hackable 1.0.0__tar.gz

hackable-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shafqat Mehmood
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

hackable-1.0.0/PKG-INFO

@@ -0,0 +1,104 @@
+Metadata-Version: 2.4
+Name: hackable
+Version: 1.0.0
+Summary: Hack yourself before they do. One-command website security check for people who have never run a security tool.
+Author: Shafqat Mehmood
+License: MIT
+Project-URL: Homepage, https://github.com/Shifu34/hackable
+Keywords: security,pentest,scanner,web,vulnerability,dast
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests
+Dynamic: license-file
+
+# hackable
+
+**Hack yourself before they do.**
+
+One-command website security check for people who have never run a security tool. Point it at your app, and in about ten seconds it tells you, in plain English, how a hacker would break in and exactly how to stop them.
+
+```
+$ pip install hackable
+$ hackable https://myapp.com
+```
+
+![hackable scanning a deliberately vulnerable demo app](demo/demo.gif)
+
+## The problem
+
+Millions of apps are being built with AI right now by people who have never heard of OWASP. The apps work. They also leak database keys, take SQL injection, and let anyone log in as anyone. The existing scanners (ZAP, Nuclei, Burp) are expert tools with expert UX. They might as well be in another language.
+
+hackable is the Let's Encrypt of pentesting: free, one command, plain English.
+
+## What it checks
+
+14 checks. Before probing, hackable crawls your app like a visitor would,
+collecting real links and forms, so injection tests hit your actual inputs
+instead of guessed parameter names.
+
+| Check | What it finds |
+|---|---|
+| SQL injection | Error-based probes plus boolean differential checks (safe, GET-only) |
+| Exposed files | Public `/.env`, `/.git/`, config backups, with content verification (no false alarms from SPA fallbacks) |
+| XSS | Your input reflected unescaped into the page |
+| Open redirects | Your site redirecting visitors to attacker domains |
+| CORS | Arbitrary origins trusted with credentials |
+| Debug mode | Stack traces leaking from error pages |
+| Login rate limiting | 10 rapid wrong passwords, checking for pushback |
+| Security headers | HSTS, CSP, X-Frame-Options, and friends |
+| Cookie flags | Session cookies missing Secure, HttpOnly, or SameSite |
+| TLS | Missing HTTPS, expired certs, ancient TLS versions |
+| Version disclosure | Server headers announcing exact versions |
+| HTTP methods | Risky methods like TRACE |
+| robots.txt | Hidden paths handed to attackers on a plate |
+| security.txt | No standard contact for researchers to report issues |
+
+Every finding comes with **what this means** (one sentence, no jargon) and **how to fix it** (one sentence, actionable). You get a 0-100 score and an A-F grade.
+
+## Output
+
+Terminal report, machine-readable JSON (`--json`), SARIF 2.1.0 for GitHub code
+scanning (`--sarif`), and a self-contained shareable HTML report card
+(`--html report.html`).
+
+```bash
+hackable https://myapp.com --html report.html
+hackable https://myapp.com --fail-under 70   # exit 1 in CI if score < 70
+hackable https://myapp.com --only sqli,xss   # run a subset of checks
+```
+
+## GitHub Action
+
+Drop it into your workflow and every push gets scanned:
+
+```yaml
+- uses: Shifu34/hackable@v1
+  with:
+    target: https://myapp.com
+    fail-under: 70
+```
+
+Results upload to the Security tab automatically.
+
+## Safety
+
+hackable only sends harmless probes: no destructive payloads, no data deletion, no login attempts with real credentials, ~50-150 requests with delays and an identifying User-Agent. It will ask for confirmation before scanning unless you pass `--yes`.
+
+**Only scan apps you own or have explicit permission to test.** Scanning without permission may be illegal.
+
+## Roadmap
+
+- Authenticated scans (test behind a login)
+- JavaScript-rendered app support
+- Scheduled scans with diff alerts
+
+## License
+
+MIT

hackable-1.0.0/README.md

@@ -0,0 +1,84 @@
+# hackable
+
+**Hack yourself before they do.**
+
+One-command website security check for people who have never run a security tool. Point it at your app, and in about ten seconds it tells you, in plain English, how a hacker would break in and exactly how to stop them.
+
+```
+$ pip install hackable
+$ hackable https://myapp.com
+```
+
+![hackable scanning a deliberately vulnerable demo app](demo/demo.gif)
+
+## The problem
+
+Millions of apps are being built with AI right now by people who have never heard of OWASP. The apps work. They also leak database keys, take SQL injection, and let anyone log in as anyone. The existing scanners (ZAP, Nuclei, Burp) are expert tools with expert UX. They might as well be in another language.
+
+hackable is the Let's Encrypt of pentesting: free, one command, plain English.
+
+## What it checks
+
+14 checks. Before probing, hackable crawls your app like a visitor would,
+collecting real links and forms, so injection tests hit your actual inputs
+instead of guessed parameter names.
+
+| Check | What it finds |
+|---|---|
+| SQL injection | Error-based probes plus boolean differential checks (safe, GET-only) |
+| Exposed files | Public `/.env`, `/.git/`, config backups, with content verification (no false alarms from SPA fallbacks) |
+| XSS | Your input reflected unescaped into the page |
+| Open redirects | Your site redirecting visitors to attacker domains |
+| CORS | Arbitrary origins trusted with credentials |
+| Debug mode | Stack traces leaking from error pages |
+| Login rate limiting | 10 rapid wrong passwords, checking for pushback |
+| Security headers | HSTS, CSP, X-Frame-Options, and friends |
+| Cookie flags | Session cookies missing Secure, HttpOnly, or SameSite |
+| TLS | Missing HTTPS, expired certs, ancient TLS versions |
+| Version disclosure | Server headers announcing exact versions |
+| HTTP methods | Risky methods like TRACE |
+| robots.txt | Hidden paths handed to attackers on a plate |
+| security.txt | No standard contact for researchers to report issues |
+
+Every finding comes with **what this means** (one sentence, no jargon) and **how to fix it** (one sentence, actionable). You get a 0-100 score and an A-F grade.
+
+## Output
+
+Terminal report, machine-readable JSON (`--json`), SARIF 2.1.0 for GitHub code
+scanning (`--sarif`), and a self-contained shareable HTML report card
+(`--html report.html`).
+
+```bash
+hackable https://myapp.com --html report.html
+hackable https://myapp.com --fail-under 70   # exit 1 in CI if score < 70
+hackable https://myapp.com --only sqli,xss   # run a subset of checks
+```
+
+## GitHub Action
+
+Drop it into your workflow and every push gets scanned:
+
+```yaml
+- uses: Shifu34/hackable@v1
+  with:
+    target: https://myapp.com
+    fail-under: 70
+```
+
+Results upload to the Security tab automatically.
+
+## Safety
+
+hackable only sends harmless probes: no destructive payloads, no data deletion, no login attempts with real credentials, ~50-150 requests with delays and an identifying User-Agent. It will ask for confirmation before scanning unless you pass `--yes`.
+
+**Only scan apps you own or have explicit permission to test.** Scanning without permission may be illegal.
+
+## Roadmap
+
+- Authenticated scans (test behind a login)
+- JavaScript-rendered app support
+- Scheduled scans with diff alerts
+
+## License
+
+MIT

hackable-1.0.0/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "hackable"
+version = "1.0.0"
+description = "Hack yourself before they do. One-command website security check for people who have never run a security tool."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Shafqat Mehmood" }]
+keywords = ["security", "pentest", "scanner", "web", "vulnerability", "dast"]
+dependencies = ["requests"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security",
+]
+
+[project.urls]
+Homepage = "https://github.com/Shifu34/hackable"
+
+[project.scripts]
+hackable = "hackable.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

hackable-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

hackable-1.0.0/src/hackable/__init__.py

@@ -0,0 +1,3 @@
+"""hackable: hack yourself before they do."""
+
+__version__ = "1.0.0"

hackable-1.0.0/src/hackable/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    main()

hackable-1.0.0/src/hackable/checks/__init__.py

@@ -0,0 +1,22 @@
+"""Security checks. Each exposes run(base, http) -> list[Finding].
+Injection checks (sqli, xss, open_redirect) also accept an optional third
+argument: discovered (url, [params]) pairs from the crawler."""
+
+from . import cookies, cors, debug, disclosure, exposed_files, headers, methods, open_redirect, rate_limit, robots, securitytxt, sqli, tls, xss
+
+CHECKS = [
+    ("headers", "security headers", headers.run),
+    ("robots", "robots.txt", robots.run),
+    ("disclosure", "version disclosure", disclosure.run),
+    ("exposed_files", "exposed sensitive files", exposed_files.run),
+    ("debug", "debug mode / stack traces", debug.run),
+    ("cors", "CORS misconfiguration", cors.run),
+    ("methods", "dangerous HTTP methods", methods.run),
+    ("cookies", "cookie security flags", cookies.run),
+    ("sqli", "SQL injection", sqli.run),
+    ("xss", "cross-site scripting", xss.run),
+    ("open_redirect", "open redirects", open_redirect.run),
+    ("rate_limit", "login rate limiting", rate_limit.run),
+    ("tls", "TLS / HTTPS", tls.run),
+    ("securitytxt", "security.txt", securitytxt.run),
+]

hackable-1.0.0/src/hackable/checks/cookies.py

@@ -0,0 +1,65 @@
+"""Check that cookies, especially session cookies, carry security flags."""
+
+from ..findings import Finding
+
+FLAG_ADVICE = {
+    "secure": ("medium", "Cookie without the Secure flag",
+               "This cookie can be sent over plain HTTP, where anyone on the "
+               "network can read or steal it.",
+               "Fix: set the Secure attribute so the cookie is only ever "
+               "sent over HTTPS."),
+    "httponly": ("low", "Cookie without the HttpOnly flag",
+                 "JavaScript running in the page can read this cookie, which "
+                 "makes session theft via XSS much easier.",
+                 "Fix: set the HttpOnly attribute so JavaScript cannot read "
+                 "the cookie. This blunts XSS-based session theft."),
+    "samesite": ("low", "Cookie without the SameSite attribute",
+                 "The browser sends this cookie on cross-site requests, which "
+                 "enables cross-site request forgery attacks.",
+                 "Fix: set SameSite=Lax (or Strict) to block the cookie on "
+                 "cross-site requests and reduce CSRF risk."),
+}
+
+
+def _raw_cookies(response):
+    try:
+        return response.raw.headers.getlist("set-cookie")
+    except Exception:
+        pass
+    single = response.headers.get("set-cookie")
+    return [single] if single else []
+
+
+def run(base, http):
+    r = http.get(base + "/")
+    if r is None:
+        return []
+    raw = _raw_cookies(r)
+    if not raw:
+        return []
+
+    is_https = base.startswith("https://")
+    missing = {"secure": [], "httponly": [], "samesite": []}
+    for cookie in raw:
+        parts = [p.strip() for p in cookie.split(";")]
+        name = parts[0].split("=", 1)[0] or "(unnamed)"
+        flags = {p.split("=", 1)[0].lower() for p in parts[1:]}
+        for flag in missing:
+            if flag == "secure" and not is_https:
+                continue  # Secure only makes sense over HTTPS
+            if flag not in flags:
+                missing[flag].append(name)
+
+    findings = []
+    for flag, names in missing.items():
+        if not names:
+            continue
+        severity, title, meaning, fix = FLAG_ADVICE[flag]
+        findings.append(Finding(
+            check="cookies", severity=severity,
+            title=f"{title}: {', '.join(names[:3])}",
+            meaning=meaning,
+            url=base + "/", evidence=f"Set-Cookie flags seen: {flag} missing",
+            fix=fix,
+        ))
+    return findings

hackable-1.0.0/src/hackable/checks/cors.py

@@ -0,0 +1,68 @@
+"""CORS misconfiguration."""
+
+from ..findings import Finding
+
+EVIL = "https://evil-hackable-test.example.com"
+
+
+def _check_response(r):
+    acao = r.headers.get("Access-Control-Allow-Origin", "")
+    acac = r.headers.get("Access-Control-Allow-Credentials", "").lower() == "true"
+    if acao == EVIL and acac:
+        return "critical"
+    if acao == EVIL or (acao == "*" and acac):
+        return "high"
+    if acao == "*":
+        return "info"
+    return None
+
+
+def run(base, http):
+    r = http.options(base + "/", headers={"Origin": EVIL})
+    verdict = _check_response(r) if r is not None else None
+    if verdict is None:
+        r = http.get(base + "/", headers={"Origin": EVIL})
+        verdict = _check_response(r) if r is not None else None
+    if verdict is None:
+        return []
+    if verdict == "critical":
+        return [
+            Finding(
+                check="cors",
+                severity="critical",
+                title="Any website can make authenticated requests as your users",
+                meaning="Your server tells browsers that evil-hackable-test.example.com "
+                "may read responses AND send the victim's cookies along. A malicious "
+                "site can silently act as your logged-in users.",
+                fix="Never reflect arbitrary origins with Access-Control-Allow-Credentials. "
+                "Use an explicit allowlist of your own domains.",
+                evidence="Access-Control-Allow-Origin: %s + Allow-Credentials: true" % EVIL,
+                url=base + "/",
+            )
+        ]
+    if verdict == "high":
+        return [
+            Finding(
+                check="cors",
+                severity="high",
+                title="CORS trusts arbitrary websites",
+                meaning="Your server accepts cross-origin requests from any site I "
+                "named. Depending on your auth model, a malicious page could read "
+                "private API responses.",
+                fix="Replace the wildcard/reflected origin with an explicit allowlist "
+                "of domains you own.",
+                url=base + "/",
+            )
+        ]
+    return [
+        Finding(
+            check="cors",
+            severity="info",
+            title="CORS allows any origin (no credentials)",
+            meaning="Any website can read your public API responses. That is fine for "
+            "public data, but double-check nothing private is served this way.",
+            fix="If all responses are public, no action needed. Otherwise restrict "
+            "Access-Control-Allow-Origin to your own domains.",
+            url=base + "/",
+        )
+    ]

hackable-1.0.0/src/hackable/checks/debug.py

@@ -0,0 +1,43 @@
+"""Debug mode / stack traces exposed on error pages."""
+
+import secrets
+
+from ..findings import Finding
+
+MARKERS = [
+    "traceback (most recent call last)",
+    "django.core.exceptions",
+    "werkzeug.debug",
+    "raise valueerror",
+    'at ".rb:',
+    ".java:",
+    "system.nullreferenceexception",
+    "stack trace:",
+    "#0 ",
+    "fatal error:",
+]
+
+
+def run(base, http):
+    probe = "/hackable-probe-" + secrets.token_hex(4)
+    r = http.get(base + probe)
+    if r is None:
+        return []
+    body = r.text.lower()
+    hits = [m for m in MARKERS if m in body]
+    if not hits:
+        return []
+    return [
+        Finding(
+            check="debug",
+            severity="high",
+            title="Error pages leak stack traces",
+            meaning="Your 404 page shows internal error details (matched: %s). Stack "
+            "traces reveal file paths, library versions and code structure, which "
+            "is exactly what an attacker needs to aim." % ", ".join(hits[:3]),
+            fix="Turn off debug mode in production and serve a generic error page "
+            "that reveals nothing internal. Log the details server-side instead.",
+            evidence=r.text.strip().replace("\n", " ")[:160],
+            url=base + probe,
+        )
+    ]

hackable-1.0.0/src/hackable/checks/disclosure.py

@@ -0,0 +1,36 @@
+"""Software version disclosure in response headers."""
+
+import re
+
+from ..findings import Finding
+
+VERSION_RE = re.compile(r"\d+\.\d+")
+
+INTERESTING = ("server", "x-powered-by", "x-aspnet-version", "x-generator")
+
+
+def run(base, http):
+    r = http.get(base + "/")
+    if r is None:
+        return []
+    leaked = []
+    for name in INTERESTING:
+        value = r.headers.get(name)
+        if value and VERSION_RE.search(value):
+            leaked.append("%s: %s" % (name, value.strip()))
+    if not leaked:
+        return []
+    return [
+        Finding(
+            check="disclosure",
+            severity="low",
+            title="Server software versions are public",
+            meaning="Your server announces exactly what it runs (%s). Attackers search "
+            "for old versions with known holes, so this tells them where to aim."
+            % "; ".join(leaked),
+            fix="Hide or genericize the Server and X-Powered-By headers in your web "
+            "server config. More importantly, keep the software itself updated.",
+            evidence="; ".join(leaked),
+            url=base + "/",
+        )
+    ]

hackable-1.0.0/src/hackable/checks/exposed_files.py

@@ -0,0 +1,122 @@
+"""Sensitive files accidentally left public."""
+
+from ..findings import Finding
+
+
+def _looks_like_env(text):
+    t = text.strip()
+    if "<html" in t.lower()[:500]:
+        return False
+    return "=" in t and any(
+        k in t for k in ("KEY", "SECRET", "PASSWORD", "TOKEN", "DATABASE_URL")
+    )
+
+
+def _looks_like_git_head(text):
+    return text.strip().startswith("ref:")
+
+
+def _looks_like_git_config(text):
+    return "[core]" in text and "repositoryformatversion" in text
+
+
+def _looks_like_apache_status(text):
+    return "Apache Status" in text
+
+
+def _looks_like_wp_config(text):
+    return "DB_PASSWORD" in text
+
+
+def _looks_like_ds_store(raw):
+    return raw[:8].startswith(b"\x00\x01Bud") or raw[:4] == b"Bud1"
+
+
+TARGETS = [
+    (
+        "/.env",
+        "critical",
+        lambda text, raw: _looks_like_env(text),
+        "Your /.env file is public",
+        "This file usually holds database passwords, API keys and app secrets. "
+        "Anyone on the internet can now read them and log in as you.",
+        "Block /.env (and /.env.*) in your web server config immediately, then "
+        "rotate every secret that was inside it. They are all compromised.",
+    ),
+    (
+        "/.env.bak",
+        "critical",
+        lambda text, raw: _looks_like_env(text),
+        "A backup of your .env file is public",
+        "Same as a public /.env: every secret in it is now in attacker hands.",
+        "Delete the backup file from the server and rotate every secret in it.",
+    ),
+    (
+        "/.git/HEAD",
+        "critical",
+        lambda text, raw: _looks_like_git_head(text),
+        "Your .git directory is public",
+        "Attackers can download your entire source code, including old commits "
+        "that may contain secrets you later deleted.",
+        "Block /.git/ in your web server config or stop deploying the .git "
+        "directory to production.",
+    ),
+    (
+        "/.git/config",
+        "high",
+        lambda text, raw: _looks_like_git_config(text),
+        "Your git config is public",
+        "This confirms your repository internals are exposed and often leads to "
+        "full source disclosure.",
+        "Block /.git/ in your web server config.",
+    ),
+    (
+        "/server-status",
+        "high",
+        lambda text, raw: _looks_like_apache_status(text),
+        "Apache server-status page is public",
+        "It shows live requests, client IPs and server internals. Useful for you, "
+        "more useful for an attacker mapping your app.",
+        "Restrict /server-status to localhost in your Apache config.",
+    ),
+    (
+        "/wp-config.php.bak",
+        "critical",
+        lambda text, raw: _looks_like_wp_config(text),
+        "A WordPress config backup is public",
+        "It contains your database username and password in plain text.",
+        "Delete the backup file and change the database password.",
+    ),
+    (
+        "/.DS_Store",
+        "low",
+        lambda text, raw: _looks_like_ds_store(raw),
+        ".DS_Store file is public",
+        "A macOS metadata file. It can reveal file and folder names on your server.",
+        "Stop deploying .DS_Store files; add them to .gitignore.",
+    ),
+]
+
+
+def run(base, http):
+    findings = []
+    for path, severity, signature, title, meaning, fix in TARGETS:
+        r = http.get(base + path)
+        if r is None or r.status_code != 200:
+            continue
+        try:
+            if signature(r.text, r.content):
+                findings.append(
+                    Finding(
+                        check="exposed_files",
+                        severity=severity,
+                        title=title,
+                        meaning=meaning,
+                        fix=fix,
+                        evidence=r.text.strip().replace("\n", " ")[:120],
+                        url=base + path,
+                    )
+                )
+        except Exception:
+            continue
+    return findings