kramscan 0.1.1 → 0.2.0

package/dist/plugins/types.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseVulnerabilityPlugin = void 0;
+class BaseVulnerabilityPlugin {
+    enabled = true;
+    createVulnerability(title, description, url, severity, evidence, remediation, cwe) {
+        return {
+            type: this.type,
+            severity,
+            title,
+            description,
+            url,
+            evidence,
+            remediation,
+            cwe,
+        };
+    }
+    success(vulnerability) {
+        return { found: true, vulnerability };
+    }
+    failure(error) {
+        return { found: false, error };
+    }
+}
+exports.BaseVulnerabilityPlugin = BaseVulnerabilityPlugin;

package/dist/plugins/vulnerabilities/CSRFPlugin.d.ts

@@ -0,0 +1,8 @@
+import { BaseVulnerabilityPlugin, PluginContext } from "../types";
+export declare class CSRFPlugin extends BaseVulnerabilityPlugin {
+    readonly name = "CSRF Detector";
+    readonly type: "csrf";
+    readonly description = "Detects missing CSRF protection in forms";
+    private readonly csrfTokenPatterns;
+    analyzeContent(context: PluginContext, content: string): Promise<import("../../core/vulnerability-detector").Vulnerability[]>;
+}

package/dist/plugins/vulnerabilities/CSRFPlugin.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CSRFPlugin = void 0;
+const types_1 = require("../types");
+class CSRFPlugin extends types_1.BaseVulnerabilityPlugin {
+    name = "CSRF Detector";
+    type = "csrf";
+    description = "Detects missing CSRF protection in forms";
+    csrfTokenPatterns = [
+        'name="csrf',
+        'name="_token',
+        'name="authenticity_token',
+        'name="_csrf',
+    ];
+    async analyzeContent(context, content) {
+        // Look for forms in the content
+        const formRegex = /<form[^>]*>([\s\S]*?)<\/form>/gi;
+        const forms = content.match(formRegex);
+        if (!forms)
+            return [];
+        const vulnerabilities = [];
+        for (const form of forms) {
+            const hasCSRFToken = this.csrfTokenPatterns.some(pattern => form.toLowerCase().includes(pattern.toLowerCase()));
+            if (!hasCSRFToken) {
+                // Extract form action for better reporting
+                const actionMatch = form.match(/action=["']([^"']*)["']/i);
+                const action = actionMatch ? actionMatch[1] : context.url;
+                vulnerabilities.push(this.createVulnerability("Missing CSRF Protection", "Form lacks CSRF tokens. Attackers can forge requests to perform unauthorized actions.", new URL(action, context.url).toString(), "medium", "Form HTML does not contain CSRF token", "Implement anti-CSRF tokens. Use SameSite cookies.", "CWE-352"));
+            }
+        }
+        return vulnerabilities;
+    }
+}
+exports.CSRFPlugin = CSRFPlugin;

package/dist/plugins/vulnerabilities/SQLInjectionPlugin.d.ts

@@ -0,0 +1,11 @@
+import { BaseVulnerabilityPlugin, PluginContext } from "../types";
+export declare class SQLInjectionPlugin extends BaseVulnerabilityPlugin {
+    readonly name = "SQL Injection Detector";
+    readonly type: "sqli";
+    readonly description = "Detects SQL Injection vulnerabilities";
+    private readonly errorBasedPayloads;
+    private readonly timeBasedPayloads;
+    private getErrorPayloads;
+    private readonly sqlErrors;
+    testParameter(context: PluginContext, param: string, _value: string): Promise<import("../types").VulnerabilityTestResult>;
+}

package/dist/plugins/vulnerabilities/SQLInjectionPlugin.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SQLInjectionPlugin = void 0;
+const types_1 = require("../types");
+class SQLInjectionPlugin extends types_1.BaseVulnerabilityPlugin {
+    name = "SQL Injection Detector";
+    type = "sqli";
+    description = "Detects SQL Injection vulnerabilities";
+    errorBasedPayloads = [
+        "'",
+        "1' OR '1'='1",
+        "1; DROP TABLE users--",
+        "' OR 1=1--",
+        "' UNION SELECT 1--",
+        "1' AND '1'='1",
+    ];
+    timeBasedPayloads = [
+        "' AND SLEEP(5)--",
+        "1' AND SLEEP(5)--",
+        "'; WAITFOR DELAY '00:00:05'--",
+    ];
+    async getErrorPayloads(context, param) {
+        if (context.payloadGenerator) {
+            const aiPayloads = await context.payloadGenerator.generatePayloads("sqli", {
+                parameterName: param,
+                url: context.url,
+            });
+            if (aiPayloads.length > 0) {
+                return [...aiPayloads, ...this.errorBasedPayloads];
+            }
+        }
+        return this.errorBasedPayloads;
+    }
+    sqlErrors = [
+        "SQL syntax",
+        "mysql_fetch",
+        "ORA-",
+        "PostgreSQL",
+        "SQLite",
+        "ODBC",
+        "JET Database",
+        "Microsoft Access Driver",
+        "unterminated",
+        "mysql_num_rows",
+        "mysql_query",
+        "Microsoft SQL Native Client error",
+        "SQLServer JDBC Driver",
+        "ORA-00933",
+        "PG::SyntaxError",
+        "Warning: pg_",
+        "Syntax error",
+    ];
+    async testParameter(context, param, _value) {
+        // Test for error-based SQL injection
+        const errorPayloads = await this.getErrorPayloads(context, param);
+        for (const payload of errorPayloads) {
+            try {
+                const url = new URL(context.url);
+                url.searchParams.set(param, payload);
+                await context.page.goto(url.toString(), {
+                    waitUntil: "networkidle2",
+                    timeout: context.timeout
+                });
+                const content = await context.page.content();
+                for (const error of this.sqlErrors) {
+                    if (content.includes(error)) {
+                        return this.success(this.createVulnerability("SQL Injection", `The parameter '${param}' is vulnerable to SQL injection. Database error messages were detected.`, context.url, "critical", `Error: ${error}`, "Use parameterized queries (prepared statements). Never concatenate user input into SQL.", "CWE-89"));
+                    }
+                }
+            }
+            catch (error) {
+                return this.failure(error.message);
+            }
+        }
+        // Test for time-based blind SQL injection
+        let baselineTime = 0;
+        try {
+            const baselineStart = Date.now();
+            await context.page.goto(context.url, {
+                waitUntil: "networkidle2",
+                timeout: context.timeout
+            });
+            baselineTime = Date.now() - baselineStart;
+        }
+        catch (error) {
+            return this.failure(error.message);
+        }
+        for (const payload of this.timeBasedPayloads) {
+            try {
+                const url = new URL(context.url);
+                url.searchParams.set(param, payload);
+                const startTime = Date.now();
+                await context.page.goto(url.toString(), {
+                    waitUntil: "networkidle2",
+                    timeout: context.timeout
+                });
+                const testTime = Date.now() - startTime;
+                if (testTime > baselineTime + 3000) {
+                    return this.success(this.createVulnerability("Blind SQL Injection", `Time-based blind SQL injection detected on parameter '${param}'. Response time indicates successful payload execution.`, context.url, "high", `Response time increased by ${testTime - baselineTime}ms with sleep payload`, "Use parameterized queries. Implement input validation and proper error handling.", "CWE-89"));
+                }
+            }
+            catch (error) {
+                return this.failure(error.message);
+            }
+        }
+        return this.failure();
+    }
+}
+exports.SQLInjectionPlugin = SQLInjectionPlugin;

package/dist/plugins/vulnerabilities/SecurityHeadersPlugin.d.ts

@@ -0,0 +1,11 @@
+import { BaseVulnerabilityPlugin, PluginContext } from "../types";
+import { Vulnerability } from "../../core/vulnerability-detector";
+export declare class SecurityHeadersPlugin extends BaseVulnerabilityPlugin {
+    readonly name = "Security Headers Analyzer";
+    readonly type: "header";
+    readonly description = "Analyzes HTTP security headers";
+    private readonly reportedHosts;
+    private readonly requiredHeaders;
+    analyzeHeaders(context: PluginContext, headers: Record<string, string>): Promise<Vulnerability[]>;
+    reset(): void;
+}

package/dist/plugins/vulnerabilities/SecurityHeadersPlugin.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityHeadersPlugin = void 0;
+const types_1 = require("../types");
+class SecurityHeadersPlugin extends types_1.BaseVulnerabilityPlugin {
+    name = "Security Headers Analyzer";
+    type = "header";
+    description = "Analyzes HTTP security headers";
+    reportedHosts = new Set();
+    requiredHeaders = {
+        "content-security-policy": {
+            title: "Missing Content-Security-Policy",
+            severity: "low",
+            remediation: "Implement a strict CSP to prevent XSS and data injection attacks.",
+        },
+        "x-frame-options": {
+            title: "Missing X-Frame-Options",
+            severity: "low",
+            remediation: "Set X-Frame-Options to DENY or SAMEORIGIN to prevent clickjacking.",
+        },
+        "strict-transport-security": {
+            title: "Missing Strict-Transport-Security (HSTS)",
+            severity: "low",
+            remediation: "Enable HSTS with max-age of at least 31536000 seconds.",
+        },
+        "x-content-type-options": {
+            title: "Missing X-Content-Type-Options",
+            severity: "info",
+            remediation: "Set X-Content-Type-Options to 'nosniff'.",
+        },
+        "referrer-policy": {
+            title: "Missing Referrer-Policy",
+            severity: "info",
+            remediation: "Set Referrer-Policy to 'strict-origin-when-cross-origin'.",
+        },
+        "permissions-policy": {
+            title: "Missing Permissions-Policy",
+            severity: "info",
+            remediation: "Restrict browser features using Permissions-Policy header.",
+        },
+    };
+    async analyzeHeaders(context, headers) {
+        const host = new URL(context.url).host;
+        // Only report once per host
+        if (this.reportedHosts.has(host)) {
+            return [];
+        }
+        const vulnerabilities = [];
+        for (const [header, config] of Object.entries(this.requiredHeaders)) {
+            if (!headers[header.toLowerCase()]) {
+                vulnerabilities.push(this.createVulnerability(config.title, `The ${header} security header is not set on ${host}.`, context.url, config.severity, undefined, config.remediation));
+            }
+        }
+        if (vulnerabilities.length > 0) {
+            this.reportedHosts.add(host);
+        }
+        return vulnerabilities;
+    }
+    reset() {
+        this.reportedHosts.clear();
+    }
+}
+exports.SecurityHeadersPlugin = SecurityHeadersPlugin;

package/dist/plugins/vulnerabilities/SensitiveDataPlugin.d.ts

@@ -0,0 +1,9 @@
+import { BaseVulnerabilityPlugin, PluginContext } from "../types";
+import { Vulnerability } from "../../core/vulnerability-detector";
+export declare class SensitiveDataPlugin extends BaseVulnerabilityPlugin {
+    readonly name = "Sensitive Data Detector";
+    readonly type: "sensitive_data";
+    readonly description = "Detects exposed sensitive data in responses";
+    private readonly patterns;
+    analyzeContent(context: PluginContext, content: string): Promise<Vulnerability[]>;
+}

package/dist/plugins/vulnerabilities/SensitiveDataPlugin.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SensitiveDataPlugin = void 0;
+const types_1 = require("../types");
+class SensitiveDataPlugin extends types_1.BaseVulnerabilityPlugin {
+    name = "Sensitive Data Detector";
+    type = "sensitive_data";
+    description = "Detects exposed sensitive data in responses";
+    patterns = [
+        { regex: /sk-[a-zA-Z0-9]{48}/g, name: "OpenAI API Key", severity: "critical" },
+        { regex: /ghp_[a-zA-Z0-9]{36}/g, name: "GitHub Token", severity: "critical" },
+        { regex: /AKIA[0-9A-Z]{16}/g, name: "AWS Access Key", severity: "critical" },
+        { regex: /xox[baprs]-[0-9a-zA-Z]{10,}/g, name: "Slack Token", severity: "high" },
+        { regex: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*/g, name: "JWT Token", severity: "high" },
+        { regex: /AIza[0-9A-Za-z_-]{35}/g, name: "Google API Key", severity: "high" },
+        { regex: /password["\s:=]+[^\s"]{6,}/gi, name: "Hardcoded Password", severity: "high" },
+        { regex: /api[_-]?key["\s:=]+[\w-]{20,}/gi, name: "Generic API Key", severity: "medium" },
+        { regex: /-----BEGIN (RSA |EC )?PRIVATE KEY-----/g, name: "Private Key", severity: "critical" },
+        { regex: /database[_-]?url["\s:=]+.*(?:mysql|postgres|mongodb):\/\//gi, name: "Database Connection String", severity: "high" },
+    ];
+    async analyzeContent(context, content) {
+        const vulnerabilities = [];
+        for (const pattern of this.patterns) {
+            const matches = content.match(pattern.regex);
+            if (matches && matches.length > 0) {
+                vulnerabilities.push(this.createVulnerability(`Exposed ${pattern.name}`, `Sensitive ${pattern.name} found in response. This could lead to account compromise or data breach.`, context.url, pattern.severity, `Found: ${matches[0].substring(0, 30)}...`, "Remove sensitive data from client-side code. Use environment variables and secure secret management.", "CWE-200"));
+            }
+        }
+        return vulnerabilities;
+    }
+}
+exports.SensitiveDataPlugin = SensitiveDataPlugin;

package/dist/plugins/vulnerabilities/XSSPlugin.d.ts

@@ -0,0 +1,15 @@
+import { BaseVulnerabilityPlugin, PluginContext } from "../types";
+export declare class XSSPlugin extends BaseVulnerabilityPlugin {
+    readonly name = "XSS Detector";
+    readonly type: "xss";
+    readonly description = "Detects Cross-Site Scripting vulnerabilities";
+    private readonly payloads;
+    private getPayloads;
+    testParameter(context: PluginContext, param: string, _value: string): Promise<import("../types").VulnerabilityTestResult>;
+    testFormInput(context: PluginContext, formData: {
+        inputs: Array<{
+            name: string;
+            type: string;
+        }>;
+    }): Promise<import("../types").VulnerabilityTestResult>;
+}

package/dist/plugins/vulnerabilities/XSSPlugin.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XSSPlugin = void 0;
+const types_1 = require("../types");
+class XSSPlugin extends types_1.BaseVulnerabilityPlugin {
+    name = "XSS Detector";
+    type = "xss";
+    description = "Detects Cross-Site Scripting vulnerabilities";
+    payloads = [
+        "<script>alert('XSS')</script>",
+        '"><script>alert(1)</script>',
+        "<img src=x onerror=alert(1)>",
+        "'-alert(1)-'",
+        "<svg/onload=alert(1)>",
+    ];
+    async getPayloads(context, param) {
+        if (context.payloadGenerator) {
+            const aiPayloads = await context.payloadGenerator.generatePayloads("xss", {
+                parameterName: param,
+                url: context.url,
+                // We could extract more context from the page here if needed
+            });
+            if (aiPayloads.length > 0) {
+                return [...aiPayloads, ...this.payloads];
+            }
+        }
+        return this.payloads;
+    }
+    async testParameter(context, param, _value) {
+        const payloads = await this.getPayloads(context, param);
+        for (const payload of payloads) {
+            try {
+                const url = new URL(context.url);
+                url.searchParams.set(param, payload);
+                await context.page.goto(url.toString(), {
+                    waitUntil: "networkidle2",
+                    timeout: context.timeout
+                });
+                const content = await context.page.content();
+                if (content.includes(payload)) {
+                    return this.success(this.createVulnerability("Reflected Cross-Site Scripting (XSS)", `The parameter '${param}' reflects user input without proper encoding, allowing script injection.`, context.url, "high", `Payload: ${payload}`, "Implement input validation, output encoding, and Content Security Policy (CSP) headers.", "CWE-79"));
+                }
+            }
+            catch (error) {
+                return this.failure(error.message);
+            }
+        }
+        return this.failure();
+    }
+    async testFormInput(context, formData) {
+        for (const input of formData.inputs) {
+            if (input.type === "hidden" || input.type === "submit")
+                continue;
+            const payloads = await this.getPayloads(context, input.name);
+            for (const payload of payloads) {
+                try {
+                    await context.page.goto(context.url, {
+                        waitUntil: "networkidle2",
+                        timeout: context.timeout
+                    });
+                    const inputSelector = `input[name="${input.name}"], textarea[name="${input.name}"]`;
+                    await context.page.type(inputSelector, payload);
+                    const submitButton = await context.page.$("input[type=submit], button[type=submit]");
+                    if (submitButton) {
+                        await submitButton.click();
+                        await context.page.waitForNavigation({ timeout: context.timeout }).catch(() => { });
+                    }
+                    const content = await context.page.content();
+                    if (content.includes(payload)) {
+                        return this.success(this.createVulnerability("Reflected Cross-Site Scripting (XSS)", `The form input '${input.name}' reflects user input without proper encoding.`, context.url, "high", `Payload: ${payload}`, "Implement input validation, output encoding, and Content Security Policy (CSP) headers.", "CWE-79"));
+                    }
+                }
+                catch (error) {
+                    return this.failure(error.message);
+                }
+            }
+        }
+        return this.failure();
+    }
+}
+exports.XSSPlugin = XSSPlugin;

package/dist/reports/PdfGenerator.d.ts

@@ -0,0 +1,36 @@
+import { ScanResult } from "../core/vulnerability-detector";
+import type { ScanError } from "../core/scanner";
+export interface PdfGenerationOptions {
+    filename?: string;
+    format?: "A4" | "Letter" | "Legal";
+    margin?: {
+        top: string;
+        bottom: string;
+        left: string;
+        right: string;
+    };
+}
+export interface PdfReportData {
+    scanResult: ScanResult;
+    scanErrors?: ScanError[];
+    pluginErrors?: Map<string, Array<{
+        url: string;
+        error: string;
+    }>>;
+}
+export interface HtmlReportOptions {
+    filename?: string;
+    includeStyles?: boolean;
+    minify?: boolean;
+}
+export declare class PdfGenerator {
+    generate(data: PdfReportData, options?: PdfGenerationOptions): Promise<string>;
+    /**
+     * Generate a standalone HTML report
+     * @param data - The scan result data
+     * @param options - Options for HTML generation
+     * @returns Path to the generated HTML file
+     */
+    generateHtml(data: PdfReportData, options?: HtmlReportOptions): Promise<string>;
+}
+export declare const pdfGenerator: PdfGenerator;