Skip to content

apileaks v0.2.2

Choose a tag to compare

@MoisesTapia MoisesTapia released this 08 Jul 02:54
· 16 commits to main since this release

v0.2.2 - JWT Algorithm Confusion SSH key support & HTTP engine fix

New Features:

  • SSH public key support for algorithm confusion attacks (ssh-rsa, ecdsa-sha2)
  • Automatic detection and loading of OpenSSH key format without manual PEM conversion
  • SSH key variants (ssh_original, ssh_serialized) tried first as HMAC secrets
  • Response body displayed when content length differs from baseline

Bug Fixes:

  • Fixed HTTPRequestEngine passing empty params={} to httpx which corrupted
    URLs containing query strings (caused 400 Bad Request on Flask/Werkzeug servers)
  • Improved response analyzer to detect same-status-code vulnerabilities when
    response body changes significantly (common in CTF/lab environments)

Improvements:

  • Reordered algorithm confusion key variants for faster exploitation
  • Better vulnerability detection confidence scoring for content-based analysis