stryx-cli 0.1.0__py3-none-any.whl

stryx/__init__.py

@@ -0,0 +1,35 @@
+"""STRYX - AI-Powered Dynamic Application Security Testing (DAST).
+
+Part of the MEDUSA security platform:
+  - Remy (SAST) + STRYX (DAST) + MEDUSA (Aggregator)
+
+Features:
+  - 16 scanner modules (injection, auth, authorization, fuzz, CORS, GraphQL,
+    blind, disclosure, race, cloud SSRF, dependencies, and more)
+  - AI-powered attack chain planning and payload generation
+  - Recursive HTML crawler with depth limiting
+  - Session state machine for authenticated scanning
+  - SARIF 2.1.0 output for CI/CD integration
+  - Policy engine for security quality gates
+  - Baseline comparison for regression tracking
+  - Multi-format reports (Terminal, JSON, HTML, Markdown, SARIF)
+
+Usage:
+    stryx scan https://target.com
+    stryx scan https://target.com --deep --sarif results.sarif
+    stryx scan https://target.com --policy policy.yaml
+"""
+
+__version__ = "0.1.0"
+__author__ = "Akhilesh Varma"
+__license__ = "Apache-2.0"
+__description__ = "AI-Powered Dynamic Application Security Testing (DAST)"
+__url__ = "https://github.com/medusa-Security/stryx"
+
+__all__ = [
+    "__version__",
+    "__author__",
+    "__license__",
+    "__description__",
+    "__url__",
+]

stryx/ai/__init__.py

@@ -0,0 +1,5 @@
+"""AI-powered attack planning modules for STRYX."""
+
+from stryx.ai.attack_planner import AttackPlanner
+
+__all__ = ["AttackPlanner"]

stryx/ai/attack_planner.py

@@ -0,0 +1,199 @@
+"""AI-powered attack planner.
+
+Uses AI providers to analyze findings and construct attack chains.
+Falls back to rule-based chain building if AI is unavailable.
+Generates per-finding remediation via AI when available.
+"""
+
+from __future__ import annotations
+
+import json
+
+from stryx.ai.prompts import (
+    ATTACK_CHAIN_PROMPT,
+    REMEDIATION_PROMPT,
+    SYSTEM_PROMPT,
+    format_findings_for_prompt,
+)
+from stryx.ai.providers import AIProvider, get_provider
+from stryx.attacks.attack_chain import AttackChain, ChainBuilder
+from stryx.utils.evidence import Finding
+from stryx.utils.logging import get_logger
+
+logger = get_logger("ai.attack_planner")
+
+
+class AttackPlanner:
+    """AI-assisted attack chain planner."""
+
+    def __init__(
+        self,
+        provider_name: str = "groq",
+        model: str | None = None,
+        api_key: str | None = None,
+    ):
+        self.provider_name = provider_name
+        self.model = model
+        self.api_key = api_key
+        self._provider: AIProvider | None = None
+
+    def _get_provider(self) -> AIProvider | None:
+        """Get or create the AI provider."""
+        if self._provider is None:
+            try:
+                self._provider = get_provider(
+                    self.provider_name,
+                    api_key=self.api_key,
+                    model=self.model,
+                )
+            except Exception as e:
+                logger.warning(f"Failed to initialize AI provider: {e}")
+                return None
+        return self._provider
+
+    async def plan_attack_chains(self, findings: list[Finding]) -> list[AttackChain]:
+        """Plan attack chains using AI or rule-based fallback."""
+        if not findings:
+            logger.info("No findings to analyze")
+            return []
+
+        # Always build rule-based chains as a baseline
+        builder = ChainBuilder(findings)
+        chains = builder.build_chains()
+
+        # Try AI-enhanced planning
+        provider = self._get_provider()
+        if provider and self.api_key:
+            try:
+                ai_chains = await self._ai_plan_chains(findings, provider)
+                if ai_chains:
+                    chains.extend(ai_chains)
+                    logger.info(f"AI generated {len(ai_chains)} additional attack chains")
+            except Exception as e:
+                logger.warning(f"AI attack planning failed, using rule-based chains: {e}")
+
+            # Generate AI remediation for findings
+            try:
+                await self._generate_remediation(findings, provider)
+            except Exception as e:
+                logger.warning(f"AI remediation generation failed: {e}")
+        else:
+            logger.info("AI provider not configured, using rule-based attack chains only")
+
+        return chains
+
+    async def _generate_remediation(
+        self, findings: list[Finding], provider: AIProvider
+    ) -> None:
+        """Generate AI-powered remediation for each finding."""
+        logger.info(f"Generating remediation for {len(findings)} findings")
+
+        # Process findings in batches to avoid token limits
+        batch_size = 10
+        for i in range(0, len(findings), batch_size):
+            batch = findings[i:i + batch_size]
+
+            for finding in batch:
+                if finding.remediation:
+                    continue  # Skip if already has remediation
+
+                try:
+                    prompt = REMEDIATION_PROMPT.format(
+                        title=finding.title,
+                        severity=finding.severity.value,
+                        cwe=finding.cwe,
+                        endpoint=finding.endpoint,
+                        description=finding.description,
+                    )
+
+                    response = await provider.generate(prompt, SYSTEM_PROMPT)
+                    if not response:
+                        continue
+
+                    # Parse response
+                    response = response.strip()
+                    if response.startswith("```"):
+                        response = response.split("\n", 1)[1]
+                        if response.endswith("```"):
+                            response = response[:-3]
+
+                    data = json.loads(response)
+                    if isinstance(data, dict):
+                        fix = data.get("fix", "")
+                        if fix:
+                            finding.remediation = fix
+                            logger.debug(f"Generated remediation for: {finding.title}")
+
+                except (json.JSONDecodeError, ValueError, Exception) as e:
+                    logger.debug(f"Failed to generate remediation for {finding.title}: {e}")
+                    continue
+
+    async def _ai_plan_chains(
+        self, findings: list[Finding], provider: AIProvider
+    ) -> list[AttackChain]:
+        """Use AI to generate attack chains."""
+        findings_data = [f.to_dict() for f in findings]
+        findings_text = format_findings_for_prompt(findings_data)
+
+        prompt = ATTACK_CHAIN_PROMPT.format(findings_json=findings_text)
+
+        response = await provider.generate(prompt, SYSTEM_PROMPT)
+        if not response:
+            return []
+
+        # Parse AI response
+        try:
+            # Try to extract JSON from response
+            response = response.strip()
+            if response.startswith("```"):
+                response = response.split("\n", 1)[1]
+                if response.endswith("```"):
+                    response = response[:-3]
+
+            chains_data = json.loads(response)
+            if not isinstance(chains_data, list):
+                return []
+
+            chains: list[AttackChain] = []
+            for chain_data in chains_data:
+                if not isinstance(chain_data, dict):
+                    continue
+
+                chain = AttackChain(
+                    name=chain_data.get("name", "AI-Generated Chain"),
+                    total_impact=chain_data.get("total_impact", ""),
+                    estimated_severity=chain_data.get("estimated_severity", "high"),
+                )
+
+                for step_data in chain_data.get("steps", []):
+                    if isinstance(step_data, dict):
+                        # Find matching finding
+                        matching_finding = self._find_matching_finding(
+                            findings, step_data.get("title", "")
+                        )
+                        if matching_finding:
+                            chain.add_step(
+                                matching_finding,
+                                step_data.get("description", ""),
+                                step_data.get("impact", ""),
+                            )
+
+                if chain.steps:
+                    chains.append(chain)
+
+            return chains
+
+        except (json.JSONDecodeError, ValueError) as e:
+            logger.warning(f"Failed to parse AI response: {e}")
+            return []
+
+    def _find_matching_finding(
+        self, findings: list[Finding], title: str
+    ) -> Finding | None:
+        """Find a finding matching the given title."""
+        title_lower = title.lower()
+        for f in findings:
+            if title_lower in f.title.lower() or f.title.lower() in title_lower:
+                return f
+        # Fallback: return first finding
+        return findings[0] if findings else None

stryx/ai/payload_generator.py

@@ -0,0 +1,212 @@
+"""AI-powered smart payload generator.
+
+Uses LLMs to generate context-aware attack payloads that bypass WAFs
+and target specific frameworks. Falls back to static payloads when
+AI is unavailable.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from stryx.utils.logging import get_logger
+
+logger = get_logger("ai.payload_generator")
+
+
+# Static fallback payloads by category
+FALLBACK_PAYLOADS: dict[str, list[str]] = {
+    "sqli": [
+        "' OR '1'='1'--",
+        "' UNION SELECT NULL--",
+        "1' AND SLEEP(3)--",
+        "1; DROP TABLE users--",
+        "' OR 1=1#",
+    ],
+    "xss": [
+        "<script>alert(1)</script>",
+        "<img src=x onerror=alert(1)>",
+        "<svg onload=alert(1)>",
+        "javascript:alert(1)",
+        "'-alert(1)-'",
+    ],
+    "ssrf": [
+        "http://127.0.0.1:80/",
+        "http://169.254.169.254/latest/meta-data/",
+        "http://localhost:8080/",
+        "http://[::1]/",
+        "http://0177.0.0.1/",
+    ],
+    "cmdi": [
+        "; cat /etc/passwd",
+        "| id",
+        "`whoami`",
+        "$(cat /etc/passwd)",
+        "; sleep 5",
+    ],
+    "path_traversal": [
+        "../../../etc/passwd",
+        "..%2f..%2f..%2fetc/passwd",
+        "....//....//....//etc/passwd",
+        "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd",
+    ],
+    "ssti": [
+        "{{7*7}}",
+        "${7*7}",
+        "<%= 7*7 %>",
+        "#{7*7}",
+        "{{config.items()}}",
+    ],
+}
+
+
+PAYLOAD_GENERATION_PROMPT = """You are an expert penetration tester. Generate {count} security testing payloads for the following scenario:
+
+Category: {category}
+Framework: {framework}
+Target endpoint: {endpoint}
+WAF detected: {waf}
+Previous payload that worked: {previous_payload}
+
+Generate payloads that:
+1. Are specific to the {framework} framework
+2. Bypass common WAF rules if {waf} is detected
+3. Are realistic and would be used by a real attacker
+4. Cover different encoding and bypass techniques
+
+Return ONLY a JSON array of payload strings, no other text.
+Example: ["payload1", "payload2", "payload3"]
+"""
+
+
+class PayloadGenerator:
+    """Generates context-aware attack payloads using AI."""
+
+    def __init__(self, ai_provider: Any = None):
+        """
+        Args:
+            ai_provider: An AI provider instance with a generate() method.
+                        If None, uses fallback static payloads.
+        """
+        self.ai_provider = ai_provider
+        self._cache: dict[str, list[str]] = {}
+
+    async def generate(
+        self,
+        category: str,
+        framework: str = "unknown",
+        endpoint: str = "",
+        waf: str = "none",
+        previous_payload: str = "",
+        count: int = 10,
+    ) -> list[str]:
+        """Generate payloads for a specific category and context.
+
+        Args:
+            category: Payload category (sqli, xss, ssrf, cmdi, etc.)
+            framework: Detected framework (e.g., "Express", "Django", "Flask")
+            endpoint: Target endpoint URL
+            waf: Detected WAF name (e.g., "Cloudflare", "ModSecurity")
+            previous_payload: A payload that previously worked
+            count: Number of payloads to generate
+
+        Returns:
+            List of payload strings
+        """
+        # Check cache
+        cache_key = f"{category}:{framework}:{waf}"
+        if cache_key in self._cache:
+            return self._cache[cache_key][:count]
+
+        # Try AI generation
+        if self.ai_provider:
+            try:
+                payloads = await self._generate_with_ai(
+                    category, framework, endpoint, waf, previous_payload, count
+                )
+                if payloads:
+                    self._cache[cache_key] = payloads
+                    return payloads
+            except Exception as e:
+                logger.debug(f"AI payload generation failed: {e}")
+
+        # Fallback to static payloads
+        payloads = self._get_fallback_payloads(category)
+        self._cache[cache_key] = payloads
+        return payloads[:count]
+
+    async def _generate_with_ai(
+        self,
+        category: str,
+        framework: str,
+        endpoint: str,
+        waf: str,
+        previous_payload: str,
+        count: int,
+    ) -> list[str]:
+        """Generate payloads using the AI provider."""
+        prompt = PAYLOAD_GENERATION_PROMPT.format(
+            count=count,
+            category=category,
+            framework=framework,
+            endpoint=endpoint or "N/A",
+            waf=waf,
+            previous_payload=previous_payload or "None",
+        )
+
+        response = await self.ai_provider.generate(
+            prompt=prompt,
+            system_prompt="You are a security testing expert. Return only valid JSON arrays.",
+        )
+
+        # Parse response
+        try:
+            # Try to extract JSON array from response
+            text = response.strip()
+            if text.startswith("["):
+                payloads = json.loads(text)
+            else:
+                # Try to find JSON array in the response
+                start = text.find("[")
+                end = text.rfind("]") + 1
+                if start != -1 and end > start:
+                    payloads = json.loads(text[start:end])
+                else:
+                    return []
+
+            if isinstance(payloads, list):
+                return [str(p) for p in payloads if isinstance(p, str)][:count]
+        except (json.JSONDecodeError, TypeError):
+            pass
+
+        return []
+
+    def _get_fallback_payloads(self, category: str) -> list[str]:
+        """Get static fallback payloads for a category."""
+        return FALLBACK_PAYLOADS.get(category, [])
+
+    def detect_waf(self, response_headers: dict[str, str], response_body: str = "") -> str:
+        """Detect if a WAF is present based on response patterns."""
+        waf_signatures = {
+            "Cloudflare": ["cf-ray", "cf-cache-status", "cloudflare"],
+            "Akamai": ["x-akamai-transformed", "akamai"],
+            "AWS WAF": ["x-amzn-waf", "aws"],
+            "ModSecurity": ["mod_security", "modsecurity"],
+            "Incapsula": ["x-iinfo", "incap_ses", "incapsula"],
+            "Sucuri": ["x-sucuri-id", "sucuri"],
+            "Barracuda": ["x-barracuda", "barracuda"],
+            "F5 BIG-IP": ["x-cnection", "bigip"],
+            "FortiWeb": ["x-fortiwaf", "fortiweb"],
+            "Imperva": ["x-cdn", "imperva"],
+        }
+
+        headers_str = json.dumps(response_headers).lower()
+        body_lower = response_body.lower()
+
+        for waf_name, signatures in waf_signatures.items():
+            for sig in signatures:
+                if sig.lower() in headers_str or sig.lower() in body_lower:
+                    return waf_name
+
+        return "none"

stryx/ai/prompts.py

@@ -0,0 +1,85 @@
+"""Prompt templates for the AI attack planner."""
+
+SYSTEM_PROMPT = """You are an expert application security analyst specializing in
+Dynamic Application Security Testing (DAST). Your role is to analyze scan findings
+and construct realistic attack chains that demonstrate how individual vulnerabilities
+can be combined to achieve significant impact.
+
+Rules:
+1. Only propose attack chains that are supported by the actual findings provided.
+2. Each chain must have a clear sequence of steps.
+3. Estimate the realistic impact of each chain.
+4. Return your response as strict JSON matching the schema provided.
+5. Do not fabricate vulnerabilities not present in the findings.
+6. Prioritize chains with highest real-world impact.
+7. Consider the relationships between findings (e.g., auth bypass enables IDOR)."""
+
+ATTACK_CHAIN_PROMPT = """Analyze the following security scan findings and construct
+realistic attack chains. Each chain should show how individual vulnerabilities can
+be combined for greater impact.
+
+Findings:
+{findings_json}
+
+Return a JSON array of attack chains with this exact schema:
+[
+  {{
+    "name": "Chain name describing the attack path",
+    "steps": [
+      {{
+        "title": "Step title",
+        "description": "What this step achieves",
+        "severity": "critical|high|medium|low",
+        "endpoint": "affected endpoint"
+      }}
+    ],
+    "total_impact": "Description of the overall impact",
+    "estimated_severity": "critical|high|medium|low",
+    "rationale": "Why this chain is realistic and actionable"
+  }}
+]
+
+Focus on chains that:
+1. Combine authentication/authorization issues with injection or data exposure
+2. Demonstrate privilege escalation paths
+3. Show data exfiltration scenarios
+4. Reveal denial-of-service opportunities
+
+Return ONLY the JSON array, no other text."""
+
+REMEDIATION_PROMPT = """Based on the following finding, provide a detailed
+remediation recommendation:
+
+Title: {title}
+Severity: {severity}
+CWE: {cwe}
+Endpoint: {endpoint}
+Description: {description}
+
+Provide:
+1. A specific, actionable fix
+2. Code example if applicable
+3. Additional hardening recommendations
+4. Testing steps to verify the fix
+
+Return as JSON:
+{{
+  "fix": "Specific remediation steps",
+  "code_example": "Code example if applicable",
+  "hardening": ["Additional recommendations"],
+  "testing": ["Steps to verify the fix"]
+}}"""
+
+
+def format_findings_for_prompt(findings: list[dict]) -> str:
+    """Format findings list into a string for the AI prompt."""
+    formatted = []
+    for i, f in enumerate(findings, 1):
+        formatted.append(
+            f"{i}. [{f.get('severity', 'unknown').upper()}] {f.get('title', 'Unknown')}\n"
+            f"   Endpoint: {f.get('endpoint', 'N/A')}\n"
+            f"   Description: {f.get('description', 'N/A')}\n"
+            f"   CWE: {f.get('cwe', 'N/A')}\n"
+            f"   Tags: {', '.join(f.get('tags', []))}\n"
+        )
+    return "\n".join(formatted)