full-disclosure

Open Source and information security mailing list archives

Message-ID: <20250818182753.Horde.pcl0-v-Ghf7GaYaeUF1Gx5Y@webmail.inetadmin.eu>
Date: Mon, 18 Aug 2025 18:27:53 +0200
From: Jozef Sudolsky <jozef@...olsky.sk>
To: fulldisclosure@...lists.org
Subject: [FD] [tool] CRSprober

Dear community,

I’d like to share a small tool I’ve recently released - CRSprober.

This utility is designed to remotely detect the version of the OWASP  
CRS as well as the configured paranoia level on a target protected by  
ModSecurity + CRS.

It works by sending specific payloads and analyzing the WAF's  
responses to determine this information. This can be useful for  
testing, research, or verification purposes, especially when auditing  
remote systems.

The tool is available here: https://github.com/azurit/CRSprober

Any feedback, suggestions, or contributions are very welcome.

Best regards,
Jozef Sudolsky

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives