bingo-ai 6.2.332__tar.gz → 6.2.334__tar.gz

{bingo_ai-6.2.332 → bingo_ai-6.2.334}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bingo-ai
-Version: 6.2.332
+Version: 6.2.334
 Summary: AI-powered red team terminal — Zero-Hallucination · WAF bypass · XSS·Upload·SSRF·OAuth·GraphQL·Smuggling exploit chains · CVE/Exploit KB (trickest+exploitarium) · role-based testing · vuln manager · attack chain · HITL · LLM Orchestrator · multi-model · multi-language
 Author-email: bingook <bingook@users.noreply.github.com>
 License: MIT

{bingo_ai-6.2.332 → bingo_ai-6.2.334}/bingo/__init__.py

@@ -1,2 +1,2 @@
 """Bingo — Hacker-style AI Terminal"""
-__version__ = "6.2.332"
+__version__ = "6.2.334"

{bingo_ai-6.2.332 → bingo_ai-6.2.334}/bingo/tools/function_schema.py

@@ -60,9 +60,9 @@ PYTHON_EXEC = {
 HTTP_REQUEST = {
     "name": "http_request",
     "description": (
-        "Send a structured HTTP request and return full response with headers. "
-        "Use when you need precise control over method, headers, body, and "
-        "want structured response parsing (status, headers dict, body)."
+        "Send an HTTP request to the TARGET and return full response with headers. "
+        "Provide only the path — the target domain is automatically prepended by the executor. "
+        "Use when you need precise control over method, headers, body."
     ),
     "parameters": {
         "type": "object",
@@ -72,9 +72,9 @@ HTTP_REQUEST = {
                 "enum": ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"],
                 "description": "HTTP method",
             },
-            "url": {
+            "path": {
                 "type": "string",
-                "description": "Full URL to request",
+                "description": "Request path on the target (e.g. /api/login, /admin/)",
             },
             "headers": {
                 "type": "object",
@@ -96,7 +96,7 @@ HTTP_REQUEST = {
                 "default": 30,
             },
         },
-        "required": ["method", "url"],
+        "required": ["method", "path"],
     },
 }
 

{bingo_ai-6.2.332 → bingo_ai-6.2.334}/bingo/ui/terminal.py

@@ -4113,13 +4113,8 @@ class BingoTerminal:
                         import platform as _plt
                         if _plt.system() == "Darwin" and "grep" in cmd and "-P" in cmd:
                             cmd = re.sub(r'(\s-\w*)P\b', lambda m: m.group(1) + 'E', cmd)
-                        # Target drift guard: check URLs in bash commands
-                        drift_blocked = self._check_target_drift_in_text(cmd)
-                        if drift_blocked:
-                            output = drift_blocked
-                            self.console.print(f"[{THEME['dim']}]  🚫 Target drift blocked in bash_exec[/]")
-                            results.append({"id": tc.id, "name": name, "output": output})
-                            continue
+                        # v6.2.333: drift 차단이 아닌 자동 교정 — URL 도메인을 타겟으로 치환
+                        cmd = self._rewrite_urls_to_target(cmd)
                         # VPN DNS bypass: rewrite curl/wget/dig commands to use external DNS
                         if _vpn_spoof:
                             cmd = self._rewrite_dns_commands(cmd)
@@ -4164,13 +4159,8 @@ class BingoTerminal:
                     if not code:
                         output = "[ERROR] No code provided"
                     else:
-                        # Target drift guard: check URLs in python code
-                        drift_blocked = self._check_target_drift_in_text(code)
-                        if drift_blocked:
-                            output = drift_blocked
-                            self.console.print(f"[{THEME['dim']}]  🚫 Target drift blocked in python_exec[/]")
-                            results.append({"id": tc.id, "name": name, "output": output})
-                            continue
+                        # v6.2.333: drift 차단 → 자동 교정 (URL 도메인을 타겟으로 치환)
+                        code = self._rewrite_urls_to_target(code)
                         # VPN DNS leak guard: block hardcoded 198.18.x.x IPs in python code
                         if _vpn_spoof:
                             # Remove line comments before checking
@@ -4210,79 +4200,45 @@ class BingoTerminal:
                             output += "\n\n[WARNING] VPN virtual IP detected in output — DNS leak detected"
                 elif name == "http_request":
                     import httpx as _httpx
+                    import re
+                    from urllib.parse import urlparse, urlunparse
                     method = args.get("method", "GET")
-                    url = args.get("url", "")
+                    # v6.2.333: executor-owned URL — model provides path only, executor binds target
+                    path = args.get("path", "")
+                    _legacy_url = args.get("url", "")
+                    if not path and _legacy_url:
+                        _lp = urlparse(_legacy_url)
+                        path = _lp.path + (f"?{_lp.query}" if _lp.query else "")
+                    if not path:
+                        path = "/"
+                    if not path.startswith("/"):
+                        path = "/" + path
                     headers = args.get("headers") or {}
                     body = args.get("body")
                     follow = args.get("follow_redirects", False)
-                    # POST requests to WAF-protected endpoints often hang — use shorter timeout
                     default_timeout = 10 if method in ("POST", "PUT", "PATCH") else 30
                     timeout = args.get("timeout", default_timeout)
-                    if not url:
-                        output = "[ERROR] No URL provided"
+                    target_raw = getattr(self, "_current_target", "")
+                    if not target_raw:
+                        output = "[ERROR] No target set — use /target first"
                     else:
-                        # Target drift guard: block requests to different domains
-                        import re
-                        from urllib.parse import urlparse
-                        import tldextract
+                        _tp = urlparse(target_raw if target_raw.startswith("http") else f"https://{target_raw}")
+                        _target_host = _tp.hostname or ""
+                        _target_scheme = _tp.scheme or "https"
+                        url = f"{_target_scheme}://{_target_host}{path}"
                         parsed = urlparse(url)
-                        request_host = parsed.hostname or ""
-                        target_url = getattr(self, "_current_target", "")
-                        if target_url:
-                            target_parsed = urlparse(target_url if target_url.startswith("http") else f"http://{target_url}")
-                            target_host = target_parsed.hostname or ""
-                            req_ext = tldextract.extract(request_host)
-                            tgt_ext = tldextract.extract(target_host)
-                            req_domain = f"{req_ext.domain}.{req_ext.suffix}" if req_ext.domain and req_ext.suffix else request_host
-                            tgt_domain = f"{tgt_ext.domain}.{tgt_ext.suffix}" if tgt_ext.domain and tgt_ext.suffix else target_host
-                            _resolved_ip = getattr(self, "_target_resolved_ip", None)
-                            _is_target_ip = (request_host == _resolved_ip) if _resolved_ip else False
-                            _is_cf_domain = bool(_resolved_ip and self._is_cf_ip(_resolved_ip))
-                            if req_domain != tgt_domain and request_host != target_host:
-                                _session_allowed_http = getattr(self, "_session_allowed_domains", set())
-                                if req_domain in _session_allowed_http or request_host in _session_allowed_http:
-                                    # v6.2.332: CDN 도메인 — 정적 자산만 허용, API/로그인 차단
-                                    _req_path = parsed.path.lower()
-                                    _req_method = (method or "GET").upper()
-                                    _cdn_api = bool(re.search(r'/api/|/login|/admin|/auth|/user/|/account|/register|/logout|/signin|/signup|/pass|/member', _req_path))
-                                    _cdn_mut = _req_method in ("POST", "PUT", "DELETE", "PATCH")
-                                    if _cdn_api or _cdn_mut:
-                                        output = (
-                                            f"[ERROR] CDN/연관 도메인 API 접근 차단: {request_host}\n"
-                                            f"타겟: {target_url}\n"
-                                            f"CDN 도메인({request_host})은 정적 자산(CSS/JS/img) 조회만 허용됩니다.\n"
-                                            f"API/로그인 테스트는 실제 타겟({target_host})에 직접 수행하세요."
-                                        )
-                                        self.console.print(f"[{THEME['dim']}]  🚫 CDN 도메인 API 차단: {request_host}[/]")
-                                        results.append({"id": tc.id, "name": name, "output": output})
-                                        continue
-                                elif _is_target_ip and self._check_ip_direct_accessible(request_host):
-                                    pass  # resolved IP + accessible
-                                elif _is_cf_domain and self._check_ip_direct_accessible(request_host, domain=target_host):
-                                    pass  # CF domain: origin IP verified via Host header
-                                else:
-                                    _reason = "IP direct access blocked (domain-binding)" if _is_target_ip else "Target drift blocked"
-                                    output = f"[ERROR] {_reason}: {url}\nSession target: {target_url}\nAttempted: {request_host} ({req_domain})\nAllowed: {target_host} ({tgt_domain})"
-                                    self.console.print(f"[{THEME['dim']}]  🚫 {_reason}: {request_host}[/]")
-                                    results.append({"id": tc.id, "name": name, "output": output})
-                                    continue
                         self.console.print(
                             f"[{THEME['dim']}]  ⚙ http_request: {method} {url[:100]}[/]"
                         )
-                        # VPN DNS bypass: resolve via external DNS and replace hostname with real IP
+                        # VPN DNS bypass: resolve via external DNS
                         if _vpn_spoof:
-                            from urllib.parse import urlunparse
-                            original_host = parsed.hostname
-                            if original_host:
-                                real_ip = self._resolve_via_external_dns(original_host)
-                                if real_ip:
-                                    # Replace hostname with real IP
-                                    netloc = real_ip
-                                    if parsed.port:
-                                        netloc = f"{real_ip}:{parsed.port}"
-                                    url = urlunparse((parsed.scheme, netloc, parsed.path, parsed.params, parsed.query, parsed.fragment))
-                                    # Preserve original Host header for virtual hosting
-                                    headers["Host"] = original_host
+                            real_ip = self._resolve_via_external_dns(_target_host)
+                            if real_ip:
+                                netloc = real_ip
+                                if parsed.port:
+                                    netloc = f"{real_ip}:{parsed.port}"
+                                url = urlunparse((parsed.scheme, netloc, parsed.path, parsed.params, parsed.query, parsed.fragment))
+                                headers["Host"] = _target_host
                         with _httpx.Client(
                             verify=False, timeout=timeout,
                             follow_redirects=follow,
@@ -4290,16 +4246,13 @@ class BingoTerminal:
                             resp = client.request(method, url, headers=headers, content=body)
                             resp_headers = "\n".join(f"{k}: {v}" for k, v in resp.headers.items())
                             output = f"HTTP/{resp.http_version} {resp.status_code}\n{resp_headers}\n\n{resp.text[:6000]}"
-                            # Check for 198.18.x.x contamination in response
                             if _vpn_spoof and ("198.18." in output or "198.19." in output):
-                                output += "\n\n[WARNING] VPN virtual IP detected in response — may indicate DNS leak"
-                            # v6.2.332: http_request 응답에서 도메인 추출 → _session_allowed_domains
+                                output += "\n\n[WARNING] VPN virtual IP detected in response — DNS leak"
+                            # 응답에서 발견된 연관 도메인 등록 (CDN 정적자산 용도)
                             try:
                                 import tldextract as _tld2
-                                _tgt_raw2 = getattr(self, "_current_target", "") or ""
-                                _tgt_host2 = _tgt_raw2.split("//")[-1].split("/")[0]
-                                _tgt_ext2 = _tld2.extract(_tgt_host2)
-                                _tgt_regd2 = f"{_tgt_ext2.domain}.{_tgt_ext2.suffix}" if _tgt_ext2.domain and _tgt_ext2.suffix else _tgt_host2
+                                _tgt_ext2 = _tld2.extract(_target_host)
+                                _tgt_regd2 = f"{_tgt_ext2.domain}.{_tgt_ext2.suffix}" if _tgt_ext2.domain and _tgt_ext2.suffix else _target_host
                                 for _dm2 in re.findall(r'https?://([a-zA-Z0-9][-a-zA-Z0-9.]*\.[a-zA-Z]{2,})', resp.text[:6000]):
                                     _ext2 = _tld2.extract(_dm2)
                                     _regd2 = f"{_ext2.domain}.{_ext2.suffix}" if _ext2.domain and _ext2.suffix else _dm2
@@ -4389,6 +4342,75 @@ class BingoTerminal:
         self._ip_accessibility_cache = cache
         return result
 
+    def _rewrite_urls_to_target(self, text: str) -> str:
+        """Rewrite non-target URLs to canonical target domain (structural anti-hallucination).
+
+        Instead of BLOCKING drift URLs, REWRITE them so the model's intent (path/method)
+        is preserved but always directed at the actual target. This makes it structurally
+        impossible for drift-domain data to be misattributed as target findings.
+        """
+        if not hasattr(self, "_current_target") or not self._current_target:
+            return text
+        import re
+        from urllib.parse import urlparse
+        import tldextract
+
+        target_parsed = urlparse(self._current_target if self._current_target.startswith("http") else f"https://{self._current_target}")
+        target_host = target_parsed.hostname or ""
+        target_scheme = target_parsed.scheme or "https"
+        tgt_ext = tldextract.extract(target_host)
+        tgt_domain = f"{tgt_ext.domain}.{tgt_ext.suffix}" if tgt_ext.domain and tgt_ext.suffix else target_host
+
+        _OSINT_ALLOWED = {
+            "google.com", "google.co.kr", "bing.com", "shodan.io",
+            "censys.io", "crt.sh", "archive.org", "web.archive.org",
+            "virustotal.com", "urlscan.io", "securitytrails.com",
+            "exploit-db.com", "github.com", "pastebin.com",
+            "dnsdb.info", "bgp.he.net", "whois.domaintools.com",
+        }
+        _session_allowed = getattr(self, "_session_allowed_domains", set())
+        _STATIC_RE = re.compile(r'\.(css|js|png|jpg|jpeg|gif|svg|woff2?|ttf|eot|ico|webp|map)(\?|$|[\s\'"])')
+        _rewritten = []
+
+        url_pattern = r'(https?://)([a-zA-Z0-9][-a-zA-Z0-9.]*[a-zA-Z0-9])(/[^\s\'"<>]*)?'
+
+        def _rewrite(m):
+            scheme = m.group(1)
+            host = m.group(2)
+            path = m.group(3) or ""
+
+            # IP address → rewrite to target domain (웹 공격에 IP 사용 금지)
+            if re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', host):
+                _rewritten.append(host)
+                return f"{target_scheme}://{target_host}{path}"
+
+            req_ext = tldextract.extract(host)
+            req_domain = f"{req_ext.domain}.{req_ext.suffix}" if req_ext.domain and req_ext.suffix else host
+
+            # Target domain → keep
+            if req_domain == tgt_domain or host == target_host:
+                return m.group(0)
+
+            # OSINT tools → keep
+            if req_domain in _OSINT_ALLOWED:
+                return m.group(0)
+
+            # CDN/session-allowed + static file extension → keep
+            if req_domain in _session_allowed or host in _session_allowed:
+                if _STATIC_RE.search(path):
+                    return m.group(0)
+
+            # Everything else → rewrite domain to target
+            _rewritten.append(host)
+            return f"{target_scheme}://{target_host}{path}"
+
+        result = re.sub(url_pattern, _rewrite, text)
+        if _rewritten:
+            unique = set(_rewritten)
+            for h in unique:
+                self.console.print(f"[{THEME['dim']}]  🔄 URL 교정: {h} → {target_host}[/]")
+        return result
+
     def _check_target_drift_in_text(self, text: str) -> str | None:
         """Check if text contains URLs pointing to different domains than session target."""
         if not hasattr(self, "_current_target") or not self._current_target:

{bingo_ai-6.2.332 → bingo_ai-6.2.334}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bingo-ai"
-version = "6.2.332"
+version = "6.2.334"
 description = "AI-powered red team terminal — Zero-Hallucination · WAF bypass · XSS·Upload·SSRF·OAuth·GraphQL·Smuggling exploit chains · CVE/Exploit KB (trickest+exploitarium) · role-based testing · vuln manager · attack chain · HITL · LLM Orchestrator · multi-model · multi-language"
 readme = "README.md"
 requires-python = ">=3.12"