souleyez 2.43.13__tar.gz → 2.43.15__tar.gz

{souleyez-2.43.13/souleyez.egg-info → souleyez-2.43.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: souleyez
-Version: 2.43.13
+Version: 2.43.15
 Summary: AI-Powered Penetration Testing Platform with 40+ integrated tools
 Author-email: CyberSoul Security <contact@cybersoulsecurity.com>
 Maintainer-email: CyberSoul Security <contact@cybersoulsecurity.com>

{souleyez-2.43.13 → souleyez-2.43.15}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "souleyez"
-version = "2.43.13"
+version = "2.43.15"
 description = "AI-Powered Penetration Testing Platform with 40+ integrated tools"
 readme = "README.md"
 license = {text = "MIT"}

souleyez-2.43.15/souleyez/__init__.py

@@ -0,0 +1,2 @@
+__version__ = '2.43.15'
+

{souleyez-2.43.13 → souleyez-2.43.15}/souleyez/core/tool_chaining.py

@@ -4451,6 +4451,58 @@ class ToolChaining:
                         return job_ids
                 # === END Wildcard Auto-Retry ===
 
+                # === Host Redirect Auto-Retry Logic ===
+                # If gobuster detected a host-level redirect (e.g., non-www to www), auto-retry with corrected target
+                if parse_results.get('host_redirect_detected') and parse_results.get('redirect_target'):
+                    # Check if this is already a retry attempt (prevent loops)
+                    is_retry = job.get('metadata', {}).get('redirect_retry', False)
+
+                    if not is_retry:
+                        redirect_target = parse_results['redirect_target']
+                        original_target = target
+                        logger.info(f"🔄 Host redirect detected ({original_target} → {redirect_target}), creating auto-retry with corrected target")
+
+                        # Get original args and update the -u parameter with new target
+                        args = job.get('args', [])
+                        retry_args = []
+                        for i, arg in enumerate(args):
+                            if arg == '-u' and i + 1 < len(args):
+                                # Next arg is the URL, replace it
+                                retry_args.append(arg)
+                                retry_args.append(redirect_target)
+                                # Skip the next iteration since we handled it
+                            elif i > 0 and args[i - 1] == '-u':
+                                # This is the URL after -u, skip it (already handled)
+                                continue
+                            else:
+                                # Replace <target> placeholder if present
+                                retry_args.append(arg.replace(original_target, redirect_target) if original_target in arg else arg)
+
+                        # Build retry job command with corrected target
+                        retry_command = {
+                            'tool': 'gobuster',
+                            'target': redirect_target,
+                            'args': retry_args,
+                            'reason': f'Auto-retry: gobuster (host redirect detected: {original_target} → {redirect_target})',
+                            'metadata': {
+                                'redirect_retry': True,
+                                'retry_parent_job_id': job.get('id'),
+                                'original_target': original_target,
+                                'redirect_target': redirect_target
+                            }
+                        }
+
+                        # Enqueue the retry job
+                        retry_job_ids = self._enqueue_commands([retry_command], tool, engagement_id, redirect_target, parent_job_id=job.get('id'))
+                        if retry_job_ids:
+                            job_ids.extend(retry_job_ids)
+                            logger.info(f"✓ Retry job created with corrected target: {redirect_target}")
+
+                        # Skip further processing of this redirect scan
+                        # Let the retry job complete and process properly
+                        return job_ids
+                # === END Host Redirect Auto-Retry ===
+
                 # PHP/ASP files found → trigger SQLMap intelligently
                 # High-value targets get direct testing, others get base URL crawl
                 php_files = parse_results.get('php_files', [])
@@ -5041,6 +5093,57 @@ class ToolChaining:
                 return job_ids
             # === END Gobuster wildcard retry ===
 
+            # === Special handling for Gobuster host redirect retry ===
+            if tool == 'gobuster' and parse_results.get('host_redirect_detected'):
+                # Gobuster detected host-level redirect, auto-retry with corrected target
+                from souleyez.engine.background import enqueue_job
+                from souleyez.log_config import get_logger
+                logger = get_logger(__name__)
+
+                # Check if this is already a redirect retry (prevent loops)
+                is_redirect_retry = job.get('metadata', {}).get('redirect_retry', False)
+                if is_redirect_retry:
+                    logger.info(f"Gobuster host redirect: Already attempted redirect retry, skipping")
+                    return job_ids
+
+                # Get the redirect target
+                redirect_target = parse_results.get('redirect_target')
+                if not redirect_target:
+                    logger.warning(f"Gobuster host redirect detected but no redirect_target found")
+                    return job_ids
+
+                original_target = target
+                logger.info(f"Gobuster host redirect: Auto-retrying with corrected target {redirect_target}")
+
+                # Get original args and update the -u parameter with new target
+                job_args = job.get('args', [])
+                retry_args = []
+                for i, arg in enumerate(job_args):
+                    if arg == '-u' and i + 1 < len(job_args):
+                        retry_args.append(arg)
+                        retry_args.append(redirect_target)
+                    elif i > 0 and job_args[i - 1] == '-u':
+                        continue
+                    else:
+                        retry_args.append(arg.replace(original_target, redirect_target) if original_target in arg else arg)
+
+                retry_job_id = enqueue_job(
+                    tool='gobuster',
+                    target=redirect_target,
+                    args=retry_args,
+                    label=f"Auto-retry: gobuster (redirect → {redirect_target})",
+                    engagement_id=engagement_id,
+                    parent_id=job.get('id'),
+                    reason=f"Auto-triggered by gobuster: Host redirect detected ({original_target} → {redirect_target})",
+                    metadata={'redirect_retry': True, 'retry_parent_job_id': job.get('id'), 'original_target': original_target}
+                )
+
+                job_ids.append(retry_job_id)
+                logger.info(f"Created gobuster redirect retry job #{retry_job_id}")
+
+                return job_ids
+            # === END Gobuster host redirect retry ===
+
             # === Special handling for ffuf: Create SQLMap jobs and recursive ffuf scans ===
             if tool == 'ffuf':
                 from souleyez.engine.background import enqueue_job

{souleyez-2.43.13 → souleyez-2.43.15}/souleyez/docs/README.md

@@ -1,6 +1,6 @@
 # SoulEyez Documentation
 
-**Version:** 2.43.13
+**Version:** 2.43.15
 **Last Updated:** January 12, 2026
 **Organization:** CyberSoul Security
 

{souleyez-2.43.13 → souleyez-2.43.15}/souleyez/engine/result_handler.py

@@ -1218,12 +1218,27 @@ def parse_gobuster_job(engagement_id: int, log_path: str, job: Dict[str, Any]) -
                 exclude_length = length_match.group(1)
                 logger.info(f"Gobuster wildcard detected: Length {exclude_length}b")
 
+        # Check for host-level redirect (for auto-retry with corrected target)
+        host_redirect_detected = False
+        redirect_target = None
+
+        if "HOST_REDIRECT_TARGET:" in log_content:
+            host_redirect_detected = True
+            import re
+            redirect_match = re.search(r'HOST_REDIRECT_TARGET:\s*(\S+)', log_content)
+            if redirect_match:
+                redirect_target = redirect_match.group(1)
+                logger.info(f"Gobuster host redirect detected: {redirect_target}")
+
         # Check for gobuster errors
         gobuster_error = detect_tool_error(log_content, 'gobuster')
 
         # Determine status based on results
         if gobuster_error:
             status = STATUS_ERROR  # Tool failed to connect
+        elif host_redirect_detected:
+            # Host redirect detected - warning status (triggers auto-retry with corrected target)
+            status = STATUS_WARNING
         elif wildcard_detected:
             # Wildcard detected - warning status (triggers auto-retry)
             status = STATUS_WARNING
@@ -1255,6 +1270,12 @@ def parse_gobuster_job(engagement_id: int, log_path: str, job: Dict[str, Any]) -
             if exclude_length:
                 result['exclude_length'] = exclude_length
 
+        # Add host redirect info if detected
+        if host_redirect_detected:
+            result['host_redirect_detected'] = True
+            if redirect_target:
+                result['redirect_target'] = redirect_target
+
         return result
     except Exception as e:
         return {'error': str(e)}

{souleyez-2.43.13 → souleyez-2.43.15}/souleyez/main.py

@@ -173,7 +173,7 @@ def _check_privileged_tools():
 
 
 @click.group()
-@click.version_option(version='2.43.13')
+@click.version_option(version='2.43.15')
 def cli():
     """SoulEyez - AI-Powered Pentesting Platform by CyberSoul Security"""
     from souleyez.log_config import init_logging

{souleyez-2.43.13 → souleyez-2.43.15}/souleyez/plugins/gobuster.py

@@ -239,18 +239,25 @@ class GobusterPlugin(PluginBase):
         This causes gobuster to fail or produce false positives. We detect this
         upfront and auto-add --exclude-length to filter them out.
 
+        Also detects host-level redirects (e.g., non-www to www) and warns the user.
+
         Returns:
             dict with keys:
                 - exclude_length: str or None (response length to exclude)
                 - exclude_status: str or None (status code detected)
                 - reason: str or None (explanation)
+                - redirect_host: str or None (suggested target if host redirect detected)
         """
-        result = {'exclude_length': None, 'exclude_status': None, 'reason': None}
+        result = {'exclude_length': None, 'exclude_status': None, 'reason': None, 'redirect_host': None}
 
         # Generate random UUID path that definitely doesn't exist
         test_path = str(uuid.uuid4())
         test_url = f"{base_url.rstrip('/')}/{test_path}"
 
+        # Parse the original target host for comparison
+        original_parsed = urlparse(base_url)
+        original_host = original_parsed.netloc.lower()
+
         try:
             resp = requests.get(
                 test_url,
@@ -263,6 +270,46 @@ class GobusterPlugin(PluginBase):
             if resp.status_code == 404:
                 return result
 
+            # Check for host-level redirects (301/302/307/308)
+            if resp.status_code in [301, 302, 307, 308]:
+                location = resp.headers.get('Location', '')
+                if location:
+                    # Parse the redirect location
+                    redirect_parsed = urlparse(location)
+                    redirect_host = redirect_parsed.netloc.lower()
+
+                    # If Location is relative, it's not a host redirect
+                    if redirect_host and redirect_host != original_host:
+                        # This is a host-level redirect (e.g., non-www to www)
+                        suggested_url = f"{redirect_parsed.scheme or original_parsed.scheme}://{redirect_host}"
+                        result['redirect_host'] = suggested_url
+                        result['exclude_status'] = str(resp.status_code)
+                        result['reason'] = (
+                            f"Host redirect detected: {original_host} → {redirect_host}"
+                        )
+
+                        if log_path:
+                            with open(log_path, 'a') as f:
+                                f.write(f"\n{'=' * 70}\n")
+                                f.write("⚠️  HOST-LEVEL REDIRECT DETECTED\n")
+                                f.write(f"{'=' * 70}\n")
+                                f.write(f"Target: {base_url}\n")
+                                f.write(f"Redirects to: {redirect_host}\n")
+                                f.write(f"Status: {resp.status_code}\n\n")
+                                f.write("The server redirects ALL requests to a different host.\n")
+                                f.write("This causes unreliable results because:\n")
+                                f.write("  - Response sizes vary based on path length in redirect URL\n")
+                                f.write("  - Gobuster may report false positives or miss real paths\n\n")
+                                # Parseable marker for auto-retry
+                                f.write(f"HOST_REDIRECT_TARGET: {suggested_url}\n\n")
+                                f.write("Auto-retrying with corrected target...\n")
+                                f.write(f"{'=' * 70}\n\n")
+
+                        # Still try to exclude the response length for this scan
+                        content_length = len(resp.content)
+                        result['exclude_length'] = str(content_length)
+                        return result
+
             # Any other status for a random UUID = false positive indicator
             # Common: 403 (blocked), 401 (auth required), 200 (catch-all), 500 (error page)
             if resp.status_code in [200, 301, 302, 400, 401, 403, 500, 503]: