create-dwy 0.5.0 → 0.6.0

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_web.py

@@ -0,0 +1,330 @@
+"""阶段 4：Web 应用测试 — 目录枚举、SQL 注入探测、XSS 探测（HTTP 探测全异步并发）。
+
+用法:
+    uv run pentest_web.py --target <url> --mode dir|sqli|xss --output-dir <dir>
+"""
+
+import argparse
+import asyncio
+import sys
+import time
+from pathlib import Path
+
+import httpx
+from rich.console import Console
+
+from lib.executor import AuditLog, run_command, save_json_result
+from lib.validator import validate_target
+
+console = Console()
+
+XSS_PROBE = "<dwy-xss-test>"
+XSS_PAYLOADS = [
+    '<dwy-xss-test>',
+    '"><dwy-xss-test>',
+    "'-dwy-xss-test-'",
+    'javascript:dwy-xss-test',
+    '<img src=x onerror=dwy-xss-test>',
+]
+
+COMMON_PATHS = [
+    "/admin", "/login", "/api", "/backup", "/.env", "/.git/HEAD",
+    "/.htaccess", "/wp-admin", "/wp-login.php", "/phpmyadmin",
+    "/robots.txt", "/sitemap.xml", "/server-status", "/server-info",
+    "/.DS_Store", "/web.config", "/crossdomain.xml", "/favicon.ico",
+    "/api/v1", "/api/docs", "/swagger.json", "/openapi.json",
+    "/graphql", "/.well-known/security.txt", "/config.json",
+    "/package.json", "/composer.json", "/Dockerfile",
+]
+SENSITIVE_PATTERNS = [".env", ".git", ".htaccess", "backup", ".sql", ".bak", "config", "wp-admin", "phpmyadmin"]
+SQLI_PROBES = ["'", "\"", "' OR '1'='1", "1' OR '1'='1' --", "1 UNION SELECT NULL--"]
+SQL_ERROR_PATTERNS = [
+    "SQL syntax", "mysql_fetch", "ORA-", "PostgreSQL",
+    "SQLite", "SQLITE_ERROR", "Unclosed quotation",
+    "unterminated string", "syntax error",
+]
+SECURITY_HEADERS = {
+    "X-Content-Type-Options": "防止 MIME 嗅探",
+    "X-Frame-Options": "防止点击劫持",
+    "Content-Security-Policy": "内容安全策略",
+    "X-XSS-Protection": "XSS 过滤",
+    "Strict-Transport-Security": "HSTS",
+}
+
+
+async def _async_probe_path(client: httpx.AsyncClient, base_url: str, path: str) -> dict | None:
+    try:
+        resp = await client.get(f"{base_url}{path}")
+        if resp.status_code in (200, 201, 204, 301, 302, 307, 401, 403):
+            return {
+                "path": path,
+                "status": resp.status_code,
+                "size": len(resp.content),
+                "redirect": resp.headers.get("location", ""),
+            }
+    except Exception:
+        pass
+    return None
+
+
+async def _async_enum_paths(url: str, paths: list[str]) -> list[dict]:
+    """并发探测路径列表。"""
+    limits = httpx.Limits(max_connections=20, max_keepalive_connections=10)
+    async with httpx.AsyncClient(timeout=5, verify=False, follow_redirects=False, limits=limits) as client:
+        tasks = [_async_probe_path(client, url, p) for p in paths]
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+    return [r for r in results if isinstance(r, dict)]
+
+
+def scan_directory(url: str, audit: AuditLog, output_dir: Path) -> list[dict]:
+    """目录/文件枚举（gobuster → ffuf → 内置并发探测）。"""
+    findings = []
+    console.print(f"[bold]目录枚举: {url}[/bold]")
+
+    gobuster_output = output_dir / "gobuster_raw.txt"
+    cmd = [
+        "gobuster", "dir",
+        "-u", url,
+        "-w", "/usr/share/wordlists/dirb/common.txt",
+        "-o", str(gobuster_output),
+        "-t", "20",
+        "-q",
+        "--no-error",
+        "-s", "200,201,204,301,302,307,401,403",
+    ]
+
+    result = run_command(cmd, timeout=300, audit=audit)
+
+    if result.returncode == -3:
+        console.print("[yellow]gobuster 未安装，尝试 ffuf...[/yellow]")
+        ffuf_output = output_dir / "ffuf_raw.json"
+        cmd = [
+            "ffuf",
+            "-u", f"{url}/FUZZ",
+            "-w", "/usr/share/wordlists/dirb/common.txt",
+            "-o", str(ffuf_output),
+            "-of", "json",
+            "-t", "20",
+            "-mc", "200,201,204,301,302,307,401,403",
+            "-s",
+        ]
+        result = run_command(cmd, timeout=300, audit=audit)
+
+    if result.returncode == -3:
+        console.print("[yellow]gobuster/ffuf 均未安装，使用内置路径列表（并发）...[/yellow]")
+        findings = asyncio.run(_async_enum_paths(url, COMMON_PATHS))
+    elif result.returncode == 0 and gobuster_output.exists():
+        with open(gobuster_output) as f:
+            for line in f:
+                parts = line.strip().split()
+                if parts:
+                    findings.append({
+                        "path": parts[0],
+                        "status": int(parts[1].strip("()")) if len(parts) > 1 else 200,
+                        "size": 0,
+                    })
+
+    for f in findings:
+        f["sensitive"] = any(p in f["path"].lower() for p in SENSITIVE_PATTERNS)
+        if f["sensitive"]:
+            console.print(f"  [red][敏感][/red] {f['path']} — {f['status']}")
+        else:
+            console.print(f"  [green]{f['path']}[/green] — {f['status']}")
+
+    console.print(f"  发现 {len(findings)} 个路径")
+    return findings
+
+
+def scan_sqli(url: str, audit: AuditLog, output_dir: Path) -> list[dict]:
+    """SQL 注入探测（sqlmap，仅检测不利用）。"""
+    findings = []
+    console.print(f"[bold]SQL 注入探测: {url}[/bold]")
+
+    sqlmap_output = output_dir / "sqlmap_output"
+    cmd = [
+        "sqlmap",
+        "-u", url,
+        "--batch",
+        "--level", "3",
+        "--risk", "2",
+        "--technique=BEU",
+        "--output-dir", str(sqlmap_output),
+        "--forms",
+        "--crawl=2",
+        "--threads=4",
+        "--random-agent",
+    ]
+
+    result = run_command(cmd, timeout=600, audit=audit)
+
+    if result.blocked:
+        console.print(f"[red]sqlmap 被安全策略拦截: {result.block_reason}[/red]")
+        return findings
+
+    if result.returncode == -3:
+        console.print("[yellow]sqlmap 未安装，使用基础 SQL 注入并发探针...[/yellow]")
+        return asyncio.run(_async_basic_sqli_probe(url))
+
+    if result.returncode == 0:
+        output_text = result.stdout
+        if "is vulnerable" in output_text.lower() or "injectable" in output_text.lower():
+            for line in output_text.split("\n"):
+                if "Parameter:" in line or "injectable" in line.lower():
+                    findings.append({
+                        "type": "SQL Injection",
+                        "detail": line.strip(),
+                        "url": url,
+                        "severity": "High",
+                        "cvss": 8.0,
+                    })
+                    console.print(f"  [red][SQLi] {line.strip()}[/red]")
+
+    if not findings:
+        console.print("  [green]未发现 SQL 注入点[/green]")
+
+    return findings
+
+
+async def _async_sqli_one(client: httpx.AsyncClient, url: str, probe: str) -> dict | None:
+    test_url = f"{url}{probe}" if "?" in url else f"{url}?id={probe}"
+    try:
+        resp = await client.get(test_url)
+        for pattern in SQL_ERROR_PATTERNS:
+            if pattern.lower() in resp.text.lower():
+                return {
+                    "type": "SQL Injection (Basic Probe)",
+                    "detail": f"SQL 错误特征 '{pattern}' 在探针 '{probe}' 后出现",
+                    "url": test_url,
+                    "severity": "High",
+                    "cvss": 8.0,
+                    "_pattern": pattern,
+                }
+    except Exception:
+        return None
+    return None
+
+
+async def _async_basic_sqli_probe(url: str) -> list[dict]:
+    """基础 SQL 注入并发探针。"""
+    findings: list[dict] = []
+    async with httpx.AsyncClient(timeout=10, verify=False, follow_redirects=True) as client:
+        tasks = [_async_sqli_one(client, url, probe) for probe in SQLI_PROBES]
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+
+    for r in results:
+        if isinstance(r, dict):
+            console.print(f"  [red][SQLi] 发现 SQL 错误: {r['_pattern']}[/red]")
+            r.pop("_pattern", None)
+            findings.append(r)
+    return findings
+
+
+async def _async_xss_one(client: httpx.AsyncClient, url: str, payload: str) -> dict | None:
+    test_url = f"{url}&xss_test={payload}" if "?" in url else f"{url}?q={payload}"
+    try:
+        resp = await client.get(test_url)
+        if XSS_PROBE in resp.text or "dwy-xss-test" in resp.text:
+            return {
+                "type": "Reflected XSS",
+                "detail": f"探针 '{payload}' 被反射到响应中",
+                "url": test_url,
+                "severity": "Medium",
+                "cvss": 6.1,
+            }
+    except Exception:
+        return None
+    return None
+
+
+async def _async_check_security_headers(client: httpx.AsyncClient, url: str) -> list[dict]:
+    findings: list[dict] = []
+    try:
+        resp = await client.get(url)
+        headers_lower = {k.lower() for k in resp.headers.keys()}
+        for header, desc in SECURITY_HEADERS.items():
+            if header.lower() not in headers_lower:
+                findings.append({
+                    "type": "Missing Security Header",
+                    "detail": f"缺少 {header} 头（{desc}）",
+                    "url": url,
+                    "severity": "Low",
+                    "cvss": 2.0,
+                })
+    except Exception:
+        pass
+    return findings
+
+
+async def _async_xss_scan(url: str) -> list[dict]:
+    findings: list[dict] = []
+    async with httpx.AsyncClient(timeout=10, verify=False, follow_redirects=True) as client:
+        # XSS payload 探测 + 安全头检查 全部并发
+        payload_tasks = [_async_xss_one(client, url, p) for p in XSS_PAYLOADS]
+        header_task = _async_check_security_headers(client, url)
+        results = await asyncio.gather(*payload_tasks, header_task, return_exceptions=True)
+
+    for r in results[:-1]:
+        if isinstance(r, dict):
+            console.print(f"  [yellow][XSS] 反射探针被检测到: {r['detail']}[/yellow]")
+            findings.append(r)
+
+    header_findings = results[-1] if isinstance(results[-1], list) else []
+    for h in header_findings:
+        console.print(f"  [blue][Header] {h['detail']}[/blue]")
+        findings.append(h)
+
+    return findings
+
+
+def scan_xss(url: str, audit: AuditLog) -> list[dict]:
+    """XSS 反射探测（payload + 安全头并发）。"""
+    console.print(f"[bold]XSS 反射探测: {url}[/bold]")
+    findings = asyncio.run(_async_xss_scan(url))
+    if not findings:
+        console.print("  [green]未发现 XSS 反射点[/green]")
+    return findings
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - Web 应用测试（并发）")
+    parser.add_argument("--target", required=True, help="目标 URL")
+    parser.add_argument("--mode", required=True, choices=["dir", "sqli", "xss"], help="测试模式")
+    parser.add_argument("--output-dir", required=True, help="输出目录")
+    args = parser.parse_args()
+
+    target, warning = validate_target(args.target)
+    if target is None:
+        console.print(f"[red]{warning}[/red]")
+        sys.exit(1)
+    if warning:
+        console.print(f"[yellow]{warning}[/yellow]")
+
+    output_dir = Path(args.output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+    audit = AuditLog(output_dir / "audit.log")
+
+    url = target.web_url or f"http://{target.host}"
+    findings = []
+
+    if args.mode == "dir":
+        findings = scan_directory(url, audit, output_dir)
+    elif args.mode == "sqli":
+        findings = scan_sqli(url, audit, output_dir)
+    elif args.mode == "xss":
+        findings = scan_xss(url, audit)
+
+    result = {
+        "target": url,
+        "mode": args.mode,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "findings": findings,
+        "total": len(findings),
+    }
+
+    output_file = output_dir / f"web_{args.mode}.json"
+    save_json_result(result, output_file)
+    console.print(f"\n[green]结果已保存: {output_file}[/green]")
+
+
+if __name__ == "__main__":
+    main()

package/templates/claude-global/skills/dwy-pentest/scripts/pyproject.toml

@@ -0,0 +1,14 @@
+[project]
+name = "dwy-pentest"
+version = "0.1.0"
+description = "White-hat penetration testing scripts for Claude Code skill"
+requires-python = ">=3.11"
+dependencies = [
+    "python-nmap>=0.7.1",
+    "httpx>=0.27.0",
+    "dnspython>=2.6.0",
+    "python-whois>=0.9.4",
+    "rich>=13.0.0",
+    "jinja2>=3.1.0",
+    "pydantic>=2.0.0",
+]

package/templates/claude-global/skills/dwy-pentest/scripts/setup_tools.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# setup_tools.sh — 检测并安装渗透测试所需的 CLI 工具
+# 仅支持 macOS (brew)
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+# 工具列表：命令名 → brew 包名
+declare -A TOOLS=(
+    ["nmap"]="nmap"
+    ["nuclei"]="nuclei"
+    ["testssl"]="testssl"
+    ["gobuster"]="gobuster"
+    ["sqlmap"]="sqlmap"
+    ["hydra"]="hydra"
+    ["ffuf"]="ffuf"
+    ["whatweb"]="whatweb"
+)
+
+echo "========================================="
+echo "  dwy-pentest 环境检测与安装"
+echo "========================================="
+echo ""
+
+# 检查 brew
+if ! command -v brew &> /dev/null; then
+    echo -e "${RED}[ERROR] Homebrew 未安装，请先安装: https://brew.sh${NC}"
+    exit 1
+fi
+
+MISSING=()
+INSTALLED=()
+
+for cmd in "${!TOOLS[@]}"; do
+    if command -v "$cmd" &> /dev/null; then
+        version=$($cmd --version 2>/dev/null | head -1 || echo "已安装")
+        echo -e "${GREEN}[OK]${NC} $cmd — $version"
+        INSTALLED+=("$cmd")
+    else
+        echo -e "${YELLOW}[MISSING]${NC} $cmd"
+        MISSING+=("$cmd")
+    fi
+done
+
+echo ""
+
+if [ ${#MISSING[@]} -eq 0 ]; then
+    echo -e "${GREEN}所有工具已就绪！${NC}"
+else
+    echo -e "${YELLOW}缺少 ${#MISSING[@]} 个工具，正在安装...${NC}"
+    echo ""
+
+    for cmd in "${MISSING[@]}"; do
+        pkg="${TOOLS[$cmd]}"
+        echo -e "  安装 $pkg ..."
+        brew install "$pkg" 2>/dev/null || echo -e "${RED}  [WARN] $pkg 安装失败，请手动安装${NC}"
+    done
+
+    echo ""
+    echo "安装完成，重新检测："
+    for cmd in "${MISSING[@]}"; do
+        if command -v "$cmd" &> /dev/null; then
+            echo -e "  ${GREEN}[OK]${NC} $cmd"
+        else
+            echo -e "  ${RED}[FAIL]${NC} $cmd — 请手动安装"
+        fi
+    done
+fi
+
+# 更新 nuclei 模板
+if command -v nuclei &> /dev/null; then
+    echo ""
+    echo "更新 nuclei 漏洞模板..."
+    nuclei -update-templates 2>/dev/null || echo -e "${YELLOW}[WARN] nuclei 模板更新失败，可能需要网络${NC}"
+fi
+
+# 检查 Python 环境
+echo ""
+echo "检查 Python 环境..."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if command -v uv &> /dev/null; then
+    echo "使用 uv 同步 Python 依赖..."
+    cd "$SCRIPT_DIR" && uv sync 2>/dev/null || echo -e "${YELLOW}[WARN] uv sync 失败${NC}"
+    echo -e "${GREEN}Python 环境就绪${NC}"
+else
+    echo -e "${YELLOW}[WARN] uv 未安装，请安装: pip install uv${NC}"
+fi
+
+echo ""
+echo "========================================="
+echo -e "${GREEN}  环境准备完成${NC}"
+echo "========================================="