wormclaude 1.0.181 → 1.0.183

package/dist/pentest.js

@@ -41,8 +41,127 @@ function hostOf(u) {
         return '';
     }
 }
+// ── FAZ 4c: LOGIN OTOMASYONU (cred → session cookie; tamamen istemci-tarafı, sır sunucuya gitmez) ──
+function _setCookies(res) {
+    // Node 18.14+ getSetCookie() tüm Set-Cookie satırlarını verir; yoksa tek başlığa düş.
+    try {
+        const f = res.headers.getSetCookie;
+        if (typeof f === 'function')
+            return f.call(res.headers) || [];
+    }
+    catch { }
+    const one = res.headers.get('set-cookie');
+    return one ? [one] : [];
+}
+function _mergeJar(jar, setCookies) {
+    for (const sc of setCookies) {
+        const kv = sc.split(';', 1)[0];
+        const eq = kv.indexOf('=');
+        if (eq > 0)
+            jar[kv.slice(0, eq).trim()] = kv.slice(eq + 1).trim();
+    }
+    return jar;
+}
+function _cookieHeader(jar) {
+    return Object.entries(jar).map(([k, v]) => `${k}=${v}`).join('; ');
+}
+function _attrOf(s, key) {
+    const m = new RegExp(key + '\\s*=\\s*["\']([^"\']*)', 'i').exec(s);
+    return m ? m[1] : '';
+}
+// Login formunu bul: type=password içeren <form>. userField = ilk görünür text/email input; passField =
+// password input; hidden/csrf alanları gerçek değeriyle korunur.
+function _findLoginForm(html, baseUrl) {
+    for (const m of html.matchAll(/<form\b([^>]*)>([\s\S]*?)<\/form>/gi)) {
+        const attrs = m[1], inner = m[2];
+        if (!/<input\b[^>]*type\s*=\s*["']?password/i.test(inner))
+            continue;
+        let passField = '', userField = '', hidden = {};
+        for (const t of inner.matchAll(/<(?:input|select|textarea)\b([^>]*)>/gi)) {
+            const ia = t[1];
+            const name = _attrOf(ia, 'name');
+            if (!name)
+                continue;
+            const typ = (_attrOf(ia, 'type') || 'text').toLowerCase();
+            if (typ === 'password')
+                passField = name;
+            else if (typ === 'hidden')
+                hidden[name] = _attrOf(ia, 'value');
+            else if (!userField && ['text', 'email', 'tel', 'username'].includes(typ))
+                userField = name;
+        }
+        if (!passField)
+            continue;
+        if (!userField)
+            userField = 'username';
+        let action = baseUrl;
+        try {
+            action = new URL(_attrOf(attrs, 'action') || baseUrl, baseUrl).toString();
+        }
+        catch { }
+        const method = (_attrOf(attrs, 'method') || 'post').toLowerCase();
+        return { action, method, userField, passField, hidden };
+    }
+    return null;
+}
+/** Otomatik login: login sayfasını çek → formu bul (CSRF korunur) → cred ile POST → Set-Cookie yakala
+ *  → session cookie string döndür. Trafik kullanıcı IP'sinden; cookie/cred SUNUCUYA GİTMEZ. */
+export async function autoLogin(loginUrl, username, password, extra) {
+    let jar = {};
+    try {
+        const r0 = await fetch(loginUrl, { headers: { 'User-Agent': 'Mozilla/5.0' }, redirect: 'follow', signal: AbortSignal.timeout(20000) });
+        _mergeJar(jar, _setCookies(r0));
+        const html = await r0.text();
+        const form = _findLoginForm(html, r0.url || loginUrl);
+        if (!form)
+            return { ok: false, cookie: '', note: 'Login formu bulunamadı (password alanı yok). login_url doğru mu?' };
+        const data = { ...form.hidden, [form.userField]: username, [form.passField]: password, ...(extra || {}) };
+        const r1 = await fetch(form.action, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0', ...(Object.keys(jar).length ? { Cookie: _cookieHeader(jar) } : {}) },
+            body: new URLSearchParams(data).toString(),
+            redirect: 'manual', signal: AbortSignal.timeout(20000),
+        });
+        _mergeJar(jar, _setCookies(r1));
+        // login sonrası 30x yönlendirme genelde asıl session cookie'sini set eder → bir adım takip et
+        const loc = r1.headers.get('location');
+        if (loc && [301, 302, 303, 307, 308].includes(r1.status)) {
+            try {
+                const nu = new URL(loc, form.action).toString();
+                const r2 = await fetch(nu, { headers: { 'User-Agent': 'Mozilla/5.0', ...(Object.keys(jar).length ? { Cookie: _cookieHeader(jar) } : {}) }, redirect: 'manual', signal: AbortSignal.timeout(15000) });
+                _mergeJar(jar, _setCookies(r2));
+            }
+            catch { }
+        }
+        if (!Object.keys(jar).length)
+            return { ok: false, cookie: '', note: 'Login denendi ama Set-Cookie gelmedi (kimlik hatalı ya da JS/token tabanlı login olabilir).' };
+        return { ok: true, cookie: _cookieHeader(jar), note: `Login OK — ${Object.keys(jar).length} cookie alındı (oturumlu tarama).` };
+    }
+    catch (e) {
+        return { ok: false, cookie: '', note: 'Login hatası: ' + (e?.name === 'TimeoutError' ? 'zaman aşımı' : (e?.message || e)) };
+    }
+}
+// İstek başlıklarına kullanıcı oturumunu (auth) birleştir. Sunucunun spec'i temel; auth ÜSTE biner
+// (Cookie + Authorization), böylece her istek login-arkası koşar. Sunucu zaten Cookie/Authorization
+// koyduysa kullanıcınınki kazanır (gerçek oturum). allowed-host SSRF guard'ı değişmez.
+export function _mergeAuth(reqHeaders, auth) {
+    if (!auth || (!auth.cookie && !auth.authHeader && !auth.headers))
+        return reqHeaders;
+    const h = { ...(reqHeaders || {}) };
+    if (auth.cookie) {
+        const existing = h['Cookie'] || h['cookie'];
+        h['Cookie'] = existing ? `${existing}; ${auth.cookie}` : auth.cookie;
+        delete h['cookie'];
+    }
+    if (auth.authHeader)
+        h['Authorization'] = auth.authHeader;
+    if (auth.headers)
+        for (const [k, v] of Object.entries(auth.headers))
+            h[k] = v;
+    return h;
+}
 // Tek bir istek-spec'ini yerelde çalıştır. allowed dışı host → atlanır (SSRF koruması).
-async function execReq(req, allowed) {
+async function execReq(req, allowed, auth) {
     const t0 = Date.now();
     const h = hostOf(req.url);
     if (!allowed.has(h)) {
@@ -51,7 +170,7 @@ async function execReq(req, allowed) {
     try {
         const r = await fetch(req.url, {
             method: req.method || 'GET',
-            headers: req.headers,
+            headers: _mergeAuth(req.headers, auth),
             body: req.body,
             redirect: req.follow === false ? 'manual' : 'follow', // open-redirect vb. için Location'ı görmek
             signal: AbortSignal.timeout(Math.max(3, req.timeout || 20) * 1000),
@@ -71,8 +190,10 @@ async function execReq(req, allowed) {
     }
 }
 // Tam akış: plan al → her round'da istekleri yerelde at → /exec ile analiz ettir → done'a dek döngü.
-export async function runPentest(config, tool, target, scopeAck, log) {
-    const plan = await postJson(config, '/pentest/plan', { tool, target, scope_ack: scopeAck }, 15000);
+export async function runPentest(config, tool, target, scopeAck, log, auth) {
+    const _authed = !!(auth && (auth.cookie || auth.authHeader || auth.headers));
+    // authenticated: SUNUCUYA SADECE BAYRAK gider (login-arkası crawl/POST planlasın diye) — sır/cookie DEĞİL.
+    const plan = await postJson(config, '/pentest/plan', { tool, target, scope_ack: scopeAck, authenticated: _authed }, 15000);
     if (!plan.ok)
         return { ok: false, reason: plan.reason, plan };
     const allowed = new Set((plan.allowed_hosts || [plan.host || '']).map((x) => x.toLowerCase()));
@@ -86,7 +207,7 @@ export async function runPentest(config, tool, target, scopeAck, log) {
         const CONC = 6;
         for (let i = 0; i < requests.length; i += CONC) {
             const batch = requests.slice(i, i + CONC);
-            const rs = await Promise.all(batch.map((req) => execReq(req, allowed)));
+            const rs = await Promise.all(batch.map((req) => execReq(req, allowed, auth)));
             responses.push(...rs);
         }
         report = await postJson(config, '/pentest/exec', { job_id: plan.job_id, responses }, 30000);

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.181';
+export const VERSION = '1.0.183';

package/dist/tools.js

@@ -226,12 +226,17 @@ export const toolSchemas = [
         type: 'function',
         function: {
             name: 'SecurityScan',
-            description: "Run an AUTHORIZED security scan with WormClaude's own server-side engine (no external tools, no manual payloads). Use THIS — never shell/curl/Invoke-WebRequest — whenever the user asks to scan/test a target (\"tara\", \"scan\", \"xss tara\", \"sqli\", \"recon\", \"açık bul\", \"zafiyet tara\", \"tam kapsamlı tara\"). For a FULL/comprehensive scan use tool='full' ONCE — it deterministically runs recon+XSS+SQLi in code and returns ONE consolidated report (do NOT chain recon/xss/sqli yourself, that loops). For a single check use recon/xss/sqli. For xss/sqli give a PARAMETERIZED url; for recon/full give a domain. Requires authorized-researcher level (3+); traffic exits the user's IP — only authorized targets.",
+            description: "Run an AUTHORIZED security scan with WormClaude's own server-side engine (no external tools, no manual payloads). Use THIS — never shell/curl/Invoke-WebRequest — whenever the user asks to scan/test a target (\"tara\", \"scan\", \"xss tara\", \"sqli\", \"recon\", \"açık bul\", \"zafiyet tara\", \"tam kapsamlı tara\"). For a FULL/comprehensive scan use tool='full' ONCE — it deterministically runs recon+XSS+SQLi in code and returns ONE consolidated report (do NOT chain recon/xss/sqli yourself, that loops). For a single check use recon/xss/sqli. For xss/sqli give a PARAMETERIZED url; for recon/full give a domain. For AUTHENTICATED / behind-login scanning, pass the user's session via `cookie` (and/or `auth_header`) — every request is then sent logged-in, so pages and parameters behind the login are reached. Requires authorized-researcher level (3+); traffic exits the user's IP — only authorized targets.",
             parameters: {
                 type: 'object',
                 properties: {
                     tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan'], description: 'full → tam kapsamlı (recon+xss+sqli tek seferde, kapsamlı tarama için BUNU kullan); recon/scan/dirscan → domain; xss/sqli → parameterized URL' },
                     target: { type: 'string', description: 'Domain for recon/scan/dirscan (example.com) OR parameterized URL for xss/sqli (https://example.com/p?id=1)' },
+                    cookie: { type: 'string', description: 'Optional. Session cookie for AUTHENTICATED / behind-login scanning, e.g. "sessionid=abc123; csrftoken=xyz". The user copies it from their logged-in browser (DevTools → Application → Cookies, or the Cookie request header). Sent only to the target from the user IP — never stored on the server. Provide it whenever the user wants to scan pages behind a login.' },
+                    auth_header: { type: 'string', description: 'Optional. Authorization header value for token-based authenticated scanning, e.g. "Bearer eyJhbGci..." or "Basic dXNlcjpwYXNz". Use instead of / together with cookie when the site authenticates via a token header.' },
+                    login_url: { type: 'string', description: 'Optional. URL of the login PAGE for AUTO-LOGIN. When the user gives credentials instead of a cookie, set this + username + password; the scanner fetches the login form, submits the credentials (preserving CSRF), captures the session cookie, and scans logged-in. Login happens from the user IP; credentials/cookie never reach the server.' },
+                    username: { type: 'string', description: 'Optional. Username/email for auto-login (use with login_url + password).' },
+                    password: { type: 'string', description: 'Optional. Password for auto-login (use with login_url + username).' },
                 },
                 required: ['tool', 'target'],
             },
@@ -737,10 +742,35 @@ async function execOne(call, hooks) {
         }
         if (tool === 'scan')
             tool = 'recon'; // "scan" genel tarama → motorun bildiği "recon" (slash ile aynı)
+        // AUTHENTICATED / login-arkası: kullanıcı session cookie / auth header verdiyse her isteğe enjekte
+        // edilir (sır SUNUCUYA gitmez, sadece hedefe kullanıcı IP'sinden). Cache key'e auth-parmakizi ekle ki
+        // anonim tarama sonucu authenticated tarama için (veya tersi) yeniden kullanılmasın.
+        let _cookie = String(args?.cookie || '').trim();
+        const _authHeader = String(args?.auth_header || '').trim();
+        // FAZ 4c: login_url + username + password verildiyse OTOMATİK login ol → session cookie'yi al
+        // (manuel cookie kopyalamaya gerek yok). İstemci-tarafı; cred/cookie sunucuya gitmez.
+        const _loginUrl = String(args?.login_url || '').trim();
+        const _username = String(args?.username || '').trim();
+        const _password = String(args?.password || '');
+        let _loginNote = '';
+        if (_loginUrl && _username && _password && !_cookie) {
+            try {
+                const { autoLogin } = await import('./pentest.js');
+                const lr = await autoLogin(_loginUrl, _username, _password);
+                _loginNote = `\n[login] ${lr.note}`;
+                if (lr.ok && lr.cookie)
+                    _cookie = lr.cookie;
+            }
+            catch (e) {
+                _loginNote = `\n[login] hata: ${e?.message || e}`;
+            }
+        }
+        const _auth = (_cookie || _authHeader) ? { cookie: _cookie || undefined, authHeader: _authHeader || undefined } : undefined;
+        const _authTag = _auth ? '|auth' : '';
         // FULL: tam kapsamlı tarama TEK ÇAĞRIDA — model orkestrasyona girmesin (döngü olur). Kod
         // deterministik olarak recon → xss → sqli koşar, TEK konsolide rapor döner.
         if (tool === 'full' || tool === 'fullscan') {
-            const _fk = 'full|' + target.toLowerCase();
+            const _fk = 'full|' + target.toLowerCase() + _authTag;
             const _fc = _scanCache.get(_fk);
             if (_fc && Date.now() - _fc.t < 120000) {
                 return { ok: false, args, output: `[ALREADY-SCANNED] full scan "${target}" already ran — findings are above. Do NOT call SecurityScan again; summarize the results in text.` };
@@ -748,14 +778,14 @@ async function execOne(call, hooks) {
             try {
                 const { runPentest } = await import('./pentest.js');
                 const all = [];
-                let rpt = `Tam kapsamlı tarama — ${target}\n`;
+                let rpt = `Tam kapsamlı tarama — ${target}${_auth ? ' (authenticated / login-arkası — oturum enjekte edildi)' : ''}${_loginNote}\n`;
                 for (const _t of ['recon', 'xss', 'sqli']) {
                     if (hooks?.signal?.aborted) {
                         rpt += `\n[STOPPED] kullanıcı durdurdu (Esc) — kalan taramalar atlandı.`;
                         break;
                     }
                     try {
-                        const o = await runPentest(cfg(), _t, target, true, () => { });
+                        const o = await runPentest(cfg(), _t, target, true, () => { }, _auth);
                         if (o?.ok) {
                             const ff = o.report?.findings || [];
                             all.push(...ff.map((x) => ({ ...x, scan: _t })));
@@ -782,7 +812,7 @@ async function execOne(call, hooks) {
                 _scanCache.set(_fk, { out: rpt, t: _now });
                 // Alt tarama tiplerini de cache'le → full sonrası model tek tek recon/xss/sqli çağıramaz (gereksiz tekrar).
                 for (const _t of ['recon', 'xss', 'sqli'])
-                    _scanCache.set(_t + '|' + target.toLowerCase(), { out: rpt, t: _now });
+                    _scanCache.set(_t + '|' + target.toLowerCase() + _authTag, { out: rpt, t: _now });
                 return { ok: true, output: rpt, args };
             }
             catch (e) {
@@ -790,7 +820,7 @@ async function execOne(call, hooks) {
             }
         }
         // DÖNGÜ-KIRICI: aynı tarama 2 dk içinde tekrar → yeniden koşma, önceki sonuç + "yeniden tarama" notu.
-        const _ck = tool + '|' + target.toLowerCase();
+        const _ck = tool + '|' + target.toLowerCase() + _authTag;
         const _cached = _scanCache.get(_ck);
         if (_cached && Date.now() - _cached.t < 120000) {
             // SADECE kısa DUR notu — bulguları TEKRAR verme (yoksa model onları yeniden yazıp tekrar çağırır).
@@ -798,7 +828,7 @@ async function execOne(call, hooks) {
         }
         try {
             const { runPentest } = await import('./pentest.js');
-            const out = await runPentest(cfg(), tool, target, true, () => { });
+            const out = await runPentest(cfg(), tool, target, true, () => { }, _auth);
             if (!out?.ok) {
                 const reason = out?.reason || out?.plan?.reason || 'error';
                 const tip = reason === 'trust_required' ? ' (Doğrulanmış Araştırmacı / seviye 3+ gerekir: /dogrula)'
@@ -807,7 +837,7 @@ async function execOne(call, hooks) {
             }
             const rep = out.report || {};
             const f = rep.findings || [];
-            let txt = `Tarama tamam (${tool}) — ${rep.target || target}\n`;
+            let txt = `Tarama tamam (${tool}) — ${rep.target || target}${_loginNote}\n`;
             if (!f.length)
                 txt += 'Zafiyet bulunamadı (hedef temiz ya da yanıt vermedi).';
             else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.181",
+  "version": "1.0.183",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {