wormclaude 1.0.184 → 1.0.186

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.184';
+export const VERSION = '1.0.186';

package/dist/tools.js

@@ -230,7 +230,7 @@ export const toolSchemas = [
             parameters: {
                 type: 'object',
                 properties: {
-                    tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan'], description: 'full → tam kapsamlı (recon+xss+sqli tek seferde, kapsamlı tarama için BUNU kullan); recon/scan/dirscan → domain; xss/sqli → parameterized URL' },
+                    tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor'], description: 'full → tam kapsamlı (recon+dirscan+xss+sqli+idor + tüm şablonlar tek seferde, kapsamlı için BUNU kullan); recon/scan/dirscan → domain; xss/sqli/idor → parameterized URL (idor = yetkisiz nesne erişimi, id-benzeri param gerekir)' },
                     target: { type: 'string', description: 'Domain for recon/scan/dirscan (example.com) OR parameterized URL for xss/sqli (https://example.com/p?id=1)' },
                     cookie: { type: 'string', description: 'Optional. Session cookie for AUTHENTICATED / behind-login scanning, e.g. "sessionid=abc123; csrftoken=xyz". The user copies it from their logged-in browser (DevTools → Application → Cookies, or the Cookie request header). Sent only to the target from the user IP — never stored on the server. Provide it whenever the user wants to scan pages behind a login.' },
                     auth_header: { type: 'string', description: 'Optional. Authorization header value for token-based authenticated scanning, e.g. "Bearer eyJhbGci..." or "Basic dXNlcjpwYXNz". Use instead of / together with cookie when the site authenticates via a token header.' },
@@ -737,7 +737,7 @@ async function execOne(call, hooks) {
     if (call.name === 'SecurityScan') {
         let tool = String(args?.tool || '').toLowerCase().trim();
         const target = String(args?.target || '').trim();
-        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'full', 'fullscan'].includes(tool) || !target) {
+        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'full', 'fullscan'].includes(tool) || !target) {
             return { ok: false, output: 'SecurityScan: tool (recon|scan|xss|sqli|dirscan|full) ve target gerekli.', args };
         }
         if (tool === 'scan')
@@ -780,7 +780,7 @@ async function execOne(call, hooks) {
                 const all = [];
                 // PROFESYONEL KAPSAM: çekirdek (recon+dirscan+xss+sqli) + sunucudaki TÜM şablon tarayıcıları
                 // (SSRF/XXE/SSTI/LFI/LDAP/open-redirect/CRLF/graphql/exposed-files/waf-detect …). /fullscan ile aynı.
-                const _steps = ['recon', 'dirscan', 'xss', 'sqli'];
+                const _steps = ['recon', 'dirscan', 'xss', 'sqli', 'idor'];
                 try {
                     const _pt = await fetchPtTools(cfg());
                     for (const tm of ((_pt && _pt.templates) || [])) {
@@ -818,6 +818,31 @@ async function execOne(call, hooks) {
                         rpt += `\n[${_t}] hata: ${e?.message || e}`;
                     }
                 }
+                // TÜM-SUBDOMAIN TARAMASI: recon'un bulduğu alt-alanlarda da xss+sqli koş (sadece root değil →
+                // gerçek saldırı yüzeyi). Cap'li (top 5) + kullanıcı IP'sinden; ölü/erişilemez olan hızlı düşer.
+                const _rootHost = target.toLowerCase().replace(/^https?:\/\//, '').replace(/[/?].*$/, '').replace(/^www\./, '');
+                const _subs = [...new Set(all.filter((x) => x.type === 'subdomain' && x.value)
+                        .map((x) => String(x.value).toLowerCase().trim()))]
+                    .filter((s) => s && !s.startsWith('*') && s.includes('.') && s !== _rootHost && s !== 'www.' + _rootHost)
+                    .slice(0, 5);
+                if (_subs.length && !hooks?.signal?.aborted) {
+                    rpt += `\n\n[subdomain-sweep] ${_subs.length} alt-alan taranıyor (xss+sqli)…`;
+                    for (const _sub of _subs) {
+                        if (hooks?.signal?.aborted)
+                            break;
+                        for (const _st of ['xss', 'sqli']) {
+                            try {
+                                const o2 = await runPentest(cfg(), _st, `https://${_sub}/`, true, () => { }, _auth);
+                                const ff = (o2?.ok ? (o2.report?.findings || []) : []).filter((x) => x.note !== 'no_params');
+                                if (ff.length) {
+                                    all.push(...ff.map((x) => ({ ...x, scan: `${_st}@${_sub}`, subdomain: _sub })));
+                                    rpt += `\n  [${_sub} ${_st}] ${ff.length} bulgu`;
+                                }
+                            }
+                            catch { }
+                        }
+                    }
+                }
                 // no_params spam'ini tekille (her inject tarayıcı bir tane ekliyor)
                 const _np = all.filter((f) => f.note === 'no_params');
                 for (let i = all.length - 1; i >= 0; i--)
@@ -828,13 +853,25 @@ async function execOne(call, hooks) {
                         evidence: `${_np.length} enjeksiyon tarayıcısı test edilebilir GET parametresi bulamadı — girdiler POST form/login-arkası/JS-üretimli olabilir.` });
                 const _sev = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
                 all.sort((a, b) => (_sev[a.severity] ?? 9) - (_sev[b.severity] ?? 9));
+                // CVSS 3.1 taban skoru (yaklaşık, tip-bazlı; yoksa severity-haritası). Profesyonel rapor için.
+                const _CVSS = { sqli: 9.8, nosql: 9.8, 'cmd-injection': 9.8, ssti: 9.4, ssrf: 8.6,
+                    xxe: 8.6, lfi: 8.1, 'ldap-injection': 8.1, 'subdomain-takeover': 8.1, exposure: 7.5, idor: 6.5,
+                    xss: 6.1, 'open-redirect': 6.1, crlf: 6.1, 'host-header': 6.1, cookie_flags: 5.3, cors: 5.3,
+                    reflection: 4.3, weak_headers: 3.1 };
+                const _sevCvss = { critical: 9.5, high: 8.1, medium: 6.1, low: 3.5, info: 0 };
+                const _skipCvss = new Set(['info', 'tech', 'subdomain', 'host']);
+                for (const f of all) {
+                    if (_skipCvss.has(f.type) || f.severity === 'info')
+                        continue;
+                    f.cvss = _CVSS[f.type] ?? _CVSS[String(f.scan || '').split('@')[0]] ?? _sevCvss[f.severity] ?? 0;
+                }
                 if (_wafSeen || /cloudflare|akamai|imperva/i.test(rpt)) {
                     rpt += `\n\n⚠️ WAF/CDN tespit edildi — payload'lar filtrelenmiş olabilir; "temiz" sonuçlar KESİN değil. Kesin sonuç için origin sunucuya (CDN arkası) doğrudan tara.`;
                 }
-                rpt += `\n\nToplam ${all.length} bulgu (${_steps.length} tarayıcı).`;
+                rpt += `\n\nToplam ${all.length} bulgu (${_steps.length} tarayıcı${_subs && _subs.length ? ' + ' + _subs.length + ' alt-alan' : ''}).`;
                 if (all.length)
                     rpt += '\n' + all.slice(0, 80).map((x) => '  ' + JSON.stringify(x)).join('\n');
-                rpt += `\n[full-done] comprehensive scan (${_steps.length} scanners) ran. Do NOT call SecurityScan again — report the findings to the user in text (severity-ordered summary + prioritized fixes), in their language.`;
+                rpt += `\n[full-done] comprehensive scan (${_steps.length} scanners${_subs && _subs.length ? ' + ' + _subs.length + ' subdomains' : ''}) ran. Each finding has a "cvss" base score. Do NOT call SecurityScan again — report to the user in text: severity-ordered summary, include the CVSS score per finding, note subdomain findings, prioritized fixes, in their language.`;
                 const _now = Date.now();
                 _scanCache.set(_fk, { out: rpt, t: _now });
                 for (const _t of ['recon', 'xss', 'sqli', 'dirscan'])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.184",
+  "version": "1.0.186",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {