@cyanheads/pentest-mcp-server 0.1.6 → 0.1.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +40 -27
- package/CLAUDE.md +40 -27
- package/Dockerfile +14 -6
- package/LICENSE +1 -1
- package/README.md +5 -4
- package/changelog/0.1.x/0.1.7.md +37 -0
- package/changelog/0.1.x/0.1.8.md +11 -0
- package/changelog/template.md +60 -19
- package/dist/data/encodings/index.d.ts.map +1 -1
- package/dist/data/encodings/index.js +9 -6
- package/dist/data/encodings/index.js.map +1 -1
- package/dist/data/payloads/index.d.ts +1 -1
- package/dist/data/payloads/index.d.ts.map +1 -1
- package/dist/data/payloads/index.js +5 -3
- package/dist/data/payloads/index.js.map +1 -1
- package/dist/data/payloads/ssti.d.ts.map +1 -1
- package/dist/data/payloads/ssti.js +3 -0
- package/dist/data/payloads/ssti.js.map +1 -1
- package/dist/data/payloads/xss.d.ts.map +1 -1
- package/dist/data/payloads/xss.js +5 -1
- package/dist/data/payloads/xss.js.map +1 -1
- package/dist/data/waf-bypass/index.d.ts.map +1 -1
- package/dist/data/waf-bypass/index.js +3 -1
- package/dist/data/waf-bypass/index.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts +8 -8
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js +12 -12
- package/dist/mcp-server/tools/definitions/pentest-analyze-response.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts +5 -5
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.js +12 -7
- package/dist/mcp-server/tools/definitions/pentest-encode.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts +30 -36
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js +5 -18
- package/dist/mcp-server/tools/definitions/pentest-generate-payloads.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.d.ts +10 -16
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.js +16 -22
- package/dist/mcp-server/tools/definitions/pentest-guide.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js +4 -6
- package/dist/mcp-server/tools/definitions/pentest-lookup-group.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-lookup-technique.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-lookup-technique.tool.js +6 -8
- package/dist/mcp-server/tools/definitions/pentest-lookup-technique.tool.js.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.d.ts +13 -9
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.d.ts.map +1 -1
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.js +19 -7
- package/dist/mcp-server/tools/definitions/pentest-map-techniques.tool.js.map +1 -1
- package/dist/mcp-server/tools/index.d.ts +174 -180
- package/dist/mcp-server/tools/index.d.ts.map +1 -1
- package/dist/services/attack/attack-service.d.ts.map +1 -1
- package/dist/services/attack/attack-service.js +18 -21
- package/dist/services/attack/attack-service.js.map +1 -1
- package/dist/services/encoding/encoding-service.d.ts.map +1 -1
- package/dist/services/methodology/methodology-service.d.ts +249 -1
- package/dist/services/methodology/methodology-service.d.ts.map +1 -1
- package/dist/services/methodology/methodology-service.js +7 -17
- package/dist/services/methodology/methodology-service.js.map +1 -1
- package/dist/services/payload/payload-service.d.ts +2 -2
- package/dist/services/payload/payload-service.d.ts.map +1 -1
- package/dist/services/payload/payload-service.js +1 -3
- package/dist/services/payload/payload-service.js.map +1 -1
- package/dist/services/response-analysis/response-analysis-service.d.ts.map +1 -1
- package/dist/services/response-analysis/response-analysis-service.js +1 -1
- package/dist/services/response-analysis/response-analysis-service.js.map +1 -1
- package/package.json +18 -18
- package/server.json +3 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/encodings/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,6EAA6E;IAC7E,sEAAsE;IACtE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/encodings/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,SAAS,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,6EAA6E;IAC7E,sEAAsE;IACtE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC;SACpC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC;YACvD,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC;YAC7C,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAClD,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;YACd,wDAAwD;YACxD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAClD,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,gCAAgC;QAChC,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAC7B,OAAO,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAClD,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,GAAG,KAAK,KAAK,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;SACnE,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAiC;IAC9D,GAAG,EAAE,iKAAiK;IACtK,UAAU,EACR,uMAAuM;IACzM,WAAW,EACT,kJAAkJ;IACpJ,OAAO,EACL,uMAAuM;IACzM,GAAG,EAAE,kJAAkJ;IACvJ,MAAM,EACJ,yKAAyK;IAC3K,SAAS,EACP,sKAAsK;IACxK,SAAS,EACP,0OAA0O;IAC5O,UAAU,EACR,oMAAoM;IACtM,aAAa,EACX,8MAA8M;CACjN,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,QAAsB;IACjE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,YAAY;YACf,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,aAAa;YAChB,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,YAAY;YACf,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,eAAe;YAClB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,KAAqB;IAErB,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAqB;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACvD,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACF,OAAO,CACL,iFAAiF;QACjF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAC7D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,UAAU,CAAC,IAAI,CACb,gFAAgF,CACjF,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpD,UAAU,CAAC,IAAI,CACb,6FAA6F,CAC9F,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,UAAU,CAAC,IAAI,CACb,6GAA6G,CAC9G,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,UAAU,CAAC,IAAI,CACb,2FAA2F,CAC5F,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,UAAU,CAAC,IAAI,CACb,+FAA+F,CAChG,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,UAAU,CAAC,IAAI,CACb,iGAAiG,CAClG,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACzB,UAAU,CAAC,IAAI,CACb,gFAAgF,CACjF,CAAC;IACJ,OAAO,qBAAqB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvD,CAAC"}
|
|
@@ -10,5 +10,5 @@ export type PayloadCategory = 'xss' | 'sqli' | 'ssrf' | 'xxe' | 'path_traversal'
|
|
|
10
10
|
* Retrieve payload templates for a given category and injection context.
|
|
11
11
|
* Falls back to 'generic' if the specific context isn't found.
|
|
12
12
|
*/
|
|
13
|
-
export declare function getPayloads(category:
|
|
13
|
+
export declare function getPayloads(category: PayloadCategory, injectionContext: string): PayloadTemplate[];
|
|
14
14
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,sDAAsD;AACtD,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,MAAM,GACN,mBAAmB,GACnB,eAAe,GACf,MAAM,GACN,iBAAiB,GACjB,KAAK,GACL,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,CAAC;AAoBlB;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,sDAAsD;AACtD,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,MAAM,GACN,mBAAmB,GACnB,eAAe,GACf,MAAM,GACN,iBAAiB,GACjB,KAAK,GACL,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,CAAC;AAoBlB;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,eAAe,EACzB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CAOnB"}
|
|
@@ -33,8 +33,10 @@ const registry = {
|
|
|
33
33
|
*/
|
|
34
34
|
export function getPayloads(category, injectionContext) {
|
|
35
35
|
const cat = registry[category];
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
36
|
+
const templates = cat[injectionContext] ?? cat['generic'];
|
|
37
|
+
if (!templates) {
|
|
38
|
+
throw new Error(`Payload registry has no generic fallback for category "${category}".`);
|
|
39
|
+
}
|
|
40
|
+
return templates;
|
|
39
41
|
}
|
|
40
42
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAqBvC,8DAA8D;AAC9D,MAAM,QAAQ,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/payloads/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAqBvC,8DAA8D;AAC9D,MAAM,QAAQ,GAA+D;IAC3E,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,cAAc,EAAE,qBAAqB;IACrC,IAAI,EAAE,YAAY;IAClB,iBAAiB,EAAE,wBAAwB;IAC3C,aAAa,EAAE,oBAAoB;IACnC,IAAI,EAAE,YAAY;IAClB,eAAe,EAAE,uBAAuB;IACxC,GAAG,EAAE,WAAW;IAChB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,sBAAsB;IACvC,WAAW,EAAE,kBAAkB;CAChC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,QAAyB,EACzB,gBAAwB;IAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,IAAI,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ssti.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,
|
|
1
|
+
{"version":3,"file":"ssti.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAuE1D,CAAC"}
|
|
@@ -12,8 +12,10 @@ export const sstiPayloads = {
|
|
|
12
12
|
mitigation: 'Never pass user input directly to template render calls. Use template sandboxing or data-binding instead of string interpolation.',
|
|
13
13
|
},
|
|
14
14
|
{
|
|
15
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
|
|
15
16
|
template: '${7*7}',
|
|
16
17
|
description: 'FreeMarker/EL (Java) SSTI probe. If response reflects "49", expression language evaluation is active.',
|
|
18
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal detection pattern, not interpolation
|
|
17
19
|
detection_signature: 'Pattern: ${...} EL expression evaluated in response',
|
|
18
20
|
mitigation: 'Disable EL evaluation for user-controlled input; use whitelisted template functions only.',
|
|
19
21
|
},
|
|
@@ -50,6 +52,7 @@ export const sstiPayloads = {
|
|
|
50
52
|
mitigation: 'Never pass user input directly to template engines.',
|
|
51
53
|
},
|
|
52
54
|
{
|
|
55
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
|
|
53
56
|
template: '${7*7}',
|
|
54
57
|
description: 'EL/FreeMarker SSTI probe for Java stacks.',
|
|
55
58
|
detection_signature: 'Pattern: EL expression evaluated in response',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ssti.js","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAsC;IAC7D,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EACT,yLAAyL;YAC3L,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EACR,mIAAmI;SACtI;QACD;YACE,QAAQ,EAAE,QAAQ;YAClB,WAAW,EACT,uGAAuG;YACzG,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EACR,2FAA2F;SAC9F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,+GAA+G;YACjH,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,qKAAqK;YACvK,mBAAmB,EACjB,uFAAuF;YACzF,UAAU,EACR,6GAA6G;SAChH;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,mKAAmK;YACrK,mBAAmB,EAAE,uEAAuE;YAC5F,UAAU,EACR,sFAAsF;SACzF;QACD;YACE,QAAQ,EACN,sFAAsF;YACxF,WAAW,EACT,+KAA+K;YACjL,mBAAmB,EACjB,kHAAkH;YACpH,UAAU,EACR,oJAAoJ;SACvJ;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,oDAAoD;YACzE,UAAU,EAAE,qDAAqD;SAClE;QACD;YACE,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EAAE,wCAAwC;SACrD;KACF;CACF,CAAC"}
|
|
1
|
+
{"version":3,"file":"ssti.js","sourceRoot":"","sources":["../../../src/data/payloads/ssti.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAsC;IAC7D,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EACT,yLAAyL;YAC3L,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EACR,mIAAmI;SACtI;QACD;YACE,oGAAoG;YACpG,QAAQ,EAAE,QAAQ;YAClB,WAAW,EACT,uGAAuG;YACzG,qGAAqG;YACrG,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EACR,2FAA2F;SAC9F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,+GAA+G;YACjH,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,WAAW,EACT,qKAAqK;YACvK,mBAAmB,EACjB,uFAAuF;YACzF,UAAU,EACR,6GAA6G;SAChH;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,mKAAmK;YACrK,mBAAmB,EAAE,uEAAuE;YAC5F,UAAU,EACR,sFAAsF;SACzF;QACD;YACE,QAAQ,EACN,sFAAsF;YACxF,WAAW,EACT,+KAA+K;YACjL,mBAAmB,EACjB,kHAAkH;YACpH,UAAU,EACR,oJAAoJ;SACvJ;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,oDAAoD;YACzE,UAAU,EAAE,qDAAqD;SAClE;QACD;YACE,oGAAoG;YACpG,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,2CAA2C;YACxD,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EAAE,wCAAwC;SACrD;KACF;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xss.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wDAAwD;AACxD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,
|
|
1
|
+
{"version":3,"file":"xss.d.ts","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wDAAwD;AACxD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAgNzD,CAAC"}
|
|
@@ -96,12 +96,16 @@ export const xssPayloads = {
|
|
|
96
96
|
],
|
|
97
97
|
js_template: [
|
|
98
98
|
{
|
|
99
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
|
|
99
100
|
template: '${alert(document.domain)}',
|
|
100
101
|
description: 'Template literal expression injection. Direct execution when input is placed inside a template literal without escaping.',
|
|
101
|
-
detection_signature:
|
|
102
|
+
detection_signature:
|
|
103
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal detection pattern, not interpolation
|
|
104
|
+
'Pattern: ${...} expression in template literal; WAF signatures: "${alert"',
|
|
102
105
|
mitigation: 'Never interpolate untrusted user input directly into template literals; sanitize and JS-encode first.',
|
|
103
106
|
},
|
|
104
107
|
{
|
|
108
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal security payload, not interpolation
|
|
105
109
|
template: '`-${alert(document.domain)}-`',
|
|
106
110
|
description: 'Closes and re-opens a template literal to inject an expression. Useful when the injection point is inside a larger template literal string.',
|
|
107
111
|
detection_signature: 'Pattern: backtick template literal injection',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAsC;IAC5D,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,2JAA2J;YAC7J,mBAAmB,EACjB,4FAA4F;YAC9F,UAAU,EACR,mHAAmH;SACtH;QACD;YACE,QAAQ,EAAE,4CAA4C;YACtD,WAAW,EACT,0GAA0G;YAC5G,mBAAmB,EACjB,0EAA0E;YAC5E,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EACT,iKAAiK;YACnK,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,oHAAoH;YACtH,mBAAmB,EACjB,qFAAqF;YACvF,UAAU,EACR,4FAA4F;SAC/F;QACD;YACE,QAAQ,EAAE,0CAA0C;YACpD,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EAAE,uCAAuC;YAC5D,UAAU,EAAE,0DAA0D;SACvE;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,+HAA+H;YACjI,mBAAmB,EACjB,8FAA8F;YAChG,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,sGAAsG;YACxG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,wCAAwC;YAClD,WAAW,EACT,6FAA6F;YAC/F,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,qHAAqH;YACvH,mBAAmB,EACjB,4EAA4E;YAC9E,UAAU,EACR,iGAAiG;SACpG;QACD;YACE,QAAQ,EAAE,wDAAwD;YAClE,WAAW,EACT,mGAAmG;YACrG,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EAAE,+EAA+E;SAC5F;KACF;IACD,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,0IAA0I;YAC5I,mBAAmB,EACjB,2EAA2E;YAC7E,UAAU,EAAE,gFAAgF;SAC7F;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,oIAAoI;YACtI,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EAAE,2EAA2E;SACxF;QACD;YACE,QAAQ,EAAE,8BAA8B;YACxC,WAAW,EACT,uIAAuI;YACzI,mBAAmB,EAAE,gDAAgD;YACrE,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,kJAAkJ;YACpJ,mBAAmB,EAAE,mDAAmD;YACxE,UAAU,EAAE,8EAA8E;SAC3F;KACF;IACD,WAAW,EAAE;QACX;YACE,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EACT,0HAA0H;YAC5H,mBAAmB,
|
|
1
|
+
{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../src/data/payloads/xss.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAsC;IAC5D,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,2JAA2J;YAC7J,mBAAmB,EACjB,4FAA4F;YAC9F,UAAU,EACR,mHAAmH;SACtH;QACD;YACE,QAAQ,EAAE,4CAA4C;YACtD,WAAW,EACT,0GAA0G;YAC5G,mBAAmB,EACjB,0EAA0E;YAC5E,UAAU,EACR,wFAAwF;SAC3F;QACD;YACE,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EACT,iKAAiK;YACnK,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,oHAAoH;YACtH,mBAAmB,EACjB,qFAAqF;YACvF,UAAU,EACR,4FAA4F;SAC/F;QACD;YACE,QAAQ,EAAE,0CAA0C;YACpD,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EAAE,uCAAuC;YAC5D,UAAU,EAAE,0DAA0D;SACvE;KACF;IACD,cAAc,EAAE;QACd;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,+HAA+H;YACjI,mBAAmB,EACjB,8FAA8F;YAChG,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,gDAAgD;YAC1D,WAAW,EACT,sGAAsG;YACxG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EACR,oFAAoF;SACvF;QACD;YACE,QAAQ,EAAE,wCAAwC;YAClD,WAAW,EACT,6FAA6F;YAC/F,mBAAmB,EAAE,2CAA2C;YAChE,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,qHAAqH;YACvH,mBAAmB,EACjB,4EAA4E;YAC9E,UAAU,EACR,iGAAiG;SACpG;QACD;YACE,QAAQ,EAAE,wDAAwD;YAClE,WAAW,EACT,mGAAmG;YACrG,mBAAmB,EAAE,kEAAkE;YACvF,UAAU,EAAE,+EAA+E;SAC5F;KACF;IACD,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,0IAA0I;YAC5I,mBAAmB,EACjB,2EAA2E;YAC7E,UAAU,EAAE,gFAAgF;SAC7F;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,oIAAoI;YACtI,mBAAmB,EAAE,qDAAqD;YAC1E,UAAU,EAAE,2EAA2E;SACxF;QACD;YACE,QAAQ,EAAE,8BAA8B;YACxC,WAAW,EACT,uIAAuI;YACzI,mBAAmB,EAAE,gDAAgD;YACrE,UAAU,EACR,qGAAqG;SACxG;QACD;YACE,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EACT,kJAAkJ;YACpJ,mBAAmB,EAAE,mDAAmD;YACxE,UAAU,EAAE,8EAA8E;SAC3F;KACF;IACD,WAAW,EAAE;QACX;YACE,oGAAoG;YACpG,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EACT,0HAA0H;YAC5H,mBAAmB;YACjB,qGAAqG;YACrG,2EAA2E;YAC7E,UAAU,EACR,uGAAuG;SAC1G;QACD;YACE,oGAAoG;YACpG,QAAQ,EAAE,+BAA+B;YACzC,WAAW,EACT,6IAA6I;YAC/I,mBAAmB,EAAE,8CAA8C;YACnE,UAAU,EACR,qFAAqF;SACxF;KACF;IACD,eAAe,EAAE;QACf;YACE,QAAQ,EAAE,kDAAkD;YAC5D,WAAW,EACT,8GAA8G;YAChH,mBAAmB,EACjB,gFAAgF;YAClF,UAAU,EACR,2GAA2G;SAC9G;QACD;YACE,QAAQ,EAAE,0BAA0B;YACpC,WAAW,EACT,uGAAuG;YACzG,mBAAmB,EAAE,6DAA6D;YAClF,UAAU,EAAE,wDAAwD;SACrE;KACF;IACD,aAAa,EAAE;QACb;YACE,QAAQ,EAAE,2CAA2C;YACrD,WAAW,EACT,mJAAmJ;YACrJ,mBAAmB,EACjB,8EAA8E;YAChF,UAAU,EACR,yFAAyF;SAC5F;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EAAE,+EAA+E;YAC5F,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EACR,mFAAmF;SACtF;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yCAAyC;YACnD,WAAW,EACT,kGAAkG;YACpG,mBAAmB,EAAE,qEAAqE;YAC1F,UAAU,EAAE,6DAA6D;SAC1E;QACD;YACE,QAAQ,EAAE,8CAA8C;YACxD,WAAW,EACT,2GAA2G;YAC7G,mBAAmB,EAAE,sDAAsD;YAC3E,UAAU,EAAE,8EAA8E;SAC3F;QACD;YACE,QAAQ,EAAE,mCAAmC;YAC7C,WAAW,EACT,+FAA+F;YACjG,mBAAmB,EAAE,0CAA0C;YAC/D,UAAU,EAAE,0DAA0D;SACvE;QACD;YACE,QAAQ,EAAE,qBAAqB;YAC/B,WAAW,EACT,iLAAiL;YACnL,mBAAmB,EAAE,kDAAkD;YACvE,UAAU,EACR,kFAAkF;SACrF;KACF;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,aAAa,EA8PzC,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIzF"}
|
|
@@ -32,7 +32,9 @@ export const wafBypassNotes = [
|
|
|
32
32
|
{
|
|
33
33
|
waf: 'cloudflare',
|
|
34
34
|
category: 'cmd_injection',
|
|
35
|
-
technique:
|
|
35
|
+
technique:
|
|
36
|
+
// biome-ignore lint/suspicious/noTemplateCurlyInString: literal shell syntax, not interpolation
|
|
37
|
+
"Bash brace expansion ({ls,/etc/passwd}), IFS substitution (${IFS}), and $() command substitution may evade keyword-based filters. Hex-encoded command strings passed through $'\\x6c\\x73' bypass literal pattern matching.",
|
|
36
38
|
reference: 'Public command injection bypass research — HackerOne disclosed reports',
|
|
37
39
|
},
|
|
38
40
|
{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,iFAAiF;IACjF;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,+QAA+Q;QACjR,SAAS,EAAE,mFAAmF;KAC/F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/data/waf-bypass/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,iFAAiF;IACjF;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,8LAA8L;QAChM,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,iMAAiM;QACnM,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6LAA6L;QAC/L,SAAS,EACP,uFAAuF;KAC1F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,+QAA+Q;QACjR,SAAS,EAAE,mFAAmF;KAC/F;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS;QACP,gGAAgG;QAChG,6NAA6N;QAC/N,SAAS,EAAE,wEAAwE;KACpF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,oNAAoN;QACtN,SAAS,EAAE,iEAAiE;KAC7E;IACD;QACE,GAAG,EAAE,YAAY;QACjB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,qPAAqP;QACvP,SAAS,EAAE,oFAAoF;KAChG;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6LAA6L;QAC/L,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kOAAkO;QACpO,SAAS,EAAE,gDAAgD;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,kQAAkQ;QACpQ,SAAS,EAAE,gFAAgF;KAC5F;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,kPAAkP;QACpP,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,iPAAiP;QACnP,SAAS,EAAE,mEAAmE;KAC/E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,2MAA2M;QAC7M,SAAS,EAAE,2DAA2D;KACvE;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yMAAyM;QAC3M,SAAS,EAAE,4CAA4C;KACxD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,uSAAuS;QACzS,SAAS,EAAE,sEAAsE;KAClF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,eAAe;QACzB,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EAAE,mEAAmE;KAC/E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,yOAAyO;QAC3O,SAAS,EAAE,2DAA2D;KACvE;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,4MAA4M;QAC9M,SAAS,EAAE,+DAA+D;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EAAE,4EAA4E;KACxF;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,0QAA0Q;QAC5Q,SAAS,EAAE,6DAA6D;KACzE;IACD;QACE,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,iRAAiR;QACnR,SAAS,EAAE,oEAAoE;KAChF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,wMAAwM;QAC1M,SAAS,EAAE,mCAAmC;KAC/C;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,sQAAsQ;QACxQ,SAAS,EAAE,0EAA0E;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,6OAA6O;QAC/O,SAAS,EAAE,0DAA0D;KACtE;IACD;QACE,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EACP,yPAAyP;QAC3P,SAAS,EAAE,gEAAgE;KAC5E;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,uTAAuT;QACzT,SAAS,EACP,qGAAqG;KACxG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,wUAAwU;QAC1U,SAAS,EAAE,oFAAoF;KAChG;IACD;QACE,GAAG,EAAE,cAAc;QACnB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,qRAAqR;QACvR,SAAS,EAAE,kFAAkF;KAC9F;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EACP,sGAAsG;KACzG;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,yUAAyU;QAC3U,SAAS,EACP,qFAAqF;KACxF;IAED,iFAAiF;IACjF;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EACP,2RAA2R;QAC7R,SAAS,EACP,0GAA0G;KAC7G;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,MAAM;QAChB,SAAS,EACP,8UAA8U;QAChV,SAAS,EACP,2GAA2G;KAC9G;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAgB;IAC5D,OAAO,cAAc,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC5E,CAAC;AACJ,CAAC"}
|
|
@@ -13,22 +13,22 @@ export declare const pentestAnalyzeResponseTool: import("@cyanheads/mcp-ts-core"
|
|
|
13
13
|
authorized_use_reminder: z.ZodString;
|
|
14
14
|
findings: z.ZodArray<z.ZodObject<{
|
|
15
15
|
category: z.ZodEnum<{
|
|
16
|
-
version_disclosure: "version_disclosure";
|
|
17
|
-
stack_trace: "stack_trace";
|
|
18
|
-
internal_path: "internal_path";
|
|
19
|
-
debug_header: "debug_header";
|
|
20
|
-
technology_fingerprint: "technology_fingerprint";
|
|
21
16
|
auth_pattern: "auth_pattern";
|
|
22
17
|
cors_misconfiguration: "cors_misconfiguration";
|
|
23
|
-
|
|
24
|
-
interesting_field: "interesting_field";
|
|
18
|
+
debug_header: "debug_header";
|
|
25
19
|
error_message: "error_message";
|
|
20
|
+
interesting_field: "interesting_field";
|
|
21
|
+
internal_path: "internal_path";
|
|
22
|
+
security_header_missing: "security_header_missing";
|
|
23
|
+
stack_trace: "stack_trace";
|
|
24
|
+
technology_fingerprint: "technology_fingerprint";
|
|
25
|
+
version_disclosure: "version_disclosure";
|
|
26
26
|
}>;
|
|
27
27
|
severity: z.ZodEnum<{
|
|
28
|
+
high: "high";
|
|
28
29
|
info: "info";
|
|
29
30
|
low: "low";
|
|
30
31
|
medium: "medium";
|
|
31
|
-
high: "high";
|
|
32
32
|
}>;
|
|
33
33
|
finding: z.ZodString;
|
|
34
34
|
significance: z.ZodString;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-analyze-response.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"pentest-analyze-response.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyNrC,CAAC"}
|
|
@@ -8,19 +8,19 @@ import { getResponseAnalysisService } from '../../../services/response-analysis/
|
|
|
8
8
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: Response analysis is for systems you own or are explicitly authorized to test. Findings from this tool support authorized penetration testing and security research only.';
|
|
9
9
|
export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
|
|
10
10
|
title: 'Pentest Analyze Response',
|
|
11
|
-
description: 'Analyze
|
|
11
|
+
description: 'Analyze an HTTP response from authorized probing for information leakage, fingerprinting signals, and related exposure. Structured findings cover version disclosures, stack traces, debug headers, internal paths, authentication patterns, CORS configuration, detection signals, remediation, and associated methodology vectors.',
|
|
12
12
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
13
13
|
input: z.object({
|
|
14
14
|
response_headers: z
|
|
15
15
|
.string()
|
|
16
16
|
.max(20000)
|
|
17
17
|
.optional()
|
|
18
|
-
.describe('Raw HTTP response headers
|
|
18
|
+
.describe('Raw HTTP response headers, optionally including the status line. Maximum 20,000 characters.'),
|
|
19
19
|
response_body: z
|
|
20
20
|
.string()
|
|
21
21
|
.max(10000)
|
|
22
22
|
.optional()
|
|
23
|
-
.describe('
|
|
23
|
+
.describe('Raw HTML, JSON, XML, or error response body text. Maximum 10,000 characters.'),
|
|
24
24
|
status_code: z
|
|
25
25
|
.number()
|
|
26
26
|
.int()
|
|
@@ -66,7 +66,7 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
|
|
|
66
66
|
.describe('Why this finding matters for an authorized penetration test.'),
|
|
67
67
|
detection: z
|
|
68
68
|
.string()
|
|
69
|
-
.describe('
|
|
69
|
+
.describe('Observable signals associated with exploitation of this finding.'),
|
|
70
70
|
remediation: z.string().describe('Recommended fix for the target application.'),
|
|
71
71
|
suggested_vector: z
|
|
72
72
|
.string()
|
|
@@ -95,23 +95,23 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
|
|
|
95
95
|
.array(z.string().describe('A technology signal.'))
|
|
96
96
|
.describe('Other technology signals detected.'),
|
|
97
97
|
})
|
|
98
|
-
.describe('
|
|
98
|
+
.describe('Detected server, framework, language, database, cloud, and other technology signals.'),
|
|
99
99
|
summary: z
|
|
100
100
|
.string()
|
|
101
|
-
.describe('One-paragraph summary of findings and
|
|
101
|
+
.describe('One-paragraph summary of findings and associated follow-up actions.'),
|
|
102
102
|
nextToolSuggestions: z
|
|
103
103
|
.array(z
|
|
104
104
|
.object({
|
|
105
|
-
toolName: z.string().describe('
|
|
105
|
+
toolName: z.string().describe('Suggested tool name (e.g., "pentest_guide").'),
|
|
106
106
|
reason: z
|
|
107
107
|
.string()
|
|
108
|
-
.describe('
|
|
108
|
+
.describe('Relationship between the analysis findings and the suggested tool.'),
|
|
109
109
|
args: z
|
|
110
110
|
.record(z.string(), z.unknown())
|
|
111
|
-
.describe('
|
|
111
|
+
.describe('Arguments derived from detected fingerprints and findings.'),
|
|
112
112
|
})
|
|
113
|
-
.describe('A suggested
|
|
114
|
-
.describe('Suggested
|
|
113
|
+
.describe('A suggested tool with arguments derived from the analysis.'))
|
|
114
|
+
.describe('Suggested tools derived from detected fingerprints and findings.'),
|
|
115
115
|
}),
|
|
116
116
|
errors: [
|
|
117
117
|
{
|
|
@@ -123,7 +123,7 @@ export const pentestAnalyzeResponseTool = tool('pentest_analyze_response', {
|
|
|
123
123
|
],
|
|
124
124
|
handler(input, ctx) {
|
|
125
125
|
if (!input.response_headers && !input.response_body) {
|
|
126
|
-
throw ctx.fail('no_input', 'At least one of response_headers or response_body must be provided.',
|
|
126
|
+
throw ctx.fail('no_input', 'At least one of response_headers or response_body must be provided.', ctx.recoveryFor('no_input'));
|
|
127
127
|
}
|
|
128
128
|
const svc = getResponseAnalysisService();
|
|
129
129
|
const result = svc.analyze(input.response_headers, input.response_body, input.status_code, input.context, ctx);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-analyze-response.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,uBAAuB,GAC3B,oMAAoM,CAAC;AAEvM,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,
|
|
1
|
+
{"version":3,"file":"pentest-analyze-response.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-analyze-response.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,uBAAuB,GAC3B,oMAAoM,CAAC;AAEvM,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,EAAE;IACzE,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,sUAAsU;IACxU,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,6FAA6F,CAC9F;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;QAC3F,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,GAAG,CAAC;aACR,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;QAC5E,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,IAAI,CAAC;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,8LAA8L,CAC/L;KACJ,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,iFAAiF,CAAC;QAC9F,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,oBAAoB;gBACpB,aAAa;gBACb,eAAe;gBACf,cAAc;gBACd,wBAAwB;gBACxB,cAAc;gBACd,uBAAuB;gBACvB,yBAAyB;gBACzB,mBAAmB;gBACnB,eAAe;aAChB,CAAC;iBACD,QAAQ,CACP,6fAA6f,CAC9f;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;iBACvC,QAAQ,CACP,mKAAmK,CACpK;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,CACP,kGAAkG,CACnG;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,CAAC,kEAAkE,CAAC;YAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC/E,gBAAgB,EAAE,CAAC;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kIAAkI,CACnI;SACJ,CAAC;aACD,QAAQ,CAAC,6CAA6C,CAAC,CAC3D;aACA,QAAQ,CAAC,kEAAkE,CAAC;QAC/E,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC;YACN,eAAe,EAAE,CAAC;iBACf,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;YAC1F,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4DAA4D,CAAC;YACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjF,KAAK,EAAE,CAAC;iBACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;iBAClD,QAAQ,CAAC,oCAAoC,CAAC;SAClD,CAAC;aACD,QAAQ,CACP,sFAAsF,CACvF;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,CAAC,qEAAqE,CAAC;QAClF,mBAAmB,EAAE,CAAC;aACnB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YAC7E,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,CAAC,oEAAoE,CAAC;YACjF,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,CAAC,4DAA4D,CAAC;SAC1E,CAAC;aACD,QAAQ,CAAC,4DAA4D,CAAC,CAC1E;aACA,QAAQ,CAAC,kEAAkE,CAAC;KAChF,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,uEAAuE;SAClF;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,UAAU,EACV,qEAAqE,EACrE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAC5B,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,GAAG,CACJ,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACjD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;SACvE,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,CAAC,QAAQ,MAAM,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,gBAAgB;oBAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG;YAChB,EAAE,CAAC,eAAe,IAAI,WAAW,EAAE,CAAC,eAAe,EAAE;YACrD,EAAE,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,SAAS,EAAE;YAC5C,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,QAAQ,IAAI,aAAa,EAAE,CAAC,QAAQ,EAAE;YACzC,EAAE,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC,cAAc,EAAE;YAClD,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SACtC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CACR,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -7,16 +7,16 @@ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
|
|
|
7
7
|
export declare const pentestEncodeTool: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
|
|
8
8
|
payload: z.ZodString;
|
|
9
9
|
chain: z.ZodArray<z.ZodEnum<{
|
|
10
|
-
url: "url";
|
|
11
10
|
base64: "base64";
|
|
11
|
+
comment_break: "comment_break";
|
|
12
12
|
double_url: "double_url";
|
|
13
|
-
html_entity: "html_entity";
|
|
14
|
-
unicode: "unicode";
|
|
15
13
|
hex: "hex";
|
|
14
|
+
html_entity: "html_entity";
|
|
16
15
|
js_escape: "js_escape";
|
|
17
|
-
null_byte: "null_byte";
|
|
18
16
|
mixed_case: "mixed_case";
|
|
19
|
-
|
|
17
|
+
null_byte: "null_byte";
|
|
18
|
+
unicode: "unicode";
|
|
19
|
+
url: "url";
|
|
20
20
|
}>>;
|
|
21
21
|
explain: z.ZodDefault<z.ZodBoolean>;
|
|
22
22
|
}, z.core.$strip>, z.ZodObject<{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-encode.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"pentest-encode.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYjE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyJ5B,CAAC"}
|
|
@@ -6,9 +6,14 @@ import { tool, z } from '@cyanheads/mcp-ts-core';
|
|
|
6
6
|
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
|
|
7
7
|
import { getEncodingService } from '../../../services/encoding/encoding-service.js';
|
|
8
8
|
const AUTHORIZED_USE_REMINDER = 'AUTHORIZED TESTING ONLY: Encoding transforms are for bypass research against systems you own or are explicitly authorized to test.';
|
|
9
|
+
function textPreview(value, limit) {
|
|
10
|
+
if (value.length <= limit)
|
|
11
|
+
return value;
|
|
12
|
+
return `${value.slice(0, limit)}… [truncated in text; full value is available in structuredContent]`;
|
|
13
|
+
}
|
|
9
14
|
export const pentestEncodeTool = tool('pentest_encode', {
|
|
10
15
|
title: 'Pentest Encode',
|
|
11
|
-
description: 'Transform a payload string through
|
|
16
|
+
description: 'Transform a payload string through an ordered encoding chain for authorized filter research. Results include the final value, intermediate values, optional decode path and rationale, and detection guidance. All transforms are local; no live probing occurs.',
|
|
12
17
|
annotations: { readOnlyHint: true, openWorldHint: false, idempotentHint: true },
|
|
13
18
|
input: z.object({
|
|
14
19
|
payload: z
|
|
@@ -37,7 +42,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
|
|
|
37
42
|
explain: z
|
|
38
43
|
.boolean()
|
|
39
44
|
.default(true)
|
|
40
|
-
.describe('
|
|
45
|
+
.describe('Whether to include the decode path and bypass rationale.'),
|
|
41
46
|
}),
|
|
42
47
|
output: z.object({
|
|
43
48
|
authorized_use_reminder: z
|
|
@@ -63,7 +68,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
|
|
|
63
68
|
.describe('Why this encoding combination might bypass common filter patterns. Included when explain is true.'),
|
|
64
69
|
detection_note: z
|
|
65
70
|
.string()
|
|
66
|
-
.describe('
|
|
71
|
+
.describe('Detection methods for encoded variants, including normalization and behavior signals.'),
|
|
67
72
|
}),
|
|
68
73
|
errors: [
|
|
69
74
|
{
|
|
@@ -80,7 +85,7 @@ export const pentestEncodeTool = tool('pentest_encode', {
|
|
|
80
85
|
result = svc.applyChain(input.payload, input.chain, input.explain, ctx);
|
|
81
86
|
}
|
|
82
87
|
catch (err) {
|
|
83
|
-
throw ctx.fail('encoding_error', `Encoding chain failed: ${err instanceof Error ? err.message : String(err)}
|
|
88
|
+
throw ctx.fail('encoding_error', `Encoding chain failed: ${err instanceof Error ? err.message : String(err)}`, ctx.recoveryFor('encoding_error'), { cause: err });
|
|
84
89
|
}
|
|
85
90
|
ctx.log.info('pentest_encode completed', {
|
|
86
91
|
chain: input.chain,
|
|
@@ -103,15 +108,15 @@ export const pentestEncodeTool = tool('pentest_encode', {
|
|
|
103
108
|
'',
|
|
104
109
|
'# Encoding Result',
|
|
105
110
|
'',
|
|
106
|
-
`**Original:** \`${result.original
|
|
111
|
+
`**Original:** \`${textPreview(result.original, 200)}\``,
|
|
107
112
|
'',
|
|
108
|
-
`**Encoded:** \`${result.encoded
|
|
113
|
+
`**Encoded:** \`${textPreview(result.encoded, 500)}\``,
|
|
109
114
|
'',
|
|
110
115
|
];
|
|
111
116
|
if (result.intermediate_steps.length > 0) {
|
|
112
117
|
lines.push('## Encoding Steps');
|
|
113
118
|
for (const step of result.intermediate_steps) {
|
|
114
|
-
lines.push(`- **${step.encoding}:** \`${step.result
|
|
119
|
+
lines.push(`- **${step.encoding}:** \`${textPreview(step.result, 200)}\``);
|
|
115
120
|
}
|
|
116
121
|
lines.push('');
|
|
117
122
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-encode.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,uBAAuB,GAC3B,oIAAoI,CAAC;AAEvI,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE;IACtD,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,
|
|
1
|
+
{"version":3,"file":"pentest-encode.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-encode.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,MAAM,uBAAuB,GAC3B,oIAAoI,CAAC;AAEvI,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,qEAAqE,CAAC;AACvG,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE;IACtD,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,kQAAkQ;IACpQ,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,QAAQ,CAAC,wDAAwD,CAAC;QACrE,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,IAAI,CAAC;YACJ,KAAK;YACL,YAAY;YACZ,aAAa;YACb,SAAS;YACT,KAAK;YACL,QAAQ;YACR,WAAW;YACX,WAAW;YACX,YAAY;YACZ,eAAe;SAChB,CAAC;aACD,QAAQ,CAAC,mBAAmB,CAAC,CACjC;aACA,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,4JAA4J,CAC7J;QACH,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CAAC,0DAA0D,CAAC;KACxE,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,CAAC,4EAA4E,CAAC;QACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACpF,kBAAkB,EAAE,CAAC;aAClB,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;SACvE,CAAC;aACD,QAAQ,CAAC,iDAAiD,CAAC,CAC/D;aACA,QAAQ,CAAC,mEAAmE,CAAC;QAChF,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mIAAmI,CACpI;QACH,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,mGAAmG,CACpG;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,CACP,uFAAuF,CACxF;KACJ,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,gBAAgB,CAAC,eAAe;YACtC,IAAI,EAAE,2EAA2E;YACjF,QAAQ,EACN,iGAAiG;SACpG;KACF;IAED,OAAO,CAAC,KAAK,EAAE,GAAG;QAChB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QAEjC,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAuB,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,IAAI,CACZ,gBAAgB,EAChB,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC5E,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,EACjC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,OAAO;YACL,uBAAuB,EAAE,uBAAuB;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa;YACtB,QAAQ,MAAM,CAAC,uBAAuB,EAAE;YACxC,EAAE;YACF,mBAAmB;YACnB,EAAE;YACF,mBAAmB,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI;YACxD,EAAE;YACF,kBAAkB,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI;YACtD,EAAE;SACH,CAAC;QAEF,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,SAAS,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -3,63 +3,62 @@
|
|
|
3
3
|
* @module mcp-server/tools/definitions/pentest-generate-payloads.tool
|
|
4
4
|
*/
|
|
5
5
|
import { z } from '@cyanheads/mcp-ts-core';
|
|
6
|
-
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
|
|
7
6
|
export declare const pentestGeneratePayloadsTool: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
|
|
8
7
|
category: z.ZodEnum<{
|
|
9
|
-
path_traversal: "path_traversal";
|
|
10
|
-
xss: "xss";
|
|
11
|
-
csrf: "csrf";
|
|
12
|
-
sqli: "sqli";
|
|
13
|
-
jwt: "jwt";
|
|
14
|
-
http_header: "http_header";
|
|
15
|
-
ssrf: "ssrf";
|
|
16
|
-
xxe: "xxe";
|
|
17
|
-
ssti: "ssti";
|
|
18
8
|
command_injection: "command_injection";
|
|
19
|
-
|
|
9
|
+
csrf: "csrf";
|
|
20
10
|
deserialization: "deserialization";
|
|
11
|
+
http_header: "http_header";
|
|
12
|
+
jwt: "jwt";
|
|
21
13
|
ldap_injection: "ldap_injection";
|
|
22
14
|
nosql_injection: "nosql_injection";
|
|
15
|
+
open_redirect: "open_redirect";
|
|
16
|
+
path_traversal: "path_traversal";
|
|
17
|
+
sqli: "sqli";
|
|
18
|
+
ssrf: "ssrf";
|
|
19
|
+
ssti: "ssti";
|
|
20
|
+
xss: "xss";
|
|
21
|
+
xxe: "xxe";
|
|
23
22
|
}>;
|
|
24
23
|
injection_context: z.ZodEnum<{
|
|
25
|
-
|
|
26
|
-
url_parameter: "url_parameter";
|
|
24
|
+
cookie_value: "cookie_value";
|
|
27
25
|
file_name: "file_name";
|
|
28
26
|
generic: "generic";
|
|
29
|
-
http_header: "http_header";
|
|
30
|
-
json_value: "json_value";
|
|
31
|
-
url_path: "url_path";
|
|
32
|
-
sql_integer: "sql_integer";
|
|
33
|
-
html_body: "html_body";
|
|
34
27
|
html_attribute: "html_attribute";
|
|
28
|
+
html_body: "html_body";
|
|
29
|
+
http_header: "http_header";
|
|
30
|
+
js_script_block: "js_script_block";
|
|
35
31
|
js_string: "js_string";
|
|
36
32
|
js_template: "js_template";
|
|
37
|
-
|
|
38
|
-
|
|
33
|
+
json_value: "json_value";
|
|
34
|
+
sql_integer: "sql_integer";
|
|
35
|
+
sql_where: "sql_where";
|
|
36
|
+
url_parameter: "url_parameter";
|
|
37
|
+
url_path: "url_path";
|
|
39
38
|
xml_attribute: "xml_attribute";
|
|
40
|
-
|
|
39
|
+
xml_element: "xml_element";
|
|
41
40
|
}>;
|
|
42
41
|
waf_profile: z.ZodDefault<z.ZodEnum<{
|
|
43
|
-
cloudflare: "cloudflare";
|
|
44
|
-
unknown: "unknown";
|
|
45
|
-
aws_waf: "aws_waf";
|
|
46
|
-
modsecurity_crs: "modsecurity_crs";
|
|
47
|
-
imperva: "imperva";
|
|
48
42
|
akamai: "akamai";
|
|
43
|
+
aws_waf: "aws_waf";
|
|
44
|
+
cloudflare: "cloudflare";
|
|
49
45
|
f5_bigip_asm: "f5_bigip_asm";
|
|
50
|
-
nginx_modsecurity: "nginx_modsecurity";
|
|
51
46
|
fortinet_fortiwaf: "fortinet_fortiwaf";
|
|
47
|
+
imperva: "imperva";
|
|
48
|
+
modsecurity_crs: "modsecurity_crs";
|
|
49
|
+
nginx_modsecurity: "nginx_modsecurity";
|
|
52
50
|
none: "none";
|
|
51
|
+
unknown: "unknown";
|
|
53
52
|
}>>;
|
|
54
53
|
encoding: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
55
|
-
url: "url";
|
|
56
54
|
base64: "base64";
|
|
57
55
|
double_url: "double_url";
|
|
58
|
-
html_entity: "html_entity";
|
|
59
|
-
unicode: "unicode";
|
|
60
56
|
hex: "hex";
|
|
57
|
+
html_entity: "html_entity";
|
|
61
58
|
js_escape: "js_escape";
|
|
62
59
|
none: "none";
|
|
60
|
+
unicode: "unicode";
|
|
61
|
+
url: "url";
|
|
63
62
|
}>>>;
|
|
64
63
|
count: z.ZodDefault<z.ZodNumber>;
|
|
65
64
|
}, z.core.$strip>, z.ZodObject<{
|
|
@@ -74,10 +73,5 @@ export declare const pentestGeneratePayloadsTool: import("@cyanheads/mcp-ts-core
|
|
|
74
73
|
waf_bypass_note: z.ZodOptional<z.ZodString>;
|
|
75
74
|
encoded_variant: z.ZodOptional<z.ZodString>;
|
|
76
75
|
}, z.core.$strip>>;
|
|
77
|
-
}, z.core.$strip>,
|
|
78
|
-
readonly reason: "no_payloads";
|
|
79
|
-
readonly code: JsonRpcErrorCode.NotFound;
|
|
80
|
-
readonly when: "No payload templates exist for the category + injection_context combination.";
|
|
81
|
-
readonly recovery: "Try injection_context: \"generic\" for broad templates, or a different category.";
|
|
82
|
-
}], undefined>;
|
|
76
|
+
}, z.core.$strip>, undefined, undefined>;
|
|
83
77
|
//# sourceMappingURL=pentest-generate-payloads.tool.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"pentest-generate-payloads.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/pentest-generate-payloads.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAOjD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAqMtC,CAAC"}
|