@pbpyrojust/universal-security-audit 0.0.0-stage → 0.2.0

package/scripts/lib/exposed-paths.mjs

@@ -0,0 +1,111 @@
+// ── Mildly-intrusive exposed-path probing: admin/login pages, backup/config leaks, exposed APIs ──
+// Every probe here is a single unauthenticated GET request to a well-known, publicly documented path —
+// equivalent to what any search engine or casual visitor could trigger by guessing a URL. No auth
+// bypass, fuzzing, brute force, or payload injection is performed.
+
+export const ADMIN_LOGIN_PATHS = [
+  { path: '/wp-login.php', label: 'WordPress login', platform: 'WordPress' },
+  { path: '/wp-admin/', label: 'WordPress admin', platform: 'WordPress' },
+  { path: '/administrator/', label: 'Joomla admin', platform: 'Joomla' },
+  { path: '/user/login', label: 'Drupal login', platform: 'Drupal' },
+  { path: '/admin/', label: 'Generic admin path', platform: 'Generic' },
+  { path: '/admin/login', label: 'Generic admin login', platform: 'Generic' },
+  { path: '/login', label: 'Generic login', platform: 'Generic' },
+  { path: '/cpanel', label: 'cPanel', platform: 'Hosting panel' },
+  { path: '/phpmyadmin/', label: 'phpMyAdmin', platform: 'DB admin' },
+  { path: '/adminer.php', label: 'Adminer DB admin', platform: 'DB admin' },
+  { path: '/craft/admin', label: 'Craft CMS admin', platform: 'Craft CMS' },
+  { path: '/umbraco/', label: 'Umbraco admin', platform: 'Umbraco' },
+  { path: '/typo3/', label: 'TYPO3 admin', platform: 'TYPO3' },
+];
+
+export const EXPOSED_FILE_PATHS = [
+  { path: '/.env', label: 'Environment file (secrets/credentials)', severity: 'critical' },
+  { path: '/.git/config', label: 'Exposed .git directory', severity: 'critical' },
+  { path: '/.git/HEAD', label: 'Exposed .git directory', severity: 'critical' },
+  { path: '/wp-config.php.bak', label: 'WordPress config backup', severity: 'critical' },
+  { path: '/wp-config.php~', label: 'WordPress config backup (editor swap)', severity: 'critical' },
+  { path: '/wp-config.old', label: 'WordPress config backup', severity: 'critical' },
+  { path: '/config.php.bak', label: 'Config backup file', severity: 'critical' },
+  { path: '/settings.php.bak', label: 'Drupal settings backup', severity: 'critical' },
+  { path: '/.DS_Store', label: 'macOS .DS_Store (reveals directory listing)', severity: 'low' },
+  { path: '/backup.zip', label: 'Backup archive', severity: 'high' },
+  { path: '/backup.sql', label: 'Database backup', severity: 'critical' },
+  { path: '/database.sql', label: 'Database backup', severity: 'critical' },
+  { path: '/dump.sql', label: 'Database dump', severity: 'critical' },
+  { path: '/.htpasswd', label: 'htpasswd credential file', severity: 'critical' },
+  { path: '/composer.json', label: 'Composer manifest (reveals dependency versions)', severity: 'low' },
+  { path: '/package.json', label: 'npm manifest (reveals dependency versions)', severity: 'low' },
+  { path: '/phpinfo.php', label: 'phpinfo() disclosure', severity: 'high' },
+  { path: '/info.php', label: 'phpinfo() disclosure', severity: 'high' },
+  { path: '/server-status', label: 'Apache server-status', severity: 'high' },
+  { path: '/.well-known/security.txt', label: 'security.txt (informational, not a leak)', severity: 'info' },
+  { path: '/error_log', label: 'Exposed PHP error log', severity: 'high' },
+  { path: '/debug.log', label: 'Exposed debug log', severity: 'medium' },
+];
+
+export const EXPOSED_API_PATHS = [
+  { path: '/wp-json/', label: 'WordPress REST API root', severity: 'info' },
+  { path: '/wp-json/wp/v2/users', label: 'WordPress REST API user enumeration', severity: 'medium' },
+  { path: '/xmlrpc.php', label: 'WordPress XML-RPC (brute-force/amplification vector)', severity: 'medium' },
+  { path: '/graphql', label: 'Exposed GraphQL endpoint (check introspection)', severity: 'medium' },
+  { path: '/api/', label: 'Generic API root', severity: 'info' },
+  { path: '/api/users', label: 'Generic user-listing API', severity: 'medium' },
+  { path: '/.well-known/change-password', label: 'Change-password well-known (informational)', severity: 'info' },
+];
+
+function isDirectoryListingHtml(html = '') {
+  return /index of \//i.test(html) && /<title>index of/i.test(html);
+}
+
+// Loads a user-supplied wordlist file (one path per line, '#' comments and blank lines ignored) and
+// turns it into probe entries alongside the curated lists. Larger lists are gated by --intensity
+// concurrency/delay, same as the built-in path sets.
+export function loadWordlistEntries(fs, filePath) {
+  const text = fs.readFileSync(filePath, 'utf8');
+  return text.split(/\r?\n/g)
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith('#'))
+    .map((line) => ({ path: line.startsWith('/') ? line : `/${line}`, label: `Custom wordlist entry: ${line}`, severity: 'medium' }));
+}
+
+export async function probePath(origin, entry, { timeoutMs = 8000, userAgent = 'Universal-Security-Audit' } = {}) {
+  const url = new URL(entry.path, origin).toString();
+  try {
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch(url, { method: 'GET', redirect: 'manual', headers: { 'user-agent': userAgent }, signal: controller.signal });
+    clearTimeout(t);
+    const status = res.status;
+    // Treat redirects to a login/home page as "not exposed" unless it's a 2xx.
+    const exists = status >= 200 && status < 300;
+    let bodySnippet = '';
+    let directoryListing = false;
+    if (exists) {
+      const text = await res.text().catch(() => '');
+      bodySnippet = text.slice(0, 300);
+      directoryListing = isDirectoryListingHtml(text);
+    }
+    return { url, path: entry.path, label: entry.label, status, exists, directoryListing, severity: entry.severity, platform: entry.platform, bodySnippet };
+  } catch (e) {
+    return { url, path: entry.path, label: entry.label, status: 0, exists: false, error: String(e?.message || e), severity: entry.severity, platform: entry.platform };
+  }
+}
+
+export async function probeAllPaths(origin, entries, { concurrency = 4, delayMs = 150, isAllowedUrl = null, onProgress = null, ...opts } = {}) {
+  const results = [];
+  const queue = entries.filter((e) => !isAllowedUrl || isAllowedUrl(new URL(e.path, origin).toString()));
+  const total = queue.length;
+  let idx = 0;
+  async function worker() {
+    while (idx < queue.length) {
+      const entry = queue[idx++];
+      const result = await probePath(origin, entry, opts);
+      results.push(result);
+      if (onProgress) onProgress(results.length, total, result);
+      if (delayMs) await new Promise((r) => setTimeout(r, delayMs));
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, worker));
+  return results;
+}

package/scripts/lib/fingerprint.mjs

@@ -0,0 +1,154 @@
+// ── CMS/platform + hosting/CDN fingerprinting, DNS records, TLS cert info ──
+import dns from 'node:dns/promises';
+import tls from 'node:tls';
+
+export function detectPlatform({ html = '', headers = {}, scriptSrcs = [], cookieNames = [], siteUrl = '' }) {
+  const h = html.toLowerCase();
+  const get = (name) => (headers.get ? headers.get(name) : headers[name]) || '';
+  const server = String(get('server') || '').toLowerCase();
+  const poweredBy = String(get('x-powered-by') || '').toLowerCase();
+  const scripts = scriptSrcs.join(' ').toLowerCase();
+  const cookies = cookieNames.join(' ').toLowerCase();
+
+  const signals = [];
+  const add = (platform, confidence, reason) => signals.push({ platform, confidence, reason });
+
+  // wp-content/wp-includes are literal upload/asset paths — they can show up in a page's HTML
+  // purely because it links to an image/script hosted on a *different* WordPress site (a blog
+  // subdomain, an embedded widget, etc). Only treat them as "this site is WordPress" when the
+  // reference is same-origin; a cross-origin match is reported separately so it doesn't get
+  // mistaken for this host's own platform (and doesn't trigger false hybrid-architecture alerts).
+  let siteHost = '';
+  try { siteHost = new URL(siteUrl).hostname.toLowerCase(); } catch { /* no siteUrl given */ }
+  const isSameOriginRef = (urlStr) => {
+    if (!urlStr) return true;
+    if (urlStr.startsWith('/') && !urlStr.startsWith('//')) return true; // root-relative path
+    try {
+      return !siteHost || new URL(urlStr, `https://${siteHost}`).hostname.toLowerCase() === siteHost;
+    } catch { return true; }
+  };
+  const wpPathMatches = html.match(/[^\s"'<>]*\/wp-(?:content|includes)\/[^\s"'<>]*/gi) || [];
+  const wpSameOriginHtml = wpPathMatches.some(isSameOriginRef);
+  const wpCrossOriginMatches = wpPathMatches.filter((m) => !isSameOriginRef(m));
+  const wpSameOriginScript = scriptSrcs.some((s) => /\/wp-content\//i.test(s) && isSameOriginRef(s));
+  const hasGeneratorTag = h.includes('name="generator" content="wordpress');
+
+  if (wpSameOriginHtml || wpSameOriginScript || hasGeneratorTag) {
+    add('WordPress', 'high', 'wp-content/wp-includes paths or generator meta tag found.');
+  } else if (wpCrossOriginMatches.length) {
+    const externalHosts = [...new Set(wpCrossOriginMatches.map((m) => {
+      try { return new URL(m, `https://${siteHost || 'example.com'}`).hostname; } catch { return null; }
+    }).filter(Boolean))];
+    add('WordPress (external reference)', 'info', `Page links to wp-content/wp-includes assets hosted on a different domain (${externalHosts.join(', ') || 'unknown host'}) — likely a separate WordPress site (e.g. a blog subdomain), not this scanned host.`);
+  }
+  if (h.includes('/sites/default/files') || h.includes('drupal.settings') || cookies.includes('has_js') || h.includes('drupal-')) {
+    add('Drupal', 'high', 'Drupal-specific paths, settings object, or cookie found.');
+  }
+  if (h.includes('/media/jui/') || h.includes('joomla') || cookies.includes('joomla')) {
+    add('Joomla', 'medium', 'Joomla-specific paths or cookie found.');
+  }
+  if (h.includes('cdn.shopify.com') || scripts.includes('cdn.shopify.com') || cookies.includes('_shopify')) {
+    add('Shopify', 'high', 'Shopify CDN asset references or cookie found.');
+  }
+  if (h.includes('static.wixstatic.com') || scripts.includes('wixstatic') || h.includes('wix.com')) {
+    add('Wix', 'high', 'Wix static asset host referenced.');
+  }
+  if (h.includes('assets.squarespace.com') || scripts.includes('squarespace')) {
+    add('Squarespace', 'high', 'Squarespace asset host referenced.');
+  }
+  if (h.includes('webflow.js') || h.includes('assets.website-files.com') || h.includes('data-wf-page')) {
+    add('Webflow', 'high', 'Webflow runtime script or data-wf-page attribute found.');
+  }
+  if (h.includes('/skin/frontend/') || h.includes('mage/cookies') || cookies.includes('frontend')) {
+    add('Magento', 'medium', 'Magento-specific asset paths or cookie found.');
+  }
+  if (server.includes('cloudflare') && !signals.length) {
+    // Cloudflare is hosting/CDN, not a CMS signal — handled separately.
+  }
+  if (h.includes('__next') || h.includes('/_next/static/')) add('Next.js (React)', 'high', '_next/static asset paths found.');
+  if (h.includes('data-reactroot') || h.includes('__nuxt')) add('Nuxt/React SPA', 'medium', 'SPA framework hydration markers found.');
+
+  const xRuntime = get('x-runtime');
+  const hasRailsCsrfTags = /name=["']csrf-param["']/.test(h) && /name=["']csrf-token["']/.test(h);
+  const hasAuthenticityTokenField = /name=["']authenticity_token["']/.test(h);
+  const hasRailsSessionCookie = cookieNames.some((n) => /^_[\w-]+_session$/i.test(n));
+  if (xRuntime || hasRailsCsrfTags || hasAuthenticityTokenField || hasRailsSessionCookie) {
+    const strongSignal = xRuntime || hasRailsCsrfTags;
+    add('Ruby on Rails', strongSignal ? 'high' : 'medium', [
+      xRuntime && 'X-Runtime header present',
+      hasRailsCsrfTags && 'csrf-param/csrf-token meta tags found',
+      hasAuthenticityTokenField && 'authenticity_token form field found',
+      hasRailsSessionCookie && 'Rails-style _appname_session cookie found',
+    ].filter(Boolean).join('; ') + '.');
+  }
+
+  signals.sort((a, b) => (b.confidence === 'high') - (a.confidence === 'high'));
+  return signals.length ? signals : [{ platform: 'Unknown/Custom', confidence: 'low', reason: 'No known CMS/platform signature matched.' }];
+}
+
+export function detectHosting(headers = {}) {
+  const get = (name) => String((headers.get ? headers.get(name) : headers[name]) || '');
+  const server = get('server').toLowerCase();
+  const signals = [];
+  if (get('cf-ray') || server.includes('cloudflare')) signals.push({ provider: 'Cloudflare', via: 'cf-ray header / Server banner' });
+  if (get('x-vercel-id')) signals.push({ provider: 'Vercel', via: 'x-vercel-id header' });
+  if (get('x-nf-request-id') || get('x-nf-render-mode')) signals.push({ provider: 'Netlify', via: 'x-nf-* header' });
+  if (get('x-served-by')?.toLowerCase().includes('fastly') || get('via')?.toLowerCase().includes('fastly')) signals.push({ provider: 'Fastly', via: 'x-served-by/via header' });
+  if (server.includes('amazons3')) signals.push({ provider: 'AWS S3', via: 'Server banner' });
+  if (get('x-amz-cf-id')) signals.push({ provider: 'AWS CloudFront', via: 'x-amz-cf-id header' });
+  if (server.includes('apache')) signals.push({ provider: 'Apache (origin server)', via: 'Server banner' });
+  if (server.includes('nginx')) signals.push({ provider: 'nginx (origin server)', via: 'Server banner' });
+  if (get('x-github-request-id')) signals.push({ provider: 'GitHub Pages', via: 'x-github-request-id header' });
+  if (get('x-pantheon-styx-hostname')) signals.push({ provider: 'Pantheon', via: 'x-pantheon header' });
+  if (get('x-wpe-token') || server.includes('wpengine')) signals.push({ provider: 'WP Engine', via: 'header/Server banner' });
+  return signals;
+}
+
+export async function lookupDnsRecords(hostname) {
+  const out = { a: [], aaaa: [], mx: [], ns: [], txt: [], error: null };
+  try { out.a = await dns.resolve4(hostname); } catch {}
+  try { out.aaaa = await dns.resolve6(hostname); } catch {}
+  try { out.mx = (await dns.resolveMx(hostname)).map((m) => `${m.exchange} (pri ${m.priority})`); } catch {}
+  try { out.ns = await dns.resolveNs(hostname); } catch {}
+  try { out.txt = (await dns.resolveTxt(hostname)).map((t) => t.join('')); } catch {}
+  return out;
+}
+
+export function getTlsCertInfo(hostname, port = 443, timeoutMs = 8000) {
+  return new Promise((resolve) => {
+    const socket = tls.connect({ host: hostname, port, servername: hostname, timeout: timeoutMs, rejectUnauthorized: false }, () => {
+      const cert = socket.getPeerCertificate?.();
+      const protocol = socket.getProtocol?.();
+      const authorized = socket.authorized;
+      const authError = socket.authorizationError;
+      socket.end();
+      if (!cert || !Object.keys(cert).length) {
+        resolve({ ok: false, error: 'No certificate returned' });
+        return;
+      }
+      const now = new Date();
+      const validTo = new Date(cert.valid_to);
+      const daysRemaining = Math.round((validTo - now) / (1000 * 60 * 60 * 24));
+      resolve({
+        ok: true,
+        protocol,
+        authorized,
+        authError: authorized ? null : String(authError || ''),
+        issuer: cert.issuer?.O || cert.issuer?.CN || 'unknown',
+        subject: cert.subject?.CN || hostname,
+        validFrom: cert.valid_from,
+        validTo: cert.valid_to,
+        daysRemaining,
+        isExpired: daysRemaining < 0,
+        isExpiringSoon: daysRemaining >= 0 && daysRemaining < 21,
+      });
+    });
+    socket.on('error', (e) => resolve({ ok: false, error: String(e?.message || e) }));
+    socket.setTimeout(timeoutMs, () => { socket.destroy(); resolve({ ok: false, error: 'timeout' }); });
+  });
+}
+
+const WEAK_TLS_PROTOCOLS = new Set(['TLSv1', 'TLSv1.1', 'SSLv3', 'SSLv2']);
+export function isWeakTlsProtocol(protocol) {
+  return WEAK_TLS_PROTOCOLS.has(protocol);
+}

package/scripts/lib/graphql-introspect.mjs

@@ -0,0 +1,55 @@
+// ── Live GraphQL introspection: a single, standard, read-only introspection query (the same
+// query GraphiQL/Apollo DevTools send on load) — not a crafted exploit, just asking the API "what's
+// your schema", which the GraphQL spec defines as an optional but common capability. If it's on,
+// the response itself is the finding: it hands over every type, field, and mutation name for free. ──
+
+const INTROSPECTION_QUERY = `
+  query IntrospectionQuery {
+    __schema {
+      queryType { name }
+      mutationType { name }
+      types { name kind fields { name } }
+    }
+  }
+`;
+
+const SENSITIVE_NAME_RE = /user|admin|password|token|secret|apikey|api_key|credential|session|delete|remove|destroy|payment|card|billing/i;
+
+export async function introspectGraphQL(url, { timeoutMs = 10000 } = {}) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', accept: 'application/json', 'user-agent': 'Universal-Security-Audit' },
+      body: JSON.stringify({ query: INTROSPECTION_QUERY, operationName: 'IntrospectionQuery' }),
+      signal: controller.signal,
+    });
+    clearTimeout(t);
+    if (!res.ok) return { checked: true, introspectionEnabled: false, status: res.status };
+    const data = await res.json().catch(() => null);
+    const schema = data?.data?.__schema;
+    if (!schema) return { checked: true, introspectionEnabled: false, status: res.status };
+
+    const types = schema.types || [];
+    const typeCount = types.length;
+    const mutationTypeName = schema.mutationType?.name || null;
+    const mutationType = mutationTypeName ? types.find((t) => t.name === mutationTypeName) : null;
+    const mutationFieldNames = (mutationType?.fields || []).map((f) => f.name);
+    const sensitiveTypeNames = types.filter((t) => t.name && SENSITIVE_NAME_RE.test(t.name)).map((t) => t.name);
+    const sensitiveMutations = mutationFieldNames.filter((n) => SENSITIVE_NAME_RE.test(n));
+
+    return {
+      checked: true,
+      introspectionEnabled: true,
+      typeCount,
+      hasMutations: !!mutationTypeName,
+      mutationFieldNames,
+      sensitiveTypeNames: [...new Set(sensitiveTypeNames)],
+      sensitiveMutations: [...new Set(sensitiveMutations)],
+    };
+  } catch (e) {
+    clearTimeout(t);
+    return { checked: false, error: String(e?.message || e) };
+  }
+}

package/scripts/lib/infra-topology.mjs

@@ -0,0 +1,71 @@
+// ── Multi-server / reverse-proxy topology signals. Everything here is either read from headers
+// already being collected elsewhere, or a handful of repeated plain GETs to the homepage (the same
+// request a browser reload does) — no scanning beyond what's already in scope. ──
+
+// Fires a few repeated requests to the same URL and compares response headers that commonly differ
+// between backend instances behind a load balancer (Server, X-Powered-By, Via, X-Served-By,
+// X-Request-Id-style instance identifiers). Consistent headers don't prove a single server (a
+// well-configured fleet looks identical on purpose), but *inconsistent* headers are a solid signal
+// of multiple distinct backends answering.
+const INSTANCE_HEADER_NAMES = ['server', 'x-powered-by', 'via', 'x-served-by', 'x-backend-server', 'x-instance-id'];
+
+export async function checkResponseConsistency(url, { attempts = 4, delayMs = 300, timeoutMs = 8000 } = {}) {
+  const samples = [];
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const controller = new AbortController();
+      const t = setTimeout(() => controller.abort(), timeoutMs);
+      const res = await fetch(url, { headers: { 'user-agent': 'Universal-Security-Audit', 'cache-control': 'no-cache' }, signal: controller.signal });
+      clearTimeout(t);
+      const sample = {};
+      for (const name of INSTANCE_HEADER_NAMES) sample[name] = res.headers.get(name) || '';
+      samples.push(sample);
+    } catch { /* one failed attempt doesn't invalidate the others */ }
+    if (i < attempts - 1 && delayMs) await new Promise((r) => setTimeout(r, delayMs));
+  }
+  if (samples.length < 2) return { checked: false, samples };
+
+  const variations = [];
+  for (const name of INSTANCE_HEADER_NAMES) {
+    const values = new Set(samples.map((s) => s[name]).filter(Boolean));
+    if (values.size > 1) variations.push({ header: name, values: [...values] });
+  }
+  return { checked: true, attempts: samples.length, variations, multiServerLikely: variations.length > 0 };
+}
+
+// A single response can hint at a reverse proxy: a `Via` header is the standard, explicit signal;
+// seeing both a CDN/edge signal (Cloudflare, Fastly, etc.) AND an origin-server signal (nginx/Apache
+// in the same Server header, or a distinct one) in one response also implies a proxy layer in front
+// of an origin, even without a Via header (many CDNs don't add one by default).
+export function checkReverseProxyIndicators(headers = {}, hostingSignals = []) {
+  const get = (name) => String((headers.get ? headers.get(name) : headers[name]) || '');
+  const via = get('via');
+  const cdnProviders = new Set(['Cloudflare', 'Vercel', 'Netlify', 'Fastly', 'AWS CloudFront', 'GitHub Pages']);
+  const originProviders = new Set(['Apache (origin server)', 'nginx (origin server)']);
+  const hasCdnSignal = hostingSignals.some((h) => cdnProviders.has(h.provider));
+  const hasOriginSignal = hostingSignals.some((h) => originProviders.has(h.provider));
+  const likelyProxied = !!via || (hasCdnSignal && hasOriginSignal);
+  return {
+    hasVia: !!via,
+    viaValue: via || null,
+    hasCdnSignal,
+    hasOriginSignal,
+    likelyProxied,
+    note: likelyProxied
+      ? `Traffic passes through a reverse proxy/CDN before reaching the origin${via ? ` (Via: ${via})` : hasCdnSignal && hasOriginSignal ? ` (${[...hostingSignals.map((h) => h.provider)].join(' + ')})` : ''}.`
+      : 'No reverse-proxy indicator found in this response (many proxies are transparent and won\'t show up this way).',
+  };
+}
+
+// More than one A record with no recognized CDN in front is a reasonable hint of DNS-level load
+// balancing across the site's own servers (CDNs also return multiple IPs, but those are edge nodes,
+// not the client's own infrastructure — already accounted for separately via hostingSignals).
+export function checkDnsLoadBalancingHint(dnsRecords = {}, hostingSignals = []) {
+  const aCount = (dnsRecords.a || []).length;
+  const hasCdn = hostingSignals.some((h) => ['Cloudflare', 'Vercel', 'Netlify', 'Fastly', 'AWS CloudFront'].includes(h.provider));
+  return {
+    multipleARecords: aCount > 1,
+    likelyOwnLoadBalancing: aCount > 1 && !hasCdn,
+    aRecordCount: aCount,
+  };
+}

package/scripts/lib/intensity.mjs

@@ -0,0 +1,30 @@
+// ── Single dial controlling concurrency/delay/probe-list-size across every active check, so the
+// speed-vs-footprint tradeoff is one explicit flag (--intensity) instead of a dozen separate ones. ──
+import { INTENSITY_PORT_PROFILES } from './port-scan.mjs';
+
+const PROFILES = {
+  light: {
+    exposedPathConcurrency: 3, exposedPathDelayMs: 400,
+    portScan: INTENSITY_PORT_PROFILES.light,
+    subdomainLivenessLimit: 5,
+  },
+  normal: {
+    exposedPathConcurrency: 4, exposedPathDelayMs: 150,
+    portScan: INTENSITY_PORT_PROFILES.normal,
+    subdomainLivenessLimit: 15,
+  },
+  aggressive: {
+    exposedPathConcurrency: 10, exposedPathDelayMs: 50,
+    portScan: INTENSITY_PORT_PROFILES.aggressive,
+    subdomainLivenessLimit: 40,
+  },
+};
+
+export function resolveIntensity(name) {
+  const key = String(name || 'normal').toLowerCase();
+  if (!PROFILES[key]) {
+    console.error(`Warning: unknown --intensity "${name}", falling back to "normal". Valid values: light, normal, aggressive.`);
+    return PROFILES.normal;
+  }
+  return PROFILES[key];
+}

package/scripts/lib/misc-checks.mjs

@@ -0,0 +1,78 @@
+// ── CORS misconfig, mixed-content, and public AI/SEO-crawler exposure checks ──
+
+export async function checkCorsMisconfig(url, { timeoutMs = 8000 } = {}) {
+  const probeOrigin = 'https://security-audit-cors-probe.invalid';
+  try {
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch(url, { headers: { origin: probeOrigin, 'user-agent': 'Universal-Security-Audit' }, signal: controller.signal });
+    clearTimeout(t);
+    const allowOrigin = res.headers.get('access-control-allow-origin');
+    const allowCreds = res.headers.get('access-control-allow-credentials');
+    const reflectsArbitraryOrigin = allowOrigin === probeOrigin || allowOrigin === '*';
+    const misconfigured = reflectsArbitraryOrigin && String(allowCreds).toLowerCase() === 'true';
+    return {
+      checked: true,
+      allowOrigin,
+      allowCreds,
+      reflectsArbitraryOrigin,
+      misconfigured,
+      note: misconfigured
+        ? 'Reflects arbitrary Origin AND allows credentials — any site can make authenticated cross-origin requests on behalf of visiting users.'
+        : reflectsArbitraryOrigin
+          ? 'Reflects/wildcards Origin but does not allow credentials (lower risk).'
+          : 'No permissive CORS reflection detected.',
+    };
+  } catch (e) {
+    return { checked: false, error: String(e?.message || e) };
+  }
+}
+
+export function findMixedContent(html = '', pageUrl = '') {
+  if (!/^https:/i.test(pageUrl)) return { applicable: false, refs: [] };
+  const refs = new Set();
+  for (const m of html.matchAll(/(?:src|href)=["']http:\/\/([^"']+)["']/gi)) refs.add('http://' + m[1]);
+  return { applicable: true, refs: [...refs] };
+}
+
+// `sitemapInfo` (optional) is the result already computed by Phase 1's URL discovery
+// ({ sitemapUrl, robotsDeclaredSitemaps, sitemapDeclaredInRobots }) — passed in so this function
+// doesn't redundantly re-guess sitemap paths and risk reporting a different answer than what the
+// rest of the run actually used.
+export async function summarizeCrawlerExposure(origin, sitemapInfo = null) {
+  const fetchText = async (p) => {
+    try {
+      const res = await fetch(new URL(p, origin).toString(), { headers: { 'user-agent': 'Universal-Security-Audit' } });
+      return res.ok ? await res.text() : null;
+    } catch { return null; }
+  };
+  const robots = await fetchText('/robots.txt');
+  const llms = await fetchText('/llms.txt');
+
+  const disallowedPaths = robots
+    ? [...robots.matchAll(/^disallow:\s*(.+)$/gim)].map((m) => m[1].trim()).filter((p) => p && p !== '/')
+    : [];
+  const sensitiveLookingDisallows = disallowedPaths.filter((p) => /admin|login|wp-|config|backup|private|internal|staging|test|debug/i.test(p));
+  const robotsDeclaredSitemaps = robots ? [...robots.matchAll(/^sitemap:\s*(\S+)$/gim)].map((m) => m[1].trim()) : [];
+
+  const hasSitemap = sitemapInfo ? !!sitemapInfo.sitemapUrl : null;
+  const sitemapDeclaredInRobots = sitemapInfo ? !!sitemapInfo.sitemapDeclaredInRobots : robotsDeclaredSitemaps.length > 0;
+  const sitemapUndeclaredButReachable = hasSitemap && robotsDeclaredSitemaps.length > 0 && !sitemapDeclaredInRobots;
+  const sitemapDeclaredButUnreachable = robotsDeclaredSitemaps.length > 0 && !hasSitemap;
+
+  return {
+    hasRobots: !!robots,
+    hasLlmsTxt: !!llms,
+    hasSitemap,
+    sitemapUrl: sitemapInfo?.sitemapUrl || null,
+    robotsDeclaredSitemaps,
+    sitemapDeclaredInRobots,
+    sitemapUndeclaredButReachable,
+    sitemapDeclaredButUnreachable,
+    disallowedPathCount: disallowedPaths.length,
+    sensitiveLookingDisallows,
+    note: sensitiveLookingDisallows.length
+      ? `robots.txt Disallow rules name ${sensitiveLookingDisallows.length} sensitive-looking path(s) — this is public and tells both search engines AND attackers/AI scrapers where to look, even though it doesn't block direct requests.`
+      : 'No obviously sensitive path names found in robots.txt Disallow rules.',
+  };
+}