Scan report
The-Art-of-Hacking / h4cker
Could an attacker exploit mistakes in this code?
Real issues worth reviewing before you rely on this code.
- High
- 5
- Medium
- 14
- Low
- 21
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Serious issues. Review the high-severity findings before using it.
- High
- 24
- Medium
- 15
- Low
- 19
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 40
- Uncertain
- 11
- Likely noise
- 47
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository has a medium vulnerability score of 75 and a high malicious-pattern score of 73, which means the code contains several serious security flaws that could be exploited by attackers. The most critical issues involve using deprecated encryption libraries like pyCrypto and hardcoding sensitive credentials such as AWS keys directly in the source files, both of which significantly increase the risk of data theft or system compromise. While some findings appear to be ordinary mistakes like missing JWT verification or exposing a server on all network interfaces, others are highly suspicious because they match known patterns used by malware to execute reverse shells, inject code into running processes, or steal credentials from the environment. These malicious indicators suggest that the code may have been intentionally written to bypass security checks rather than just containing bugs, so you should treat it with extreme caution and avoid using it in any production environment without a thorough review.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_assessment.py line 170
- Likely real
- Yes, 99% confidence
Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.
payload = jwt.decode(token, options={"verify_signature": False}) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/labs-practice/capture-the-flag/challenges/heavy_computation/encrypt.py line 2
- Likely real
- Yes, 98% confidence
The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.
1 from Crypto.Util.number import bytes_to_long, long_to_bytes 2 from Crypto.Cipher import AES 3 from Crypto.Util.Padding import pad -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/labs-practice/capture-the-flag/challenges/heavy_computation/encrypt.py line 1
- Likely real
- Yes, 98% confidence
The pyCrypto library and its module bytes_to_long are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.
1 from Crypto.Util.number import bytes_to_long, long_to_bytes 2 from Crypto.Cipher import AES 3 from Crypto.Util.Padding import pad -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/labs-practice/capture-the-flag/challenges/heavy_computation/encrypt.py line 3
- Likely real
- Yes, 98% confidence
The pyCrypto library and its module pad are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.
2 from Crypto.Cipher import AES 3 from Crypto.Util.Padding import pad 4 from secret import password, flag -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/defensive-security/dfir/snort/README.md line 5
- Likely real
- Yes, 73% confidence
AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.
- [Snort Rules Writing Guide](https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/000/596/original/Rules_Writers_Guide_to_Snort_3_Rules.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIXACIED2SPMSC7GA%2F20211011%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20211011T165700Z&X-Amz-Expires=172800&X-Amz-SignedHeaders=host&X-Amz-Signature=1d5134d3a84db0f7b1ece95fcf98387a0cc32ff131b6c95e6a80d3cd4b616a5c) -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/post-exploitation/python-reverse.py
- Likely real
- Uncertain, 39% confidence
YARA rule matched: detect_reverse_shell — Reverse shell command patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/more-payloads/server-side-template-injection.txt
- Likely real
- Uncertain, 39% confidence
YARA rule matched: detect_reverse_shell — Reverse shell command patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/post_exploitation/reverse_shells.md
- Likely real
- Uncertain, 39% confidence
YARA rule matched: detect_reverse_shell — Reverse shell command patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/python_cool_tricks.md
- Likely real
- Uncertain, 39% confidence
YARA rule matched: detect_reverse_shell — Reverse shell command patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/dll_injection_example.py
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/defensive-security/threat-intelligence/malware_bazzar_to_stix.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/more-payloads/more-xxs-payloads.txt
- Likely real
- Probably noise, 3% confidence
YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /training-reference/cheat-sheets/scripting/python-security.md
- Likely real
- Probably noise, 3% confidence
YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/buffer-overflow-examples/exploitation/writing-exploits.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/python_cool_tricks.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /certifications/cisco/AITECH/Lesson-5-AI-for-Code-and-Workflow-Optimization/Lesson-5-11-resources.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /ai/llm-engineering/ollama-labs/lab-01-installation-and-basics.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /training-reference/cheat-sheets/scripting/python-security.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /certifications/cisco/scor-350-701/Dockerfile_example
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/more-payloads/more-xxs-payloads.txt
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/xss_vectors.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/more-payloads/xss_obfuscation_vectors.txt
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/infrastructure-network-security/virl-topologies/8.13.virl
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/defensive-security/macos-hardening/detecting-compromise.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/cryptography-pki/cryptography-and-pki/tutorials/tls-ssl-guide.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/infrastructure-network-security/virl-topologies/8.10-2.virl
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/bash_resources.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/defensive-security/linux-hardening/detecting-compromise.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /training-reference/cheat-sheets/windows/powershell.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/cookie_stealer.py line 31
- Likely real
- Yes, 99% confidence
Running flask app with host 0.0.0.0 could expose the server publicly.
app.run(host = '0.0.0.0', port=1337) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/python_nmap.py line 23
- Likely real
- Yes, 98% confidence
Detects extensive system/network enumeration activities [threat-runtime-enumeration]
my_scanner = nmap.PortScanner() my_scanner.scan(addr, port) for host in my_scanner.all_hosts(): -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/python_nmap.py line 11
- Likely real
- Yes, 98% confidence
Detects extensive system/network enumeration activities [threat-runtime-enumeration]
try: import nmap except: sys.exit("[!] It looks like the nmap library is not installed in your system. You can install it with: pip install python-nmap") -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/python_nmap.py line 13
- Likely real
- Yes, 98% confidence
Detects extensive system/network enumeration activities [threat-runtime-enumeration]
except: sys.exit("[!] It looks like the nmap library is not installed in your system. You can install it with: pip install python-nmap") # The arguments to be processed -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_ywing.py line 28
- Likely real
- Yes, 98% confidence
Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
...n Cookie Value") parser.add_argument("-u", "--url", required=False, default="http://8t2s8yx5gh5nw0z9bd3atkoprgx6lv.burpcollaborator.net",help="URL of host to check will need http or https") parser.add_argument("-H", "--host", default="http://kubernet... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/osint/quick_recon/plugins/pasting.py line 27
- Likely real
- Yes, 98% confidence
Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
print(colored ('[>] Looking in Pasting Sites...' ,'green')) #Pasting Sites e.g : PasteBin... query = "site:pastebin.com | site:hastebin.com | site:carbon.now.sh " + key for gamma in search(query, tld=zolo, num=30 , stop=60 , pause=2): ... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/osint/quick_recon/plugins/pasting.py line 27
- Likely real
- Yes, 98% confidence
Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
...ored ('[>] Looking in Pasting Sites...' ,'green')) #Pasting Sites e.g : PasteBin... query = "site:pastebin.com | site:hastebin.com | site:carbon.now.sh " + key for gamma in search(query, tld=zolo, num=30 , stop=60 , pause=2): print("" + gamma)... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_ywing.py line 28
- Likely real
- Yes, 97% confidence
Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
...a",help="Session Cookie Value") parser.add_argument("-u", "--url", required=False, default="http://8t2s8yx5gh5nw0z9bd3atkoprgx6lv.burpcollaborator.net",help="URL of host to check will need http or https") parser.add_argument("-H", "--host", default=... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_ywing.py line 28
- Likely real
- Yes, 97% confidence
Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
...n Cookie Value") parser.add_argument("-u", "--url", required=False, default="http://8t2s8yx5gh5nw0z9bd3atkoprgx6lv.burpcollaborator.net",help="URL of host to check will need http or https") parser.add_argument("-H", "--host", default="http://kubernet... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_ywing.py line 28
- Likely real
- Yes, 97% confidence
Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
...n Cookie Value") parser.add_argument("-u", "--url", required=False, default="http://8t2s8yx5gh5nw0z9bd3atkoprgx6lv.burpcollaborator.net",help="URL of host to check will need http or https") parser.add_argument("-H", "--host", default="http://kuberne... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_ywing.py line 28
- Likely real
- Yes, 97% confidence
Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
...29f3a",help="Session Cookie Value") parser.add_argument("-u", "--url", required=False, default="http://8t2s8yx5gh5nw0z9bd3atkoprgx6lv.burpcollaborator.net",help="URL of host to check will need http or https") parser.add_argument("-H", "--host", defau... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_ywing.py line 28
- Likely real
- Yes, 97% confidence
Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
...29f3a",help="Session Cookie Value") parser.add_argument("-u", "--url", required=False, default="http://8t2s8yx5gh5nw0z9bd3atkoprgx6lv.burpcollaborator.net",help="URL of host to check will need http or https") parser.add_argument("-H", "--host", defa... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_assessment.py line 253
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
... # Test with different user IDs idor_payloads = ['1', '2', '999', '../admin', '../../etc/passwd'] for payload in idor_payloads: idor_url = f"{self.base_url}{endpoint}?id=... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_assessment.py line 301
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
"| whoami", "&& cat /etc/passwd", "`id`", "$(whoami)" -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_assessment.py line 389
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
"http://169.254.169.254/metadata/instance", # Azure metadata "file:///etc/passwd", "gopher://127.0.0.1:3306", "dict://127.0.0.1:11211", -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_assessment.py line 405
- Likely real
- Yes, 96% confidence
Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]
ssrf_indicators = [ 'root:', 'daemon:', 'bin:', '/bin/bash', # /etc/passwd content 'instance-id', 'ami-id', 'security-groups', # AWS metadata 'p... -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/certificate_information/check_weak_crypto.py line 26
- Likely real
- Yes, 80% confidence
The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.
context.set_ciphers(cipher) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/hardware-embedded-security/mobile-security/OmarsApplication/app/src/main/AndroidManifest.xml line 12
- Likely real
- Yes, 73% confidence
The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane.
<activity android:name=".ItemListActivity" android:label="@string/app_name" android:theme="@style/AppTheme.NoActionBar"> <intent-filter> <action android:name="android.intent.action.MAIN" /> -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/cloud-container-security/docker-and-k8s-security/docker/run_cis_bench_locally.sh line 28
- Likely real
- Yes, 54% confidence
Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.
curl https://omnitruck.chef.io/install.sh | sudo bash -s -- -P inspec -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/assign_pr.yml line 32
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: actions-ecosystem/action-add-assignees@v1 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/greetings.yml line 12
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
- uses: actions/first-interaction@v1 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/stale.yml line 26
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: actions/stale@v5 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/cloud-container-security/docker-and-k8s-security/docker/server.js line 6
- Likely real
- Yes, 51% confidence
Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information.
const server = http.createServer((req, res) => { -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/cookie_stealer.py line 31
- Likely real
- Uncertain, 37% confidence
Possible binding to all interfaces.
30 if __name__ == "__main__": 31 app.run(host = '0.0.0.0', port=1337) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /certifications/cisco/scor-350-701/threat-response-api-example.py line 45
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
44 45 response = requests.post(config['token_url'], headers=headers, 46 auth=(config['threat_response_api_client_id'], 47 config['threat_response_api_client_pass']), 48 data=payload) 49 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/additional_exploits/druid_exploit.py line 22
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
21 ''' 22 response = requests.post(url, headers=headers, data=json.dumps(data)) 23 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_galatic_archives.py line 20
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
19 # The attacker sends a request to the exploit URL. 20 response = requests.get(exploit_url) 21 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/offensive-security/osint/quick_recon/plugins/pasting.py line 17
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
16 17 X = requests.get('https://www.google.com/webhp?ei=1') # : / 18 X.status_code -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/offensive-security/osint/quick_recon/quick_recon.py line 21
- Likely real
- Probably noise, 22% confidence
Call to requests without timeout
20 print("") 21 Qupdate = requests.get('https://raw.githubusercontent.com/The-Art-of-Hacking/h4cker/osint/quick_recon/qrecon_update.txt') #Quantom 22 Qupdate.status_code -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_example.py line 36
- Likely real
- Yes, 95% confidence
Possible hardcoded password: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
35 api_url = "https://api.example.com" 36 auth_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # Example JWT 37 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /certifications/cisco/scor-350-701/threat-response-api-example.py line 11
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'TR-token.txt'
10 #options 11 config['threat_response_token_file']='TR-token.txt' 12 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /certifications/cisco/scor-350-701/threat-response-api-example.py line 24
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'oauth2/token'
23 config['threat_response_api_root']="iroh/" 24 config['threat_response_token_path']="oauth2/token" 25 config['threat_response_inspect_path']="iroh-inspect/inspect" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_example.py line 108
- Likely real
- Yes, 93% confidence
Possible hardcoded password: 'Bearer xyz789'
107 {"url": "https://api2.example.com", "token": "token123"}, 108 {"url": "https://api3.example.com", "token": "Bearer xyz789"} 109 ] -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /certifications/cisco/scor-350-701/threat-response-api-example.py line 15
- Likely real
- Yes, 93% confidence
Possible hardcoded password: '<INSERT YOUR API CLIENT PASSWORD HERE>'
14 config['threat_response_api_client_id']="<INSERT YOUR API CLIENT ID HERE>" 15 config['threat_response_api_client_pass']="<INSERT YOUR API CLIENT PASSWORD HERE>" 16 -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_example.py line 132
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
api_url = os.getenv('API_URL', 'https://api.staging.example.com') auth_token = os.getenv('API_TOKEN') if not api_url: -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /ai/incident-response-and-automation/ai-for-incident-response/analyzing_logs.py line 22
- Likely real
- Yes, 93% confidence
Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
# Initialize the OpenAI client with the new v1+ syntax client = OpenAI(api_key=os.getenv('OPENAI_API_KEY')) def analyze_logs(log_file_path='logs.txt'): -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/dll_injection_example.py line 61
- Likely real
- Yes, 92% confidence
Detects DLL injection and process injection techniques [threat-process-injection-dll]
if not windll.kernel32.CreateRemoteThread(process_handle, None, 0, memory_allocation_variable, 0, 0, 0): print "Failed to inject shellcode. Exiting." sys.exit(0) -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/dll_injection_example.py line 59
- Likely real
- Yes, 92% confidence
Detects DLL injection and process injection techniques [threat-process-injection-dll]
...tion_variable = windll.kernel32.VirtualAllocEx(process_handle, 0, len(shellcode), 0x00001000, 0x40) windll.kernel32.WriteProcessMemory(process_handle, memory_allocation_variable, shellcode, len(shellcode), 0) if not windll.kernel32.CreateRemoteThrea... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/dll_injection_example.py line 58
- Likely real
- Yes, 92% confidence
Detects DLL injection and process injection techniques [threat-process-injection-dll]
memory_allocation_variable = windll.kernel32.VirtualAllocEx(process_handle, 0, len(shellcode), 0x00001000, 0x40) windll.kernel32.WriteProcessMemory(process_handle, memory_allocation_variable, shellcode, len(shellcode), 0) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_example.py line 75
- Likely real
- Yes, 91% confidence
Possible hardcoded password: 'Bearer your-token-here'
74 api_url = "https://api.myapp.com" 75 auth_token = "Bearer your-token-here" 76 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_example.py line 107
- Likely real
- Yes, 65% confidence
Possible hardcoded password: 'token123'
106 {"url": "https://api1.example.com", "token": None}, 107 {"url": "https://api2.example.com", "token": "token123"}, 108 {"url": "https://api3.example.com", "token": "Bearer xyz789"} -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_example.py line 106
- Likely real
- Uncertain, 45% confidence
Possible hardcoded password: 'None'
105 apis_to_test = [ 106 {"url": "https://api1.example.com", "token": None}, 107 {"url": "https://api2.example.com", "token": "token123"}, -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/arp_cache_poisoner.py line 75
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell
74 print("[*] Enabling IP forwarding") 75 os.system("sysctl -w net.inet.ip.forwarding=1") 76 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/arp_cache_poisoner.py line 49
- Likely real
- Uncertain, 35% confidence
Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell
48 print("[*] Disabling IP forwarding") 49 os.system("sysctl -w net.inet.ip.forwarding=0") 50 os.kill(os.getpid(), signal.SIGTERM) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_galatic_archives.py line 20
- Likely real
- Uncertain, 32% confidence
Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.
response = requests.get(exploit_url) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/quick_scanner.py line 17
- Likely real
- Probably noise, 24% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
16 17 subprocess.call('clear', shell=True) 18 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/quick_scanner.py line 17
- Likely real
- Probably noise, 13% confidence
Starting a process with a partial executable path
16 17 subprocess.call('clear', shell=True) 18 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/quick_scanner.py line 10
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
9 10 import socket, subprocess, sys 11 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/basic_ping_sweep.py line 5
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
4 5 import subprocess 6 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/arp_cache_poisoner.py line 75
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
74 print("[*] Enabling IP forwarding") 75 os.system("sysctl -w net.inet.ip.forwarding=1") 76 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/basic_ping_sweep.py line 13
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
12 ip = "10.6.6." + str(i) 13 result = subprocess.run(["ping", "-c", "1", "-W", "1", ip], stdout=subprocess.PIPE) 14 if result.returncode == 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/arp_cache_poisoner.py line 49
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
48 print("[*] Disabling IP forwarding") 49 os.system("sysctl -w net.inet.ip.forwarding=0") 50 os.kill(os.getpid(), signal.SIGTERM) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/recon_scripts/scanning/basic_ping_sweep.py line 13
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
12 ip = "10.6.6." + str(i) 13 result = subprocess.run(["ping", "-c", "1", "-W", "1", ip], stdout=subprocess.PIPE) 14 if result.returncode == 0: -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/cryptography-pki/cryptography-and-pki/tutorials/pki-fundamentals.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/exploitation/python_cool_tricks.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/more-payloads/command_injection_unix.txt
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/programming-and-scripting-for-cybersecurity/post_exploitation/armor.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/cracking-passwords/SecLists.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/osint/quick_recon/quick_recon.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/offensive-security/osint/quick_recon/plugins/pasting.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/ssrf_galatic_archives.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /cybersecurity-domains/application-security/web-application-testing/api_security_assessment.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /ai/llm-engineering/prompt_engineering.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /ai/llm-engineering/ollama-labs/lab-06-tool-calling.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /training-reference/cheat-sheets/linux/survival-guide.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /training-reference/cheat-sheets/scripting/python-security.md
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /certifications/cisco/scor-350-701/Dockerfile_example
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/labs-practice/capture-the-flag/challenges/heavy_computation/encrypt.py line 37
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
36 assert(len(password) == 2) 37 assert(password.decode().isprintable()) 38 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /cybersecurity-domains/labs-practice/capture-the-flag/challenges/heavy_computation/encrypt.py line 36
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
35 36 assert(len(password) == 2) 37 assert(password.decode().isprintable())
No findings match these filters.