opencode-api-security-testing 3.0.9 → 3.0.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/agents/api-cyber-supervisor.md +22 -19
  2. package/agents/api-probing-miner.md +34 -10
  3. package/agents/api-resource-specialist.md +49 -20
  4. package/agents/api-vuln-verifier.md +69 -18
  5. package/package.json +1 -1
  6. package/postinstall.mjs +1 -0
  7. package/preuninstall.mjs +43 -32
  8. package/src/index.ts +6 -3
  9. package/README.md +0 -74
  10. package/SKILL.md +0 -1797
  11. package/core/advanced_recon.py +0 -788
  12. package/core/agentic_analyzer.py +0 -445
  13. package/core/analyzers/api_parser.py +0 -210
  14. package/core/analyzers/response_analyzer.py +0 -212
  15. package/core/analyzers/sensitive_finder.py +0 -184
  16. package/core/api_fuzzer.py +0 -422
  17. package/core/api_interceptor.py +0 -525
  18. package/core/api_parser.py +0 -955
  19. package/core/browser_tester.py +0 -479
  20. package/core/cloud_storage_tester.py +0 -1330
  21. package/core/collectors/__init__.py +0 -23
  22. package/core/collectors/api_path_finder.py +0 -300
  23. package/core/collectors/browser_collect.py +0 -645
  24. package/core/collectors/browser_collector.py +0 -411
  25. package/core/collectors/http_client.py +0 -111
  26. package/core/collectors/js_collector.py +0 -490
  27. package/core/collectors/js_parser.py +0 -780
  28. package/core/collectors/url_collector.py +0 -319
  29. package/core/context_manager.py +0 -682
  30. package/core/deep_api_tester_v35.py +0 -844
  31. package/core/deep_api_tester_v55.py +0 -366
  32. package/core/dynamic_api_analyzer.py +0 -532
  33. package/core/http_client.py +0 -179
  34. package/core/models.py +0 -296
  35. package/core/orchestrator.py +0 -890
  36. package/core/prerequisite.py +0 -227
  37. package/core/reasoning_engine.py +0 -1042
  38. package/core/response_classifier.py +0 -606
  39. package/core/runner.py +0 -938
  40. package/core/scan_engine.py +0 -599
  41. package/core/skill_executor.py +0 -435
  42. package/core/skill_executor_v2.py +0 -670
  43. package/core/skill_executor_v3.py +0 -704
  44. package/core/smart_analyzer.py +0 -687
  45. package/core/strategy_pool.py +0 -707
  46. package/core/testers/auth_tester.py +0 -264
  47. package/core/testers/idor_tester.py +0 -200
  48. package/core/testers/sqli_tester.py +0 -211
  49. package/core/testing_loop.py +0 -655
  50. package/core/utils/base_path_dict.py +0 -255
  51. package/core/utils/payload_lib.py +0 -167
  52. package/core/utils/ssrf_detector.py +0 -220
  53. package/core/verifiers/vuln_verifier.py +0 -536
  54. package/references/README.md +0 -72
  55. package/references/asset-discovery.md +0 -119
  56. package/references/fuzzing-patterns.md +0 -129
  57. package/references/graphql-guidance.md +0 -108
  58. package/references/intake.md +0 -84
  59. package/references/pua-agent.md +0 -192
  60. package/references/report-template.md +0 -156
  61. package/references/rest-guidance.md +0 -76
  62. package/references/severity-model.md +0 -76
  63. package/references/test-matrix.md +0 -86
  64. package/references/validation.md +0 -78
  65. package/references/vulnerabilities/01-sqli-tests.md +0 -1128
  66. package/references/vulnerabilities/02-user-enum-tests.md +0 -423
  67. package/references/vulnerabilities/03-jwt-tests.md +0 -499
  68. package/references/vulnerabilities/04-idor-tests.md +0 -362
  69. package/references/vulnerabilities/05-sensitive-data-tests.md +0 -466
  70. package/references/vulnerabilities/06-biz-logic-tests.md +0 -501
  71. package/references/vulnerabilities/07-security-config-tests.md +0 -511
  72. package/references/vulnerabilities/08-brute-force-tests.md +0 -457
  73. package/references/vulnerabilities/09-vulnerability-chains.md +0 -465
  74. package/references/vulnerabilities/10-auth-tests.md +0 -537
  75. package/references/vulnerabilities/11-graphql-tests.md +0 -355
  76. package/references/vulnerabilities/12-ssrf-tests.md +0 -396
  77. package/references/vulnerabilities/README.md +0 -148
  78. package/references/workflows.md +0 -192
@@ -1,227 +0,0 @@
1
- """
2
- 前置检查模块 - Playwright 依赖检测与自动修复
3
-
4
- 检测顺序:
5
- 1. Playwright (首选)
6
- 2. Pyppeteer (异步无头浏览器)
7
- 3. Selenium (多浏览器支持)
8
- 4. MCP: headless_browser
9
- 5. Skill: headless_browser skill
10
-
11
- 自动修复:
12
- - playwright install-deps
13
- - playwright install chromium
14
- - pip install playwright
15
- """
16
-
17
- import subprocess
18
- import sys
19
-
20
-
21
- def check_playwright():
22
- """检查 Playwright 是否可用"""
23
- try:
24
- from playwright.sync_api import sync_playwright
25
- with sync_playwright() as p:
26
- browser = p.chromium.launch(headless=True)
27
- browser.close()
28
- return True, "playwright"
29
- except ImportError:
30
- return False, "playwright_not_installed"
31
- except Exception as e:
32
- return False, f"playwright_error: {e}"
33
-
34
-
35
- def check_pyppeteer():
36
- """检查 Pyppeteer 是否可用"""
37
- try:
38
- import pyppeteer
39
- return True, "pyppeteer"
40
- except ImportError:
41
- return False, "pyppeteer_not_installed"
42
- except Exception as e:
43
- return False, f"pyppeteer_error: {e}"
44
-
45
-
46
- def check_selenium():
47
- """检查 Selenium 是否可用"""
48
- try:
49
- from selenium import webdriver
50
- from selenium.webdriver.chrome.options import Options
51
- options = Options()
52
- options.add_argument('--headless')
53
- options.add_argument('--no-sandbox')
54
- driver = webdriver.Chrome(options=options)
55
- driver.quit()
56
- return True, "selenium"
57
- except ImportError:
58
- return False, "selenium_not_installed"
59
- except Exception as e:
60
- return False, f"selenium_error: {e}"
61
-
62
-
63
- def check_mcp_headless_browser():
64
- """检查 MCP: headless_browser 是否可用"""
65
- try:
66
- import mcp
67
- # 尝试导入 headless_browser MCP
68
- from mcp.server import Server
69
- return True, "mcp_headless_browser"
70
- except ImportError:
71
- return False, "mcp_not_installed"
72
- except Exception as e:
73
- return False, f"mcp_error: {e}"
74
-
75
-
76
- def check_skill_headless_browser():
77
- """检查 headless_browser skill 是否存在"""
78
- import os
79
- skill_paths = [
80
- "/root/.claude/skills/headless_browser/SKILL.md",
81
- "./skills/headless_browser/SKILL.md",
82
- "../headless_browser/SKILL.md",
83
- ]
84
- for path in skill_paths:
85
- if os.path.exists(path):
86
- return True, f"headless_browser_skill: {path}"
87
- return False, "headless_browser_skill_not_found"
88
-
89
-
90
- def auto_install_playwright():
91
- """自动安装 Playwright"""
92
- print(" [尝试自动安装 Playwright...]")
93
-
94
- commands = [
95
- ["pip", "install", "playwright"],
96
- ["playwright", "install-deps", "chromium"],
97
- ["playwright", "install", "chromium"],
98
- ]
99
-
100
- for cmd in commands:
101
- try:
102
- print(f" [执行] {' '.join(cmd)}")
103
- result = subprocess.run(
104
- cmd,
105
- capture_output=True,
106
- text=True,
107
- timeout=120
108
- )
109
- if result.returncode == 0:
110
- print(f" [OK] {' '.join(cmd)}")
111
- else:
112
- print(f" [FAIL] {' '.join(cmd)}: {result.stderr[:100]}")
113
- except subprocess.TimeoutExpired:
114
- print(f" [TIMEOUT] {' '.join(cmd)}")
115
- except Exception as e:
116
- print(f" [ERROR] {' '.join(cmd)}: {e}")
117
-
118
- # 验证安装
119
- available, reason = check_playwright()
120
- if available:
121
- print(" [OK] Playwright 安装成功!")
122
- return True
123
- else:
124
- print(f" [FAIL] Playwright 仍不可用: {reason}")
125
- return False
126
-
127
-
128
- def check_browser_alternatives():
129
- """
130
- 检测无头浏览器平替方案
131
-
132
- Returns:
133
- (available, browser_type, can_proceed)
134
- """
135
- print("\n[无头浏览器检测]")
136
- print("-" * 40)
137
-
138
- # 1. 检查 Playwright
139
- available, reason = check_playwright()
140
- if available:
141
- print(f" [OK] Playwright 可用")
142
- return True, "playwright", True
143
-
144
- print(f" [FAIL] Playwright 不可用: {reason}")
145
-
146
- # 2. 检查平替方案
147
- alternatives = [
148
- ("Pyppeteer", check_pyppeteer),
149
- ("Selenium", check_selenium),
150
- ("MCP: headless_browser", check_mcp_headless_browser),
151
- ("Skill: headless_browser", check_skill_headless_browser),
152
- ]
153
-
154
- found_alternatives = []
155
- for name, check_func in alternatives:
156
- available, reason = check_func()
157
- if available:
158
- print(f" [发现平替] {name}")
159
- found_alternatives.append(name)
160
- else:
161
- print(f" [未发现] {name}: {reason}")
162
-
163
- # 3. 尝试自动安装 Playwright
164
- print("\n[尝试自动安装...]")
165
- if auto_install_playwright():
166
- return True, "playwright", True
167
-
168
- # 4. 如果有平替方案,提示用户
169
- if found_alternatives:
170
- print(f"\n [提示] 发现 {len(found_alternatives)} 个平替方案:")
171
- for alt in found_alternatives:
172
- print(f" - {alt}")
173
- print(" [建议] 可以使用平替方案继续测试")
174
- return False, found_alternatives[0], True
175
-
176
- # 5. 无任何方案
177
- print("\n [FATAL] 没有任何可用的无头浏览器方案")
178
- print(" [建议] 请手动安装 Playwright:")
179
- print(" pip install playwright")
180
- print(" playwright install-deps chromium")
181
- print(" playwright install chromium")
182
-
183
- return False, None, False
184
-
185
-
186
- def prerequisite_check():
187
- """
188
- 前置检查主函数
189
-
190
- Returns:
191
- (playwright_available, browser_type, can_proceed)
192
- """
193
- print("\n" + "=" * 50)
194
- print(" [0] 前置检查")
195
- print("=" * 50)
196
-
197
- # 检查 requests
198
- print("\n[Requests 检测]")
199
- try:
200
- import requests
201
- print(" [OK] requests 可用")
202
- requests_available = True
203
- except ImportError:
204
- print(" [FAIL] requests 未安装")
205
- requests_available = False
206
-
207
- if not requests_available:
208
- print("\n [FATAL] requests 是必需依赖")
209
- print(" [建议] pip install requests")
210
- return False, None, False
211
-
212
- # 检查无头浏览器
213
- playwright_available, browser_type, can_proceed = check_browser_alternatives()
214
-
215
- print("\n" + "=" * 50)
216
- print(" 前置检查结果:")
217
- print(f" requests: {'OK' if requests_available else 'FAIL'}")
218
- print(f" 无头浏览器: {'OK' if playwright_available else 'FAIL'}")
219
- if browser_type:
220
- print(f" 浏览器类型: {browser_type}")
221
- print("=" * 50 + "\n")
222
-
223
- return playwright_available, browser_type, can_proceed
224
-
225
-
226
- if __name__ == "__main__":
227
- prerequisite_check()