necessary to represent its significant bits. Any encoding that uses more bytes than required is referred to as "overlong" and is considered invalid under the UTF-8 specification. This rule ensures a one-to-one mapping between codepoints and their valid encodings, guaranteeing that each codepoint has a single, unique representation.
 
-| Character | Encoded |
-| --- | -------- |
-| `.` | `%c0%2e`, `%e0%40%ae`, `%c0%ae` |
-| `/` | `%c0%af`, `%e0%80%af`, `%c0%2f` |
-| `\` | `%c0%5c`, `%c0%80%5c` |
+| Character | Encoded                         |
+| --------- | ------------------------------- |
+| `.`       | `%c0%2e`, `%e0%40%ae`, `%c0%ae` |
+| `/`       | `%c0%af`, `%e0%80%af`, `%c0%2f` |
+| `\`       | `%c0%5c`, `%c0%80%5c`           |
 
 ### Mangled Path
 
@@ -171,12 +171,12 @@ When cookieless session state is enabled. Instead of relying on a cookie to iden
 
 For example, a typical URL might be transformed from: `http://example.com/page.aspx` to something like: `http://example.com/(S(lit3py55t21z5v55vlm25s55))/page.aspx`. The value within `(S(...))` is the Session ID.
 
-| .NET Version   | URI                        |
-| -------------- | -------------------------- |
-| V1.0, V1.1     | /(XXXXXXXX)/               |
-| V2.0+          | /(S(XXXXXXXX))/            |
-| V2.0+          | /(A(XXXXXXXX)F(YYYYYYYY))/ |
-| V2.0+          | ...                        |
+| .NET Version | URI                        |
+| ------------ | -------------------------- |
+| V1.0, V1.1   | /(XXXXXXXX)/               |
+| V2.0+        | /(S(XXXXXXXX))/            |
+| V2.0+        | /(A(XXXXXXXX)F(YYYYYYYY))/ |
+| V2.0+        | ...                        |
 
 We can use this behavior to bypass filtered URLs.
 

Encoding Transformations/README.md

@@ -26,22 +26,22 @@ Unicode normalization is the process of converting Unicode text into a standardi
 * **NFKC** (Normalization Form Compatibility Composition): Like NFC, but also replaces characters with compatibility equivalents (may change appearance/format).
 * **NFKD** (Normalization Form Compatibility Decomposition): Like NFD, but also decomposes compatibility characters.
 
-| Character    | Payload               | After Normalization   |
-| ------------ | --------------------- | --------------------- |
-| `‥` (U+2025) | `‥/‥/‥/etc/passwd` | `../../../etc/passwd` |
+| Character     | Payload               | After Normalization   |
+| ------------- | --------------------- | --------------------- |
+| `‥` (U+2025)  | `‥/‥/‥/etc/passwd`    | `../../../etc/passwd` |
 | `︰` (U+FE30) | `︰/︰/︰/etc/passwd` | `../../../etc/passwd` |
-| `＇` (U+FF07) | `＇ or ＇1＇=＇1` | `' or '1'='1` |
-| `＂` (U+FF02) | `＂ or ＂1＂=＂1` | `" or "1"="1` |
-| `﹣` (U+FE63) | `admin'﹣﹣` | `admin'--` |
-| `。` (U+3002) | `domain。com` | `domain.com` |
-| `／` (U+FF0F) | `／／domain.com` | `//domain.com` |
-| `＜` (U+FF1C) | `＜img src=a＞` | `<img src=a/>` |
-| `﹛` (U+FE5B) | `﹛﹛3+3﹜﹜` | `{{3+3}}` |
-| `［` (U+FF3B) | `［［5+5］］` | `[[5+5]]` |
-| `＆` (U+FF06) | `＆＆whoami` | `&&whoami` |
-| `ｐ` (U+FF50) | `shell.ｐʰｐ` | `shell.php` |
-| `ʰ` (U+02B0) | `shell.ｐʰｐ` | `shell.php` |
-| `ª` (U+00AA) | `ªdmin` | `admin` |
+| `＇` (U+FF07) | `＇ or ＇1＇=＇1`     | `' or '1'='1`         |
+| `＂` (U+FF02) | `＂ or ＂1＂=＂1`     | `" or "1"="1`         |
+| `﹣` (U+FE63) | `admin'﹣﹣`          | `admin'--`            |
+| `。` (U+3002) | `domain。com`         | `domain.com`          |
+| `／` (U+FF0F) | `／／domain.com`      | `//domain.com`        |
+| `＜` (U+FF1C) | `＜img src=a＞`       | `<img src=a/>`        |
+| `﹛` (U+FE5B) | `﹛﹛3+3﹜﹜`         | `{{3+3}}`             |
+| `［` (U+FF3B) | `［［5+5］］`         | `[[5+5]]`             |
+| `＆` (U+FF06) | `＆＆whoami`          | `&&whoami`            |
+| `ｐ` (U+FF50) | `shell.ｐʰｐ`         | `shell.php`           |
+| `ʰ` (U+02B0)  | `shell.ｐʰｐ`         | `shell.php`           |
+| `ª` (U+00AA)  | `ªdmin`               | `admin`               |
 
 ```py
 import unicodedata

File Inclusion/Wrappers.md

@@ -21,11 +21,11 @@ A wrapper in the context of file inclusion vulnerabilities refers to the protoco
 
 The part "`php://filter`" is case insensitive
 
-| Filter | Description |
-| ------ | ----------- |
-| `php://filter/read=string.rot13/resource=index.php` | Display index.php as rot13 |
-| `php://filter/convert.iconv.utf-8.utf-16/resource=index.php` | Encode index.php from utf8 to utf16  |
-| `php://filter/convert.base64-encode/resource=index.php` | Display index.php as a base64 encoded string |
+| Filter                                                       | Description                                  |
+| ------------------------------------------------------------ | -------------------------------------------- |
+| `php://filter/read=string.rot13/resource=index.php`          | Display index.php as rot13                   |
+| `php://filter/convert.iconv.utf-8.utf-16/resource=index.php` | Encode index.php from utf8 to utf16          |
+| `php://filter/convert.base64-encode/resource=index.php`      | Display index.php as a base64 encoded string |
 
 ```powershell
 http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php

Insecure Deserialization/DotNET.md

@@ -18,11 +18,11 @@
 
 ## Detection
 
-| Data           | Description         |
-| -------------- | ------------------- |
+| Data           | Description          |
+| -------------- | -------------------- |
 | `AAEAAD` (Hex) | .NET BinaryFormatter |
-| `FF01` (Hex)   | .NET ViewState |
-| `/w` (Base64)   | .NET ViewState |
+| `FF01` (Hex)   | .NET ViewState       |
+| `/w` (Base64)  | .NET ViewState       |
 
 Example: `AAEAAAD/////AQAAAAAAAAAMAgAAAF9TeXN0ZW0u[...]0KPC9PYmpzPgs=`