@cyanheads/pentest-mcp-server 0.1.2 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (26) hide show
  1. package/AGENTS.md +6 -2
  2. package/CLAUDE.md +6 -2
  3. package/README.md +17 -5
  4. package/changelog/0.1.x/0.1.3.md +21 -0
  5. package/changelog/0.1.x/0.1.4.md +17 -0
  6. package/dist/data/waf-bypass/index.d.ts.map +1 -1
  7. package/dist/data/waf-bypass/index.js +146 -5
  8. package/dist/data/waf-bypass/index.js.map +1 -1
  9. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts +3 -0
  10. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map +1 -1
  11. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js +12 -1
  12. package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js.map +1 -1
  13. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.d.ts +31 -0
  14. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.d.ts.map +1 -0
  15. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js +109 -0
  16. package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js.map +1 -0
  17. package/dist/mcp-server/tools/index.d.ts +28 -1
  18. package/dist/mcp-server/tools/index.d.ts.map +1 -1
  19. package/dist/mcp-server/tools/index.js +3 -1
  20. package/dist/mcp-server/tools/index.js.map +1 -1
  21. package/dist/services/attack/attack-service.d.ts +29 -0
  22. package/dist/services/attack/attack-service.d.ts.map +1 -1
  23. package/dist/services/attack/attack-service.js +99 -0
  24. package/dist/services/attack/attack-service.js.map +1 -1
  25. package/package.json +7 -6
  26. package/server.json +3 -3
package/AGENTS.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # Developer Protocol
2
2
 
3
3
  **Server:** pentest-mcp-server
4
- **Version:** 0.1.2
5
- **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.16`
4
+ **Version:** 0.1.4
5
+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.21`
6
6
  **Engines:** Bun ≥1.3.0, Node ≥24.0.0
7
7
  **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
8
8
  **Zod:** ^4.4.3
@@ -228,6 +228,7 @@ Available skills:
228
228
  | `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |
229
229
  | `release-and-publish` | Push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
230
230
  | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
231
+ | `orchestrations` | Chain task skills into a gated multi-phase pipeline — build-out, QA-fix, update-ship — when you can spawn sub-agents |
231
232
  | `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
232
233
  | `report-issue-local` | File a bug or feature request against this server's own repo via `gh` CLI |
233
234
  | `api-auth` | Auth modes, scopes, JWT/OAuth |
@@ -242,6 +243,8 @@ Available skills:
242
243
  | `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
243
244
  | `api-workers` | Cloudflare Workers runtime |
244
245
 
246
+ **Chaining skills into pipelines.** When the user wants a multi-phase effort — build this server out, QA-and-fix the surface, update-and-ship — *and you can spawn sub-agents*, `skills/orchestrations/SKILL.md` sequences the task skills above into a gated pipeline with verification at each step. Read it to drive the run. Optional: skip it if you can't orchestrate sub-agents, and ignore it entirely if you were *spawned* as one — you've already been scoped to a single phase.
247
+
245
248
  When you complete a skill's checklist, check the boxes and add a completion timestamp at the end (e.g., `Completed: 2026-03-11`).
246
249
 
247
250
  ---
@@ -265,6 +268,7 @@ When you complete a skill's checklist, check the boxes and add a completion time
265
268
  | `npm run start:http` | Production mode (HTTP) |
266
269
  | `npm run changelog:build` | Regenerate `CHANGELOG.md` from `changelog/*.md` |
267
270
  | `npm run changelog:check` | Verify `CHANGELOG.md` is in sync (used by devcheck) |
271
+ | `npm run release:github` | Create GitHub Release from the current annotated tag |
268
272
  | `npm run bundle` | Build and pack as `.mcpb` for one-click Claude Desktop install |
269
273
 
270
274
  ---
package/CLAUDE.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # Developer Protocol
2
2
 
3
3
  **Server:** pentest-mcp-server
4
- **Version:** 0.1.2
5
- **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.16`
4
+ **Version:** 0.1.4
5
+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.21`
6
6
  **Engines:** Bun ≥1.3.0, Node ≥24.0.0
7
7
  **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
8
8
  **Zod:** ^4.4.3
@@ -228,6 +228,7 @@ Available skills:
228
228
  | `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |
229
229
  | `release-and-publish` | Push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
230
230
  | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
231
+ | `orchestrations` | Chain task skills into a gated multi-phase pipeline — build-out, QA-fix, update-ship — when you can spawn sub-agents |
231
232
  | `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
232
233
  | `report-issue-local` | File a bug or feature request against this server's own repo via `gh` CLI |
233
234
  | `api-auth` | Auth modes, scopes, JWT/OAuth |
@@ -242,6 +243,8 @@ Available skills:
242
243
  | `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
243
244
  | `api-workers` | Cloudflare Workers runtime |
244
245
 
246
+ **Chaining skills into pipelines.** When the user wants a multi-phase effort — build this server out, QA-and-fix the surface, update-and-ship — *and you can spawn sub-agents*, `skills/orchestrations/SKILL.md` sequences the task skills above into a gated pipeline with verification at each step. Read it to drive the run. Optional: skip it if you can't orchestrate sub-agents, and ignore it entirely if you were *spawned* as one — you've already been scoped to a single phase.
247
+
245
248
  When you complete a skill's checklist, check the boxes and add a completion timestamp at the end (e.g., `Completed: 2026-03-11`).
246
249
 
247
250
  ---
@@ -265,6 +268,7 @@ When you complete a skill's checklist, check the boxes and add a completion time
265
268
  | `npm run start:http` | Production mode (HTTP) |
266
269
  | `npm run changelog:build` | Regenerate `CHANGELOG.md` from `changelog/*.md` |
267
270
  | `npm run changelog:check` | Verify `CHANGELOG.md` is in sync (used by devcheck) |
271
+ | `npm run release:github` | Create GitHub Release from the current annotated tag |
268
272
  | `npm run bundle` | Build and pack as `.mcpb` for one-click Claude Desktop install |
269
273
 
270
274
  ---
package/README.md CHANGED
@@ -1,13 +1,13 @@
1
1
  <div align="center">
2
2
  <h1>@cyanheads/pentest-mcp-server</h1>
3
3
  <p><b>Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education via MCP. STDIO or Streamable HTTP.</b>
4
- <div>6 Tools</div>
4
+ <div>7 Tools</div>
5
5
  </p>
6
6
  </div>
7
7
 
8
8
  <div align="center">
9
9
 
10
- [![Version](https://img.shields.io/badge/Version-0.1.2-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/pentest-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/pentest-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/pentest-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^5.9.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
10
+ [![Version](https://img.shields.io/badge/Version-0.1.4-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/pentest-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/pentest-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/pentest-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^5.9.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
11
11
 
12
12
  </div>
13
13
 
@@ -35,13 +35,14 @@
35
35
 
36
36
  ## Tools
37
37
 
38
- Six tools spanning the full authorized-testing workflow — from initial scoping through response analysis and payload generation:
38
+ Seven tools spanning the full authorized-testing workflow — from initial scoping through response analysis and payload generation:
39
39
 
40
40
  | Tool | Description |
41
41
  |:-----|:------------|
42
42
  | `pentest_guide` | Returns a step-by-step methodology playbook for the given attack vector, scoped to authorized testing. Each phase covers what to look for, tools, detection indicators for defenders, and mitigations. |
43
43
  | `pentest_analyze_response` | Analyzes a raw server response (headers + body) from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities — each finding paired with remediation. |
44
44
  | `pentest_lookup_technique` | Looks up a MITRE ATT&CK technique by ID or keyword. Returns description, tactics, detection data sources, behavioral indicators, mitigations, and real-world procedure examples. |
45
+ | `pentest_lookup_group` | Looks up a MITRE ATT&CK threat group or software entry by ID or name. Returns aliases, type (group vs. software), description, and the techniques it uses with procedure context. |
45
46
  | `pentest_map_techniques` | Given a target profile (stack, services, auth type, OS), returns ranked ATT&CK techniques and OWASP test cases most relevant to that authorized engagement. |
46
47
  | `pentest_generate_payloads` | Generates annotated payload templates for authorized testing. Each template includes why it works in the injection context, detection signatures, and mitigations. |
47
48
  | `pentest_encode` | Applies an encoding chain to a payload string (URL, double-URL, HTML entity, Unicode, hex, Base64, and more). Returns step-by-step decode explanation and bypass rationale. |
@@ -85,6 +86,17 @@ Single-record ATT&CK lookup. Accepts exact IDs (`T1190`, `T1059.001`) or keyword
85
86
 
86
87
  ---
87
88
 
89
+ ### `pentest_lookup_group`
90
+
91
+ ATT&CK threat group and software lookup. Accepts exact IDs (`G0007`, `S0002`) or name/keyword search (`APT28`, `Mimikatz`).
92
+
93
+ - Covers both intrusion sets (threat groups, G-prefix) and software entries (malware and tools, S-prefix)
94
+ - Returns: name, type (`group` or `software`), aliases, description, and up to 20 techniques used with procedure-level context
95
+ - Technique entries link directly to `pentest_lookup_technique` for full detection and mitigation context
96
+ - Equally useful for defenders building detection coverage around specific adversary tradecraft
97
+
98
+ ---
99
+
88
100
  ### `pentest_map_techniques`
89
101
 
90
102
  Discovery and ranking tool. Takes a target profile, returns prioritized testing scope.
@@ -103,7 +115,7 @@ Context-aware payload template generator for authorized testing. Returns annotat
103
115
 
104
116
  - Fourteen payload categories: `xss`, `sqli`, `ssrf`, `xxe`, `path_traversal`, `ssti`, `command_injection`, `open_redirect`, `csrf`, `deserialization`, `jwt`, `ldap_injection`, `nosql_injection`, `http_header`
105
117
  - Sixteen injection contexts for precision targeting: `html_attribute`, `html_body`, `js_string`, `js_template`, `js_script_block`, `url_parameter`, `url_path`, `sql_where`, `sql_integer`, `xml_element`, `xml_attribute`, `http_header`, `json_value`, `cookie_value`, `file_name`, `generic`
106
- - WAF profile variants: `cloudflare`, `aws_waf`, `modsecurity_crs`, `imperva`, `akamai`, `none`, `unknown` — bypass variants reference public research per WAF product
118
+ - WAF profile variants: `cloudflare`, `aws_waf`, `modsecurity_crs`, `imperva`, `akamai`, `f5_bigip_asm`, `nginx_modsecurity`, `fortinet_fortiwaf`, `none`, `unknown` — bypass variants reference public research per WAF product
107
119
  - Optional encoding chain applied at generation time; up to 20 variants per request
108
120
  - Each template annotated with: vulnerability class, detection signature, mitigation, and WAF bypass notes
109
121
  - `authorized_use_reminder` rendered as the first line of every response
@@ -179,7 +191,7 @@ A public instance is available at `https://pentest.caseyjhand.com/mcp` — no in
179
191
  ```json
180
192
  {
181
193
  "mcpServers": {
182
- "pentest": {
194
+ "pentest-mcp-server": {
183
195
  "type": "streamable-http",
184
196
  "url": "https://pentest.caseyjhand.com/mcp"
185
197
  }
package/changelog/0.1.x/0.1.3.md ADDED
@@ -0,0 +1,21 @@
1
+ ---
2
+ summary: "Adopt @cyanheads/mcp-ts-core 0.9.21: per-request log context fix, secret-stripping in error messages, withRetry fail-fast on non-retryable errors"
3
+ breaking: false
4
+ security: false
5
+ ---
6
+
7
+ # 0.1.3 — 2026-06-02
8
+
9
+ ## Changed
10
+
11
+ - **`@cyanheads/mcp-ts-core`** `^0.9.16` → `^0.9.21` — HTTP transport per-request log context fix (logs and traces carry fresh request + trace/span IDs instead of the frozen boot context); `fetchWithTimeout` strips query-string secrets (e.g. `?api_key=`) from error messages and logs; `withRetry` fails fast on non-retryable errors; `ctx.fail` auto-populates the `retryable` flag.
12
+
13
+ - **Skills** (`skills/`) — 8 updated + new `api-mirror` and `orchestrations` skills added from framework 0.9.21 sync; `devcheck.ts` and `scripts/check-skill-versions.ts`, `scripts/release-github.ts` added.
14
+
15
+ ## Dependencies
16
+
17
+ - `@cyanheads/mcp-ts-core` ^0.9.16 → ^0.9.21
18
+ - `@biomejs/biome` ^2.4.7 → ^2.4.16 (dev)
19
+ - `@types/node` ^25.6.0 → ^25.9.1 (dev)
20
+ - `tsc-alias` ^1.8.16 → ^1.8.17 (dev)
21
+ - `vitest` ^4.1.0 → ^4.1.8 (dev)
package/changelog/0.1.x/0.1.4.md ADDED
@@ -0,0 +1,17 @@
1
+ ---
2
+ summary: "pentest_lookup_group (ATT&CK threat group/software lookup) + expanded WAF bypass dataset (10 → 34 entries, 3 new WAF products)"
3
+ breaking: false
4
+ security: false
5
+ ---
6
+
7
+ # 0.1.4 — 2026-06-04
8
+
9
+ ## Added
10
+
11
+ - **`pentest_lookup_group`** — new tool for MITRE ATT&CK threat group and software lookup ([#3](https://github.com/cyanheads/pentest-mcp-server/issues/3)). Accepts exact G/S-prefix IDs or name/keyword search; returns name, type (`group` vs. `software`), aliases, description, and up to 20 technique-use entries with procedure context. `authorized_use_reminder` in every response; `no_match` error contract.
12
+ - **`AttackGroup` index** in `attack-service.ts` — parallel `groupById`/`groupKeywordIndex` maps built at startup from `intrusion-set`, `malware`, and `tool` STIX objects; `lookupGroupById()` and `searchGroups()` methods; alias fields read correctly per STIX type (`aliases` for intrusion-sets, `x_mitre_aliases` for malware/tool).
13
+
14
+ ## Changed
15
+
16
+ - **WAF bypass dataset** expanded from 10 to 34 entries ([#4](https://github.com/cyanheads/pentest-mcp-server/issues/4)). New coverage: Cloudflare (`path_traversal`, `cmd_injection`, `xxe`, `open_redirect`), AWS WAF (`ssrf`, `path_traversal`, `cmd_injection`), ModSecurity CRS (`ssrf`, `cmd_injection`, `xxe`), Imperva (`sqli`, `ssrf`, `path_traversal`), Akamai (`sqli`, `ssrf`, `path_traversal`), F5 BIG-IP ASM (`xss`, `sqli`, `ssrf`), Nginx ModSecurity (`xss`, `sqli`), Fortinet FortiWAF (`xss`, `sqli`). All entries cite publicly available references.
17
+ - **`pentest_generate_payloads` `waf_profile` enum** extended with `f5_bigip_asm`, `nginx_modsecurity`, `fortinet_fortiwaf` to surface the new bypass entries.
package/dist/data/waf-bypass/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA6EzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA6PzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}
package/dist/data/waf-bypass/index.js CHANGED
@@ -4,7 +4,7 @@
4
4
  */
5
5
  /** Known WAF bypass techniques from public research. */
6
6
  export const wafBypassNotes = [
7
- // Cloudflare
7
+ // ── Cloudflare ────────────────────────────────────────────────────────────────
8
8
  {
9
9
  waf: 'cloudflare',
10
10
  category: 'xss',
@@ -23,7 +23,31 @@ export const wafBypassNotes = [
23
23
  technique: 'IPv6 representation of loopback (::1, ::ffff:127.0.0.1), decimal IP notation (2130706433 = 127.0.0.1), octal notation (0177.0.0.1). DNS rebinding via services like singularity or similar.',
24
24
  reference: 'Public SSRF bypass research — hackerone disclosures, portswigger web security academy',
25
25
  },
26
- // AWS WAF
26
+ {
27
+ waf: 'cloudflare',
28
+ category: 'path_traversal',
29
+ technique: 'URL-encoded dot-dot-slash variants (%2e%2e%2f, %2e%2e/, ..%2f) can bypass path-normalization checks if the WAF decodes before matching. Double URL-encoding (%252e%252e%252f) exploits single-decode WAF rules. Null bytes (%00) may truncate path matching on some backends.',
30
+ reference: 'PortSwigger Web Security — path traversal labs; OWASP Testing Guide OTG-AUTHZ-001',
31
+ },
32
+ {
33
+ waf: 'cloudflare',
34
+ category: 'cmd_injection',
35
+ technique: "Bash brace expansion ({ls,/etc/passwd}), IFS substitution (${IFS}), and $() command substitution may evade keyword-based filters. Hex-encoded command strings passed through $'\\x6c\\x73' bypass literal pattern matching.",
36
+ reference: 'Public command injection bypass research — HackerOne disclosed reports',
37
+ },
38
+ {
39
+ waf: 'cloudflare',
40
+ category: 'xxe',
41
+ technique: 'External entity declarations split across CDATA or parameter entities can bypass inline rule matching. Encoding the DOCTYPE declaration via UTF-16 or BOM-prefixed UTF-8 may shift pattern offsets past WAF rules.',
42
+ reference: 'PortSwigger Web Security — XXE injection; OWASP XXE cheat sheet',
43
+ },
44
+ {
45
+ waf: 'cloudflare',
46
+ category: 'open_redirect',
47
+ technique: 'Protocol-relative URLs (//evil.com) and URL fragments (#redirect) may bypass destination allow-listing when the WAF only inspects the path component. Double-slash and backslash variants (\\\\evil.com) exploit browser normalization differences.',
48
+ reference: 'OWASP Unvalidated Redirects and Forwards cheat sheet; public HackerOne disclosures',
49
+ },
50
+ // ── AWS WAF ───────────────────────────────────────────────────────────────────
27
51
  {
28
52
  waf: 'aws_waf',
29
53
  category: 'xss',
@@ -36,7 +60,25 @@ export const wafBypassNotes = [
36
60
  technique: 'AWS WAF SQL injection rules focus on common SQL keywords. Encoding individual characters in SQL keywords, or using database-specific syntax variations, can reduce detection rate. Test with both URL-encoding and hex-encoding.',
37
61
  reference: 'AWS WAF SQL injection protection documentation',
38
62
  },
39
- // ModSecurity CRS
63
+ {
64
+ waf: 'aws_waf',
65
+ category: 'ssrf',
66
+ technique: 'AWS WAF does not natively block SSRF payloads — blocking relies on custom rules or application-layer controls. IPv6-mapped IPv4 addresses (::ffff:169.254.169.254) and decimal IP representation bypass simple string matching on the metadata endpoint address.',
67
+ reference: 'AWS Security Blog — protecting SSRF with WAF; HackerOne cloud SSRF disclosures',
68
+ },
69
+ {
70
+ waf: 'aws_waf',
71
+ category: 'path_traversal',
72
+ technique: 'AWS Managed Rules path traversal detection is limited; crafted paths using %c0%ae (overlong UTF-8 for ".") or Windows UNC-style paths (\\\\..\\\\) may not be normalized before matching. Custom rate-based rules are the primary defense layer.',
73
+ reference: 'AWS WAF managed rule group documentation; OWASP path traversal guide',
74
+ },
75
+ {
76
+ waf: 'aws_waf',
77
+ category: 'cmd_injection',
78
+ technique: 'AWS WAF regex-based rules for command injection check common shell metacharacters. Obfuscation via environment variable indirection ($SHELL), string concatenation (c"at"), and here-string constructs (<<<) may evade static pattern matching.',
79
+ reference: 'AWS WAF custom rule documentation; public AWS WAF bypass research',
80
+ },
81
+ // ── ModSecurity CRS ───────────────────────────────────────────────────────────
40
82
  {
41
83
  waf: 'modsecurity_crs',
42
84
  category: 'xss',
@@ -55,20 +97,119 @@ export const wafBypassNotes = [
55
97
  technique: 'CRS detects ../ patterns. URL normalization bypass: use path segments that normalize to traversal after server-side URL decode (e.g., %2e%2e%2f). Request path vs. query parameter parsing differences.',
56
98
  reference: 'CRS path traversal rules — coreruleset.org',
57
99
  },
58
- // Imperva
100
+ {
101
+ waf: 'modsecurity_crs',
102
+ category: 'ssrf',
103
+ technique: 'CRS does not include dedicated SSRF rules by default (SSRF is application-logic-dependent). When custom SSRF rules rely on block-list matching, IPv6 loopback variants (::1) and decimal IP notation bypass string-literal checks. Parameter pollution can distribute the URL across multiple values.',
104
+ reference: 'CRS GitHub — SSRF rule discussion; OWASP SSRF prevention cheat sheet',
105
+ },
106
+ {
107
+ waf: 'modsecurity_crs',
108
+ category: 'cmd_injection',
109
+ technique: 'CRS rule 932100–932180 covers OS command injection. Bypass techniques include using $() vs backtick substitution, inserting whitespace via $IFS, and splitting commands with shell arithmetic ((( ))). Anomaly threshold tuning (paranoia level < 3) may leave rule gaps.',
110
+ reference: 'CRS rule documentation — coreruleset.org/docs; GitHub rule source',
111
+ },
112
+ {
113
+ waf: 'modsecurity_crs',
114
+ category: 'xxe',
115
+ technique: 'CRS rules check for DOCTYPE and ENTITY declarations in XML bodies. Bypasses include placing declarations inside CDATA sections, using alternate XML serializations, or splitting the payload across chunked transfer encoding segments.',
116
+ reference: 'CRS XXE rules — coreruleset.org; PortSwigger XXE research',
117
+ },
118
+ // ── Imperva ───────────────────────────────────────────────────────────────────
59
119
  {
60
120
  waf: 'imperva',
61
121
  category: 'xss',
62
122
  technique: 'Imperva protects heavily against reflected XSS. DOM-based XSS sources that do not appear in server responses are often bypassed since WAF inspection is request/response-based. JSON response context XSS.',
63
123
  reference: 'Public Imperva bypass research — security researcher writeups',
64
124
  },
65
- // Akamai
125
+ {
126
+ waf: 'imperva',
127
+ category: 'sqli',
128
+ technique: 'Imperva applies behavioral analysis in addition to signature matching. Bypass attempts include using less-common SQL functions (ELT(), FIELD(), MAKE_SET()), chained comments to split keywords, and time-based blind injection via SLEEP() alternatives (BENCHMARK()). Rotating between different quoting styles may slow correlation.',
129
+ reference: 'Public Imperva SQLi bypass research; PortSwigger SQL injection cheat sheet',
130
+ },
131
+ {
132
+ waf: 'imperva',
133
+ category: 'ssrf',
134
+ technique: 'Imperva WAF SSRF rules depend on configuration. Bypasses leveraging DNS rebinding, redirect chains through open-redirect vulnerabilities, and cloud-metadata IP variants (169.254.169.254 via decimal, octal, or IPv6 forms) are commonly explored in disclosed reports.',
135
+ reference: 'HackerOne disclosed SSRF reports; Orange Tsai SSRF research',
136
+ },
137
+ {
138
+ waf: 'imperva',
139
+ category: 'path_traversal',
140
+ technique: 'Imperva normalizes many URL-encoded traversal patterns. Overlong UTF-8 encodings (%c0%ae for ".") and unicode normalization variants (U+FF0E fullwidth period) may shift pattern matching. Mixing forward and back slashes can exploit OS-level path normalization differences.',
141
+ reference: 'OWASP path traversal testing guide; public Imperva bypass research',
142
+ },
143
+ // ── Akamai ────────────────────────────────────────────────────────────────────
66
144
  {
67
145
  waf: 'akamai',
68
146
  category: 'xss',
69
147
  technique: 'Akamai Kona WAF performs deep inspection. Polyglot payloads combining multiple contexts may evade single-vector detection. HTTP/2-specific headers and pseudo-headers may be inconsistently inspected.',
70
148
  reference: 'Public Akamai WAF bypass research',
71
149
  },
150
+ {
151
+ waf: 'akamai',
152
+ category: 'sqli',
153
+ technique: 'Akamai Kona rules cover standard SQL injection patterns. Bypass research focuses on Unicode whitespace characters (U+00A0, U+2009) as keyword separators, non-standard comment sequences (--+, #), and database-specific functions not covered by generic rule sets.',
154
+ reference: 'Public Akamai Kona bypass research; SQL injection filter evasion — OWASP',
155
+ },
156
+ {
157
+ waf: 'akamai',
158
+ category: 'ssrf',
159
+ technique: 'Akamai edge rules for SSRF are configuration-dependent. IPv6-encoded metadata addresses, URL-encoded host components, and redirect chains through trusted third-party domains are commonly tested bypass vectors in bug bounty disclosures.',
160
+ reference: 'HackerOne disclosed Akamai-protected target SSRF reports',
161
+ },
162
+ {
163
+ waf: 'akamai',
164
+ category: 'path_traversal',
165
+ technique: 'Akamai normalizes standard ../ sequences; bypass attempts use URL-encoded variants (%2e%2e%2f), double-encoded forms (%252e%252e%252f), and Unicode dot equivalents. Request smuggling techniques may shift path parsing between Akamai and the origin.',
166
+ reference: 'PortSwigger path traversal labs; public Akamai bypass writeups',
167
+ },
168
+ // ── F5 BIG-IP ASM ─────────────────────────────────────────────────────────────
169
+ {
170
+ waf: 'f5_bigip_asm',
171
+ category: 'xss',
172
+ technique: 'F5 BIG-IP ASM signature-based XSS detection can be bypassed by mutating event handler names with HTML entity encoding inside attribute values (on&#99;lick=), inserting tab characters between event handler name and "=", and leveraging SVG animate elements with href attributes that are less commonly inspected.',
173
+ reference: 'F5 BIG-IP ASM documentation; public ASM bypass research — security conferences (DEF CON, Black Hat)',
174
+ },
175
+ {
176
+ waf: 'f5_bigip_asm',
177
+ category: 'sqli',
178
+ technique: 'BIG-IP ASM SQL injection signatures cover standard patterns. Bypass research focuses on: using MySQL-specific syntax variations not in the signature set (GROUP_CONCAT, JSON_EXTRACT), using versioned comment syntax (/*!50000 SELECT*/), and exploiting the ASM learning mode where certain parameter types are initially unblocked.',
179
+ reference: 'F5 BIG-IP ASM policy configuration guide; public SQL injection WAF bypass research',
180
+ },
181
+ {
182
+ waf: 'f5_bigip_asm',
183
+ category: 'ssrf',
184
+ technique: 'F5 BIG-IP ASM does not include native SSRF blocking; protection depends on custom signatures or iRules. Attackers probe for gaps using localhost aliases, IPv6 loopback, and DNS rebinding. Internal IP ranges accessed via URL parameters are often not covered by default policy.',
185
+ reference: 'F5 BIG-IP ASM custom signatures documentation; OWASP SSRF prevention cheat sheet',
186
+ },
187
+ // ── Nginx ModSecurity ─────────────────────────────────────────────────────────
188
+ {
189
+ waf: 'nginx_modsecurity',
190
+ category: 'xss',
191
+ technique: 'Nginx ModSecurity typically runs the OWASP CRS. Bypass techniques mirror CRS gaps: anomaly score manipulation, using non-standard HTML event handlers (onpointerrawupdate, onformdata) not yet in the CRS rule set, and multipart body encoding to alter parsing context.',
192
+ reference: 'OWASP CRS — coreruleset.org; Nginx ModSecurity integration documentation; public CRS bypass research',
193
+ },
194
+ {
195
+ waf: 'nginx_modsecurity',
196
+ category: 'sqli',
197
+ technique: 'Running atop CRS, Nginx ModSecurity SQL injection coverage depends on paranoia level. At PL1-2, less-common SQL constructs go undetected. Character encoding tricks (URL-encoding single quotes, hex literals), MySQL-specific CONCAT(0x3a,0x3a) patterns, and chained comment splitting can reduce detection at lower paranoia levels.',
198
+ reference: 'CRS paranoia level documentation — coreruleset.org; OWASP SQL injection cheat sheet',
199
+ },
200
+ // ── Fortinet FortiWAF ─────────────────────────────────────────────────────────
201
+ {
202
+ waf: 'fortinet_fortiwaf',
203
+ category: 'xss',
204
+ technique: 'FortiWAF signature-based XSS detection is evadable via tag variations not in the active signature set (<details open ontoggle=>, <marquee onstart=>), Punycode-encoded domain names in href attributes, and payloads embedded inside JSON or XML response contexts processed client-side.',
205
+ reference: 'FortiWAF documentation; public WAF bypass research — bug bounty disclosures and conference presentations',
206
+ },
207
+ {
208
+ waf: 'fortinet_fortiwaf',
209
+ category: 'sqli',
210
+ technique: 'FortiWAF SQL injection rules cover common patterns. Bypass research focuses on database-specific syntax that diverges from generic rule sets: PostgreSQL dollar-quoting ($$payload$$), MSSQL stacked queries separated by semicolons, and using CHAR() or NCHAR() string construction to reconstruct blocked keywords at the database layer.',
211
+ reference: 'FortiWAF technical documentation; public SQL injection WAF evasion research — OWASP and conference papers',
212
+ },
72
213
  ];
73
214
  /** Get WAF bypass notes for a specific WAF and category. */
74
215
  export function getWafBypassNote(waf, category) {
package/dist/data/waf-bypass/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,aAAa;IACb;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD,UAAU;IACV;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD,kBAAkB;IAClB;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD,UAAU;IACV;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD,SAAS;IACT;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,iFAAiF;IACjF;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,+QAA+Q;QACjR,SAAS,EAAE,mFAAmF;KAC/F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,6NAA6N;QAC/N,SAAS,EAAE,wEAAwE;KACpF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,oNAAoN;QACtN,SAAS,EAAE,iEAAiE;KAC7E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,qPAAqP;QACvP,SAAS,EAAE,oFAAoF;KAChG;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kQAAkQ;QACpQ,SAAS,EAAE,gFAAgF;KAC5F;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,kPAAkP;QACpP,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,iPAAiP;QACnP,SAAS,EAAE,mEAAmE;KAC/E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,uSAAuS;QACzS,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,yOAAyO;QAC3O,SAAS,EAAE,2DAA2D;KACvE;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,0QAA0Q;QAC5Q,SAAS,EAAE,6DAA6D;KACzE;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,iRAAiR;QACnR,SAAS,EAAE,oEAAoE;KAChF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,sQAAsQ;QACxQ,SAAS,EAAE,0EAA0E;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,0DAA0D;KACtE;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yPAAyP;QAC3P,SAAS,EAAE,gEAAgE;KAC5E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,uTAAuT;QACzT,SAAS,EACP,qGAAqG;KACxG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,wUAAwU;QAC1U,SAAS,EAAE,oFAAoF;KAChG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,qRAAqR;QACvR,SAAS,EAAE,kFAAkF;KAC9F;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EACP,sGAAsG;KACzG;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EACP,qFAAqF;KACxF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2RAA2R;QAC7R,SAAS,EACP,0GAA0G;KAC7G;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,8UAA8U;QAChV,SAAS,EACP,2GAA2G;KAC9G;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts CHANGED
@@ -46,6 +46,9 @@ export declare const pentestGeneratePayloadsTool: import("@cyanheads/mcp-ts-core
46
46
  modsecurity_crs: "modsecurity_crs";
47
47
  imperva: "imperva";
48
48
  akamai: "akamai";
49
+ f5_bigip_asm: "f5_bigip_asm";
50
+ nginx_modsecurity: "nginx_modsecurity";
51
+ fortinet_fortiwaf: "fortinet_fortiwaf";
49
52
  none: "none";
50
53
  }>>;
51
54
  encoding: z.ZodOptional<z.ZodArray<z.ZodEnum<{
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAiNtC,CAAC"}
1
+ {"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA4NtC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js CHANGED
@@ -50,7 +50,18 @@ export const pentestGeneratePayloadsTool = tool('pentest_generate_payloads', {
50
50
  ])
51
51
  .describe('Precise injection context. Critical for XSS: an HTML attribute payload differs from a JS string payload. Provide the most specific context for the best results.'),
52
52
  waf_profile: z
53
- .enum(['cloudflare', 'aws_waf', 'modsecurity_crs', 'imperva', 'akamai', 'none', 'unknown'])
53
+ .enum([
54
+ 'cloudflare',
55
+ 'aws_waf',
56
+ 'modsecurity_crs',
57
+ 'imperva',
58
+ 'akamai',
59
+ 'f5_bigip_asm',
60
+ 'nginx_modsecurity',
61
+ 'fortinet_fortiwaf',
62
+ 'none',
63
+ 'unknown',
64
+ ])
54
65
  .default('none')
55
66
  .describe('WAF or filter in front of the authorized test target. When a specific WAF is named, bypass variants referencing known public research are included.'),
56
67
  encoding: z
package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"pentest-generate-payloads.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,MAAM,uBAAuB,GAC3B,2KAA2K,CAAC;AAE9K,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,EAAE;IAC3E,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,moBAAmoB;IACroB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,MAAM;YACN,mBAAmB;YACnB,eAAe;YACf,MAAM;YACN,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,iBAAiB;YACjB,aAAa;SACd,CAAC;aACD,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,iBAAiB,EAAE,CAAC;aACjB,IAAI,CAAC;YACJ,gBAAgB;YAChB,WAAW;YACX,WAAW;YACX,aAAa;YACb,iBAAiB;YACjB,eAAe;YACf,UAAU;YACV,WAAW;YACX,aAAa;YACb,aAAa;YACb,eAAe;YACf,aAAa;YACb,YAAY;YACZ,cAAc;YACd,WAAW;YACX,SAAS;SACV,CAAC;aACD,QAAQ,CACP,kKAAkK,CACnK;QACH,WAAW,EAAE,CAAC;aACX,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aAC1F,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CACP,qJAAqJ,CACtJ;QACH,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,MAAM;YACN,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;SACZ,CAAC;aACD,QAAQ,CAAC,4BAA4B,CAAC,CAC1C;aACA,QAAQ,EAAE;aACV,QAAQ,CACP,0JAA0J,CAC3J;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,+HAA+H,CAChI;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACtE,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,CACP,iHAAiH,CAClH;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;YACH,mBAAmB,EAAE,CAAC;iBACnB,MAAM,EAAE;iBACR,QAAQ,CACP,4GAA4G,CAC7G;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,CACP,8FAA8F,CAC/F;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,uGAAuG,CACxG;SACJ,CAAC;aACD,QAAQ,CACP,wIAAwI,CACzI,CACJ;aACA,QAAQ,CACP,iGAAiG,CAClG;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,8EAA8E;YACpF,QAAQ,EAAE,gFAAgF;SAC3F;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAmB,CAAC;QAE3F,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAC9B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,WAAW,EACjB,aAAa,EACb,KAAK,CAAC,KAAK,EACX,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,CAAC,IAAI,CACZ,aAAa,EACb,4CAA4C,KAAK,CAAC,QAAQ,iBAAiB,KAAK,CAAC,iBAAiB,IAAI,CACvG,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;YACzC,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,eAAe,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,iBAAiB,EAAE;YAC9D,EAAE;SACH,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
1
+ {"version":3,"file":"pentest-generate-payloads.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,MAAM,uBAAuB,GAC3B,2KAA2K,CAAC;AAE9K,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,EAAE;IAC3E,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,moBAAmoB;IACroB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB;YAChB,MAAM;YACN,mBAAmB;YACnB,eAAe;YACf,MAAM;YACN,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,iBAAiB;YACjB,aAAa;SACd,CAAC;aACD,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,iBAAiB,EAAE,CAAC;aACjB,IAAI,CAAC;YACJ,gBAAgB;YAChB,WAAW;YACX,WAAW;YACX,aAAa;YACb,iBAAiB;YACjB,eAAe;YACf,UAAU;YACV,WAAW;YACX,aAAa;YACb,aAAa;YACb,eAAe;YACf,aAAa;YACb,YAAY;YACZ,cAAc;YACd,WAAW;YACX,SAAS;SACV,CAAC;aACD,QAAQ,CACP,kKAAkK,CACnK;QACH,WAAW,EAAE,CAAC;aACX,IAAI,CAAC;YACJ,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,SAAS;YACT,QAAQ;YACR,cAAc;YACd,mBAAmB;YACnB,mBAAmB;YACnB,MAAM;YACN,SAAS;SACV,CAAC;aACD,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CACP,qJAAqJ,CACtJ;QACH,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,MAAM;YACN,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;SACZ,CAAC;aACD,QAAQ,CAAC,4BAA4B,CAAC,CAC1C;aACA,QAAQ,EAAE;aACV,QAAQ,CACP,0JAA0J,CAC3J;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,+HAA+H,CAChI;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACtE,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,CACP,iHAAiH,CAClH;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;YACH,mBAAmB,EAAE,CAAC;iBACnB,MAAM,EAAE;iBACR,QAAQ,CACP,4GAA4G,CAC7G;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,CACP,8FAA8F,CAC/F;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,uGAAuG,CACxG;SACJ,CAAC;aACD,QAAQ,CACP,wIAAwI,CACzI,CACJ;aACA,QAAQ,CACP,iGAAiG,CAClG;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,8EAA8E;YACpF,QAAQ,EAAE,gFAAgF;SAC3F;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAmB,CAAC;QAE3F,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAC9B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,WAAW,EACjB,aAAa,EACb,KAAK,CAAC,KAAK,EACX,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,CAAC,IAAI,CACZ,aAAa,EACb,4CAA4C,KAAK,CAAC,QAAQ,iBAAiB,KAAK,CAAC,iBAAiB,IAAI,CACvG,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;YACzC,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,eAAe,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,iBAAiB,EAAE;YAC9D,EAAE;SACH,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.d.ts ADDED
@@ -0,0 +1,31 @@
1
+ /**
2
+ * @fileoverview pentest_lookup_group — MITRE ATT&CK threat group and software lookup.
3
+ * @module mcp-server/tools/definitions/pentest-lookup-group.tool
4
+ */
5
+ import { z } from '@cyanheads/mcp-ts-core';
6
+ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
7
+ export declare const pentestLookupGroupTool: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
8
+ query: z.ZodString;
9
+ }, z.core.$strip>, z.ZodObject<{
10
+ authorized_use_reminder: z.ZodString;
11
+ id: z.ZodString;
12
+ name: z.ZodString;
13
+ aliases: z.ZodArray<z.ZodString>;
14
+ type: z.ZodEnum<{
15
+ group: "group";
16
+ software: "software";
17
+ }>;
18
+ description: z.ZodString;
19
+ techniques_used: z.ZodArray<z.ZodObject<{
20
+ technique_id: z.ZodString;
21
+ technique_name: z.ZodString;
22
+ description: z.ZodString;
23
+ }, z.core.$strip>>;
24
+ attack_version: z.ZodString;
25
+ }, z.core.$strip>, readonly [{
26
+ readonly reason: "no_match";
27
+ readonly code: JsonRpcErrorCode.NotFound;
28
+ readonly when: "No group or software entry matched the query.";
29
+ readonly recovery: "Try the exact ATT&CK ID (e.g., \"G0007\" for a group, \"S0002\" for software) or broaden the name. Group IDs use a G-prefix; software IDs use an S-prefix.";
30
+ }], undefined>;
31
+ //# sourceMappingURL=pentest-lookup-group.tool.d.ts.map
package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"pentest-lookup-group.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-group.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMjE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;cAiIjC,CAAC"}
package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js ADDED
@@ -0,0 +1,109 @@
1
+ /**
2
+ * @fileoverview pentest_lookup_group — MITRE ATT&CK threat group and software lookup.
3
+ * @module mcp-server/tools/definitions/pentest-lookup-group.tool
4
+ */
5
+ import { tool, z } from '@cyanheads/mcp-ts-core';
6
+ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
7
+ import { getAttackService } from '../../../services/attack/attack-service.js';
8
+ const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: ATT&CK threat group and software data is provided for authorized penetration testing, threat intelligence, and defensive detection coverage only.';
9
+ export const pentestLookupGroupTool = tool('pentest_lookup_group', {
10
+ title: 'Pentest Lookup Group',
11
+ description: 'Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.',
12
+ annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
13
+ input: z.object({
14
+ query: z
15
+ .string()
16
+ .describe('ATT&CK threat group ID (e.g., "G0007"), software ID (e.g., "S0002"), or name/keyword (e.g., "APT28", "Mimikatz", "Lazarus Group"). ID lookup is exact and case-insensitive; name/keyword search returns the best match.'),
17
+ }),
18
+ output: z.object({
19
+ authorized_use_reminder: z
20
+ .string()
21
+ .describe('Reminder that threat group data is for authorized testing and research only. Rendered first.'),
22
+ id: z.string().describe('ATT&CK ID (e.g., "G0007" for a group, "S0002" for software).'),
23
+ name: z.string().describe('Primary display name (e.g., "APT28", "Mimikatz").'),
24
+ aliases: z
25
+ .array(z.string().describe('An alternate name for this group or software.'))
26
+ .describe('Known alternate names from ATT&CK.'),
27
+ type: z
28
+ .enum(['group', 'software'])
29
+ .describe('"group" for intrusion sets (threat actors), "software" for malware and tools.'),
30
+ description: z.string().describe('ATT&CK description (truncated to 800 characters).'),
31
+ techniques_used: z
32
+ .array(z
33
+ .object({
34
+ technique_id: z.string().describe('ATT&CK technique ID (e.g., "T1190").'),
35
+ technique_name: z.string().describe('Technique name.'),
36
+ description: z
37
+ .string()
38
+ .describe('How this group or software used the technique, from public ATT&CK reporting.'),
39
+ })
40
+ .describe('A technique used by this group or software with procedure context.'))
41
+ .describe('Techniques this group or software is known to use, with procedure-level context from public ATT&CK reporting (up to 20 entries). Use pentest_lookup_technique with each technique_id for full technique details including detection and mitigations.'),
42
+ attack_version: z
43
+ .string()
44
+ .describe('ATT&CK dataset version used (e.g., "Enterprise v19.1"). Included so callers know the data vintage.'),
45
+ }),
46
+ errors: [
47
+ {
48
+ reason: 'no_match',
49
+ code: JsonRpcErrorCode.NotFound,
50
+ when: 'No group or software entry matched the query.',
51
+ recovery: 'Try the exact ATT&CK ID (e.g., "G0007" for a group, "S0002" for software) or broaden the name. Group IDs use a G-prefix; software IDs use an S-prefix.',
52
+ },
53
+ ],
54
+ handler(input, ctx) {
55
+ const svc = getAttackService();
56
+ const query = input.query.trim();
57
+ // Try exact ID lookup first (G#### or S####)
58
+ let group = /^[GS]\d{4}$/i.test(query) ? svc.lookupGroupById(query) : undefined;
59
+ // Fall back to keyword/name search
60
+ if (!group) {
61
+ const results = svc.searchGroups(query, ctx);
62
+ group = results[0];
63
+ }
64
+ if (!group) {
65
+ throw ctx.fail('no_match', `No ATT&CK group or software found for query: "${query}"`);
66
+ }
67
+ ctx.log.info('pentest_lookup_group found', {
68
+ id: group.id,
69
+ name: group.name,
70
+ type: group.type,
71
+ });
72
+ return {
73
+ authorized_use_reminder: AUTHORIZED_USE_REMINDER,
74
+ id: group.id,
75
+ name: group.name,
76
+ aliases: group.aliases,
77
+ type: group.type,
78
+ description: group.description,
79
+ techniques_used: group.techniques_used,
80
+ attack_version: group.attack_version,
81
+ };
82
+ },
83
+ format: (result) => {
84
+ const lines = [
85
+ `> ⚠️ ${result.authorized_use_reminder}`,
86
+ '',
87
+ `# ${result.id}: ${result.name}`,
88
+ '',
89
+ `**Type:** ${result.type === 'group' ? 'Threat Group (Intrusion Set)' : 'Software (Malware / Tool)'}`,
90
+ `**ATT&CK Version:** ${result.attack_version}`,
91
+ ];
92
+ if (result.aliases.length > 0) {
93
+ lines.push(`**Aliases:** ${result.aliases.join(', ')}`);
94
+ }
95
+ lines.push('', result.description, '');
96
+ if (result.techniques_used.length > 0) {
97
+ lines.push(`## Techniques Used (${result.techniques_used.length})`);
98
+ lines.push('_Use `pentest_lookup_technique` with each technique ID for full detection and mitigation context._', '');
99
+ for (const t of result.techniques_used) {
100
+ lines.push(`### ${t.technique_id}: ${t.technique_name}`);
101
+ if (t.description)
102
+ lines.push(t.description);
103
+ lines.push('');
104
+ }
105
+ }
106
+ return [{ type: 'text', text: lines.join('\n') }];
107
+ },
108
+ });
109
+ //# sourceMappingURL=pentest-lookup-group.tool.js.map
package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"pentest-lookup-group.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-lookup-group.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,uBAAuB,GAC3B,4KAA4K,CAAC;AAE/K,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,EAAE;IACjE,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,wkBAAwkB;IAC1kB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,CACP,yNAAyN,CAC1N;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CACP,8FAA8F,CAC/F;QACH,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;QACvF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC9E,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;aAC3E,QAAQ,CAAC,oCAAoC,CAAC;QACjD,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;aAC3B,QAAQ,CAAC,+EAA+E,CAAC;QAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QACrF,eAAe,EAAE,CAAC;aACf,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACtD,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,8EAA8E,CAC/E;SACJ,CAAC;aACD,QAAQ,CAAC,oEAAoE,CAAC,CAClF;aACA,QAAQ,CACP,sPAAsP,CACvP;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CACP,oGAAoG,CACrG;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,+CAA+C;YACrD,QAAQ,EACN,wJAAwJ;SAC3J;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEjC,6CAA6C;QAC7C,IAAI,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,mCAAmC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,iDAAiD,KAAK,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACzC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,KAAK,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE;YAChC,EAAE;YACF,aAAa,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,2BAA2B,EAAE;YACrG,uBAAuB,MAAM,CAAC,cAAc,EAAE;SAC/C,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAEvC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YACpE,KAAK,CAAC,IAAI,CACR,oGAAoG,EACpG,EAAE,CACH,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,CAAC,CAAC,WAAW;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
package/dist/mcp-server/tools/index.d.ts CHANGED
@@ -6,9 +6,10 @@ import { pentestAnalyzeResponseTool } from './definitions/pentest-analyze-respon
6
6
  import { pentestEncodeTool } from './definitions/pentest-encode.tool.js';
7
7
  import { pentestGeneratePayloadsTool } from './definitions/pentest-generate-payloads.tool.js';
8
8
  import { pentestGuideTool } from './definitions/pentest-guide.tool.js';
9
+ import { pentestLookupGroupTool } from './definitions/pentest-lookup-group.tool.js';
9
10
  import { pentestLookupTechniqueTool } from './definitions/pentest-lookup-technique.tool.js';
10
11
  import { pentestMapTechniquesTool } from './definitions/pentest-map-techniques.tool.js';
11
- export { pentestAnalyzeResponseTool, pentestEncodeTool, pentestGeneratePayloadsTool, pentestGuideTool, pentestLookupTechniqueTool, pentestMapTechniquesTool, };
12
+ export { pentestAnalyzeResponseTool, pentestEncodeTool, pentestGeneratePayloadsTool, pentestGuideTool, pentestLookupGroupTool, pentestLookupTechniqueTool, pentestMapTechniquesTool, };
12
13
  export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
13
14
  response_headers: import("zod").ZodOptional<import("zod").ZodString>;
14
15
  response_body: import("zod").ZodOptional<import("zod").ZodString>;
@@ -133,6 +134,9 @@ export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolD
133
134
  modsecurity_crs: "modsecurity_crs";
134
135
  imperva: "imperva";
135
136
  akamai: "akamai";
137
+ f5_bigip_asm: "f5_bigip_asm";
138
+ nginx_modsecurity: "nginx_modsecurity";
139
+ fortinet_fortiwaf: "fortinet_fortiwaf";
136
140
  none: "none";
137
141
  }>>;
138
142
  encoding: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
@@ -221,6 +225,29 @@ export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolD
221
225
  readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.InvalidParams;
222
226
  readonly when: "Vector value is not in the supported enum.";
223
227
  readonly recovery: "Use one of the listed enum values for the vector parameter.";
228
+ }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
229
+ query: import("zod").ZodString;
230
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
231
+ authorized_use_reminder: import("zod").ZodString;
232
+ id: import("zod").ZodString;
233
+ name: import("zod").ZodString;
234
+ aliases: import("zod").ZodArray<import("zod").ZodString>;
235
+ type: import("zod").ZodEnum<{
236
+ group: "group";
237
+ software: "software";
238
+ }>;
239
+ description: import("zod").ZodString;
240
+ techniques_used: import("zod").ZodArray<import("zod").ZodObject<{
241
+ technique_id: import("zod").ZodString;
242
+ technique_name: import("zod").ZodString;
243
+ description: import("zod").ZodString;
244
+ }, import("zod/v4/core").$strip>>;
245
+ attack_version: import("zod").ZodString;
246
+ }, import("zod/v4/core").$strip>, readonly [{
247
+ readonly reason: "no_match";
248
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.NotFound;
249
+ readonly when: "No group or software entry matched the query.";
250
+ readonly recovery: "Try the exact ATT&CK ID (e.g., \"G0007\" for a group, \"S0002\" for software) or broaden the name. Group IDs use a G-prefix; software IDs use an S-prefix.";
224
251
  }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
225
252
  query: import("zod").ZodString;
226
253
  include_subtechniques: import("zod").ZodDefault<import("zod").ZodBoolean>;
package/dist/mcp-server/tools/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,0BAA0B,EAC1B,wBAAwB,GACzB,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO9B,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GACzB,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQ9B,CAAC"}
package/dist/mcp-server/tools/index.js CHANGED
@@ -6,13 +6,15 @@ import { pentestAnalyzeResponseTool } from './definitions/pentest-analyze-respon
6
6
  import { pentestEncodeTool } from './definitions/pentest-encode.tool.js';
7
7
  import { pentestGeneratePayloadsTool } from './definitions/pentest-generate-payloads.tool.js';
8
8
  import { pentestGuideTool } from './definitions/pentest-guide.tool.js';
9
+ import { pentestLookupGroupTool } from './definitions/pentest-lookup-group.tool.js';
9
10
  import { pentestLookupTechniqueTool } from './definitions/pentest-lookup-technique.tool.js';
10
11
  import { pentestMapTechniquesTool } from './definitions/pentest-map-techniques.tool.js';
11
- export { pentestAnalyzeResponseTool, pentestEncodeTool, pentestGeneratePayloadsTool, pentestGuideTool, pentestLookupTechniqueTool, pentestMapTechniquesTool, };
12
+ export { pentestAnalyzeResponseTool, pentestEncodeTool, pentestGeneratePayloadsTool, pentestGuideTool, pentestLookupGroupTool, pentestLookupTechniqueTool, pentestMapTechniquesTool, };
12
13
  export const allToolDefinitions = [
13
14
  pentestGuideTool,
14
15
  pentestAnalyzeResponseTool,
15
16
  pentestLookupTechniqueTool,
17
+ pentestLookupGroupTool,
16
18
  pentestMapTechniquesTool,
17
19
  pentestGeneratePayloadsTool,
18
20
  pentestEncodeTool,
package/dist/mcp-server/tools/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp-server/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,0BAA0B,EAC1B,wBAAwB,GACzB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,wBAAwB;IACxB,2BAA2B;IAC3B,iBAAiB;CAClB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp-server/tools/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GACzB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,sBAAsB;IACtB,wBAAwB;IACxB,2BAA2B;IAC3B,iBAAiB;CAClB,CAAC"}
package/dist/services/attack/attack-service.d.ts CHANGED
@@ -3,6 +3,27 @@
3
3
  * @module services/attack/attack-service
4
4
  */
5
5
  import type { Context } from '@cyanheads/mcp-ts-core';
6
+ /** Parsed ATT&CK group or software record (intrusion-set, malware, or tool). */
7
+ export interface AttackGroup {
8
+ /** Alternate names for this group or software. */
9
+ aliases: string[];
10
+ /** ATT&CK dataset version used. */
11
+ attack_version: string;
12
+ /** ATT&CK description (truncated). */
13
+ description: string;
14
+ /** ATT&CK ID (e.g. "G0007" for a group, "S0002" for software). */
15
+ id: string;
16
+ /** Display name (e.g. "APT28", "Mimikatz"). */
17
+ name: string;
18
+ /** Techniques used by this group/software, with procedure context. */
19
+ techniques_used: Array<{
20
+ technique_id: string;
21
+ technique_name: string;
22
+ description: string;
23
+ }>;
24
+ /** Whether this is a threat group or software entry. */
25
+ type: 'group' | 'software';
26
+ }
6
27
  /** Parsed ATT&CK technique record (normalized from STIX). */
7
28
  export interface AttackTechnique {
8
29
  /** ATT&CK description. */
@@ -43,6 +64,10 @@ export declare class AttackService {
43
64
  private readonly byId;
44
65
  /** Inverted index: keyword token → set of technique IDs. */
45
66
  private readonly keywordIndex;
67
+ /** Group/software index: ATT&CK ID (uppercase) → AttackGroup. */
68
+ private readonly groupById;
69
+ /** Inverted index: keyword token → set of group/software ATT&CK IDs. */
70
+ private readonly groupKeywordIndex;
46
71
  readonly version: string;
47
72
  constructor();
48
73
  private loadAndIndex;
@@ -52,6 +77,10 @@ export declare class AttackService {
52
77
  search(query: string, ctx: Context): AttackTechnique[];
53
78
  /** Get all techniques for profile-based ranking. */
54
79
  getAllTechniques(): AttackTechnique[];
80
+ /** Look up a group or software entry by exact ATT&CK ID (case-insensitive, G/S-prefix). */
81
+ lookupGroupById(id: string): AttackGroup | undefined;
82
+ /** Keyword search across group names and aliases — returns ranked results (up to 5). */
83
+ searchGroups(query: string, ctx: Context): AttackGroup[];
55
84
  /** Get sub-techniques for a parent technique. */
56
85
  getSubtechniques(parentId: string): AttackTechnique[];
57
86
  }
package/dist/services/attack/attack-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"attack-service.d.ts","sourceRoot":"","sources":["../../../src/services/attack/attack-service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAOtD,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,yBAAyB;IACzB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,+BAA+B;IAC/B,WAAW,EAAE,KAAK,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,wBAAwB;IACxB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qCAAqC;IACrC,kBAAkB,EAAE,KAAK,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAkDD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;;IASzB,OAAO,CAAC,YAAY;IA2MpB,iEAAiE;IACjE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAInD,kDAAkD;IAClD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE;IAgCtD,oDAAoD;IACpD,gBAAgB,IAAI,eAAe,EAAE;IAIrC,iDAAiD;IACjD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE;CAOtD;AAMD,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAIhD"}
1
+ {"version":3,"file":"attack-service.d.ts","sourceRoot":"","sources":["../../../src/services/attack/attack-service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAOtD,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,eAAe,EAAE,KAAK,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,wDAAwD;IACxD,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;CAC5B;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,yBAAyB;IACzB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,+BAA+B;IAC/B,WAAW,EAAE,KAAK,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,wBAAwB;IACxB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qCAAqC;IACrC,kBAAkB,EAAE,KAAK,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAqDD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IACxD,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;;IAWzB,OAAO,CAAC,YAAY;IA8QpB,iEAAiE;IACjE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAInD,kDAAkD;IAClD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,EAAE;IAgCtD,oDAAoD;IACpD,gBAAgB,IAAI,eAAe,EAAE;IAIrC,2FAA2F;IAC3F,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIpD,wFAAwF;IACxF,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,WAAW,EAAE;IAwBxD,iDAAiD;IACjD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE;CAOtD;AAMD,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAIhD"}
package/dist/services/attack/attack-service.js CHANGED
@@ -31,10 +31,16 @@ export class AttackService {
31
31
  byId;
32
32
  /** Inverted index: keyword token → set of technique IDs. */
33
33
  keywordIndex;
34
+ /** Group/software index: ATT&CK ID (uppercase) → AttackGroup. */
35
+ groupById;
36
+ /** Inverted index: keyword token → set of group/software ATT&CK IDs. */
37
+ groupKeywordIndex;
34
38
  version;
35
39
  constructor() {
36
40
  this.byId = new Map();
37
41
  this.keywordIndex = new Map();
42
+ this.groupById = new Map();
43
+ this.groupKeywordIndex = new Map();
38
44
  this.version = ATTACK_VERSION;
39
45
  this.loadAndIndex();
40
46
  }
@@ -196,6 +202,71 @@ export class AttackService {
196
202
  indicators: indicators.slice(0, 8),
197
203
  };
198
204
  };
205
+ // Collect technique names for group techniques_used cross-reference
206
+ const techniqueNameById = new Map();
207
+ for (const obj of objects) {
208
+ if (obj.type !== 'attack-pattern' || obj.revoked || obj.x_mitre_deprecated)
209
+ continue;
210
+ const aid = extractAttackId(obj);
211
+ if (aid && obj.name)
212
+ techniqueNameById.set(aid.toUpperCase(), obj.name);
213
+ }
214
+ // Build group/software procedure map: group STIX ID → list of technique uses.
215
+ // Only include relationships where the target is an attack-pattern (T-prefix ID).
216
+ const groupProcedures = new Map();
217
+ for (const obj of objects) {
218
+ if (obj.type !== 'relationship' || obj.relationship_type !== 'uses')
219
+ continue;
220
+ const sourceType = objects.find((o) => o.id === obj.source_ref)?.type;
221
+ if (sourceType !== 'intrusion-set' && sourceType !== 'malware' && sourceType !== 'tool')
222
+ continue;
223
+ const targetAid = obj.target_ref ? stixToAttack.get(obj.target_ref) : undefined;
224
+ // Skip targets that are not attack-patterns (e.g. software used by software has S-prefix IDs)
225
+ if (!targetAid || !targetAid.startsWith('T') || !obj.source_ref)
226
+ continue;
227
+ if (!groupProcedures.has(obj.source_ref))
228
+ groupProcedures.set(obj.source_ref, []);
229
+ groupProcedures.get(obj.source_ref).push({
230
+ technique_id: targetAid,
231
+ technique_name: techniqueNameById.get(targetAid.toUpperCase()) ?? '',
232
+ description: truncate(obj.description, 300),
233
+ });
234
+ }
235
+ // Index intrusion-set, malware, and tool objects as groups/software
236
+ for (const obj of objects) {
237
+ if (obj.type !== 'intrusion-set' && obj.type !== 'malware' && obj.type !== 'tool')
238
+ continue;
239
+ if (obj.revoked || obj.x_mitre_deprecated)
240
+ continue;
241
+ const aid = extractAttackId(obj);
242
+ if (!aid || !obj.name)
243
+ continue;
244
+ // intrusion-set uses `aliases`; malware/tool use `x_mitre_aliases`
245
+ const aliases = obj.type === 'intrusion-set'
246
+ ? (obj.aliases ?? []).filter((a) => a !== obj.name)
247
+ : (obj.x_mitre_aliases ?? []).filter((a) => a !== obj.name);
248
+ const group = {
249
+ id: aid,
250
+ name: obj.name,
251
+ aliases,
252
+ type: obj.type === 'intrusion-set' ? 'group' : 'software',
253
+ description: truncate(obj.description, 800),
254
+ techniques_used: (groupProcedures.get(obj.id) ?? []).slice(0, 20),
255
+ attack_version: ATTACK_VERSION,
256
+ };
257
+ this.groupById.set(aid.toUpperCase(), group);
258
+ // Keyword index: ID, name tokens, alias tokens
259
+ const groupTokens = new Set([
260
+ ...tokenize(aid),
261
+ ...tokenize(obj.name),
262
+ ...aliases.flatMap((a) => tokenize(a)),
263
+ ]);
264
+ for (const tok of groupTokens) {
265
+ if (!this.groupKeywordIndex.has(tok))
266
+ this.groupKeywordIndex.set(tok, new Set());
267
+ this.groupKeywordIndex.get(tok).add(aid.toUpperCase());
268
+ }
269
+ }
199
270
  // Index techniques and sub-techniques
200
271
  for (const obj of objects) {
201
272
  if (obj.type !== 'attack-pattern')
@@ -275,6 +346,34 @@ export class AttackService {
275
346
  getAllTechniques() {
276
347
  return [...this.byId.values()];
277
348
  }
349
+ /** Look up a group or software entry by exact ATT&CK ID (case-insensitive, G/S-prefix). */
350
+ lookupGroupById(id) {
351
+ return this.groupById.get(id.toUpperCase());
352
+ }
353
+ /** Keyword search across group names and aliases — returns ranked results (up to 5). */
354
+ searchGroups(query, ctx) {
355
+ ctx.log.debug('ATT&CK group keyword search', { query });
356
+ const tokens = tokenize(query);
357
+ const scores = new Map();
358
+ for (const tok of tokens) {
359
+ const exact = this.groupKeywordIndex.get(tok);
360
+ if (exact) {
361
+ for (const id of exact)
362
+ scores.set(id, (scores.get(id) ?? 0) + 2);
363
+ }
364
+ for (const [key, ids] of this.groupKeywordIndex) {
365
+ if (key.startsWith(tok) && key !== tok) {
366
+ for (const id of ids)
367
+ scores.set(id, (scores.get(id) ?? 0) + 1);
368
+ }
369
+ }
370
+ }
371
+ return [...scores.entries()]
372
+ .sort((a, b) => b[1] - a[1])
373
+ .slice(0, 5)
374
+ .map(([id]) => this.groupById.get(id))
375
+ .filter((g) => g !== undefined);
376
+ }
278
377
  /** Get sub-techniques for a parent technique. */
279
378
  getSubtechniques(parentId) {
280
379
  const parent = this.byId.get(parentId.toUpperCase());
package/dist/services/attack/attack-service.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"attack-service.js","sourceRoot":"","sources":["../../../src/services/attack/attack-service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;AAkEvE,SAAS,eAAe,CAAC,GAAe;IACtC,OAAO,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,EAAE,WAAW,CAAC;AAC7F,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,2CAA2C;IAC3C,OAAO,SAAS;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,wCAAwC;AACxC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,aAAa;IACP,IAAI,CAA+B;IACpD,4DAA4D;IAC3C,YAAY,CAA2B;IAC/C,OAAO,CAAS;IAEzB;QACE,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY;QAClB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,4BAA4B,SAAS,0CAA0C,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,wBAAwB;QACxB,MAAM,YAAY,GAAmB,IAAI,GAAG,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG;gBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6D,CAAC;QACzF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,SAAS;YAC9C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;gBACtB,EAAE,EAAE,GAAG;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAG7B,CAAC;QACJ,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;QAEJ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;YAEtC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAChC,iDAAiD;oBACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC/D,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;wBAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBAC1E,gBAAgB;yBACb,GAAG,CAAC,SAAS,CAAE;yBACf,IAAI,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,CAAC;qBAAM,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACvC,uDAAuD;gBACzD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC5C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;4BAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;wBACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACtD,QAAQ,CAAC,IAAI,CAAC;gCACZ,aAAa,EAAE,GAAG,CAAC,EAAE;gCACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gCACd,WAAW,EAAE,GAAG,CAAC,WAAW;6BAC7B,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;QAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,iBAAiB;gBAAE,SAAS;YACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC1B,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC1E,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,6EAA6E;QAC7E,+EAA+E;QAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;QACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAsB,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACpD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;iBACjE,IAAI,GAAG,CAAC,IAAI,KAAK,4BAA4B;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;gBAAE,SAAS;YACjF,IAAI,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,SAAS;YAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;gBACvC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,kFAAkF;QAClF,MAAM,cAAc,GAAG,CAAC,eAAuB,EAAgC,EAAE;YAC/E,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,aAAa,GAAa,EAAE,CAAC;YACnC,MAAM,oBAAoB,GAAa,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;YAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,IAAI,QAAQ,CAAC,IAAI;oBAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACrD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;oBAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBAClD,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;oBAC1C,IAAI,IAAI;wBAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1C,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,6BAA6B,IAAI,EAAE,EAAE,CAAC;wBACrE,IAAI,SAAS,CAAC,IAAI;4BAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBACpD,MAAM,SAAS,GACb,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO;4BACjC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,GAAG;4BAC5C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;wBACrB,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BAChD,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;4BAC9B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;wBAC5C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iFAAiF;YACjF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC;gBAC5E,YAAY,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3C,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACnC,CAAC;QACJ,CAAC,CAAC;QAEF,sCAAsC;QACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;gBAAE,SAAS;YAC5C,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACpD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;iBAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,cAAc,CAAC;iBACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjD,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,SAAS,GAAoB;gBACjC,EAAE,EAAE,GAAG;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO;gBACP,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;gBACxC,SAAS;gBACT,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,WAAW,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3D,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;gBACjD,eAAe,EAAE,GAAG,CAAC,uBAAuB,KAAK,IAAI;gBACrD,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;YAE5C,qDAAqD;YACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;gBACrB,GAAG,QAAQ,CAAC,GAAG,CAAC;gBAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC3B,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACvE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,kDAAkD;IAClD,MAAM,CAAC,KAAa,EAAE,GAAY;QAChC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,eAAe;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACvC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;wBACrB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAExD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oDAAoD;IACpD,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,iDAAiD;IACjD,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,gBAAgB;aAC3B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;aAC5C,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,gCAAgC;AAEhC,IAAI,QAAmC,CAAC;AAExC,MAAM,UAAU,iBAAiB;IAC/B,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
1
+ {"version":3,"file":"attack-service.js","sourceRoot":"","sources":["../../../src/services/attack/attack-service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;AA2FvE,SAAS,eAAe,CAAC,GAAe;IACtC,OAAO,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,EAAE,WAAW,CAAC;AAC7F,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,2CAA2C;IAC3C,OAAO,SAAS;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,wCAAwC;AACxC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,aAAa;IACP,IAAI,CAA+B;IACpD,4DAA4D;IAC3C,YAAY,CAA2B;IACxD,iEAAiE;IAChD,SAAS,CAA2B;IACrD,wEAAwE;IACvD,iBAAiB,CAA2B;IACpD,OAAO,CAAS;IAEzB;QACE,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY;QAClB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,4BAA4B,SAAS,0CAA0C,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,wBAAwB;QACxB,MAAM,YAAY,GAAmB,IAAI,GAAG,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG;gBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6D,CAAC;QACzF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,SAAS;YAC9C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;gBACtB,EAAE,EAAE,GAAG;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAG7B,CAAC;QACJ,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;QAEJ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;YAEtC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAChC,iDAAiD;oBACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC/D,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;wBAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBAC1E,gBAAgB;yBACb,GAAG,CAAC,SAAS,CAAE;yBACf,IAAI,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,CAAC;qBAAM,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACvC,uDAAuD;gBACzD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC5C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;4BAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;wBACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACtD,QAAQ,CAAC,IAAI,CAAC;gCACZ,aAAa,EAAE,GAAG,CAAC,EAAE;gCACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gCACd,WAAW,EAAE,GAAG,CAAC,WAAW;6BAC7B,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;QAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,iBAAiB;gBAAE,SAAS;YACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC1B,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC1E,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,6EAA6E;QAC7E,+EAA+E;QAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;QACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAsB,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACpD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;iBACjE,IAAI,GAAG,CAAC,IAAI,KAAK,4BAA4B;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;gBAAE,SAAS;YACjF,IAAI,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,SAAS;YAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;gBACvC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,kFAAkF;QAClF,MAAM,cAAc,GAAG,CAAC,eAAuB,EAAgC,EAAE;YAC/E,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,aAAa,GAAa,EAAE,CAAC;YACnC,MAAM,oBAAoB,GAAa,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;YAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,IAAI,QAAQ,CAAC,IAAI;oBAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACrD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;oBAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBAClD,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;oBAC1C,IAAI,IAAI;wBAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1C,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,6BAA6B,IAAI,EAAE,EAAE,CAAC;wBACrE,IAAI,SAAS,CAAC,IAAI;4BAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBACpD,MAAM,SAAS,GACb,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO;4BACjC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,GAAG;4BAC5C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;wBACrB,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BAChD,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;4BAC9B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;wBAC5C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iFAAiF;YACjF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC;gBAC5E,YAAY,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3C,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACnC,CAAC;QACJ,CAAC,CAAC;QAEF,oEAAoE;QACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACrF,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI;gBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QAED,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,eAAe,GAAG,IAAI,GAAG,EAG5B,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,MAAM;gBAAE,SAAS;YAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YACtE,IAAI,UAAU,KAAK,eAAe,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM;gBACrF,SAAS;YACX,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,8FAA8F;YAC9F,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,SAAS;YAC1E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAClF,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC;gBACxC,YAAY,EAAE,SAAS;gBACvB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;gBACpE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAC5F,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACpD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,SAAS;YAEhC,mEAAmE;YACnE,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC;gBACnD,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;YAEhE,MAAM,KAAK,GAAgB;gBACzB,EAAE,EAAE,GAAG;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;gBACzD,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;gBAC3C,eAAe,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACjE,cAAc,EAAE,cAAc;aAC/B,CAAC;YAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;YAE7C,+CAA+C;YAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;gBAC1B,GAAG,QAAQ,CAAC,GAAG,CAAC;gBAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACjF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;gBAAE,SAAS;YAC5C,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACpD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;iBAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,cAAc,CAAC;iBACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjD,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,SAAS,GAAoB;gBACjC,EAAE,EAAE,GAAG;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO;gBACP,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;gBACxC,SAAS;gBACT,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,WAAW,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3D,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;gBACjD,eAAe,EAAE,GAAG,CAAC,uBAAuB,KAAK,IAAI;gBACrD,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;YAE5C,qDAAqD;YACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;gBACrB,GAAG,QAAQ,CAAC,GAAG,CAAC;gBAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC3B,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACvE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,kDAAkD;IAClD,MAAM,CAAC,KAAa,EAAE,GAAY;QAChC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,eAAe;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACvC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;wBACrB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAExD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oDAAoD;IACpD,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,2FAA2F;IAC3F,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,wFAAwF;IACxF,YAAY,CAAC,KAAa,EAAE,GAAY;QACtC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,EAAE,IAAI,KAAK;oBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpE,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACvC,KAAK,MAAM,EAAE,IAAI,GAAG;wBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,iDAAiD;IACjD,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,gBAAgB;aAC3B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;aAC5C,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,gCAAgC;AAEhC,IAAI,QAAmC,CAAC;AAExC,MAAM,UAAU,iBAAiB;IAC/B,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cyanheads/pentest-mcp-server",
3
- "version": "0.1.2",
3
+ "version": "0.1.4",
4
4
  "description": "Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education via MCP. STDIO or Streamable HTTP.",
5
5
  "mcpName": "io.github.cyanheads/pentest-mcp-server",
6
6
  "type": "module",
@@ -34,6 +34,7 @@
34
34
  "bundle": "bun run build && npx -y @anthropic-ai/mcpb pack . dist/pentest-mcp-server.mcpb",
35
35
  "changelog:build": "bun run scripts/build-changelog.ts",
36
36
  "changelog:check": "bun run scripts/build-changelog.ts --check",
37
+ "release:github": "bun run scripts/release-github.ts",
37
38
  "test": "bunx vitest run",
38
39
  "start": "bun ./dist/index.js",
39
40
  "start:stdio": "MCP_TRANSPORT_TYPE=stdio bun ./dist/index.js",
@@ -82,17 +83,17 @@
82
83
  "access": "public"
83
84
  },
84
85
  "dependencies": {
85
- "@cyanheads/mcp-ts-core": "^0.9.16",
86
+ "@cyanheads/mcp-ts-core": "^0.9.21",
86
87
  "pino-pretty": "^13.1.3",
87
88
  "zod": "^4.4.3"
88
89
  },
89
90
  "devDependencies": {
90
- "@biomejs/biome": "^2.4.7",
91
- "@types/node": "^25.6.0",
91
+ "@biomejs/biome": "^2.4.16",
92
+ "@types/node": "^25.9.1",
92
93
  "depcheck": "^1.4.7",
93
94
  "ignore": "^7.0.5",
94
- "tsc-alias": "^1.8.16",
95
+ "tsc-alias": "^1.8.17",
95
96
  "typescript": "^5.9.3",
96
- "vitest": "^4.1.0"
97
+ "vitest": "^4.1.8"
97
98
  }
98
99
  }
package/server.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "url": "https://github.com/cyanheads/pentest-mcp-server",
7
7
  "source": "github"
8
8
  },
9
- "version": "0.1.2",
9
+ "version": "0.1.4",
10
10
  "remotes": [
11
11
  {
12
12
  "type": "streamable-http",
@@ -19,7 +19,7 @@
19
19
  "registryBaseUrl": "https://registry.npmjs.org",
20
20
  "identifier": "@cyanheads/pentest-mcp-server",
21
21
  "runtimeHint": "bun",
22
- "version": "0.1.2",
22
+ "version": "0.1.4",
23
23
  "packageArguments": [
24
24
  {
25
25
  "type": "positional",
@@ -48,7 +48,7 @@
48
48
  "registryBaseUrl": "https://registry.npmjs.org",
49
49
  "identifier": "@cyanheads/pentest-mcp-server",
50
50
  "runtimeHint": "bun",
51
- "version": "0.1.2",
51
+ "version": "0.1.4",
52
52
  "packageArguments": [
53
53
  {
54
54
  "type": "positional",