From 7fc3847bbbeaccbda97b3a0189f68f991ef006d4 Mon Sep 17 00:00:00 2001
From: Edwin Noorlander <edwin@noorlander.info>
Date: Sat, 8 Aug 2026 18:45:10 +0200
Subject: [PATCH] merge from development

---
 cli/test/pentest/pentest_results.txt | 72 ++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 cli/test/pentest/pentest_results.txt

diff --git a/cli/test/pentest/pentest_results.txt b/cli/test/pentest/pentest_results.txt
new file mode 100644
index 0000000..54eab9f
--- /dev/null
+++ b/cli/test/pentest/pentest_results.txt
@@ -0,0 +1,72 @@
+🔒 CodePress CMS Penetration Test
+Target: http://localhost:8080
+Date: za  8 aug 2026 18:09:52 CEST
+========================================
+
+1. XSS VULNERABILITY TESTS
+----------------------------
+[SAFE] XSS in page parameter - Attack blocked
+[SAFE] XSS in search parameter - Attack blocked
+[SAFE] XSS in lang parameter - Attack blocked
+[SAFE] XSS with HTML entities - Attack blocked
+[SAFE] XSS with SVG - Attack blocked
+[SAFE] XSS with IMG tag - Attack blocked
+
+2. PATH TRAVERSAL TESTS
+------------------------
+[SAFE] Path traversal - basic - Attack blocked
+[SAFE] Path traversal - URL encoded - Attack blocked
+[SAFE] Path traversal - double encoding - Attack blocked
+[SAFE] Path traversal - backslash - Attack blocked
+[SAFE] Path traversal - mixed separators - Attack blocked
+[SAFE] Path traversal - config access - Attack blocked
+
+3. PHP CODE INJECTION TESTS
+----------------------------
+[SAFE] PHP wrapper - base64 - Attack blocked
+[SAFE] Data URI PHP execution - Attack blocked
+[SAFE] Expect wrapper - Attack blocked
+
+4. NULL BYTE INJECTION TESTS
+-----------------------------
+[SAFE] Null byte in page - Attack blocked
+[UNKNOWN] Null byte bypass extension - Unexpected response
+
+5. COMMAND INJECTION TESTS
+---------------------------
+[SAFE] Command injection in search - Attack blocked
+[SAFE] Command injection with backticks - Attack blocked
+[SAFE] Command injection with pipe - Attack blocked
+
+6. TEMPLATE INJECTION TESTS
+----------------------------
+[SAFE] Mustache SSTI - basic - Attack blocked
+[SAFE] Mustache SSTI - complex - Attack blocked
+
+7. HTTP HEADER INJECTION TESTS
+-------------------------------
+[VULNERABLE] CRLF injection - Header injection successful
+
+8. INFORMATION DISCLOSURE TESTS
+--------------------------------
+[SAFE] PHP version hidden
+[SAFE] Directory listing - Attack blocked
+[SAFE] Config file access - Attack blocked
+[SAFE] Composer dependencies - Attack blocked
+
+9. SECURITY HEADERS CHECK
+--------------------------
+[PRESENT] X-Frame-Options header
+[PRESENT] Content-Security-Policy header
+[PRESENT] X-Content-Type-Options header
+
+10. DOS VULNERABILITY TESTS
+---------------------------
+[SAFE] Large parameter DOS - Server handled large parameter gracefully (200)
+
+PENETRATION TEST SUMMARY
+=========================
+
+Total tests: 30
+Vulnerabilities found: 1
+Safe tests: 29