wormclaude 1.0.185 → 1.0.186

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.185';
+export const VERSION = '1.0.186';

package/dist/tools.js

@@ -818,6 +818,31 @@ async function execOne(call, hooks) {
                         rpt += `\n[${_t}] hata: ${e?.message || e}`;
                     }
                 }
+                // TÜM-SUBDOMAIN TARAMASI: recon'un bulduğu alt-alanlarda da xss+sqli koş (sadece root değil →
+                // gerçek saldırı yüzeyi). Cap'li (top 5) + kullanıcı IP'sinden; ölü/erişilemez olan hızlı düşer.
+                const _rootHost = target.toLowerCase().replace(/^https?:\/\//, '').replace(/[/?].*$/, '').replace(/^www\./, '');
+                const _subs = [...new Set(all.filter((x) => x.type === 'subdomain' && x.value)
+                        .map((x) => String(x.value).toLowerCase().trim()))]
+                    .filter((s) => s && !s.startsWith('*') && s.includes('.') && s !== _rootHost && s !== 'www.' + _rootHost)
+                    .slice(0, 5);
+                if (_subs.length && !hooks?.signal?.aborted) {
+                    rpt += `\n\n[subdomain-sweep] ${_subs.length} alt-alan taranıyor (xss+sqli)…`;
+                    for (const _sub of _subs) {
+                        if (hooks?.signal?.aborted)
+                            break;
+                        for (const _st of ['xss', 'sqli']) {
+                            try {
+                                const o2 = await runPentest(cfg(), _st, `https://${_sub}/`, true, () => { }, _auth);
+                                const ff = (o2?.ok ? (o2.report?.findings || []) : []).filter((x) => x.note !== 'no_params');
+                                if (ff.length) {
+                                    all.push(...ff.map((x) => ({ ...x, scan: `${_st}@${_sub}`, subdomain: _sub })));
+                                    rpt += `\n  [${_sub} ${_st}] ${ff.length} bulgu`;
+                                }
+                            }
+                            catch { }
+                        }
+                    }
+                }
                 // no_params spam'ini tekille (her inject tarayıcı bir tane ekliyor)
                 const _np = all.filter((f) => f.note === 'no_params');
                 for (let i = all.length - 1; i >= 0; i--)
@@ -828,13 +853,25 @@ async function execOne(call, hooks) {
                         evidence: `${_np.length} enjeksiyon tarayıcısı test edilebilir GET parametresi bulamadı — girdiler POST form/login-arkası/JS-üretimli olabilir.` });
                 const _sev = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
                 all.sort((a, b) => (_sev[a.severity] ?? 9) - (_sev[b.severity] ?? 9));
+                // CVSS 3.1 taban skoru (yaklaşık, tip-bazlı; yoksa severity-haritası). Profesyonel rapor için.
+                const _CVSS = { sqli: 9.8, nosql: 9.8, 'cmd-injection': 9.8, ssti: 9.4, ssrf: 8.6,
+                    xxe: 8.6, lfi: 8.1, 'ldap-injection': 8.1, 'subdomain-takeover': 8.1, exposure: 7.5, idor: 6.5,
+                    xss: 6.1, 'open-redirect': 6.1, crlf: 6.1, 'host-header': 6.1, cookie_flags: 5.3, cors: 5.3,
+                    reflection: 4.3, weak_headers: 3.1 };
+                const _sevCvss = { critical: 9.5, high: 8.1, medium: 6.1, low: 3.5, info: 0 };
+                const _skipCvss = new Set(['info', 'tech', 'subdomain', 'host']);
+                for (const f of all) {
+                    if (_skipCvss.has(f.type) || f.severity === 'info')
+                        continue;
+                    f.cvss = _CVSS[f.type] ?? _CVSS[String(f.scan || '').split('@')[0]] ?? _sevCvss[f.severity] ?? 0;
+                }
                 if (_wafSeen || /cloudflare|akamai|imperva/i.test(rpt)) {
                     rpt += `\n\n⚠️ WAF/CDN tespit edildi — payload'lar filtrelenmiş olabilir; "temiz" sonuçlar KESİN değil. Kesin sonuç için origin sunucuya (CDN arkası) doğrudan tara.`;
                 }
-                rpt += `\n\nToplam ${all.length} bulgu (${_steps.length} tarayıcı).`;
+                rpt += `\n\nToplam ${all.length} bulgu (${_steps.length} tarayıcı${_subs && _subs.length ? ' + ' + _subs.length + ' alt-alan' : ''}).`;
                 if (all.length)
                     rpt += '\n' + all.slice(0, 80).map((x) => '  ' + JSON.stringify(x)).join('\n');
-                rpt += `\n[full-done] comprehensive scan (${_steps.length} scanners) ran. Do NOT call SecurityScan again — report the findings to the user in text (severity-ordered summary + prioritized fixes), in their language.`;
+                rpt += `\n[full-done] comprehensive scan (${_steps.length} scanners${_subs && _subs.length ? ' + ' + _subs.length + ' subdomains' : ''}) ran. Each finding has a "cvss" base score. Do NOT call SecurityScan again — report to the user in text: severity-ordered summary, include the CVSS score per finding, note subdomain findings, prioritized fixes, in their language.`;
                 const _now = Date.now();
                 _scanCache.set(_fk, { out: rpt, t: _now });
                 for (const _t of ['recon', 'xss', 'sqli', 'dirscan'])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.185",
+  "version": "1.0.186",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {