RASP.Net is a security research project. If you discover a vulnerability in the RASP itself (ironic, we know!), please report it responsibly.

DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: [rasp.net.passerby434@passinbox.com] with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We will respond within 48 hours and provide a timeline for a fix.

This is a Proof of Concept with inherent limitations:

1. No Taint Tracking: The RASP does not track data flow through variables

   • Impact: Obfuscated attacks may bypass detection
   • Mitigation: Defense-in-depth approach (detect at entry + sink)

2. Signature-Based Detection: Uses regex patterns, not behavioral analysis

   • Impact: Novel/zero-day attacks may not be detected
   • Mitigation: Regular pattern updates

3. Performance Overhead: All interception adds latency

   • Impact: ~3-5% throughput reduction in high-load scenarios
   • Mitigation: Benchmarking tools provided

• ❌ NoSQL Injection (MongoDB, Cosmos DB)
• ❌ LDAP Injection
• ❌ XML External Entity (XXE)
• ❌ Server-Side Template Injection (SSTI)
• ⚠️ XSS (Partial: only in gRPC string fields)

If you're deploying RASP.Net in a test/production environment:

RASP is not a replacement for:

• Input validation at API boundaries
• Parameterized queries (use EF Core correctly!)
• Web Application Firewalls (WAF)
• Network segmentation

builder.Services.AddRasp(options =>
{
    options.EnableDetailedLogging = true; // ⚠️ May log sensitive data
    options.BlockMode = true; // false = monitor-only mode
});

Warning: Detailed logging may capture sensitive data in payloads. Ensure logs are secured.

Add legitimate patterns to allowlist:

{
  "Rasp": {
    "Allowlist": {
      "Patterns": [
        "SELECT * FROM Users WHERE Name = 'O''Reilly'"
      ]
    }
  }
}

# Check for updates
dotnet list package --outdated

# Update RASP packages
dotnet add package Rasp.Core --version 1.x.x

Vulnerability: URL-encoded payloads bypass gRPC interceptor

payload = urllib.parse.quote("' OR '1'='1")
# RASP doesn't decode before inspection

Fix: Add URL decoding before pattern matching

Vulnerability: Complex regex causes ReDoS

// Bad: Catastrophic backtracking
Regex.Match(input, @"(a+)+b");

Fix: Use RegexOptions.NonBacktracking (. NET 7+)

Security researchers who responsibly disclose vulnerabilities will be recognized here (with permission).

• OWASP RASP Cheat Sheet
• CWE-89: SQL Injection
• OWASP Top 10

Remember: This is an educational project. Use in production at your own risk. 🚀