@murk-security/runner-darwin-arm64 0.0.0-stage → 0.7.1

package/runners/checklists/anonymous.json

@@ -0,0 +1,24 @@
+{
+  "version": "2026.10.1",
+  "note": "Blackglass anonymous/external attack-surface checklist. A COVERAGE FLOOR, not a cage: the agent must ensure these surfaces are considered, but stays free to open novel directions beyond them. 'web' items are reachable through the existing http GET op. 'recon' items need Phase-2 prober ops (dns/crt/tls/storage/leak) and are not injected until those ops exist.",
+  "surfaces": {
+    "web": [
+      {"id": "web.js-secrets", "title": "Secrets in JS bundles & source maps", "hint": "Fetch linked scripts and any .map files; grep for API keys, tokens, cloud creds, internal URLs, hardcoded endpoints.", "severity_hint": "high"},
+      {"id": "web.unauth-api", "title": "Unauthenticated API endpoints & GraphQL introspection", "hint": "Probe /api, /v1, /graphql, OpenAPI/swagger specs; try GraphQL introspection; look for data-returning endpoints that need no auth.", "severity_hint": "high"},
+      {"id": "web.idor", "title": "IDOR on public endpoints", "hint": "On resources keyed by id, enumerate/alter identifiers to read other tenants' or users' data without authorization.", "severity_hint": "high"},
+      {"id": "web.exposed-paths", "title": "Exposed .git/.env/backups/debug/swagger", "hint": "Check /.git/config, /.env, /backup, /dump.sql, /debug, /actuator, /swagger, /.well-known, phpinfo, admin consoles.", "severity_hint": "critical"},
+      {"id": "web.verbose-errors", "title": "Verbose errors / stack traces", "hint": "Trigger 4xx/5xx with malformed input; capture stack traces, framework/version banners, internal paths, SQL in errors.", "severity_hint": "medium"},
+      {"id": "web.cors-headers", "title": "CORS & security-header misconfig", "hint": "Inspect Access-Control-Allow-* (reflected origin + credentials), and missing/weak CSP, HSTS, X-Frame-Options, cookie flags.", "severity_hint": "medium"},
+      {"id": "web.auth-boundary", "title": "Auth-boundary bypass / access-control", "hint": "Compare what each identity CAN reach vs what it SHOULD; find role/tenant boundaries crossed by direct request (forced browsing, missing server-side checks).", "severity_hint": "high"}
+    ],
+    "recon": [
+      {"id": "recon.subdomains", "title": "Subdomain enumeration + dangling DNS / takeover", "hint": "Enumerate subdomains of the verified root; flag CNAMEs pointing at deprovisioned services (takeover).", "needs_op": "dns", "phase": 2, "severity_hint": "high"},
+      {"id": "recon.crt", "title": "Certificate-transparency mining", "hint": "Pull CT logs for the root domain; surface staging/admin/internal hosts leaked in cert SANs.", "needs_op": "crt", "phase": 2, "severity_hint": "medium"},
+      {"id": "recon.storage", "title": "Exposed cloud storage (S3/GCS buckets)", "hint": "Derive likely bucket names from org/domain; probe for public listing/read.", "needs_op": "storage", "phase": 2, "severity_hint": "high"},
+      {"id": "recon.registries", "title": "Container repositories & public artifacts", "hint": "Check public Docker Hub / GHCR / npm / registry namespaces tied to the org for exposed images, packages, and their embedded secrets.", "needs_op": "leak", "phase": 2, "severity_hint": "high"},
+      {"id": "recon.code-leaks", "title": "Secret/credential leaks in public code", "hint": "Search GitHub/npm/public repos for the org's leaked keys. OPT-IN: needs a provider token; off by default.", "needs_op": "leak", "phase": 2, "opt_in": true, "severity_hint": "critical"},
+      {"id": "recon.fingerprint", "title": "Tech/version fingerprinting -> known-CVE surface", "hint": "Fingerprint server/framework/library versions from headers, assets, error pages; map to known CVEs.", "needs_op": "http", "phase": 2, "severity_hint": "medium"},
+      {"id": "recon.email-dns", "title": "Email/DNS posture", "hint": "Check SPF/DMARC/DKIM records, open resolvers, zone-transfer, dangling MX.", "needs_op": "dns", "phase": 2, "severity_hint": "low"}
+    ]
+  }
+}

package/runners/cve_feed.json

@@ -0,0 +1,53 @@
+{
+  "_comment": "Notable/recent-CVE feed for the profile version->CVE track (profile.py). DETECTION-ONLY: a match means the fingerprinted version falls in a known-vulnerable range; it is a SIGNAL (a lead to confirm), never a verdict -- banners can be spoofed or backport-patched, so confirmation/exploitation is a separate tiered step. This file is meant to be refreshed from a threat feed; flagship threats are typically post-model-cutoff. Each entry: id (CVE), aka, match (product-name tokens, lowercased, matched against the HTTP Server/X-Powered-By fingerprint), affected (list of version ranges; version in ANY range => affected; ge/gt/le/lt bounds), cvss, title, published (patch/disclosure date), confirm (tier needed to actually prove it), note.",
+  "version": "2026-10-28",
+  "entries": [
+    {
+      "id": "CVE-2026-109618",
+      "aka": "PHP2Shell",
+      "match": ["php"],
+      "affected": [
+        {"ge": "8.5.0", "lt": "8.5.12"},
+        {"ge": "8.4.0", "lt": "8.4.27"},
+        {"ge": "8.3.0", "lt": "8.3.36"},
+        {"ge": "8.2.0", "lt": "8.2.35"},
+        {"lt": "8.2.0"}
+      ],
+      "cvss": 9.2,
+      "title": "PHP-core RCE (session.upload_progress use-after-free)",
+      "published": "2026-10-21",
+      "confirm": "exploit",
+      "note": "PHP2Shell. Patched in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; every earlier build (incl. EOL <8.2 branches) is affected. The UAF/OOM trigger is destructive, so proving it is exploit-tier; disabling session.upload_progress is NOT a complete fix -- patch."
+    },
+    {
+      "id": "CVE-2026-109619",
+      "aka": "PHP2Shell",
+      "match": ["php"],
+      "affected": [
+        {"ge": "8.5.0", "lt": "8.5.12"},
+        {"ge": "8.4.0", "lt": "8.4.27"},
+        {"ge": "8.3.0", "lt": "8.3.36"},
+        {"ge": "8.2.0", "lt": "8.2.35"},
+        {"lt": "8.2.0"}
+      ],
+      "cvss": 9.2,
+      "title": "PHP-core RCE (second PHP2Shell flaw, same patch set)",
+      "published": "2026-10-21",
+      "confirm": "exploit",
+      "note": "PHP2Shell companion CVE. Same fixed versions (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12) and the same patch-only remediation."
+    },
+    {
+      "id": "CVE-2026-42945",
+      "aka": "NGINX Rift",
+      "match": ["nginx"],
+      "affected": [
+        {"ge": "0.6.27", "lt": "1.30.1"}
+      ],
+      "cvss": 8.1,
+      "title": "nginx rewrite-module heap overflow (pre-auth RCE where ASLR is disabled)",
+      "published": "2026-05-14",
+      "confirm": "exploit",
+      "note": "Open-source nginx 0.6.27 through 1.30.0 affected (and NGINX Plus R32-R36, which this HTTP fingerprint cannot see). Fixed in 1.30.1 (stable) and 1.31.0 (mainline)."
+    }
+  ]
+}