opencode-api-security-testing 2.0.0 → 2.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. package/README.md +30 -24
  2. package/SKILL.md +1797 -0
  3. package/core/advanced_recon.py +788 -0
  4. package/core/agentic_analyzer.py +445 -0
  5. package/core/analyzers/api_parser.py +210 -0
  6. package/core/analyzers/response_analyzer.py +212 -0
  7. package/core/analyzers/sensitive_finder.py +184 -0
  8. package/core/api_fuzzer.py +422 -0
  9. package/core/api_interceptor.py +525 -0
  10. package/core/api_parser.py +955 -0
  11. package/core/browser_tester.py +479 -0
  12. package/core/cloud_storage_tester.py +1330 -0
  13. package/core/collectors/__init__.py +23 -0
  14. package/core/collectors/api_path_finder.py +300 -0
  15. package/core/collectors/browser_collect.py +645 -0
  16. package/core/collectors/browser_collector.py +411 -0
  17. package/core/collectors/http_client.py +111 -0
  18. package/core/collectors/js_collector.py +490 -0
  19. package/core/collectors/js_parser.py +780 -0
  20. package/core/collectors/url_collector.py +319 -0
  21. package/core/context_manager.py +682 -0
  22. package/core/deep_api_tester_v35.py +844 -0
  23. package/core/deep_api_tester_v55.py +366 -0
  24. package/core/dynamic_api_analyzer.py +532 -0
  25. package/core/http_client.py +179 -0
  26. package/core/models.py +296 -0
  27. package/core/orchestrator.py +890 -0
  28. package/core/prerequisite.py +227 -0
  29. package/core/reasoning_engine.py +1042 -0
  30. package/core/response_classifier.py +606 -0
  31. package/core/runner.py +938 -0
  32. package/core/scan_engine.py +599 -0
  33. package/core/skill_executor.py +435 -0
  34. package/core/skill_executor_v2.py +670 -0
  35. package/core/skill_executor_v3.py +704 -0
  36. package/core/smart_analyzer.py +687 -0
  37. package/core/strategy_pool.py +707 -0
  38. package/core/testers/auth_tester.py +264 -0
  39. package/core/testers/idor_tester.py +200 -0
  40. package/core/testers/sqli_tester.py +211 -0
  41. package/core/testing_loop.py +655 -0
  42. package/core/utils/base_path_dict.py +255 -0
  43. package/core/utils/payload_lib.py +167 -0
  44. package/core/utils/ssrf_detector.py +220 -0
  45. package/core/verifiers/vuln_verifier.py +536 -0
  46. package/package.json +17 -13
  47. package/references/asset-discovery.md +119 -612
  48. package/references/graphql-guidance.md +65 -641
  49. package/references/intake.md +84 -0
  50. package/references/report-template.md +131 -38
  51. package/references/rest-guidance.md +55 -526
  52. package/references/severity-model.md +52 -264
  53. package/references/test-matrix.md +65 -263
  54. package/references/validation.md +53 -400
  55. package/scripts/postinstall.js +46 -0
  56. package/src/index.ts +259 -275
  57. package/agents/cyber-supervisor.md +0 -55
  58. package/agents/probing-miner.md +0 -42
  59. package/agents/resource-specialist.md +0 -31
  60. package/commands/api-security-testing-scan.md +0 -59
  61. package/commands/api-security-testing-test.md +0 -49
  62. package/commands/api-security-testing.md +0 -72
  63. package/tsconfig.json +0 -17
@@ -0,0 +1,227 @@
1
+ """
2
+ 前置检查模块 - Playwright 依赖检测与自动修复
3
+
4
+ 检测顺序:
5
+ 1. Playwright (首选)
6
+ 2. Pyppeteer (异步无头浏览器)
7
+ 3. Selenium (多浏览器支持)
8
+ 4. MCP: headless_browser
9
+ 5. Skill: headless_browser skill
10
+
11
+ 自动修复:
12
+ - playwright install-deps
13
+ - playwright install chromium
14
+ - pip install playwright
15
+ """
16
+
17
+ import subprocess
18
+ import sys
19
+
20
+
21
+ def check_playwright():
22
+ """检查 Playwright 是否可用"""
23
+ try:
24
+ from playwright.sync_api import sync_playwright
25
+ with sync_playwright() as p:
26
+ browser = p.chromium.launch(headless=True)
27
+ browser.close()
28
+ return True, "playwright"
29
+ except ImportError:
30
+ return False, "playwright_not_installed"
31
+ except Exception as e:
32
+ return False, f"playwright_error: {e}"
33
+
34
+
35
+ def check_pyppeteer():
36
+ """检查 Pyppeteer 是否可用"""
37
+ try:
38
+ import pyppeteer
39
+ return True, "pyppeteer"
40
+ except ImportError:
41
+ return False, "pyppeteer_not_installed"
42
+ except Exception as e:
43
+ return False, f"pyppeteer_error: {e}"
44
+
45
+
46
+ def check_selenium():
47
+ """检查 Selenium 是否可用"""
48
+ try:
49
+ from selenium import webdriver
50
+ from selenium.webdriver.chrome.options import Options
51
+ options = Options()
52
+ options.add_argument('--headless')
53
+ options.add_argument('--no-sandbox')
54
+ driver = webdriver.Chrome(options=options)
55
+ driver.quit()
56
+ return True, "selenium"
57
+ except ImportError:
58
+ return False, "selenium_not_installed"
59
+ except Exception as e:
60
+ return False, f"selenium_error: {e}"
61
+
62
+
63
+ def check_mcp_headless_browser():
64
+ """检查 MCP: headless_browser 是否可用"""
65
+ try:
66
+ import mcp
67
+ # 尝试导入 headless_browser MCP
68
+ from mcp.server import Server
69
+ return True, "mcp_headless_browser"
70
+ except ImportError:
71
+ return False, "mcp_not_installed"
72
+ except Exception as e:
73
+ return False, f"mcp_error: {e}"
74
+
75
+
76
+ def check_skill_headless_browser():
77
+ """检查 headless_browser skill 是否存在"""
78
+ import os
79
+ skill_paths = [
80
+ "/root/.claude/skills/headless_browser/SKILL.md",
81
+ "./skills/headless_browser/SKILL.md",
82
+ "../headless_browser/SKILL.md",
83
+ ]
84
+ for path in skill_paths:
85
+ if os.path.exists(path):
86
+ return True, f"headless_browser_skill: {path}"
87
+ return False, "headless_browser_skill_not_found"
88
+
89
+
90
+ def auto_install_playwright():
91
+ """自动安装 Playwright"""
92
+ print(" [尝试自动安装 Playwright...]")
93
+
94
+ commands = [
95
+ ["pip", "install", "playwright"],
96
+ ["playwright", "install-deps", "chromium"],
97
+ ["playwright", "install", "chromium"],
98
+ ]
99
+
100
+ for cmd in commands:
101
+ try:
102
+ print(f" [执行] {' '.join(cmd)}")
103
+ result = subprocess.run(
104
+ cmd,
105
+ capture_output=True,
106
+ text=True,
107
+ timeout=120
108
+ )
109
+ if result.returncode == 0:
110
+ print(f" [OK] {' '.join(cmd)}")
111
+ else:
112
+ print(f" [FAIL] {' '.join(cmd)}: {result.stderr[:100]}")
113
+ except subprocess.TimeoutExpired:
114
+ print(f" [TIMEOUT] {' '.join(cmd)}")
115
+ except Exception as e:
116
+ print(f" [ERROR] {' '.join(cmd)}: {e}")
117
+
118
+ # 验证安装
119
+ available, reason = check_playwright()
120
+ if available:
121
+ print(" [OK] Playwright 安装成功!")
122
+ return True
123
+ else:
124
+ print(f" [FAIL] Playwright 仍不可用: {reason}")
125
+ return False
126
+
127
+
128
+ def check_browser_alternatives():
129
+ """
130
+ 检测无头浏览器平替方案
131
+
132
+ Returns:
133
+ (available, browser_type, can_proceed)
134
+ """
135
+ print("\n[无头浏览器检测]")
136
+ print("-" * 40)
137
+
138
+ # 1. 检查 Playwright
139
+ available, reason = check_playwright()
140
+ if available:
141
+ print(f" [OK] Playwright 可用")
142
+ return True, "playwright", True
143
+
144
+ print(f" [FAIL] Playwright 不可用: {reason}")
145
+
146
+ # 2. 检查平替方案
147
+ alternatives = [
148
+ ("Pyppeteer", check_pyppeteer),
149
+ ("Selenium", check_selenium),
150
+ ("MCP: headless_browser", check_mcp_headless_browser),
151
+ ("Skill: headless_browser", check_skill_headless_browser),
152
+ ]
153
+
154
+ found_alternatives = []
155
+ for name, check_func in alternatives:
156
+ available, reason = check_func()
157
+ if available:
158
+ print(f" [发现平替] {name}")
159
+ found_alternatives.append(name)
160
+ else:
161
+ print(f" [未发现] {name}: {reason}")
162
+
163
+ # 3. 尝试自动安装 Playwright
164
+ print("\n[尝试自动安装...]")
165
+ if auto_install_playwright():
166
+ return True, "playwright", True
167
+
168
+ # 4. 如果有平替方案,提示用户
169
+ if found_alternatives:
170
+ print(f"\n [提示] 发现 {len(found_alternatives)} 个平替方案:")
171
+ for alt in found_alternatives:
172
+ print(f" - {alt}")
173
+ print(" [建议] 可以使用平替方案继续测试")
174
+ return False, found_alternatives[0], True
175
+
176
+ # 5. 无任何方案
177
+ print("\n [FATAL] 没有任何可用的无头浏览器方案")
178
+ print(" [建议] 请手动安装 Playwright:")
179
+ print(" pip install playwright")
180
+ print(" playwright install-deps chromium")
181
+ print(" playwright install chromium")
182
+
183
+ return False, None, False
184
+
185
+
186
+ def prerequisite_check():
187
+ """
188
+ 前置检查主函数
189
+
190
+ Returns:
191
+ (playwright_available, browser_type, can_proceed)
192
+ """
193
+ print("\n" + "=" * 50)
194
+ print(" [0] 前置检查")
195
+ print("=" * 50)
196
+
197
+ # 检查 requests
198
+ print("\n[Requests 检测]")
199
+ try:
200
+ import requests
201
+ print(" [OK] requests 可用")
202
+ requests_available = True
203
+ except ImportError:
204
+ print(" [FAIL] requests 未安装")
205
+ requests_available = False
206
+
207
+ if not requests_available:
208
+ print("\n [FATAL] requests 是必需依赖")
209
+ print(" [建议] pip install requests")
210
+ return False, None, False
211
+
212
+ # 检查无头浏览器
213
+ playwright_available, browser_type, can_proceed = check_browser_alternatives()
214
+
215
+ print("\n" + "=" * 50)
216
+ print(" 前置检查结果:")
217
+ print(f" requests: {'OK' if requests_available else 'FAIL'}")
218
+ print(f" 无头浏览器: {'OK' if playwright_available else 'FAIL'}")
219
+ if browser_type:
220
+ print(f" 浏览器类型: {browser_type}")
221
+ print("=" * 50 + "\n")
222
+
223
+ return playwright_available, browser_type, can_proceed
224
+
225
+
226
+ if __name__ == "__main__":
227
+ prerequisite_check()