Scan report
commixproject / commix
Could an attacker exploit mistakes in this code?
Strong warning signs. Do not run or install this without a careful review.
- High
- 51
- Medium
- 44
- Low
- 16
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 8
- Medium
- 0
- Low
- 17
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 47
- Uncertain
- 48
- Likely noise
- 41
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository has two distinct security issues that are clearly not caused by malicious intent but rather by poor coding practices. The most serious problem is an unverified SSL context, which means the code could allow connections without checking if the website's certificate is valid, potentially letting attackers hijack your network traffic. Additionally, there are multiple instances where developers use shell=True with the subprocess function, which runs commands using the current user's shell settings and variables instead of a safe environment, making it easy for attackers to execute arbitrary code. While some other findings like weak hash algorithms or suspicious GitHub Actions steps are present, they appear to be standard security weaknesses rather than signs that someone is trying to break into your system. The overall vulnerability risk score of 344.0 indicates significant exposure to exploitation if these issues are not fixed immediately.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/settings.py line 1122
- Likely real
- Yes, 99% confidence
Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.
return ssl._create_unverified_context() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 109
- Likely real
- Yes, 99% confidence
Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.call("chmod +x " + launcher_path + settings.NO_OUTPUT, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 28
- Likely real
- Yes, 99% confidence
Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.call("rm -rf " + os.path.join(settings.WRAPPER_PATH, settings.APPLICATION) + settings.NO_OUTPUT, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 29
- Likely real
- Yes, 99% confidence
Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.call("rm -rf " + os.path.join(settings.INSTALL_DIR, settings.APPLICATION) + settings.NO_OUTPUT, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 87
- Likely real
- Yes, 99% confidence
Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.call("apt-get --force-yes -y install " + packages + settings.NO_OUTPUT, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 95
- Likely real
- Yes, 99% confidence
Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.call("cp -r " + current_dir + " " + app_install_path + settings.NO_OUTPUT, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 96
- Likely real
- Yes, 99% confidence
Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.call("chmod 775 " + os.path.join(app_install_path, settings.APPLICATION + ".py") + settings.NO_OUTPUT, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 58
- Likely real
- Yes, 54% confidence
Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=root).wait() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 94
- Likely real
- Yes, 54% confidence
Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
process = subprocess.Popen("git checkout . && git pull " + settings.GIT_URL + " HEAD", shell=True, -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 322
- Likely real
- Yes, 53% confidence
Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
process = subprocess.Popen(menu.options.alert, shell=True) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 4790
- Likely real
- Yes, 53% confidence
Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
shell=True -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 680
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" (waf_enabled VARCHAR);") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 221
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 235
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute(delete_query) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 256
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" " "(id INTEGER PRIMARY KEY, url VARCHAR, technique VARCHAR, injection_type VARCHAR, separator VARCHAR, " "shell VARCHAR, vuln_parameter VARCHAR, prefix VARCHAR, suffix VARCHAR, " "TAG VARCHAR, interpreter VARCHAR, payload VARCHAR, http_header VARCHAR, http_request_method VARCHAR, url_time_response INTEGER, " "timesec INTEGER, exec_time INTEGER, output_length INTEGER, is_vulnerable VARCHAR, data VARCHAR, cookie VARCHAR, tamper VARCHAR, " "target_os VARCHAR, file_deleted VARCHAR DEFAULT '', web_root VARCHAR DEFAULT '', tmp_path VARCHAR DEFAULT '');") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 282
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("INSERT INTO \"" + table + "\" (url, technique, injection_type, separator, " "shell, vuln_parameter, prefix, suffix, TAG, interpreter, payload, http_header, http_request_method, " "url_time_response, timesec, exec_time, output_length, is_vulnerable, data, cookie, tamper, target_os, web_root, tmp_path) " "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", params) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 316
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query, url_params + ("shellshock injection technique", http_request_method)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 510
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor.execute(query, (base_url, escape_like(base_url) + "?%", http_request_method)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 605
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor.execute(query, url_params + (technique, vuln_parameter, vuln_parameter, http_request_method)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 621
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("UPDATE \"" + table + "\" SET file_deleted = '1' WHERE " + clause + " AND technique = ? AND " "(vuln_parameter = ? OR http_header = ?) AND http_request_method = ?;", url_params + (technique, vuln_parameter, vuln_parameter, http_request_method)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 637
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" " "(cmd VARCHAR, output VARCHAR, vuln_parameter VARCHAR);") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 639
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("INSERT INTO \"" + table + "\" (cmd, output, vuln_parameter) VALUES (?, ?, ?)", (base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode(), base64.b64encode(shell.encode(settings.DEFAULT_CODEC)).decode(), vuln_parameter)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 682
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("INSERT INTO \"" + table + "\" (waf_enabled) VALUES (?)", (str(waf_enabled),)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 697
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
row = conn.execute("SELECT waf_enabled FROM \"" + table + "\" LIMIT 1;").fetchone() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 724
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" (vuln_parameter VARCHAR, http_request_method VARCHAR, placeholder VARCHAR);") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 725
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("DELETE FROM \"" + table + "\" WHERE vuln_parameter = ? AND http_request_method = ?;", (vuln_parameter, http_request_method)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 726
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("INSERT INTO \"" + table + "\" (vuln_parameter, http_request_method, placeholder) VALUES (?, ?, ?)", (vuln_parameter, http_request_method, placeholder)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 740
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
row = conn.execute("SELECT placeholder FROM \"" + table + "\" WHERE vuln_parameter = ? AND http_request_method = ?;", (vuln_parameter, http_request_method)).fetchone() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 778
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" " "(id INTEGER PRIMARY KEY, url VARCHAR, authentication_type VARCHAR, admin_panel VARCHAR, " "username VARCHAR, password VARCHAR);") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 781
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute("SELECT 1 FROM \"" + table + "\" WHERE url = ? AND authentication_type = ? AND " "admin_panel = ? AND username = ? AND password = ? LIMIT 1;", (url, authentication_type, admin_panel, username, password)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 785
- Likely real
- Yes, 53% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("INSERT INTO \"" + table + "\" (url, authentication_type, admin_panel, username, password) VALUES (?, ?, ?, ?, ?)", (url, authentication_type, admin_panel, username, password)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 335
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query, url_params + ("shellshock injection technique",)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 196
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("DROP TABLE IF EXISTS " + table) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 278
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query_check, params) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 352
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query, url_params + (http_request_method,)).fetchall() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 378
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query, url_params + (http_request_method,)).fetchall() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 420
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor.execute(query, url_params + (http_request_method,)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 450
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor.execute(query, (base_url, escape_like(base_url) + "?%")) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 661
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query, (encoded_cmd, vuln_parameter)).fetchall() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 681
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
conn.execute("DELETE FROM \"" + table + "\";") -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 803
- Likely real
- Yes, 52% confidence
Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
cursor = conn.execute(query, url_params + (authentication_type,)).fetchall() -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/shells/reverse_tcp.py
- Likely real
- Uncertain, 39% confidence
YARA rule matched: detect_reverse_shell — Reverse shell command patterns
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 87
- Likely real
- Uncertain, 33% confidence
subprocess call with shell=True identified, security issue.
86 87 subprocess.call("apt-get --force-yes -y install " + packages + settings.NO_OUTPUT, shell=True) 88 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 322
- Likely real
- Uncertain, 33% confidence
subprocess call with shell=True identified, security issue.
321 try: 322 process = subprocess.Popen(menu.options.alert, shell=True) 323 process.wait() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 58
- Likely real
- Uncertain, 33% confidence
subprocess call with shell=True identified, security issue.
57 try: 58 subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=root).wait() 59 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 28
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
27 try: 28 subprocess.call("rm -rf " + os.path.join(settings.WRAPPER_PATH, settings.APPLICATION) + settings.NO_OUTPUT, shell=True) 29 subprocess.call("rm -rf " + os.path.join(settings.INSTALL_DIR, settings.APPLICATION) + settings.NO_OUTPUT, shell=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 29
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
28 subprocess.call("rm -rf " + os.path.join(settings.WRAPPER_PATH, settings.APPLICATION) + settings.NO_OUTPUT, shell=True) 29 subprocess.call("rm -rf " + os.path.join(settings.INSTALL_DIR, settings.APPLICATION) + settings.NO_OUTPUT, shell=True) 30 except Exception as e: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 95
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
94 current_dir = os.getcwd() 95 subprocess.call("cp -r " + current_dir + " " + app_install_path + settings.NO_OUTPUT, shell=True) 96 subprocess.call("chmod 775 " + os.path.join(app_install_path, settings.APPLICATION + ".py") + settings.NO_OUTPUT, shell=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 96
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
95 subprocess.call("cp -r " + current_dir + " " + app_install_path + settings.NO_OUTPUT, shell=True) 96 subprocess.call("chmod 775 " + os.path.join(app_install_path, settings.APPLICATION + ".py") + settings.NO_OUTPUT, shell=True) 97 except Exception as e: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 94
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
93 # they were, and everything else in the directory is the user's own business. 94 process = subprocess.Popen("git checkout . && git pull " + settings.GIT_URL + " HEAD", shell=True, 95 stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=root) 96 stdout, _ = process.communicate() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 4790
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
4789 extra_msfvenom_args + " -o " + output + settings.NO_OUTPUT, 4790 shell=True 4791 ).wait() 4792 4793 with open(output, "r+" if strip_newlines else "r") as content_file: 4794 data = ''.join(content_file.readlines()) 4795 if strip_newlines: 4796 data = data.replace(settings.END_LINE.LF, settings.SINGLE_WHITESPACE) 4797 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 109
- Likely real
- Uncertain, 32% confidence
subprocess call with shell=True identified, security issue.
108 f.write("cd " + app_install_path + " && ./" + settings.APPLICATION + ".py \"$@\"" + settings.END_LINE.LF) 109 subprocess.call("chmod +x " + launcher_path + settings.NO_OUTPUT, shell=True) 110 except Exception as e: -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/controller/checks.py
- Likely real
- Probably noise, 3% confidence
YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/controller/checks.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/utils/update.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/thirdparty/six/__init__.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/techniques/oob/oob_payloads.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/modules/shellshock/shellshock.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/shells/reverse_tcp.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/settings.py line 1122
- Likely real
- Yes, 98% confidence
By default, Python will create a secure, verified ssl context for use in such classes as HTTPSConnection. However, it still allows using an insecure context via the _create_unverified_context that reverts to the previous behavior that does not validate certificates or perform hostname checks.
1121 import ssl 1122 return ssl._create_unverified_context() 1123 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 77
- Likely real
- Yes, 52% confidence
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
return hashlib.sha1(text.encode('utf-8')).hexdigest() -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/lockbot.yml line 14
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
- uses: dessant/lock-threads@v2 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/builds.yml line 17
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: actions/setup-python@v2 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/builds.yml line 15
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
- uses: actions/checkout@v2 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/common.py line 246
- Likely real
- Uncertain, 49% confidence
Use of weak MD5 hash for security. Consider usedforsecurity=False
245 # Generate short hash used as issue identifier 246 key = hashlib.md5(fingerprint).hexdigest()[:8] 247 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 2506
- Likely real
- Uncertain, 49% confidence
Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
command = importlib.import_module("src.tamper." + name).rewrite_command(command) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 3004
- Likely real
- Uncertain, 48% confidence
Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
module = importlib.import_module("src.tamper." + script) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 2696
- Likely real
- Uncertain, 48% confidence
Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
module = importlib.import_module("src.tamper." + script) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 77
- Likely real
- Uncertain, 48% confidence
Use of weak SHA1 hash for security. Consider usedforsecurity=False
76 def sha1_hash(text): 77 return hashlib.sha1(text.encode('utf-8')).hexdigest() 78 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 639
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
638 "(cmd VARCHAR, output VARCHAR, vuln_parameter VARCHAR);") 639 conn.execute("INSERT INTO \"" + table + "\" (cmd, output, vuln_parameter) VALUES (?, ?, ?)", 640 (base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode(), -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/handler.py line 149
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
148 return 149 msg = "Do you want to delete from the target the file ('" + OUTPUT_TEXTFILE + "') used for command execution? [y/N] " 150 if common.read_input(msg, default="N", check_batch=True) not in settings.CHOICE_YES: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 220
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
219 220 query = "SELECT MIN(id) FROM \"" + table + "\" GROUP BY url, technique, vuln_parameter, http_header;" 221 cursor = conn.execute(query) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 234
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
233 # Delete all records that do NOT have an id in the earliest_ids list 234 delete_query = "DELETE FROM \"" + table + "\" WHERE id NOT IN (" + ids_to_keep + ");" 235 conn.execute(delete_query) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 264
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
263 # Check if an exact matching record already exists to avoid duplicates 264 query_check = ("SELECT 1 FROM \"" + table + "\" WHERE url = ? AND technique = ? AND injection_type = ? AND separator = ? AND " 265 "shell = ? AND vuln_parameter = ? AND prefix = ? AND suffix = ? AND TAG = ? AND interpreter = ? AND payload = ? AND " -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 282
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
281 if cursor.fetchone() is None: 282 conn.execute("INSERT INTO \"" + table + "\" (url, technique, injection_type, separator, " 283 "shell, vuln_parameter, prefix, suffix, TAG, interpreter, payload, http_header, http_request_method, " -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 314
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
313 clause, url_params = url_match(url) 314 query = ("SELECT http_header, payload FROM \"" + table + "\" WHERE " + clause + " AND " 315 "technique = ? AND http_request_method = ?;") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 334
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
333 clause, url_params = url_match(url) 334 query = "SELECT 1 FROM \"" + table + "\" WHERE " + clause + " AND technique = ? LIMIT 1;" 335 cursor = conn.execute(query, url_params + ("shellshock injection technique",)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 351
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
350 clause, url_params = url_match(url) 351 query = "SELECT technique FROM \"" + table + "\" WHERE " + clause + " AND http_request_method = ?;" 352 cursor = conn.execute(query, url_params + (http_request_method,)).fetchall() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 377
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
376 clause, url_params = url_match(url) 377 query = "SELECT http_header, is_vulnerable FROM \"" + table + "\" WHERE " + clause + " AND http_request_method = ?;" 378 cursor = conn.execute(query, url_params + (http_request_method,)).fetchall() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 419
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
418 clause, url_params = url_match(url) 419 query = "SELECT technique, injection_type FROM \"" + table + "\" WHERE " + clause + " AND http_request_method = ?;" 420 cursor.execute(query, url_params + (http_request_method,)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 449
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
448 base_url = split_url(url) 449 query = "SELECT * FROM \"" + table + "\" WHERE (url = ? OR url LIKE ? ESCAPE '\\');" 450 cursor.execute(query, (base_url, escape_like(base_url) + "?%")) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 603
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
602 clause, url_params = url_match(url) 603 query = ("SELECT file_deleted FROM \"" + table + "\" WHERE " + clause + " AND technique = ? AND " 604 "(vuln_parameter = ? OR http_header = ?) AND http_request_method = ? LIMIT 1;") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 802
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
801 clause, url_params = url_match(url) 802 query = "SELECT username, password FROM \"" + table + "\" WHERE " + clause + " AND authentication_type = ?;" 803 cursor = conn.execute(query, url_params + (authentication_type,)).fetchall() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 785
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
784 if cursor.fetchone() is None: 785 conn.execute("INSERT INTO \"" + table + "\" (url, authentication_type, admin_panel, username, password) VALUES (?, ?, ?, ?, ?)", 786 (url, authentication_type, admin_panel, username, password)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 781
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
780 "username VARCHAR, password VARCHAR);") 781 cursor = conn.execute("SELECT 1 FROM \"" + table + "\" WHERE url = ? AND authentication_type = ? AND " 782 "admin_panel = ? AND username = ? AND password = ? LIMIT 1;", -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 740
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
739 return None 740 row = conn.execute("SELECT placeholder FROM \"" + table + "\" WHERE vuln_parameter = ? AND http_request_method = ?;", (vuln_parameter, http_request_method)).fetchone() 741 return row[0] if row else None -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 726
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
725 conn.execute("DELETE FROM \"" + table + "\" WHERE vuln_parameter = ? AND http_request_method = ?;", (vuln_parameter, http_request_method)) 726 conn.execute("INSERT INTO \"" + table + "\" (vuln_parameter, http_request_method, placeholder) VALUES (?, ?, ?)", (vuln_parameter, http_request_method, placeholder)) 727 conn.commit() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 697
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
696 return None 697 row = conn.execute("SELECT waf_enabled FROM \"" + table + "\" LIMIT 1;").fetchone() 698 return row[0] == "True" if row else None -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 682
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
681 conn.execute("DELETE FROM \"" + table + "\";") 682 conn.execute("INSERT INTO \"" + table + "\" (waf_enabled) VALUES (?)", (str(waf_enabled),)) 683 conn.commit() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 681
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
680 conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" (waf_enabled VARCHAR);") 681 conn.execute("DELETE FROM \"" + table + "\";") 682 conn.execute("INSERT INTO \"" + table + "\" (waf_enabled) VALUES (?)", (str(waf_enabled),)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 660
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
659 encoded_cmd = base64.b64encode(cmd.encode(settings.DEFAULT_CODEC)).decode() 660 query = "SELECT output FROM \"" + table + "\" WHERE cmd = ? AND vuln_parameter = ?;" 661 cursor = conn.execute(query, (encoded_cmd, vuln_parameter)).fetchall() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 621
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
620 clause, url_params = url_match(url) 621 conn.execute("UPDATE \"" + table + "\" SET file_deleted = '1' WHERE " + clause + " AND technique = ? AND " 622 "(vuln_parameter = ? OR http_header = ?) AND http_request_method = ?;", -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 509
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
508 base_url = split_url(url) 509 query = "SELECT * FROM \"" + table + "\" WHERE (url = ? OR url LIKE ? ESCAPE '\\') AND http_request_method = ?;" 510 cursor.execute(query, (base_url, escape_like(base_url) + "?%", http_request_method)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/session_handler.py line 725
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
724 conn.execute("CREATE TABLE IF NOT EXISTS \"" + table + "\" (vuln_parameter VARCHAR, http_request_method VARCHAR, placeholder VARCHAR);") 725 conn.execute("DELETE FROM \"" + table + "\" WHERE vuln_parameter = ? AND http_request_method = ?;", (vuln_parameter, http_request_method)) 726 conn.execute("INSERT INTO \"" + table + "\" (vuln_parameter, http_request_method, placeholder) VALUES (?, ?, ?)", (vuln_parameter, http_request_method, placeholder)) -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/settings.py line 990
- Likely real
- Uncertain, 45% confidence
Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
source = globals()[name + "_" + suffix] -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/thirdparty/six/__init__.py line 735
- Likely real
- Uncertain, 40% confidence
Use of exec detected.
734 _locs_ = _globs_ 735 exec("""exec _code_ in _globs_, _locs_""") 736 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/shell_options.py line 108
- Likely real
- Uncertain, 37% confidence
Possible binding to all interfaces.
107 probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1 if keep_listening else 0) 108 bind_host = lhost if lhost not in ("", "0.0.0.0") else "0.0.0.0" 109 try: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/shell_options.py line 108
- Likely real
- Uncertain, 37% confidence
Possible binding to all interfaces.
107 probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1 if keep_listening else 0) 108 bind_host = lhost if lhost not in ("", "0.0.0.0") else "0.0.0.0" 109 try: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/thirdparty/socks/socks.py line 411
- Likely real
- Uncertain, 37% confidence
Possible binding to all interfaces.
410 super(socksocket, self).settimeout(self._timeout) 411 self.proxy_sockname = ("0.0.0.0", 0) # Unknown 412 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/thirdparty/socks/socks.py line 804
- Likely real
- Uncertain, 37% confidence
Possible binding to all interfaces.
803 # address so that packets are received from any peer 804 if dest_addr == "0.0.0.0" and not dest_port: 805 self.proxy_peername = None -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 4434
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
4433 settings.CALL_TMP_BASED = False 4434 if menu.options.file_dest and '/tmp/' in menu.options.file_dest: 4435 settings.CALL_TMP_BASED = True -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 4421
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
4420 else: 4421 settings.TMP_PATH = "/tmp/" 4422 return normalize_target_dir(menu.options.tmp_path or settings.TMP_PATH) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 4906
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
4905 def random_tmp_path(length=5): 4906 return "/tmp/" + ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(length)) 4907 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/settings.py line 895
- Likely real
- Yes, 95% confidence
Possible hardcoded password: '/etc/passwd'
894 # /etc/passwd 895 PASSWD_FILE = "/etc/passwd" 896 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/settings.py line 1077
- Likely real
- Uncertain, 44% confidence
Possible hardcoded password: ''
1076 OOB_SERVER = "" 1077 OOB_TOKEN = "" 1078 OOB_TIMEOUT = 15 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/settings.py line 2196
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
2195 _TARGET_STATE_BASELINE[name] = copy.deepcopy(value) 2196 except Exception: 2197 continue 2198 if options is not None: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/handler.py line 513
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
512 raise 513 except Exception: 514 continue 515 fired.append((token, separator, probe_prefix, probe_suffix, probe_whitespace, bare_prefix, bare_suffix, vuln_parameter, payload, expected, transport)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/handler.py line 654
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
653 raise 654 except Exception: 655 continue 656 fired.append((token, expected, candidate, payload)) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/shell_options.py line 97
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
96 return True 97 except Exception: 98 continue 99 return None if keep_open else False -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/oob/interactsh.py line 101
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
100 record = json.loads(plaintext.decode(settings.DEFAULT_CODEC, errors="replace")) 101 except Exception: 102 continue 103 found.append(Interaction( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 44
- Likely real
- Probably noise, 24% confidence
subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
43 try: 44 process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, 45 stderr=subprocess.STDOUT, cwd=root) 46 stdout, _ = process.communicate() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 18
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
17 import os 18 import subprocess 19 from src.core.parse import cmdline as menu -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/install.py line 17
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
16 import os 17 import subprocess 18 from src.utils import common -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/core/controller/checks.py line 30
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
29 import zlib 30 import subprocess 31 import contextlib -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/requirements.py line 16
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
15 import os 16 import subprocess 17 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/update.py line 44
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
43 try: 44 process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, 45 stderr=subprocess.STDOUT, cwd=root) 46 stdout, _ = process.communicate() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/utils/requirements.py line 26
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
25 with open(os.devnull,"w") as null: 26 subprocess.Popen(requirement, stdout=null, stderr=null) 27 return True -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/utils/update.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/utils/common.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/requests.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/thirdparty/six/__init__.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/controller/checks.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/parse/cmdline.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/cookies.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/main.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/controller/controller.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/techniques/oob/oob_payloads.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/oob/interactsh.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/headers.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/authentication.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/tor.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/redirection.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/requests/proxy.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/core/modules/shellshock/shellshock.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/thirdparty/flatten_json/flatten_json.py line 49
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
48 try: 49 assert isinstance(separator, str), "Separator must be a string" 50 # assert isinstance(nested_dict, dict), "The flatten() requires a dictionary input." -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /src/thirdparty/flatten_json/flatten_json.py line 83
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
82 try: 83 assert isinstance(separator, str), "Separator must be a string." 84 # assert isinstance(flat_dict, dict), "The unflatten() requires a dictionary input."
No findings match these filters.