summit-scanner 0.7.2__tar.gz → 0.7.4__tar.gz

{summit_scanner-0.7.2 → summit_scanner-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: summit-scanner
-Version: 0.7.2
+Version: 0.7.4
 Summary: Summit - open-source web security testing platform (proxy, scanner, fuzzer) by Pennacle Security
 Author: Pennacle Security
 License: MIT

{summit_scanner-0.7.2 → summit_scanner-0.7.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "summit-scanner"
-version = "0.7.2"
+version = "0.7.4"
 description = "Summit - open-source web security testing platform (proxy, scanner, fuzzer) by Pennacle Security"
 readme = "README.md"
 requires-python = ">=3.10"

{summit_scanner-0.7.2 → summit_scanner-0.7.4}/summit/cli.py

@@ -13,6 +13,7 @@ from .http.models import HttpRequest
 from .openapi import load_spec, spec_pages
 from .paramminer import mine
 from .proxy.server import ProxyServer
+from .race import findings_from as race_findings_from, run_race_test
 from .recon import missing_tools, render_report, run_recon
 from .report.writer import write_console, write_html, write_json
 from .scan.core import SEVERITIES, filter_by_min_severity, filter_by_severities
@@ -108,6 +109,15 @@ def build_parser() -> argparse.ArgumentParser:
     tls_p.add_argument("--timeout", type=float, default=10.0)
     tls_p.add_argument("--json", dest="json_path", help="write findings as JSON")
 
+    race_p = sub.add_parser("race", help="detect race conditions via concurrent identical requests")
+    race_p.add_argument("url", help="target URL that performs a state change")
+    race_p.add_argument("-n", "--concurrency", type=int, default=10, help="number of concurrent requests (default 10)")
+    race_p.add_argument("--method", default="GET", help="HTTP method (default GET)")
+    race_p.add_argument("--data", default=None, help="request body (for POST)")
+    race_p.add_argument("--cookie", default=None, help="Cookie header value")
+    race_p.add_argument("--timeout", type=float, default=10.0)
+    race_p.add_argument("--json", dest="json_path", help="write findings as JSON")
+
     return parser
 
 
@@ -310,6 +320,25 @@ def _cmd_tls(args: argparse.Namespace) -> int:
     return 0
 
 
+def _cmd_race(args: argparse.Namespace) -> int:
+    print(BANNER.format(version=__version__))
+    client = HttpClient(timeout=args.timeout)
+    headers = {"Cookie": args.cookie} if args.cookie else {}
+    print(f"[*] testing {args.url} with {args.concurrency} concurrent {args.method} requests ...")
+    result = run_race_test(
+        client, args.url, concurrency=args.concurrency, method=args.method,
+        body=args.data.encode() if args.data else None, headers=headers,
+    )
+    print(f"[*] baseline: HTTP {result.baseline.status}/{len(result.baseline.body)}B")
+    print(f"[*] concurrent: {len(result.concurrent)} responses, {result.unique_responses} unique")
+    findings = race_findings_from([result])
+    print(write_console(findings, args.url))
+    if args.json_path:
+        write_json(findings, args.json_path)
+        print(f"[*] JSON report written to {args.json_path}")
+    return 0
+
+
 def _cmd_encode(args: argparse.Namespace) -> int:
     try:
         print(encode_text(args.value, args.encoding))
@@ -354,6 +383,8 @@ def main(argv: list[str] | None = None) -> int:
             return _cmd_recon(args)
         if args.command == "tls":
             return _cmd_tls(args)
+        if args.command == "race":
+            return _cmd_race(args)
         if args.command == "encode":
             return _cmd_encode(args)
         if args.command == "decode":

summit_scanner-0.7.4/summit/race.py

@@ -0,0 +1,109 @@
+"""Race condition detection - concurrent state manipulation.
+
+Race conditions exist when concurrent requests produce a state that
+sequential requests cannot. The classic examples: double-spending a
+gift card, withdrawing more than the balance, creating duplicate
+accounts, bypassing rate limits.
+
+Detection strategy:
+
+1. send one request sequentially to establish the baseline response
+2. send N identical requests concurrently
+3. compare: if concurrent responses differ from the baseline in a
+   meaningful way (different body, different status, different side
+   effects visible in the response), the server has a concurrency bug
+
+This is always `potential` - only a human who understands the business
+logic can confirm that the differing responses represent an exploit
+rather than expected variation.
+"""
+
+from __future__ import annotations
+
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass
+
+from ...http.client import HttpClient
+from ...http.models import HttpRequest, HttpResponse
+from ..scan.core import Finding
+
+
+@dataclass
+class RaceResult:
+    url: str
+    baseline: HttpResponse
+    concurrent: list[HttpResponse]
+    unique_responses: int
+    verdict: str  # no-race | possible-race
+
+
+def _fingerprint(response: HttpResponse) -> tuple:
+    return (response.status, len(response.body))
+
+
+def run_race_test(
+    client: HttpClient,
+    url: str,
+    concurrency: int = 10,
+    method: str = "GET",
+    body: bytes | None = None,
+    headers: dict[str, str] | None = None,
+) -> RaceResult:
+    """Send one sequential request, then N concurrent identical requests."""
+    request = HttpRequest(method=method, url=url, headers=headers or {}, body=body)
+
+    baseline = client.send(request)
+    base_fp = _fingerprint(baseline)
+
+    concurrent_responses: list[HttpResponse] = []
+    with ThreadPoolExecutor(max_workers=concurrency) as pool:
+        futures = [pool.submit(client.send, request) for _ in range(concurrency)]
+        for future in as_completed(futures):
+            concurrent_responses.append(future.result())
+
+    unique_fps = {_fingerprint(r) for r in concurrent_responses}
+    all_fps = unique_fps | {base_fp}
+
+    if len(all_fps) == 1:
+        verdict = "no-race"
+    elif len(unique_fps) > 1 or (len(all_fps) > 1 and base_fp not in unique_fps):
+        verdict = "possible-race"
+    else:
+        verdict = "possible-race"
+
+    return RaceResult(
+        url=url,
+        baseline=baseline,
+        concurrent=concurrent_responses,
+        unique_responses=len(unique_fps),
+        verdict=verdict,
+    )
+
+
+def findings_from(results: list[RaceResult]) -> list[Finding]:
+    findings: list[Finding] = []
+    for result in results:
+        if result.verdict != "possible-race":
+            continue
+        statuses = sorted({r.status for r in result.concurrent})
+        sizes = sorted({len(r.body) for r in result.concurrent})
+        findings.append(
+            Finding(
+                check_id="race-condition",
+                title="Race condition (concurrent requests produce different responses)",
+                severity="high",
+                url=result.url,
+                confidence="potential",
+                detail=(
+                    f"{len(result.concurrent)} concurrent requests produced "
+                    f"{result.unique_responses} unique response(s) that differ from the "
+                    f"sequential baseline (HTTP {result.baseline.status}/{len(result.baseline.body)}B). "
+                    "If this endpoint performs a state change (balance transfer, voucher redemption, "
+                    "rate limit), concurrent requests may bypass the check. Verify manually by "
+                    "inspecting server-side state after the race."
+                ),
+                evidence=f"statuses: {statuses}, sizes: {sizes}, unique: {result.unique_responses}",
+                remediation="Use atomic operations, database-level locks, or idempotency keys for state-changing endpoints.",
+            )
+        )
+    return findings

{summit_scanner-0.7.2 → summit_scanner-0.7.4}/summit/scan/core.py

@@ -68,6 +68,7 @@ CWE_BY_CHECK_ID = {
     "nosql-injection": "CWE-943",
     "ldap-injection": "CWE-90",
     "format-string": "CWE-134",
+    "race-condition": "CWE-362",
 }
 
 # Security impact per check: what an attacker concretely achieves, not

{summit_scanner-0.7.2 → summit_scanner-0.7.4}/summit_scanner.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: summit-scanner
-Version: 0.7.2
+Version: 0.7.4
 Summary: Summit - open-source web security testing platform (proxy, scanner, fuzzer) by Pennacle Security
 Author: Pennacle Security
 License: MIT

{summit_scanner-0.7.2 → summit_scanner-0.7.4}/summit_scanner.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ summit/cve.py
 summit/graphql.py
 summit/openapi.py
 summit/paramminer.py
+summit/race.py
 summit/ratelimit.py
 summit/recon.py
 summit/smart.py