@kinosec/cli 0.3.3 → 0.4.0

package/dist/cli.js

@@ -7750,6 +7750,27 @@ function parseApiError(body, status) {
     requestId: typeof b.request_id === "string" ? b.request_id : "unknown"
   });
 }
+var CredentialsResource = class {
+  constructor(api) {
+    this.api = api;
+  }
+  api;
+  async set(assetId, params) {
+    return this.api.put(`v1/assets/${assetId}/credentials`, { json: params }).json();
+  }
+  async get(assetId) {
+    return this.api.get(`v1/assets/${assetId}/credentials`).json();
+  }
+  async remove(assetId) {
+    return this.api.delete(`v1/assets/${assetId}/credentials`).json();
+  }
+  async setTarget(assetId, params) {
+    return this.api.put(`v1/assets/${assetId}/credentials/target`, { json: params }).json();
+  }
+  async removeTarget(assetId) {
+    return this.api.delete(`v1/assets/${assetId}/credentials/target`).json();
+  }
+};
 var IDEMPOTENT_EXACT_PATHS = ["/v1/scans", "/v1/tokens"];
 var IDEMPOTENT_SUFFIXES = ["/cancel", "/retest"];
 function needsIdempotencyKey(method, path) {
@@ -7831,8 +7852,10 @@ var KinoSecClient = class {
 var AssetsResource = class {
   constructor(api) {
     this.api = api;
+    this.credentials = new CredentialsResource(api);
   }
   api;
+  credentials;
   async list(params = {}) {
     return this.api.get("v1/assets", { searchParams: buildSearchParams(params) }).json();
   }
@@ -10912,10 +10935,15 @@ Examples:
           asset = await client.assets.lookup(domain);
         } catch (err) {
           if (err instanceof ApiError && err.status === 404) {
-            console.error(`No asset found for '${domain}'. Run kinosec asset list to see your assets.`);
-            process.exit(1);
+            asset = await client.assets.create({
+              asset_type: "domain",
+              asset_value: domain,
+              verification_method: "dns"
+            });
+            console.error(`Asset created for ${domain}.`);
+          } else {
+            throw err;
           }
-          throw err;
         }
         targetDisplay = domain;
         params = { asset_id: asset.id, scan_mode: options.mode };
@@ -11099,7 +11127,402 @@ Timeout: pentest still running after ${options.timeout}s.`);
 }
 
 // src/commands/asset.ts
+var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/commands/asset-auth.ts
 var import_picocolors6 = __toESM(require_picocolors(), 1);
+
+// src/lib/resolve-asset.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-/i;
+async function resolveAsset(client, identifier) {
+  try {
+    if (UUID_RE.test(identifier)) {
+      return await client.assets.get(identifier);
+    }
+    return await client.assets.lookup(identifier);
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      throw new ApiError({
+        status: 404,
+        code: error.code,
+        detail: `Asset "${identifier}" not found. Create it with:
+  kinosec asset create --type domain --value ${identifier} --verify-method dns
+or use pentest which auto-creates the asset:
+  kinosec pentest -t ${identifier}`,
+        requestId: error.requestId
+      });
+    }
+    throw error;
+  }
+}
+
+// src/lib/prompt.ts
+import { createInterface as createInterface2 } from "readline";
+async function promptMasked(label) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
+    process.exit(2);
+  }
+  process.stderr.write(`${label}: `);
+  return new Promise((resolve, reject) => {
+    const chars = [];
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf-8");
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\r" || ch === "\n") {
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener("data", onData);
+          process.stderr.write("\n");
+          resolve(chars.join(""));
+          return;
+        } else if (ch === "") {
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener("data", onData);
+          process.stderr.write("\n");
+          reject(new Error("Cancelled"));
+          return;
+        } else if (ch === "\x7F" || ch === "\b") {
+          if (chars.length > 0) {
+            chars.pop();
+            process.stderr.write("\b \b");
+          }
+        } else if (ch >= " ") {
+          chars.push(ch);
+          process.stderr.write("*");
+        }
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
+async function promptText(label) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
+    process.exit(2);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question(`${label}: `, resolve);
+  });
+  rl.close();
+  return answer;
+}
+async function promptSelect(message, options) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error("Cannot show interactive menu in non-interactive mode. Use flags instead.");
+    process.exit(2);
+  }
+  console.error(`
+${message}`);
+  for (let i = 0; i < options.length; i++) {
+    console.error(`  ${i + 1}. ${options[i].label} \u2014 ${options[i].description}`);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question("> ", resolve);
+  });
+  rl.close();
+  const index = parseInt(answer, 10) - 1;
+  if (isNaN(index) || index < 0 || index >= options.length) {
+    console.error("Invalid selection.");
+    process.exit(2);
+  }
+  return options[index].value;
+}
+
+// src/commands/asset-auth.ts
+var VALID_AUTH_TYPES = ["bearer", "basic", "apikey", "session", "cookie"];
+var AUTH_TYPE_OPTIONS = [
+  { value: "bearer", label: "Bearer Token", description: "Authorization header with token" },
+  { value: "apikey", label: "API Key", description: "Custom header (e.g. X-API-Key)" },
+  { value: "basic", label: "Basic Auth", description: "Username + password" },
+  { value: "session", label: "Session Login", description: "Replays login form POST" },
+  { value: "cookie", label: "Cookie / Session", description: "Inject browser cookies" }
+];
+async function collectCredentialsInteractive(authType) {
+  const params = { auth_type: authType, credentials: {} };
+  switch (authType) {
+    case "bearer": {
+      params.credentials = { token: await promptMasked("Bearer token") };
+      break;
+    }
+    case "basic": {
+      const username = await promptText("Username");
+      const password = await promptMasked("Password");
+      params.credentials = { username, password };
+      break;
+    }
+    case "apikey": {
+      const key = await promptMasked("API key");
+      const headerName = await promptText("Header name (e.g. X-API-Key)");
+      params.credentials = { key };
+      params.auth_header_name = headerName;
+      break;
+    }
+    case "session": {
+      const username = await promptText("Username or email");
+      const password = await promptMasked("Password");
+      const endpoint = await promptText("Login endpoint URL");
+      params.credentials = { email: username, password };
+      params.auth_endpoint_url = endpoint;
+      break;
+    }
+    case "cookie": {
+      params.credentials = { cookie: await promptMasked("Cookie string") };
+      break;
+    }
+  }
+  return params;
+}
+function collectCredentialsFromFlags(options) {
+  const authType = options.type;
+  const params = { auth_type: authType, credentials: {} };
+  switch (authType) {
+    case "bearer": {
+      if (!options.bearerToken) {
+        console.error("--bearer-token is required for bearer auth type.");
+        process.exit(2);
+      }
+      params.credentials = { token: options.bearerToken };
+      break;
+    }
+    case "basic": {
+      if (!options.username || !options.password) {
+        console.error("--username and --password are required for basic auth type.");
+        process.exit(2);
+      }
+      params.credentials = { username: options.username, password: options.password };
+      break;
+    }
+    case "apikey": {
+      if (!options.key || !options.headerName) {
+        console.error("--key and --header-name are required for apikey auth type.");
+        process.exit(2);
+      }
+      params.credentials = { key: options.key };
+      params.auth_header_name = options.headerName;
+      break;
+    }
+    case "session": {
+      if (!options.username || !options.password || !options.authEndpoint) {
+        console.error("--username, --password, and --auth-endpoint are required for session auth type.");
+        process.exit(2);
+      }
+      params.credentials = { email: options.username, password: options.password };
+      params.auth_endpoint_url = options.authEndpoint;
+      break;
+    }
+    case "cookie": {
+      if (!options.cookie) {
+        console.error("--cookie is required for cookie auth type.");
+        process.exit(2);
+      }
+      params.credentials = { cookie: options.cookie };
+      break;
+    }
+  }
+  if (options.context) {
+    params.context_text = options.context;
+  }
+  return params;
+}
+function registerAssetAuthCommand(assetCmd) {
+  const auth = assetCmd.command("auth").description("Manage asset authentication credentials");
+  auth.command("set").description("Configure authentication credentials for an asset").argument("<asset>", "Asset domain name or UUID").option("--type <type>", "Auth type: bearer, basic, apikey, session, cookie").option("--bearer-token <value>", "Bearer token (bearer type)").option("--username <value>", "Username or email (basic, session types)").option("--password <value>", "Password (basic, session types)").option("--key <value>", "API key value (apikey type)").option("--header-name <name>", "Custom header name (apikey type, e.g. X-API-Key)").option("--cookie <value>", "Cookie string (cookie type)").option("--auth-endpoint <url>", "Login endpoint URL (session type)").option("--context <text>", "Optional notes about the auth configuration").addHelpText("after", `
+Examples:
+  $ kinosec asset auth set example.com                                      # interactive
+  $ kinosec asset auth set example.com --type bearer --bearer-token "$TOKEN"
+  $ kinosec asset auth set example.com --type basic --username admin --password "$PASS"
+  $ kinosec asset auth set example.com --type apikey --key "$KEY" --header-name "X-API-Key"
+  $ kinosec asset auth set example.com --type session --username admin@example.com --password "$PASS" --auth-endpoint "https://example.com/api/login"
+  $ kinosec asset auth set example.com --type cookie --cookie "session_id=abc123"
+
+Security: Pass credentials via environment variables to avoid shell history exposure.`).action(async (assetIdentifier, options) => {
+    try {
+      const opts = auth.parent.parent.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset = await resolveAsset(client, assetIdentifier);
+      let params;
+      if (options.type) {
+        if (!VALID_AUTH_TYPES.includes(options.type)) {
+          console.error(`Invalid auth type "${options.type}". Must be: ${VALID_AUTH_TYPES.join(", ")}`);
+          process.exit(2);
+        }
+        params = collectCredentialsFromFlags(options);
+      } else {
+        const authType = await promptSelect("Authentication type:", AUTH_TYPE_OPTIONS);
+        params = await collectCredentialsInteractive(authType);
+        if (options.context) {
+          params.context_text = options.context;
+        }
+      }
+      const result = await client.assets.credentials.set(asset.id, params);
+      if (opts.json || opts.output === "json") {
+        printJson({ ...result, asset: asset.asset_value });
+        return;
+      }
+      printSuccess(`Credentials saved for ${asset.asset_value} (${result.auth_type})`);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  auth.command("show").description("Show authentication configuration for an asset").argument("<asset>", "Asset domain name or UUID").addHelpText("after", `
+Examples:
+  $ kinosec asset auth show example.com
+  $ kinosec asset auth show example.com --json`).action(async (assetIdentifier) => {
+    try {
+      const opts = auth.parent.parent.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset = await resolveAsset(client, assetIdentifier);
+      const creds = await client.assets.credentials.get(asset.id);
+      if (opts.json || opts.output === "json") {
+        printJson({ asset: asset.asset_value, ...creds });
+        return;
+      }
+      if (!creds.has_credentials) {
+        console.log(`Asset:           ${asset.asset_value}`);
+        console.log(`Auth Type:       ${import_picocolors6.default.dim("(none)")}`);
+        console.log(`Has Credentials: no`);
+        return;
+      }
+      console.log(`Asset:           ${asset.asset_value}`);
+      console.log(`Auth Type:       ${creds.auth_type}`);
+      console.log(`Has Credentials: yes`);
+      if (creds.auth_header_name) {
+        console.log(`Header Name:     ${creds.auth_header_name}`);
+      }
+      if (creds.auth_endpoint_url) {
+        console.log(`Auth Endpoint:   ${creds.auth_endpoint_url}`);
+      }
+      if (creds.context_text) {
+        console.log(`Notes:           ${creds.context_text}`);
+      }
+      if (creds.target_account) {
+        const ta = creds.target_account;
+        const hasAny = ta.has_username || ta.has_cookie || ta.has_bearer_token || ta.has_apikey;
+        if (hasAny) {
+          const detail = ta.has_username ? "username" : ta.has_bearer_token ? "bearer token" : ta.has_cookie ? "cookie" : "API key";
+          console.log(`Target Account:  ${import_picocolors6.default.green("configured")} (${detail})`);
+        } else {
+          console.log(`Target Account:  ${import_picocolors6.default.dim("not configured")}`);
+        }
+      }
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  auth.command("remove").description("Remove all credentials for an asset").argument("<asset>", "Asset domain name or UUID").option("-y, --yes", "Skip confirmation prompt").addHelpText("after", `
+Examples:
+  $ kinosec asset auth remove example.com
+  $ kinosec asset auth remove example.com --yes`).action(async (assetIdentifier, options) => {
+    try {
+      const opts = auth.parent.parent.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset = await resolveAsset(client, assetIdentifier);
+      await confirmDestructive(`Remove all credentials for ${asset.asset_value}?`, Boolean(options.yes));
+      await client.assets.credentials.remove(asset.id);
+      if (opts.json || opts.output === "json") {
+        printJson({ deleted: true, asset: asset.asset_value });
+        return;
+      }
+      printSuccess(`Credentials removed for ${asset.asset_value}`);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  auth.command("set-target").description("Configure IDOR target account credentials").argument("<asset>", "Asset domain name or UUID").option("--target-username <value>", "Target account username or email").option("--target-password <value>", "Target account password").option("--target-totp-secret <value>", "Target account TOTP secret").option("--target-token <value>", "Target bearer token").option("--target-cookie <value>", "Target cookie string").option("--target-key <value>", "Target API key").addHelpText("after", `
+Examples:
+  $ kinosec asset auth set-target example.com                                          # interactive
+  $ kinosec asset auth set-target example.com --target-username victim@example.com --target-password "$PASS"
+  $ kinosec asset auth set-target example.com --target-token "$VICTIM_TOKEN"
+  $ kinosec asset auth set-target example.com --target-cookie "session_id=victim_abc"`).action(async (assetIdentifier, options) => {
+    try {
+      const opts = auth.parent.parent.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset = await resolveAsset(client, assetIdentifier);
+      const creds = await client.assets.credentials.get(asset.id);
+      if (!creds.has_credentials || !creds.auth_type) {
+        console.error(`No primary credentials configured for ${asset.asset_value}. Run 'kinosec asset auth set' first.`);
+        process.exit(2);
+      }
+      const isTokenBased = creds.auth_type === "bearer" || creds.auth_type === "apikey" || creds.auth_type === "cookie";
+      const hasAnyFlag = options.targetUsername || options.targetPassword || options.targetTotpSecret || options.targetToken || options.targetCookie || options.targetKey;
+      let targetParams;
+      if (hasAnyFlag) {
+        targetParams = {
+          username: options.targetUsername,
+          password: options.targetPassword,
+          totp_secret: options.targetTotpSecret,
+          bearer_token: options.targetToken,
+          cookie: options.targetCookie,
+          apikey: options.targetKey
+        };
+      } else {
+        console.error(`
+Primary auth type: ${creds.auth_type}
+`);
+        if (isTokenBased) {
+          if (creds.auth_type === "bearer") {
+            const targetToken = await promptMasked("Target bearer token");
+            targetParams = { bearer_token: targetToken };
+          } else if (creds.auth_type === "cookie") {
+            const targetCookie = await promptMasked("Target cookie string");
+            targetParams = { cookie: targetCookie };
+          } else {
+            const targetKey = await promptMasked("Target API key");
+            targetParams = { apikey: targetKey };
+          }
+        } else {
+          const username = await promptText("Target account username");
+          const password = await promptMasked("Target account password");
+          targetParams = { username, password };
+          const totp = await promptText("Target TOTP secret (optional, Enter to skip)");
+          if (totp) {
+            targetParams.totp_secret = totp;
+          }
+        }
+      }
+      await client.assets.credentials.setTarget(asset.id, targetParams);
+      if (opts.json || opts.output === "json") {
+        printJson({ saved: true, asset: asset.asset_value });
+        return;
+      }
+      printSuccess(`Target account saved for ${asset.asset_value} (IDOR testing)`);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+  auth.command("remove-target").description("Remove target account credentials (keeps primary credentials)").argument("<asset>", "Asset domain name or UUID").option("-y, --yes", "Skip confirmation prompt").addHelpText("after", `
+Examples:
+  $ kinosec asset auth remove-target example.com
+  $ kinosec asset auth remove-target example.com --yes`).action(async (assetIdentifier, options) => {
+    try {
+      const opts = auth.parent.parent.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset = await resolveAsset(client, assetIdentifier);
+      await confirmDestructive(`Remove target account for ${asset.asset_value}?`, Boolean(options.yes));
+      await client.assets.credentials.removeTarget(asset.id);
+      if (opts.json || opts.output === "json") {
+        printJson({ deleted: true, asset: asset.asset_value });
+        return;
+      }
+      printSuccess(`Target account removed for ${asset.asset_value}`);
+    } catch (error) {
+      handleError(error);
+    }
+  });
+}
+
+// src/commands/asset.ts
 function registerAssetCommand(program3) {
   const asset = program3.command("asset").description("Manage assets");
   asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--search <term>", "Filter by asset value (substring match)").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
@@ -11138,7 +11561,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors6.default.dim(`
+        console.log(import_picocolors7.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error) {
@@ -11246,10 +11669,11 @@ Examples:
       handleError(error);
     }
   });
+  registerAssetAuthCommand(asset);
 }
 
 // src/commands/finding.ts
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 function formatPoc(poc) {
   if (poc == null) return null;
   if (typeof poc === "string") return poc.trim() || null;
@@ -11290,7 +11714,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors7.default.dim(`
+        console.log(import_picocolors8.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error) {
@@ -11378,7 +11802,7 @@ Examples:
 }
 
 // src/commands/report.ts
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 function renderMarkdown(data) {
   const { scan, findings } = data;
   const lines = [];
@@ -11455,7 +11879,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors8.default.dim(`
+        console.log(import_picocolors9.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error) {
@@ -11526,7 +11950,7 @@ Examples:
 }
 
 // src/commands/token.ts
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -11561,7 +11985,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors9.default.dim(`
+        console.log(import_picocolors10.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error) {
@@ -11588,7 +12012,7 @@ Examples:
       }
       printSuccess(`Token created: ${result.name}`);
       console.log("");
-      console.log(import_picocolors9.default.bold("  Token: ") + result.token);
+      console.log(import_picocolors10.default.bold("  Token: ") + result.token);
       console.log("");
       printWarning("Save this token \u2014 it will not be shown again.");
       console.log(`  ID: ${result.id}`);
@@ -11621,7 +12045,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.3.3", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN and config)").option("--api-url <url>", "API base URL (overrides config)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.4.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN and config)").option("--api-url <url>", "API base URL (overrides config)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerConfigCommand(program2);
 registerMeCommand(program2);
@@ -11630,7 +12054,7 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.3.3")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.4.0")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js: