openpen 0.2.0

package/dist/checks/sensitive-data.js

@@ -0,0 +1,122 @@
+/**
+ * Sensitive Data Exposure Check (A02:2021 - Cryptographic Failures)
+ */
+import { BaseCheck } from './base.js';
+import { sendRequest } from '../utils/http.js';
+const SENSITIVE_PATTERNS = [
+    { name: 'email', pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, severity: 'low' },
+    { name: 'jwt', pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, severity: 'high' },
+    { name: 'api_key', pattern: /(?:api[_-]?key|apikey|api_secret)['":\s]*['"]?([a-zA-Z0-9]{20,})/gi, severity: 'high' },
+    { name: 'aws_key', pattern: /AKIA[0-9A-Z]{16}/g, severity: 'high' },
+    { name: 'private_key', pattern: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g, severity: 'high' },
+    { name: 'password_field', pattern: /"password"\s*:\s*"[^"]+"/gi, severity: 'high' },
+    { name: 'ssn', pattern: /\b\d{3}-\d{2}-\d{4}\b/g, severity: 'high' },
+    { name: 'credit_card', pattern: /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b/g, severity: 'high' },
+    { name: 'internal_ip', pattern: /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g, severity: 'medium' },
+    { name: 'stack_trace', pattern: /(?:at\s+[\w.$]+\s*\(.*:\d+:\d+\)|Traceback \(most recent|Exception in thread)/g, severity: 'medium' },
+    { name: 'debug_info', pattern: /(?:DEBUG|TRACE|stack_trace|backtrace).*[:=]/gi, severity: 'low' },
+];
+const COMMON_LEAK_PATHS = [
+    '/.env',
+    '/config.json',
+    '/config.yaml',
+    '/.git/config',
+    '/debug',
+    '/actuator/env',
+    '/api/debug',
+    '/graphql',
+    '/__debug__',
+    '/server-status',
+    '/phpinfo.php',
+    '/swagger.json',
+    '/api-docs',
+    '/.well-known/security.txt',
+];
+export class SensitiveDataCheck extends BaseCheck {
+    id = 'sensitive-data';
+    name = 'Sensitive Data Exposure';
+    description = 'Check for leaked secrets, PII, and debug information in responses';
+    owaspCategory = 'A02:2021 Crypto Failures';
+    async run(target, config) {
+        const findings = [];
+        let requestCount = 0;
+        // Check endpoint responses for sensitive data
+        for (const ep of target.endpoints) {
+            const url = target.baseUrl + ep.path;
+            try {
+                const res = await sendRequest({
+                    url,
+                    method: ep.method,
+                    headers: target.globalHeaders,
+                    timeout: config.timeout,
+                });
+                requestCount++;
+                for (const sp of SENSITIVE_PATTERNS) {
+                    const matches = res.response.bodySnippet.match(sp.pattern);
+                    if (matches && matches.length > 0) {
+                        // Don't flag emails in obvious contexts (like user profile endpoints)
+                        if (sp.name === 'email' && matches.length < 3)
+                            continue;
+                        findings.push({
+                            id: `sensitive-${sp.name}-${ep.method}-${ep.path}`,
+                            checkId: this.id,
+                            checkName: this.name,
+                            severity: sp.severity,
+                            endpoint: url,
+                            method: ep.method,
+                            evidence: `Found ${matches.length} ${sp.name} pattern(s): ${matches[0].slice(0, 50)}...`,
+                            description: `Response from ${ep.method} ${ep.path} contains ${sp.name} data that may be sensitive.`,
+                            remediation: 'Review response content. Mask or remove sensitive data. Use proper access controls.',
+                            owaspCategory: this.owaspCategory,
+                            request: res.request,
+                            response: res.response,
+                        });
+                    }
+                }
+            }
+            catch {
+                // skip
+            }
+        }
+        // Probe common leak paths
+        const leakPaths = config.depth === 'shallow'
+            ? COMMON_LEAK_PATHS.slice(0, 5)
+            : COMMON_LEAK_PATHS;
+        for (const path of leakPaths) {
+            const url = target.baseUrl + path;
+            try {
+                const res = await sendRequest({
+                    url,
+                    method: 'GET',
+                    headers: target.globalHeaders,
+                    timeout: config.timeout,
+                });
+                requestCount++;
+                if (res.response.statusCode === 200 && res.response.bodySnippet.length > 10) {
+                    let severity = 'medium';
+                    if (path.includes('.env') || path.includes('.git') || path.includes('config')) {
+                        severity = 'high';
+                    }
+                    findings.push({
+                        id: `sensitive-leak-path-${path}`,
+                        checkId: this.id,
+                        checkName: this.name,
+                        severity,
+                        endpoint: url,
+                        method: 'GET',
+                        evidence: `Path ${path} returned 200 with ${res.response.bodySnippet.length} bytes`,
+                        description: `Sensitive path ${path} is accessible and returns content. This may expose configuration, debug info, or secrets.`,
+                        remediation: `Block access to ${path}. Ensure sensitive files are not served by the web server.`,
+                        owaspCategory: this.owaspCategory,
+                        request: res.request,
+                        response: res.response,
+                    });
+                }
+            }
+            catch {
+                // skip
+            }
+        }
+        return { findings, requestCount };
+    }
+}

package/dist/checks/sqli.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SQL Injection Check (A03:2021 - Injection)
+ */
+import { BaseCheck, type CheckResult } from './base.js';
+import type { ScanTarget, ScanConfig } from '../types.js';
+export declare class SqlInjectionCheck extends BaseCheck {
+    id: string;
+    name: string;
+    description: string;
+    owaspCategory: string;
+    run(target: ScanTarget, config: ScanConfig): Promise<CheckResult>;
+}

package/dist/checks/sqli.js

@@ -0,0 +1,178 @@
+/**
+ * SQL Injection Check (A03:2021 - Injection)
+ */
+import { BaseCheck } from './base.js';
+import { sendRequest, Semaphore, RateLimiter } from '../utils/http.js';
+import { SQLI_PAYLOADS } from '../fuzzer/payloads.js';
+const SQL_ERROR_PATTERNS = [
+    /you have an error in your sql syntax/i,
+    /warning:.*mysql/i,
+    /unclosed quotation mark/i,
+    /quoted string not properly terminated/i,
+    /pg_query\(\)/i,
+    /postgresql/i,
+    /sqlite3?\.OperationalError/i,
+    /SQLite\/JDBCDriver/i,
+    /ORA-\d{5}/i,
+    /Microsoft OLE DB Provider for SQL Server/i,
+    /ODBC SQL Server Driver/i,
+    /SQL Server.*Driver/i,
+    /Warning.*mssql_/i,
+    /com\.mysql\.jdbc/i,
+    /org\.postgresql\.util\.PSQLException/i,
+    /Syntax error.*in query expression/i,
+];
+export class SqlInjectionCheck extends BaseCheck {
+    id = 'sqli';
+    name = 'SQL Injection';
+    description = 'Test for SQL injection vulnerabilities in parameters and request bodies';
+    owaspCategory = 'A03:2021 Injection';
+    async run(target, config) {
+        const findings = [];
+        let requestCount = 0;
+        const sem = new Semaphore(config.concurrency);
+        const rl = new RateLimiter(config.rateLimit);
+        const payloads = config.depth === 'shallow'
+            ? SQLI_PAYLOADS.slice(0, 5)
+            : config.depth === 'deep'
+                ? SQLI_PAYLOADS
+                : SQLI_PAYLOADS.slice(0, 12);
+        const tasks = [];
+        for (const ep of target.endpoints) {
+            const url = target.baseUrl + ep.path;
+            // Test query parameters
+            for (const param of ep.parameters.filter(p => p.in === 'query')) {
+                for (const payload of payloads) {
+                    tasks.push(testPayload(url, ep.method, param.name, payload));
+                }
+            }
+            // Test body fields
+            if (ep.requestBody?.fields) {
+                for (const [fieldName] of Object.entries(ep.requestBody.fields)) {
+                    for (const payload of payloads) {
+                        tasks.push(testBodyField(url, ep.method, fieldName, payload, ep.requestBody.fields));
+                    }
+                }
+            }
+            // Always test with a query param even if none defined
+            if (ep.parameters.filter(p => p.in === 'query').length === 0) {
+                for (const payload of payloads.slice(0, 3)) {
+                    tasks.push(testPayload(url, ep.method, 'id', payload));
+                }
+            }
+        }
+        async function testPayload(baseUrl, method, param, payload) {
+            await sem.acquire();
+            try {
+                await rl.wait();
+                const testUrl = `${baseUrl}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
+                const res = await sendRequest({
+                    url: testUrl,
+                    method: 'GET',
+                    headers: target.globalHeaders,
+                    timeout: config.timeout,
+                });
+                requestCount++;
+                const match = checkForSqlError(res.response.bodySnippet);
+                if (match) {
+                    findings.push({
+                        id: `sqli-${param}-${findings.length}`,
+                        checkId: 'sqli',
+                        checkName: 'SQL Injection',
+                        severity: 'critical',
+                        endpoint: baseUrl,
+                        method: method,
+                        parameter: param,
+                        payload,
+                        evidence: `SQL error detected: "${match}"`,
+                        description: `Parameter "${param}" may be vulnerable to SQL injection. The server returned a database error in response to a SQL payload.`,
+                        remediation: 'Use parameterized queries or prepared statements. Never concatenate user input into SQL.',
+                        owaspCategory: 'A03:2021 Injection',
+                        request: res.request,
+                        response: res.response,
+                    });
+                }
+                // Time-based detection
+                if (payload.includes('SLEEP') || payload.includes('WAITFOR')) {
+                    if (res.response.responseTime > 4500) {
+                        findings.push({
+                            id: `sqli-time-${param}-${findings.length}`,
+                            checkId: 'sqli',
+                            checkName: 'SQL Injection (Time-based)',
+                            severity: 'critical',
+                            endpoint: baseUrl,
+                            method: method,
+                            parameter: param,
+                            payload,
+                            evidence: `Response took ${res.response.responseTime}ms (expected delay from payload)`,
+                            description: `Parameter "${param}" appears vulnerable to time-based blind SQL injection.`,
+                            remediation: 'Use parameterized queries or prepared statements.',
+                            owaspCategory: 'A03:2021 Injection',
+                            request: res.request,
+                            response: res.response,
+                        });
+                    }
+                }
+            }
+            catch {
+                // Request failed, skip
+            }
+            finally {
+                sem.release();
+            }
+        }
+        async function testBodyField(baseUrl, method, field, payload, fields) {
+            await sem.acquire();
+            try {
+                await rl.wait();
+                const body = {};
+                for (const [k, v] of Object.entries(fields)) {
+                    body[k] = k === field ? payload : (v.example || 'test');
+                }
+                const res = await sendRequest({
+                    url: baseUrl,
+                    method,
+                    headers: { ...target.globalHeaders, 'Content-Type': 'application/json' },
+                    body: JSON.stringify(body),
+                    timeout: config.timeout,
+                });
+                requestCount++;
+                const match = checkForSqlError(res.response.bodySnippet);
+                if (match) {
+                    findings.push({
+                        id: `sqli-body-${field}-${findings.length}`,
+                        checkId: 'sqli',
+                        checkName: 'SQL Injection',
+                        severity: 'critical',
+                        endpoint: baseUrl,
+                        method: method,
+                        parameter: field,
+                        payload,
+                        evidence: `SQL error in response body: "${match}"`,
+                        description: `Body field "${field}" may be vulnerable to SQL injection.`,
+                        remediation: 'Use parameterized queries or prepared statements.',
+                        owaspCategory: 'A03:2021 Injection',
+                        request: res.request,
+                        response: res.response,
+                    });
+                }
+            }
+            catch {
+                // skip
+            }
+            finally {
+                sem.release();
+            }
+        }
+        await Promise.all(tasks);
+        return { findings, requestCount };
+    }
+}
+function checkForSqlError(body) {
+    for (const pattern of SQL_ERROR_PATTERNS) {
+        const match = body.match(pattern);
+        if (match)
+            return match[0];
+    }
+    return null;
+}

package/dist/checks/ssrf.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Server-Side Request Forgery Check (A10:2021)
+ */
+import { BaseCheck, type CheckResult } from './base.js';
+import type { ScanTarget, ScanConfig } from '../types.js';
+export declare class SsrfCheck extends BaseCheck {
+    id: string;
+    name: string;
+    description: string;
+    owaspCategory: string;
+    run(target: ScanTarget, config: ScanConfig): Promise<CheckResult>;
+}

package/dist/checks/ssrf.js

@@ -0,0 +1,126 @@
+/**
+ * Server-Side Request Forgery Check (A10:2021)
+ */
+import { BaseCheck } from './base.js';
+import { sendRequest, Semaphore, RateLimiter } from '../utils/http.js';
+import { SSRF_PAYLOADS } from '../fuzzer/payloads.js';
+const SSRF_INDICATORS = [
+    /root:.*:0:0/i, // /etc/passwd content
+    /ami-id/i, // AWS metadata
+    /instance-id/i, // Cloud metadata
+    /compute\.internal/i, // GCP metadata
+    /\b10\.\d+\.\d+\.\d+/, // Internal IP leaked
+    /\b172\.(1[6-9]|2\d|3[01])\.\d+\.\d+/, // Internal IP
+    /\b192\.168\.\d+\.\d+/, // Internal IP
+];
+export class SsrfCheck extends BaseCheck {
+    id = 'ssrf';
+    name = 'Server-Side Request Forgery';
+    description = 'Test for SSRF vulnerabilities in URL parameters';
+    owaspCategory = 'A10:2021 SSRF';
+    async run(target, config) {
+        const findings = [];
+        let requestCount = 0;
+        const sem = new Semaphore(config.concurrency);
+        const rl = new RateLimiter(config.rateLimit);
+        const payloads = config.depth === 'shallow'
+            ? SSRF_PAYLOADS.slice(0, 4)
+            : config.depth === 'deep'
+                ? SSRF_PAYLOADS
+                : SSRF_PAYLOADS.slice(0, 8);
+        // Find parameters that look like URLs
+        const urlParamNames = ['url', 'uri', 'href', 'link', 'redirect', 'callback', 'next', 'return', 'dest', 'target', 'path', 'file', 'page', 'fetch', 'load'];
+        const tasks = [];
+        for (const ep of target.endpoints) {
+            const url = target.baseUrl + ep.path;
+            const queryParams = ep.parameters.filter(p => p.in === 'query');
+            // Test named URL-like params, or common param names if none defined
+            const testParams = queryParams.length > 0
+                ? queryParams.filter(p => urlParamNames.some(n => p.name.toLowerCase().includes(n)))
+                : urlParamNames.slice(0, 3).map(n => ({ name: n }));
+            for (const param of testParams) {
+                for (const payload of payloads) {
+                    tasks.push((async () => {
+                        await sem.acquire();
+                        try {
+                            await rl.wait();
+                            const testUrl = `${url}?${encodeURIComponent(param.name)}=${encodeURIComponent(payload)}`;
+                            const res = await sendRequest({
+                                url: testUrl,
+                                method: ep.method,
+                                headers: target.globalHeaders,
+                                timeout: config.timeout,
+                            });
+                            requestCount++;
+                            // Check for SSRF indicators in response
+                            for (const indicator of SSRF_INDICATORS) {
+                                if (indicator.test(res.response.bodySnippet)) {
+                                    findings.push({
+                                        id: `ssrf-${param.name}-${findings.length}`,
+                                        checkId: this.id,
+                                        checkName: this.name,
+                                        severity: 'critical',
+                                        endpoint: url,
+                                        method: ep.method,
+                                        parameter: param.name,
+                                        payload,
+                                        evidence: `SSRF indicator in response: ${res.response.bodySnippet.slice(0, 200)}`,
+                                        description: `Parameter "${param.name}" may be vulnerable to SSRF. The server appears to fetch attacker-controlled URLs.`,
+                                        remediation: 'Validate and sanitize all URL inputs. Use allowlists for permitted domains. Block requests to internal/metadata IPs.',
+                                        owaspCategory: this.owaspCategory,
+                                        request: res.request,
+                                        response: res.response,
+                                    });
+                                    break;
+                                }
+                            }
+                            // Check for different behavior with internal URLs
+                            if (res.response.statusCode === 200 && payload.includes('127.0.0.1')) {
+                                // Compare with a non-internal URL
+                                const extUrl = `${url}?${encodeURIComponent(param.name)}=${encodeURIComponent('http://example.com')}`;
+                                try {
+                                    const extRes = await sendRequest({
+                                        url: extUrl,
+                                        method: ep.method,
+                                        headers: target.globalHeaders,
+                                        timeout: config.timeout,
+                                    });
+                                    requestCount++;
+                                    if (res.response.bodySnippet !== extRes.response.bodySnippet) {
+                                        findings.push({
+                                            id: `ssrf-diff-${param.name}-${findings.length}`,
+                                            checkId: this.id,
+                                            checkName: this.name,
+                                            severity: 'high',
+                                            endpoint: url,
+                                            method: ep.method,
+                                            parameter: param.name,
+                                            payload,
+                                            evidence: `Different responses for internal (${payload}) vs external URL`,
+                                            description: `Parameter "${param.name}" produces different responses for internal vs external URLs, suggesting server-side URL fetching.`,
+                                            remediation: 'Block requests to internal IPs and cloud metadata endpoints. Use URL allowlists.',
+                                            owaspCategory: this.owaspCategory,
+                                            request: res.request,
+                                            response: res.response,
+                                        });
+                                    }
+                                }
+                                catch {
+                                    // skip comparison
+                                }
+                            }
+                        }
+                        catch {
+                            // skip
+                        }
+                        finally {
+                            sem.release();
+                        }
+                    })());
+                }
+            }
+        }
+        await Promise.all(tasks);
+        return { findings, requestCount };
+    }
+}

package/dist/checks/xss.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Cross-Site Scripting Check (A03:2021 - Injection)
+ */
+import { BaseCheck, type CheckResult } from './base.js';
+import type { ScanTarget, ScanConfig } from '../types.js';
+export declare class XssCheck extends BaseCheck {
+    id: string;
+    name: string;
+    description: string;
+    owaspCategory: string;
+    run(target: ScanTarget, config: ScanConfig): Promise<CheckResult>;
+}

package/dist/checks/xss.js

@@ -0,0 +1,79 @@
+/**
+ * Cross-Site Scripting Check (A03:2021 - Injection)
+ */
+import { BaseCheck } from './base.js';
+import { sendRequest, Semaphore, RateLimiter } from '../utils/http.js';
+import { XSS_PAYLOADS } from '../fuzzer/payloads.js';
+export class XssCheck extends BaseCheck {
+    id = 'xss';
+    name = 'Cross-Site Scripting';
+    description = 'Test for reflected XSS vulnerabilities';
+    owaspCategory = 'A03:2021 Injection';
+    async run(target, config) {
+        const findings = [];
+        let requestCount = 0;
+        const sem = new Semaphore(config.concurrency);
+        const rl = new RateLimiter(config.rateLimit);
+        const payloads = config.depth === 'shallow'
+            ? XSS_PAYLOADS.slice(0, 4)
+            : config.depth === 'deep'
+                ? XSS_PAYLOADS
+                : XSS_PAYLOADS.slice(0, 8);
+        const tasks = [];
+        for (const ep of target.endpoints) {
+            if (ep.method !== 'GET')
+                continue; // reflected XSS mainly via GET
+            const url = target.baseUrl + ep.path;
+            const params = ep.parameters.filter(p => p.in === 'query');
+            // Also test a generic param if none defined
+            const testParams = params.length > 0 ? params.map(p => p.name) : ['q', 'search', 'input'];
+            for (const paramName of testParams) {
+                for (const payload of payloads) {
+                    tasks.push((async () => {
+                        await sem.acquire();
+                        try {
+                            await rl.wait();
+                            const testUrl = `${url}?${encodeURIComponent(paramName)}=${encodeURIComponent(payload)}`;
+                            const res = await sendRequest({
+                                url: testUrl,
+                                method: 'GET',
+                                headers: target.globalHeaders,
+                                timeout: config.timeout,
+                            });
+                            requestCount++;
+                            // Check if payload is reflected unescaped
+                            if (res.response.bodySnippet.includes(payload)) {
+                                const contentType = res.response.headers['content-type'] || '';
+                                const isHtml = contentType.includes('html');
+                                findings.push({
+                                    id: `xss-${paramName}-${findings.length}`,
+                                    checkId: this.id,
+                                    checkName: this.name,
+                                    severity: isHtml ? 'high' : 'medium',
+                                    endpoint: url,
+                                    method: 'GET',
+                                    parameter: paramName,
+                                    payload,
+                                    evidence: `Payload reflected in response${isHtml ? ' (HTML context)' : ''}`,
+                                    description: `Parameter "${paramName}" reflects input without escaping. ${isHtml ? 'Response is HTML, making XSS likely exploitable.' : 'Response is not HTML but input is reflected.'}`,
+                                    remediation: 'Escape all user input before rendering. Use Content-Type headers correctly. Implement CSP.',
+                                    owaspCategory: this.owaspCategory,
+                                    request: res.request,
+                                    response: res.response,
+                                });
+                            }
+                        }
+                        catch {
+                            // skip
+                        }
+                        finally {
+                            sem.release();
+                        }
+                    })());
+                }
+            }
+        }
+        await Promise.all(tasks);
+        return { findings, requestCount };
+    }
+}

package/dist/cli.d.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+/**
+ * openpen - Open source API fuzzing and penetration testing CLI
+ */
+export {};