stryx-cli 0.1.0__py3-none-any.whl

stryx/scanners/race.py

@@ -0,0 +1,257 @@
+"""Race condition scanner.
+
+Tests for TOCTOU (Time-of-Check to Time-of-Use) vulnerabilities
+by sending concurrent requests and detecting inconsistent state changes.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+from dataclasses import dataclass
+from typing import Any
+
+from stryx.utils.evidence import Evidence, Finding, Severity
+from stryx.utils.http_client import HttpClient
+from stryx.utils.logging import get_logger
+
+logger = get_logger("scanner.race")
+
+# Number of concurrent requests per race test
+RACE_CONCURRENCY = 15
+
+
+@dataclass
+class RaceTestConfig:
+    """Configuration for a race condition test."""
+
+    name: str
+    url: str
+    method: str = "POST"
+    body: dict[str, Any] | None = None
+    headers: dict[str, str] | None = None
+    expected_count: int = 1  # Expected number of successful operations
+    description: str = ""
+
+
+class RaceScanner:
+    """Scanner for race condition (TOCTOU) vulnerabilities."""
+
+    def __init__(self, client: HttpClient):
+        self.client = client
+
+    async def scan(
+        self,
+        endpoints: list[str],
+        base_url: str,
+    ) -> list[Finding]:
+        """Run race condition tests against endpoints."""
+        findings: list[Finding] = []
+        logger.info("Running race condition scanner")
+
+        # Detect potential race condition endpoints
+        race_configs = self._build_race_tests(endpoints, base_url)
+
+        for config in race_configs:
+            try:
+                finding = await self._test_race_condition(config)
+                if finding:
+                    findings.append(finding)
+            except Exception as e:
+                logger.debug(f"Race test error ({config.name}): {e}")
+
+        logger.info(f"Race condition scanner found {len(findings)} findings")
+        return findings
+
+    def _build_race_tests(
+        self, endpoints: list[str], base_url: str
+    ) -> list[RaceTestConfig]:
+        """Build race condition test configurations based on discovered endpoints."""
+        configs: list[RaceTestConfig] = []
+
+        for endpoint in endpoints:
+            ep_lower = endpoint.lower()
+
+            # Balance/transfer endpoints
+            if any(kw in ep_lower for kw in ["transfer", "balance", "payment", "checkout", "purchase"]):
+                configs.append(RaceTestConfig(
+                    name="double-spend",
+                    url=endpoint,
+                    method="POST",
+                    body={"amount": 100, "currency": "USD"},
+                    expected_count=1,
+                    description="Double-spend via race condition on payment endpoint",
+                ))
+
+            # Coupon/discount endpoints
+            if any(kw in ep_lower for kw in ["coupon", "discount", "promo", "redeem"]):
+                configs.append(RaceTestConfig(
+                    name="coupon-reuse",
+                    url=endpoint,
+                    method="POST",
+                    body={"code": "TESTCOUPON"},
+                    expected_count=1,
+                    description="Coupon reuse via race condition",
+                ))
+
+            # Vote/like endpoints
+            if any(kw in ep_lower for kw in ["vote", "like", "upvote", "reaction"]):
+                configs.append(RaceTestConfig(
+                    name="vote-manipulation",
+                    url=endpoint,
+                    method="POST",
+                    body={"id": "1"},
+                    expected_count=1,
+                    description="Vote manipulation via race condition",
+                ))
+
+            # Registration endpoints
+            if any(kw in ep_lower for kw in ["register", "signup", "create"]):
+                configs.append(RaceTestConfig(
+                    name="duplicate-registration",
+                    url=endpoint,
+                    method="POST",
+                    body={"email": "race-test@example.com", "username": "race-test-user"},
+                    expected_count=1,
+                    description="Duplicate registration via race condition",
+                ))
+
+            # Generic POST endpoints (test for idempotency issues)
+            if any(kw in ep_lower for kw in ["api", "action", "submit", "process"]):
+                configs.append(RaceTestConfig(
+                    name="generic-race",
+                    url=endpoint,
+                    method="POST",
+                    body={"test": "race-condition"},
+                    expected_count=1,
+                    description="Generic race condition test",
+                ))
+
+        # Add common race condition paths
+        common_paths = [
+            "/api/transfer", "/api/payment", "/api/checkout",
+            "/api/coupon/redeem", "/api/vote", "/api/like",
+        ]
+        for path in common_paths:
+            url = f"{base_url}{path}"
+            if not any(c.url == url for c in configs):
+                configs.append(RaceTestConfig(
+                    name=f"common-{path.split('/')[-1]}",
+                    url=url,
+                    method="POST",
+                    body={"test": "race"},
+                    expected_count=1,
+                    description=f"Race condition test on {path}",
+                ))
+
+        return configs[:10]  # Limit total tests
+
+    async def _test_race_condition(self, config: RaceTestConfig) -> Finding | None:
+        """Test a specific race condition scenario."""
+        logger.info(f"Testing race condition: {config.name}")
+
+        # Send concurrent requests
+        tasks = []
+        for i in range(RACE_CONCURRENCY):
+            tasks.append(self._send_request(config, i))
+
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+
+        # Analyze results
+        successful = []
+        failed = []
+        responses: list[str] = []
+
+        for i, result in enumerate(results):
+            if isinstance(result, Exception):
+                failed.append(i)
+                responses.append(f"Request {i}: ERROR - {result}")
+            elif result is not None:
+                status, body = result
+                responses.append(f"Request {i}: {status}")
+                if status in (200, 201, 202):
+                    successful.append(i)
+            else:
+                failed.append(i)
+                responses.append(f"Request {i}: None")
+
+        # Check for race condition indicators
+        if len(successful) > config.expected_count:
+            # More requests succeeded than expected — possible race condition
+            confidence = min(0.85, 0.4 + (len(successful) - config.expected_count) * 0.1)
+
+            return Finding(
+                title=f"Race condition: {config.name} ({len(successful)}/{RACE_CONCURRENCY} succeeded)",
+                severity=Severity.HIGH,
+                evidence=Evidence(
+                    request_method=config.method,
+                    request_url=config.url,
+                    response_status=200,
+                    response_body=json.dumps(config.body or {}),
+                    response_snippet="\n".join(responses[:20]),
+                    payload=json.dumps(config.body or {}),
+                    confidence=confidence,
+                ),
+                description=(
+                    f"{config.description}. "
+                    f"Out of {RACE_CONCURRENCY} concurrent requests, "
+                    f"{len(successful)} succeeded (expected: {config.expected_count}). "
+                    f"This indicates a race condition vulnerability."
+                ),
+                remediation=(
+                    "Implement proper locking mechanisms (database transactions, "
+                    "distributed locks, idempotency keys) to prevent concurrent "
+                    "operations from corrupting state."
+                ),
+                cwe="CWE-362",
+                owasp="A04:2021 - Insecure Design",
+                endpoint=config.url,
+                scanner="race",
+                tags=["race-condition", "toctou", "concurrency"],
+            )
+
+        # Check for inconsistent responses (some succeed, some fail)
+        if successful and failed and len(successful) < RACE_CONCURRENCY:
+            # Partial success may indicate timing-dependent behavior
+            return Finding(
+                title=f"Possible race condition: {config.name}",
+                severity=Severity.MEDIUM,
+                evidence=Evidence(
+                    request_method=config.method,
+                    request_url=config.url,
+                    response_status=200,
+                    response_body=json.dumps(config.body or {}),
+                    response_snippet="\n".join(responses[:20]),
+                    payload=json.dumps(config.body or {}),
+                    confidence=0.5,
+                ),
+                description=(
+                    f"{config.description}. "
+                    f"{len(successful)}/{RACE_CONCURRENCY} requests succeeded, "
+                    f"indicating timing-dependent behavior that may be exploitable."
+                ),
+                remediation="Review endpoint for race conditions. Add proper locking.",
+                cwe="CWE-362",
+                owasp="A04:2021 - Insecure Design",
+                endpoint=config.url,
+                scanner="race",
+                tags=["race-condition", "timing"],
+            )
+
+        return None
+
+    async def _send_request(
+        self, config: RaceTestConfig, index: int
+    ) -> tuple[int, str] | None:
+        """Send a single request for the race test."""
+        try:
+            body = json.dumps(config.body) if config.body else None
+            response, _ = await self.client.request(
+                method=config.method,
+                url=config.url,
+                headers=config.headers,
+                body=body,
+            )
+            return (response.status_code, response.text[:200])
+        except Exception:
+            return None

stryx/signatures/framework_fingerprints.yaml

@@ -0,0 +1,122 @@
+# Framework and technology fingerprints used by the injection engine
+# to adapt payloads to the target framework.
+
+frameworks:
+  python_flask:
+    name: Flask
+    headers:
+      - "Server: Werkzeug"
+      - "Server: Python"
+    cookies:
+      - "session=ey"
+      - "csrf_token="
+    body_patterns:
+      - "flask"
+      - "werkzeug"
+    sql_dialect: "generic"
+    injection_modifiers:
+      - "sleep"
+      - "benchmark"
+
+  python_django:
+    name: Django
+    headers:
+      - "Server: WSGIServer"
+      - "X-Frame-Options: DENY"
+      - "X-Content-Type-Options: nosniff"
+    cookies:
+      - "csrftoken="
+      - "sessionid="
+    body_patterns:
+      - "csrfmiddlewaretoken"
+      - "django"
+    sql_dialect: "postgres"
+    injection_modifiers:
+      - "pg_sleep"
+
+  node_express:
+    name: Express
+    headers:
+      - "X-Powered-By: Express"
+    cookies:
+      - "connect.sid="
+    body_patterns:
+      - "express"
+    sql_dialect: "generic"
+
+  php_laravel:
+    name: Laravel
+    headers:
+      - "Server: Apache"
+      - "X-Powered-By: PHP"
+    cookies:
+      - "laravel_session="
+      - "XSRF-TOKEN="
+    body_patterns:
+      - "laravel"
+      - "csrf-token"
+    sql_dialect: "mysql"
+    injection_modifiers:
+      - "sleep(5)"
+
+  ruby_rails:
+    name: Ruby on Rails
+    headers:
+      - "X-Powered-By: Phusion Passenger"
+      - "X-Request-Id:"
+    cookies:
+      - "_session_id="
+      - "rack.session="
+    body_patterns:
+      - "authenticity_token"
+    sql_dialect: "postgres"
+
+  java_spring:
+    name: Spring Boot
+    headers:
+      - "X-Application-Context:"
+      - "Set-Cookie: JSESSIONID="
+    cookies:
+      - "JSESSIONID="
+    body_patterns:
+      - "spring"
+      - "whitelabel error"
+    sql_dialect: "generic"
+
+  dotnet_aspnet:
+    name: ASP.NET
+    headers:
+      - "X-Powered-By: ASP.NET"
+      - "X-AspNet-Version:"
+      - "X-AspNetMvc-Version:"
+    cookies:
+      - "ASP.NET_SessionId="
+      - "__RequestVerificationToken="
+    body_patterns:
+      - "__VIEWSTATE"
+      - "__EVENTVALIDATION"
+    sql_dialect: "mssql"
+
+  go_gin:
+    name: Go (Gin/Echo/Fiber)
+    headers:
+      - "Server: Go-http-server"
+    cookies:
+      - "session="
+    body_patterns:
+      - "go"
+    sql_dialect: "generic"
+
+  graphql:
+    name: GraphQL
+    headers:
+      - "Content-Type: application/json"
+    endpoints:
+      - "/graphql"
+      - "/graphiql"
+      - "/api/graphql"
+      - "/query"
+    body_patterns:
+      - "query"
+      - "mutation"
+      - "subscription"

stryx/signatures/known_vulns.yaml

@@ -0,0 +1,210 @@
+# Known vulnerable JavaScript library versions
+# Format: library_name:
+#   CVE-ID:
+#     affected: "<version" or ">=version,<version"
+#     fixed_version: "version"
+#     severity: "critical|high|medium|low"
+#     description: "Description of the vulnerability"
+#     reference: "URL to advisory"
+#     cwe: "CWE-XXX"
+
+jquery:
+  CVE-2020-11022:
+    affected: "<3.5.0"
+    fixed_version: "3.5.0"
+    severity: "medium"
+    description: "XSS vulnerability in jQuery's html() method when passing untrusted HTML"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2020-11022"
+    cwe: "CWE-79"
+  CVE-2020-11023:
+    affected: "<3.5.0"
+    fixed_version: "3.5.0"
+    severity: "medium"
+    description: "XSS vulnerability in jQuery's DOM manipulation methods"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2020-11023"
+    cwe: "CWE-79"
+  CVE-2019-11358:
+    affected: "<3.4.0"
+    fixed_version: "3.4.0"
+    severity: "medium"
+    description: "Prototype pollution vulnerability in jQuery.extend()"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2019-11358"
+    cwe: "CWE-1321"
+  CVE-2015-9251:
+    affected: "<3.0.0"
+    fixed_version: "3.0.0"
+    severity: "medium"
+    description: "XSS via cross-domain AJAX requests when text/javascript responses are received"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
+    cwe: "CWE-79"
+
+lodash:
+  CVE-2021-23337:
+    affected: "<4.17.21"
+    fixed_version: "4.17.21"
+    severity: "high"
+    description: "Command injection via template function"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
+    cwe: "CWE-78"
+  CVE-2020-28500:
+    affected: "<4.17.21"
+    fixed_version: "4.17.21"
+    severity: "medium"
+    description: "ReDoS (Regular Expression Denial of Service) in trim functions"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"
+    cwe: "CWE-400"
+  CVE-2020-8203:
+    affected: "<4.17.19"
+    fixed_version: "4.17.19"
+    severity: "high"
+    description: "Prototype pollution vulnerability"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2020-8203"
+    cwe: "CWE-1321"
+
+angular:
+  CVE-2022-25869:
+    affected: "<1.8.0"
+    fixed_version: "1.8.0"
+    severity: "high"
+    description: "XSS vulnerability in $sanitize service"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2022-25869"
+    cwe: "CWE-79"
+  CVE-2022-25868:
+    affected: "<1.8.0"
+    fixed_version: "1.8.0"
+    severity: "medium"
+    description: "XSS via template injection in jqLite"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2022-25868"
+    cwe: "CWE-79"
+  CVE-2021-41056:
+    affected: "<1.7.5"
+    fixed_version: "1.7.5"
+    severity: "high"
+    description: "XSS vulnerability in $sanitize"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2021-41056"
+    cwe: "CWE-79"
+
+bootstrap:
+  CVE-2024-6531:
+    affected: "<4.3.1"
+    fixed_version: "4.3.1"
+    severity: "medium"
+    description: "XSS vulnerability in tooltip and popover data attributes"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2024-6531"
+    cwe: "CWE-79"
+  CVE-2019-8331:
+    affected: "<4.3.1"
+    fixed_version: "4.3.1"
+    severity: "medium"
+    description: "XSS in tooltip, popover, and collapse data-template"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2019-8331"
+    cwe: "CWE-79"
+
+moment:
+  CVE-2022-31129:
+    affected: "<2.29.4"
+    fixed_version: "2.29.4"
+    severity: "high"
+    description: "ReDoS (Regular Expression Denial of Service) in ISO date parsing"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2022-31129"
+    cwe: "CWE-400"
+
+underscore:
+  CVE-2021-23358:
+    affected: "<1.13.3"
+    fixed_version: "1.13.3"
+    severity: "high"
+    description: "Arbitrary code execution via template settings"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2021-23358"
+    cwe: "CWE-94"
+
+three:
+  CVE-2023-36479:
+    affected: "<0.160.0"
+    fixed_version: "0.160.0"
+    severity: "medium"
+    description: "Prototype pollution in GLTFLoader"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2023-36479"
+    cwe: "CWE-1321"
+
+d3:
+  CVE-2023-45133:
+    affected: "<7.0.0"
+    fixed_version: "7.0.0"
+    severity: "critical"
+    description: "Prototype pollution in d3.merge() and d3.concat()"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2023-45133"
+    cwe: "CWE-1321"
+
+backbone:
+  CVE-2020-21716:
+    affected: "<1.4.0"
+    fixed_version: "1.4.0"
+    severity: "medium"
+    description: "XSS vulnerability in template rendering"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2020-21716"
+    cwe: "CWE-79"
+
+ember:
+  CVE-2023-26920:
+    affected: "<4.12.0"
+    fixed_version: "4.12.0"
+    severity: "high"
+    description: "Prototype pollution in handlebars templates"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2023-26920"
+    cwe: "CWE-1321"
+
+mootools:
+  CVE-2022-23536:
+    affected: "<1.6.0"
+    fixed_version: "1.6.0"
+    severity: "medium"
+    description: "XSS in Element.inject methods"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2022-23536"
+    cwe: "CWE-79"
+
+prototype:
+  CVE-2018-16487:
+    affected: "<1.7.3"
+    fixed_version: "1.7.3"
+    severity: "high"
+    description: "Prototype pollution via Object.toQueryParameter"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2018-16487"
+    cwe: "CWE-1321"
+
+chart:
+  CVE-2023-2828:
+    affected: "<4.0.0"
+    fixed_version: "4.0.0"
+    severity: "medium"
+    description: "XSS via tooltip callback and external script loading"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2023-2828"
+    cwe: "CWE-79"
+
+# Node.js / npm packages
+express:
+  CVE-2024-29041:
+    affected: "<4.19.2"
+    fixed_version: "4.19.2"
+    severity: "high"
+    description: "Open redirect vulnerability in res.location()"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2024-29041"
+    cwe: "CWE-601"
+
+axios:
+  CVE-2023-45857:
+    affected: "<1.6.0"
+    fixed_version: "1.6.0"
+    severity: "medium"
+    description: "CSRF token exposure in cross-site requests"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2023-45857"
+    cwe: "CWE-352"
+
+webpack:
+  CVE-2023-28154:
+    affected: "<5.76.0"
+    fixed_version: "5.76.0"
+    severity: "medium"
+    description: "Cross-realm object access in webpack-dev-middleware"
+    reference: "https://nvd.nist.gov/vuln/detail/CVE-2023-28154"
+    cwe: "CWE-502"

stryx/utils/__init__.py

@@ -0,0 +1,7 @@
+"""Utility modules for STRYX."""
+
+from stryx.utils.evidence import Evidence, Finding
+from stryx.utils.http_client import HttpClient
+from stryx.utils.rate_limiter import RateLimiter
+
+__all__ = ["Finding", "Evidence", "RateLimiter", "HttpClient"]