farai 0.1.0

package/docker/kali/Dockerfile

@@ -0,0 +1,117 @@
+ARG GO_VERSION=1.25.0
+ARG GOPLS_VERSION=v0.20.0
+ARG RUST_ANALYZER_VERSION=2025-08-25
+
+FROM golang:${GO_VERSION}-bookworm AS lsp-builder
+ARG GOPLS_VERSION
+ARG RUST_ANALYZER_VERSION
+ARG TARGETARCH
+RUN mkdir -p /out \
+  && GOBIN=/out go install golang.org/x/tools/gopls@${GOPLS_VERSION}
+
+RUN set -eux; \
+  case "${TARGETARCH:-amd64}" in \
+    amd64) rust_analyzer_arch=x86_64; rust_analyzer_sha=487fb1cb99e567fd6b818cc88a7c1452d5260da57dbc171fc1359a4b604348ae ;; \
+    arm64) rust_analyzer_arch=aarch64; rust_analyzer_sha=c738e00a5caa712f9d9c8f81f9661884c7108ef94db6df48985c11fe3c2695bd ;; \
+    *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+  esac; \
+  curl -fsSL "https://github.com/rust-lang/rust-analyzer/releases/download/${RUST_ANALYZER_VERSION}/rust-analyzer-${rust_analyzer_arch}-unknown-linux-gnu.gz" -o /tmp/rust-analyzer.gz; \
+  echo "${rust_analyzer_sha}  /tmp/rust-analyzer.gz" | sha256sum -c -; \
+  gzip -dc /tmp/rust-analyzer.gz >/out/rust-analyzer; \
+  chmod 0755 /out/rust-analyzer; \
+  /out/rust-analyzer --version; \
+  rm -f /tmp/rust-analyzer.gz
+
+FROM kalilinux/kali-rolling
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+ARG TARGETARCH
+ARG NAABU_VERSION=2.6.1
+ARG INTERACTSH_VERSION=1.3.1
+ARG TYPESCRIPT_VERSION=5.9.3
+ARG TYPESCRIPT_LANGUAGE_SERVER_VERSION=4.3.4
+ARG PYRIGHT_VERSION=1.1.408
+
+LABEL org.farai.kali.contract="curated-security-runtime"
+
+COPY farai-tool-manifest.json /usr/local/share/farai/farai-tool-manifest.json
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends python3-minimal \
+  && python3 -c 'import json, subprocess; manifest=json.load(open("/usr/local/share/farai/farai-tool-manifest.json", encoding="utf-8")); subprocess.run(["apt-get", "install", "-y", "--no-install-recommends", *manifest["aptPackages"]], check=True)' \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+  case "${TARGETARCH:-amd64}" in \
+    amd64) \
+      naabu_arch=amd64; naabu_sha=018c4c9884dea971eda860435ede3021d1150732f34cfd245498c6726d8cab90; \
+      interactsh_arch=amd64; interactsh_sha=d553fb3dd4c2684c953aedeb555f13f0d1ca94bd75112c949a5fd975d385a903 ;; \
+    arm64) \
+      naabu_arch=arm64; naabu_sha=3adc2bb2395c3efff89623499b20eea66ef54924c485d3ae86762393a31736ea; \
+      interactsh_arch=arm64; interactsh_sha=475aa78c59afad115149a5b0d6d9c99d2410a4f12d0c6f5a24c32e7338fc6adb ;; \
+    *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+  esac; \
+  curl -fsSL "https://github.com/projectdiscovery/naabu/releases/download/v${NAABU_VERSION}/naabu_${NAABU_VERSION}_linux_${naabu_arch}.zip" -o /tmp/naabu.zip; \
+  echo "${naabu_sha}  /tmp/naabu.zip" | sha256sum -c -; \
+  unzip -q /tmp/naabu.zip -d /tmp/naabu; \
+  install -m 0755 /tmp/naabu/naabu /usr/local/bin/naabu; \
+  curl -fsSL "https://github.com/projectdiscovery/interactsh/releases/download/v${INTERACTSH_VERSION}/interactsh-client_${INTERACTSH_VERSION}_linux_${interactsh_arch}.zip" -o /tmp/interactsh.zip; \
+  echo "${interactsh_sha}  /tmp/interactsh.zip" | sha256sum -c -; \
+  unzip -q /tmp/interactsh.zip -d /tmp/interactsh; \
+  install -m 0755 /tmp/interactsh/interactsh-client /usr/local/bin/interactsh-client; \
+  rm -rf /tmp/naabu /tmp/interactsh /tmp/naabu.zip /tmp/interactsh.zip
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
+  && ln -sf /root/.local/bin/uv /usr/local/bin/uv \
+  && ln -sf /root/.local/bin/uvx /usr/local/bin/uvx
+
+RUN UV_TOOL_DIR=/opt/uv/tools UV_TOOL_BIN_DIR=/opt/uv/bin uv tool install --with fastmcp mitmproxy-mcp==0.6.1 \
+  && chmod -R a+rX /opt/uv \
+  && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install -g \
+    @playwright/mcp@latest \
+    typescript@${TYPESCRIPT_VERSION} \
+    typescript-language-server@${TYPESCRIPT_LANGUAGE_SERVER_VERSION} \
+    pyright@${PYRIGHT_VERSION} \
+  && uv cache clean \
+  && npm cache clean --force
+
+COPY --from=lsp-builder /out/gopls /usr/local/bin/gopls
+COPY --from=lsp-builder /out/rust-analyzer /usr/local/bin/rust-analyzer
+
+RUN useradd --system --create-home --home-dir /home/mitm --shell /usr/sbin/nologin mitm \
+  && mkdir -p /home/mitm/.mitmproxy /usr/local/share/farai \
+  && openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+    -keyout /tmp/farai-ca-key.pem -out /tmp/farai-ca-cert.pem \
+    -subj "/CN=farai mitmproxy/O=farai" \
+    -addext "basicConstraints=critical,CA:TRUE" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" \
+  && cat /tmp/farai-ca-key.pem /tmp/farai-ca-cert.pem >/home/mitm/.mitmproxy/mitmproxy-ca.pem \
+  && cp /tmp/farai-ca-cert.pem /home/mitm/.mitmproxy/mitmproxy-ca-cert.pem \
+  && cp /tmp/farai-ca-cert.pem /usr/local/share/ca-certificates/farai-mitmproxy.crt \
+  && cp /tmp/farai-ca-cert.pem /usr/local/share/farai/farai-mitmproxy-ca.pem \
+  && rm -f /tmp/farai-ca-key.pem /tmp/farai-ca-cert.pem \
+  && chown -R mitm:mitm /home/mitm \
+  && chmod 700 /home/mitm/.mitmproxy \
+  && update-ca-certificates \
+  && mkdir -p /root/.pki/nssdb \
+  && certutil -d sql:/root/.pki/nssdb -N --empty-password \
+  && certutil -d sql:/root/.pki/nssdb -A -n farai-mitmproxy -t "C,," -i /usr/local/share/farai/farai-mitmproxy-ca.pem
+
+COPY redsocks.conf.tmpl /usr/local/share/farai/redsocks.conf.tmpl
+COPY farai-proxy-init.sh /usr/local/bin/farai-proxy-init
+COPY farai-proxy-teardown.sh /usr/local/bin/farai-proxy-teardown
+COPY farai-mitmproxy-mcp.sh /usr/local/bin/mitmproxy-mcp
+COPY farai_mitmproxy_mcp.py /usr/local/share/farai/farai_mitmproxy_mcp.py
+COPY farai-image-doctor.py /usr/local/bin/farai-image-doctor
+RUN chmod 0755 /usr/local/bin/farai-proxy-init /usr/local/bin/farai-proxy-teardown /usr/local/bin/mitmproxy-mcp /usr/local/bin/farai-image-doctor \
+  && farai-image-doctor --write /usr/local/share/farai/kali-capabilities.json
+
+ENV NODE_EXTRA_CA_CERTS=/usr/local/share/farai/farai-mitmproxy-ca.pem \
+    REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
+    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
+    CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
+    GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt
+
+WORKDIR /workspace

package/docker/kali/farai-image-doctor.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+def resolve_manifest_path():
+    configured = os.environ.get("FARAI_TOOL_MANIFEST")
+    candidates = [
+        Path(configured) if configured else None,
+        Path("/usr/local/share/farai/farai-tool-manifest.json"),
+        Path(__file__).with_name("farai-tool-manifest.json"),
+    ]
+    for candidate in candidates:
+        if candidate is not None and candidate.is_file():
+            return candidate
+    raise FileNotFoundError("farai tool manifest not found")
+
+
+MANIFEST_PATH = resolve_manifest_path()
+MANIFEST = json.loads(MANIFEST_PATH.read_text(encoding="utf-8"))
+CONTRACT = MANIFEST["contract"]
+APT_PACKAGES = tuple(MANIFEST["aptPackages"])
+WORKFLOWS = MANIFEST["workflows"]
+REQUIRED = tuple(dict.fromkeys(command for commands in WORKFLOWS.values() for command in commands))
+
+
+def installed_commands():
+    commands = {}
+    for directory in os.environ.get("PATH", "").split(os.pathsep):
+        resolved = os.path.realpath(directory)
+        if not resolved or not os.path.isdir(resolved):
+            continue
+        try:
+            names = os.listdir(resolved)
+        except OSError:
+            continue
+        for name in names:
+            path = os.path.join(resolved, name)
+            if name not in commands and os.path.isfile(path) and os.access(path, os.X_OK):
+                commands[name] = path
+    return commands
+
+
+def missing_packages():
+    missing = []
+    for package in APT_PACKAGES:
+        result = subprocess.run(
+            ["dpkg-query", "-W", "-f=${Status}", package],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if result.returncode != 0 or result.stdout.strip() != "install ok installed":
+            missing.append(package)
+    return missing
+
+
+commands = installed_commands()
+missing = [name for name in REQUIRED if name not in commands]
+missing_apt_packages = missing_packages()
+payload = {
+    "contract": CONTRACT,
+    "manifest": str(MANIFEST_PATH),
+    "inventoryCount": len(commands),
+    "packageCount": len(APT_PACKAGES),
+    "requiredCount": len(REQUIRED),
+    "missing": missing,
+    "missingPackages": missing_apt_packages,
+    "workflows": WORKFLOWS,
+}
+
+if len(sys.argv) == 3 and sys.argv[1] == "--write":
+    payload["commands"] = sorted(commands)
+    destination = Path(sys.argv[2])
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    destination.write_text(json.dumps(payload, ensure_ascii=True, separators=(",", ":")) + "\n", encoding="utf-8")
+else:
+    print(json.dumps(payload, ensure_ascii=True, separators=(",", ":")))
+
+raise SystemExit(0 if not missing and not missing_apt_packages else 1)

package/docker/kali/farai-mitmproxy-mcp.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+proxy_user="${FARAI_PROXY_USER:-mitm}"
+chown "$proxy_user:$proxy_user" "$PWD" 2>/dev/null || true
+
+exec setpriv --reuid="$proxy_user" --regid="$proxy_user" --init-groups \
+  env HOME=/home/mitm PATH=/opt/uv/bin:/usr/local/bin:/usr/bin:/bin \
+  /opt/uv/tools/mitmproxy-mcp/bin/python /usr/local/share/farai/farai_mitmproxy_mcp.py "$@"

package/docker/kali/farai-proxy-init.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+set -euo pipefail
+
+proxy_port="${FARAI_PROXY_PORT:-31337}"
+redsocks_port="${FARAI_REDSOCKS_PORT:-31338}"
+tcp_ports="${FARAI_PROXY_TCP_PORTS:-80,443,3000,5000,8000,8008,8080,8081,8443,8888,9000}"
+proxy_user="${FARAI_PROXY_USER:-mitm}"
+runtime_dir=/run/farai
+chain=FARAI_PROXY
+
+mkdir -p "$runtime_dir"
+
+proxy_listening() {
+  (exec 3<>"/dev/tcp/127.0.0.1/$proxy_port") 2>/dev/null || return 1
+  exec 3>&- 3<&-
+  return 0
+}
+
+attempts=0
+until proxy_listening; do
+  attempts=$((attempts + 1))
+  if [ "$attempts" -ge 60 ]; then
+    echo "farai-proxy-init: no proxy listening on 127.0.0.1:$proxy_port" >&2
+    exit 1
+  fi
+  sleep 0.5
+done
+
+if ! [ -s "$runtime_dir/redsocks.pid" ] || ! kill -0 "$(cat "$runtime_dir/redsocks.pid")" 2>/dev/null; then
+  sed -e "s/__LOCAL_PORT__/$redsocks_port/" -e "s/__PROXY_PORT__/$proxy_port/" \
+    /usr/local/share/farai/redsocks.conf.tmpl >"$runtime_dir/redsocks.conf"
+  redsocks -c "$runtime_dir/redsocks.conf" -p "$runtime_dir/redsocks.pid"
+fi
+
+iptables -t nat -N "$chain" 2>/dev/null || true
+iptables -t nat -F "$chain"
+iptables -t nat -A "$chain" -d 127.0.0.0/8 -j RETURN
+iptables -t nat -A "$chain" -m owner --uid-owner "$proxy_user" -j RETURN
+iptables -t nat -A "$chain" -p tcp -m multiport --dports "$tcp_ports" -j REDIRECT --to-ports "$redsocks_port"
+iptables -t nat -C OUTPUT -p tcp -j "$chain" 2>/dev/null || iptables -t nat -A OUTPUT -p tcp -j "$chain"
+iptables -C OUTPUT -p udp --dport 443 -j REJECT 2>/dev/null || iptables -A OUTPUT -p udp --dport 443 -j REJECT
+
+echo "farai-proxy-init: transparent capture active on tcp $tcp_ports via 127.0.0.1:$proxy_port"

package/docker/kali/farai-proxy-teardown.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -uo pipefail
+
+chain=FARAI_PROXY
+runtime_dir=/run/farai
+
+iptables -t nat -D OUTPUT -p tcp -j "$chain" 2>/dev/null || true
+iptables -t nat -F "$chain" 2>/dev/null || true
+iptables -t nat -X "$chain" 2>/dev/null || true
+iptables -D OUTPUT -p udp --dport 443 -j REJECT 2>/dev/null || true
+
+if [ -s "$runtime_dir/redsocks.pid" ]; then
+  kill "$(cat "$runtime_dir/redsocks.pid")" 2>/dev/null || true
+  rm -f "$runtime_dir/redsocks.pid"
+fi
+
+echo "farai-proxy-init: transparent capture disabled"

package/docker/kali/farai-tool-manifest.json

@@ -0,0 +1,215 @@
+{
+  "contract": "curated-security-runtime",
+  "aptPackages": [
+    "amass",
+    "arjun",
+    "assetfinder",
+    "binwalk",
+    "bind9-dnsutils",
+    "build-essential",
+    "ca-certificates",
+    "cargo",
+    "chromium",
+    "commix",
+    "curl",
+    "dirb",
+    "dirsearch",
+    "dnsenum",
+    "dnsrecon",
+    "dnsx",
+    "enum4linux-ng",
+    "evil-winrm",
+    "exploitdb",
+    "feroxbuster",
+    "ffuf",
+    "file",
+    "findomain",
+    "fonts-liberation",
+    "foremost",
+    "gdb",
+    "git",
+    "gobuster",
+    "golang-go",
+    "hashcat",
+    "hydra",
+    "impacket-scripts",
+    "iproute2",
+    "iptables",
+    "iputils-ping",
+    "john",
+    "jq",
+    "less",
+    "libimage-exiftool-perl",
+    "libnss3-tools",
+    "libpcap0.8t64",
+    "masscan",
+    "massdns",
+    "medusa",
+    "mitmproxy",
+    "ncrack",
+    "netcat-traditional",
+    "netexec",
+    "nikto",
+    "nmap",
+    "nodejs",
+    "npm",
+    "nuclei",
+    "openssh-client",
+    "openssl",
+    "pipx",
+    "procps",
+    "python3",
+    "python3-pip",
+    "python3-venv",
+    "radare2",
+    "redsocks",
+    "responder",
+    "ripgrep",
+    "rustc",
+    "smbclient",
+    "smbmap",
+    "socat",
+    "sqlmap",
+    "sslscan",
+    "sslyze",
+    "steghide",
+    "subfinder",
+    "tcpdump",
+    "testssl.sh",
+    "theharvester",
+    "tree",
+    "tshark",
+    "unzip",
+    "util-linux",
+    "wafw00f",
+    "wapiti",
+    "wget",
+    "wfuzz",
+    "whatweb",
+    "whois",
+    "wordlists",
+    "wpscan",
+    "xz-utils",
+    "yara",
+    "zip"
+  ],
+  "workflows": {
+    "shell-and-network-utilities": [
+      "curl",
+      "dig",
+      "file",
+      "ip",
+      "iptables",
+      "jq",
+      "nc",
+      "openssl",
+      "ping",
+      "rg",
+      "ssh",
+      "unzip",
+      "wget",
+      "whois",
+      "zip"
+    ],
+    "browser-and-proxy": [
+      "chromium",
+      "mitmdump",
+      "mitmproxy",
+      "mitmproxy-mcp",
+      "playwright-mcp"
+    ],
+    "passive-asset-discovery": [
+      "amass",
+      "assetfinder",
+      "dnsenum",
+      "dnsrecon",
+      "dnsx",
+      "findomain",
+      "massdns",
+      "subfinder",
+      "theHarvester"
+    ],
+    "service-discovery": [
+      "masscan",
+      "naabu",
+      "nmap"
+    ],
+    "callback-verification": [
+      "interactsh-client",
+      "socat"
+    ],
+    "web-content-discovery": [
+      "arjun",
+      "dirb",
+      "dirsearch",
+      "feroxbuster",
+      "ffuf",
+      "gobuster"
+    ],
+    "web-assessment": [
+      "commix",
+      "nikto",
+      "nuclei",
+      "sqlmap",
+      "sslscan",
+      "sslyze",
+      "testssl",
+      "wafw00f",
+      "wapiti",
+      "wfuzz",
+      "whatweb",
+      "wpscan"
+    ],
+    "credential-access": [
+      "hashcat",
+      "hydra",
+      "john",
+      "medusa",
+      "ncrack"
+    ],
+    "exploit-reference": [
+      "searchsploit"
+    ],
+    "active-directory": [
+      "enum4linux-ng",
+      "evil-winrm",
+      "impacket-secretsdump",
+      "netexec",
+      "responder",
+      "smbclient",
+      "smbmap"
+    ],
+    "reverse-engineering-and-forensics": [
+      "binwalk",
+      "exiftool",
+      "foremost",
+      "gdb",
+      "r2",
+      "radare2",
+      "steghide",
+      "yara"
+    ],
+    "network-observation": [
+      "socat",
+      "tcpdump",
+      "tshark"
+    ],
+    "development": [
+      "cargo",
+      "git",
+      "go",
+      "gopls",
+      "node",
+      "npm",
+      "pip3",
+      "pyright",
+      "python3",
+      "rg",
+      "rust-analyzer",
+      "rustc",
+      "typescript-language-server",
+      "uv",
+      "uvx"
+    ]
+  }
+}