rtexit-method 0.1.20 → 0.1.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rtexit-method",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "RTExit - AI-assisted Red Team methodology installer",
   "license": "MIT",
   "author": "Exit Code",

package/packaged-assets/docker/Dockerfile

@@ -1342,16 +1342,27 @@ RUN for bin in httprobe puredns subzy feroxbuster; do \
 # Phase 2 — Web Testing (Verified Fixes)
 # ─────────────────────────────────────────────
 
-# semgrep — via apt (pip conflicts with system packaging)
-RUN apt-get update && apt-get install -y --no-install-recommends python3-semgrep \
-    2>/dev/null && apt-get clean && rm -rf /var/lib/apt/lists/* 2>/dev/null || true
+# semgrep — pip3 ONLY (apt python3-semgrep does NOT create the 'semgrep' binary)
+RUN pip3 install --no-cache-dir --break-system-packages semgrep 2>/dev/null || true
 
 # checkov — IaC scanner (requires --ignore-installed due to packaging conflict)
 RUN pip3 install --no-cache-dir --break-system-packages --ignore-installed checkov \
     2>/dev/null || true
 
 # git-dumper — exposed .git directory dumper
-RUN pip3 install --no-cache-dir --break-system-packages git-dumper 2>/dev/null || true
+RUN pip3 install --no-cache-dir --break-system-packages \
+    git-dumper graphql-cop graphw00f inql 2>/dev/null || true
+
+# graphql-cop wrapper (pip installs module only, binary needs wrapper)
+RUN printf '#!/bin/bash\npython3 -m graphql_cop "$@"\n' \
+    > /usr/local/bin/graphql-cop && chmod +x /usr/local/bin/graphql-cop || true
+
+# graphw00f wrapper
+RUN printf '#!/bin/bash\npython3 -m graphw00f "$@"\n' \
+    > /usr/local/bin/graphw00f && chmod +x /usr/local/bin/graphw00f || true
+
+# wpscan via gem (NOT apt — apt version is outdated/broken)
+RUN gem install wpscan 2>/dev/null || true
 
 # gitleaks — binary (not pip)
 RUN curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz" \

package/packaged-assets/docker/verify/phase2-web.sh

@@ -22,9 +22,8 @@ chk_py "PyJWT"          jwt
 
 section "GraphQL"
 chk "graphql-cop"       graphql-cop
-chk_py "graphw00f"      graphw00f
-chk_py "InQL"           inql
-chk_dir "graphql-cop"   /opt/graphql-cop
+chk "graphw00f"         graphw00f
+chk "InQL"              inql
 
 section "XXE"
 chk_dir "XXEinjector"   /opt/XXEinjector
@@ -50,7 +49,7 @@ chk_py "jsbeautifier"   jsbeautifier
 
 section "Web Frameworks"
 chk "wpscan"            wpscan
-chk_dir "Caido"         /opt/caido
+# Caido — proprietary commercial tool, not open source, skipped
 
 section "gRPC / WebSockets"
 chk "grpcurl"           grpcurl
@@ -73,7 +72,7 @@ chk "grype"             grype
 
 section "Secret Scanning"
 chk "gitleaks"          gitleaks
-chk_py "trufflehog"     trufflehog
+chk "trufflehog"        trufflehog   # binary not Python module
 chk "git-dumper"        git-dumper
 
 phase_summary

package/packaged-assets/scripts/rt-native-install.sh

@@ -191,10 +191,14 @@ section "Phase 2 — Web Application Testing"
 
 apt_install sqlmap
 
-# semgrep — MUST use apt (pip conflicts with system python packaging)
-apt_install python3-semgrep
+# semgrep — pip3 ONLY (apt python3-semgrep does NOT create the semgrep binary)
+pip_install semgrep
 
-pip_install mitmproxy arjun jsbeautifier graphql-cop inql
+pip_install mitmproxy arjun jsbeautifier graphql-cop graphw00f inql
+
+# graphql-cop wrapper (pip installs module only, binary needs wrapper)
+printf '#!/bin/bash\npython3 -m graphql_cop "$@"\n' > /usr/local/bin/graphql-cop && chmod +x /usr/local/bin/graphql-cop
+printf '#!/bin/bash\npython3 -m graphw00f "$@"\n' > /usr/local/bin/graphw00f && chmod +x /usr/local/bin/graphw00f
 pip_install PyJWT python-jose grpcio grpcio-tools websocket-client
 pip_install blackboxprotobuf padding-oracle-attacker
 
@@ -221,6 +225,9 @@ pip_install -r /opt/tplmap/requirements.txt
 ln -sf /opt/tplmap/tplmap.py /usr/local/bin/tplmap
 chmod +x /opt/tplmap/tplmap.py
 
+# wpscan via gem (NOT apt — apt version is outdated/broken on new Kali)
+gem_install wpscan
+
 # XXEinjector
 clone https://github.com/enjoiz/XXEinjector /opt/XXEinjector