hackable 1.0.0__py3-none-any.whl

hackable/__init__.py

@@ -0,0 +1,3 @@
+"""hackable: hack yourself before they do."""
+
+__version__ = "1.0.0"

hackable/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    main()

hackable/checks/__init__.py

@@ -0,0 +1,22 @@
+"""Security checks. Each exposes run(base, http) -> list[Finding].
+Injection checks (sqli, xss, open_redirect) also accept an optional third
+argument: discovered (url, [params]) pairs from the crawler."""
+
+from . import cookies, cors, debug, disclosure, exposed_files, headers, methods, open_redirect, rate_limit, robots, securitytxt, sqli, tls, xss
+
+CHECKS = [
+    ("headers", "security headers", headers.run),
+    ("robots", "robots.txt", robots.run),
+    ("disclosure", "version disclosure", disclosure.run),
+    ("exposed_files", "exposed sensitive files", exposed_files.run),
+    ("debug", "debug mode / stack traces", debug.run),
+    ("cors", "CORS misconfiguration", cors.run),
+    ("methods", "dangerous HTTP methods", methods.run),
+    ("cookies", "cookie security flags", cookies.run),
+    ("sqli", "SQL injection", sqli.run),
+    ("xss", "cross-site scripting", xss.run),
+    ("open_redirect", "open redirects", open_redirect.run),
+    ("rate_limit", "login rate limiting", rate_limit.run),
+    ("tls", "TLS / HTTPS", tls.run),
+    ("securitytxt", "security.txt", securitytxt.run),
+]

hackable/checks/cookies.py

@@ -0,0 +1,65 @@
+"""Check that cookies, especially session cookies, carry security flags."""
+
+from ..findings import Finding
+
+FLAG_ADVICE = {
+    "secure": ("medium", "Cookie without the Secure flag",
+               "This cookie can be sent over plain HTTP, where anyone on the "
+               "network can read or steal it.",
+               "Fix: set the Secure attribute so the cookie is only ever "
+               "sent over HTTPS."),
+    "httponly": ("low", "Cookie without the HttpOnly flag",
+                 "JavaScript running in the page can read this cookie, which "
+                 "makes session theft via XSS much easier.",
+                 "Fix: set the HttpOnly attribute so JavaScript cannot read "
+                 "the cookie. This blunts XSS-based session theft."),
+    "samesite": ("low", "Cookie without the SameSite attribute",
+                 "The browser sends this cookie on cross-site requests, which "
+                 "enables cross-site request forgery attacks.",
+                 "Fix: set SameSite=Lax (or Strict) to block the cookie on "
+                 "cross-site requests and reduce CSRF risk."),
+}
+
+
+def _raw_cookies(response):
+    try:
+        return response.raw.headers.getlist("set-cookie")
+    except Exception:
+        pass
+    single = response.headers.get("set-cookie")
+    return [single] if single else []
+
+
+def run(base, http):
+    r = http.get(base + "/")
+    if r is None:
+        return []
+    raw = _raw_cookies(r)
+    if not raw:
+        return []
+
+    is_https = base.startswith("https://")
+    missing = {"secure": [], "httponly": [], "samesite": []}
+    for cookie in raw:
+        parts = [p.strip() for p in cookie.split(";")]
+        name = parts[0].split("=", 1)[0] or "(unnamed)"
+        flags = {p.split("=", 1)[0].lower() for p in parts[1:]}
+        for flag in missing:
+            if flag == "secure" and not is_https:
+                continue  # Secure only makes sense over HTTPS
+            if flag not in flags:
+                missing[flag].append(name)
+
+    findings = []
+    for flag, names in missing.items():
+        if not names:
+            continue
+        severity, title, meaning, fix = FLAG_ADVICE[flag]
+        findings.append(Finding(
+            check="cookies", severity=severity,
+            title=f"{title}: {', '.join(names[:3])}",
+            meaning=meaning,
+            url=base + "/", evidence=f"Set-Cookie flags seen: {flag} missing",
+            fix=fix,
+        ))
+    return findings

hackable/checks/cors.py

@@ -0,0 +1,68 @@
+"""CORS misconfiguration."""
+
+from ..findings import Finding
+
+EVIL = "https://evil-hackable-test.example.com"
+
+
+def _check_response(r):
+    acao = r.headers.get("Access-Control-Allow-Origin", "")
+    acac = r.headers.get("Access-Control-Allow-Credentials", "").lower() == "true"
+    if acao == EVIL and acac:
+        return "critical"
+    if acao == EVIL or (acao == "*" and acac):
+        return "high"
+    if acao == "*":
+        return "info"
+    return None
+
+
+def run(base, http):
+    r = http.options(base + "/", headers={"Origin": EVIL})
+    verdict = _check_response(r) if r is not None else None
+    if verdict is None:
+        r = http.get(base + "/", headers={"Origin": EVIL})
+        verdict = _check_response(r) if r is not None else None
+    if verdict is None:
+        return []
+    if verdict == "critical":
+        return [
+            Finding(
+                check="cors",
+                severity="critical",
+                title="Any website can make authenticated requests as your users",
+                meaning="Your server tells browsers that evil-hackable-test.example.com "
+                "may read responses AND send the victim's cookies along. A malicious "
+                "site can silently act as your logged-in users.",
+                fix="Never reflect arbitrary origins with Access-Control-Allow-Credentials. "
+                "Use an explicit allowlist of your own domains.",
+                evidence="Access-Control-Allow-Origin: %s + Allow-Credentials: true" % EVIL,
+                url=base + "/",
+            )
+        ]
+    if verdict == "high":
+        return [
+            Finding(
+                check="cors",
+                severity="high",
+                title="CORS trusts arbitrary websites",
+                meaning="Your server accepts cross-origin requests from any site I "
+                "named. Depending on your auth model, a malicious page could read "
+                "private API responses.",
+                fix="Replace the wildcard/reflected origin with an explicit allowlist "
+                "of domains you own.",
+                url=base + "/",
+            )
+        ]
+    return [
+        Finding(
+            check="cors",
+            severity="info",
+            title="CORS allows any origin (no credentials)",
+            meaning="Any website can read your public API responses. That is fine for "
+            "public data, but double-check nothing private is served this way.",
+            fix="If all responses are public, no action needed. Otherwise restrict "
+            "Access-Control-Allow-Origin to your own domains.",
+            url=base + "/",
+        )
+    ]

hackable/checks/debug.py

@@ -0,0 +1,43 @@
+"""Debug mode / stack traces exposed on error pages."""
+
+import secrets
+
+from ..findings import Finding
+
+MARKERS = [
+    "traceback (most recent call last)",
+    "django.core.exceptions",
+    "werkzeug.debug",
+    "raise valueerror",
+    'at ".rb:',
+    ".java:",
+    "system.nullreferenceexception",
+    "stack trace:",
+    "#0 ",
+    "fatal error:",
+]
+
+
+def run(base, http):
+    probe = "/hackable-probe-" + secrets.token_hex(4)
+    r = http.get(base + probe)
+    if r is None:
+        return []
+    body = r.text.lower()
+    hits = [m for m in MARKERS if m in body]
+    if not hits:
+        return []
+    return [
+        Finding(
+            check="debug",
+            severity="high",
+            title="Error pages leak stack traces",
+            meaning="Your 404 page shows internal error details (matched: %s). Stack "
+            "traces reveal file paths, library versions and code structure, which "
+            "is exactly what an attacker needs to aim." % ", ".join(hits[:3]),
+            fix="Turn off debug mode in production and serve a generic error page "
+            "that reveals nothing internal. Log the details server-side instead.",
+            evidence=r.text.strip().replace("\n", " ")[:160],
+            url=base + probe,
+        )
+    ]

hackable/checks/disclosure.py

@@ -0,0 +1,36 @@
+"""Software version disclosure in response headers."""
+
+import re
+
+from ..findings import Finding
+
+VERSION_RE = re.compile(r"\d+\.\d+")
+
+INTERESTING = ("server", "x-powered-by", "x-aspnet-version", "x-generator")
+
+
+def run(base, http):
+    r = http.get(base + "/")
+    if r is None:
+        return []
+    leaked = []
+    for name in INTERESTING:
+        value = r.headers.get(name)
+        if value and VERSION_RE.search(value):
+            leaked.append("%s: %s" % (name, value.strip()))
+    if not leaked:
+        return []
+    return [
+        Finding(
+            check="disclosure",
+            severity="low",
+            title="Server software versions are public",
+            meaning="Your server announces exactly what it runs (%s). Attackers search "
+            "for old versions with known holes, so this tells them where to aim."
+            % "; ".join(leaked),
+            fix="Hide or genericize the Server and X-Powered-By headers in your web "
+            "server config. More importantly, keep the software itself updated.",
+            evidence="; ".join(leaked),
+            url=base + "/",
+        )
+    ]

hackable/checks/exposed_files.py

@@ -0,0 +1,122 @@
+"""Sensitive files accidentally left public."""
+
+from ..findings import Finding
+
+
+def _looks_like_env(text):
+    t = text.strip()
+    if "<html" in t.lower()[:500]:
+        return False
+    return "=" in t and any(
+        k in t for k in ("KEY", "SECRET", "PASSWORD", "TOKEN", "DATABASE_URL")
+    )
+
+
+def _looks_like_git_head(text):
+    return text.strip().startswith("ref:")
+
+
+def _looks_like_git_config(text):
+    return "[core]" in text and "repositoryformatversion" in text
+
+
+def _looks_like_apache_status(text):
+    return "Apache Status" in text
+
+
+def _looks_like_wp_config(text):
+    return "DB_PASSWORD" in text
+
+
+def _looks_like_ds_store(raw):
+    return raw[:8].startswith(b"\x00\x01Bud") or raw[:4] == b"Bud1"
+
+
+TARGETS = [
+    (
+        "/.env",
+        "critical",
+        lambda text, raw: _looks_like_env(text),
+        "Your /.env file is public",
+        "This file usually holds database passwords, API keys and app secrets. "
+        "Anyone on the internet can now read them and log in as you.",
+        "Block /.env (and /.env.*) in your web server config immediately, then "
+        "rotate every secret that was inside it. They are all compromised.",
+    ),
+    (
+        "/.env.bak",
+        "critical",
+        lambda text, raw: _looks_like_env(text),
+        "A backup of your .env file is public",
+        "Same as a public /.env: every secret in it is now in attacker hands.",
+        "Delete the backup file from the server and rotate every secret in it.",
+    ),
+    (
+        "/.git/HEAD",
+        "critical",
+        lambda text, raw: _looks_like_git_head(text),
+        "Your .git directory is public",
+        "Attackers can download your entire source code, including old commits "
+        "that may contain secrets you later deleted.",
+        "Block /.git/ in your web server config or stop deploying the .git "
+        "directory to production.",
+    ),
+    (
+        "/.git/config",
+        "high",
+        lambda text, raw: _looks_like_git_config(text),
+        "Your git config is public",
+        "This confirms your repository internals are exposed and often leads to "
+        "full source disclosure.",
+        "Block /.git/ in your web server config.",
+    ),
+    (
+        "/server-status",
+        "high",
+        lambda text, raw: _looks_like_apache_status(text),
+        "Apache server-status page is public",
+        "It shows live requests, client IPs and server internals. Useful for you, "
+        "more useful for an attacker mapping your app.",
+        "Restrict /server-status to localhost in your Apache config.",
+    ),
+    (
+        "/wp-config.php.bak",
+        "critical",
+        lambda text, raw: _looks_like_wp_config(text),
+        "A WordPress config backup is public",
+        "It contains your database username and password in plain text.",
+        "Delete the backup file and change the database password.",
+    ),
+    (
+        "/.DS_Store",
+        "low",
+        lambda text, raw: _looks_like_ds_store(raw),
+        ".DS_Store file is public",
+        "A macOS metadata file. It can reveal file and folder names on your server.",
+        "Stop deploying .DS_Store files; add them to .gitignore.",
+    ),
+]
+
+
+def run(base, http):
+    findings = []
+    for path, severity, signature, title, meaning, fix in TARGETS:
+        r = http.get(base + path)
+        if r is None or r.status_code != 200:
+            continue
+        try:
+            if signature(r.text, r.content):
+                findings.append(
+                    Finding(
+                        check="exposed_files",
+                        severity=severity,
+                        title=title,
+                        meaning=meaning,
+                        fix=fix,
+                        evidence=r.text.strip().replace("\n", " ")[:120],
+                        url=base + path,
+                    )
+                )
+        except Exception:
+            continue
+    return findings

hackable/checks/headers.py

@@ -0,0 +1,70 @@
+"""Missing security headers."""
+
+from ..findings import Finding
+
+WANTED = [
+    (
+        "strict-transport-security",
+        "medium",
+        "No HSTS header",
+        "Without HSTS, a visitor on public Wi-Fi can be silently downgraded from "
+        "HTTPS to plain HTTP, and everything they type can be read.",
+        "Send Strict-Transport-Security: max-age=31536000 on every HTTPS response.",
+    ),
+    (
+        "content-security-policy",
+        "low",
+        "No Content-Security-Policy header",
+        "CSP is a seatbelt against cross-site scripting: it tells browsers which "
+        "scripts are allowed to run. Without it, one injected script runs anywhere.",
+        "Add a Content-Security-Policy header that only allows scripts from your own domain.",
+    ),
+    (
+        "x-frame-options",
+        "low",
+        "No X-Frame-Options header",
+        "Without it, an attacker can embed your site invisibly inside theirs and "
+        "trick visitors into clicking things they cannot see (clickjacking).",
+        "Send X-Frame-Options: DENY, or use frame-ancestors in your CSP.",
+    ),
+    (
+        "x-content-type-options",
+        "low",
+        "No X-Content-Type-Options header",
+        "Browsers may guess a file's type and execute it. An uploaded 'image' could "
+        "be run as a script.",
+        "Send X-Content-Type-Options: nosniff on every response.",
+    ),
+    (
+        "referrer-policy",
+        "info",
+        "No Referrer-Policy header",
+        "Browsers may leak full page URLs (sometimes containing tokens or private "
+        "IDs) to third-party sites when visitors click links.",
+        "Send Referrer-Policy: strict-origin-when-cross-origin or stricter.",
+    ),
+]
+
+
+def run(base, http):
+    findings = []
+    r = http.get(base + "/")
+    if r is None:
+        return findings
+    present = {k.lower() for k in r.headers}
+    is_https = base.startswith("https://")
+    for header, severity, title, meaning, fix in WANTED:
+        if header == "strict-transport-security" and not is_https:
+            continue  # covered by the TLS check instead
+        if header not in present:
+            findings.append(
+                Finding(
+                    check="headers",
+                    severity=severity,
+                    title=title,
+                    meaning=meaning,
+                    fix=fix,
+                    url=base + "/",
+                )
+            )
+    return findings

hackable/checks/methods.py

@@ -0,0 +1,28 @@
+"""Dangerous HTTP methods (TRACE/TRACK)."""
+
+from ..findings import Finding
+
+
+def run(base, http):
+    r = http.options(base + "/")
+    if r is None:
+        return []
+    allow = r.headers.get("allow", "")
+    methods = {m.strip().upper() for m in allow.split(",") if m.strip()}
+    bad = sorted(m for m in ("TRACE", "TRACK") if m in methods)
+    if not bad:
+        return []
+    return [
+        Finding(
+            check="methods",
+            severity="medium",
+            title="Risky HTTP methods enabled (%s)" % ", ".join(bad),
+            meaning="The TRACE method lets an attacker bounce requests off your server "
+            "to steal cookies and auth headers (cross-site tracing), bypassing the "
+            "protections browsers put on JavaScript.",
+            fix="Disable TRACE/TRACK in your web server config. You almost certainly "
+            "do not use them.",
+            evidence="Allow: " + allow,
+            url=base + "/",
+        )
+    ]

hackable/checks/open_redirect.py

@@ -0,0 +1,57 @@
+"""Open redirect probes."""
+
+from ..findings import Finding
+
+EVIL = "https://evil-hackable-test.example.com/"
+
+CANDIDATES = [
+    ("/goto", "next"),
+    ("/redirect", "next"),
+    ("/login", "next"),
+    ("", "next"),
+    ("/goto", "redirect"),
+    ("/go", "url"),
+    ("", "redirect"),
+    ("/callback", "returnUrl"),
+]
+
+
+def _pairs(base, targets):
+    pairs, seen = [], set()
+    for url, params in (targets or [])[:8]:
+        for param in params[:3]:
+            key = (url, param)
+            if key not in seen:
+                seen.add(key)
+                pairs.append(key)
+    for path, param in CANDIDATES:
+        key = (base + path, param)
+        if key not in seen:
+            seen.add(key)
+            pairs.append(key)
+    return pairs[:14]
+
+
+def run(base, http, targets=None):
+    for url, param in _pairs(base, targets):
+        path = url.replace(base, "") or "/"
+        r = http.get(url, params={param: EVIL}, allow_redirects=False)
+        if r is None:
+            continue
+        location = r.headers.get("location", "")
+        if r.status_code in (301, 302, 303, 307, 308) and "evil-hackable-test" in location:
+            return [
+                Finding(
+                    check="open_redirect",
+                    severity="high",
+                    title="Open redirect in %s" % (path or "/"),
+                    meaning="Your site happily redirects visitors to any address I "
+                    "name, including an attacker's. Phishing emails love this: the "
+                    "link shows YOUR domain, but lands on THEIR fake login page.",
+                    fix="Only redirect to relative paths or an allowlist of your "
+                    "own domains. Reject anything starting with http or //.",
+                    evidence="Location: %s" % location[:120],
+                    url=url + "?%s=%s" % (param, EVIL),
+                )
+            ]
+    return []

hackable/checks/rate_limit.py

@@ -0,0 +1,53 @@
+"""Login rate-limiting probe (gentle: 10 attempts, wrong creds)."""
+
+from ..findings import Finding
+
+ENDPOINTS = ["/login", "/signin", "/auth/login", "/api/login", "/admin/login", "/users/sign_in"]
+
+
+def run(base, http):
+    login_url = None
+    for path in ENDPOINTS:
+        r = http.get(base + path)
+        if r is not None and r.status_code in (200, 401, 403, 405):
+            login_url = base + path
+            break
+    if login_url is None:
+        return []
+    blocked = 0
+    attempts = 10
+    for _ in range(attempts):
+        r = http.post(
+            login_url,
+            data={"username": "hackable-probe", "password": "wrong-password"},
+        )
+        if r is None:
+            break
+        if r.status_code in (429, 403):
+            blocked += 1
+    if blocked:
+        return [
+            Finding(
+                check="rate_limit",
+                severity="info",
+                title="Login rate limiting appears active",
+                meaning="After a few wrong passwords the server pushed back (%d of %d "
+                "attempts blocked). That is what you want." % (blocked, attempts),
+                fix="No action needed. Keep it.",
+                url=login_url,
+            )
+        ]
+    return [
+        Finding(
+            check="rate_limit",
+            severity="medium",
+            title="No rate limiting on the login page",
+            meaning="I tried 10 wrong passwords as fast as I could and nobody stopped "
+            "me. An attacker can try millions: common passwords, leaked passwords, "
+            "until one works.",
+            fix="Throttle login attempts (a few tries, then growing delays or a "
+            "temporary lockout), add a CAPTCHA after failures, and alert on bursts.",
+            evidence="%d rapid attempts, none blocked" % attempts,
+            url=login_url,
+        )
+    ]

hackable/checks/robots.py

@@ -0,0 +1,31 @@
+"""Interesting paths leaked via robots.txt."""
+
+from ..findings import Finding
+
+
+def run(base, http):
+    r = http.get(base + "/robots.txt")
+    if r is None or r.status_code != 200:
+        return []
+    lines = [
+        line.split(":", 1)[1].strip()
+        for line in r.text.splitlines()
+        if line.lower().startswith("disallow:") and line.split(":", 1)[1].strip()
+    ]
+    if not lines:
+        return []
+    shown = ", ".join(lines[:5])
+    return [
+        Finding(
+            check="robots",
+            severity="low",
+            title="robots.txt lists hidden paths",
+            meaning="Your robots.txt names %d path(s) you asked search engines to ignore "
+            "(%s). Attackers read this file too: it is a map of where you keep the "
+            "interesting things." % (len(lines), shown),
+            fix="Assume every path in robots.txt is public. If something must stay "
+            "hidden, protect it with a login instead of relying on robots.txt.",
+            evidence=shown,
+            url=base + "/robots.txt",
+        )
+    ]

hackable/checks/securitytxt.py

@@ -0,0 +1,21 @@
+"""Check for a security.txt file so researchers can report vulnerabilities."""
+
+from ..findings import Finding
+
+
+def run(base, http):
+    for path in ("/.well-known/security.txt", "/security.txt"):
+        r = http.get(base + path)
+        if r is not None and r.status_code == 200 and "contact" in r.text.lower():
+            return []
+    return [Finding(
+        check="securitytxt", severity="info",
+        title="No security.txt file",
+        meaning="There is no standard way for a security researcher who finds "
+                "a vulnerability to contact you, so reports may go public "
+                "instead of reaching you first.",
+        url=base + "/.well-known/security.txt",
+        evidence="no file with a Contact: line found",
+        fix="Publish /.well-known/security.txt with a Contact: line so "
+            "security researchers can reach you. See securitytxt.org.",
+    )]