0sec-cli 0.15.0 → 0.18.0

package/chunks/pre-recon-cve-66EB6G4M.js

@@ -0,0 +1,351 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  runWpFingerprint
+} from "./chunk-3MOLBTLS.js";
+import "./chunk-IR537GON.js";
+
+// packages/core/dist/pre-recon-cve.js
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+function findManifests(repoPath, kinds, maxDepth = 4) {
+  const SKIP_DIRS = /* @__PURE__ */ new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".next",
+    ".nuxt",
+    ".svelte-kit",
+    "target",
+    "vendor",
+    "venv",
+    ".venv",
+    "__pycache__",
+    ".pytest_cache",
+    "out",
+    ".cache",
+    "coverage"
+  ]);
+  const found = [];
+  function walk(dir, depth) {
+    if (depth > maxDepth)
+      return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (SKIP_DIRS.has(entry))
+        continue;
+      const abs = join(dir, entry);
+      let st;
+      try {
+        st = statSync(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(abs, depth + 1);
+      } else if (st.isFile()) {
+        for (const kind of kinds) {
+          if (entry === kind.filename) {
+            found.push({
+              kind,
+              absPath: abs,
+              relPath: relative(repoPath, abs)
+            });
+          }
+        }
+      }
+    }
+  }
+  walk(repoPath, 0);
+  return found;
+}
+function runNpmAudit(manifestPath, manifestRel) {
+  const dir = manifestPath.replace(/\/(?:package-lock\.json|package\.json)$/, "");
+  let output;
+  try {
+    output = execFileSync("npm", ["audit", "--json"], {
+      cwd: dir,
+      timeout: 3e4,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch (err) {
+    output = (err && typeof err.stdout === "string" ? err.stdout : "") || "";
+    if (!output)
+      return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(output);
+  } catch {
+    return [];
+  }
+  const advisories = [];
+  const vulns = parsed.vulnerabilities ?? {};
+  for (const [pkgName, vuln] of Object.entries(vulns)) {
+    const sev = vuln.severity;
+    if (sev !== "high" && sev !== "critical")
+      continue;
+    const via = Array.isArray(vuln.via) ? vuln.via : [];
+    let advisoryAdded = false;
+    for (const v of via) {
+      if (typeof v === "object" && v !== null && v.title) {
+        advisories.push({
+          manifest: manifestRel,
+          tool: "npm-audit",
+          package: pkgName,
+          version: typeof vuln.range === "string" ? vuln.range : void 0,
+          vulnerableRange: typeof v.range === "string" ? v.range : void 0,
+          id: String(v.source ?? v.url ?? v.title),
+          title: String(v.title),
+          severity: sev,
+          url: typeof v.url === "string" ? v.url : void 0
+        });
+        advisoryAdded = true;
+      }
+    }
+    if (!advisoryAdded) {
+      advisories.push({
+        manifest: manifestRel,
+        tool: "npm-audit",
+        package: pkgName,
+        severity: sev,
+        id: `npm-audit:${pkgName}`,
+        title: `Transitive ${sev} advisory in ${pkgName} (see npm audit for chain)`
+      });
+    }
+  }
+  return advisories;
+}
+function runPipAudit(manifestPath, manifestRel) {
+  const dir = manifestPath.replace(/\/requirements\.txt$/, "");
+  let output;
+  try {
+    output = execFileSync("pip-audit", ["--requirement", "requirements.txt", "--format", "json"], {
+      cwd: dir,
+      timeout: 6e4,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch (err) {
+    if (err && err.code === "ENOENT")
+      return [];
+    output = (err && typeof err.stdout === "string" ? err.stdout : "") || "";
+    if (!output)
+      return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(output);
+  } catch {
+    return [];
+  }
+  const advisories = [];
+  const dependencies = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
+  for (const dep of dependencies) {
+    const pkgName = dep.name;
+    const version = dep.version;
+    const vulns = Array.isArray(dep.vulns) ? dep.vulns : [];
+    for (const v of vulns) {
+      const id = String(v.id ?? "");
+      const isCveOrGhsa = /^(CVE-|GHSA-)/i.test(id);
+      if (!isCveOrGhsa)
+        continue;
+      advisories.push({
+        manifest: manifestRel,
+        tool: "pip-audit",
+        package: String(pkgName),
+        version: typeof version === "string" ? version : void 0,
+        id,
+        title: String(v.description ?? v.id ?? "pip-audit advisory"),
+        severity: "high",
+        url: typeof v.aliases?.[0] === "string" ? v.aliases[0] : void 0
+      });
+    }
+  }
+  return advisories;
+}
+var MANIFEST_KINDS = [
+  { filename: "package-lock.json", tool: "npm-audit", run: runNpmAudit },
+  { filename: "requirements.txt", tool: "pip-audit", run: runPipAudit }
+  // Future: bundle-audit (Gemfile.lock), composer audit (composer.lock),
+  // cargo audit (Cargo.lock), govulncheck (go.sum). Each goes here as a
+  // new ManifestKind entry. Out of scope for the initial Phase 4 patch.
+];
+function runPreReconCveCheck(repoPath) {
+  const start = Date.now();
+  const advisories = [];
+  const scanned = [];
+  const skipped = [];
+  if (!existsSync(repoPath)) {
+    return { advisories, manifestsScanned: scanned, manifestsSkipped: skipped, durationMs: 0 };
+  }
+  const manifests = findManifests(repoPath, MANIFEST_KINDS);
+  for (const { kind, absPath, relPath } of manifests) {
+    try {
+      const found = kind.run(absPath, relPath);
+      scanned.push(relPath);
+      advisories.push(...found);
+    } catch (err) {
+      skipped.push({
+        manifest: relPath,
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return {
+    advisories,
+    manifestsScanned: scanned,
+    manifestsSkipped: skipped,
+    durationMs: Date.now() - start
+  };
+}
+function formatPreReconForPrompt(report) {
+  if (report.advisories.length === 0)
+    return null;
+  const seen = /* @__PURE__ */ new Set();
+  const uniqueLines = [];
+  for (const a of report.advisories) {
+    const key = `${a.package}::${a.id}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    const range = a.vulnerableRange ? ` (vulnerable: ${a.vulnerableRange})` : "";
+    const url = a.url ? ` \u2014 ${a.url}` : "";
+    uniqueLines.push(`- \`${a.package}\`${a.version ? `@${a.version}` : ""}: **${a.severity}** \u2014 ${a.title} [${a.id}]${range}${url}`);
+  }
+  const limited = uniqueLines.slice(0, 30);
+  const more = uniqueLines.length > limited.length ? `
+
+_(${uniqueLines.length - limited.length} more advisories suppressed; see npm audit / pip-audit on the source tree for the full list)_` : "";
+  return [
+    "## Priority CVE leads from source-tree audit",
+    "",
+    "The following high/critical advisories were found by running `npm audit` / `pip-audit` against the package manifests in the source tree before this scan started. The vulnerable versions are confirmed installed. **Investigate these as your first priority** \u2014 the running target almost certainly inherits at least one of them, and the exploit chain may already be public.",
+    "",
+    ...limited,
+    more,
+    ""
+  ].join("\n");
+}
+async function detectWordPressCheap(target, fetchImpl, timeoutMs, headers) {
+  const base = target.replace(/\/+$/, "");
+  const paths = ["wp-login.php", "readme.html", "wp-includes/version.php"];
+  const evidence = [];
+  const results = await Promise.all(paths.map(async (p) => {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), timeoutMs);
+      const res = await fetchImpl(`${base}/${p}`, {
+        method: "GET",
+        headers: headers ?? {}
+      }).finally(() => clearTimeout(timer));
+      const body = await res.text().catch(() => "");
+      return { path: p, ok: res.ok, status: res.status, body };
+    } catch {
+      return void 0;
+    }
+  }));
+  for (const r of results) {
+    if (!r)
+      continue;
+    if (r.path === "wp-login.php" && r.ok && /wp-submit|user_login|wp-login/i.test(r.body)) {
+      evidence.push("wp-login.php");
+    }
+    if (r.path === "readme.html" && r.ok && /wordpress/i.test(r.body)) {
+      evidence.push("readme.html");
+    }
+    if (r.path === "wp-includes/version.php" && r.ok && /\$wp_version/.test(r.body)) {
+      evidence.push("wp-includes/version.php");
+    }
+  }
+  return evidence;
+}
+async function runPreReconWordPress(opts) {
+  const start = Date.now();
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const timeoutMs = opts.timeoutMs ?? 8e3;
+  try {
+    const evidence = await detectWordPressCheap(opts.target, fetchImpl, timeoutMs, opts.headers);
+    if (evidence.length === 0) {
+      return {
+        isWordPress: false,
+        detectionEvidence: [],
+        durationMs: Date.now() - start
+      };
+    }
+    const fingerprint = await runWpFingerprint({
+      target: opts.target,
+      fetchImpl,
+      timeoutMs,
+      skipOsv: opts.skipOsv,
+      headers: opts.headers
+    });
+    return {
+      isWordPress: true,
+      detectionEvidence: evidence,
+      fingerprint,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      isWordPress: false,
+      detectionEvidence: [],
+      durationMs: Date.now() - start,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function formatPreReconWordPressForPrompt(report) {
+  if (!report.isWordPress || !report.fingerprint)
+    return null;
+  const fp = report.fingerprint;
+  if (fp.plugins.length === 0 && fp.themes.length === 0 && fp.findings.length === 0) {
+    return null;
+  }
+  const lines = [];
+  lines.push("## WordPress pre-recon");
+  lines.push("");
+  lines.push(`Phase-4 auto-detected WordPress at the target before the attack agent started. Core version: ${fp.coreVersion ?? "unknown"}. Detection evidence: ${report.detectionEvidence.join(", ")}.`);
+  lines.push("");
+  lines.push(`Enumerated **${fp.plugins.length} plugin${fp.plugins.length === 1 ? "" : "s"}** and **${fp.themes.length} theme${fp.themes.length === 1 ? "" : "s"}**.`);
+  const withCves = fp.findings.filter((f) => f.cves.length > 0);
+  if (withCves.length > 0) {
+    lines.push("");
+    lines.push(`### Priority WP CVE leads (${withCves.length} affected components)`);
+    lines.push("");
+    lines.push("**Investigate these first** \u2014 the WP fingerprinter confirmed each slug/version pair against the OSV advisory database, so every entry below is a concrete lead, not a guess.");
+    lines.push("");
+    for (const f of withCves.slice(0, 20)) {
+      const ids = f.cves.slice(0, 5).map((c) => c.id).join(", ");
+      const more = f.cves.length > 5 ? ` (+${f.cves.length - 5} more)` : "";
+      lines.push(`- **${f.kind}** \`${f.slug}\`${f.version ? `@${f.version}` : ""}: ${ids}${more}`);
+      for (const hint of f.exploitHints.slice(0, 2)) {
+        lines.push(`  - hint: ${hint}`);
+      }
+    }
+    if (withCves.length > 20) {
+      lines.push("");
+      lines.push(`_(${withCves.length - 20} more affected components suppressed for brevity.)_`);
+    }
+  } else {
+    lines.push("");
+    lines.push("No OSV advisory matches for the enumerated plugin/theme versions.");
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+export {
+  formatPreReconForPrompt,
+  formatPreReconWordPressForPrompt,
+  runPreReconCveCheck,
+  runPreReconWordPress
+};

package/chunks/prepare-MYY743TK.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  detectTargetType,
+  prepare
+} from "./chunk-WU6AFRAZ.js";
+import "./chunk-DW5UWPFY.js";
+import "./chunk-IR537GON.js";
+export {
+  detectTargetType,
+  prepare
+};

package/chunks/process-LQRCS5OY.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  ProcessRuntime
+} from "./chunk-ATATQACO.js";
+import "./chunk-ADOLI6DT.js";
+import "./chunk-6L26OBWI.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  ProcessRuntime
+};

package/chunks/replay-runner-45G3VU7X.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  DEFAULT_DOCKER_HTTP_IMAGE,
+  DEFAULT_DOCKER_SHELL_IMAGE,
+  DEFAULT_STEP_TIMEOUT_MS,
+  DockerRunner,
+  LocalShellRunner,
+  MAX_STREAM_CAPTURE_BYTES,
+  QemuRunner,
+  STREAM_EXCERPT_BYTES,
+  argvForStep,
+  assertionFromStepExpect,
+  evaluateAssertion,
+  excerpt,
+  persistArtifact,
+  runDeterministicReplay
+} from "./chunk-C2WXWFBB.js";
+import "./chunk-KLTNTE2Z.js";
+import "./chunk-6L26OBWI.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  DEFAULT_DOCKER_HTTP_IMAGE,
+  DEFAULT_DOCKER_SHELL_IMAGE,
+  DEFAULT_STEP_TIMEOUT_MS,
+  DockerRunner,
+  LocalShellRunner,
+  MAX_STREAM_CAPTURE_BYTES,
+  QemuRunner,
+  STREAM_EXCERPT_BYTES,
+  argvForStep,
+  assertionFromStepExpect,
+  evaluateAssertion,
+  excerpt,
+  persistArtifact,
+  runDeterministicReplay
+};