@voidagency/web-scanner 0.0.1

package/README.md

@@ -0,0 +1,198 @@
+# VoidSec Scanner
+
+CLI orchestrator that runs 3 mature security tools and generates unified reports.
+
+```
+voidsec scan https://target.com --profile quick
+```
+
+## Architecture
+
+```
+voidsec scan https://target.com
+    ↓
+┌─────────┬─────────┬───────────┐
+│   ZAP   │ Nuclei  │ testssl   │
+└────┬────┴────┬────┴─────┬─────┘
+     └─────────┼──────────┘
+               ↓
+      Aggregator (dedupe, consolidate)
+               ↓
+         HTML Report
+```
+
+## What It Does
+
+- Single command runs 3 tools
+- Unified HTML report
+- Noise reduction (filters informational clutter)
+- Consolidates same vuln across multiple URLs
+- Tech detection (Drupal, PHP, nginx versions)
+- Zero CVE maintenance (Nuclei community handles it)
+
+## What It Doesn't Do
+
+- Authenticated scanning
+- Business logic flaw detection
+- Zero-day detection
+- API fuzzing
+- Replace manual pentesting
+
+## Scanners
+
+### ZAP (Primary)
+
+Docker-based OWASP ZAP baseline scan.
+
+```bash
+docker run zaproxy/zap-stable zap-baseline.py
+```
+
+**Skipped plugins (noise):**
+
+| ID | Name | Why Skip |
+|----|------|----------|
+| 10109 | Modern Web Application | Just says "this is SPA" |
+| 10015 | Re-examine Cache-control | Informational |
+| 10049 | Non-Storable Content | Informational |
+| 10050 | Retrieved from Cache | Informational |
+| 10044 | Big Redirect Detected | 99% false positives |
+| 10027 | Suspicious Comments | Triggers on TODO/FIXME |
+| 10112 | Session Management Response | Just says "session exists" |
+| 10017 | Cross-Domain JS | Merged into SRI finding |
+
+### Nuclei (Supplementary)
+
+Template-based scanner with 5000+ community templates.
+
+```bash
+nuclei -u https://target.com -t templates/
+```
+
+**Updates:**
+```bash
+nuclei -update-templates  # auto-updates community templates
+```
+
+**Custom templates** (`/templates/`):
+
+| Template | What It Does |
+|----------|--------------|
+| drupal-theme-lockfiles.yaml | Exposed package.json/yarn.lock in themes |
+| drupal-api-user-detail.yaml | JSON:API user detail exposure |
+| drupal-file-path-disclosure.yaml | Filename leak in 403 errors |
+| drupal-dev-files-exposed.yaml | Composer.json/lock exposed |
+| http-options-enabled.yaml | HTTP OPTIONS method enabled |
+| nextjs-version-detect.yaml | Next.js version via headless browser |
+
+### testssl.sh
+
+SSL/TLS vulnerability scanner.
+
+```bash
+testssl.sh --jsonfile output.json https://target.com
+```
+
+**Skipped:** Scanner errors (engine_problem, scanProblem) - our machine issues, not target.
+
+## Profiles
+
+| Profile | What It Runs |
+|---------|--------------|
+| quick | ZAP baseline + Nuclei (misconfig, exposure) |
+| standard | + more Nuclei templates |
+| deep | + fuzzing templates |
+
+**Note:** SSL/TLS analysis (testssl.sh) is opt-in with `--ssl` flag.
+
+## Output
+
+```bash
+voidsec scan https://target.com --output report.html
+```
+
+Report includes:
+- Severity summary (Critical/High/Medium/Low/Info)
+- Technology detection
+- Test coverage
+- Findings with reproduce commands
+- Passed security checks
+
+## Maintenance
+
+| Component | Maintenance | How |
+|-----------|-------------|-----|
+| Nuclei templates | Zero | `nuclei -update-templates` |
+| ZAP | Zero | Docker pulls latest |
+| testssl | Zero | System updates |
+| Custom templates | Low | Update when Drupal changes |
+| Filters | Minimal | Quarterly review |
+
+## Install
+
+### Via npm (recommended)
+
+```bash
+# Install globally
+npm install -g @voidagency/web-scanner
+
+# Or use with npx (no installation)
+npx @voidagency/web-scanner scan https://target.com --profile quick
+
+# Setup dependencies (checks brew, installs nuclei, pulls ZAP image)
+voidsec setup
+```
+
+### From source
+
+```bash
+# Clone and install
+git clone <repo-url>
+cd voidsec
+npm install
+npm run build
+
+# Setup dependencies (checks brew, installs nuclei, pulls ZAP image)
+npm run dev -- setup
+```
+
+**Requirements:**
+- Node.js 18+
+- OrbStack or Docker (for ZAP) - [Get OrbStack](https://orbstack.dev/) (recommended, faster & lighter)
+- Homebrew (for installing nuclei)
+- nuclei (auto-installed via `setup` command)
+- testssl.sh (optional, for SSL/TLS analysis)
+
+**Setup Command:**
+The `setup` command automatically:
+- Checks if Homebrew is installed
+- Checks if Docker/OrbStack is running
+- Installs Nuclei via Homebrew if missing
+- Pulls ZAP Docker image if Docker is available
+
+**macOS Note:**
+First run will prompt "Chromium wants to use your keychain" - click **Always Allow**. This is for Nuclei headless templates (Next.js detection). Only asked once.
+
+## Usage
+
+```bash
+# Quick scan
+voidsec scan https://target.com --profile quick
+
+# Nuclei only (fast, no Docker)
+voidsec scan https://target.com --profile quick --no-zap
+
+# With SSL/TLS analysis
+voidsec scan https://target.com --ssl
+
+# With output
+voidsec scan https://target.com --output report.html
+
+# Disable CVE lookup
+voidsec scan https://target.com --no-cve
+
+# Test Drupal checks only
+voidsec test-drupal https://target.com
+```
+
+**Note:** If installed from source, use `npm run dev --` prefix (e.g., `npm run dev -- scan ...`)

package/dist/aggregator.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Finding Aggregator
+ * Combine and normalize findings from all scanning tools
+ */
+import { Finding, Report, ScanProfile, SeverityCounts, TechDetection } from './types.js';
+/**
+ * Count findings by severity
+ */
+export declare function countSeverities(findings: Finding[]): SeverityCounts;
+/**
+ * Sort findings by severity (critical first)
+ */
+export declare function sortBySeverity(findings: Finding[]): Finding[];
+/**
+ * Re-number findings sequentially
+ */
+export declare function renumberFindings(findings: Finding[]): Finding[];
+/**
+ * Deduplicate findings by title and target
+ */
+export declare function deduplicateFindings(findings: Finding[]): Finding[];
+/**
+ * Consolidate findings - group same vulnerability type across multiple URLs
+ * Results in one finding with list of affected URLs
+ */
+export declare function consolidateFindings(findings: Finding[]): Finding[];
+/**
+ * Merge technology detections from multiple sources
+ */
+export declare function mergeTechnologies(techLists: TechDetection[][]): TechDetection[];
+/**
+ * Format duration in human-readable format
+ */
+export declare function formatDuration(ms: number): string;
+/**
+ * Lookup CVEs for detected technologies (default behavior)
+ * Only checks nginx, drupal, php, nextjs etc.
+ */
+export declare function lookupDefaultCves(findings: Finding[], target: string, onProgress?: (msg: string) => void): Promise<Finding[]>;
+/**
+ * Full NVD enrichment (--enrich flag)
+ * - Enriches existing CVE findings with full descriptions
+ * - Looks up CVEs for ALL detected technology versions
+ */
+export declare function enrichFindings(findings: Finding[], target: string, options?: {
+    enableNvd?: boolean;
+    manualTech?: Array<{
+        tech: string;
+        version: string;
+    }>;
+    onProgress?: (msg: string) => void;
+}): Promise<Finding[]>;
+/**
+ * Aggregate all findings into a report
+ */
+export declare function aggregateFindings(target: string, profile: ScanProfile, startTime: Date, endTime: Date, allFindings: Finding[], technologies: TechDetection[], options?: {
+    enableNvd?: boolean;
+    disableCve?: boolean;
+    manualTech?: Array<{
+        tech: string;
+        version: string;
+    }>;
+    onProgress?: (msg: string) => void;
+}): Promise<Report>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../src/aggregator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAA2B,MAAM,YAAY,CAAC;AAIlH;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,cAAc,CAcnE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAG7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAK/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAalE;AA0GD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAmDlE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,GAAG,aAAa,EAAE,CAkB/E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CASjD;AA0ND;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,OAAO,EAAE,CAAC,CAiBpB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9B,GACL,OAAO,CAAC,OAAO,EAAE,CAAC,CAwFpB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,IAAI,EACf,OAAO,EAAE,IAAI,EACb,WAAW,EAAE,OAAO,EAAE,EACtB,YAAY,EAAE,aAAa,EAAE,EAC7B,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9B,GACL,OAAO,CAAC,MAAM,CAAC,CA0CjB"}