Release v1.1.4

Added

• Argument injection 2234bc6
  • ssh
    • Command execution via authorized_keys and id_*.pub
• Command injection 0b8edca
  • Using PERL5OPT environment variable to execute commands
  • Using PERL5DB environment variable to execute commands
  • Using PERLLIB and PERL5LIB environment variables to execute commands
  • Using PYTHONWARNINGS environment variable to execute commands
  • Using NODE_OPTIONS environment variable to execute commands
  • Using RUBYOPT environment variable to execute commands
• HTML injection d930245
  • Using link to exfiltrate data via DNS
• Content Security Policy fd417e5
  • Common misconfigurations
  • Using third-party frameworks to bypass CSP
  • Abusing CSP to exfiltrate data
  • Script gadgets
• GitHub Action fbe8adc
  • Using GITHUB_TOKEN to trigger workflow_dispatch and repository_dispatch workflows in the post-exploitation stage

Updated

• HTML injection d930245
  • Refactoring
• GitHub Action fbe8adc
  • Refactoring of the "potential impact of a compromised runner workflow" section