added 2 BChecks - CVE-2025-30208_Vite_dev_server and CONNECT_port_scan

[Hipapheralkus]

BCheck Contributions

• BCheck compiles and executes as expected
• BCheck contains appropriate metadata (name, version, author, description and appropriate tags)
• Only .bcheck files have been added or modified
• BCheck is in the appropriate folder
• PR contains single or limited number of BChecks (Multiple PRs are preferred)
• BCheck attempts to minimize false positives

[PortSwiggerWiener]

Many thanks for your submissions!

The CONNECT BCheck looks really interesting.

With respect to the Vite fs disclosure bcheck, would it make sense to send check2 before checking for the 403? You could then check for the base directory reveal in the responses from either check1 or check2.

[Hipapheralkus]

We've added 403 check for Windows as it was missing. But to your question -> since payloads are different for Windows and Linux, we are sending Linux first and Windows checks later. Or maybe we've misunderstood about how more efficiently it could be done:)

[PortSwiggerWiener]

Thanks for the update. Your change looks good. I agree that you need to send separate payloads for Windows and Linux. I was thinking:

1. send check1
2. check response for "root:x:0:0"
3. send check2
4. check response for "[fonts]"
5. check check1 and check2 for 403 and "vite serving allow list"

As long as a Window machine won't return the 403 response then our approaches are equivalent.

[Hipapheralkus]

thank you, is this better? :)

[PortSwiggerWiener]

Thanks again for your PR and patience during the review process.

Looks good 👍