redgun-security 1.4.0 → 1.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +57 -57
  2. package/package.json +1 -1
  3. package/src/core/reporter/console.js +1 -0
  4. package/src/utils/fetch.js +17 -0
package/README.md CHANGED
@@ -52,68 +52,68 @@ redgun modules # List all modules
52
52
 
53
53
  ## Remote Scan Modules (33 — Black-box)
54
54
 
55
- | Module | What it tests | Source |
56
- |---|---|---|
57
- | **Probe & Fingerprint** | Status code, title, technologies (40+), CDN/WAF detection, favicon hash, response time, virtual host discovery | httpx |
58
- | **Crawl & Extract** | JS file parsing, endpoint extraction, form discovery, parameter mining, email harvesting, secret detection in bundles | Katana |
59
- | **HTTP Headers** | Missing CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP | OWASP |
60
- | **Exposed Files** | `.env`, `.git/config`, `package.json`, `.DS_Store`, source maps, actuator, swagger, phpinfo, Docker files, backups | HackTricks |
61
- | **Secrets Detection** | API keys (AWS, Stripe, Firebase, Supabase, OpenAI, Anthropic), tokens, passwords in page source | HackTricks |
62
- | **XSS Reflected** | 6 payloads × 14 parameters, DOM-based indicators | HackTricks |
63
- | **SQL Injection** | Error-based, UNION-based, time-based blind across common parameters | HackTricks |
64
- | **CORS Misconfiguration** | Wildcard + credentials, reflected origin, null origin | HackTricks |
65
- | **Open Redirect** | 12 redirect parameters tested with external URL | HackTricks |
66
- | **SSRF** | AWS metadata, internal IPs, localhost, IPv6, decimal IP, file:// protocol | HackTricks |
67
- | **Host Header Injection** | Reflected host, X-Forwarded-Host poisoning | HackTricks |
68
- | **HTTP Request Smuggling** | CL.TE probe detection | HackTricks |
69
- | **CRLF Injection** | Header injection via URL encoding variants | HackTricks |
70
- | **GraphQL Introspection** | Schema exposure via introspection query at 5 endpoints | HackTricks |
71
- | **Clickjacking** | Missing X-Frame-Options and frame-ancestors CSP | OWASP |
72
- | **Cookie Security** | Missing HttpOnly, Secure, SameSite flags | OWASP |
73
- | **HTTP Methods** | TRACE, PUT, DELETE enabled | HackTricks |
74
- | **Subdomain Enumeration** | 40+ common subdomains, dangerous subdomain detection | HackTricks |
75
- | **DNS & Email** | SPF, DKIM, DMARC analysis | HackTricks |
76
- | **Technology Fingerprint** | 40+ frameworks, servers, and services detected | — |
77
- | **API Discovery** | Common API paths, auth testing | HackTricks |
78
- | **SSL/TLS Analysis** | HTTP vs HTTPS detection | OWASP |
79
- | **Path Traversal / LFI** | Double-encoding, unicode bypass, null byte | HackTricks |
80
- | **NoSQL Injection** | MongoDB operator injection auth bypass | HackTricks |
81
- | **WebSocket Security** | Origin validation, authentication checks | HackTricks |
82
- | **Cache Poisoning** | Unkeyed headers (X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL) | HackTricks |
83
- | **Race Conditions** | Detection guidance for concurrent request attacks | HackTricks |
84
- | **XXE Injection** | XML entity injection at upload/import/SOAP endpoints | PortSwigger |
85
- | **OAuth Misconfiguration** | redirect_uri validation, OIDC config exposure, implicit flow detection | PortSwigger |
86
- | **Access Control Bypass** | Admin panel exposure, 403 bypass via X-Original-URL/X-Forwarded-For, robots.txt disclosure | PortSwigger |
87
- | **Web Cache Deception** | Static extension cache deception, path normalization inconsistency | PortSwigger |
88
- | **Parameter Pollution** | HTTP Parameter Pollution, null byte truncation, duplicate params | PortSwigger |
89
- | **File Upload Testing** | Upload endpoint discovery, OPTIONS probing | PortSwigger |
90
- | **DOM-Based Vulnerabilities** | DOM sinks (document.write, innerHTML, eval, postMessage), source-to-sink flow | PortSwigger |
91
- | **HTTP/2 Attacks** | H2.CL/H2.TE smuggling indicators, HPACK injection surface | PortSwigger |
55
+ | Module | What it tests |
56
+ |---|---|
57
+ | **Probe & Fingerprint** | Status code, title, technologies (40+), CDN/WAF detection, favicon hash, response time, virtual host discovery |
58
+ | **Crawl & Extract** | JS file parsing, endpoint extraction, form discovery, parameter mining, email harvesting, secret detection in bundles |
59
+ | **HTTP Headers** | Missing CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP |
60
+ | **Exposed Files** | `.env`, `.git/config`, `package.json`, `.DS_Store`, source maps, actuator, swagger, phpinfo, Docker files, backups |
61
+ | **Secrets Detection** | API keys (AWS, Stripe, Firebase, Supabase, OpenAI, Anthropic), tokens, passwords in page source |
62
+ | **XSS Reflected** | 6 payloads × 14 parameters, DOM-based indicators |
63
+ | **SQL Injection** | Error-based, UNION-based, time-based blind across common parameters |
64
+ | **CORS Misconfiguration** | Wildcard + credentials, reflected origin, null origin |
65
+ | **Open Redirect** | 12 redirect parameters tested with external URL |
66
+ | **SSRF** | AWS metadata, internal IPs, localhost, IPv6, decimal IP, file:// protocol |
67
+ | **Host Header Injection** | Reflected host, X-Forwarded-Host poisoning |
68
+ | **HTTP Request Smuggling** | CL.TE probe detection |
69
+ | **CRLF Injection** | Header injection via URL encoding variants |
70
+ | **GraphQL Introspection** | Schema exposure via introspection query at 5 endpoints |
71
+ | **Clickjacking** | Missing X-Frame-Options and frame-ancestors CSP |
72
+ | **Cookie Security** | Missing HttpOnly, Secure, SameSite flags |
73
+ | **HTTP Methods** | TRACE, PUT, DELETE enabled |
74
+ | **Subdomain Enumeration** | 40+ common subdomains, dangerous subdomain detection |
75
+ | **DNS & Email** | SPF, DKIM, DMARC analysis |
76
+ | **Technology Fingerprint** | 40+ frameworks, servers, and services detected |
77
+ | **API Discovery** | Common API paths, auth testing |
78
+ | **SSL/TLS Analysis** | HTTP vs HTTPS detection |
79
+ | **Path Traversal / LFI** | Double-encoding, unicode bypass, null byte |
80
+ | **NoSQL Injection** | MongoDB operator injection auth bypass |
81
+ | **WebSocket Security** | Origin validation, authentication checks |
82
+ | **Cache Poisoning** | Unkeyed headers (X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL) |
83
+ | **Race Conditions** | Detection guidance for concurrent request attacks |
84
+ | **XXE Injection** | XML entity injection at upload/import/SOAP endpoints |
85
+ | **OAuth Misconfiguration** | redirect_uri validation, OIDC config exposure, implicit flow detection |
86
+ | **Access Control Bypass** | Admin panel exposure, 403 bypass via X-Original-URL/X-Forwarded-For, robots.txt disclosure |
87
+ | **Web Cache Deception** | Static extension cache deception, path normalization inconsistency |
88
+ | **Parameter Pollution** | HTTP Parameter Pollution, null byte truncation, duplicate params |
89
+ | **File Upload Testing** | Upload endpoint discovery, OPTIONS probing |
90
+ | **DOM-Based Vulnerabilities** | DOM sinks (document.write, innerHTML, eval, postMessage), source-to-sink flow |
91
+ | **HTTP/2 Attacks** | H2.CL/H2.TE smuggling indicators, HPACK injection surface |
92
92
 
93
93
  <br>
94
94
 
95
95
  ## Local Audit Modules (18 — White-box)
96
96
 
97
- | Module | What it checks | Source |
98
- |---|---|---|
99
- | **Code Secrets** | 25+ secret patterns (AWS, GitHub, Stripe, OpenAI, Anthropic, Discord, Telegram, npm, etc.) with line numbers | HackTricks |
100
- | **Environment Files** | `.env` in `.gitignore`, real secrets in `.env.example`, sensitive config exposure | OWASP |
101
- | **Dependencies** | `npm audit` for CVEs, supply-chain attack package detection | OWASP |
102
- | **Code Vulnerabilities** | SQL injection (template literals), XSS (`v-html`, `dangerouslySetInnerHTML`, `innerHTML`), eval(), ReDoS | HackTricks |
103
- | **Auth & Middleware** | Rate limiting, CORS wildcards, CSRF protection, session config, JWT expiration, hardcoded passwords | HackTricks |
104
- | **Headers Config** | CSP/HSTS in Nuxt, Next.js, Vercel, Netlify, Express configs | OWASP |
105
- | **SSRF Detection** | User-controlled URLs in fetch/axios/request/http.get/urllib | HackTricks |
106
- | **SSTI Detection** | Jinja2, Twig, Nunjucks, Pug, EJS, Handlebars, Velocity, Freemarker, Thymeleaf | HackTricks |
107
- | **Insecure Deserialization** | pickle, yaml.load, unserialize, ObjectInputStream, Marshal, BinaryFormatter | HackTricks |
108
- | **Prototype Pollution** | Object.assign, spread operator, deepmerge, lodash.merge, __proto__ access | HackTricks |
109
- | **JWT Vulnerabilities** | Algorithm "none", verify disabled, weak secrets, expiration bypass, decode without verify | HackTricks |
110
- | **Path Traversal / LFI** | User input in file paths, readFile, sendFile, include/require | HackTricks |
111
- | **Command Injection** | exec, spawn, child_process, system, subprocess with user input, shell interpolation | HackTricks |
112
- | **Weak Cryptography** | MD5, SHA1, DES, RC4, ECB mode, Math.random, hardcoded keys/IVs | HackTricks |
113
- | **XXE Detection** | XML parsers without entity disabled, DOMParser, lxml, simplexml with user input | PortSwigger |
114
- | **Access Control / IDOR** | Direct object reference, role from user input, admin headers, ownership checks | PortSwigger |
115
- | **OAuth / OIDC Flaws** | redirect_uri manipulation, missing state, client_secret exposure, token storage | PortSwigger |
116
- | **Business Logic** | Price manipulation, negative quantity, workflow step skipping, race conditions, referral abuse | PortSwigger |
97
+ | Module | What it checks |
98
+ |---|---|
99
+ | **Code Secrets** | 25+ secret patterns (AWS, GitHub, Stripe, OpenAI, Anthropic, Discord, Telegram, npm, etc.) with line numbers |
100
+ | **Environment Files** | `.env` in `.gitignore`, real secrets in `.env.example`, sensitive config exposure |
101
+ | **Dependencies** | `npm audit` for CVEs, supply-chain attack package detection |
102
+ | **Code Vulnerabilities** | SQL injection (template literals), XSS (`v-html`, `dangerouslySetInnerHTML`, `innerHTML`), eval(), ReDoS |
103
+ | **Auth & Middleware** | Rate limiting, CORS wildcards, CSRF protection, session config, JWT expiration, hardcoded passwords |
104
+ | **Headers Config** | CSP/HSTS in Nuxt, Next.js, Vercel, Netlify, Express configs |
105
+ | **SSRF Detection** | User-controlled URLs in fetch/axios/request/http.get/urllib |
106
+ | **SSTI Detection** | Jinja2, Twig, Nunjucks, Pug, EJS, Handlebars, Velocity, Freemarker, Thymeleaf |
107
+ | **Insecure Deserialization** | pickle, yaml.load, unserialize, ObjectInputStream, Marshal, BinaryFormatter |
108
+ | **Prototype Pollution** | Object.assign, spread operator, deepmerge, lodash.merge, __proto__ access |
109
+ | **JWT Vulnerabilities** | Algorithm "none", verify disabled, weak secrets, expiration bypass, decode without verify |
110
+ | **Path Traversal / LFI** | User input in file paths, readFile, sendFile, include/require |
111
+ | **Command Injection** | exec, spawn, child_process, system, subprocess with user input, shell interpolation |
112
+ | **Weak Cryptography** | MD5, SHA1, DES, RC4, ECB mode, Math.random, hardcoded keys/IVs |
113
+ | **XXE Detection** | XML parsers without entity disabled, DOMParser, lxml, simplexml with user input |
114
+ | **Access Control / IDOR** | Direct object reference, role from user input, admin headers, ownership checks |
115
+ | **OAuth / OIDC Flaws** | redirect_uri manipulation, missing state, client_secret exposure, token storage |
116
+ | **Business Logic** | Price manipulation, negative quantity, workflow step skipping, race conditions, referral abuse |
117
117
 
118
118
  <br>
119
119
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "redgun-security",
3
- "version": "1.4.0",
3
+ "version": "1.4.2",
4
4
  "description": "Black-box & white-box security auditor for web applications with HackTricks techniques",
5
5
  "type": "module",
6
6
  "main": "scan.js",
package/src/core/reporter/console.js CHANGED
@@ -20,6 +20,7 @@ export function printBanner() {
20
20
  ╚═╝ ╚═╝╚══════╝╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝
21
21
  `));
22
22
  console.log(chalk.gray(' Black-box & white-box security auditor | Enhanced\n'));
23
+ console.log(chalk.gray(' Developed by @aloc999 (Hashemi)\n'));
23
24
  }
24
25
 
25
26
  export function printResults() {
package/src/utils/fetch.js CHANGED
@@ -1,7 +1,24 @@
1
1
  import https from 'https';
2
2
  import http from 'http';
3
3
 
4
+ const RATE_LIMIT = 5;
5
+ let lastRequestTime = 0;
6
+
7
+ async function waitForSlot() {
8
+ const now = Date.now();
9
+ const minInterval = 1000 / RATE_LIMIT;
10
+ const timeSinceLast = now - lastRequestTime;
11
+
12
+ if (timeSinceLast < minInterval) {
13
+ await new Promise((r) => setTimeout(r, minInterval - timeSinceLast));
14
+ }
15
+
16
+ lastRequestTime = Date.now();
17
+ }
18
+
4
19
  export async function fetchWithTimeout(url, options = {}, timeout = 10000) {
20
+ await waitForSlot();
21
+
5
22
  const controller = new AbortController();
6
23
  const timer = setTimeout(() => controller.abort(), timeout);
7
24