Security Export: Issues, Dependabot & CodeScan Alerts #229
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| # Repository: LazyOwn | ||
|
|
||
| **Description:** LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Windows/Linux/Mac OSX, and self-configuring backdoors. With its Web interface and powerful Console Client, it is the best combination for your Autonomous RedTeam/APT campaigns. | ||
|
|
||
| | Metric | Value | | ||
| |--------|-------| | ||
| | ⭐ Stars | 218 | | ||
| | 📥 Clones (last 14 days) | 4276 | | ||
| | 🟢 Open Issues | 2 | | ||
| | 📋 Total Issues | 2 | ||
| 3 | | ||
| | 🛡 Dependabot Open Alerts | 0 | | ||
| | 🔍 CodeScan Open Alerts | 4 | | ||
|
Comment on lines
+5
to
+13
There was a problem hiding this comment. [VALIDATION] The markdown table is malformed and the metrics appear inconsistent (e.g., '📋 Total Issues | 2' followed by stray '3' on the next line). Verify the metrics generation script and fix the table formatting so columns align correctly. Ensure the numeric counts (stars, clones, open/total issues, alerts) are computed correctly and validated before writing the README to avoid misleading data. | Metric | Value |
|-----------------------------|-------|
| ⭐ Stars | 218 |
| 📥 Clones (last 14 days) | 4276 |
| 🟢 Open Issues | 2 |
| 📋 Total Issues | 5 |
| 🛡 Dependabot Open Alerts | 0 |
| 🔍 CodeScan Open Alerts | 4 | |
||
|
|
||
| ## Issues | ||
| - [#165](./issue_165.md) - Docker failed build (closed) | ||
| - [#84](./issue_84.md) - Lazynmap failing to execute (closed) | ||
| - [#30](./issue_30.md) - Please remove ngrok as a tunneling option as this tool violates the terms of service (closed) | ||
| - [#17](./issue_17.md) - Fix code scanning alert - Flask app is run in debug mode (closed) | ||
| - [#16](./issue_16.md) - Fix code scanning alert - Information exposure through an exception (closed) | ||
|
|
||
| ## Code Scanning Alerts | ||
| - [CodeScan #859](./codescan/alert_859.md) - py/cookie-injection (warning) - open | ||
| - [CodeScan #858](./codescan/alert_858.md) - py/stack-trace-exposure (error) - open | ||
| - [CodeScan #857](./codescan/alert_857.md) - py/stack-trace-exposure (error) - open | ||
| - [CodeScan #851](./codescan/alert_851.md) - py/insecure-protocol (warning) - open | ||
|
|
||
| Total issues downloaded: 5 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Code Scanning Alert #851: py/insecure-protocol | ||
|
|
||
| - **State:** open | ||
| - **Severity:** warning | ||
| - **Tool:** CodeQL | ||
| - **Created:** 2026-08-04T22:08:00Z | ||
| - **URL:** https://github.com/grisuno/LazyOwn/security/code-scanning/851 | ||
|
|
||
| ## Description | ||
| Use of insecure SSL/TLS version |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Code Scanning Alert #857: py/stack-trace-exposure | ||
|
|
||
| - **State:** open | ||
| - **Severity:** error | ||
| - **Tool:** CodeQL | ||
| - **Created:** 2026-08-08T09:40:19Z | ||
| - **URL:** https://github.com/grisuno/LazyOwn/security/code-scanning/857 | ||
|
|
||
| ## Description | ||
| Information exposure through an exception |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Code Scanning Alert #858: py/stack-trace-exposure | ||
|
|
||
| - **State:** open | ||
| - **Severity:** error | ||
| - **Tool:** CodeQL | ||
| - **Created:** 2026-08-08T09:40:19Z | ||
| - **URL:** https://github.com/grisuno/LazyOwn/security/code-scanning/858 | ||
|
|
||
| ## Description | ||
| Information exposure through an exception |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Code Scanning Alert #859: py/cookie-injection | ||
|
|
||
| - **State:** open | ||
| - **Severity:** warning | ||
| - **Tool:** CodeQL | ||
| - **Created:** 2026-08-13T05:46:56Z | ||
| - **URL:** https://github.com/grisuno/LazyOwn/security/code-scanning/859 | ||
|
|
||
| ## Description | ||
| Construction of a cookie using user-supplied input |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| # Issue #16: Fix code scanning alert - Information exposure through an exception | ||
|
|
||
| - **State:** closed | ||
| - **Created:** 2024-06-09T07:07:45Z | ||
| - **Updated:** 2024-06-09T07:12:42Z | ||
| - **Labels:** None | ||
|
|
||
| --- | ||
|
|
||
| <!-- Warning: The suggested title contains the alert rule name. This can expose security information. --> | ||
|
|
||
| Tracking issue for: | ||
| - [x] https://github.com/grisuno/LazyOwn/security/code-scanning/6 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| # Issue #17: Fix code scanning alert - Flask app is run in debug mode | ||
|
|
||
| - **State:** closed | ||
| - **Created:** 2024-06-09T07:08:21Z | ||
| - **Updated:** 2024-06-09T07:09:28Z | ||
| - **Labels:** None | ||
|
|
||
| --- | ||
|
|
||
| <!-- Warning: The suggested title contains the alert rule name. This can expose security information. --> | ||
|
|
||
| Tracking issue for: | ||
| - [x] https://github.com/grisuno/LazyOwn/security/code-scanning/5 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # Issue #30: Please remove ngrok as a tunneling option as this tool violates the terms of service | ||
|
|
||
| - **State:** closed | ||
| - **Created:** 2024-09-03T16:49:02Z | ||
| - **Updated:** 2024-09-05T05:06:42Z | ||
| - **Labels:** None | ||
|
|
||
| --- | ||
|
|
||
| PM for ngrok here. This tool directly violates the ngrok Terms of Service even when used for educational purposes only. We kindly request that ngrok be removed as an option in your tool. Please consider replacing it with other options [from this list](https://github.com/anderspitman/awesome-tunneling). | ||
|
|
||
| To learn more about how ngrok combats abuse, see https://ngrok.com/abuse and https://ngrok.com/tos . | ||
|
|
||
| - ngrok is not anonymous and can not be used to hide your identity. | ||
| - ngrok directly exposes your public IP address to anyone who sees the ngrok url you send them and in an http header. | ||
| - ngrok will ban your account if you use this tool. | ||
| - ngrok adds an interstitial page to all requests warning anyone viewing the page that the site is hosted by ngrok. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| # Issue #84: Lazynmap failing to execute | ||
|
|
||
| - **State:** closed | ||
| - **Created:** 2025-01-31T17:03:11Z | ||
| - **Updated:** 2025-02-05T03:16:37Z | ||
| - **Labels:** None | ||
|
|
||
| --- | ||
|
|
||
| **Describe the bug** | ||
| When executing the `run lazynmap` command, an error is generated indicating that `No such file or directory` is present in /home/USER/LazyOwn/sessions/logs/command_/home/USER/LazyOwn/modules/lazynmap.shoutputBigBang.htb.txt | ||
|
|
||
| **To Reproduce** | ||
| Steps to reproduce the behavior: | ||
| 1. Assign RHOST IP | ||
| 2. Execute `run lazynmap` | ||
|
|
||
|
|
||
| **Expected behavior** | ||
| LazyNmap should run successfully | ||
|
|
||
| **Screenshots** | ||
| N/A | ||
|
|
||
| **Desktop (please complete the following information):** | ||
| - OS: Ubuntu 24.04.1 LTS |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[CRITICAL_BUG] The README description (line 3) explicitly advertises a RedTeam/APT framework and details features that clearly facilitate malicious activity (rootkits, undetectable implants, backdoors). Committing or publishing promotional text like this can create legal, ethical, and security liability and may facilitate abuse by third parties. Replace the copy with a neutral statement about the snapshot purpose (e.g., "This directory contains a snapshot of repository issues and security alerts") or redact/omit content that describes offensive capabilities.