Skip to content

fix(web-security): stop installing unlicensed surf at sandbox boot (ADM-447) #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
briangreunke merged 1 commit into from
Sep 23, 2026
+6 −9
Merged

fix(web-security): stop installing unlicensed surf at sandbox boot (ADM-447) #154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion capabilities/web-security/capability.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
schema: 1
name: web-security
version: "1.15.0"
version: "1.15.1"
description: >
Web application penetration testing with 83 attack technique playbooks
covering HTTP desync/request smuggling, cache poisoning, SSRF, SSTI, DOM
Expand Down
4 changes: 1 addition & 3 deletions capabilities/web-security/docker/Dockerfile.runtime
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@
# - 2fa (TOTP code generation)
# - agent-browser (headless Chromium for DOM interaction)
# - kiterunner (API-aware content discovery)
# - surf (SSRF target identification)
# - wrangler (Cloudflare Workers CLI for custom OAST endpoints)
# - pacu (AWS exploitation framework)
# - ast-grep (AST-based code pattern search via tree-sitter)
Expand Down Expand Up @@ -108,8 +107,7 @@ RUN git clone --depth 1 https://github.com/assetnote/kiterunner /tmp/kiterunner
&& rm -rf /tmp/kiterunner \
|| echo "WARN: kiterunner build failed, skipping"

# ── surf (SSRF target identification) ────────────────────────────
RUN go install github.com/assetnote/surf/cmd/surf@latest
# surf is not installed: upstream grants no licence (ADM-447).

# ── protoscope ──────────────────────────────────────────────────────
RUN go install github.com/protocolbuffers/protoscope/cmd/protoscope@latest
Expand Down
7 changes: 3 additions & 4 deletions capabilities/web-security/scripts/install_tools.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,13 +62,12 @@ GO_TOOL_VERSIONS_pdtm="v0.1.5"
GO_TOOL_VERSIONS_protoscope="v0.0.0-20221109213918-8e7a6aafa2c9"
GO_TOOL_VERSIONS_interactsh="v1.3.1"
GO_TOOL_VERSIONS_2fa="v1.2.0"
GO_TOOL_VERSIONS_surf="v0.0.5"

PD_TOOLS="nuclei httpx subfinder naabu dnsx uncover alterx tlsx asnmap"

# What is actually missing, before anything is fetched.
missing_go_tools=""
for tool in protoscope interactsh-client 2fa surf; do
for tool in protoscope interactsh-client 2fa; do
have "$tool" || missing_go_tools="$missing_go_tools $tool"
done
missing_pd_tools=""
Expand Down Expand Up @@ -127,8 +126,8 @@ have interactsh-client || \
# -- 2fa (TOTP generator) --------------------------------------------------
have 2fa || go install "rsc.io/2fa@${GO_TOOL_VERSIONS_2fa}"

# -- surf (SSRF target identification) ------------------------------------
have surf || go install "github.com/assetnote/surf/cmd/surf@${GO_TOOL_VERSIONS_surf}"
# surf is not installed: upstream grants no licence, so we have no right to use
# or redistribute it (ADM-447).

# -- kiterunner (API content discovery) ------------------------------------
if ! have kr; then
Expand Down
2 changes: 1 addition & 1 deletion capabilities/web-security/skills/timing-attack-recon/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ Highest-value technique. Detect proxy endpoints routing to internal services --
Once scoped proxy is confirmed via timing:
1. Feed it your subdomain list -- timing reveals which resolve internally
2. Test RFC1918 ranges on common ports (80, 443, 8080, 8443)
3. Pre-filter candidates: `surf -l hosts.txt`
3. Pre-filter candidates: probe the range with `naabu`/`httpx` for live hosts

### Front-End Impersonation
If the proxy respects forwarded headers:
Expand Down
Loading