beatzaplenty/autorecon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1 from beatz174-bit/codex/create-triage-sheet-for-cve-hits

Browse Source 
Add CVE triage generator and disposition artifacts for scan results
This commit is contained in:
beatz174-bit
2026-04-13 10:38:35 +10:00
committed by GitHub
parent 7817122265 60c1719b6d
commit 750b10e01c
18 changed files with 818 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build-cve-triage.py
Executable
+248
View File
@@ -0,0 +1,248 @@
#!/usr/bin/env python3
"""Build CVE triage sheets from AutoRecon artifacts."""
from __future__ import annotations
import json
import re
from collections import defaultdict
from datetime import datetime, timezone
from pathlib import Path
RESULTS_DIR = Path("results")
CVE_RE = re.compile(r"CVE-\d{4}-\d{4,7}")
OPEN_PORT_RE = re.compile(r"^(\d+/(?:tcp|udp))\s+open\s+(.*)$")
SCRIPT_URL_RE = re.compile(r"\|\s+(/[^: ]*):\s+(.*CVE-\d{4}-\d{4,7}.*)$")
PRECONDITIONS = {
"CVE-2011-3192": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.",
"CVE-2009-3733": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
"CVE-2011-0966": "Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling.",
"CVE-2018-10822": "Target must be affected D-Link router firmware exposing /uir/ traversal path.",
"CVE-2018-10824": "Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman.",
"CVE-2017-9798": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.",
"CVE-2005-3299": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
"CVE-2003-1418": "Target must expose Apache mod_include with vulnerable SSI execution behavior.",
}
REQUIRED_REPRO_STEP = (
"Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, "
"or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient."
)
def load_text(path: Path) -> str:
try:
return path.read_text(encoding="utf-8", errors="ignore")
except FileNotFoundError:
return ""
def parse_service_evidence(nmap_paths: list[Path]) -> dict[str, list[str]]:
evidence: dict[str, list[str]] = defaultdict(list)
for path in nmap_paths:
for line in load_text(path).splitlines():
m = OPEN_PORT_RE.match(line.strip())
if m:
endpoint = m.group(1)
value = m.group(2).strip()
if value and value not in evidence[endpoint]:
evidence[endpoint].append(value)
return dict(evidence)
def parse_nmap_hits(nmap_paths: list[Path]) -> dict[str, list[dict[str, str]]]:
hits: dict[str, list[dict[str, str]]] = defaultdict(list)
for path in nmap_paths:
lines = load_text(path).splitlines()
current_endpoint = "unknown"
for idx, line in enumerate(lines):
stripped = line.strip()
m_open = OPEN_PORT_RE.match(stripped)
if m_open:
current_endpoint = m_open.group(1)
for cve in CVE_RE.findall(line):
endpoint = current_endpoint
detail = stripped
m_url = SCRIPT_URL_RE.search(line)
if m_url:
endpoint = m_url.group(1)
detail = m_url.group(2)
# include short context for review
ctx = "\n".join(lines[max(0, idx - 1): min(len(lines), idx + 2)])
hits[cve].append(
{
"source_file": str(path),
"endpoint": endpoint,
"evidence": detail,
"context": ctx,
}
)
return dict(hits)
def parse_pattern_hits(pattern_path: Path) -> dict[str, int]:
counts: dict[str, int] = defaultdict(int)
for line in load_text(pattern_path).splitlines():
for cve in CVE_RE.findall(line):
counts[cve] += 1
return dict(counts)
def infer_status(cve: str, evidence_blob: str) -> tuple[str, str]:
blob = evidence_blob.lower()
if "401 unauthorized" in blob:
return (
"not-applicable",
"Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
)
if cve in {"CVE-2017-9798", "CVE-2003-1418"}:
return (
"needs-manual-test",
"Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
)
return (
"needs-manual-test",
"Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
)
def host_dirs() -> list[Path]:
return sorted([p for p in RESULTS_DIR.iterdir() if p.is_dir() and (p / "scans").exists()])
def main() -> None:
generated = datetime.now(timezone.utc).isoformat()
global_suppressions = []
for host_dir in host_dirs():
scans_dir = host_dir / "scans"
pattern_path = scans_dir / "_patterns.log"
nmap_paths = sorted(scans_dir.glob("**/*nmap*.txt"))
if not pattern_path.exists() and not nmap_paths:
continue
pattern_counts = parse_pattern_hits(pattern_path)
nmap_hits = parse_nmap_hits(nmap_paths)
cves = sorted(set(pattern_counts) | set(nmap_hits))
if not cves:
continue
service_evidence = parse_service_evidence(nmap_paths)
host_entries = []
for cve in cves:
hit_entries = nmap_hits.get(cve, [])
endpoints = sorted({h["endpoint"] for h in hit_entries if h["endpoint"]}) or ["unknown"]
endpoint = endpoints[0]
product_versions = []
for ep, products in service_evidence.items():
if ep in endpoint or endpoint in ep or endpoint == "unknown":
product_versions.extend(products)
product_versions = sorted(set(product_versions))
if not product_versions:
product_versions = ["No explicit product/version fingerprint in nmap service line."]
evidence_blob = "\n".join([h["evidence"] for h in hit_entries])
status, rationale = infer_status(cve, evidence_blob)
reproducibility = (
"not-reproduced" if status != "confirmed" else "reproduced"
)
sources = []
if pattern_counts.get(cve, 0):
sources.append({"file": str(pattern_path), "match_count": pattern_counts[cve]})
for h in hit_entries:
sources.append(
{
"file": h["source_file"],
"endpoint": h["endpoint"],
"evidence": h["evidence"],
}
)
entry = {
"host": host_dir.name,
"cve": cve,
"affected_host": host_dir.name,
"endpoint": endpoint,
"product_version_evidence": product_versions,
"exploit_precondition": PRECONDITIONS.get(
cve,
"Validate affected product/version and exploit path prerequisites before filing.",
),
"reproducibility": reproducibility,
"disposition": status,
"disposition_rationale": rationale,
"required_reproduction_step_before_ticket": REQUIRED_REPRO_STEP,
"evidence_sources": sources,
}
host_entries.append(entry)
if status == "not-applicable":
global_suppressions.append(
{
"host": host_dir.name,
"signature": cve,
"reason": rationale,
"suppression_scope": "host-specific",
"source": "cve-triage",
"updated_at": generated,
}
)
host_entries.sort(key=lambda item: item["cve"])
md_lines = [
f"# CVE triage sheet - {host_dir.name}",
"",
f"Generated (UTC): {generated}",
"",
"| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |",
"|---|---|---|---|---|---|---|",
]
for item in host_entries:
evidence_short = "; ".join(item["product_version_evidence"][:2])
md_lines.append(
f"| {item['cve']} | {item['affected_host']} | `{item['endpoint']}` | {evidence_short} | {item['exploit_precondition']} | {item['reproducibility']} | **{item['disposition']}** |"
)
md_lines.append(
f"| | | | | | | Required reproduction gate: {item['required_reproduction_step_before_ticket']} |"
)
(scans_dir / "_cve_triage.md").write_text("\n".join(md_lines) + "\n", encoding="utf-8")
(scans_dir / "_cve_disposition.json").write_text(
json.dumps(
{
"host": host_dir.name,
"generated_at": generated,
"required_reproduction_step_before_ticket": REQUIRED_REPRO_STEP,
"findings": host_entries,
},
indent=2,
)
+ "\n",
encoding="utf-8",
)
if global_suppressions:
(RESULTS_DIR / "_false_positive_suppressions.json").write_text(
json.dumps(
{
"generated_at": generated,
"description": "Host-level CVE suppressions derived from triage dispositions.",
"suppressions": sorted(
global_suppressions,
key=lambda item: (item["host"], item["signature"]),
),
},
indent=2,
)
+ "\n",
encoding="utf-8",
)
if __name__ == "__main__":
main()
results/_false_positive_suppressions.json
+38
View File
@@ -0,0 +1,38 @@
{
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"description": "Host-level CVE suppressions derived from triage dispositions.",
"suppressions": [
{
"host": "prometheus.lan.ddnsgeek.com",
"signature": "CVE-2009-3733",
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"suppression_scope": "host-specific",
"source": "cve-triage",
"updated_at": "2026-04-07T03:49:38.723646+00:00"
},
{
"host": "prometheus.lan.ddnsgeek.com",
"signature": "CVE-2011-0966",
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"suppression_scope": "host-specific",
"source": "cve-triage",
"updated_at": "2026-04-07T03:49:38.723646+00:00"
},
{
"host": "prometheus.lan.ddnsgeek.com",
"signature": "CVE-2018-10822",
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"suppression_scope": "host-specific",
"source": "cve-triage",
"updated_at": "2026-04-07T03:49:38.723646+00:00"
},
{
"host": "prometheus.lan.ddnsgeek.com",
"signature": "CVE-2018-10824",
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"suppression_scope": "host-specific",
"source": "cve-triage",
"updated_at": "2026-04-07T03:49:38.723646+00:00"
}
]
}
results/auth.lan.ddnsgeek.com/scans/_cve_disposition.json
+67
View File
@@ -0,0 +1,67 @@
{
"host": "auth.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "auth.lan.ddnsgeek.com",
"cve": "CVE-2005-3299",
"affected_host": "auth.lan.ddnsgeek.com",
"endpoint": "443/tcp",
"product_version_evidence": [
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
],
"exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| IDs: CVE:CVE-2005-3299"
},
{
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299"
}
]
},
{
"host": "auth.lan.ddnsgeek.com",
"cve": "CVE-2009-3733",
"affected_host": "auth.lan.ddnsgeek.com",
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
"product_version_evidence": [
"No explicit product/version fingerprint in nmap service line."
],
"exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
"evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
},
{
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
"evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
}
]
}
]
}
results/auth.lan.ddnsgeek.com/scans/_cve_triage.md
+10
View File
@@ -0,0 +1,10 @@
# CVE triage sheet - auth.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2005-3299 | auth.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
| CVE-2009-3733 | auth.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/familytree.lan.ddnsgeek.com/scans/_cve_disposition.json
+93
View File
@@ -0,0 +1,93 @@
{
"host": "familytree.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "familytree.lan.ddnsgeek.com",
"cve": "CVE-2003-1418",
"affected_host": "familytree.lan.ddnsgeek.com",
"endpoint": "unknown",
"product_version_evidence": [
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"tcpwrapped syn-ack ttl 56"
],
"exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 1
}
]
},
{
"host": "familytree.lan.ddnsgeek.com",
"cve": "CVE-2005-3299",
"affected_host": "familytree.lan.ddnsgeek.com",
"endpoint": "443/tcp",
"product_version_evidence": [
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
],
"exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| IDs: CVE:CVE-2005-3299"
},
{
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299"
}
]
},
{
"host": "familytree.lan.ddnsgeek.com",
"cve": "CVE-2009-3733",
"affected_host": "familytree.lan.ddnsgeek.com",
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
"product_version_evidence": [
"No explicit product/version fingerprint in nmap service line."
],
"exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
"evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
},
{
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "|_ /sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml: Possible path traversal in VMWare (CVE-2009-3733)"
}
]
}
]
}
results/familytree.lan.ddnsgeek.com/scans/_cve_triage.md
+12
View File
@@ -0,0 +1,12 @@
# CVE triage sheet - familytree.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2003-1418 | familytree.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must expose Apache mod_include with vulnerable SSI execution behavior. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
| CVE-2005-3299 | familytree.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
| CVE-2009-3733 | familytree.lan.ddnsgeek.com | `/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/kuma.lan.ddnsgeek.com/scans/_cve_disposition.json
+30
View File
@@ -0,0 +1,30 @@
{
"host": "kuma.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "kuma.lan.ddnsgeek.com",
"cve": "CVE-2017-9798",
"affected_host": "kuma.lan.ddnsgeek.com",
"endpoint": "unknown",
"product_version_evidence": [
"http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
],
"exploit_precondition": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/kuma.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 31
}
]
}
]
}
results/kuma.lan.ddnsgeek.com/scans/_cve_triage.md
+8
View File
@@ -0,0 +1,8 @@
# CVE triage sheet - kuma.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2017-9798 | kuma.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_disposition.json
+32
View File
@@ -0,0 +1,32 @@
{
"host": "monitor-kuma.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "monitor-kuma.lan.ddnsgeek.com",
"cve": "CVE-2017-9798",
"affected_host": "monitor-kuma.lan.ddnsgeek.com",
"endpoint": "unknown",
"product_version_evidence": [
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"tcpwrapped syn-ack ttl 56"
],
"exploit_precondition": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/monitor-kuma.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 31
}
]
}
]
}
results/monitor-kuma.lan.ddnsgeek.com/scans/_cve_triage.md
+8
View File
@@ -0,0 +1,8 @@
# CVE triage sheet - monitor-kuma.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2017-9798 | monitor-kuma.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/nextcloud.lan.ddnsgeek.com/scans/_cve_disposition.json
+32
View File
@@ -0,0 +1,32 @@
{
"host": "nextcloud.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "nextcloud.lan.ddnsgeek.com",
"cve": "CVE-2003-1418",
"affected_host": "nextcloud.lan.ddnsgeek.com",
"endpoint": "unknown",
"product_version_evidence": [
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"tcpwrapped syn-ack ttl 56"
],
"exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/nextcloud.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 1
}
]
}
]
}
results/nextcloud.lan.ddnsgeek.com/scans/_cve_triage.md
+8
View File
@@ -0,0 +1,8 @@
# CVE triage sheet - nextcloud.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2003-1418 | nextcloud.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must expose Apache mod_include with vulnerable SSI execution behavior. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/prometheus.lan.ddnsgeek.com/scans/_cve_disposition.json
+127
View File
@@ -0,0 +1,127 @@
{
"host": "prometheus.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "prometheus.lan.ddnsgeek.com",
"cve": "CVE-2009-3733",
"affected_host": "prometheus.lan.ddnsgeek.com",
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
"product_version_evidence": [
"No explicit product/version fingerprint in nmap service line."
],
"exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
"reproducibility": "not-reproduced",
"disposition": "not-applicable",
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
"evidence": "Possible path traversal in VMWare (CVE-2009-3733) (401 Unauthorized)"
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
"evidence": "Possible path traversal in VMWare (CVE-2009-3733) (401 Unauthorized)"
}
]
},
{
"host": "prometheus.lan.ddnsgeek.com",
"cve": "CVE-2011-0966",
"affected_host": "prometheus.lan.ddnsgeek.com",
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties",
"product_version_evidence": [
"No explicit product/version fingerprint in nmap service line."
],
"exploit_precondition": "Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling.",
"reproducibility": "not-reproduced",
"disposition": "not-applicable",
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 4
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini",
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties",
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\lib\\classpath\\com\\cisco\\nm\\cmf\\dbservice2\\DBServer.properties",
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\log\\dbpwdChange.log",
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
}
]
},
{
"host": "prometheus.lan.ddnsgeek.com",
"cve": "CVE-2018-10822",
"affected_host": "prometheus.lan.ddnsgeek.com",
"endpoint": "/uir//etc/passwd",
"product_version_evidence": [
"No explicit product/version fingerprint in nmap service line."
],
"exploit_precondition": "Target must be affected D-Link router firmware exposing /uir/ traversal path.",
"reproducibility": "not-reproduced",
"disposition": "not-applicable",
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 1
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/uir//etc/passwd",
"evidence": "Possible D-Link router directory traversal vulnerability (CVE-2018-10822) (401 Unauthorized)"
}
]
},
{
"host": "prometheus.lan.ddnsgeek.com",
"cve": "CVE-2018-10824",
"affected_host": "prometheus.lan.ddnsgeek.com",
"endpoint": "/uir//tmp/csman/0",
"product_version_evidence": [
"No explicit product/version fingerprint in nmap service line."
],
"exploit_precondition": "Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman.",
"reproducibility": "not-reproduced",
"disposition": "not-applicable",
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 1
},
{
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "/uir//tmp/csman/0",
"evidence": "Possible D-Link router plaintext password file exposure (CVE-2018-10824) (401 Unauthorized)"
}
]
}
]
}
results/prometheus.lan.ddnsgeek.com/scans/_cve_triage.md
+14
View File
@@ -0,0 +1,14 @@
# CVE triage sheet - prometheus.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2009-3733 | prometheus.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **not-applicable** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
| CVE-2011-0966 | prometheus.lan.ddnsgeek.com | `/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program%20Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.properties` | No explicit product/version fingerprint in nmap service line. | Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling. | not-reproduced | **not-applicable** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
| CVE-2018-10822 | prometheus.lan.ddnsgeek.com | `/uir//etc/passwd` | No explicit product/version fingerprint in nmap service line. | Target must be affected D-Link router firmware exposing /uir/ traversal path. | not-reproduced | **not-applicable** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
| CVE-2018-10824 | prometheus.lan.ddnsgeek.com | `/uir//tmp/csman/0` | No explicit product/version fingerprint in nmap service line. | Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman. | not-reproduced | **not-applicable** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/shifts.lan.ddnsgeek.com/scans/_cve_disposition.json
+38
View File
@@ -0,0 +1,38 @@
{
"host": "shifts.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "shifts.lan.ddnsgeek.com",
"cve": "CVE-2011-3192",
"affected_host": "shifts.lan.ddnsgeek.com",
"endpoint": "443/tcp",
"product_version_evidence": [
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
],
"exploit_precondition": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/shifts.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/shifts.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| IDs: CVE:CVE-2011-3192 BID:49303"
},
{
"file": "results/shifts.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192"
}
]
}
]
}
results/shifts.lan.ddnsgeek.com/scans/_cve_triage.md
+8
View File
@@ -0,0 +1,8 @@
# CVE triage sheet - shifts.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2011-3192 | shifts.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
results/stockfill.lan.ddnsgeek.com/scans/_cve_disposition.json
+37
View File
@@ -0,0 +1,37 @@
{
"host": "stockfill.lan.ddnsgeek.com",
"generated_at": "2026-04-07T03:49:38.723646+00:00",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"findings": [
{
"host": "stockfill.lan.ddnsgeek.com",
"cve": "CVE-2011-3192",
"affected_host": "stockfill.lan.ddnsgeek.com",
"endpoint": "443/tcp",
"product_version_evidence": [
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
],
"exploit_precondition": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.",
"reproducibility": "not-reproduced",
"disposition": "needs-manual-test",
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
"evidence_sources": [
{
"file": "results/stockfill.lan.ddnsgeek.com/scans/_patterns.log",
"match_count": 2
},
{
"file": "results/stockfill.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| IDs: BID:49303 CVE:CVE-2011-3192"
},
{
"file": "results/stockfill.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
"endpoint": "443/tcp",
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192"
}
]
}
]
}
results/stockfill.lan.ddnsgeek.com/scans/_cve_triage.md
+8
View File
@@ -0,0 +1,8 @@
# CVE triage sheet - stockfill.lan.ddnsgeek.com
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|---|---|---|---|---|---|---|
| CVE-2011-3192 | stockfill.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition. | not-reproduced | **needs-manual-test** |
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |