narvy-cli 1.0.0__py3-none-any.whl

narvy/web/ssrf_guard.py

@@ -0,0 +1,374 @@
+"""SSRF defense for the web scanner: URL validation, IP pinning, and
+redirect-aware safe fetching.
+"""
+
+import ipaddress
+import os
+import socket
+from typing import List, Optional, Set, Tuple
+from urllib.parse import urlparse, urljoin
+
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.poolmanager import PoolManager
+
+
+def _allowlisted_hosts() -> Set[str]:
+    """Opt-in allowlist of host[:port] entries that bypass the IP blocklist."""
+    raw = os.environ.get('SSRF_GUARD_ALLOW_HOSTS', '')
+    return {h.strip().lower() for h in raw.split(',') if h.strip()}
+
+try:
+    from loguru import logger
+except Exception:  # pragma: no cover - loguru always present in prod
+    import logging
+    logger = logging.getLogger("ssrf_guard")
+
+
+# Blocked by name too: split-horizon DNS can point these at a benign IP.
+METADATA_HOSTNAMES = {
+    'localhost',
+    'metadata.google.internal',
+    'metadata',
+    'instance-data',
+    'instance-data.ec2.internal',
+}
+
+# IPv4 nets the stdlib does not flag but a scanner must never reach.
+_BLOCKED_V4_NETS = (
+    ipaddress.ip_network('100.64.0.0/10'),   # CGNAT / carrier-grade NAT range
+    ipaddress.ip_network('0.0.0.0/8'),       # "this network"
+    ipaddress.ip_network('198.18.0.0/15'),   # benchmarking
+    ipaddress.ip_network('192.0.0.0/24'),    # IETF protocol assignments
+    ipaddress.ip_network('240.0.0.0/4'),     # future-use / reserved
+    ipaddress.ip_network('224.0.0.0/4'),     # multicast
+)
+
+# Mostly covered by the stdlib is_* properties; listed explicitly for clarity.
+_BLOCKED_V6_NETS = (
+    ipaddress.ip_network('fc00::/7'),        # unique-local (ULA)
+    ipaddress.ip_network('fe80::/10'),       # link-local (also is_link_local)
+)
+
+MAX_URL_LEN = 2048
+DEFAULT_MAX_REDIRECTS = 5
+
+# Caps buffered body so a hostile target cannot OOM the process.
+MAX_RESPONSE_BYTES = 25 * 1024 * 1024
+_READ_CHUNK = 65536
+
+
+class SSRFBlocked(Exception):
+    """Raised when a URL is rejected by the SSRF guard. The message is safe to show."""
+
+
+class ResponseTooLarge(Exception):
+    """Raised when a target's response exceeds MAX_RESPONSE_BYTES."""
+
+
+def _ip_is_blocked(ip_obj) -> bool:
+    # IPv4-mapped IPv6 (e.g. ::ffff:127.0.0.1) is unwrapped and re-checked.
+    if isinstance(ip_obj, ipaddress.IPv6Address) and ip_obj.ipv4_mapped:
+        ip_obj = ip_obj.ipv4_mapped
+
+    if (
+        ip_obj.is_private
+        or ip_obj.is_loopback
+        or ip_obj.is_link_local
+        or ip_obj.is_reserved
+        or ip_obj.is_multicast
+        or ip_obj.is_unspecified
+    ):
+        return True
+
+    if isinstance(ip_obj, ipaddress.IPv4Address):
+        # Cloud metadata range; already covered by is_link_local, kept explicit.
+        if str(ip_obj).startswith('169.254.'):
+            return True
+        if str(ip_obj) == '255.255.255.255':
+            return True
+        for net in _BLOCKED_V4_NETS:
+            if ip_obj in net:
+                return True
+    else:
+        for net in _BLOCKED_V6_NETS:
+            if ip_obj in net:
+                return True
+
+    return False
+
+
+def _resolve_all_ips(hostname: str, port: int) -> List[Tuple[int, str]]:
+    results: List[Tuple[int, str]] = []
+    try:
+        infos = socket.getaddrinfo(hostname, port, family=socket.AF_UNSPEC,
+                                   type=socket.SOCK_STREAM)
+    except socket.gaierror as e:
+        raise SSRFBlocked(f"Could not resolve hostname: {hostname}") from e
+
+    for family, _stype, _proto, _canon, sockaddr in infos:
+        ip_str = sockaddr[0]
+        # Strip any IPv6 scope id (e.g. fe80::1%eth0).
+        if '%' in ip_str:
+            ip_str = ip_str.split('%', 1)[0]
+        results.append((family, ip_str))
+
+    if not results:
+        raise SSRFBlocked(f"Could not resolve hostname: {hostname}")
+    return results
+
+
+def validate_url(url: str) -> Tuple[str, str, int]:
+    """Validate a URL, returning (validated_url, pinned_ip, port) or raising."""
+    if not url or not isinstance(url, str):
+        raise SSRFBlocked("Empty or invalid URL")
+    if len(url) > MAX_URL_LEN:
+        raise SSRFBlocked(f"URL too long (max {MAX_URL_LEN} characters)")
+
+    # urlparse() and .port raise on a malformed IPv6 bracket or bad port.
+    try:
+        parsed = urlparse(url)
+        scheme = (parsed.scheme or '').lower()
+        hostname = parsed.hostname
+        port_value = parsed.port
+    except ValueError as e:
+        raise SSRFBlocked(f"Invalid URL: {e}")
+
+    if scheme not in ('http', 'https'):
+        raise SSRFBlocked("Only HTTP and HTTPS URLs are allowed")
+
+    if not hostname:
+        raise SSRFBlocked("Invalid URL - no hostname found")
+    hostname = hostname.lower()
+
+    port = port_value or (443 if scheme == 'https' else 80)
+
+    _allow = _allowlisted_hosts()
+    if _allow and (hostname in _allow or f"{hostname}:{port}" in _allow):
+        try:
+            literal = ipaddress.ip_address(hostname)
+            return url, str(literal), port
+        except ValueError:
+            # Allowlisted by name, still resolved so there is an IP to pin.
+            try:
+                resolved = _resolve_all_ips(hostname, port)
+                return url, resolved[0][1], port
+            except SSRFBlocked:
+                raise
+
+    if hostname in METADATA_HOSTNAMES:
+        raise SSRFBlocked("Scanning internal/metadata addresses is not allowed")
+
+    try:
+        literal = ipaddress.ip_address(hostname)
+        if _ip_is_blocked(literal):
+            raise SSRFBlocked("Scanning internal/private/reserved IP addresses is not allowed")
+        return url, str(literal), port
+    except ValueError:
+        pass
+
+    resolved = _resolve_all_ips(hostname, port)
+
+    pinned_ip: Optional[str] = None
+    for _family, ip_str in resolved:
+        try:
+            ip_obj = ipaddress.ip_address(ip_str)
+        except ValueError:
+            raise SSRFBlocked("Resolved to an unparseable address")
+        if _ip_is_blocked(ip_obj):
+            # Anti-rebinding: one dangerous record rejects the whole host.
+            raise SSRFBlocked(
+                "Host resolves to an internal/private/reserved address - blocked"
+            )
+        if pinned_ip is None:
+            pinned_ip = ip_str
+
+    if pinned_ip is None:
+        raise SSRFBlocked(f"Could not resolve hostname: {hostname}")
+
+    return url, pinned_ip, port
+
+
+class SSRFSafeAdapter(HTTPAdapter):
+    """HTTPAdapter that pins the TCP connection to a pre-validated IP, keeping the
+    hostname for Host header/SNI so it cannot be re-resolved between validate and connect."""
+
+    def __init__(self, pinned_host: str, pinned_ip: str, *args, **kwargs):
+        self._pinned_host = pinned_host.lower()
+        self._pinned_ip = pinned_ip
+        super().__init__(*args, **kwargs)
+
+    def init_poolmanager(self, connections, maxsize, block=False, **pool_kwargs):
+        # Pinning happens in send() via a scoped create_connection swap.
+        self.poolmanager = PoolManager(
+            num_pools=connections, maxsize=maxsize, block=block, **pool_kwargs
+        )
+
+    def _make_pinned_create_connection(self, orig_create_connection):
+        pinned_host = self._pinned_host
+        pinned_ip = self._pinned_ip
+
+        def _pinned_create_connection(address, *a, **kw):
+            host = address[0] if address else None
+            if host and host.lower() == pinned_host:
+                address = (pinned_ip,) + tuple(address[1:])
+            return orig_create_connection(address, *a, **kw)
+
+        return _pinned_create_connection
+
+    def send(self, request, *args, **kwargs):
+        import urllib3.util.connection as _u3c
+        import urllib3.connection as _u3conn
+        _orig_util = _u3c.create_connection
+        pinned = self._make_pinned_create_connection(_orig_util)
+        _orig_conn = getattr(_u3conn, 'create_connection', None)
+        _u3c.create_connection = pinned
+        if _orig_conn is not None:
+            _u3conn.create_connection = pinned
+        try:
+            return super().send(request, *args, **kwargs)
+        finally:
+            _u3c.create_connection = _orig_util
+            if _orig_conn is not None:
+                _u3conn.create_connection = _orig_conn
+
+
+def _build_pinned_session(
+    validated_url: str,
+    pinned_ip: str,
+    base_session: Optional[requests.Session] = None,
+    user_agent: Optional[str] = None,
+) -> requests.Session:
+    host = urlparse(validated_url).hostname.lower()
+    if base_session is not None:
+        sess = base_session
+    else:
+        sess = requests.Session()
+        sess.verify = False
+        if user_agent:
+            sess.headers.setdefault('User-Agent', user_agent)
+
+    adapter = SSRFSafeAdapter(pinned_host=host, pinned_ip=pinned_ip)
+    sess.mount('http://', adapter)
+    sess.mount('https://', adapter)
+    return sess
+
+
+def _materialize_capped(resp: requests.Response, url: str) -> None:
+    """Buffer a streamed response body into ``resp``, capped at MAX_RESPONSE_BYTES."""
+    declared = resp.headers.get('Content-Length')
+    if declared is not None:
+        try:
+            if int(declared) > MAX_RESPONSE_BYTES:
+                resp.close()
+                raise ResponseTooLarge(
+                    f"{url}: declared Content-Length {declared} exceeds the "
+                    f"{MAX_RESPONSE_BYTES} byte cap")
+        except ValueError:
+            pass
+
+    buf = bytearray()
+    try:
+        for chunk in resp.iter_content(chunk_size=_READ_CHUNK):
+            if not chunk:
+                continue
+            buf += chunk
+            if len(buf) > MAX_RESPONSE_BYTES:
+                resp.close()
+                raise ResponseTooLarge(
+                    f"{url}: response body exceeded the {MAX_RESPONSE_BYTES} "
+                    f"byte cap (streaming)")
+    finally:
+        resp.close()
+
+    # The two attributes `requests` sets on a cached body, so .content/.text/.json() work.
+    resp._content = bytes(buf)
+    resp._content_consumed = True
+
+
+def safe_get(
+    url: str,
+    *,
+    timeout: int = 10,
+    headers: Optional[dict] = None,
+    session: Optional[requests.Session] = None,
+    max_redirects: int = DEFAULT_MAX_REDIRECTS,
+    verify: bool = False,
+    user_agent: Optional[str] = None,
+    **kwargs,
+) -> requests.Response:
+    """SSRF-safe GET: every redirect hop is re-validated and re-pinned. Cookies and
+    headers from ``session`` are preserved across hops."""
+    kwargs.pop('allow_redirects', None)
+
+    current_url = url
+    # Base session carries cookies; each hop gets a fresh pinned adapter (host/IP may differ).
+    base = session if session is not None else None
+    if base is None:
+        base = requests.Session()
+        base.verify = verify
+        if user_agent:
+            base.headers.setdefault('User-Agent', user_agent)
+
+    last_resp: Optional[requests.Response] = None
+    for hop in range(max_redirects + 1):
+        validated_url, pinned_ip, _port = validate_url(current_url)
+        sess = _build_pinned_session(validated_url, pinned_ip, base_session=base)
+
+        resp = sess.get(
+            validated_url,
+            timeout=timeout,
+            headers=headers,
+            allow_redirects=False,
+            verify=verify,
+            stream=True,
+            **kwargs,
+        )
+        last_resp = resp
+
+        if resp.is_redirect or resp.status_code in (301, 302, 303, 307, 308):
+            location = resp.headers.get('Location')
+            if not location:
+                _materialize_capped(resp, validated_url)
+                return resp
+            # A hop's body is closed unread, so it cannot smuggle a huge body past the cap.
+            next_url = urljoin(validated_url, location)
+            logger.debug(f"[ssrf_guard] redirect hop {hop}: {validated_url} -> {next_url}")
+            current_url = next_url
+            resp.close()
+            continue
+
+        _materialize_capped(resp, validated_url)
+        return resp
+
+    logger.warning(f"[ssrf_guard] max redirects ({max_redirects}) exceeded for {url}")
+    if last_resp is not None:
+        _materialize_capped(last_resp, current_url)
+    return last_resp
+
+
+def safe_session(
+    url: str,
+    *,
+    base_session: Optional[requests.Session] = None,
+    user_agent: Optional[str] = None,
+    verify: bool = False,
+) -> Tuple[requests.Session, str]:
+    """Return (session, validated_url) pinned to ``url``'s IP, for one request.
+    Callers that follow redirects must use safe_get, which re-validates each hop."""
+    validated_url, pinned_ip, _port = validate_url(url)
+    sess = _build_pinned_session(
+        validated_url, pinned_ip, base_session=base_session, user_agent=user_agent
+    )
+    sess.verify = verify
+    return sess, validated_url
+
+
+def is_safe_url(url: str) -> bool:
+    try:
+        validate_url(url)
+        return True
+    except SSRFBlocked:
+        return False
+    except Exception:
+        return False

narvy_cli-1.0.0.dist-info/METADATA

@@ -0,0 +1,165 @@
+Metadata-Version: 2.4
+Name: narvy-cli
+Version: 1.0.0
+Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
+Author: Narvy
+License: Apache-2.0
+Project-URL: Homepage, https://narvy.io
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyaxmlparser
+Requires-Dist: pyyaml
+Requires-Dist: rich
+Requires-Dist: requests
+Requires-Dist: semgrep==1.152.0
+Requires-Dist: lief
+Provides-Extra: ios-full
+Requires-Dist: icdump; extra == "ios-full"
+Provides-Extra: cloud
+Requires-Dist: boto3; extra == "cloud"
+Dynamic: license-file
+
+# Narvy CLI
+
+[![PyPI version](https://badge.fury.io/py/narvy-cli.svg)](https://badge.fury.io/py/narvy-cli)
+[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+
+A free, local static application security testing (SAST) scanner. It runs
+entirely on your machine, needs no account, and finds real, high-signal
+vulnerabilities - hardcoded secrets, insecure configuration, weak
+cryptography, SSRF, injection, and more - in:
+
+- **Android**: `.apk` / `.aab`, split-APK bundles (`.apkm` / `.xapk` /
+  `.apks`), or a raw Gradle/Kotlin source checkout
+- **iOS**: an unencrypted `.ipa`, or a raw Xcode/Swift source checkout
+- **Web/backend source**: JavaScript/TypeScript, Python, PHP, Go, Ruby,
+  Rust, Java/Kotlin, C#/.NET
+
+It also ships three standalone scanners that need nothing but network
+access or your own existing credentials:
+
+- `web-scan` - passive Nuclei-based scan of a live URL
+- `host-audit` - agentless host audit over your own SSH access (Narvy's own
+  host checks plus Lynis (GPL-3.0) as the hardening baseline)
+- `cloud-scan` - AWS account posture check using your own ambient AWS
+  credentials
+
+Nothing is uploaded anywhere unless you explicitly pass `--upload`.
+
+## Install
+
+```bash
+pip install narvy-cli
+```
+
+Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
+auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+is pure Python plus a couple of optional extras:
+
+```bash
+pip install 'narvy-cli[ios-full]'  # full Obj-C introspection for iOS binary scans
+pip install 'narvy-cli[cloud]'     # boto3, needed for cloud-scan
+```
+
+## Usage
+
+```bash
+# Android APK/AAB, split bundle, or a Gradle/Kotlin source checkout
+narvy scan app-release.apk
+narvy scan app.apkm
+narvy scan ./my-android-app/
+
+# iOS: unencrypted IPA, or a Swift/Xcode source checkout
+narvy scan MyApp.ipa
+narvy scan ./my-ios-app/
+
+# Web/backend source (Node, Python, PHP, Go, Ruby, Rust, Java/Kotlin, C#/.NET)
+narvy scan ./my-api-repo/
+
+# SARIF output, for CI or GitHub/GitLab code scanning
+narvy scan app-release.apk --output sarif --file results.sarif
+
+# Passive web scan of a live URL - no active injection payloads, ever
+narvy web-scan https://example.com
+
+# Agentless host hardening audit over your own SSH access
+narvy host-audit example.com --user deploy
+
+# AWS account posture check using your own aws configure / env vars / IAM role
+narvy cloud-scan
+
+# List recent scans on your Narvy account (requires `narvy login`)
+narvy scans
+
+# Scan + upload every .apk/.aab/.apkm/.xapk/.ipa found in a folder, in one command
+narvy upload-all ./my-apps-folder/
+```
+
+Run `narvy doctor` before your first scan to check your Java/jadx/iOS
+tooling setup, and `narvy <command> --help` for the full flag list of
+any subcommand.
+
+### Very large Android apps
+
+Decompiling is memory-hungry, and file size is a poor predictor of how much
+you need. Before decompiling, the CLI reads the DEX headers to estimate the
+Java heap the app needs and checks it against `--max-mem` and your
+machine's free memory, so an app that won't fit fails in about a second
+instead of after several minutes of doomed work. The estimate is a
+heuristic, not a hard limit - `--force` runs the decompile regardless.
+
+### Optional Narvy Cloud scan
+
+`narvy login` links the CLI to a Narvy account. Add `--upload`
+to a scan to also submit it for a deeper cloud pass (full taint
+analysis, compliance mapping, dashboard history) - not required for local
+scanning, and not on by default. `narvy upload-all <directory>` does
+the same for every binary target found in a folder in one command.
+`narvy scans` lists recent scans on your account from the terminal.
+
+## Known limitations
+
+- Encrypted iOS binaries (the normal App Store distribution state) are
+  detected but not decrypted; only the local, static checks that don't need
+  the decrypted binary run.
+- Web-source coverage depth isn't uniform across all eight languages - Rust
+  and C#/.NET have a smaller rule set than the others, and the CLI says so
+  in its own output when it applies.
+- Only one architecture's native libraries are checked in a multi-ABI
+  APK/split bundle.
+
+See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
+exact commands this README's examples were run against.
+
+## License
+
+Apache License 2.0 - see [LICENSE](LICENSE).
+
+Rule packs under `narvy/rules/` are authored by Narvy
+(Apache 2.0, same as the rest of this package) and contain no third-party
+rule text.
+`host-audit` runs Narvy's own host checks (secrets exposed on disk,
+unauthenticated data services, cloud metadata exposure, container/daemon
+posture, exposed VCS/artifacts in web roots) and, as the hardening baseline,
+shells out to [Lynis](https://cisofy.com/lynis/) (GPL-3.0), auto-fetched at
+run time over your SSH access, run arm's-length, never bundled. Lynis is
+attributed as the engine in the audit output; its controls are not presented
+as Narvy's own.
+
+## Contributing
+
+Issues and pull requests welcome, especially new or improved detection
+rules. Rule packs live under `narvy/rules/`: Android/iOS
+(`rules/android`, `rules/ios`) and web/backend (`rules/web`, Semgrep-based).

narvy_cli-1.0.0.dist-info/RECORD

@@ -0,0 +1,93 @@
+narvy/__init__.py,sha256=IQxw1-Fgen70bKkXPsnhdnJKTnWRXaE_AwP5DbpyNvY,96
+narvy/android_rule_context.py,sha256=6jzMyT4D5NpLcys32PLxqHClNKqvb7sCNCVA3N51P7U,7811
+narvy/apk_memory_preflight.py,sha256=AIQ81rW2C0hXAqhYbTDrEH3lKj7fSF6ZXAA_iQl3_8A,10278
+narvy/auth.py,sha256=to9_Luc6TgyQnZa5RcHELHQeaSTiY-Y2coX6WVe7Cm8,1160
+narvy/comment_filter.py,sha256=absOixsgQrvMI1BzradWZQ6iS90HxWsIhE5P1tNjj3s,3918
+narvy/crypto_taint_lite.py,sha256=aac8sM_o91gxVjEPlaQOe6GK0aSqM358Fh58BKKP7yg,3337
+narvy/decompiler.py,sha256=cwXyikAkjNe5NNcymqRGFJe45XIiirP3PJfkqK95ljY,13198
+narvy/doctor.py,sha256=IZ6wDs2R95BYKyY8kxgKyfFnFQ0hX6OAJqXD7sq2TtE,9869
+narvy/main.py,sha256=6yJnOk6x35qxQSblRo88SDcFjHRAth5NmXo0_HJC-sw,97720
+narvy/native_hardening.py,sha256=sQaSEFgnhHQ9ES2vWE3XDH74O5HHvu5qZSWBfykgvLw,20507
+narvy/reporter.py,sha256=MV9CE6Otb9sGmUQxFWcIGjCWRtvh6I2tCvlwdevFwEs,5739
+narvy/rule_engine.py,sha256=aKc0K_Xj0bGtXVaQAQI0m2E8gNl2xYHNAXfp1OEZX1U,2365
+narvy/scope_config.py,sha256=Y5rHbNSh81TKNuFTxGlW-pX6Ov4xsBFsmW5JBFPHzJo,6862
+narvy/semgrep_engine.py,sha256=PpWXSwcSZmZa6eEkGhd4ViKAbM8DZI5evm7Oc7dFirc,8564
+narvy/stack_protector_evidence.py,sha256=9MgTkAqp1twnN-qJFBgYa4xg3WR5C1RSjARg-nF1DLc,3740
+narvy/third_party_filter.py,sha256=Nvb5Mdx5FTGvCb2BfYoTxHXf6fOlwJtyvjMn1XsK6j8,7987
+narvy/uploader.py,sha256=L7x3cn5p9Lu7VXqlZRtjJnKxiO_wLQHCmL-rFU_CuNo,2860
+narvy/weak_prng_context.py,sha256=eYLiNw2p4ua8rbms3QhK5f8bifPyVUQ77Aq4XHm-woc,10080
+narvy/android/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+narvy/android/source_analyzer.py,sha256=0roHyMfVViZDcmFI-73aVRYoYa9LOwEyErjzXkqSxXQ,10092
+narvy/android/split_bundle.py,sha256=L4Y15OUHxeePX1AwlZQOb6cNeZhtn6Fkci0--qGlQVU,18881
+narvy/ci_templates/bitbucket.yml,sha256=uYCvi1QH4p4U3B9XMGljf9rRCrGOUdTEcNr9mWHmPiY,978
+narvy/ci_templates/github.yml,sha256=cWgnxeeXEJhkLtPgTbbDJZ30LGmQ4X3rlLY63SU-qyU,2002
+narvy/ci_templates/gitlab.yml,sha256=BWBNu_EsAZRVK1lkbEoReUvqwRLsYbrXFETNGGS18VI,1234
+narvy/cloud/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+narvy/cloud/aws_scan.py,sha256=DgUEwB6pZGf7LMX8P0Lv8CNMGNmeglfsZijms3tADiQ,53110
+narvy/host/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+narvy/host/audit.py,sha256=6-wsjqDaOpJx9RZMJh_O7THWYnYnMUhaf7gqGE9TABs,5453
+narvy/host/host_knowledge.py,sha256=pyw6iy7jSdRWow508IrPKmiRM3A744JG6lanLvZl0L0,52391
+narvy/host/lynis_bootstrap.py,sha256=G2AqcPklBwScbNhCGBC7hUoOdXMtf3CD2yrwZxDes7E,15594
+narvy/host/lynis_parser.py,sha256=jEK5UwyAqXnQL-cKvErZ-ho0NWBwL2V840HgzZNfCO0,12669
+narvy/host/narvy_checks.py,sha256=TGuErYdgBsNgPY9XAfKaTK6GMBrJnU1A2vbROmbm55s,31179
+narvy/host/report.py,sha256=hhSPpBrE4SP1xukg3ExyQ7Op6N_NAb_qwIBLZ0RT6vg,2397
+narvy/host/ssh_exec.py,sha256=nh7xjMQcnJvk-i9mk8m-9s31Wjzp4CsHRQhnL4-aqLY,7517
+narvy/ios/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+narvy/ios/binary_analyzer.py,sha256=NnPjHXC_7GJ4IHFdlCYH6BVvGALlLaY_bhrlKRsOULQ,56326
+narvy/ios/plist_checks.py,sha256=XghxO8Y1YsbWpoEqf8M_p4i5mD-ZERep15PEaqx8Hpw,11693
+narvy/ios/source_analyzer.py,sha256=xCIKzXOICkanqdQlHdibdRXqTWXWbJZhrgoRrKiP4Os,11086
+narvy/ios/third_party_filter.py,sha256=wl-bLev2nfuTd30Ga0qU8tm-COEB4oftWk1y20ZXIEI,8955
+narvy/ios/trust_all_context.py,sha256=H_iVaEmJecLAGIpPEGZnDkot9BmMuQVDcXPNWunEdcQ,1993
+narvy/rules/android.yml,sha256=MmG_-jTUy5nOZDkTerWFLjfIu0GQANQiZeJz9H0lqGM,8172
+narvy/rules/ios_swift.yml,sha256=RSPQPcETrS9KMUxaHFrS2Bh3d430N491RI1u3JrijxA,12318
+narvy/rules/android/config.yml,sha256=qUtCazhmV02FZd81qoi9ZYq8dH2uAGGPk70Z_AfU4X0,4909
+narvy/rules/android/crypto.yml,sha256=wyf4fuDJG5m4_klqTJw7zTPhTo1sDHBqsXi_d_P5W3Q,1744
+narvy/rules/android/secrets.yml,sha256=pK1pTlc_nQcQvjF4NgvGtlL46Qo_psKOaBZNdRphBI4,8555
+narvy/rules/android/storage.yml,sha256=-0rkA-XtIlnCuPxJpG7NsI9IkDDRGrnq23Y5LFrXD80,1475
+narvy/rules/android/webview.yml,sha256=kWIGPuQ6UVLbgGyvj-3MsaIf8NrLn-NG4JZW4sYh7Cw,1049
+narvy/rules/ios/objc/crypto.yml,sha256=yPPqcDCbM8Gc8jGdFowrudZPGXT0vnvV5DrtpJmMn1Y,2874
+narvy/rules/ios/objc/network.yml,sha256=2ryYViC43FFuUm9O4CtFojcrNWbM6fU5CM9nDfW_kCA,4295
+narvy/rules/ios/objc/secrets.yml,sha256=8NFYEN3uzsj3vFKgbl4hDBalLVn2I0nGwfeLWqashxQ,4356
+narvy/rules/ios/objc/storage.yml,sha256=asXrK7YeJZTa76uDpYv7LgS3rEl7PRRcuf7SKuSwolA,2788
+narvy/rules/ios/objc/webview.yml,sha256=uusi2CQLrQrcrKmDJ1e1q51lkmG5aXUNH8GwrLAQRl4,2985
+narvy/rules/web/go.yml,sha256=NhjOvlmUllanfguDAyJH9P-n0vYl7a0wXFMFOhWzpLk,100033
+narvy/rules/web/java.yml,sha256=BzzA02D7nyccF2dUv0HSw3Ap53EmQtWcV4s7G9RLtLk,55805
+narvy/rules/web/javascript.yml,sha256=wx7ZAF9a2yn5Ymu8k_lp-SSVA25MygIP47o1YHhg_48,147582
+narvy/rules/web/kotlin.yml,sha256=7oKcqfJ4Gfcz7yte6MobH8aUnoebkVs0e2ihoxYB5Xk,14360
+narvy/rules/web/php.yml,sha256=PE3w9HXW3o8HPKOQW9RsubqMY9_u2bBMpAlDuXQP85c,54459
+narvy/rules/web/python.yml,sha256=O4-YjldmNgtFrb-KUBoce_fycXyOAq3qoj9NYAqD34s,140549
+narvy/rules/web/ruby.yml,sha256=DMeiAR7ZdWG34lKQ9PS2gmZv0AIK1NrwhYpv_A-29kg,25949
+narvy/rules/web/rust.yml,sha256=oY0srMOsGM7D3dr8ciN0H2lzy6ii2AGo-xaizsm9Z8A,9265
+narvy/rules/web/secrets.yml,sha256=8YX4fUKWW4RZ5oau-Iog8JhMteomDmkN3IDYj5tx7tM,41287
+narvy/rules/web/secrets_supplement.yml,sha256=-Qda5MljM189L3DZ8DXPWbZZnmzDUyjVOSEXgCnMFVc,9924
+narvy/rules/web/local/csharp_narvy/config.yml,sha256=pTAxBVLzid8-7aYk2biZZfffBUbQP-qS1fkWkx4esWs,2082
+narvy/rules/web/local/csharp_narvy/crypto.yml,sha256=oRBhPjI7wc8r2ba9RBOdUQsB_EXBtPNbWeqlNRH6PAM,2313
+narvy/rules/web/local/csharp_narvy/deserialization.yml,sha256=PfegDUx7ysFpv644ihytaPmhP4PpHNPGS3f7UcjkekQ,2254
+narvy/rules/web/local/csharp_narvy/injection.yml,sha256=7tiI5hvF4nxobPXXvKQCoApTpX6SN6S-_vzfbt5OWZU,5140
+narvy/rules/web/local/csharp_narvy/xxe.yml,sha256=2y1Kycs2FWPWf0zVZy_49XeMLnUQgwuptL5_8P6ifPM,1633
+narvy/rules/web/local/java_narvy/auth_jwt.yml,sha256=wFN81YbT7bAYjv42k6hSKkms9RzZ1iZPG7WKOoZoKFg,5046
+narvy/rules/web/local/java_narvy/deserialization.yml,sha256=wiMTGKpqWup0HzGhpIWE1EEoUr8GCqo4iN5lMr_vdm4,4415
+narvy/rules/web/local/java_narvy/mybatis.yml,sha256=LcBiPVL7wSKGyjtrNDpzHyt0UEjp7Aw5_ZImj2aPcHk,1697
+narvy/rules/web/local/java_narvy/snakeyaml.yml,sha256=_DkLcyHyOaZTrozriqFRIPAt6KyaMdlkGMcrOizJJyA,1269
+narvy/rules/web/local/java_narvy/spring_authz.yml,sha256=RrdtjgijRpr_VFs0sscbWpnAvgD91Tlmd_yFEC7pI2U,1137
+narvy/rules/web/local/java_narvy/spring_config.yml,sha256=5f3UZRueTfQF1Q9-eBaJXc9NZcOZLCKXge6KW30eU1g,2405
+narvy/rules/web/local/java_narvy/spring_hardening.yml,sha256=REZKg5t92eq32riTnvaijPpFukZ_5G6gK8usZAEVGJY,10940
+narvy/rules/web/local/java_narvy/sqli.yml,sha256=fMJXogX9XJG-R79Re2OChNcrd0Jf4p22ybDtnLAbFpU,8652
+narvy/rules/web/local/java_narvy/xxe.yml,sha256=immbF7DrTS3rYzeBpwlO2pjuTLyq9DMVrs_mhhCt7Cg,7798
+narvy/sca/__init__.py,sha256=yf6o8Yj140CoYXLNxx8Sg7cxwS0Cfd-WOGi2ueVyqT8,74
+narvy/sca/android_deps.py,sha256=zx1fNZkDuMZ-Zl6UZSzQtezfQ2oHbs82wlBGQPwXVHE,13109
+narvy/sca/ios_deps.py,sha256=72MNCxx1SiEnxrGgfommFe8M33CbWg2aeqtV7co0sNo,21560
+narvy/sca/osv_client.py,sha256=cP3nC5x2IGXqu2FMdjkzveg0WXV8XvXWTsbhdtBLriw,20532
+narvy/sca/web_deps.py,sha256=L2xqvCDs5MWzrcdbEsF-l7P3zWgdKgQJWfG-toMBrFU,34409
+narvy/web/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+narvy/web/nuclei_binary.py,sha256=S5zzPSEYiYDjS830INHOFD44WFa0k2Th4IMfsvMYIm0,3570
+narvy/web/scan_blocklist.py,sha256=toKPe4Z7OH2TAfTaTTpplZrzaRiP8LIRtvq-wx-hNtM,3250
+narvy/web/scanner.py,sha256=liJRqtSKMPJ-75_C9Kpzls7TuC6nzxdzQdoFvmahd6g,34687
+narvy/web/source_analyzer.py,sha256=CNzb2E0B1Ive-wIFOl7cDpGyTfxoBTLMbAxzN8zpyxs,27313
+narvy/web/ssrf_guard.py,sha256=Fem_GbuTSQT9P88KFksbf1ru7O0kQqC_buFVFU_E45M,12806
+narvy_cli-1.0.0.dist-info/licenses/LICENSE,sha256=oRS_yX70S6CuKY_6fQvPIaql-fucDYMZG9Mo_I9VPww,11341
+narvy_cli-1.0.0.dist-info/METADATA,sha256=1VwaPJdcGq0bOobxfNusqTnp8CwzV0Ee0SkBBzWUcgc,6390
+narvy_cli-1.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+narvy_cli-1.0.0.dist-info/entry_points.txt,sha256=B9il_Cpsbt7F1Gk6ePswqmu7oduBalCtbJheDFSbQu8,41
+narvy_cli-1.0.0.dist-info/top_level.txt,sha256=z_E-mw3b3pmziLN825vSN-d7FqP5-QC4Cel_nRy-Jm8,6
+narvy_cli-1.0.0.dist-info/RECORD,,

narvy_cli-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

narvy_cli-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+narvy = narvy.main:cli