npm - opencode-api-security-testing - Versions diffs - 3.0.8 → 3.0.10 - Mend

opencode-api-security-testing 3.0.8 → 3.0.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (79) hide show

package/agents/api-cyber-supervisor.md +9 -3
package/agents/api-probing-miner.md +10 -2
package/agents/api-resource-specialist.md +44 -35
package/agents/api-vuln-verifier.md +56 -24
package/package.json +1 -1
package/postinstall.mjs +1 -0
package/preuninstall.mjs +43 -32
package/src/index.ts +3 -100
package/README.md +0 -74
package/SKILL.md +0 -1797
package/core/advanced_recon.py +0 -788
package/core/agentic_analyzer.py +0 -445
package/core/analyzers/api_parser.py +0 -210
package/core/analyzers/response_analyzer.py +0 -212
package/core/analyzers/sensitive_finder.py +0 -184
package/core/api_fuzzer.py +0 -422
package/core/api_interceptor.py +0 -525
package/core/api_parser.py +0 -955
package/core/browser_tester.py +0 -479
package/core/cloud_storage_tester.py +0 -1330
package/core/collectors/__init__.py +0 -23
package/core/collectors/api_path_finder.py +0 -300
package/core/collectors/browser_collect.py +0 -645
package/core/collectors/browser_collector.py +0 -411
package/core/collectors/http_client.py +0 -111
package/core/collectors/js_collector.py +0 -490
package/core/collectors/js_parser.py +0 -780
package/core/collectors/url_collector.py +0 -319
package/core/context_manager.py +0 -682
package/core/deep_api_tester_v35.py +0 -844
package/core/deep_api_tester_v55.py +0 -366
package/core/dynamic_api_analyzer.py +0 -532
package/core/http_client.py +0 -179
package/core/models.py +0 -296
package/core/orchestrator.py +0 -890
package/core/prerequisite.py +0 -227
package/core/reasoning_engine.py +0 -1042
package/core/response_classifier.py +0 -606
package/core/runner.py +0 -938
package/core/scan_engine.py +0 -599
package/core/skill_executor.py +0 -435
package/core/skill_executor_v2.py +0 -670
package/core/skill_executor_v3.py +0 -704
package/core/smart_analyzer.py +0 -687
package/core/strategy_pool.py +0 -707
package/core/testers/auth_tester.py +0 -264
package/core/testers/idor_tester.py +0 -200
package/core/testers/sqli_tester.py +0 -211
package/core/testing_loop.py +0 -655
package/core/utils/base_path_dict.py +0 -255
package/core/utils/payload_lib.py +0 -167
package/core/utils/ssrf_detector.py +0 -220
package/core/verifiers/vuln_verifier.py +0 -536
package/references/README.md +0 -72
package/references/asset-discovery.md +0 -119
package/references/fuzzing-patterns.md +0 -129
package/references/graphql-guidance.md +0 -108
package/references/intake.md +0 -84
package/references/pua-agent.md +0 -192
package/references/report-template.md +0 -156
package/references/rest-guidance.md +0 -76
package/references/severity-model.md +0 -76
package/references/test-matrix.md +0 -86
package/references/validation.md +0 -78
package/references/vulnerabilities/01-sqli-tests.md +0 -1128
package/references/vulnerabilities/02-user-enum-tests.md +0 -423
package/references/vulnerabilities/03-jwt-tests.md +0 -499
package/references/vulnerabilities/04-idor-tests.md +0 -362
package/references/vulnerabilities/05-sensitive-data-tests.md +0 -466
package/references/vulnerabilities/06-biz-logic-tests.md +0 -501
package/references/vulnerabilities/07-security-config-tests.md +0 -511
package/references/vulnerabilities/08-brute-force-tests.md +0 -457
package/references/vulnerabilities/09-vulnerability-chains.md +0 -465
package/references/vulnerabilities/10-auth-tests.md +0 -537
package/references/vulnerabilities/11-graphql-tests.md +0 -355
package/references/vulnerabilities/12-ssrf-tests.md +0 -396
package/references/vulnerabilities/README.md +0 -148
package/references/workflows.md +0 -192
package/src/hooks/directory-agents-injector.ts +0 -106

package/core/analyzers/response_analyzer.py DELETED Viewed

@@ -1,212 +0,0 @@
-"""
-响应类型分析 - 识别响应是真实API还是WAF/路由/错误页
-输入: {response, expected_type}
-输出: {type, is_suspicious, suspicious_reasons, sensitive_fields, is_valid_json, parsed_json}
-"""
-import re
-import json
-def response_analyzer(config):
-    """
-    分析HTTP响应类型和内容
-    输入:
-        response: {
-            status: number,
-            headers: dict,
-            body: string,
-            content_type: string
-        }
-        expected_type?: "json" | "html" | "any"
-    输出:
-        type: "json" | "html" | "empty" | "redirect"
-        is_suspicious: boolean
-        suspicious_reasons: string[]
-        sensitive_fields: string[]
-        is_valid_json: boolean
-        parsed_json?: object
-    """
-    response = config.get('response', {})
-    expected_type = config.get('expected_type', 'any')
-    status = response.get('status', 0)
-    body = response.get('body', '')
-    headers = response.get('headers', {})
-    content_type = response.get('content_type', '') or headers.get('Content-Type', '')
-    result = {
-        'type': 'unknown',
-        'is_suspicious': False,
-        'suspicious_reasons': [],
-        'sensitive_fields': [],
-        'is_valid_json': False,
-        'parsed_json': None
-    }
-    # 判断响应类型
-    if status in [301, 302, 303, 307, 308]:
-        result['type'] = 'redirect'
-        result['is_suspicious'] = True
-        result['suspicious_reasons'].append('redirect')
-        return result
-    body_lower = body.lower()
-    body_len = len(body)
-    # 检查是否是HTML
-    is_html = (
-        '<!doctype html>' in body_lower or
-        '<html' in body_lower or
-        'text/html' in content_type.lower()
-    )
-    # 检查是否包含DOCTYPE
-    hasdoctype = '<!doctype' in body_lower
-    # 检查是否是JSON
-    is_json = False
-    parsed_json = None
-    if 'application/json' in content_type.lower():
-        try:
-            parsed_json = json.loads(body)
-            is_json = True
-            result['is_valid_json'] = True
-            result['parsed_json'] = parsed_json
-        except:
-            pass
-    # 也尝试直接解析body
-    if not is_json and body.strip().startswith('{'):
-        try:
-            parsed_json = json.loads(body)
-            is_json = True
-            result['is_valid_json'] = True
-            result['parsed_json'] = parsed_json
-        except:
-            pass
-    # 分类响应类型
-    if body_len < 50:
-        result['type'] = 'empty'
-        if status == 200:
-            result['is_suspicious'] = True
-            result['suspicious_reasons'].append('empty_response')
-    elif is_html:
-        result['type'] = 'html'
-        # HTML可能是WAF、SPA路由或错误页
-        if 'waf' in body_lower or '安全' in body_lower or '拦截' in body_lower:
-            result['suspicious_reasons'].append('waf_block')
-        if 'not found' in body_lower or '404' in body_lower:
-            result['suspicious_reasons'].append('not_found')
-        if hasdoctype and 'vue' in body_lower or 'react' in body_lower:
-            result['suspicious_reasons'].append('spa_route')
-    elif is_json:
-        result['type'] = 'json'
-    else:
-        result['type'] = 'other'
-    # 检查敏感字段
-    sensitive_patterns = {
-        'password': r'password["\']?\s*[:=]\s*["\']([^"\']+)',
-        'token': r'(?:token|Token|TOKEN)["\']?\s*[:=]\s*["\']([^"\']{10,})',
-        'secret': r'secret["\']?\s*[:=]\s*["\']([^"\']+)',
-        'api_key': r'api[_-]?key["\']?\s*[:=]\s*["\']([^"\']+)',
-        'jwt': r'eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+',
-    }
-    if parsed_json:
-        body_str = json.dumps(parsed_json)
-    else:
-        body_str = body
-    for field_name, pattern in sensitive_patterns.items():
-        matches = re.findall(pattern, body_str, re.I)
-        if matches:
-            result['sensitive_fields'].append({
-                'field': field_name,
-                'count': len(matches),
-                'preview': matches[0][:50] if matches else ''
-            })
-    # 判断是否可疑
-    if 'waf_block' in result['suspicious_reasons']:
-        result['is_suspicious'] = True
-    if 'spa_route' in result['suspicious_reasons']:
-        result['is_suspicious'] = True
-    if result['type'] == 'html' and expected_type == 'json':
-        result['is_suspicious'] = True
-    return result
-def compare_responses(baseline, test):
-    """
-    对比两个响应的差异
-    输入:
-        baseline: response - 正常响应
-        test: response - 测试响应
-    输出:
-        identical: boolean
-        differences: Array<{field, baseline_value, test_value, significance}>
-    """
-    differences = []
-    # 比较状态码
-    if baseline.get('status') != test.get('status'):
-        differences.append({
-            'field': 'status',
-            'baseline_value': baseline.get('status'),
-            'test_value': test.get('status'),
-            'significance': 'high'
-        })
-    # 比较响应长度
-    baseline_len = len(baseline.get('body', ''))
-    test_len = len(test.get('body', ''))
-    if baseline_len != test_len:
-        diff_ratio = abs(baseline_len - test_len) / max(baseline_len, test_len)
-        significance = 'high' if diff_ratio > 0.5 else 'low'
-        differences.append({
-            'field': 'body_length',
-            'baseline_value': baseline_len,
-            'test_value': test_len,
-            'significance': significance
-        })
-    # 比较响应类型
-    baseline_type = response_analyzer({'response': baseline}).get('type')
-    test_type = response_analyzer({'response': test}).get('type')
-    if baseline_type != test_type:
-        differences.append({
-            'field': 'response_type',
-            'baseline_value': baseline_type,
-            'test_value': test_type,
-            'significance': 'high'
-        })
-    identical = len(differences) == 0
-    return {
-        'identical': identical,
-        'differences': differences
-    }
-if __name__ == '__main__':
-    # 测试
-    result = response_analyzer({
-        'response': {
-            'status': 200,
-            'headers': {'Content-Type': 'application/json'},
-            'body': '{"code": 200, "data": {"userId": 1}}'
-        }
-    })
-    print(f"Type: {result['type']}, Suspicious: {result['is_suspicious']}")

package/core/analyzers/sensitive_finder.py DELETED Viewed

@@ -1,184 +0,0 @@
-"""
-敏感信息发现 - 从响应/源码中提取敏感信息
-输入: {content, check_fields}
-输出: {found: [{field, value, position}], severity}
-"""
-import re
-import json
-def sensitive_finder(config):
-    """
-    发现敏感信息
-    输入:
-        content: string - 响应body或JS内容
-        check_fields?: string[] - 自定义敏感字段
-    输出:
-        found: Array<{field, value, position}>
-        severity: "high" | "medium" | "low"
-    """
-    content = str(content)
-    check_fields = config.get('check_fields', [])
-    # 默认敏感字段
-    default_fields = [
-        'password', 'passwd', 'pwd',
-        'token', 'access_token', 'refresh_token',
-        'secret', 'secret_key', 'app_secret',
-        'api_key', 'apikey', 'api_secret',
-        'private_key',
-        'aws_access_key', 'aws_secret_key',
-        'phone', 'mobile',
-        'email',
-        'id_card', 'idcard', '身份证',
-        'balance', 'account', '余额'
-    ]
-    # 合并字段
-    all_fields = set(default_fields + check_fields)
-    found = []
-    # 通用敏感信息模式
-    patterns = {
-        'password': [
-            r'password["\']?\s*[:=]\s*["\']([^"\']{1,100})["\']',
-            r'"pwd"\s*:\s*"([^"]+)"',
-            r'"passwd"\s*:\s*"([^"]+)"',
-        ],
-        'token': [
-            r'(?:token|Token|TOKEN)["\']?\s*[:=]\s*["\']([^"\']{10,200})["\']',
-            r'Bearer\s+([a-zA-Z0-9\-_\.]+)',
-        ],
-        'jwt': [
-            r'eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+',
-        ],
-        'phone': [
-            r'1[3-9]\d{9}',
-            r'\d{3}-?\d{4}-?\d{4}',
-        ],
-        'email': [
-            r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}',
-        ],
-        'secret': [
-            r'secret["\']?\s*[:=]\s*["\']([^"\']{1,100})["\']',
-            r'appSecret["\']?\s*[:=]\s*["\']([^"\']{1,100})["\']',
-        ],
-        'api_key': [
-            r'apiKey["\']?\s*[:=]\s*["\']([^"\']{1,100})["\']',
-            r'api[_-]?key["\']?\s*[:=]\s*["\']([^"\']{1,100})["\']',
-        ],
-        'aws_key': [
-            r'AKIA[0-9A-Z]{16}',
-        ],
-        'private_key': [
-            r'-----BEGIN[ A-Z]*PRIVATE KEY-----',
-        ]
-    }
-    # 搜索敏感信息
-    for field_name, field_patterns in patterns.items():
-        for pattern in field_patterns:
-            matches = re.finditer(pattern, content, re.I)
-            for match in matches:
-                value = match.group(0)
-                # 过滤掉太长的值
-                if len(value) > 200:
-                    continue
-                # 过滤掉测试数据
-                if is_test_data(value):
-                    continue
-                found.append({
-                    'field': field_name,
-                    'value': value[:100],
-                    'position': match.start()
-                })
-    # 搜索用户定义的字段
-    for field in all_fields:
-        if field.lower() in ['password', 'token', 'secret', 'api_key']:
-            continue  # 已处理
-        pattern = rf'{field}["\']?\s*[:=]\s*["\']([^"\']{{1,100}})["\']'
-        matches = re.finditer(pattern, content, re.I)
-        for match in matches:
-            value = match.group(1)
-            if len(value) > 100:
-                continue
-            if is_test_data(value):
-                continue
-            found.append({
-                'field': field,
-                'value': value[:50],
-                'position': match.start()
-            })
-    # 判断严重性
-    severity = 'low'
-    high_severity = ['password', 'token', 'jwt', 'secret', 'api_key', 'aws_key', 'private_key']
-    medium_severity = ['phone', 'email', 'id_card']
-    found_fields = [f['field'].lower() for f in found]
-    if any(f in found_fields for f in high_severity):
-        severity = 'high'
-    elif any(f in found_fields for f in medium_severity):
-        severity = 'medium'
-    return {
-        'found': found,
-        'severity': severity,
-        'count': len(found)
-    }
-def is_test_data(value):
-    """判断是否是测试数据"""
-    test_patterns = [
-        'test', 'TEST', 'Test',
-        'xxx', 'xxx.xxx',
-        'null', 'undefined',
-        'example', 'sample',
-        'placeholder'
-    ]
-    value_lower = value.lower()
-    return any(t in value_lower for t in test_patterns)
-def extract_secrets_from_json(data, path=''):
-    """从JSON中递归提取敏感信息"""
-    secrets = []
-    if isinstance(data, dict):
-        for key, value in data.items():
-            current_path = f"{path}.{key}" if path else key
-            sensitive_keys = ['password', 'token', 'secret', 'key', 'api', 'credential']
-            if any(s in key.lower() for s in sensitive_keys):
-                if isinstance(value, str) and len(value) > 0:
-                    secrets.append({
-                        'path': current_path,
-                        'value': value[:50],
-                        'key': key
-                    })
-            if isinstance(value, (dict, list)):
-                secrets.extend(extract_secrets_from_json(value, current_path))
-    elif isinstance(data, list):
-        for i, item in enumerate(data):
-            current_path = f"{path}[{i}]"
-            if isinstance(item, (dict, list)):
-                secrets.extend(extract_secrets_from_json(item, current_path))
-    return secrets
-if __name__ == '__main__':
-    # 测试
-    result = sensitive_finder({
-        'content': '{"token": "eyJhbGciOiJIUzI1NiJ9", "password": "admin123"}',
-        'check_fields': ['custom_field']
-    })
-    print(f"Found: {result['count']}, Severity: {result['severity']}")