Release v1.1.3

Added

• Argument injection 0437b2f
  • awk
    • Command execution via system()
  • curl
    • Reading/writing/exfiltrating local files
  • find
    • Command execution via exec and execdir
    • Writing local files using fprintf
  • git
    • Command execution via core.pager in .git/config
    • git-diff
      • Reading local files using --no-index or diff against /dev/null
    • git-fetch
      • Command execution via --upload-pack
    • git-fetch-pack
      • Command execution via --upload-pack and --exec
    • git-grep
      • Command execution via -O/--open-files-in-pager
    • git-ls-remote
      • Command execution via --upload-pack
    • git-pull
      • Command execution via --upload-pack
  • ssh
    • Command execution via LocalCommand in ssh_config
  • ssh-keygen
    • Command execution via -D
  • tar
    • Command execution via --to-command
    • Command execution via -I/--use-compress-program
  • wget
    • Reading/writing/exfiltrating local files
  • zip
    • Command execution via -TT/--unzip-command
• Docker Escaping 00adf5f
  • PID Namespace Sharing
• Spring 33127c1
  • useSuffixPatternMatch misconfiguration
• Command injection dac29c7
  • Link to an article that describes a case of remote LD_PRELOAD exploitation

Updated

• Parameter Injection was renamed into Argument Injection 0437b2f
• GitHub Actions 351807c
  • Prohibition to make changes in .github/workflow from forks using GITHUB_TOKEN (including pull requests merging)
• Cookie Security 28fb2ab
  • Tiny notes