stryx-cli 0.1.0__py3-none-any.whl

stryx/comparison/differ.py

@@ -0,0 +1,255 @@
+"""Scan comparison and baseline tracking.
+
+Compares current scan results against a previous baseline to detect
+new vulnerabilities, resolved issues, and severity changes.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from stryx.utils.logging import get_logger
+
+logger = get_logger("comparison.differ")
+
+
+@dataclass
+class FindingDiff:
+    """A single finding change between scans."""
+
+    title: str
+    endpoint: str
+    severity: str
+    status: str  # "new", "resolved", "severity_changed"
+    old_severity: str | None = None
+    new_severity: str | None = None
+
+
+@dataclass
+class ScanDiff:
+    """Result of comparing two scans."""
+
+    baseline_file: str
+    current_file: str
+    baseline_time: str
+    current_time: str
+    new_findings: list[FindingDiff] = field(default_factory=list)
+    resolved_findings: list[FindingDiff] = field(default_factory=list)
+    severity_changes: list[FindingDiff] = field(default_factory=list)
+    unchanged_count: int = 0
+
+    @property
+    def has_regressions(self) -> bool:
+        """Check if there are new critical/high findings."""
+        return any(
+            d.severity in ("critical", "high")
+            for d in self.new_findings
+        )
+
+    @property
+    def total_changes(self) -> int:
+        return len(self.new_findings) + len(self.resolved_findings) + len(self.severity_changes)
+
+    def summary(self) -> str:
+        """Generate a human-readable summary."""
+        lines = [
+            f"📊 Scan Comparison",
+            f"Baseline: {self.baseline_file} ({self.baseline_time})",
+            f"Current:  {self.current_file} ({self.current_time})",
+            "",
+        ]
+
+        if self.new_findings:
+            lines.append(f"🆕 New findings: {len(self.new_findings)}")
+            for f in self.new_findings[:10]:
+                lines.append(f"  - [{f.severity.upper()}] {f.title} @ {f.endpoint}")
+            if len(self.new_findings) > 10:
+                lines.append(f"  ... and {len(self.new_findings) - 10} more")
+
+        if self.resolved_findings:
+            lines.append(f"✅ Resolved findings: {len(self.resolved_findings)}")
+            for f in self.resolved_findings[:5]:
+                lines.append(f"  - [{f.severity.upper()}] {f.title}")
+
+        if self.severity_changes:
+            lines.append(f"⚡ Severity changes: {len(self.severity_changes)}")
+            for f in self.severity_changes[:5]:
+                lines.append(f"  - {f.title}: {f.old_severity} → {f.new_severity}")
+
+        if not self.new_findings and not self.resolved_findings and not self.severity_changes:
+            lines.append("✅ No changes detected between scans")
+
+        if self.has_regressions:
+            lines.append("")
+            lines.append("⚠️  REGRESSION DETECTED: New critical/high findings!")
+
+        return "\n".join(lines)
+
+    def to_dict(self) -> dict[str, Any]:
+        """Convert to dictionary for JSON serialization."""
+        return {
+            "baseline": {
+                "file": self.baseline_file,
+                "timestamp": self.baseline_time,
+            },
+            "current": {
+                "file": self.current_file,
+                "timestamp": self.current_time,
+            },
+            "summary": {
+                "new_findings": len(self.new_findings),
+                "resolved_findings": len(self.resolved_findings),
+                "severity_changes": len(self.severity_changes),
+                "unchanged": self.unchanged_count,
+                "has_regressions": self.has_regressions,
+            },
+            "new_findings": [
+                {"title": d.title, "endpoint": d.endpoint, "severity": d.severity}
+                for d in self.new_findings
+            ],
+            "resolved_findings": [
+                {"title": d.title, "endpoint": d.endpoint, "severity": d.severity}
+                for d in self.resolved_findings
+            ],
+            "severity_changes": [
+                {
+                    "title": d.title,
+                    "endpoint": d.endpoint,
+                    "old_severity": d.old_severity,
+                    "new_severity": d.new_severity,
+                }
+                for d in self.severity_changes
+            ],
+        }
+
+
+def _fingerprint_finding(finding: dict) -> str:
+    """Create a unique fingerprint for a finding."""
+    title = finding.get("title", "")
+    endpoint = finding.get("endpoint", "")
+    return f"{title}::{endpoint}"
+
+
+class ScanDiffer:
+    """Compares two scan JSON files."""
+
+    def __init__(self, baseline_path: str, current_path: str):
+        self.baseline_path = baseline_path
+        self.current_path = current_path
+        self._baseline: dict[str, Any] = {}
+        self._current: dict[str, Any] = {}
+
+    def load(self) -> bool:
+        """Load both scan files."""
+        try:
+            with open(self.baseline_path, encoding="utf-8") as f:
+                self._baseline = json.load(f)
+            with open(self.current_path, encoding="utf-8") as f:
+                self._current = json.load(f)
+            return True
+        except (json.JSONDecodeError, FileNotFoundError) as e:
+            logger.error(f"Failed to load scan files: {e}")
+            return False
+
+    def compare(self) -> ScanDiff:
+        """Compare the two scans and return the diff."""
+        if not self._baseline or not self._current:
+            if not self.load():
+                return ScanDiff(
+                    baseline_file=self.baseline_path,
+                    current_file=self.current_path,
+                    baseline_time="unknown",
+                    current_time="unknown",
+                )
+
+        baseline_findings = self._index_findings(self._baseline.get("findings", []))
+        current_findings = self._index_findings(self._current.get("findings", []))
+
+        baseline_fps = set(baseline_findings.keys())
+        current_fps = set(current_findings.keys())
+
+        # New findings (in current but not baseline)
+        new_fps = current_fps - baseline_fps
+        resolved_fps = baseline_fps - current_fps
+        common_fps = baseline_fps & current_fps
+
+        new_diffs = [
+            FindingDiff(
+                title=current_findings[fp]["title"],
+                endpoint=current_findings[fp].get("endpoint", ""),
+                severity=current_findings[fp].get("severity", "info"),
+                status="new",
+            )
+            for fp in sorted(new_fps)
+        ]
+
+        resolved_diffs = [
+            FindingDiff(
+                title=baseline_findings[fp]["title"],
+                endpoint=baseline_findings[fp].get("endpoint", ""),
+                severity=baseline_findings[fp].get("severity", "info"),
+                status="resolved",
+            )
+            for fp in sorted(resolved_fps)
+        ]
+
+        # Check for severity changes
+        severity_changes = []
+        for fp in common_fps:
+            old_sev = baseline_findings[fp].get("severity", "info")
+            new_sev = current_findings[fp].get("severity", "info")
+            if old_sev != new_sev:
+                severity_changes.append(FindingDiff(
+                    title=current_findings[fp]["title"],
+                    endpoint=current_findings[fp].get("endpoint", ""),
+                    severity=new_sev,
+                    status="severity_changed",
+                    old_severity=old_sev,
+                    new_severity=new_sev,
+                ))
+
+        return ScanDiff(
+            baseline_file=self.baseline_path,
+            current_file=self.current_path,
+            baseline_time=self._baseline.get("timestamp", "unknown"),
+            current_time=self._current.get("timestamp", "unknown"),
+            new_findings=new_diffs,
+            resolved_findings=resolved_diffs,
+            severity_changes=severity_changes,
+            unchanged_count=len(common_fps) - len(severity_changes),
+        )
+
+    def _index_findings(
+        self, findings: list[dict]
+    ) -> dict[str, dict]:
+        """Index findings by their fingerprint."""
+        indexed = {}
+        for f in findings:
+            fp = _fingerprint_finding(f)
+            indexed[fp] = f
+        return indexed
+
+
+def save_scan_metadata(
+    path: str,
+    findings_count: int,
+    target_url: str,
+    metadata: dict[str, Any] | None = None,
+) -> None:
+    """Save scan metadata alongside the JSON report for future comparison."""
+    meta_path = Path(path).with_suffix(".meta.json")
+    meta = {
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "target_url": target_url,
+        "findings_count": findings_count,
+        "tool_version": "0.1.0",
+    }
+    if metadata:
+        meta.update(metadata)
+
+    with open(meta_path, "w", encoding="utf-8") as f:
+        json.dump(meta, f, indent=2)

stryx/config/__init__.py

@@ -0,0 +1,6 @@
+"""Configuration management for STRYX."""
+
+from stryx.config.loader import get_effective_config, load_config
+from stryx.config.schema import StryxConfig
+
+__all__ = ["load_config", "get_effective_config", "StryxConfig"]

stryx/config/default_config.yaml

@@ -0,0 +1,12 @@
+provider: groq
+model: openai/gpt-oss-120b
+threads: 20
+timeout: 10
+crawl_depth: 5
+respect_robots: false
+ai_attack_planning: true
+modules:
+  auth: true
+  authorization: true
+  injection: true
+  fuzzing: true

stryx/config/loader.py

@@ -0,0 +1,111 @@
+"""Configuration loader with priority: CLI flags > file config > defaults."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from stryx.config.schema import StryxConfig
+
+_DEFAULT_CONFIG_PATH = Path(__file__).parent / "default_config.yaml"
+_USER_CONFIG_PATH = Path.home() / ".stryx" / "config.yaml"
+_LOCAL_CONFIG_PATH = Path("stryx.config.yaml")
+
+
+def _read_yaml(path: Path) -> dict[str, Any]:
+    """Read and parse a YAML file, returning empty dict on failure."""
+    if path.exists() and path.is_file():
+        try:
+            with open(path) as f:
+                data = yaml.safe_load(f)
+                return data if isinstance(data, dict) else {}
+        except (yaml.YAMLError, OSError):
+            return {}
+    return {}
+
+
+def load_config(cli_overrides: dict[str, Any] | None = None) -> StryxConfig:
+    """Load configuration with priority: CLI > user file > local file > defaults.
+
+    Priority order:
+    1. CLI flags (passed as cli_overrides)
+    2. ~/.stryx/config.yaml (user-level config)
+    3. ./stryx.config.yaml (project-level config)
+    4. default_config.yaml (built-in defaults)
+    """
+    # Start with defaults
+    defaults = _read_yaml(_DEFAULT_CONFIG_PATH)
+
+    # Layer local project config
+    local = _read_yaml(_LOCAL_CONFIG_PATH)
+
+    # Layer user config
+    user = _read_yaml(_USER_CONFIG_PATH)
+
+    # Merge: defaults < local < user
+    merged: dict[str, Any] = defaults
+    for key, value in local.items():
+        if key == "modules" and isinstance(value, dict) and isinstance(merged.get("modules"), dict):
+            merged["modules"].update(value)
+        else:
+            merged[key] = value
+    for key, value in user.items():
+        if key == "modules" and isinstance(value, dict) and isinstance(merged.get("modules"), dict):
+            merged["modules"].update(value)
+        else:
+            merged[key] = value
+
+    # Apply CLI overrides (non-None values only)
+    if cli_overrides:
+        for key, value in cli_overrides.items():
+            if value is not None:
+                if key == "modules" and isinstance(value, dict) and isinstance(merged.get("modules"), dict):
+                    merged["modules"].update(value)
+                else:
+                    merged[key] = value
+
+    # Read API key from environment if not set
+    if merged.get("api_key") is None:
+        provider = merged.get("provider", "groq")
+        env_key_map = {
+            "openai": "OPENAI_API_KEY",
+            "anthropic": "ANTHROPIC_API_KEY",
+            "groq": "GROQ_API_KEY",
+            "openrouter": "OPENROUTER_API_KEY",
+            "nvidia_nim": "NVIDIA_NIM_API_KEY",
+            "xai": "XAI_API_KEY",
+        }
+        env_var = env_key_map.get(provider)
+        if env_var:
+            merged["api_key"] = os.environ.get(env_var)
+
+    # Also check Ollama (no key needed for local)
+    if merged.get("provider") == "ollama":
+        merged["api_key"] = "ollama"  # dummy key, not needed
+
+    return StryxConfig(**merged)
+
+
+def get_effective_config(config: StryxConfig) -> dict[str, Any]:
+    """Return the resolved effective config as a dictionary (for display)."""
+    return config.model_dump(exclude_none=True)
+
+
+def save_config(config: StryxConfig, path: Path | None = None) -> Path:
+    """Save configuration to the user config path."""
+    target = path or _USER_CONFIG_PATH
+    target.parent.mkdir(parents=True, exist_ok=True)
+    data = config.model_dump(exclude_none=True)
+    # Remove CLI-only fields
+    cli_fields = {
+        "target_url", "deep", "json_output", "html_output",
+        "markdown_output", "headers", "cookies", "proxy", "wordlist", "rate",
+    }
+    for field in cli_fields:
+        data.pop(field, None)
+    with open(target, "w") as f:
+        yaml.dump(data, f, default_flow_style=False, sort_keys=False)
+    return target

stryx/config/schema.py

@@ -0,0 +1,80 @@
+"""Pydantic schema for STRYX configuration."""
+
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+
+class ModuleConfig(BaseModel):
+    """Which scanner modules are enabled."""
+
+    auth: bool = True
+    authorization: bool = True
+    injection: bool = True
+    fuzzing: bool = True
+    blind: bool = True
+    disclosure: bool = True
+    race: bool = True
+    cloud_ssrf: bool = True
+    dependencies: bool = True
+
+
+class SessionConfig(BaseModel):
+    """Authentication session configuration."""
+
+    username: str | None = None
+    password: str | None = None
+    login_url: str | None = None
+
+
+class PolicyConfig(BaseModel):
+    """Security policy for CI/CD quality gates."""
+
+    enabled: bool = False
+    policy_file: str | None = None
+    max_critical: int | None = None
+    max_high: int | None = None
+    max_medium: int | None = None
+    max_low: int | None = None
+    max_findings: int | None = None
+    blocked_cwe: list[str] = Field(default_factory=list)
+
+
+class ComparisonConfig(BaseModel):
+    """Baseline comparison configuration."""
+
+    enabled: bool = False
+    baseline_file: str | None = None
+
+
+class StryxConfig(BaseModel):
+    """Root configuration model with validation."""
+
+    provider: str = Field(default="groq", description="AI provider name")
+    model: str = Field(default="openai/gpt-oss-120b", description="AI model identifier")
+    api_key: str | None = Field(default=None, description="API key for the AI provider")
+    threads: int = Field(default=20, ge=1, le=200, description="Concurrent threads")
+    timeout: int = Field(default=10, ge=1, le=120, description="HTTP timeout in seconds")
+    crawl_depth: int = Field(default=5, ge=1, le=50, description="Max crawl depth")
+    respect_robots: bool = Field(default=False, description="Respect robots.txt rules")
+    ai_attack_planning: bool = True
+    ai_payload_generation: bool = True
+    modules: ModuleConfig = Field(default_factory=ModuleConfig)
+    session: SessionConfig = Field(default_factory=SessionConfig)
+    policy: PolicyConfig = Field(default_factory=PolicyConfig)
+    comparison: ComparisonConfig = Field(default_factory=ComparisonConfig)
+
+    # CLI overrides (not from config file)
+    target_url: str | None = None
+    deep: bool = False
+    json_output: str | None = None
+    html_output: str | None = None
+    markdown_output: str | None = None
+    sarif_output: str | None = None
+    headers: dict[str, str] | None = None
+    cookies: str | None = None
+    proxy: str | None = None
+    wordlist: str | None = None
+    rate: int | None = None
+    policy_file: str | None = None
+    baseline_file: str | None = None

stryx/crawler/__init__.py

@@ -0,0 +1,5 @@
+"""Endpoint discovery and crawling modules for STRYX."""
+
+from stryx.crawler.discovery import DiscoveryAggregator, Endpoint
+
+__all__ = ["Endpoint", "DiscoveryAggregator"]

stryx/crawler/discovery.py

@@ -0,0 +1,178 @@
+"""Main discovery aggregator -- merges results from all crawler modules."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from stryx.utils.logging import get_logger
+
+logger = get_logger("crawler.discovery")
+
+
+@dataclass
+class Endpoint:
+    """A discovered endpoint with metadata."""
+
+    path: str
+    method: str = "GET"
+    source: str = "unknown"
+    confidence: float = 1.0
+    params: list[str] = field(default_factory=list)
+    headers: dict[str, str] = field(default_factory=dict)
+    body: str | None = None
+
+    @property
+    def url(self) -> str:
+        """Full URL if path starts with http, else just the path."""
+        return self.path
+
+    def __hash__(self) -> int:
+        return hash((self.path.lower(), self.method.upper()))
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, Endpoint):
+            return NotImplemented
+        return self.path.lower() == other.path.lower() and self.method.upper() == other.method.upper()
+
+
+class DiscoveryAggregator:
+    """Aggregates endpoint discovery from all crawler modules.
+
+    Merges and deduplicates results into a single Endpoint list.
+    """
+
+    def __init__(
+        self,
+        target_url: str,
+        depth: int = 5,
+        wordlist: str | None = None,
+        respect_robots: bool = False,
+    ):
+        self.target_url = target_url.rstrip("/")
+        self.depth = depth
+        self.wordlist = wordlist
+        self.respect_robots = respect_robots
+        self.endpoints: list[Endpoint] = []
+
+    async def discover(self) -> list[Endpoint]:
+        """Run all discovery modules and return merged endpoints."""
+        logger.info(f"Starting endpoint discovery for {self.target_url}")
+
+        # 1. Run passive discovery modules in parallel (OpenAPI, Sitemap, GraphQL, external JS)
+        from stryx.crawler.graphql_discovery import discover_graphql
+        from stryx.crawler.js_endpoints import discover_js_endpoints
+        from stryx.crawler.openapi import discover_openapi
+        from stryx.crawler.sitemap import discover_sitemap
+
+        passive_tasks = [
+            discover_openapi(self.target_url),
+            discover_sitemap(self.target_url),
+            discover_graphql(self.target_url),
+            discover_js_endpoints(self.target_url),
+        ]
+
+        import asyncio
+        passive_results = await asyncio.gather(*passive_tasks, return_exceptions=True)
+        for result in passive_results:
+            if isinstance(result, list):
+                self.endpoints.extend(result)
+            elif isinstance(result, Exception):
+                logger.warning(f"Discovery module failed: {result}")
+
+        # 2. Run recursive HTML crawler (follows links, extracts forms)
+        from stryx.crawler.html_crawler import HTMLCrawler
+
+        crawler = HTMLCrawler(
+            self.target_url,
+            max_depth=self.depth,
+            max_pages=500,
+            respect_robots=self.respect_robots,
+        )
+        try:
+            html_endpoints = await crawler.crawl()
+            self.endpoints.extend(html_endpoints)
+        except Exception as e:
+            logger.warning(f"HTML crawler failed: {e}")
+
+        # 3. Wordlist-based discovery if a wordlist was provided
+        if self.wordlist:
+            await self._discover_from_wordlist()
+
+        # Deduplicate
+        seen: set[tuple[str, str]] = set()
+        unique: list[Endpoint] = []
+        for ep in self.endpoints:
+            key = (ep.path.lower(), ep.method.upper())
+            if key not in seen:
+                seen.add(key)
+                unique.append(ep)
+        self.endpoints = unique
+
+        self._log_summary()
+        return self.endpoints
+
+    async def _discover_from_wordlist(self) -> None:
+        """Discover endpoints from a wordlist file."""
+        from pathlib import Path
+
+        wordlist_path = Path(self.wordlist)
+        if not wordlist_path.exists():
+            logger.warning(f"Wordlist not found: {self.wordlist}")
+            return
+
+        logger.info(f"Loading wordlist from {self.wordlist}")
+        lines = wordlist_path.read_text().splitlines()
+        words = [line.strip() for line in lines if line.strip() and not line.startswith("#")]
+
+        if not words:
+            logger.warning("Wordlist is empty")
+            return
+
+        logger.info(f"Testing {len(words)} paths from wordlist")
+
+        from stryx.utils.http_client import HttpClient
+        client = HttpClient(timeout=5)
+        batch_size = 50
+
+        for i in range(0, len(words), batch_size):
+            batch = words[i : i + batch_size]
+            tasks = []
+            for word in batch:
+                url = f"{self.target_url}/{word.lstrip('/')}"
+                tasks.append(self._probe_path(client, url, f"wordlist:{word}"))
+            results = await asyncio.gather(*tasks, return_exceptions=True)
+            for result in results:
+                if isinstance(result, Endpoint):
+                    self.endpoints.append(result)
+
+    async def _probe_path(
+        self, client, url: str, source: str
+    ) -> Endpoint | None:
+        """Probe a single path and return an Endpoint if it exists."""
+        try:
+            response, _ = await client.get(url)
+            if response.status_code < 400:
+                return Endpoint(
+                    path=url,
+                    method="GET",
+                    source=source,
+                    confidence=0.7,
+                )
+        except Exception:
+            pass
+        return None
+
+    def _log_summary(self) -> None:
+        """Log endpoint summary statistics."""
+        method_counts: dict[str, int] = {}
+        source_counts: dict[str, int] = {}
+        for ep in self.endpoints:
+            method = ep.method.upper()
+            method_counts[method] = method_counts.get(method, 0) + 1
+            source_counts[ep.source] = source_counts.get(ep.source, 0) + 1
+
+        logger.info(f"{len(self.endpoints)} Endpoints")
+        for method, count in sorted(method_counts.items(), key=lambda x: -x[1]):
+            logger.info(f"  {count} {method}")
+        for source, count in sorted(source_counts.items(), key=lambda x: -x[1]):
+            logger.info(f"  {count} from {source}")