trace-sec 0.0.0-stage → 2.1.0

package/src/trace_engine/testpacks/authentication.py

@@ -0,0 +1,60 @@
+"""Authentication bypass and missing authentication test pack."""
+
+import re
+from trace_engine.testpacks.base import TestPack, TestContext, TestExecutionResult
+from trace_engine.security.hypotheses import SecurityHypothesis
+from trace_engine.runtime.client import ScopedHttpClient
+
+
+class AuthenticationTestPack(TestPack):
+    @property
+    def name(self) -> str:
+        return "authentication"
+
+    @property
+    def description(self) -> str:
+        return "Tests whether sensitive endpoints enforce authentication headers."
+
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        base_url = context.target_base_url.rstrip("/")
+        parts = hypothesis.endpoint_display.split(" ")
+        method = parts[0] if len(parts) > 1 else "GET"
+        raw_path = parts[1] if len(parts) > 1 else parts[0]
+
+        # Replace any path param with dummy id
+        probe_path = re.sub(r"\{[a-zA-Z0-9_]+\}", "1", raw_path)
+        target_url = f"{base_url}{probe_path}"
+
+        # Send completely unauthenticated request
+        obs = client.execute(method=method, url=target_url, headers={})
+        observations = [obs]
+
+        confirmed = False
+        summary = "Authentication properly enforced (received 401/403)."
+        steps = []
+
+        if obs.response_status in (200, 201, 204):
+            confirmed = True
+            summary = (
+                f"Missing Authentication confirmed: Sensitive endpoint {raw_path} responded "
+                f"with {obs.response_status} to an unauthenticated request."
+            )
+            steps = [
+                f"Send unauthenticated {method} request to {target_url}",
+                f"Received HTTP {obs.response_status} rather than expected 401/403",
+            ]
+
+        return TestExecutionResult(
+            testpack_name=self.name,
+            hypothesis_id=hypothesis.id,
+            confirmed=confirmed,
+            confidence=0.90 if confirmed else 0.15,
+            summary=summary,
+            observations=observations,
+            reproduction_steps=steps,
+        )

package/src/trace_engine/testpacks/base.py

@@ -0,0 +1,63 @@
+"""Base interfaces and context for TRACE test packs."""
+
+from abc import ABC, abstractmethod
+from typing import Dict, Any, Optional, List
+from pydantic import BaseModel, Field
+from trace_engine.runtime.client import ScopedHttpClient
+from trace_engine.runtime.observations import RuntimeObservation
+from trace_engine.security.hypotheses import SecurityHypothesis
+
+
+class UserIdentity(BaseModel):
+    """Synthetic test identity credentials."""
+    username: str
+    password: str
+    token: Optional[str] = None
+    role: str = "user"
+
+
+class TestContext(BaseModel):
+    """Context provided to a test pack execution."""
+    __test__ = False
+    target_base_url: str
+    identities: Dict[str, UserIdentity] = Field(default_factory=dict)
+    active_tokens: Dict[str, str] = Field(default_factory=dict)
+
+
+class TestExecutionResult(BaseModel):
+    """Outcome of running a test pack against a hypothesis."""
+    __test__ = False
+    testpack_name: str
+    hypothesis_id: str
+    confirmed: bool
+    confidence: float
+    summary: str
+    observations: List[RuntimeObservation] = Field(default_factory=list)
+    reproduction_steps: List[str] = Field(default_factory=list)
+
+
+class TestPack(ABC):
+    """Abstract base class for all security test packs."""
+    __test__ = False
+
+    @property
+    @abstractmethod
+    def name(self) -> str:
+        """Name of the test pack (e.g., 'bola', 'ssrf')."""
+        pass
+
+    @property
+    @abstractmethod
+    def description(self) -> str:
+        """Brief description of what this pack validates."""
+        pass
+
+    @abstractmethod
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        """Run the test pack against the given hypothesis using the scoped client."""
+        pass

package/src/trace_engine/testpacks/bfla.py

@@ -0,0 +1,70 @@
+"""BFLA (Broken Function Level Authorization) test pack."""
+
+import re
+from trace_engine.testpacks.base import TestPack, TestContext, TestExecutionResult
+from trace_engine.security.hypotheses import SecurityHypothesis
+from trace_engine.runtime.client import ScopedHttpClient
+
+
+class BflaTestPack(TestPack):
+    @property
+    def name(self) -> str:
+        return "bfla"
+
+    @property
+    def description(self) -> str:
+        return "Validates whether administrative and privileged endpoints enforce proper RBAC."
+
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        base_url = context.target_base_url.rstrip("/")
+        parts = hypothesis.endpoint_display.split(" ")
+        method = parts[0] if len(parts) > 1 else "POST"
+        raw_path = parts[1] if len(parts) > 1 else parts[0]
+
+        clean_path = re.sub(r"\{[a-zA-Z0-9_]+\}", "1", raw_path)
+        target_url = f"{base_url}{clean_path}"
+        token_user = context.active_tokens.get("user-a") or context.active_tokens.get("user-b", "")
+
+        observations = []
+        confirmed = False
+        summary = "No BFLA behavior observed."
+        steps = []
+
+        headers = {}
+        if token_user:
+            headers["Authorization"] = f"Bearer {token_user}"
+
+        # Probe with low-privileged token
+        test_payload = {"order_id": "order-101", "amount": 50, "reason": "test"}
+        obs = client.execute(
+            method=method, url=target_url, headers=headers, json_body=test_payload if method != "GET" else None
+        )
+        observations.append(obs)
+
+        # If HTTP 200 or 201 is returned rather than 403 Forbidden, privilege check is flawed
+        if obs.response_status in (200, 201):
+            confirmed = True
+            summary = (
+                f"BFLA confirmed: Privileged endpoint {raw_path} executed successfully "
+                f"under standard user identity without 403 Forbidden check."
+            )
+            steps = [
+                f"Authenticate as standard user 'user-a'",
+                f"Invoke privileged endpoint {method} {target_url}",
+                f"Received HTTP {obs.response_status} indicating unauthorized function execution",
+            ]
+
+        return TestExecutionResult(
+            testpack_name=self.name,
+            hypothesis_id=hypothesis.id,
+            confirmed=confirmed,
+            confidence=0.92 if confirmed else 0.20,
+            summary=summary,
+            observations=observations,
+            reproduction_steps=steps,
+        )

package/src/trace_engine/testpacks/bola.py

@@ -0,0 +1,94 @@
+"""BOLA (Broken Object Level Authorization) dual-tenant differential test pack."""
+
+import re
+from typing import List
+from trace_engine.testpacks.base import TestPack, TestContext, TestExecutionResult
+from trace_engine.security.hypotheses import SecurityHypothesis
+from trace_engine.runtime.client import ScopedHttpClient
+from trace_engine.runtime.observations import RuntimeObservation
+
+
+class BolaTestPack(TestPack):
+    @property
+    def name(self) -> str:
+        return "bola"
+
+    @property
+    def description(self) -> str:
+        return "Validates whether object lookups enforce tenant and ownership boundaries using dual-identity differential testing."
+
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        base_url = context.target_base_url.rstrip("/")
+        parts = hypothesis.endpoint_display.split(" ")
+        method = parts[0] if len(parts) > 1 else "GET"
+        raw_path = parts[1] if len(parts) > 1 else parts[0]
+
+        test_ids = ["order-101", "101", "1", "order-102", "order-user-a", "2", "3", "user-1", "doc-1"]
+        observations: List[RuntimeObservation] = []
+        confirmed = False
+        summary = "No BOLA behavior observed."
+        steps: List[str] = []
+
+        token_a = context.active_tokens.get("user-a", "")
+        token_b = context.active_tokens.get("user-b", "")
+
+        for test_id in test_ids:
+            probe_path = re.sub(r"\{[a-zA-Z0-9_]+\}", test_id, raw_path)
+            target_url = f"{base_url}{probe_path}"
+
+            # Differential Phase 1: Request with User A context
+            headers_a = {"Authorization": f"Bearer {token_a}"} if token_a else {}
+            obs_a = client.execute(method=method, url=target_url, headers=headers_a)
+            observations.append(obs_a)
+
+            # Differential Phase 2: Request with User B context (or unauthenticated)
+            headers_b = {"Authorization": f"Bearer {token_b}"} if token_b else {}
+            obs_b = client.execute(method=method, url=target_url, headers=headers_b)
+            observations.append(obs_b)
+
+            # Case A: True dual-tenant differential match
+            if obs_a.response_status == 200 and obs_b.response_status == 200:
+                body_b_lower = obs_b.response_body.lower()
+                # If User B receives legitimate record data without authorization restriction
+                if any(k in body_b_lower for k in ("id", "user", "order", "item", "total", "data", "status")):
+                    confirmed = True
+                    summary = (
+                        f"BOLA / IDOR (CWE-639) CONFIRMED via Dual-Tenant Differential Test: Object '{test_id}' on {raw_path} "
+                        f"is accessible by both Identity A and Identity B without tenant isolation."
+                    )
+                    steps = [
+                        f"Query {method} {target_url} using Tenant A credentials (HTTP {obs_a.response_status})",
+                        f"Query identical resource {method} {target_url} using Tenant B credentials (HTTP {obs_b.response_status})",
+                        "Observe cross-tenant data leak without HTTP 403 Forbidden or 404 Not Found scoping",
+                    ]
+                    break
+
+            # Case B: Single token / unauthenticated BOLA check
+            elif obs_b.response_status == 200:
+                body_b_lower = obs_b.response_body.lower()
+                if "user-a" in body_b_lower or "total" in body_b_lower or "items" in body_b_lower or "product" in body_b_lower:
+                    confirmed = True
+                    summary = (
+                        f"BOLA confirmed: User 'user-b' accessed object '{test_id}' "
+                        f"belonging to another identity on endpoint {raw_path} with status 200 OK."
+                    )
+                    steps = [
+                        f"Send {method} {target_url} with user-b credentials",
+                        "Observe HTTP status 200 OK returning private data of user-a",
+                    ]
+                    break
+
+        return TestExecutionResult(
+            testpack_name=self.name,
+            hypothesis_id=hypothesis.id,
+            confirmed=confirmed,
+            confidence=0.98 if confirmed else 0.20,
+            summary=summary,
+            observations=observations,
+            reproduction_steps=steps,
+        )

package/src/trace_engine/testpacks/cors.py

@@ -0,0 +1,85 @@
+"""CORS (Cross-Origin Resource Sharing) Misconfiguration test pack (CWE-942)."""
+
+from typing import List, Dict, Any
+from trace_engine.testpacks.base import TestPack, TestContext, TestExecutionResult
+from trace_engine.security.hypotheses import SecurityHypothesis
+from trace_engine.runtime.client import ScopedHttpClient
+from trace_engine.runtime.observations import RuntimeObservation
+
+PROBE_ORIGINS = [
+    "https://attacker.evil.com",
+    "https://untrusted-cross-origin.net",
+    "null",
+]
+
+
+class CorsTestPack(TestPack):
+    @property
+    def name(self) -> str:
+        return "cors"
+
+    @property
+    def description(self) -> str:
+        return "Validates whether arbitrary untrusted origins are reflected with credentials enabled."
+
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        base_url = context.target_base_url.rstrip("/")
+        parts = hypothesis.endpoint_display.split(" ")
+        method = parts[0] if len(parts) > 1 else "GET"
+        raw_path = parts[1] if len(parts) > 1 else parts[0]
+
+        target_url = f"{base_url}{raw_path}"
+        observations: List[RuntimeObservation] = []
+        confirmed = False
+        summary = "No exploitable CORS misconfiguration detected."
+        steps: List[str] = []
+
+        for origin in PROBE_ORIGINS:
+            headers = {"Origin": origin}
+            obs = client.execute(method=method, url=target_url, headers=headers)
+            observations.append(obs)
+
+            resp_hdrs = {k.lower(): v for k, v in obs.response_headers.items()}
+            allow_origin = resp_hdrs.get("access-control-allow-origin", "")
+            allow_creds = resp_hdrs.get("access-control-allow-credentials", "").lower() == "true"
+
+            # 1. Arbitrary origin reflection with credentials
+            if allow_origin in (origin, "*") and allow_creds:
+                confirmed = True
+                summary = (
+                    f"CORS Misconfiguration (CWE-942) CONFIRMED: Endpoint {raw_path} reflected untrusted origin "
+                    f"'{origin}' with 'Access-Control-Allow-Credentials: true', enabling cross-origin authenticated data theft."
+                )
+                steps = [
+                    f"Send {method} request to {target_url} with header Origin: {origin}",
+                    f"Observe response headers containing Access-Control-Allow-Origin: {allow_origin} and Access-Control-Allow-Credentials: true",
+                ]
+                break
+
+            # 2. 'null' origin reflection with credentials
+            if origin == "null" and allow_origin == "null" and allow_creds:
+                confirmed = True
+                summary = (
+                    f"CORS Misconfiguration (CWE-942) CONFIRMED: Endpoint {raw_path} trusts origin 'null' "
+                    f"with credentials, exposing authenticated session to sandboxed iframe attacks."
+                )
+                steps = [
+                    f"Send {method} request to {target_url} with header Origin: null",
+                    "Observe response header Access-Control-Allow-Origin: null with credentials allowed",
+                ]
+                break
+
+        return TestExecutionResult(
+            testpack_name=self.name,
+            hypothesis_id=hypothesis.id,
+            confirmed=confirmed,
+            confidence=0.90 if confirmed else 0.1,
+            summary=summary,
+            observations=observations,
+            reproduction_steps=steps,
+        )

package/src/trace_engine/testpacks/deserialization.py

@@ -0,0 +1,86 @@
+"""Insecure Deserialization test pack (CWE-502)."""
+
+from typing import List, Dict, Any
+from trace_engine.testpacks.base import TestPack, TestContext, TestExecutionResult
+from trace_engine.security.hypotheses import SecurityHypothesis
+from trace_engine.runtime.client import ScopedHttpClient
+from trace_engine.runtime.observations import RuntimeObservation
+
+DESER_PROBES = [
+    ("pickle_base64", "gASVBAAAAAAAAACMCXRyYWNlX2JveJSULg=="),
+    ("yaml_object", "!!python/object/apply:builtins.str [\"trace_probe\"]"),
+    ("java_serial", "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sBFlmeFAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAAAeA=="),
+]
+
+DESER_ERROR_SIGNATURES = [
+    "unpicklingerror",
+    "pickle.unpicklingerror",
+    "cannot deserialize",
+    "invalidstreamheader",
+    "java.io.invalidclassexception",
+    "constructorerror",
+    "yaml.constructor",
+    "unsafe deserialization",
+]
+
+
+class DeserializationTestPack(TestPack):
+    @property
+    def name(self) -> str:
+        return "deserialization"
+
+    @property
+    def description(self) -> str:
+        return "Validates whether endpoints accept untrusted serialized byte-streams or object definitions without schema validation."
+
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        base_url = context.target_base_url.rstrip("/")
+        parts = hypothesis.endpoint_display.split(" ")
+        method = parts[0] if len(parts) > 1 else "POST"
+        raw_path = parts[1] if len(parts) > 1 else parts[0]
+
+        target_url = f"{base_url}{raw_path}"
+        token = context.active_tokens.get("user-a", "")
+        headers = {"Authorization": f"Bearer {token}"} if token else {}
+
+        observations: List[RuntimeObservation] = []
+        confirmed = False
+        summary = "No Insecure Deserialization vulnerabilities detected."
+        steps: List[str] = []
+
+        for probe_type, payload in DESER_PROBES:
+            json_payload = {"data": payload, "object": payload, "state": payload}
+            obs = client.execute(method=method, url=target_url, headers=headers, json_body=json_payload)
+            observations.append(obs)
+
+            body_lower = obs.response_body.lower()
+            for sig in DESER_ERROR_SIGNATURES:
+                if sig in body_lower:
+                    confirmed = True
+                    summary = (
+                        f"Insecure Deserialization (CWE-502) CONFIRMED: Endpoint {raw_path} attempted to deserialize "
+                        f"untrusted object probe ({probe_type}) resulting in deserialization parser reaction: '{sig}'."
+                    )
+                    steps = [
+                        f"Send {method} request to {target_url} containing serialized {probe_type} payload",
+                        f"Observe deserialization runtime exception trace '{sig}' in server response",
+                    ]
+                    break
+
+            if confirmed:
+                break
+
+        return TestExecutionResult(
+            testpack_name=self.name,
+            hypothesis_id=hypothesis.id,
+            confirmed=confirmed,
+            confidence=0.90 if confirmed else 0.1,
+            summary=summary,
+            observations=observations,
+            reproduction_steps=steps,
+        )

package/src/trace_engine/testpacks/injection.py

@@ -0,0 +1,179 @@
+"""Injection indicator test pack with polymorphic SQLi and Command Injection mutations."""
+
+import re
+import urllib.parse
+from typing import List
+from trace_engine.testpacks.base import TestPack, TestContext, TestExecutionResult
+from trace_engine.security.hypotheses import SecurityHypothesis
+from trace_engine.runtime.client import ScopedHttpClient
+from trace_engine.runtime.observations import RuntimeObservation
+
+INJECTION_PROBES = [
+    # Classic SQLi Boolean
+    "' OR '1'='1",
+    "' OR 1=1--",
+    "admin'--",
+    # SQL Syntax breakers
+    "'",
+    "''",
+    "test'--",
+    "';--",
+    # Stacked queries / Command delimiters
+    "; cat /etc/passwd",
+    "| whoami",
+    "$(id)",
+]
+
+SQL_ERROR_PATTERNS = [
+    "syntax error",
+    "sqlite3.operationalerror",
+    "unrecognized token",
+    "sql syntax",
+    "database error",
+    "pg_query",
+    "ora-01756",
+    "mysql_fetch",
+    "sqlstate",
+    "odbc sql server driver",
+    "pdoexception",
+    "unterminated quotation mark",
+    "unclosed quotation mark",
+]
+
+
+class InjectionTestPack(TestPack):
+    @property
+    def name(self) -> str:
+        return "injection"
+
+    @property
+    def description(self) -> str:
+        return "Tests query, path, and body parameters for dynamic SQL/command injection vulnerabilities across mutated probe varieties."
+
+    def execute(
+        self,
+        hypothesis: SecurityHypothesis,
+        client: ScopedHttpClient,
+        context: TestContext,
+    ) -> TestExecutionResult:
+        base_url = context.target_base_url.rstrip("/")
+        parts = hypothesis.endpoint_display.split(" ")
+        method = parts[0] if len(parts) > 1 else "GET"
+        raw_path = parts[1] if len(parts) > 1 else parts[0]
+
+        clean_path = re.sub(r"\{[a-zA-Z0-9_]+\}", "1", raw_path)
+        token = context.active_tokens.get("user-a", "")
+        headers = {"Authorization": f"Bearer {token}"} if token else {}
+
+        observations: List[RuntimeObservation] = []
+        confirmed = False
+        summary = "No dynamic injection signatures observed."
+        steps: List[str] = []
+
+        for probe in INJECTION_PROBES:
+            encoded_probe = urllib.parse.quote(probe)
+            sep = "&" if "?" in clean_path else "?"
+            probe_url = f"{base_url}{clean_path}{sep}q={encoded_probe}&query={encoded_probe}&search={encoded_probe}&id={encoded_probe}"
+
+            # 1. Query probe
+            obs = client.execute(method=method, url=probe_url, headers=headers)
+            observations.append(obs)
+
+            body_lower = obs.response_body.lower()
+            matched_error = next((pat for pat in SQL_ERROR_PATTERNS if pat in body_lower), None)
+
+            if matched_error or (obs.response_status == 500 and "error" in body_lower):
+                confirmed = True
+                detail = f"database error signature '{matched_error}'" if matched_error else "unhandled 500 server crash"
+                summary = (
+                    f"Injection vulnerability confirmed: Probe '{probe}' on {raw_path} triggered "
+                    f"{detail} indicating unparameterized query execution."
+                )
+                steps = [
+                    f"Send request with probe: {probe_url}",
+                    f"Observe server reaction: {detail}",
+                ]
+                break
+
+            # 2. Body probe for mutating requests
+            if method in ("POST", "PUT", "PATCH"):
+                body_probe = {"q": probe, "query": probe, "search": probe, "name": probe}
+                body_obs = client.execute(
+                    method=method,
+                    url=f"{base_url}{clean_path}",
+                    headers=headers,
+                    json_body=body_probe,
+                )
+                observations.append(body_obs)
+                body_res_lower = body_obs.response_body.lower()
+                matched_body_err = next((pat for pat in SQL_ERROR_PATTERNS if pat in body_res_lower), None)
+                if matched_body_err or (body_obs.response_status == 500 and "error" in body_res_lower):
+                    confirmed = True
+                    detail = f"database error signature '{matched_body_err}'" if matched_body_err else "unhandled 500 server crash"
+                    summary = (
+                        f"Injection vulnerability confirmed in request body: Probe '{probe}' on {raw_path} triggered "
+                        f"{detail}."
+                    )
+                    steps = [
+                        f"Send {method} to {base_url}{clean_path} with JSON body payload containing '{probe}'",
+                        f"Observe database reaction: {detail}",
+                    ]
+                    break
+
+        # 3. Statistical Blind Timing Oracle (Welch's t-test) if error-based probes were inconclusive
+        if not confirmed:
+            from trace_engine.security.timing import StatisticalTimingOracle
+
+            # Measure baseline latencies (N=3 baseline samples)
+            base_latencies: List[float] = []
+            for _ in range(3):
+                sep = "&" if "?" in clean_path else "?"
+                b_url = f"{base_url}{clean_path}{sep}q=trace_baseline_test"
+                b_obs = client.execute(method=method, url=b_url, headers=headers)
+                observations.append(b_obs)
+                base_latencies.append(b_obs.latency_ms / 1000.0)
+
+            # Test blind sleep payloads with Welch's t-test (N=3 delay samples)
+            timing_probes = [
+                "'; SELECT pg_sleep(1.5)--",
+                "' OR SLEEP(1.5)--",
+                "1; sleep 1.5",
+            ]
+            expected_sec = 1.5
+
+            for t_probe in timing_probes:
+                encoded_t = urllib.parse.quote(t_probe)
+                sep = "&" if "?" in clean_path else "?"
+                t_url = f"{base_url}{clean_path}{sep}q={encoded_t}"
+
+                delay_latencies: List[float] = []
+                for _ in range(3):
+                    t_obs = client.execute(method=method, url=t_url, headers=headers)
+                    observations.append(t_obs)
+                    delay_latencies.append(t_obs.latency_ms / 1000.0)
+
+                t_res = StatisticalTimingOracle.evaluate_timing_vulnerability(
+                    baseline_latencies=base_latencies,
+                    delay_latencies=delay_latencies,
+                    expected_delay_sec=expected_sec,
+                )
+
+                if t_res.is_confirmed:
+                    confirmed = True
+                    summary = t_res.summary
+                    steps = [
+                        f"Measure baseline latency across non-delayed requests ({t_res.mean_baseline_sec:.2f}s mean)",
+                        f"Send time-delay injection probe: {t_url}",
+                        f"Observe statistically significant delay shift: +{t_res.observed_shift_sec:.2f}s (Welch's t={t_res.t_statistic}, p={t_res.p_value:.2e})",
+                    ]
+                    break
+
+        return TestExecutionResult(
+            testpack_name=self.name,
+            hypothesis_id=hypothesis.id,
+            confirmed=confirmed,
+            confidence=0.98 if confirmed else 0.15,
+            summary=summary,
+            observations=observations,
+            reproduction_steps=steps,
+        )