bingo-ai 6.2.331__tar.gz → 6.2.332__tar.gz

{bingo_ai-6.2.331 → bingo_ai-6.2.332}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bingo-ai
-Version: 6.2.331
+Version: 6.2.332
 Summary: AI-powered red team terminal — Zero-Hallucination · WAF bypass · XSS·Upload·SSRF·OAuth·GraphQL·Smuggling exploit chains · CVE/Exploit KB (trickest+exploitarium) · role-based testing · vuln manager · attack chain · HITL · LLM Orchestrator · multi-model · multi-language
 Author-email: bingook <bingook@users.noreply.github.com>
 License: MIT

{bingo_ai-6.2.331 → bingo_ai-6.2.332}/bingo/__init__.py

@@ -1,2 +1,2 @@
 """Bingo — Hacker-style AI Terminal"""
-__version__ = "6.2.331"
+__version__ = "6.2.332"

{bingo_ai-6.2.331 → bingo_ai-6.2.332}/bingo/ui/terminal.py

@@ -4109,6 +4109,10 @@ class BingoTerminal:
                     if not cmd:
                         output = "[ERROR] No command provided"
                     else:
+                        # v6.2.332: macOS grep -P → grep -E 자동 변환 (BSD grep -P 미지원)
+                        import platform as _plt
+                        if _plt.system() == "Darwin" and "grep" in cmd and "-P" in cmd:
+                            cmd = re.sub(r'(\s-\w*)P\b', lambda m: m.group(1) + 'E', cmd)
                         # Target drift guard: check URLs in bash commands
                         drift_blocked = self._check_target_drift_in_text(cmd)
                         if drift_blocked:
@@ -4237,7 +4241,21 @@ class BingoTerminal:
                             if req_domain != tgt_domain and request_host != target_host:
                                 _session_allowed_http = getattr(self, "_session_allowed_domains", set())
                                 if req_domain in _session_allowed_http or request_host in _session_allowed_http:
-                                    pass  # v6.2.331: 타겟 HTML에서 발견된 허용 도메인
+                                    # v6.2.332: CDN 도메인 — 정적 자산만 허용, API/로그인 차단
+                                    _req_path = parsed.path.lower()
+                                    _req_method = (method or "GET").upper()
+                                    _cdn_api = bool(re.search(r'/api/|/login|/admin|/auth|/user/|/account|/register|/logout|/signin|/signup|/pass|/member', _req_path))
+                                    _cdn_mut = _req_method in ("POST", "PUT", "DELETE", "PATCH")
+                                    if _cdn_api or _cdn_mut:
+                                        output = (
+                                            f"[ERROR] CDN/연관 도메인 API 접근 차단: {request_host}\n"
+                                            f"타겟: {target_url}\n"
+                                            f"CDN 도메인({request_host})은 정적 자산(CSS/JS/img) 조회만 허용됩니다.\n"
+                                            f"API/로그인 테스트는 실제 타겟({target_host})에 직접 수행하세요."
+                                        )
+                                        self.console.print(f"[{THEME['dim']}]  🚫 CDN 도메인 API 차단: {request_host}[/]")
+                                        results.append({"id": tc.id, "name": name, "output": output})
+                                        continue
                                 elif _is_target_ip and self._check_ip_direct_accessible(request_host):
                                     pass  # resolved IP + accessible
                                 elif _is_cf_domain and self._check_ip_direct_accessible(request_host, domain=target_host):
@@ -4275,6 +4293,21 @@ class BingoTerminal:
                             # Check for 198.18.x.x contamination in response
                             if _vpn_spoof and ("198.18." in output or "198.19." in output):
                                 output += "\n\n[WARNING] VPN virtual IP detected in response — may indicate DNS leak"
+                            # v6.2.332: http_request 응답에서 도메인 추출 → _session_allowed_domains
+                            try:
+                                import tldextract as _tld2
+                                _tgt_raw2 = getattr(self, "_current_target", "") or ""
+                                _tgt_host2 = _tgt_raw2.split("//")[-1].split("/")[0]
+                                _tgt_ext2 = _tld2.extract(_tgt_host2)
+                                _tgt_regd2 = f"{_tgt_ext2.domain}.{_tgt_ext2.suffix}" if _tgt_ext2.domain and _tgt_ext2.suffix else _tgt_host2
+                                for _dm2 in re.findall(r'https?://([a-zA-Z0-9][-a-zA-Z0-9.]*\.[a-zA-Z]{2,})', resp.text[:6000]):
+                                    _ext2 = _tld2.extract(_dm2)
+                                    _regd2 = f"{_ext2.domain}.{_ext2.suffix}" if _ext2.domain and _ext2.suffix else _dm2
+                                    if _regd2 and _regd2 != _tgt_regd2:
+                                        self._session_allowed_domains.add(_regd2)
+                                        self._session_allowed_domains.add(_dm2)
+                            except Exception:
+                                pass
                 else:
                     output = f"[ERROR] Unknown tool: {name}"
             except subprocess.TimeoutExpired:
@@ -4395,8 +4428,19 @@ class BingoTerminal:
                 continue
             if req_domain in _OSINT_ALLOWED:
                 continue
-            # v6.2.331: 타겟 HTML/JS에서 발견된 세션 허용 도메인 (CDN, 결제 API 등)
+            # v6.2.332: CDN/연관 도메인 — 정적 자산만 허용, API/로그인 차단
             if req_domain in _session_allowed or found_host in _session_allowed:
+                _full_url = match.group(0)
+                _cdn_path = _full_url.split(found_host, 1)[-1].split("?")[0].lower() if found_host in _full_url else ""
+                _cdn_api = bool(re.search(r'/api/|/login|/admin|/auth|/user/|/account|/register|/logout|/signin|/signup|/pass|/member', _cdn_path))
+                _cdn_post = bool(re.search(r'-X\s*(POST|PUT|DELETE|PATCH)\b|--data\b|--json\b|-d\s+["\'{]', text, re.IGNORECASE))
+                if _cdn_api or _cdn_post:
+                    return (
+                        f"[ERROR] CDN/연관 도메인 API 접근 차단: {found_host}\n"
+                        f"타겟: {self._current_target}\n"
+                        f"CDN 도메인({found_host})은 정적 자산(CSS/JS/img) 조회만 허용됩니다.\n"
+                        f"API/로그인 테스트는 실제 타겟({target_host})에 직접 수행하세요."
+                    )
                 continue
             # CF 도메인: 새 IP가 Host헤더로 origin 검증되면 허용
             if _is_cf_domain and re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', found_host):

{bingo_ai-6.2.331 → bingo_ai-6.2.332}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bingo-ai"
-version = "6.2.331"
+version = "6.2.332"
 description = "AI-powered red team terminal — Zero-Hallucination · WAF bypass · XSS·Upload·SSRF·OAuth·GraphQL·Smuggling exploit chains · CVE/Exploit KB (trickest+exploitarium) · role-based testing · vuln manager · attack chain · HITL · LLM Orchestrator · multi-model · multi-language"
 readme = "README.md"
 requires-python = ">=3.12"