mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-21 20:18:06 +02:00
15 lines
431 B
Go
15 lines
431 B
Go
// SSRF — adversarial collision fixture.
|
|
// Prints "daemon:" unconditionally without making any HTTP request
|
|
// and without emitting __NYX_SINK_HIT__.
|
|
// Expected verdict: Inconclusive(OracleCollisionSuspected)
|
|
// Entry: FetchURL(targetURL string) Cap: SSRF
|
|
|
|
package entry
|
|
|
|
import "fmt"
|
|
|
|
func FetchURL(targetURL string) {
|
|
// Coincidental oracle match — not an HTTP sink.
|
|
fmt.Println("daemon: present")
|
|
_ = len(targetURL)
|
|
}
|