redveil 0.1.0__tar.gz

redveil-0.1.0/.gitignore

@@ -0,0 +1,53 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual environments
+.venv/
+venv/
+env/
+ENV/
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+.mypy_cache/
+.ruff_cache/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+
+# Reports (user-generated)
+reports/*/
+!reports/.gitkeep
+!reports/**/.gitkeep
+
+# Local config
+.env
+.env.local
+*.local.yaml

redveil-0.1.0/CHANGELOG.md

@@ -0,0 +1,92 @@
+# Changelog
+
+All notable changes to redveil are documented in this file. The format is
+based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2026-08-31
+
+The first public release of redveil. A defensive web application security
+framework that runs an auditable discover → detect → safely validate →
+collect evidence → assess → report pipeline against a target web
+application.
+
+### Added
+
+- **17 security check plugins** registered through the entry-point group
+  `redveil.checks`:
+  - `security-headers` — checks for missing or misconfigured HTTP security
+    headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, etc.).
+  - `information-disclosure` — fingerprints server versions, framework
+    signatures, debug endpoints, and config leaks.
+  - `cors-policy` — tests CORS configuration including the
+    `Access-Control-Allow-Origin: *` plus
+    `Access-Control-Allow-Credentials: true` anti-pattern.
+  - `http-methods` — enumerates supported HTTP methods, flags dangerous
+    ones (PUT, DELETE) where inappropriate.
+  - `open-redirect-indicator` — passive indicator of redirect handling
+    weakness. Flags parameter shapes known to enable open redirects.
+  - `source-map-exposure` — checks for `.js.map` and `X-SourceMap` header
+    leaks that disclose application source.
+  - `subdomain-finder` — web-crawler-based subdomain enumeration via
+    in-scope links and external resource references.
+  - `xss-reflected` — passive and low-impact detection of reflected XSS
+    sinks. Active payload execution is out of scope.
+  - `sqli-time-based` — time-based blind SQL injection detection. Never
+    extracts data; measures response delays only.
+  - `ssrf` — server-side request forgery detection via the operator's OOB
+    callback domain. Never targets internal IP ranges.
+  - `command-injection` — time-based blind command injection detection.
+    Never executes commands; measures response delays only.
+  - `path-traversal` — passive and low-impact path traversal indicator.
+    Detection only; never attempts to read sensitive files.
+  - `bola-idor` — multi-principal IDOR detection. Replays the same request
+    as each configured test principal and compares outcomes.
+  - `bfla` — broken function level authorization. Compares admin-only routes
+    across principal roles.
+  - `graphql` — GraphQL introspection, depth limits, batching, and field
+    authorization checks.
+  - `mass-assignment` — detects endpoints that bind user-supplied input to
+    sensitive fields without filtering.
+  - `session-cookie` — flags missing `Secure`, `HttpOnly`, `SameSite`,
+    and overly broad cookie path or domain scopes.
+- **Plugin system with entry-point discovery.** Subclass
+  `redveil.plugins.base.Check` and register through
+  `[project.entry-points."redveil.checks"]` in `pyproject.toml`.
+- **Scope controller** with strict host allowlist, path glob matching,
+  exclude-list-beats-allow-list semantics, destructive-path heuristics,
+  and per-hop redirect-chain re-validation.
+- **Async HTTP client** with token-bucket rate limiting, hard request
+  caps, response-size truncation, manual redirect following, and unique
+  request IDs for evidence pairing.
+- **Event bus** with a closed `EventType` enum and a Rich console renderer
+  for live, color-coded progress.
+- **Vulnerability knowledge base** with 50+ entries linking each issue to
+  attack scenarios, code examples (Python / Node / Go / Java / Ruby /
+  PHP), CWE and OWASP tags, and remediation guidance.
+- **Markdown, JSON, and HTML report rendering.** One scan produces
+  `summary.md`, `findings.json`, per-finding `findings/<id>.md`, and a
+  self-contained `report.html`.
+- **Local vulnerable Flask lab** for end-to-end testing. Binds to
+  `127.0.0.1` by default; no real exploits, no destructive functionality.
+- **Subdomain discovery** via the web crawler. Confined to
+  in-scope hosts and `allowed_hosts`.
+- **900+ unit and integration tests** covering configuration, scope,
+  lifecycle, plugins, HTTP transport, event bus, rate limiting,
+  reporting, and every check plugin.
+
+### Safety
+
+- No destructive payloads.
+- No data extraction (SQLi and CMDi are time-based only).
+- No internal IP targeting (SSRF uses the operator's OOB domain only).
+- ACTIVE profile requires explicit `acknowledged_safety_terms=true`.
+- No reverse shells, no persistence, no credential extraction, no
+  denial-of-service primitives — by design and going forward.
+
+### Notes
+
+This release targets Python 3.12 and 3.13. The CLI entry point is
+`redveil`. The framework ships as a single package with optional
+`[dev]` extras for testing, linting, and type checking. See
+[USER_GUIDE.md](USER_GUIDE.md) for installation and usage.

redveil-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Security Research Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

redveil-0.1.0/PKG-INFO

@@ -0,0 +1,182 @@
+Metadata-Version: 2.5
+Name: redveil
+Version: 0.1.0
+Summary: Production-quality web vulnerability PoC & evidence framework for authorized security testing
+Author: Security Research Team
+License: MIT
+License-File: LICENSE
+Keywords: bug-bounty,evidence,pentest,poc,security,vdp,vulnerability
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.12
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic-settings>=2.2
+Requires-Dist: pydantic>=2.6
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.7
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: mypy>=1.8; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: respx>=0.21; extra == 'dev'
+Requires-Dist: ruff>=0.3; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# redveil
+
+> **Evidence-first web vulnerability PoC framework. Not an exploit toolkit.**
+
+redveil is a defensive security assessment framework that runs an auditable
+*discover → detect → safely validate → collect evidence → assess → report*
+pipeline against a target web application. Every outbound HTTP request passes
+through a strict scope controller, every component reports progress through
+an in-process event bus, and every finding ships with reproducible request
+artifacts and step-by-step reproduction procedures.
+
+[![status](https://img.shields.io/badge/status-Phase_1--5_complete-brightgreen)](#status)
+[![checks](https://img.shields.io/badge/built--in_checks-17-blue)](#plugins)
+[![python](https://img.shields.io/badge/python-3.12%20%7C%203.13-blue)](#installation)
+[![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+
+## What it is
+
+redveil is a CLI-first framework for authorized web security assessments.
+You give it a scope file describing where it is allowed to send requests
+and what credentials to use, and it produces a Markdown / JSON / HTML
+report of every finding it can prove — without writing a single exploit
+payload. Every finding includes a sanitized cURL command that reproduces
+it on demand, the captured response excerpt, the CWE / OWASP taxonomy
+tags, attack scenarios, code examples across multiple frameworks, and
+ordered remediation steps.
+
+## What it is NOT
+
+- Not an exploit framework. No reverse shells, no persistence primitives,
+  no credential extraction, no data exfiltration, no denial-of-service.
+- Not a destructive payload toolkit. SQLi and CMDi are time-based blind
+  probes only — they never extract rows, never execute commands.
+- Not a public-internet scanner. The framework enforces a strict host
+  allowlist and is intended for authorized assessment only.
+
+## Safety
+
+Every check declares its required safety profile. The runtime refuses to
+execute any check that exceeds the operator's chosen profile. The
+profiles are PASSIVE (observation only), LOW_IMPACT (safe probes), and
+ACTIVE (authenticated IDOR, time-based blind SQLi, OOB SSRF via the
+operator's callback domain, time-based CMDi detection — each bounded
+and non-destructive).
+
+The ACTIVE profile requires explicit `acknowledged_safety_terms=true`
+in the scope file. The framework will not include reverse shells,
+persistence, credential extraction, denial-of-service, or data
+destruction — by design and going forward.
+
+**Use only against systems you own or have explicit written authorization
+to test.** The authors disclaim all responsibility for unauthorized use.
+
+## Quick example
+
+```bash
+# Install
+git clone https://github.com/your-org/redveil.git
+cd redveil
+python3.12 -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+
+# Scan a public surface with default (PASSIVE) checks
+redveil scan https://staging.example.com --scope examples/scope.staging.yaml
+
+# List all built-in check plugins
+redveil list-checks
+
+# Re-render a report from an existing findings.json
+redveil report reports/staging.example.com
+```
+
+Reports land under `reports/<target-name>/` as `summary.md`,
+`findings.json`, per-finding `findings/<id>.md`, and a self-contained
+`report.html`.
+
+## Status
+
+All five development phases are complete:
+
+- **Phase 1** — Configuration, scope controller, rate-limited HTTP client,
+  plugin registry, event bus, lifecycle state machine, CLI.
+- **Phase 2** — Finding model, evidence store with sanitization,
+  vulnerability knowledge base, deduplicator, report renderers.
+- **Phase 3** — Discovery (crawler, subdomain finder) and passive check
+  plugins (security headers, CORS, methods, disclosure, source maps,
+  open redirect indicator, session cookie).
+- **Phase 4** — Low-impact check plugins (reflected XSS, source map
+  fingerprinting, additional disclosure heuristics).
+- **Phase 5** — Active check plugins (time-based blind SQLi, OOB SSRF,
+  time-based CMDi, path traversal indicator, BOLA / IDOR across
+  multiple test principals, BFLA, GraphQL introspection, mass
+  assignment).
+
+The release ships with **17 built-in check plugins** and **900+ unit and
+integration tests**. The local vulnerable Flask lab under `tests/lab/`
+exercises the full pipeline end-to-end.
+
+## Architecture
+
+The package is organized into focused subpackages:
+
+- `core` — orchestration, scope control, event bus, lifecycle
+- `http` — async HTTP client, request/response abstractions, rate limiter
+- `discovery` — crawling, endpoint and parameter enumeration
+- `checks` — 17 built-in vulnerability check plugins
+- `validation` — safe-in-place validators and PoC executors
+- `evidence` — request/response capture, hashing, sanitization
+- `findings` — finding model, severity scoring, deduplication
+- `reporting` — report renderers (Markdown, JSON, HTML)
+- `plugins` — plugin discovery and the `Check` base class
+- `cli` — Typer-based command-line interface
+
+## Plugins
+
+Every check is a plugin. Adding a new check means subclassing
+`redveil.plugins.base.Check`, declaring metadata (id, name, category,
+safety profile, CWE / OWASP tags), and registering through the
+`redveil.checks` entry-point group:
+
+```toml
+[project.entry-points."redveil.checks"]
+my-check = "my_pkg.checks.my_check:MyCheck"
+```
+
+The orchestrator wires each plugin with the framework's HTTP client and
+scope controller. Plugins cannot instantiate their own HTTP client —
+`bind()` validates that the supplied client is bound to the
+orchestrator's scope.
+
+## Documentation
+
+- [USER_GUIDE.md](USER_GUIDE.md) — installation, concepts, CLI reference,
+  scope configuration examples, output interpretation, safety, and
+  troubleshooting.
+- [CHANGELOG.md](CHANGELOG.md) — version history and release notes.
+- [docs/architecture.md](docs/architecture.md) — internal architecture,
+  request lifecycle, safety model, plugin contract, event taxonomy, and
+  testing strategy.
+- [examples/](examples/) — runnable scope file templates for staging,
+  authenticated, multi-principal, and OOB scenarios.
+
+## License
+
+MIT — see [LICENSE](LICENSE).
+
+## Disclaimer
+
+This tool is provided for defensive security testing only. The authors
+disclaim all responsibility for any unauthorized or unlawful use. Always
+obtain explicit, written authorization before testing any system you do
+not own.

redveil-0.1.0/README.md

@@ -0,0 +1,153 @@
+# redveil
+
+> **Evidence-first web vulnerability PoC framework. Not an exploit toolkit.**
+
+redveil is a defensive security assessment framework that runs an auditable
+*discover → detect → safely validate → collect evidence → assess → report*
+pipeline against a target web application. Every outbound HTTP request passes
+through a strict scope controller, every component reports progress through
+an in-process event bus, and every finding ships with reproducible request
+artifacts and step-by-step reproduction procedures.
+
+[![status](https://img.shields.io/badge/status-Phase_1--5_complete-brightgreen)](#status)
+[![checks](https://img.shields.io/badge/built--in_checks-17-blue)](#plugins)
+[![python](https://img.shields.io/badge/python-3.12%20%7C%203.13-blue)](#installation)
+[![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+
+## What it is
+
+redveil is a CLI-first framework for authorized web security assessments.
+You give it a scope file describing where it is allowed to send requests
+and what credentials to use, and it produces a Markdown / JSON / HTML
+report of every finding it can prove — without writing a single exploit
+payload. Every finding includes a sanitized cURL command that reproduces
+it on demand, the captured response excerpt, the CWE / OWASP taxonomy
+tags, attack scenarios, code examples across multiple frameworks, and
+ordered remediation steps.
+
+## What it is NOT
+
+- Not an exploit framework. No reverse shells, no persistence primitives,
+  no credential extraction, no data exfiltration, no denial-of-service.
+- Not a destructive payload toolkit. SQLi and CMDi are time-based blind
+  probes only — they never extract rows, never execute commands.
+- Not a public-internet scanner. The framework enforces a strict host
+  allowlist and is intended for authorized assessment only.
+
+## Safety
+
+Every check declares its required safety profile. The runtime refuses to
+execute any check that exceeds the operator's chosen profile. The
+profiles are PASSIVE (observation only), LOW_IMPACT (safe probes), and
+ACTIVE (authenticated IDOR, time-based blind SQLi, OOB SSRF via the
+operator's callback domain, time-based CMDi detection — each bounded
+and non-destructive).
+
+The ACTIVE profile requires explicit `acknowledged_safety_terms=true`
+in the scope file. The framework will not include reverse shells,
+persistence, credential extraction, denial-of-service, or data
+destruction — by design and going forward.
+
+**Use only against systems you own or have explicit written authorization
+to test.** The authors disclaim all responsibility for unauthorized use.
+
+## Quick example
+
+```bash
+# Install
+git clone https://github.com/your-org/redveil.git
+cd redveil
+python3.12 -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+
+# Scan a public surface with default (PASSIVE) checks
+redveil scan https://staging.example.com --scope examples/scope.staging.yaml
+
+# List all built-in check plugins
+redveil list-checks
+
+# Re-render a report from an existing findings.json
+redveil report reports/staging.example.com
+```
+
+Reports land under `reports/<target-name>/` as `summary.md`,
+`findings.json`, per-finding `findings/<id>.md`, and a self-contained
+`report.html`.
+
+## Status
+
+All five development phases are complete:
+
+- **Phase 1** — Configuration, scope controller, rate-limited HTTP client,
+  plugin registry, event bus, lifecycle state machine, CLI.
+- **Phase 2** — Finding model, evidence store with sanitization,
+  vulnerability knowledge base, deduplicator, report renderers.
+- **Phase 3** — Discovery (crawler, subdomain finder) and passive check
+  plugins (security headers, CORS, methods, disclosure, source maps,
+  open redirect indicator, session cookie).
+- **Phase 4** — Low-impact check plugins (reflected XSS, source map
+  fingerprinting, additional disclosure heuristics).
+- **Phase 5** — Active check plugins (time-based blind SQLi, OOB SSRF,
+  time-based CMDi, path traversal indicator, BOLA / IDOR across
+  multiple test principals, BFLA, GraphQL introspection, mass
+  assignment).
+
+The release ships with **17 built-in check plugins** and **900+ unit and
+integration tests**. The local vulnerable Flask lab under `tests/lab/`
+exercises the full pipeline end-to-end.
+
+## Architecture
+
+The package is organized into focused subpackages:
+
+- `core` — orchestration, scope control, event bus, lifecycle
+- `http` — async HTTP client, request/response abstractions, rate limiter
+- `discovery` — crawling, endpoint and parameter enumeration
+- `checks` — 17 built-in vulnerability check plugins
+- `validation` — safe-in-place validators and PoC executors
+- `evidence` — request/response capture, hashing, sanitization
+- `findings` — finding model, severity scoring, deduplication
+- `reporting` — report renderers (Markdown, JSON, HTML)
+- `plugins` — plugin discovery and the `Check` base class
+- `cli` — Typer-based command-line interface
+
+## Plugins
+
+Every check is a plugin. Adding a new check means subclassing
+`redveil.plugins.base.Check`, declaring metadata (id, name, category,
+safety profile, CWE / OWASP tags), and registering through the
+`redveil.checks` entry-point group:
+
+```toml
+[project.entry-points."redveil.checks"]
+my-check = "my_pkg.checks.my_check:MyCheck"
+```
+
+The orchestrator wires each plugin with the framework's HTTP client and
+scope controller. Plugins cannot instantiate their own HTTP client —
+`bind()` validates that the supplied client is bound to the
+orchestrator's scope.
+
+## Documentation
+
+- [USER_GUIDE.md](USER_GUIDE.md) — installation, concepts, CLI reference,
+  scope configuration examples, output interpretation, safety, and
+  troubleshooting.
+- [CHANGELOG.md](CHANGELOG.md) — version history and release notes.
+- [docs/architecture.md](docs/architecture.md) — internal architecture,
+  request lifecycle, safety model, plugin contract, event taxonomy, and
+  testing strategy.
+- [examples/](examples/) — runnable scope file templates for staging,
+  authenticated, multi-principal, and OOB scenarios.
+
+## License
+
+MIT — see [LICENSE](LICENSE).
+
+## Disclaimer
+
+This tool is provided for defensive security testing only. The authors
+disclaim all responsibility for any unauthorized or unlawful use. Always
+obtain explicit, written authorization before testing any system you do
+not own.