wormclaude 1.0.193 → 1.0.194

package/dist/commands.js

@@ -62,6 +62,8 @@ export const COMMANDS = [
     { name: '/fullscan', desc: '[seviye 3+] tam kapsamlı DETERMİNİSTİK tarama: recon+XSS+SQLi tek komutta: /fullscan <hedef>' },
     { name: '/audit', desc: 'kaynak kod güvenlik denetimi (SAST — sır/açık/CVE, yerel): /audit [klasör]' },
     { name: '/jwt', desc: 'JWT token güvenlik analizi (alg=none/zayıf-secret/expiry/claim, yerel): /jwt <token>' },
+    { name: '/spray', desc: 'login formuna parola-spray (yetkili test, trust 3+): /spray <login-url> [kullanıcı]' },
+    { name: '/defaultcreds', desc: 'login\'e varsayılan kimlik denemesi (admin/admin vb, trust 3+): /defaultcreds <login-url>' },
     { name: '/exploit', desc: 'yetkili testte doğrulanmış PoC üret: /exploit <cve|açıklama>' },
     { name: '/harden', desc: 'savunma çıktısı üret (YARA/Sigma + yama önerisi): /harden <hedef|tehdit>' },
     { name: '/phish', desc: '[yetkili] phishing simülasyonu: pretext + e-posta şablonu: /phish <hedef|senaryo>' },

package/dist/pentest.js

@@ -243,10 +243,10 @@ async function execReq(req, allowed, auth) {
     }
 }
 // Tam akış: plan al → her round'da istekleri yerelde at → /exec ile analiz ettir → done'a dek döngü.
-export async function runPentest(config, tool, target, scopeAck, log, auth) {
+export async function runPentest(config, tool, target, scopeAck, log, auth, extra) {
     const _authed = !!(auth && (auth.cookie || auth.authHeader || auth.headers));
     // authenticated: SUNUCUYA SADECE BAYRAK gider (login-arkası crawl/POST planlasın diye) — sır/cookie DEĞİL.
-    const plan = await postJson(config, '/pentest/plan', { tool, target, scope_ack: scopeAck, authenticated: _authed }, 15000);
+    const plan = await postJson(config, '/pentest/plan', { tool, target, scope_ack: scopeAck, authenticated: _authed, extra: extra || undefined }, 15000);
     if (!plan.ok)
         return { ok: false, reason: plan.reason, plan };
     const allowed = new Set((plan.allowed_hosts || [plan.host || '']).map((x) => x.toLowerCase()));

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.193';
+export const VERSION = '1.0.194';

package/dist/tools.js

@@ -230,7 +230,7 @@ export const toolSchemas = [
             parameters: {
                 type: 'object',
                 properties: {
-                    tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloudscan'], description: 'full → tam kapsamlı web taraması; recon/scan/dirscan/portscan/osint/cloudscan → domain/host/şirket; xss/sqli/idor → parameterized URL. portscan = TCP port/servis. osint = DNS + e-posta güvenliği (SPF/DMARC). cloudscan = açık bulut bucket keşfi (S3/GCP/Azure — şirket/domain adından aday üretip public erişim test eder; "bucket tara"/"s3 tara"/"açık depolama"/"cloud" denince)' },
+                    tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloudscan', 'spray', 'defaultcreds'], description: 'full → tam kapsamlı web taraması; recon/scan/dirscan/portscan/osint/cloudscan → domain/host/şirket; xss/sqli/idor → parameterized URL. portscan = TCP port/servis. osint = DNS + e-posta güvenliği (SPF/DMARC). cloudscan = açık bulut bucket keşfi (S3/GCP/Azure). spray = login formuna parola-spray (target = login URL, username param ile; "parola dene"/"spray"/"brute" denince, trust 3+). defaultcreds = login\'e varsayılan kimlikler (admin/admin vb.) dene (target = login URL, trust 3+)' },
                     target: { type: 'string', description: 'Domain for recon/scan/dirscan (example.com) OR parameterized URL for xss/sqli (https://example.com/p?id=1)' },
                     cookie: { type: 'string', description: 'Optional. Session cookie for AUTHENTICATED / behind-login scanning, e.g. "sessionid=abc123; csrftoken=xyz". The user copies it from their logged-in browser (DevTools → Application → Cookies, or the Cookie request header). Sent only to the target from the user IP — never stored on the server. Provide it whenever the user wants to scan pages behind a login.' },
                     auth_header: { type: 'string', description: 'Optional. Authorization header value for token-based authenticated scanning, e.g. "Bearer eyJhbGci..." or "Basic dXNlcjpwYXNz". Use instead of / together with cookie when the site authenticates via a token header.' },
@@ -767,7 +767,7 @@ async function execOne(call, hooks) {
     if (call.name === 'SecurityScan') {
         let tool = String(args?.tool || '').toLowerCase().trim();
         const target = String(args?.target || '').trim();
-        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloud', 'cloudscan', 'full', 'fullscan'].includes(tool) || !target) {
+        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloud', 'cloudscan', 'spray', 'credspray', 'defaultcreds', 'full', 'fullscan'].includes(tool) || !target) {
             return { ok: false, output: 'SecurityScan: tool (recon|scan|xss|sqli|dirscan|full) ve target gerekli.', args };
         }
         if (tool === 'scan')
@@ -921,7 +921,8 @@ async function execOne(call, hooks) {
         }
         try {
             const { runPentest } = await import('./pentest.js');
-            const out = await runPentest(cfg(), tool, target, true, () => { }, _auth);
+            const _extra = ['spray', 'credspray', 'defaultcreds'].includes(tool) ? { username: _username || 'admin' } : undefined;
+            const out = await runPentest(cfg(), tool, target, true, () => { }, _auth, _extra);
             if (!out?.ok) {
                 const reason = out?.reason || out?.plan?.reason || 'error';
                 const tip = reason === 'trust_required' ? ' (Doğrulanmış Araştırmacı / seviye 3+ gerekir: /dogrula)'

package/dist/tui.js

@@ -852,6 +852,28 @@ export async function runTui() {
                     runTurn(`JwtAudit aracıyla şu JWT'yi güvenlik için analiz et: ${a}. Bulguları severity-sıralı özetle.`, v);
                     return;
                 }
+                // /spray — login formuna parola-spray (yetkili test); modele SecurityScan tool=spray çağırt
+                if (tok === '/spray') {
+                    const rest = v.slice(tok.length).trim().split(/\s+/);
+                    const url = rest[0] || '';
+                    const usr = rest[1] || 'admin';
+                    if (!url) {
+                        printItem({ kind: 'note', text: 'Kullanım: /spray <login-url> [kullanıcı]' });
+                        return;
+                    }
+                    runTurn(`SecurityScan aracıyla tool=spray, target=${url}, username=${usr} çalıştır (yetkili parola-spray testi). Sonucu özetle.`, v);
+                    return;
+                }
+                // /defaultcreds — login'e varsayılan kimlik denemesi
+                if (tok === '/defaultcreds') {
+                    const a = v.slice(tok.length).trim();
+                    if (!a) {
+                        printItem({ kind: 'note', text: 'Kullanım: /defaultcreds <login-url>' });
+                        return;
+                    }
+                    runTurn(`SecurityScan aracıyla tool=defaultcreds, target=${a} çalıştır (varsayılan kimlik denemesi). Sonucu özetle.`, v);
+                    return;
+                }
                 // /exploit · /harden — aktif tarama değil, model-üretim (PoC / YARA-Sigma) → çerçeveli istemle modele
                 if (tok === '/exploit') {
                     const a = v.slice(tok.length).trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.193",
+  "version": "1.0.194",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {