opencode-api-security-testing 3.0.8 → 3.0.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/agents/api-cyber-supervisor.md +9 -3
- package/agents/api-probing-miner.md +10 -2
- package/agents/api-resource-specialist.md +44 -35
- package/agents/api-vuln-verifier.md +56 -24
- package/package.json +1 -1
- package/postinstall.mjs +1 -0
- package/preuninstall.mjs +43 -32
- package/src/index.ts +3 -100
- package/README.md +0 -74
- package/SKILL.md +0 -1797
- package/core/advanced_recon.py +0 -788
- package/core/agentic_analyzer.py +0 -445
- package/core/analyzers/api_parser.py +0 -210
- package/core/analyzers/response_analyzer.py +0 -212
- package/core/analyzers/sensitive_finder.py +0 -184
- package/core/api_fuzzer.py +0 -422
- package/core/api_interceptor.py +0 -525
- package/core/api_parser.py +0 -955
- package/core/browser_tester.py +0 -479
- package/core/cloud_storage_tester.py +0 -1330
- package/core/collectors/__init__.py +0 -23
- package/core/collectors/api_path_finder.py +0 -300
- package/core/collectors/browser_collect.py +0 -645
- package/core/collectors/browser_collector.py +0 -411
- package/core/collectors/http_client.py +0 -111
- package/core/collectors/js_collector.py +0 -490
- package/core/collectors/js_parser.py +0 -780
- package/core/collectors/url_collector.py +0 -319
- package/core/context_manager.py +0 -682
- package/core/deep_api_tester_v35.py +0 -844
- package/core/deep_api_tester_v55.py +0 -366
- package/core/dynamic_api_analyzer.py +0 -532
- package/core/http_client.py +0 -179
- package/core/models.py +0 -296
- package/core/orchestrator.py +0 -890
- package/core/prerequisite.py +0 -227
- package/core/reasoning_engine.py +0 -1042
- package/core/response_classifier.py +0 -606
- package/core/runner.py +0 -938
- package/core/scan_engine.py +0 -599
- package/core/skill_executor.py +0 -435
- package/core/skill_executor_v2.py +0 -670
- package/core/skill_executor_v3.py +0 -704
- package/core/smart_analyzer.py +0 -687
- package/core/strategy_pool.py +0 -707
- package/core/testers/auth_tester.py +0 -264
- package/core/testers/idor_tester.py +0 -200
- package/core/testers/sqli_tester.py +0 -211
- package/core/testing_loop.py +0 -655
- package/core/utils/base_path_dict.py +0 -255
- package/core/utils/payload_lib.py +0 -167
- package/core/utils/ssrf_detector.py +0 -220
- package/core/verifiers/vuln_verifier.py +0 -536
- package/references/README.md +0 -72
- package/references/asset-discovery.md +0 -119
- package/references/fuzzing-patterns.md +0 -129
- package/references/graphql-guidance.md +0 -108
- package/references/intake.md +0 -84
- package/references/pua-agent.md +0 -192
- package/references/report-template.md +0 -156
- package/references/rest-guidance.md +0 -76
- package/references/severity-model.md +0 -76
- package/references/test-matrix.md +0 -86
- package/references/validation.md +0 -78
- package/references/vulnerabilities/01-sqli-tests.md +0 -1128
- package/references/vulnerabilities/02-user-enum-tests.md +0 -423
- package/references/vulnerabilities/03-jwt-tests.md +0 -499
- package/references/vulnerabilities/04-idor-tests.md +0 -362
- package/references/vulnerabilities/05-sensitive-data-tests.md +0 -466
- package/references/vulnerabilities/06-biz-logic-tests.md +0 -501
- package/references/vulnerabilities/07-security-config-tests.md +0 -511
- package/references/vulnerabilities/08-brute-force-tests.md +0 -457
- package/references/vulnerabilities/09-vulnerability-chains.md +0 -465
- package/references/vulnerabilities/10-auth-tests.md +0 -537
- package/references/vulnerabilities/11-graphql-tests.md +0 -355
- package/references/vulnerabilities/12-ssrf-tests.md +0 -396
- package/references/vulnerabilities/README.md +0 -148
- package/references/workflows.md +0 -192
- package/src/hooks/directory-agents-injector.ts +0 -106
package/core/prerequisite.py
DELETED
|
@@ -1,227 +0,0 @@
|
|
|
1
|
-
"""
|
|
2
|
-
前置检查模块 - Playwright 依赖检测与自动修复
|
|
3
|
-
|
|
4
|
-
检测顺序:
|
|
5
|
-
1. Playwright (首选)
|
|
6
|
-
2. Pyppeteer (异步无头浏览器)
|
|
7
|
-
3. Selenium (多浏览器支持)
|
|
8
|
-
4. MCP: headless_browser
|
|
9
|
-
5. Skill: headless_browser skill
|
|
10
|
-
|
|
11
|
-
自动修复:
|
|
12
|
-
- playwright install-deps
|
|
13
|
-
- playwright install chromium
|
|
14
|
-
- pip install playwright
|
|
15
|
-
"""
|
|
16
|
-
|
|
17
|
-
import subprocess
|
|
18
|
-
import sys
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
def check_playwright():
|
|
22
|
-
"""检查 Playwright 是否可用"""
|
|
23
|
-
try:
|
|
24
|
-
from playwright.sync_api import sync_playwright
|
|
25
|
-
with sync_playwright() as p:
|
|
26
|
-
browser = p.chromium.launch(headless=True)
|
|
27
|
-
browser.close()
|
|
28
|
-
return True, "playwright"
|
|
29
|
-
except ImportError:
|
|
30
|
-
return False, "playwright_not_installed"
|
|
31
|
-
except Exception as e:
|
|
32
|
-
return False, f"playwright_error: {e}"
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
def check_pyppeteer():
|
|
36
|
-
"""检查 Pyppeteer 是否可用"""
|
|
37
|
-
try:
|
|
38
|
-
import pyppeteer
|
|
39
|
-
return True, "pyppeteer"
|
|
40
|
-
except ImportError:
|
|
41
|
-
return False, "pyppeteer_not_installed"
|
|
42
|
-
except Exception as e:
|
|
43
|
-
return False, f"pyppeteer_error: {e}"
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
def check_selenium():
|
|
47
|
-
"""检查 Selenium 是否可用"""
|
|
48
|
-
try:
|
|
49
|
-
from selenium import webdriver
|
|
50
|
-
from selenium.webdriver.chrome.options import Options
|
|
51
|
-
options = Options()
|
|
52
|
-
options.add_argument('--headless')
|
|
53
|
-
options.add_argument('--no-sandbox')
|
|
54
|
-
driver = webdriver.Chrome(options=options)
|
|
55
|
-
driver.quit()
|
|
56
|
-
return True, "selenium"
|
|
57
|
-
except ImportError:
|
|
58
|
-
return False, "selenium_not_installed"
|
|
59
|
-
except Exception as e:
|
|
60
|
-
return False, f"selenium_error: {e}"
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
def check_mcp_headless_browser():
|
|
64
|
-
"""检查 MCP: headless_browser 是否可用"""
|
|
65
|
-
try:
|
|
66
|
-
import mcp
|
|
67
|
-
# 尝试导入 headless_browser MCP
|
|
68
|
-
from mcp.server import Server
|
|
69
|
-
return True, "mcp_headless_browser"
|
|
70
|
-
except ImportError:
|
|
71
|
-
return False, "mcp_not_installed"
|
|
72
|
-
except Exception as e:
|
|
73
|
-
return False, f"mcp_error: {e}"
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
def check_skill_headless_browser():
|
|
77
|
-
"""检查 headless_browser skill 是否存在"""
|
|
78
|
-
import os
|
|
79
|
-
skill_paths = [
|
|
80
|
-
"/root/.claude/skills/headless_browser/SKILL.md",
|
|
81
|
-
"./skills/headless_browser/SKILL.md",
|
|
82
|
-
"../headless_browser/SKILL.md",
|
|
83
|
-
]
|
|
84
|
-
for path in skill_paths:
|
|
85
|
-
if os.path.exists(path):
|
|
86
|
-
return True, f"headless_browser_skill: {path}"
|
|
87
|
-
return False, "headless_browser_skill_not_found"
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
def auto_install_playwright():
|
|
91
|
-
"""自动安装 Playwright"""
|
|
92
|
-
print(" [尝试自动安装 Playwright...]")
|
|
93
|
-
|
|
94
|
-
commands = [
|
|
95
|
-
["pip", "install", "playwright"],
|
|
96
|
-
["playwright", "install-deps", "chromium"],
|
|
97
|
-
["playwright", "install", "chromium"],
|
|
98
|
-
]
|
|
99
|
-
|
|
100
|
-
for cmd in commands:
|
|
101
|
-
try:
|
|
102
|
-
print(f" [执行] {' '.join(cmd)}")
|
|
103
|
-
result = subprocess.run(
|
|
104
|
-
cmd,
|
|
105
|
-
capture_output=True,
|
|
106
|
-
text=True,
|
|
107
|
-
timeout=120
|
|
108
|
-
)
|
|
109
|
-
if result.returncode == 0:
|
|
110
|
-
print(f" [OK] {' '.join(cmd)}")
|
|
111
|
-
else:
|
|
112
|
-
print(f" [FAIL] {' '.join(cmd)}: {result.stderr[:100]}")
|
|
113
|
-
except subprocess.TimeoutExpired:
|
|
114
|
-
print(f" [TIMEOUT] {' '.join(cmd)}")
|
|
115
|
-
except Exception as e:
|
|
116
|
-
print(f" [ERROR] {' '.join(cmd)}: {e}")
|
|
117
|
-
|
|
118
|
-
# 验证安装
|
|
119
|
-
available, reason = check_playwright()
|
|
120
|
-
if available:
|
|
121
|
-
print(" [OK] Playwright 安装成功!")
|
|
122
|
-
return True
|
|
123
|
-
else:
|
|
124
|
-
print(f" [FAIL] Playwright 仍不可用: {reason}")
|
|
125
|
-
return False
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
def check_browser_alternatives():
|
|
129
|
-
"""
|
|
130
|
-
检测无头浏览器平替方案
|
|
131
|
-
|
|
132
|
-
Returns:
|
|
133
|
-
(available, browser_type, can_proceed)
|
|
134
|
-
"""
|
|
135
|
-
print("\n[无头浏览器检测]")
|
|
136
|
-
print("-" * 40)
|
|
137
|
-
|
|
138
|
-
# 1. 检查 Playwright
|
|
139
|
-
available, reason = check_playwright()
|
|
140
|
-
if available:
|
|
141
|
-
print(f" [OK] Playwright 可用")
|
|
142
|
-
return True, "playwright", True
|
|
143
|
-
|
|
144
|
-
print(f" [FAIL] Playwright 不可用: {reason}")
|
|
145
|
-
|
|
146
|
-
# 2. 检查平替方案
|
|
147
|
-
alternatives = [
|
|
148
|
-
("Pyppeteer", check_pyppeteer),
|
|
149
|
-
("Selenium", check_selenium),
|
|
150
|
-
("MCP: headless_browser", check_mcp_headless_browser),
|
|
151
|
-
("Skill: headless_browser", check_skill_headless_browser),
|
|
152
|
-
]
|
|
153
|
-
|
|
154
|
-
found_alternatives = []
|
|
155
|
-
for name, check_func in alternatives:
|
|
156
|
-
available, reason = check_func()
|
|
157
|
-
if available:
|
|
158
|
-
print(f" [发现平替] {name}")
|
|
159
|
-
found_alternatives.append(name)
|
|
160
|
-
else:
|
|
161
|
-
print(f" [未发现] {name}: {reason}")
|
|
162
|
-
|
|
163
|
-
# 3. 尝试自动安装 Playwright
|
|
164
|
-
print("\n[尝试自动安装...]")
|
|
165
|
-
if auto_install_playwright():
|
|
166
|
-
return True, "playwright", True
|
|
167
|
-
|
|
168
|
-
# 4. 如果有平替方案,提示用户
|
|
169
|
-
if found_alternatives:
|
|
170
|
-
print(f"\n [提示] 发现 {len(found_alternatives)} 个平替方案:")
|
|
171
|
-
for alt in found_alternatives:
|
|
172
|
-
print(f" - {alt}")
|
|
173
|
-
print(" [建议] 可以使用平替方案继续测试")
|
|
174
|
-
return False, found_alternatives[0], True
|
|
175
|
-
|
|
176
|
-
# 5. 无任何方案
|
|
177
|
-
print("\n [FATAL] 没有任何可用的无头浏览器方案")
|
|
178
|
-
print(" [建议] 请手动安装 Playwright:")
|
|
179
|
-
print(" pip install playwright")
|
|
180
|
-
print(" playwright install-deps chromium")
|
|
181
|
-
print(" playwright install chromium")
|
|
182
|
-
|
|
183
|
-
return False, None, False
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
def prerequisite_check():
|
|
187
|
-
"""
|
|
188
|
-
前置检查主函数
|
|
189
|
-
|
|
190
|
-
Returns:
|
|
191
|
-
(playwright_available, browser_type, can_proceed)
|
|
192
|
-
"""
|
|
193
|
-
print("\n" + "=" * 50)
|
|
194
|
-
print(" [0] 前置检查")
|
|
195
|
-
print("=" * 50)
|
|
196
|
-
|
|
197
|
-
# 检查 requests
|
|
198
|
-
print("\n[Requests 检测]")
|
|
199
|
-
try:
|
|
200
|
-
import requests
|
|
201
|
-
print(" [OK] requests 可用")
|
|
202
|
-
requests_available = True
|
|
203
|
-
except ImportError:
|
|
204
|
-
print(" [FAIL] requests 未安装")
|
|
205
|
-
requests_available = False
|
|
206
|
-
|
|
207
|
-
if not requests_available:
|
|
208
|
-
print("\n [FATAL] requests 是必需依赖")
|
|
209
|
-
print(" [建议] pip install requests")
|
|
210
|
-
return False, None, False
|
|
211
|
-
|
|
212
|
-
# 检查无头浏览器
|
|
213
|
-
playwright_available, browser_type, can_proceed = check_browser_alternatives()
|
|
214
|
-
|
|
215
|
-
print("\n" + "=" * 50)
|
|
216
|
-
print(" 前置检查结果:")
|
|
217
|
-
print(f" requests: {'OK' if requests_available else 'FAIL'}")
|
|
218
|
-
print(f" 无头浏览器: {'OK' if playwright_available else 'FAIL'}")
|
|
219
|
-
if browser_type:
|
|
220
|
-
print(f" 浏览器类型: {browser_type}")
|
|
221
|
-
print("=" * 50 + "\n")
|
|
222
|
-
|
|
223
|
-
return playwright_available, browser_type, can_proceed
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
if __name__ == "__main__":
|
|
227
|
-
prerequisite_check()
|