wormclaude 1.0.181 → 1.0.182

package/dist/pentest.js

@@ -41,8 +41,27 @@ function hostOf(u) {
         return '';
     }
 }
+// İstek başlıklarına kullanıcı oturumunu (auth) birleştir. Sunucunun spec'i temel; auth ÜSTE biner
+// (Cookie + Authorization), böylece her istek login-arkası koşar. Sunucu zaten Cookie/Authorization
+// koyduysa kullanıcınınki kazanır (gerçek oturum). allowed-host SSRF guard'ı değişmez.
+export function _mergeAuth(reqHeaders, auth) {
+    if (!auth || (!auth.cookie && !auth.authHeader && !auth.headers))
+        return reqHeaders;
+    const h = { ...(reqHeaders || {}) };
+    if (auth.cookie) {
+        const existing = h['Cookie'] || h['cookie'];
+        h['Cookie'] = existing ? `${existing}; ${auth.cookie}` : auth.cookie;
+        delete h['cookie'];
+    }
+    if (auth.authHeader)
+        h['Authorization'] = auth.authHeader;
+    if (auth.headers)
+        for (const [k, v] of Object.entries(auth.headers))
+            h[k] = v;
+    return h;
+}
 // Tek bir istek-spec'ini yerelde çalıştır. allowed dışı host → atlanır (SSRF koruması).
-async function execReq(req, allowed) {
+async function execReq(req, allowed, auth) {
     const t0 = Date.now();
     const h = hostOf(req.url);
     if (!allowed.has(h)) {
@@ -51,7 +70,7 @@ async function execReq(req, allowed) {
     try {
         const r = await fetch(req.url, {
             method: req.method || 'GET',
-            headers: req.headers,
+            headers: _mergeAuth(req.headers, auth),
             body: req.body,
             redirect: req.follow === false ? 'manual' : 'follow', // open-redirect vb. için Location'ı görmek
             signal: AbortSignal.timeout(Math.max(3, req.timeout || 20) * 1000),
@@ -71,8 +90,10 @@ async function execReq(req, allowed) {
     }
 }
 // Tam akış: plan al → her round'da istekleri yerelde at → /exec ile analiz ettir → done'a dek döngü.
-export async function runPentest(config, tool, target, scopeAck, log) {
-    const plan = await postJson(config, '/pentest/plan', { tool, target, scope_ack: scopeAck }, 15000);
+export async function runPentest(config, tool, target, scopeAck, log, auth) {
+    const _authed = !!(auth && (auth.cookie || auth.authHeader || auth.headers));
+    // authenticated: SUNUCUYA SADECE BAYRAK gider (login-arkası crawl/POST planlasın diye) — sır/cookie DEĞİL.
+    const plan = await postJson(config, '/pentest/plan', { tool, target, scope_ack: scopeAck, authenticated: _authed }, 15000);
     if (!plan.ok)
         return { ok: false, reason: plan.reason, plan };
     const allowed = new Set((plan.allowed_hosts || [plan.host || '']).map((x) => x.toLowerCase()));
@@ -86,7 +107,7 @@ export async function runPentest(config, tool, target, scopeAck, log) {
         const CONC = 6;
         for (let i = 0; i < requests.length; i += CONC) {
             const batch = requests.slice(i, i + CONC);
-            const rs = await Promise.all(batch.map((req) => execReq(req, allowed)));
+            const rs = await Promise.all(batch.map((req) => execReq(req, allowed, auth)));
             responses.push(...rs);
         }
         report = await postJson(config, '/pentest/exec', { job_id: plan.job_id, responses }, 30000);

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.181';
+export const VERSION = '1.0.182';

package/dist/tools.js

@@ -226,12 +226,14 @@ export const toolSchemas = [
         type: 'function',
         function: {
             name: 'SecurityScan',
-            description: "Run an AUTHORIZED security scan with WormClaude's own server-side engine (no external tools, no manual payloads). Use THIS — never shell/curl/Invoke-WebRequest — whenever the user asks to scan/test a target (\"tara\", \"scan\", \"xss tara\", \"sqli\", \"recon\", \"açık bul\", \"zafiyet tara\", \"tam kapsamlı tara\"). For a FULL/comprehensive scan use tool='full' ONCE — it deterministically runs recon+XSS+SQLi in code and returns ONE consolidated report (do NOT chain recon/xss/sqli yourself, that loops). For a single check use recon/xss/sqli. For xss/sqli give a PARAMETERIZED url; for recon/full give a domain. Requires authorized-researcher level (3+); traffic exits the user's IP — only authorized targets.",
+            description: "Run an AUTHORIZED security scan with WormClaude's own server-side engine (no external tools, no manual payloads). Use THIS — never shell/curl/Invoke-WebRequest — whenever the user asks to scan/test a target (\"tara\", \"scan\", \"xss tara\", \"sqli\", \"recon\", \"açık bul\", \"zafiyet tara\", \"tam kapsamlı tara\"). For a FULL/comprehensive scan use tool='full' ONCE — it deterministically runs recon+XSS+SQLi in code and returns ONE consolidated report (do NOT chain recon/xss/sqli yourself, that loops). For a single check use recon/xss/sqli. For xss/sqli give a PARAMETERIZED url; for recon/full give a domain. For AUTHENTICATED / behind-login scanning, pass the user's session via `cookie` (and/or `auth_header`) — every request is then sent logged-in, so pages and parameters behind the login are reached. Requires authorized-researcher level (3+); traffic exits the user's IP — only authorized targets.",
             parameters: {
                 type: 'object',
                 properties: {
                     tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan'], description: 'full → tam kapsamlı (recon+xss+sqli tek seferde, kapsamlı tarama için BUNU kullan); recon/scan/dirscan → domain; xss/sqli → parameterized URL' },
                     target: { type: 'string', description: 'Domain for recon/scan/dirscan (example.com) OR parameterized URL for xss/sqli (https://example.com/p?id=1)' },
+                    cookie: { type: 'string', description: 'Optional. Session cookie for AUTHENTICATED / behind-login scanning, e.g. "sessionid=abc123; csrftoken=xyz". The user copies it from their logged-in browser (DevTools → Application → Cookies, or the Cookie request header). Sent only to the target from the user IP — never stored on the server. Provide it whenever the user wants to scan pages behind a login.' },
+                    auth_header: { type: 'string', description: 'Optional. Authorization header value for token-based authenticated scanning, e.g. "Bearer eyJhbGci..." or "Basic dXNlcjpwYXNz". Use instead of / together with cookie when the site authenticates via a token header.' },
                 },
                 required: ['tool', 'target'],
             },
@@ -737,10 +739,17 @@ async function execOne(call, hooks) {
         }
         if (tool === 'scan')
             tool = 'recon'; // "scan" genel tarama → motorun bildiği "recon" (slash ile aynı)
+        // AUTHENTICATED / login-arkası: kullanıcı session cookie / auth header verdiyse her isteğe enjekte
+        // edilir (sır SUNUCUYA gitmez, sadece hedefe kullanıcı IP'sinden). Cache key'e auth-parmakizi ekle ki
+        // anonim tarama sonucu authenticated tarama için (veya tersi) yeniden kullanılmasın.
+        const _cookie = String(args?.cookie || '').trim();
+        const _authHeader = String(args?.auth_header || '').trim();
+        const _auth = (_cookie || _authHeader) ? { cookie: _cookie || undefined, authHeader: _authHeader || undefined } : undefined;
+        const _authTag = _auth ? '|auth' : '';
         // FULL: tam kapsamlı tarama TEK ÇAĞRIDA — model orkestrasyona girmesin (döngü olur). Kod
         // deterministik olarak recon → xss → sqli koşar, TEK konsolide rapor döner.
         if (tool === 'full' || tool === 'fullscan') {
-            const _fk = 'full|' + target.toLowerCase();
+            const _fk = 'full|' + target.toLowerCase() + _authTag;
             const _fc = _scanCache.get(_fk);
             if (_fc && Date.now() - _fc.t < 120000) {
                 return { ok: false, args, output: `[ALREADY-SCANNED] full scan "${target}" already ran — findings are above. Do NOT call SecurityScan again; summarize the results in text.` };
@@ -748,14 +757,14 @@ async function execOne(call, hooks) {
             try {
                 const { runPentest } = await import('./pentest.js');
                 const all = [];
-                let rpt = `Tam kapsamlı tarama — ${target}\n`;
+                let rpt = `Tam kapsamlı tarama — ${target}${_auth ? ' (authenticated / login-arkası — oturum enjekte edildi)' : ''}\n`;
                 for (const _t of ['recon', 'xss', 'sqli']) {
                     if (hooks?.signal?.aborted) {
                         rpt += `\n[STOPPED] kullanıcı durdurdu (Esc) — kalan taramalar atlandı.`;
                         break;
                     }
                     try {
-                        const o = await runPentest(cfg(), _t, target, true, () => { });
+                        const o = await runPentest(cfg(), _t, target, true, () => { }, _auth);
                         if (o?.ok) {
                             const ff = o.report?.findings || [];
                             all.push(...ff.map((x) => ({ ...x, scan: _t })));
@@ -782,7 +791,7 @@ async function execOne(call, hooks) {
                 _scanCache.set(_fk, { out: rpt, t: _now });
                 // Alt tarama tiplerini de cache'le → full sonrası model tek tek recon/xss/sqli çağıramaz (gereksiz tekrar).
                 for (const _t of ['recon', 'xss', 'sqli'])
-                    _scanCache.set(_t + '|' + target.toLowerCase(), { out: rpt, t: _now });
+                    _scanCache.set(_t + '|' + target.toLowerCase() + _authTag, { out: rpt, t: _now });
                 return { ok: true, output: rpt, args };
             }
             catch (e) {
@@ -790,7 +799,7 @@ async function execOne(call, hooks) {
             }
         }
         // DÖNGÜ-KIRICI: aynı tarama 2 dk içinde tekrar → yeniden koşma, önceki sonuç + "yeniden tarama" notu.
-        const _ck = tool + '|' + target.toLowerCase();
+        const _ck = tool + '|' + target.toLowerCase() + _authTag;
         const _cached = _scanCache.get(_ck);
         if (_cached && Date.now() - _cached.t < 120000) {
             // SADECE kısa DUR notu — bulguları TEKRAR verme (yoksa model onları yeniden yazıp tekrar çağırır).
@@ -798,7 +807,7 @@ async function execOne(call, hooks) {
         }
         try {
             const { runPentest } = await import('./pentest.js');
-            const out = await runPentest(cfg(), tool, target, true, () => { });
+            const out = await runPentest(cfg(), tool, target, true, () => { }, _auth);
             if (!out?.ok) {
                 const reason = out?.reason || out?.plan?.reason || 'error';
                 const tip = reason === 'trust_required' ? ' (Doğrulanmış Araştırmacı / seviye 3+ gerekir: /dogrula)'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.181",
+  "version": "1.0.182",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {