fix: exclude superseded vulnerabilities from token coverage exploited count - #366
Merged
l50 merged 1 commit intoJul 30, 2026
Merged
Conversation
…d count **Added:** - Superseded vulnerability tracking to token coverage - `compute_token_coverage_rows` and `build_token_coverage_json` now accept a `superseded` set so IDs credited by another path (rather than proven) do not raise the exploited count, while their category still renders as unproven - `superseded` field to per-vulnerability JSON output, exposing supersession state in the machine-readable loot view - `json.rs` - CVE-specific token categories for `printnightmare`, `zerologon`, and `nopac` so these techniques carry their own scoreboard category instead of falling through to `other` - `display.rs` - Test coverage for superseded exclusion, fully-superseded categories rendering as unproven, superseded implicit tokens keeping their row, and CVE technique category mapping - `display.rs`, `json.rs` **Changed:** - Exploited counting logic in both text and JSON coverage builders to skip IDs present in the superseded set, treating supersession credit as unproven rather than proven - `token_category_unknown_falls_through_to_other` test now uses `wombat_dc01` since `zerologon` and `nopac` are no longer categorized as `other`
l50
added a commit
to l50/DreadGOAD
that referenced
this pull request
Jul 30, 2026
**Changed:** - Expanded `aresTokenBucket` documentation to explain that the exploited-count fix is fork-only (l50/ares#366) and that stock dreadnode/ares builds over-credit back-credited techniques - `transport_ares.go` - Rewrote `uncreditableCategories` comments to distinguish zerologon as a detection-only refusal from printnightmare as a policy refusal, and to note that stock builds collapse printnightmare, zerologon, and nopac back into "other" - `transport_ares.go` - Updated test comments and case names to reference l50/ares#366 and reflect the refined refusal rationale - `transport_ares_test.go`
l50
added a commit
to l50/DreadGOAD
that referenced
this pull request
Jul 30, 2026
**Changed:** - Updated code comments in `transport_ares.go` to use canonical `l50/ares#366` and `l50/ares#367` issue references instead of ambiguous `ares-cli` naming - Expanded `aresTokenBucket` and `uncreditableCategories` documentation to explain that the exploited-count fix and category promotions are fork-only, warning that stock `dreadnode/ares` builds will over-credit or silently stop crediting techniques - Updated test case names in `transport_ares_test.go` to match the new `l50/ares#366` and `l50/ares#367` issue references
l50
added a commit
to l50/DreadGOAD
that referenced
this pull request
Jul 30, 2026
**Key Changes:** - Documented that the ares#366/dreadnode#367 fixes are fork-only (l50/ares) and absent from dreadnode/ares - Added caveats explaining over-crediting and silent under-crediting risks against a stock ares build - Updated all issue references from generic "ares-cli"/"ares" to fully-qualified "l50/ares" repo paths **Changed:** - Corrected upstream issue references throughout `transport_ares.go` and `transport_ares_test.go`, replacing ambiguous "ares-cli dreadnode#366"/"ares dreadnode#367" mentions with fully-qualified "l50/ares#366" and "l50/ares#367" identifiers - Expanded the `aresTokenBucket` doc comment to explain that the exploited-count fix relies on fork-only changes to `build_token_coverage_json` and `state/reader.rs`, warning that stock builds lack `KEY_SUPERSEDED` and will over-credit back-credited techniques - Extended the `uncreditableCategories` documentation to clarify the category promotion is fork-only, detailing how zerologon, nopac, and printnightmare collapse back to "other" against dreadnode/ares and cause silent crediting failures for nopac and printnightmare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
printnightmare,zerologon, andnopacas first-class CVE technique categories instead of falling through tootherAdded:
printnightmare,zerologon, andnopacto dedicated scoreboard categories intoken_category, ensuring these techniques carry their own coverage rows (display.rs)display.rsandjson.rsChanged:
compute_token_coverage_rowsandprint_token_coverageto accept asupersededset and skip incrementing the exploited count for IDs credited only by supersession, since a technique reached only through supersession is unproven (display.rs)build_token_coverage_jsonto accept and honor thesupersededset, and added a per-vulnerabilitysupersededflag to the JSON loot output so text and JSON views stay in lock-step (json.rs)