Repository navigation
apileaks v0.2.2
v0.2.2 - JWT Algorithm Confusion SSH key support & HTTP engine fix
New Features:
- SSH public key support for algorithm confusion attacks (ssh-rsa, ecdsa-sha2)
- Automatic detection and loading of OpenSSH key format without manual PEM conversion
- SSH key variants (ssh_original, ssh_serialized) tried first as HMAC secrets
- Response body displayed when content length differs from baseline
Bug Fixes:
- Fixed HTTPRequestEngine passing empty params={} to httpx which corrupted
URLs containing query strings (caused 400 Bad Request on Flask/Werkzeug servers) - Improved response analyzer to detect same-status-code vulnerabilities when
response body changes significantly (common in CTF/lab environments)
Improvements:
- Reordered algorithm confusion key variants for faster exploitation
- Better vulnerability detection confidence scoring for content-based analysis