jaku.sh 1.0.3 → 1.2.1

package/src/agents/logic-agent.js

@@ -1,4 +1,5 @@
 import { BaseAgent } from './base-agent.js';
+import { allows, getSafetyMode } from '../utils/safety.js';
 import { BusinessRuleInferrer } from '../core/logic/business-rule-inferrer.js';
 import { PricingExploiter } from '../core/logic/pricing-exploiter.js';
 import { AccessBoundaryTester } from '../core/logic/access-boundary-tester.js';
@@ -40,12 +41,39 @@ export class LogicAgent extends BaseAgent {
             throw new Error('No surface inventory available — JAKU-CRAWL must run first');
         }
 
+        const safetyMode = getSafetyMode(config);
+        this._log(`Safety mode: ${safetyMode}`);
+
+        // Tests that issue real state-changing/mutating requests (or that the
+        // user has classified as destructive) require --aggressive. Under
+        // passive/safe-active they are skipped with a clear log line.
+        const allowDestructive = allows(config, 'aggressive');
+        // Active but non-destructive probing requires at least safe-active.
+        const allowActive = allows(config, 'safe-active');
+
+        const skipDestructive = (label, phase, pct) => {
+            this._log(`${label} skipped — requires --aggressive safety mode (current: ${safetyMode})`);
+            this.progress(phase, `${label} skipped (safe mode)`, pct);
+        };
+        const skipActive = (label, phase, pct) => {
+            this._log(`${label} skipped — requires active probing (current: ${safetyMode} mode)`);
+            this.progress(phase, `${label} skipped (passive mode)`, pct);
+        };
+
         // Phase 1: Infer business rules
         this.progress('infer', 'Inferring business rules from surface inventory...', 0);
 
         const inferrer = new BusinessRuleInferrer(logger);
         const businessContext = inferrer.infer(surfaceInventory);
 
+        // Optional, additive LLM domain/invariant inference (no-op when disabled).
+        if (context.llmClient?.isEnabled?.()) {
+            await inferrer.augmentWithLLM(businessContext, surfaceInventory, context.llmClient);
+            if (businessContext.llmInsights?.invariants?.length) {
+                this._log(`LLM inferred ${businessContext.llmInsights.invariants.length} candidate business invariants`);
+            }
+        }
+
         const activeDomains = Object.entries(businessContext.domains)
             .filter(([, items]) => items.length > 0)
             .map(([domain]) => domain);
@@ -62,123 +90,163 @@ export class LogicAgent extends BaseAgent {
         const totalPhases = 11;
         let completed = 1;
 
-        // Phase 2: Pricing exploitation
-        this.progress('pricing', 'Testing pricing & payment logic...', (completed / totalPhases) * 100);
-        try {
-            const exploiter = new PricingExploiter(logger);
-            const pricingFindings = await exploiter.exploit(businessContext);
-            this.addFindings(pricingFindings);
-            this._log(`Pricing: ${pricingFindings.length} issues`);
-        } catch (err) {
-            this._log(`Pricing testing failed: ${err.message}`, 'error');
+        // Phase 2: Pricing exploitation (DESTRUCTIVE — sends mutating requests)
+        if (allowDestructive) {
+            this.progress('pricing', 'Testing pricing & payment logic...', (completed / totalPhases) * 100);
+            try {
+                const exploiter = new PricingExploiter(logger);
+                const pricingFindings = await exploiter.exploit(businessContext);
+                this.addFindings(pricingFindings);
+                this._log(`Pricing: ${pricingFindings.length} issues`);
+            } catch (err) {
+                this._log(`Pricing testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipDestructive('Pricing exploitation', 'pricing', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 3: Access boundary testing
-        this.progress('access', 'Testing access control boundaries...', (completed / totalPhases) * 100);
-        try {
-            const tester = new AccessBoundaryTester(logger);
-            const accessFindings = await tester.test(businessContext, surfaceInventory);
-            this.addFindings(accessFindings);
-            this._log(`Access: ${accessFindings.length} issues`);
-        } catch (err) {
-            this._log(`Access boundary testing failed: ${err.message}`, 'error');
+        // Phase 3: Access boundary testing (active, non-destructive)
+        if (allowActive) {
+            this.progress('access', 'Testing access control boundaries...', (completed / totalPhases) * 100);
+            try {
+                const tester = new AccessBoundaryTester(logger);
+                const accessFindings = await tester.test(businessContext, surfaceInventory);
+                this.addFindings(accessFindings);
+                this._log(`Access: ${accessFindings.length} issues`);
+            } catch (err) {
+                this._log(`Access boundary testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Access boundary testing', 'access', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 4: Workflow enforcement
-        this.progress('workflow', 'Testing workflow enforcement...', (completed / totalPhases) * 100);
-        try {
-            const enforcer = new WorkflowEnforcer(logger);
-            const workflowFindings = await enforcer.enforce(businessContext, surfaceInventory);
-            this.addFindings(workflowFindings);
-            this._log(`Workflow: ${workflowFindings.length} issues`);
-        } catch (err) {
-            this._log(`Workflow testing failed: ${err.message}`, 'error');
+        // Phase 4: Workflow enforcement (active, non-destructive)
+        if (allowActive) {
+            this.progress('workflow', 'Testing workflow enforcement...', (completed / totalPhases) * 100);
+            try {
+                const enforcer = new WorkflowEnforcer(logger);
+                const workflowFindings = await enforcer.enforce(businessContext, surfaceInventory);
+                this.addFindings(workflowFindings);
+                this._log(`Workflow: ${workflowFindings.length} issues`);
+            } catch (err) {
+                this._log(`Workflow testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Workflow enforcement', 'workflow', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 5: Race condition detection
-        this.progress('race', 'Testing for race conditions...', (completed / totalPhases) * 100);
-        try {
-            const detector = new RaceConditionDetector(logger);
-            const raceFindings = await detector.detect(businessContext, surfaceInventory);
-            this.addFindings(raceFindings);
-            this._log(`Race conditions: ${raceFindings.length} issues`);
-        } catch (err) {
-            this._log(`Race condition testing failed: ${err.message}`, 'error');
+        // Phase 5: Race condition detection (DESTRUCTIVE — fires concurrent mutating requests)
+        if (allowDestructive) {
+            this.progress('race', 'Testing for race conditions...', (completed / totalPhases) * 100);
+            try {
+                const detector = new RaceConditionDetector(logger);
+                const raceFindings = await detector.detect(businessContext, surfaceInventory);
+                this.addFindings(raceFindings);
+                this._log(`Race conditions: ${raceFindings.length} issues`);
+            } catch (err) {
+                this._log(`Race condition testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipDestructive('Race condition detection', 'race', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 6: Abuse pattern scanning
-        this.progress('abuse', 'Scanning for abuse patterns...', (completed / totalPhases) * 100);
-        try {
-            const scanner = new AbusePatternScanner(logger);
-            const abuseFindings = await scanner.scan(businessContext, surfaceInventory);
-            this.addFindings(abuseFindings);
-            this._log(`Abuse patterns: ${abuseFindings.length} issues`);
-        } catch (err) {
-            this._log(`Abuse pattern scanning failed: ${err.message}`, 'error');
+        // Phase 6: Abuse pattern scanning (active, non-destructive)
+        if (allowActive) {
+            this.progress('abuse', 'Scanning for abuse patterns...', (completed / totalPhases) * 100);
+            try {
+                const scanner = new AbusePatternScanner(logger);
+                const abuseFindings = await scanner.scan(businessContext, surfaceInventory);
+                this.addFindings(abuseFindings);
+                this._log(`Abuse patterns: ${abuseFindings.length} issues`);
+            } catch (err) {
+                this._log(`Abuse pattern scanning failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Abuse pattern scanning', 'abuse', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 7: Coupon/promo abuse testing
-        this.progress('coupon', 'Testing for coupon/promo abuse...', (completed / totalPhases) * 100);
-        try {
-            const tester = new CouponAbuseTester(logger);
-            const couponFindings = await tester.test(businessContext, surfaceInventory);
-            this.addFindings(couponFindings);
-            this._log(`Coupon abuse: ${couponFindings.length} issues`);
-        } catch (err) {
-            this._log(`Coupon abuse testing failed: ${err.message}`, 'error');
+        // Phase 7: Coupon/promo abuse testing (gated to aggressive per safety policy)
+        if (allowDestructive) {
+            this.progress('coupon', 'Testing for coupon/promo abuse...', (completed / totalPhases) * 100);
+            try {
+                const tester = new CouponAbuseTester(logger);
+                const couponFindings = await tester.test(businessContext, surfaceInventory);
+                this.addFindings(couponFindings);
+                this._log(`Coupon abuse: ${couponFindings.length} issues`);
+            } catch (err) {
+                this._log(`Coupon abuse testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipDestructive('Coupon/promo abuse testing', 'coupon', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 8: Cart manipulation testing
-        this.progress('cart', 'Testing for cart manipulation...', (completed / totalPhases) * 100);
-        try {
-            const tester = new CartManipulationTester(logger);
-            const cartFindings = await tester.test(businessContext, surfaceInventory);
-            this.addFindings(cartFindings);
-            this._log(`Cart manipulation: ${cartFindings.length} issues`);
-        } catch (err) {
-            this._log(`Cart manipulation testing failed: ${err.message}`, 'error');
+        // Phase 8: Cart manipulation testing (gated to aggressive per safety policy)
+        if (allowDestructive) {
+            this.progress('cart', 'Testing for cart manipulation...', (completed / totalPhases) * 100);
+            try {
+                const tester = new CartManipulationTester(logger);
+                const cartFindings = await tester.test(businessContext, surfaceInventory);
+                this.addFindings(cartFindings);
+                this._log(`Cart manipulation: ${cartFindings.length} issues`);
+            } catch (err) {
+                this._log(`Cart manipulation testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipDestructive('Cart manipulation testing', 'cart', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 9: Email enumeration testing
-        this.progress('email-enum', 'Testing for email enumeration...', (completed / totalPhases) * 100);
-        try {
-            const tester = new EmailEnumerationTester(logger);
-            const emailFindings = await tester.test(businessContext, surfaceInventory);
-            this.addFindings(emailFindings);
-            this._log(`Email enumeration: ${emailFindings.length} issues`);
-        } catch (err) {
-            this._log(`Email enumeration testing failed: ${err.message}`, 'error');
+        // Phase 9: Email enumeration testing (active, non-destructive)
+        if (allowActive) {
+            this.progress('email-enum', 'Testing for email enumeration...', (completed / totalPhases) * 100);
+            try {
+                const tester = new EmailEnumerationTester(logger);
+                const emailFindings = await tester.test(businessContext, surfaceInventory);
+                this.addFindings(emailFindings);
+                this._log(`Email enumeration: ${emailFindings.length} issues`);
+            } catch (err) {
+                this._log(`Email enumeration testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Email enumeration testing', 'email-enum', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 10: Account takeover testing
-        this.progress('account-takeover', 'Testing account takeover flows...', (completed / totalPhases) * 100);
-        try {
-            const tester = new AccountTakeoverTester(logger);
-            const atoFindings = await tester.test(businessContext, surfaceInventory);
-            this.addFindings(atoFindings);
-            this._log(`Account takeover: ${atoFindings.length} issues`);
-        } catch (err) {
-            this._log(`Account takeover testing failed: ${err.message}`, 'error');
+        // Phase 10: Account takeover testing (gated to aggressive per safety policy)
+        if (allowDestructive) {
+            this.progress('account-takeover', 'Testing account takeover flows...', (completed / totalPhases) * 100);
+            try {
+                const tester = new AccountTakeoverTester(logger);
+                const atoFindings = await tester.test(businessContext, surfaceInventory);
+                this.addFindings(atoFindings);
+                this._log(`Account takeover: ${atoFindings.length} issues`);
+            } catch (err) {
+                this._log(`Account takeover testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipDestructive('Account takeover testing', 'account-takeover', (completed / totalPhases) * 100);
         }
         completed++;
 
-        // Phase 11: Feature flag bypass testing
-        this.progress('feature-flags', 'Testing for feature flag bypass...', (completed / totalPhases) * 100);
-        try {
-            const tester = new FeatureFlagBypassTester(logger);
-            const flagFindings = await tester.test(businessContext, surfaceInventory);
-            this.addFindings(flagFindings);
-            this._log(`Feature flag bypass: ${flagFindings.length} issues`);
-        } catch (err) {
-            this._log(`Feature flag bypass testing failed: ${err.message}`, 'error');
+        // Phase 11: Feature flag bypass testing (active, non-destructive)
+        if (allowActive) {
+            this.progress('feature-flags', 'Testing for feature flag bypass...', (completed / totalPhases) * 100);
+            try {
+                const tester = new FeatureFlagBypassTester(logger);
+                const flagFindings = await tester.test(businessContext, surfaceInventory);
+                this.addFindings(flagFindings);
+                this._log(`Feature flag bypass: ${flagFindings.length} issues`);
+            } catch (err) {
+                this._log(`Feature flag bypass testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Feature flag bypass testing', 'feature-flags', (completed / totalPhases) * 100);
         }
         completed++;
 

package/src/agents/orchestrator.js

@@ -1,5 +1,8 @@
 import { EventBus } from './event-bus.js';
 import { FindingsLedger } from './findings-ledger.js';
+import { getVersion } from '../utils/version.js';
+import { LLMClient } from '../core/llm/llm-client.js';
+import { enrichCorrelation, triageFinding } from '../core/llm/augmentations.js';
 
 /**
  * Orchestrator — Central coordinator for the JAKU multi-agent system.
@@ -18,6 +21,11 @@ export class Orchestrator {
         this.eventBus = new EventBus();
         this.ledger = new FindingsLedger(this.eventBus);
 
+        // Optional LLM augmentation client (default OFF). Constructed once and
+        // shared with all agents via context so any agent can opt in. Returns
+        // null on every call when disabled/unavailable → callers degrade.
+        this.llmClient = new LLMClient(config, logger);
+
         this._agents = new Map();       // name → agent instance
         this._sharedContext = {         // passed to all agents
             config,
@@ -25,6 +33,7 @@ export class Orchestrator {
             eventBus: this.eventBus,
             ledger: this.ledger,
             surfaceInventory: null,       // set by JAKU-CRAWL
+            llmClient: this.llmClient,    // optional; null-equivalent when disabled
         };
 
         this._startTime = null;
@@ -123,6 +132,10 @@ export class Orchestrator {
         const duration = Date.now() - this._startTime;
         const results = this._synthesize(duration);
 
+        // Optional LLM augmentation of synthesized results (additive, best-effort).
+        // The deterministic correlate()/dedup output above is the source of truth.
+        await this._llmAugment(results);
+
         this.eventBus.emit('scan:completed', {
             timestamp: new Date().toISOString(),
             duration,
@@ -230,6 +243,48 @@ export class Orchestrator {
         };
     }
 
+    /**
+     * Phase 2 — LLM augmentation of synthesized results. STRICTLY ADDITIVE:
+     *   - Enriches attack-chain correlation narratives (keeps original as fallback).
+     *   - Triages borderline findings (advisory `llm_triage` note only; never
+     *     mutates the deterministic severity or pass/fail).
+     * No-op when the LLM client is disabled/over-budget (returns immediately).
+     */
+    async _llmAugment(results) {
+        const client = this.llmClient;
+        if (!client?.isEnabled?.()) return;
+
+        try {
+            // Enrich correlation narratives.
+            for (const c of results.correlations || []) {
+                const enriched = await enrichCorrelation(client, c);
+                if (enriched) {
+                    c.narrative_llm = enriched;
+                    c.narrative_source = 'llm';
+                }
+            }
+
+            // Triage borderline findings only (limit egress + budget).
+            const borderline = (results.deduplicated || results.findings || [])
+                .filter(f => this._isBorderline(f))
+                .slice(0, 15);
+            for (const f of borderline) {
+                const triage = await triageFinding(client, f);
+                if (triage) f.llm_triage = triage;
+            }
+        } catch (err) {
+            this.logger?.debug?.(`[LLM] augmentation skipped: ${err.message}`);
+        }
+    }
+
+    /** Heuristic: which findings are "borderline" and worth LLM triage. */
+    _isBorderline(f) {
+        if (!f) return false;
+        if (f.severity === 'medium' || f.severity === 'low') return true;
+        const text = `${f.title || ''} ${f.description || ''}`.toLowerCase();
+        return /\b(potential|possible|may|might|suspected|likely|reflected)\b/.test(text);
+    }
+
     /**
      * Get the status of all agents.
      */
@@ -255,7 +310,7 @@ export class Orchestrator {
         try {
             const payload = {
                 agent: 'JAKU',
-                version: '1.0.3',
+                version: getVersion(),
                 target: this.config.target_url,
                 timestamp: new Date().toISOString(),
                 duration: results.duration,

package/src/agents/security-agent.js

@@ -1,4 +1,5 @@
 import { BaseAgent } from './base-agent.js';
+import { allows, getSafetyMode } from '../utils/safety.js';
 import { HeaderAnalyzer } from '../core/security/header-analyzer.js';
 import { SecretDetector } from '../core/security/secret-detector.js';
 import { XSSScanner } from '../core/security/xss-scanner.js';
@@ -37,6 +38,13 @@ export class SecurityAgent extends BaseAgent {
             throw new Error('No surface inventory available — JAKU-CRAWL must run first');
         }
 
+        // Active attack probing (injecting payloads) requires at least
+        // safe-active. In passive mode we only run read-only/analysis checks.
+        const allowActive = allows(config, 'safe-active');
+        const safetyMode = getSafetyMode(config);
+        const skipActive = (label) =>
+            this._log(`${label} skipped — requires active probing (current: ${safetyMode} mode)`);
+
         const phases = [
             { name: 'headers', label: 'Analyzing security headers' },
             { name: 'secrets', label: 'Scanning for exposed secrets' },
@@ -82,27 +90,35 @@ export class SecurityAgent extends BaseAgent {
         }
         completedPhases++;
 
-        // Phase 3: XSS Scanning
-        this.progress(phases[2].name, phases[2].label, (completedPhases / phases.length) * 100);
-        try {
-            const scanner = new XSSScanner(logger);
-            const findings = await scanner.scan(surfaceInventory);
-            this.addFindings(findings);
-            this._log(`XSS: ${findings.length} vulnerabilities`);
-        } catch (err) {
-            this._log(`XSS scanning failed: ${err.message}`, 'error');
+        // Phase 3: XSS Scanning (active probing)
+        if (allowActive) {
+            this.progress(phases[2].name, phases[2].label, (completedPhases / phases.length) * 100);
+            try {
+                const scanner = new XSSScanner(logger);
+                const findings = await scanner.scan(surfaceInventory);
+                this.addFindings(findings);
+                this._log(`XSS: ${findings.length} vulnerabilities`);
+            } catch (err) {
+                this._log(`XSS scanning failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('XSS scanning');
         }
         completedPhases++;
 
-        // Phase 4: SQL Injection Probing
-        this.progress(phases[3].name, phases[3].label, (completedPhases / phases.length) * 100);
-        try {
-            const prober = new SQLiProber(logger);
-            const findings = await prober.probe(surfaceInventory);
-            this.addFindings(findings);
-            this._log(`SQLi: ${findings.length} vulnerabilities`);
-        } catch (err) {
-            this._log(`SQLi probing failed: ${err.message}`, 'error');
+        // Phase 4: SQL Injection Probing (active probing)
+        if (allowActive) {
+            this.progress(phases[3].name, phases[3].label, (completedPhases / phases.length) * 100);
+            try {
+                const prober = new SQLiProber(logger);
+                const findings = await prober.probe(surfaceInventory);
+                this.addFindings(findings);
+                this._log(`SQLi: ${findings.length} vulnerabilities`);
+            } catch (err) {
+                this._log(`SQLi probing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('SQLi probing');
         }
         completedPhases++;
 
@@ -130,27 +146,35 @@ export class SecurityAgent extends BaseAgent {
         }
         completedPhases++;
 
-        // Phase 7: Infrastructure Scan
-        this.progress(phases[6].name, phases[6].label, (completedPhases / phases.length) * 100);
-        try {
-            const scanner = new InfraScanner(logger);
-            const findings = await scanner.scan(surfaceInventory);
-            this.addFindings(findings);
-            this._log(`Infrastructure: ${findings.length} issues`);
-        } catch (err) {
-            this._log(`Infrastructure scan failed: ${err.message}`, 'error');
+        // Phase 7: Infrastructure Scan (active probing of admin/debug endpoints)
+        if (allowActive) {
+            this.progress(phases[6].name, phases[6].label, (completedPhases / phases.length) * 100);
+            try {
+                const scanner = new InfraScanner(logger);
+                const findings = await scanner.scan(surfaceInventory);
+                this.addFindings(findings);
+                this._log(`Infrastructure: ${findings.length} issues`);
+            } catch (err) {
+                this._log(`Infrastructure scan failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Infrastructure scan');
         }
         completedPhases++;
 
-        // Phase 8: File Upload Testing
-        this.progress(phases[7].name, phases[7].label, (completedPhases / phases.length) * 100);
-        try {
-            const uploader = new FileUploadTester(logger);
-            const findings = await uploader.test(surfaceInventory);
-            this.addFindings(findings);
-            this._log(`File uploads: ${findings.length} issues`);
-        } catch (err) {
-            this._log(`File upload testing failed: ${err.message}`, 'error');
+        // Phase 8: File Upload Testing (active probing)
+        if (allowActive) {
+            this.progress(phases[7].name, phases[7].label, (completedPhases / phases.length) * 100);
+            try {
+                const uploader = new FileUploadTester(logger);
+                const findings = await uploader.test(surfaceInventory);
+                this.addFindings(findings);
+                this._log(`File uploads: ${findings.length} issues`);
+            } catch (err) {
+                this._log(`File upload testing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('File upload testing');
         }
         completedPhases++;
 
@@ -166,15 +190,19 @@ export class SecurityAgent extends BaseAgent {
         }
         completedPhases++;
 
-        // Phase 10: Open Redirect Detection
-        this.progress(phases[9].name, phases[9].label, (completedPhases / phases.length) * 100);
-        try {
-            const detector = new OpenRedirectDetector(logger);
-            const findings = await detector.detect(surfaceInventory);
-            this.addFindings(findings);
-            this._log(`Open redirects: ${findings.length} issues`);
-        } catch (err) {
-            this._log(`Open redirect detection failed: ${err.message}`, 'error');
+        // Phase 10: Open Redirect Detection (active probing)
+        if (allowActive) {
+            this.progress(phases[9].name, phases[9].label, (completedPhases / phases.length) * 100);
+            try {
+                const detector = new OpenRedirectDetector(logger);
+                const findings = await detector.detect(surfaceInventory);
+                this.addFindings(findings);
+                this._log(`Open redirects: ${findings.length} issues`);
+            } catch (err) {
+                this._log(`Open redirect detection failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('Open redirect detection');
         }
         completedPhases++;
 
@@ -226,15 +254,19 @@ export class SecurityAgent extends BaseAgent {
         }
         completedPhases++;
 
-        // Phase 15: SSRF Probing
-        this.progress(phases[14].name, phases[14].label, (completedPhases / phases.length) * 100);
-        try {
-            const prober = new SSRFProber(logger);
-            const findings = await prober.probe(surfaceInventory);
-            this.addFindings(findings);
-            this._log(`SSRF: ${findings.length} issues`);
-        } catch (err) {
-            this._log(`SSRF probing failed: ${err.message}`, 'error');
+        // Phase 15: SSRF Probing (active probing)
+        if (allowActive) {
+            this.progress(phases[14].name, phases[14].label, (completedPhases / phases.length) * 100);
+            try {
+                const prober = new SSRFProber(logger);
+                const findings = await prober.probe(surfaceInventory);
+                this.addFindings(findings);
+                this._log(`SSRF: ${findings.length} issues`);
+            } catch (err) {
+                this._log(`SSRF probing failed: ${err.message}`, 'error');
+            }
+        } else {
+            skipActive('SSRF probing');
         }
         completedPhases++;