kramscan 0.1.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (91) hide show
  1. package/LICENSE +1 -1
  2. package/README.md +419 -236
  3. package/dist/agent/confirmation.d.ts +5 -1
  4. package/dist/agent/confirmation.js +29 -9
  5. package/dist/agent/context.js +2 -3
  6. package/dist/agent/orchestrator.d.ts +2 -0
  7. package/dist/agent/orchestrator.js +50 -8
  8. package/dist/agent/prompts/system.d.ts +1 -1
  9. package/dist/agent/prompts/system.js +5 -7
  10. package/dist/agent/skills/health-check.js +22 -2
  11. package/dist/agent/skills/index.d.ts +1 -0
  12. package/dist/agent/skills/index.js +3 -1
  13. package/dist/agent/skills/verify-finding.d.ts +17 -0
  14. package/dist/agent/skills/verify-finding.js +91 -0
  15. package/dist/agent/skills/web-scan.js +46 -0
  16. package/dist/cli.js +156 -149
  17. package/dist/commands/agent.js +38 -38
  18. package/dist/commands/ai.d.ts +2 -0
  19. package/dist/commands/ai.js +112 -0
  20. package/dist/commands/analyze.js +103 -54
  21. package/dist/commands/config.js +55 -29
  22. package/dist/commands/dev.d.ts +2 -0
  23. package/dist/commands/dev.js +236 -0
  24. package/dist/commands/doctor.js +20 -15
  25. package/dist/commands/gate.d.ts +2 -0
  26. package/dist/commands/gate.js +109 -0
  27. package/dist/commands/onboard.js +188 -141
  28. package/dist/commands/report.js +68 -76
  29. package/dist/commands/scan.js +262 -81
  30. package/dist/commands/scans.d.ts +2 -0
  31. package/dist/commands/scans.js +55 -0
  32. package/dist/core/ai-client.d.ts +6 -1
  33. package/dist/core/ai-client.js +80 -12
  34. package/dist/core/ai-payloads.d.ts +17 -0
  35. package/dist/core/ai-payloads.js +54 -0
  36. package/dist/core/config-schema.d.ts +197 -0
  37. package/dist/core/config-schema.js +68 -0
  38. package/dist/core/config-schema.test.d.ts +1 -0
  39. package/dist/core/config-schema.test.js +151 -0
  40. package/dist/core/config.d.ts +8 -31
  41. package/dist/core/config.js +71 -14
  42. package/dist/core/diff-engine.d.ts +12 -0
  43. package/dist/core/diff-engine.js +47 -0
  44. package/dist/core/errors.d.ts +71 -0
  45. package/dist/core/errors.js +162 -0
  46. package/dist/core/scan-index.d.ts +20 -0
  47. package/dist/core/scan-index.js +52 -0
  48. package/dist/core/scan-storage.d.ts +11 -0
  49. package/dist/core/scan-storage.js +69 -0
  50. package/dist/core/scanner.d.ts +95 -13
  51. package/dist/core/scanner.js +342 -248
  52. package/dist/core/server-probe.d.ts +20 -0
  53. package/dist/core/server-probe.js +109 -0
  54. package/dist/core/vulnerability-detector.d.ts +9 -0
  55. package/dist/core/vulnerability-detector.js +46 -15
  56. package/dist/core/vulnerability-detector.test.d.ts +1 -0
  57. package/dist/core/vulnerability-detector.test.js +210 -0
  58. package/dist/index.js +3 -0
  59. package/dist/plugins/PluginManager.d.ts +27 -0
  60. package/dist/plugins/PluginManager.js +166 -0
  61. package/dist/plugins/index.d.ts +12 -0
  62. package/dist/plugins/index.js +29 -0
  63. package/dist/plugins/types.d.ts +55 -0
  64. package/dist/plugins/types.js +25 -0
  65. package/dist/plugins/vulnerabilities/CORSAnalyzerPlugin.d.ts +10 -0
  66. package/dist/plugins/vulnerabilities/CORSAnalyzerPlugin.js +67 -0
  67. package/dist/plugins/vulnerabilities/CSRFPlugin.d.ts +8 -0
  68. package/dist/plugins/vulnerabilities/CSRFPlugin.js +34 -0
  69. package/dist/plugins/vulnerabilities/CookieSecurityPlugin.d.ts +10 -0
  70. package/dist/plugins/vulnerabilities/CookieSecurityPlugin.js +91 -0
  71. package/dist/plugins/vulnerabilities/DebugEndpointPlugin.d.ts +15 -0
  72. package/dist/plugins/vulnerabilities/DebugEndpointPlugin.js +222 -0
  73. package/dist/plugins/vulnerabilities/DirectoryTraversalPlugin.d.ts +13 -0
  74. package/dist/plugins/vulnerabilities/DirectoryTraversalPlugin.js +110 -0
  75. package/dist/plugins/vulnerabilities/OpenRedirectPlugin.d.ts +10 -0
  76. package/dist/plugins/vulnerabilities/OpenRedirectPlugin.js +69 -0
  77. package/dist/plugins/vulnerabilities/SQLInjectionPlugin.d.ts +11 -0
  78. package/dist/plugins/vulnerabilities/SQLInjectionPlugin.js +109 -0
  79. package/dist/plugins/vulnerabilities/SecurityHeadersPlugin.d.ts +11 -0
  80. package/dist/plugins/vulnerabilities/SecurityHeadersPlugin.js +63 -0
  81. package/dist/plugins/vulnerabilities/SensitiveDataPlugin.d.ts +9 -0
  82. package/dist/plugins/vulnerabilities/SensitiveDataPlugin.js +32 -0
  83. package/dist/plugins/vulnerabilities/XSSPlugin.d.ts +15 -0
  84. package/dist/plugins/vulnerabilities/XSSPlugin.js +81 -0
  85. package/dist/reports/PdfGenerator.d.ts +36 -0
  86. package/dist/reports/PdfGenerator.js +404 -0
  87. package/dist/utils/logger.d.ts +33 -1
  88. package/dist/utils/logger.js +127 -8
  89. package/dist/utils/theme.d.ts +56 -0
  90. package/dist/utils/theme.js +201 -0
  91. package/package.json +6 -3
@@ -1,10 +1,69 @@
1
- import { ScanResult } from "./vulnerability-detector";
1
+ import { EventEmitter } from "events";
2
+ import { ScanResult, Vulnerability } from "./vulnerability-detector";
3
+ export interface ScanEventMap {
4
+ "scan:start": {
5
+ target: string;
6
+ options: ScanOptions;
7
+ };
8
+ "scan:complete": {
9
+ result: ScanResult;
10
+ };
11
+ "scan:error": {
12
+ error: Error;
13
+ };
14
+ "crawl:start": {
15
+ url: string;
16
+ depth: number;
17
+ };
18
+ "crawl:page": {
19
+ url: string;
20
+ crawledCount: number;
21
+ maxPages: number;
22
+ };
23
+ "crawl:complete": {
24
+ url: string;
25
+ };
26
+ "crawl:error": {
27
+ url: string;
28
+ error: Error;
29
+ };
30
+ "form:test": {
31
+ url: string;
32
+ formCount: number;
33
+ };
34
+ "vuln:found": {
35
+ vulnerability: Vulnerability;
36
+ };
37
+ "plugin:execute": {
38
+ plugin: string;
39
+ url: string;
40
+ duration: number;
41
+ };
42
+ "progress": {
43
+ stage: string;
44
+ current: number;
45
+ total: number;
46
+ message?: string;
47
+ };
48
+ }
2
49
  export interface ScanOptions {
3
50
  depth?: number;
4
51
  timeout?: number;
5
52
  headless?: boolean;
53
+ maxPages?: number;
54
+ maxLinksPerPage?: number;
55
+ include?: string[];
56
+ exclude?: string[];
57
+ strictScope?: boolean;
58
+ profile?: string;
59
+ useAiPayloads?: boolean;
60
+ }
61
+ export interface ScanError {
62
+ url: string;
63
+ error: string;
64
+ plugin?: string;
6
65
  }
7
- export declare class Scanner {
66
+ export declare class Scanner extends EventEmitter {
8
67
  private browser;
9
68
  private detector;
10
69
  private visitedUrls;
@@ -14,25 +73,48 @@ export declare class Scanner {
14
73
  private headersChecked;
15
74
  private rateLimiter;
16
75
  private retryConfig;
17
- constructor();
18
- private initializeRateLimiter;
76
+ private maxConcurrency;
77
+ private strictScope;
78
+ private baseOrigin;
79
+ private maxPages;
80
+ private maxLinksPerPage;
81
+ private includePatterns;
82
+ private excludePatterns;
83
+ private userAgent;
84
+ private scanErrors;
85
+ private pluginErrors;
86
+ private usePlugins;
87
+ private useAiPayloads;
88
+ private payloadGenerator;
89
+ constructor(usePlugins?: boolean);
90
+ private registerDefaultPlugins;
91
+ emit<K extends keyof ScanEventMap>(event: K, data: ScanEventMap[K]): boolean;
92
+ on<K extends keyof ScanEventMap>(event: K, listener: (data: ScanEventMap[K]) => void): this;
93
+ once<K extends keyof ScanEventMap>(event: K, listener: (data: ScanEventMap[K]) => void): this;
94
+ getScanErrors(): ScanError[];
95
+ getPluginErrors(): Map<string, Array<{
96
+ url: string;
97
+ error: string;
98
+ }>>;
99
+ private initializeScanSettings;
100
+ private resetScanState;
19
101
  initialize(options?: ScanOptions): Promise<void>;
20
102
  scan(targetUrl: string, options?: ScanOptions): Promise<ScanResult>;
21
103
  private applyRateLimit;
22
104
  private withRetry;
23
- private sanitizePayload;
105
+ private createInstrumentedPage;
106
+ private runInIsolatedPage;
24
107
  private crawl;
25
- private testForms;
108
+ private runPlugins;
109
+ private processPluginResults;
110
+ private testUrlParametersWithPlugins;
111
+ private testFormsWithPlugins;
112
+ private runLegacyDetection;
113
+ private testFormsLegacy;
114
+ private testUrlParametersLegacy;
26
115
  private runWithConcurrency;
27
- private testUrlParameters;
28
116
  private testXSS;
29
117
  private testSQLi;
30
- private testLFI;
31
- private testPathTraversal;
32
- private testCMDI;
33
- private testSSRF;
34
- private testOpenRedirect;
35
- private testIDOR;
36
118
  private buildTestUrl;
37
119
  private extractLinks;
38
120
  close(): Promise<void>;