opencode-api-security-testing 3.0.10 → 3.0.11

package/core/skill_executor_v2.py

@@ -0,0 +1,670 @@
+"""
+SKILL 执行器 v2.0 - 配置驱动执行
+
+根据 SKILL.md v2.0 定义的 execution_config:
+1. 解析配置驱动的执行流程
+2. 综合判断 API 存在性（静态 + 动态）
+3. 端点合并（静态 + 动态 + Hook）
+4. API前缀多源提取
+5. 认证端点优先测试
+"""
+
+import sys
+sys.path.insert(0, '/workspace/skill-play/API-Security-Testing-Optimized')
+
+from core.prerequisite import prerequisite_check
+from core.api_parser import APIEndpointParser
+from core.cloud_storage_tester import CloudStorageTester
+
+
+class SKILLExecutorV2:
+    """SKILL 执行器 v2.0 - 配置驱动"""
+    
+    def __init__(self, target: str):
+        self.target = target
+        self.session = None
+        self.playwright_available = False
+        self.browser_type = None
+        
+        # 资产发现结果
+        self.parser = None
+        self.js_files = []
+        self.static_endpoints = []
+        self.dynamic_endpoints = []
+        self.hooked_endpoints = []
+        self.parent_paths = {}
+        
+        # v2.0 新增：API前缀多源提取
+        self.api_prefix = None
+        self.api_prefix_sources = {}
+        
+        # 测试结果
+        self.vulnerabilities = []
+        self.cloud_findings = []
+        
+        # 决策状态
+        self.site_type = None
+        self.has_real_api = False
+        self.has_dynamic_endpoints = False
+        self.html_fallback_all = False
+    
+    def run(self):
+        """执行 SKILL 流程 v2.0"""
+        print("=" * 70)
+        print("  API Security Testing Skill v2.0 - 配置驱动执行")
+        print("=" * 70)
+        print(f"  目标: {self.target}")
+        print()
+        
+        # ========== 阶段 0: 前置检查 ==========
+        print("[阶段 0] 前置检查")
+        print("-" * 50)
+        self._check_prerequisites()
+        
+        # ========== 阶段 1: 资产发现 ==========
+        print("\n[阶段 1] 资产发现")
+        print("-" * 50)
+        
+        # 1.1 静态分析
+        print("\n[1.1] 静态分析")
+        self._static_analysis()
+        
+        # 1.2 站点类型检测
+        print("\n[1.2] 站点类型检测")
+        self._detect_site_type()
+        
+        # 1.3 父路径探测
+        print("\n[1.3] 父路径探测")
+        self._probe_parent_paths()
+        
+        # 1.4 动态分析 (条件执行)
+        print("\n[1.4] 动态分析")
+        if self.site_type in ['modern_spa', 'jquery_spa'] and self.playwright_available:
+            self._dynamic_analysis()
+        else:
+            print("  [跳过] 非SPA或Playwright不可用")
+        
+        # 1.5 API Hook (条件执行)
+        print("\n[1.5] API Hook")
+        if self.playwright_available and (self.has_real_api or self.has_dynamic_endpoints):
+            self._api_hook()
+        else:
+            print("  [跳过] 无API或Playwright不可用")
+        
+        # ========== 阶段 2: 漏洞分析 ==========
+        print("\n[阶段 2] 漏洞分析")
+        print("-" * 50)
+        
+        # v2.0 修复：综合判断
+        self._update_decision_state()
+        
+        if self.has_real_api or self.has_dynamic_endpoints:
+            self._vulnerability_testing()
+        else:
+            if self.html_fallback_all:
+                print("  [SKIP] nginx fallback，报告问题")
+                self._report_nginx_fallback()
+            else:
+                print("  [继续] 无API但非fallback，执行测试")
+                self._vulnerability_testing()
+        
+        # ========== 阶段 3: 云存储测试 ==========
+        print("\n[阶段 3] 云存储测试")
+        print("-" * 50)
+        self._cloud_storage_test()
+        
+        # ========== 阶段 4: 报告 ==========
+        print("\n[阶段 4] 报告")
+        print("-" * 50)
+        self._generate_report()
+        
+        return self._get_result()
+    
+    def _check_prerequisites(self):
+        """前置检查"""
+        self.playwright_available, self.browser_type, can_proceed = prerequisite_check()
+        
+        if can_proceed:
+            import requests
+            self.session = requests.Session()
+            self.session.headers.update({'User-Agent': 'Mozilla/5.0'})
+            print("  [OK] 前置检查通过")
+        else:
+            print("  [FAIL] 前置检查失败")
+    
+    def _static_analysis(self):
+        """静态分析"""
+        self.parser = APIEndpointParser(self.target, self.session)
+        
+        self.js_files = self.parser.discover_js_files()
+        print(f"  JS 文件: {len(self.js_files)}")
+        
+        self.static_endpoints = self.parser.parse_js_files(self.js_files)
+        print(f"  静态端点: {len(self.static_endpoints)}")
+        
+        for ep in self.static_endpoints[:5]:
+            print(f"    {ep.method} {ep.path}")
+    
+    def _detect_site_type(self):
+        """判断站点类型"""
+        html = self.session.get(self.target, timeout=10).text.lower()
+        
+        frontend = 'Unknown'
+        ui = 'Unknown'
+        
+        if 'vue' in html:
+            frontend = 'Vue.js'
+        if 'react' in html:
+            frontend = 'React'
+        if 'angular' in html:
+            frontend = 'Angular'
+        if 'jquery' in html:
+            frontend = 'jQuery'
+        
+        if 'element-ui' in html or 'element ui' in html:
+            ui = 'ElementUI'
+        if 'ant-design' in html:
+            ui = 'Ant Design'
+        
+        if len(self.js_files) == 0:
+            self.site_type = 'pure_html'
+        elif frontend == 'Unknown' and len(self.js_files) > 0:
+            self.site_type = 'modern_spa'
+            frontend = 'Vue.js/React (推断)'
+        elif frontend in ['Vue.js', 'React', 'Angular']:
+            self.site_type = 'modern_spa'
+        elif frontend == 'jQuery':
+            self.site_type = 'jquery_spa'
+        else:
+            self.site_type = 'unknown'
+        
+        print(f"  站点类型: {self.site_type}")
+        print(f"  前端框架: {frontend}")
+        print(f"  UI 框架: {ui}")
+    
+    def _probe_parent_paths(self):
+        """父路径探测"""
+        self.parent_paths = self.parser.probe_parent_paths()
+        
+        json_api_count = sum(1 for p in self.parent_paths.values() if p.get('is_api'))
+        html_fallback_count = len(self.parent_paths) - json_api_count
+        
+        print(f"  父路径: {len(self.parent_paths)}")
+        print(f"  JSON API: {json_api_count}")
+        print(f"  HTML fallback: {html_fallback_count}")
+        
+        # v2.0: 从父路径提取API前缀
+        for p in self.parent_paths.values():
+            if p.get('prefix'):
+                self.api_prefix_sources['parent_paths'] = p.get('prefix')
+                self.api_prefix = p.get('prefix')
+                print(f"  [API Prefix] from parent_paths: {self.api_prefix}")
+                break
+        
+        # v2.0: 判断 has_real_api
+        if json_api_count > 0:
+            self.has_real_api = True
+            print(f"  [OK] 父路径发现真实 API")
+        else:
+            self.has_real_api = False
+    
+    def _dynamic_analysis(self):
+        """动态分析 v2.0"""
+        print("  [动态分析] 启动 Playwright...")
+        try:
+            from core.dynamic_api_analyzer import DynamicAPIAnalyzer
+            from urllib.parse import urlparse
+            
+            analyzer = DynamicAPIAnalyzer(self.target)
+            results = analyzer.analyze_full()
+            
+            count = len(results.get('endpoints', []))
+            print(f"  [动态分析] 发现 {count} 个端点")
+            
+            self.dynamic_endpoints = results.get('endpoints', [])
+            
+            # v2.0: 从动态端点URL自动提取API前缀
+            target_host = urlparse(self.target).netloc
+            for ep in self.dynamic_endpoints:
+                ep_path = ep.get('path', '')
+                if ep_path.startswith('http'):
+                    ep_host = urlparse(ep_path).netloc
+                    ep_path_only = urlparse(ep_path).path
+                    if ep_host == target_host and ep_path_only.startswith('/'):
+                        # 提取API前缀：通常是 /xxx/xxx 格式
+                        parts = ep_path_only.strip('/').split('/')
+                        if len(parts) >= 2:
+                            potential_prefix = '/' + '/'.join(parts[:2])
+                            if potential_prefix not in ['/login', '/logout', '/static', '/js', '/css']:
+                                self.api_prefix_sources['dynamic'] = potential_prefix
+                                self.api_prefix = potential_prefix
+                                print(f"  [API Prefix] from dynamic: {self.api_prefix}")
+                                break
+            
+            for ep in self.dynamic_endpoints[:5]:
+                print(f"    {ep.get('method', 'GET')} {ep.get('path')}")
+            
+            # v2.0: 更新动态端点状态
+            if count > 0:
+                self.has_dynamic_endpoints = True
+                print(f"  [OK] 动态分析发现真实 API")
+            
+        except Exception as e:
+            print(f"  [动态分析] 失败: {e}")
+    
+    def _api_hook(self):
+        """API Hook"""
+        print("  [API Hook] 启动 Hook...")
+        try:
+            from core.api_interceptor import APIInterceptor
+            
+            interceptor = APIInterceptor(self.target)
+            results = interceptor.hook_all_apis()
+            
+            count = len(results.get('endpoints', []))
+            print(f"  [API Hook] 捕获 {count} 个 API 调用")
+            
+            self.hooked_endpoints = results.get('endpoints', [])
+            
+        except Exception as e:
+            print(f"  [API Hook] 失败: {e}")
+    
+    def _update_decision_state(self):
+        """v2.0: 更新决策状态 - 综合判断"""
+        json_api_count = sum(1 for p in self.parent_paths.values() if p.get('is_api'))
+        dynamic_count = len(self.dynamic_endpoints)
+        
+        print("\n[决策] 综合判断 API 存在性")
+        print(f"  - 父路径 JSON API: {json_api_count}")
+        print(f"  - 动态端点: {dynamic_count}")
+        
+        # v2.0 核心修复：综合判断
+        # has_real_api: 任意来源有API即认为有真实API
+        self.has_real_api = json_api_count > 0 or dynamic_count > 0
+        self.has_dynamic_endpoints = dynamic_count > 0
+        
+        # v2.0: 只有当父路径存在但全返回HTML，且无动态端点时才是真正的fallback
+        # 父路径探测失败但有动态端点，说明API是动态加载的，不是nginx fallback
+        
+        # v2.0: html_fallback_all 判断
+        # 只有当没有任何API发现时才认为是fallback
+        self.html_fallback_all = (
+            len(self.parent_paths) > 0 and 
+            json_api_count == 0 and 
+            dynamic_count == 0
+        )
+        
+        print(f"  has_real_api: {self.has_real_api}")
+        print(f"  has_dynamic_endpoints: {self.has_dynamic_endpoints}")
+        print(f"  html_fallback_all: {self.html_fallback_all}")
+    
+    def _vulnerability_testing(self):
+        """漏洞测试 v2.0 - 集成API Fuzzer进行深度测试"""
+        
+        print("  [漏洞测试] 启动深度渗透测试...")
+        
+        # 导入fuzzer
+        try:
+            from core.api_fuzzer import APIfuzzer, auto_fuzz
+            fuzzer_available = True
+        except ImportError:
+            fuzzer_available = False
+            print("  [警告] API Fuzzer模块不可用，使用基础测试")
+        
+        # v2.0: 合并所有端点
+        all_endpoints = self._merge_all_endpoints()
+        
+        # v2.0: 按优先级排序
+        sorted_endpoints = self._sort_by_priority(all_endpoints)
+        
+        print(f"  [漏洞测试] 总端点: {len(sorted_endpoints)}")
+        
+        # 打印认证端点详情
+        auth_count = 0
+        for ep in sorted_endpoints:
+            if self._is_auth_endpoint(ep['path']):
+                auth_count += 1
+        print(f"  [漏洞测试] 认证端点: {auth_count}")
+        
+        # ========== 深度Fuzzing测试 ==========
+        if fuzzer_available:
+            print("\n  [深度测试] 执行API Fuzzing...")
+            self._run_deep_fuzz_test(sorted_endpoints)
+        
+        # ========== 基础漏洞测试 ==========
+        print("\n  [基础测试] SQL注入检测...")
+        self._test_sql_injection(sorted_endpoints)
+        
+        # ========== 未授权访问测试 ==========
+        print("\n  [基础测试] 未授权访问检测...")
+        self._test_unauthorized_access(sorted_endpoints)
+        
+        print(f"\n  发现漏洞: {len(self.vulnerabilities)}")
+        
+        # 打印漏洞摘要
+        if self.vulnerabilities:
+            print("\n  [漏洞摘要]")
+            for v in self.vulnerabilities[:10]:
+                print(f"    [{v['severity']}] {v['type']} - {v.get('endpoint', 'N/A')}")
+    
+    def _run_deep_fuzz_test(self, endpoints):
+        """深度Fuzz测试"""
+        from core.api_fuzzer import APIfuzzer
+        
+        fuzzer = APIfuzzer(session=self.session)
+        
+        # 提取路径列表
+        api_paths = []
+        for ep in endpoints:
+            path = ep['path']
+            if path.startswith('http'):
+                from urllib.parse import urlparse
+                path = urlparse(path).path
+            api_paths.append(path)
+        
+        # 生成fuzz目标
+        fuzz_targets = fuzzer.generate_parent_fuzz_targets(api_paths, max_per_parent=30)
+        print(f"  [Fuzz] 生成 {len(fuzz_targets)} 个测试目标")
+        
+        # 执行fuzz
+        base_url = self.target.split('?')[0].rstrip('/')
+        results = fuzzer.fuzz_paths(base_url, fuzz_targets[:100], timeout=3.0)
+        
+        # 分析结果
+        alive = fuzzer.get_alive_endpoints()
+        high_value = fuzzer.get_high_value_endpoints()
+        
+        print(f"  [Fuzz] 存活端点: {len(alive)}")
+        print(f"  [Fuzz] 高价值端点: {len(high_value)}")
+        
+        # 发现新端点
+        for r in high_value[:5]:
+            print(f"    [发现] {r.method} {r.path} -> {r.status_code}")
+    
+    def _test_sql_injection(self, endpoints):
+        """SQL注入测试"""
+        sqli_payloads = [
+            "' OR '1'='1",
+            "' OR '1'='1' --",
+            "' OR '1'='1' #",
+            "1' OR '1'='1",
+            "' OR ''='",
+        ]
+        
+        test_params = ['id', 'page', 'pageNum', 'pageSize', 'userId', 'id']
+        
+        for ep in endpoints[:20]:
+            path = ep['path']
+            method = ep.get('method', 'GET')
+            priority = ep.get('priority', 'low')
+            
+            # 构建URL - 正确添加API前缀
+            if path.startswith('http'):
+                from urllib.parse import urlparse, parse_qs
+                parsed = urlparse(path)
+                base = f"{parsed.scheme}://{parsed.netloc}{parsed.path}"
+                existing_params = parse_qs(parsed.query)
+            else:
+                base = self.target.split('?')[0].rstrip('/')
+                # v2.0: 如果静态端点没有前缀，但有已知的api_prefix，添加前缀
+                path_to_add = path
+                if self.api_prefix and not path.startswith('/personnelWeb'):
+                    # 从 /personnelWeb/auth 提取 /personnelWeb
+                    prefix_base = '/' + self.api_prefix.split('/')[1]
+                    if path.startswith('/users') or path.startswith('/system') or path.startswith('/menu'):
+                        path_to_add = prefix_base + path
+                        print(f"    [修正] {path} -> {path_to_add}")
+                base = base + path_to_add
+                existing_params = {}
+            
+            # 添加测试参数
+            for param in test_params:
+                if param not in existing_params:
+                    test_url = f"{base}?{param}="
+                    break
+            else:
+                continue
+            
+            for payload in sqli_payloads[:2]:
+                try:
+                    if method == 'POST':
+                        r = self.session.post(
+                            base,
+                            json={param: payload for param in test_params},
+                            timeout=5
+                        )
+                    else:
+                        r = self.session.get(test_url + payload, timeout=5)
+                    
+                    ct = r.headers.get('Content-Type', '').lower()
+                    
+                    # 检查SQL错误
+                    text_lower = r.text.lower()
+                    sql_patterns = [
+                        'sql syntax', 'sql error', 'mysql', 'oracle',
+                        'sqlite', 'sqlstate', 'postgresql', 'syntax error',
+                        'microsoft sql', 'odbc', 'ora-', 'pgsql'
+                    ]
+                    if any(p in text_lower for p in sql_patterns):
+                        self.vulnerabilities.append({
+                            'type': 'SQL Injection',
+                            'severity': 'CRITICAL',
+                            'endpoint': path,
+                            'param': param,
+                            'payload': payload,
+                            'priority': priority,
+                            'evidence': 'SQL error detected'
+                        })
+                        print(f"    [!] SQL注入: {path} ({param}={payload})")
+                        break
+                    
+                    # 检查异常响应
+                    if r.status_code == 500 and 'error' in text_lower:
+                        self.vulnerabilities.append({
+                            'type': 'Potential SQL Injection',
+                            'severity': 'MEDIUM',
+                            'endpoint': path,
+                            'param': param,
+                            'payload': payload,
+                            'priority': priority,
+                            'evidence': f'Server error {r.status_code}'
+                        })
+                        
+                except:
+                    pass
+    
+    def _test_unauthorized_access(self, endpoints):
+        """未授权访问测试"""
+        sensitive_patterns = [
+            '/admin', '/user/list', '/user/export', '/config',
+            '/system', '/manage', '/dashboard', '/api/users'
+        ]
+        
+        for ep in endpoints:
+            path = ep['path']
+            method = ep.get('method', 'GET')
+            
+            # 检查敏感路径
+            if not any(p in path.lower() for p in sensitive_patterns):
+                continue
+            
+            # 构建URL
+            if path.startswith('http'):
+                from urllib.parse import urlparse
+                url = f"{urlparse(path).scheme}://{urlparse(path).netloc}{urlparse(path).path}"
+            else:
+                url = self.target.split('?')[0].rstrip('/') + path
+            
+            try:
+                # 不带认证信息访问
+                if method == 'POST':
+                    r = self.session.post(url, json={}, timeout=5)
+                else:
+                    r = self.session.get(url, timeout=5)
+                
+                # 检查是否返回敏感数据（未授权访问成功）
+                if r.status_code == 200:
+                    text_lower = r.text.lower()
+                    if any(k in text_lower for k in ['user', 'admin', 'password', 'email', 'phone']):
+                        self.vulnerabilities.append({
+                            'type': 'Unauthorized Access',
+                            'severity': 'HIGH',
+                            'endpoint': path,
+                            'method': method,
+                            'evidence': f'Sensitive data exposed without auth'
+                        })
+                        print(f"    [!] 未授权访问: {method} {path}")
+                
+                # 401/403 -> 需要认证（正常）
+                # 200 + 无敏感数据 -> 可能不需要认证
+                
+            except:
+                pass
+    
+    def _merge_all_endpoints(self):
+        """v2.0: 合并所有端点"""
+        all_endpoints = []
+        seen = set()
+        
+        # 静态端点
+        for ep in self.static_endpoints:
+            key = f"{ep.method}:{ep.path}"
+            if key not in seen:
+                seen.add(key)
+                all_endpoints.append({
+                    'path': ep.path,
+                    'method': ep.method,
+                    'source': 'static'
+                })
+        
+        # 动态端点 (v2.0 新增)
+        for ep in self.dynamic_endpoints:
+            key = f"{ep.get('method', 'GET')}:{ep.get('path', '')}"
+            if key not in seen and ep.get('path'):
+                seen.add(key)
+                all_endpoints.append({
+                    'path': ep.get('path'),
+                    'method': ep.get('method', 'GET'),
+                    'source': 'dynamic'
+                })
+        
+        # Hook 端点
+        for ep in self.hooked_endpoints:
+            key = f"{ep.get('method', 'GET')}:{ep.get('path', '')}"
+            if key not in seen and ep.get('path'):
+                seen.add(key)
+                all_endpoints.append({
+                    'path': ep.get('path'),
+                    'method': ep.get('method', 'GET'),
+                    'source': 'hooked'
+                })
+        
+        return all_endpoints
+    
+    def _is_auth_endpoint(self, path):
+        """v2.0: 判断是否为认证端点"""
+        auth_patterns = [
+            '/auth/', '/login', '/oauth/', '/user/login',
+            '/api/user/login', '/api/auth/', '/token', '/sso'
+        ]
+        path_lower = path.lower()
+        return any(p in path_lower for p in auth_patterns)
+    
+    def _sort_by_priority(self, endpoints):
+        """v2.0: 按优先级排序端点"""
+        priority_map = {'high': 0, 'medium': 1, 'low': 2}
+        
+        def get_priority(ep):
+            if self._is_auth_endpoint(ep['path']):
+                return 'high'
+            if '/api/' in ep['path'] or '/prod-api/' in ep['path']:
+                return 'medium'
+            return 'low'
+        
+        for ep in endpoints:
+            ep['priority'] = get_priority(ep)
+        
+        return sorted(endpoints, key=lambda x: priority_map.get(x.get('priority'), 2))
+    
+    def _report_nginx_fallback(self):
+        """报告 nginx fallback 问题"""
+        self.vulnerabilities.append({
+            'type': 'Backend API Unreachable / nginx fallback',
+            'severity': 'HIGH',
+            'endpoint': 'Multiple paths',
+            'evidence': '父路径全部返回HTML，且无动态端点'
+        })
+        print(f"  添加问题: nginx fallback")
+    
+    def _cloud_storage_test(self):
+        """云存储测试"""
+        tester = CloudStorageTester(self.target)
+        tester.session = self.session
+        findings, storage_url = tester.full_test(self.target)
+        
+        print(f"  云存储: {storage_url}")
+        print(f"  发现: {len(findings)}")
+        
+        self.cloud_findings = findings
+    
+    def _generate_report(self):
+        """生成报告"""
+        json_api_count = sum(1 for p in self.parent_paths.values() if p.get('is_api'))
+        
+        print("\n" + "=" * 50)
+        print("  测试完成 v2.0")
+        print("=" * 50)
+        print(f"  站点类型: {self.site_type}")
+        print(f"  静态端点: {len(self.static_endpoints)}")
+        print(f"  动态端点: {len(self.dynamic_endpoints)}")
+        print(f"  Hook 端点: {len(self.hooked_endpoints)}")
+        print(f"  JSON API: {json_api_count}")
+        print(f"  API Prefix: {self.api_prefix}")
+        print(f"  漏洞: {len(self.vulnerabilities)}")
+        print(f"  云存储: {len(self.cloud_findings)}")
+        
+        if self.api_prefix_sources:
+            print(f"  API Prefix来源: {self.api_prefix_sources}")
+    
+    def _get_result(self):
+        """获取结果"""
+        json_api_count = sum(1 for p in self.parent_paths.values() if p.get('is_api'))
+        
+        return {
+            'target': self.target,
+            'site_type': self.site_type,
+            'endpoints': {
+                'static': len(self.static_endpoints),
+                'dynamic': len(self.dynamic_endpoints),
+                'hooked': len(self.hooked_endpoints),
+                'parent_paths': len(self.parent_paths),
+                'json_api': json_api_count,
+                'merged': len(self._merge_all_endpoints()),
+            },
+            'api_prefix': self.api_prefix,
+            'api_prefix_sources': self.api_prefix_sources,
+            'decision': {
+                'has_real_api': self.has_real_api,
+                'has_dynamic_endpoints': self.has_dynamic_endpoints,
+                'html_fallback_all': self.html_fallback_all,
+            },
+            'vulnerabilities': self.vulnerabilities,
+            'cloud_findings': self.cloud_findings,
+        }
+
+
+if __name__ == "__main__":
+    import sys
+    
+    if len(sys.argv) > 1:
+        target = sys.argv[1]
+    else:
+        print("Usage: python skill_executor_v2.py <target_url>")
+        print("Example: python skill_executor_v2.py http://example.com")
+        sys.exit(1)
+    
+    executor = SKILLExecutorV2(target)
+    result = executor.run()
+    
+    print("\n\n结果:")
+    print(result)