yy22ff 1.0.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
yy22ff-1.0.0/PKG-INFO ADDED
@@ -0,0 +1,285 @@
1
+ Metadata-Version: 2.4
2
+ Name: yy22ff
3
+ Version: 1.0.0
4
+ Summary: Full-auto web vulnerability scanner: crawling, fingerprinting, SQLi, XSS, LFI, RFI, SSRF, CMDi, SSTI, file-upload exploitation, TLS analysis.
5
+ Home-page: https://t.me/yy22ff
6
+ Author: yy22ff
7
+ Author-email: adojod1231@gmail.com
8
+ Classifier: Programming Language :: Python :: 3
9
+ Classifier: Programming Language :: Python :: 3.7
10
+ Classifier: Programming Language :: Python :: 3.8
11
+ Classifier: Programming Language :: Python :: 3.9
12
+ Classifier: Programming Language :: Python :: 3.10
13
+ Classifier: Programming Language :: Python :: 3.11
14
+ Classifier: Programming Language :: Python :: 3.12
15
+ Classifier: License :: OSI Approved :: MIT License
16
+ Classifier: Operating System :: OS Independent
17
+ Classifier: Natural Language :: Arabic
18
+ Classifier: Intended Audience :: Developers
19
+ Classifier: Topic :: Security
20
+ Requires-Python: >=3.7
21
+ Description-Content-Type: text/markdown
22
+ Requires-Dist: requests>=2.25.0
23
+ Requires-Dist: colorama>=0.4.4
24
+ Dynamic: author
25
+ Dynamic: author-email
26
+ Dynamic: classifier
27
+ Dynamic: description
28
+ Dynamic: description-content-type
29
+ Dynamic: home-page
30
+ Dynamic: requires-dist
31
+ Dynamic: requires-python
32
+ Dynamic: summary
33
+
34
+ # yy22ff
35
+
36
+ **Full-Auto Web Vulnerability Scanner.**
37
+
38
+ **سكانر ثغرات ويب متعدد الوحدات — كشف كامل تلقائي.**
39
+
40
+ [![PyPI version](https://img.shields.io/pypi/v/yy22ff)](https://pypi.org/project/yy22ff/)
41
+ [![Python](https://img.shields.io/pypi/pyversions/yy22ff)](https://pypi.org/project/yy22ff/)
42
+ [![License](https://img.shields.io/pypi/l/yy22ff)](https://pypi.org/project/yy22ff/)
43
+
44
+ ---
45
+
46
+ ## Overview | نظرة عامة
47
+
48
+ **English:** yy22ff is a single-shot web vulnerability scanner that chains crawling, fingerprinting, passive recon, active injection testing, file-upload exploitation, and TLS analysis into one run. It produces a timestamped, structured report (txt + JSON) that you can review offline or diff across scans.
49
+
50
+ **العربية:** yy22ff مكتبة فحص ثغرات ويب متكاملة. تشغّل عملية واحدة تبدأ بالزحف على الموقع، ثم تحديد التقنيات المستخدمة، ثم فحص سلبي، ثم اختبار حقن نشط (SQLi, XSS, LFI, RFI, SSRF, CMDi, SSTI, Redirect)، ثم استغلال رفع الملفات، وأخيراً تحليل TLS. تنتج تقرير منظم (نص + JSON) في مجلد بتاريخ ووقت كل فحص.
51
+
52
+ ---
53
+
54
+ ## What It Does | ماذا تفعل
55
+
56
+ ### 1. Crawling & Discovery | الزحف والاكتشاف
57
+
58
+ - Recursively crawls the target domain up to a configurable depth (default 2) and URL cap (default 300).
59
+ - Extracts every link, URL parameter, and HTML form (with field names, types, and methods).
60
+ - Deduplicates URLs by fingerprinting their parameter sets.
61
+
62
+ - زحف تكراري للدومين حتى عمق محدد (2 افتراضياً) وسقف 300 URL.
63
+ - استخراج كل الروابط، والبارامترات، والنماذج (form) مع أسماء الحقول وأنواعها وطرقها.
64
+ - إزالة التكرار ببصمة البارامترات.
65
+
66
+ ### 2. Passive Recon | الاستطلاع السلبي
67
+
68
+ - **Tech fingerprinting** — WordPress, Drupal, Joomla, Laravel, Django, Rails, Express, PHP, ASP.NET, Spring, Nginx, Apache, IIS, Cloudflare, Nextcloud.
69
+ - **WAF detection** — Cloudflare, AWS WAF, Sucuri, Akamai, Imperva, F5 BIG-IP, ModSecurity, FortiWeb.
70
+ - **Security headers audit** — flags missing HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
71
+ - **CORS misconfiguration** — detects wildcard origins and credential reflection.
72
+
73
+ - **بصمة التقنيات** — WordPress, Drupal, Joomla, Laravel, Django, Rails, Express, PHP, ASP.NET, Spring, Nginx, Apache, IIS, Cloudflare, Nextcloud.
74
+ - **كشف WAF** — Cloudflare, AWS WAF, Sucuri, Akamai, Imperva, F5 BIG-IP, ModSecurity, FortiWeb.
75
+ - **فحص هيدرات الأمان** — ينبه إلى HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy الناقصة.
76
+ - **كشف سوء إعداد CORS** — wildcard origins و credential reflection.
77
+
78
+ ### 3. Sensitive File Discovery | اكتشاف الملفات الحساسة
79
+
80
+ - `.git/config`, `.env`, `.env.bak`, backups (`backup.zip`, `backup.sql`, `db.sql`), `phpinfo.php`, `web.config`, `composer.json`, `Dockerfile`, `.htaccess`, `robots.txt`, `sitemap.xml`, `.DS_Store`, `.svn/entries`.
81
+ - Validates matches against content signatures (`root:x:0:0:`, `DB_PASSWORD`, `APP_KEY`, `<?php`).
82
+
83
+ - ملفات مكشوفة شائعة، مع التحقق من التوقيع الداخلي للمحتوى.
84
+
85
+ ### 4. Admin Panel Discovery | اكتشاف لوحات التحكم
86
+
87
+ - `/admin`, `/wp-admin/`, `/wp-login.php`, `/administrator/`, `/login`, `/phpmyadmin/`, `/manager/html`, `/adminer.php`, `/cpanel`, `/dashboard`, `/auth/login`.
88
+
89
+ ### 5. Active Injection Scanning | فحص الحقن النشط
90
+
91
+ | Class | Method | Classes Covered |
92
+ |-------|--------|----------------|
93
+ | **SQLi** | Error-based + Time-based | MySQL, Oracle, PostgreSQL, SQLite, MSSQL |
94
+ | **XSS** | Reflected + Form-based | Polyglot payloads |
95
+ | **LFI** | Path traversal | `/etc/passwd`, `win.ini` |
96
+ | **RFI** | Remote inclusion | `example.com` probe |
97
+ | **SSRF** | Internal targets | `127.0.0.1`, `169.254.169.254`, `[::1]`, `localhost` |
98
+ | **CMDi** | Time-based | `; sleep 4`, `pipe sleep 4`, backticks, `$()`, `&&` |
99
+ | **SSTI** | Template eval | `{{7*7}}`, `${7*7}`, `<%= 7*7 %>`, `#{7*7}`, `*{7*7}` |
100
+ | **Open Redirect** | Location header + body | `evil.test` probe |
101
+
102
+ ### 6. File Upload Exploitation | استغلال رفع الملفات
103
+
104
+ - Detects `<input type="file">` forms.
105
+ - Uploads `wscan.php` with `system($_GET['c'])`.
106
+ - Probes common upload paths (`/uploads/`, `/files/`, `/media/`, `/tmp/`, `/assets/`).
107
+ - Confirms execution via `?c=id` (checks for `uid=` / `gid=`).
108
+
109
+ ### 7. SSL/TLS Analysis | تحليل SSL/TLS
110
+
111
+ - Reports protocol version and cipher.
112
+ - Flags weak protocols (SSLv3, TLSv1, TLSv1.1).
113
+
114
+ ### 8. Reporting | التقارير
115
+
116
+ - Live colored console output with severity tags (`+` ok, `!` vuln, `~` warn, `*` info).
117
+ - Saves to `results/<host>_<timestamp>/`:
118
+ - `findings.txt` — all findings, one per line.
119
+ - `raw.log` — debug log.
120
+ - `summary.json` — structured JSON output.
121
+ - `shell.php` — generated payload (if upload stage runs).
122
+
123
+ ---
124
+
125
+ ## Installation | التثبيت
126
+
127
+ pip install yy22ff
128
+
129
+ No configuration needed. Dependencies (`requests`, `colorama`) install automatically.
130
+
131
+ ---
132
+
133
+ ## Quick Start | البدء السريع
134
+
135
+ ### As a library | كمكتبة
136
+
137
+ import yy22ff
138
+
139
+ result = yy22ff.scan("https://target.com")
140
+
141
+ print(f"Findings: {result['summary']['total']}")
142
+ print(f"Output: {result['output_dir']}")
143
+ print(f"Duration: {result['duration']}s")
144
+
145
+ for finding in result["findings"]:
146
+ print(finding["type"], "->", finding["target"])
147
+
148
+ ### From the command line | من الطرفية
149
+
150
+ # Basic
151
+ python -m yy22ff -u https://target.com
152
+
153
+ # Or if installed as entry point
154
+ yy22ff -u https://target.com
155
+
156
+ # Advanced
157
+ yy22ff -u target.com -d 3 -t 16 --timeout 15 --delay 0.5
158
+
159
+ # With proxy (Burp, ZAP)
160
+ yy22ff -u https://target.com --proxy http://127.0.0.1:8080
161
+
162
+ # Skip file upload stage
163
+ yy22ff -u https://target.com --no-shell
164
+
165
+ ---
166
+
167
+ ## API Reference | المرجع
168
+
169
+ ### `yy22ff.scan(url, **options)`
170
+
171
+ **Parameters:**
172
+
173
+ | Parameter | Type | Default | Description |
174
+ |-----------|------|---------|-------------|
175
+ | `url` | str | — | Target URL (http/https, optional scheme) |
176
+ | `depth` | int | 2 | Crawl depth |
177
+ | `threads` | int | 8 | Parallel workers |
178
+ | `timeout` | int | 10 | Request timeout (seconds) |
179
+ | `delay` | float | 0.0 | Delay between requests |
180
+ | `proxy` | str | None | HTTP/SOCKS proxy |
181
+ | `no_shell` | bool | False | Skip upload-to-shell stage |
182
+ | `verbose` | bool | True | Print findings to console |
183
+
184
+ **Returns:** `dict`
185
+
186
+ {
187
+ "target": "https://target.com",
188
+ "duration": 45.2,
189
+ "findings": [
190
+ {"type": "sqli", "target": "...", "extra": []},
191
+ {"type": "xss", "target": "...", "extra": []},
192
+ ],
193
+ "summary": {
194
+ "total": 6,
195
+ "by_type": {"sqli": 2, "xss": 3, "file": 1}
196
+ },
197
+ "output_dir": "results/target_20261031_153000"
198
+ }
199
+
200
+ ### `yy22ff.cli()`
201
+
202
+ Entry point for `pyproject.toml`'s `console_scripts`. Same as `python -m yy22ff`.
203
+
204
+ ---
205
+
206
+ ## CLI Arguments | أوامر الطرفية
207
+
208
+ | Flag | Purpose | Default |
209
+ |------|---------|---------|
210
+ | `-u`, `--url` | Target URL (required) | — |
211
+ | `-d`, `--depth` | Crawl depth | 2 |
212
+ | `-t`, `--threads` | Parallel workers | 8 |
213
+ | `--timeout` | Request timeout (seconds) | 10 |
214
+ | `--delay` | Delay between requests | 0.0 |
215
+ | `--proxy` | HTTP/SOCKS proxy | none |
216
+ | `--no-shell` | Skip upload to shell stage | off |
217
+
218
+ ---
219
+
220
+ ## Output Structure | هيكل المخرجات
221
+
222
+ results/
223
+ target_20261031_153000/
224
+ findings.txt (human-readable)
225
+ raw.log (debug log)
226
+ summary.json (structured)
227
+ shell.php (upload payload, if applicable)
228
+
229
+ ---
230
+
231
+ ## Design Notes | ملاحظات التصميم
232
+
233
+ - **Name-mangled identifiers** — every symbol is prefixed `shlhom` to reduce casual readability.
234
+ - **Modular** — each vulnerability class is a standalone function; the dispatcher runs them in parallel via `ThreadPoolExecutor`.
235
+ - **Graceful failure** — a module crash does not abort the scan; failures are logged to `raw.log`.
236
+ - **Persistent output** — every finding is written to disk immediately, so interrupted scans still produce partial reports.
237
+ - **Session reuse** — one `requests.Session` with a random user-agent for the whole scan.
238
+ - **Auto-install** — installs `requests` at runtime if missing.
239
+
240
+ ---
241
+
242
+ ## Feature Matrix | جدول الميزات
243
+
244
+ | Feature | Status |
245
+ |---------|--------|
246
+ | Recursive crawling | [OK] |
247
+ | Form extraction | [OK] |
248
+ | Parameter discovery | [OK] |
249
+ | Tech fingerprinting | [OK] |
250
+ | WAF detection | [OK] |
251
+ | Security headers audit | [OK] |
252
+ | CORS check | [OK] |
253
+ | Sensitive file discovery | [OK] |
254
+ | Admin panel discovery | [OK] |
255
+ | SQLi (error + time) | [OK] |
256
+ | XSS (reflected + form) | [OK] |
257
+ | LFI | [OK] |
258
+ | RFI | [OK] |
259
+ | SSRF | [OK] |
260
+ | Command Injection | [OK] |
261
+ | SSTI | [OK] |
262
+ | Open Redirect | [OK] |
263
+ | File upload to shell | [OK] |
264
+ | SSL/TLS analysis | [OK] |
265
+ | Structured JSON output | [OK] |
266
+
267
+ ---
268
+
269
+ ## Author | المؤلف
270
+
271
+ - **Email:** adojod1231@gmail.com
272
+ - **Telegram:** [@yy22ff](https://t.me/yy22ff)
273
+ - **PyPI:** [yy22ff](https://pypi.org/project/yy22ff/)
274
+
275
+ ---
276
+
277
+ ## License | الترخيص
278
+
279
+ MIT © yy22ff
280
+
281
+ ---
282
+
283
+ **Built with focus. Tested on real targets.**
284
+
285
+ **صُنعت بدقة. مختبرة على أهداف حقيقية.**
yy22ff-1.0.0/README.md ADDED
@@ -0,0 +1,252 @@
1
+ # yy22ff
2
+
3
+ **Full-Auto Web Vulnerability Scanner.**
4
+
5
+ **سكانر ثغرات ويب متعدد الوحدات — كشف كامل تلقائي.**
6
+
7
+ [![PyPI version](https://img.shields.io/pypi/v/yy22ff)](https://pypi.org/project/yy22ff/)
8
+ [![Python](https://img.shields.io/pypi/pyversions/yy22ff)](https://pypi.org/project/yy22ff/)
9
+ [![License](https://img.shields.io/pypi/l/yy22ff)](https://pypi.org/project/yy22ff/)
10
+
11
+ ---
12
+
13
+ ## Overview | نظرة عامة
14
+
15
+ **English:** yy22ff is a single-shot web vulnerability scanner that chains crawling, fingerprinting, passive recon, active injection testing, file-upload exploitation, and TLS analysis into one run. It produces a timestamped, structured report (txt + JSON) that you can review offline or diff across scans.
16
+
17
+ **العربية:** yy22ff مكتبة فحص ثغرات ويب متكاملة. تشغّل عملية واحدة تبدأ بالزحف على الموقع، ثم تحديد التقنيات المستخدمة، ثم فحص سلبي، ثم اختبار حقن نشط (SQLi, XSS, LFI, RFI, SSRF, CMDi, SSTI, Redirect)، ثم استغلال رفع الملفات، وأخيراً تحليل TLS. تنتج تقرير منظم (نص + JSON) في مجلد بتاريخ ووقت كل فحص.
18
+
19
+ ---
20
+
21
+ ## What It Does | ماذا تفعل
22
+
23
+ ### 1. Crawling & Discovery | الزحف والاكتشاف
24
+
25
+ - Recursively crawls the target domain up to a configurable depth (default 2) and URL cap (default 300).
26
+ - Extracts every link, URL parameter, and HTML form (with field names, types, and methods).
27
+ - Deduplicates URLs by fingerprinting their parameter sets.
28
+
29
+ - زحف تكراري للدومين حتى عمق محدد (2 افتراضياً) وسقف 300 URL.
30
+ - استخراج كل الروابط، والبارامترات، والنماذج (form) مع أسماء الحقول وأنواعها وطرقها.
31
+ - إزالة التكرار ببصمة البارامترات.
32
+
33
+ ### 2. Passive Recon | الاستطلاع السلبي
34
+
35
+ - **Tech fingerprinting** — WordPress, Drupal, Joomla, Laravel, Django, Rails, Express, PHP, ASP.NET, Spring, Nginx, Apache, IIS, Cloudflare, Nextcloud.
36
+ - **WAF detection** — Cloudflare, AWS WAF, Sucuri, Akamai, Imperva, F5 BIG-IP, ModSecurity, FortiWeb.
37
+ - **Security headers audit** — flags missing HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
38
+ - **CORS misconfiguration** — detects wildcard origins and credential reflection.
39
+
40
+ - **بصمة التقنيات** — WordPress, Drupal, Joomla, Laravel, Django, Rails, Express, PHP, ASP.NET, Spring, Nginx, Apache, IIS, Cloudflare, Nextcloud.
41
+ - **كشف WAF** — Cloudflare, AWS WAF, Sucuri, Akamai, Imperva, F5 BIG-IP, ModSecurity, FortiWeb.
42
+ - **فحص هيدرات الأمان** — ينبه إلى HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy الناقصة.
43
+ - **كشف سوء إعداد CORS** — wildcard origins و credential reflection.
44
+
45
+ ### 3. Sensitive File Discovery | اكتشاف الملفات الحساسة
46
+
47
+ - `.git/config`, `.env`, `.env.bak`, backups (`backup.zip`, `backup.sql`, `db.sql`), `phpinfo.php`, `web.config`, `composer.json`, `Dockerfile`, `.htaccess`, `robots.txt`, `sitemap.xml`, `.DS_Store`, `.svn/entries`.
48
+ - Validates matches against content signatures (`root:x:0:0:`, `DB_PASSWORD`, `APP_KEY`, `<?php`).
49
+
50
+ - ملفات مكشوفة شائعة، مع التحقق من التوقيع الداخلي للمحتوى.
51
+
52
+ ### 4. Admin Panel Discovery | اكتشاف لوحات التحكم
53
+
54
+ - `/admin`, `/wp-admin/`, `/wp-login.php`, `/administrator/`, `/login`, `/phpmyadmin/`, `/manager/html`, `/adminer.php`, `/cpanel`, `/dashboard`, `/auth/login`.
55
+
56
+ ### 5. Active Injection Scanning | فحص الحقن النشط
57
+
58
+ | Class | Method | Classes Covered |
59
+ |-------|--------|----------------|
60
+ | **SQLi** | Error-based + Time-based | MySQL, Oracle, PostgreSQL, SQLite, MSSQL |
61
+ | **XSS** | Reflected + Form-based | Polyglot payloads |
62
+ | **LFI** | Path traversal | `/etc/passwd`, `win.ini` |
63
+ | **RFI** | Remote inclusion | `example.com` probe |
64
+ | **SSRF** | Internal targets | `127.0.0.1`, `169.254.169.254`, `[::1]`, `localhost` |
65
+ | **CMDi** | Time-based | `; sleep 4`, `pipe sleep 4`, backticks, `$()`, `&&` |
66
+ | **SSTI** | Template eval | `{{7*7}}`, `${7*7}`, `<%= 7*7 %>`, `#{7*7}`, `*{7*7}` |
67
+ | **Open Redirect** | Location header + body | `evil.test` probe |
68
+
69
+ ### 6. File Upload Exploitation | استغلال رفع الملفات
70
+
71
+ - Detects `<input type="file">` forms.
72
+ - Uploads `wscan.php` with `system($_GET['c'])`.
73
+ - Probes common upload paths (`/uploads/`, `/files/`, `/media/`, `/tmp/`, `/assets/`).
74
+ - Confirms execution via `?c=id` (checks for `uid=` / `gid=`).
75
+
76
+ ### 7. SSL/TLS Analysis | تحليل SSL/TLS
77
+
78
+ - Reports protocol version and cipher.
79
+ - Flags weak protocols (SSLv3, TLSv1, TLSv1.1).
80
+
81
+ ### 8. Reporting | التقارير
82
+
83
+ - Live colored console output with severity tags (`+` ok, `!` vuln, `~` warn, `*` info).
84
+ - Saves to `results/<host>_<timestamp>/`:
85
+ - `findings.txt` — all findings, one per line.
86
+ - `raw.log` — debug log.
87
+ - `summary.json` — structured JSON output.
88
+ - `shell.php` — generated payload (if upload stage runs).
89
+
90
+ ---
91
+
92
+ ## Installation | التثبيت
93
+
94
+ pip install yy22ff
95
+
96
+ No configuration needed. Dependencies (`requests`, `colorama`) install automatically.
97
+
98
+ ---
99
+
100
+ ## Quick Start | البدء السريع
101
+
102
+ ### As a library | كمكتبة
103
+
104
+ import yy22ff
105
+
106
+ result = yy22ff.scan("https://target.com")
107
+
108
+ print(f"Findings: {result['summary']['total']}")
109
+ print(f"Output: {result['output_dir']}")
110
+ print(f"Duration: {result['duration']}s")
111
+
112
+ for finding in result["findings"]:
113
+ print(finding["type"], "->", finding["target"])
114
+
115
+ ### From the command line | من الطرفية
116
+
117
+ # Basic
118
+ python -m yy22ff -u https://target.com
119
+
120
+ # Or if installed as entry point
121
+ yy22ff -u https://target.com
122
+
123
+ # Advanced
124
+ yy22ff -u target.com -d 3 -t 16 --timeout 15 --delay 0.5
125
+
126
+ # With proxy (Burp, ZAP)
127
+ yy22ff -u https://target.com --proxy http://127.0.0.1:8080
128
+
129
+ # Skip file upload stage
130
+ yy22ff -u https://target.com --no-shell
131
+
132
+ ---
133
+
134
+ ## API Reference | المرجع
135
+
136
+ ### `yy22ff.scan(url, **options)`
137
+
138
+ **Parameters:**
139
+
140
+ | Parameter | Type | Default | Description |
141
+ |-----------|------|---------|-------------|
142
+ | `url` | str | — | Target URL (http/https, optional scheme) |
143
+ | `depth` | int | 2 | Crawl depth |
144
+ | `threads` | int | 8 | Parallel workers |
145
+ | `timeout` | int | 10 | Request timeout (seconds) |
146
+ | `delay` | float | 0.0 | Delay between requests |
147
+ | `proxy` | str | None | HTTP/SOCKS proxy |
148
+ | `no_shell` | bool | False | Skip upload-to-shell stage |
149
+ | `verbose` | bool | True | Print findings to console |
150
+
151
+ **Returns:** `dict`
152
+
153
+ {
154
+ "target": "https://target.com",
155
+ "duration": 45.2,
156
+ "findings": [
157
+ {"type": "sqli", "target": "...", "extra": []},
158
+ {"type": "xss", "target": "...", "extra": []},
159
+ ],
160
+ "summary": {
161
+ "total": 6,
162
+ "by_type": {"sqli": 2, "xss": 3, "file": 1}
163
+ },
164
+ "output_dir": "results/target_20261031_153000"
165
+ }
166
+
167
+ ### `yy22ff.cli()`
168
+
169
+ Entry point for `pyproject.toml`'s `console_scripts`. Same as `python -m yy22ff`.
170
+
171
+ ---
172
+
173
+ ## CLI Arguments | أوامر الطرفية
174
+
175
+ | Flag | Purpose | Default |
176
+ |------|---------|---------|
177
+ | `-u`, `--url` | Target URL (required) | — |
178
+ | `-d`, `--depth` | Crawl depth | 2 |
179
+ | `-t`, `--threads` | Parallel workers | 8 |
180
+ | `--timeout` | Request timeout (seconds) | 10 |
181
+ | `--delay` | Delay between requests | 0.0 |
182
+ | `--proxy` | HTTP/SOCKS proxy | none |
183
+ | `--no-shell` | Skip upload to shell stage | off |
184
+
185
+ ---
186
+
187
+ ## Output Structure | هيكل المخرجات
188
+
189
+ results/
190
+ target_20261031_153000/
191
+ findings.txt (human-readable)
192
+ raw.log (debug log)
193
+ summary.json (structured)
194
+ shell.php (upload payload, if applicable)
195
+
196
+ ---
197
+
198
+ ## Design Notes | ملاحظات التصميم
199
+
200
+ - **Name-mangled identifiers** — every symbol is prefixed `shlhom` to reduce casual readability.
201
+ - **Modular** — each vulnerability class is a standalone function; the dispatcher runs them in parallel via `ThreadPoolExecutor`.
202
+ - **Graceful failure** — a module crash does not abort the scan; failures are logged to `raw.log`.
203
+ - **Persistent output** — every finding is written to disk immediately, so interrupted scans still produce partial reports.
204
+ - **Session reuse** — one `requests.Session` with a random user-agent for the whole scan.
205
+ - **Auto-install** — installs `requests` at runtime if missing.
206
+
207
+ ---
208
+
209
+ ## Feature Matrix | جدول الميزات
210
+
211
+ | Feature | Status |
212
+ |---------|--------|
213
+ | Recursive crawling | [OK] |
214
+ | Form extraction | [OK] |
215
+ | Parameter discovery | [OK] |
216
+ | Tech fingerprinting | [OK] |
217
+ | WAF detection | [OK] |
218
+ | Security headers audit | [OK] |
219
+ | CORS check | [OK] |
220
+ | Sensitive file discovery | [OK] |
221
+ | Admin panel discovery | [OK] |
222
+ | SQLi (error + time) | [OK] |
223
+ | XSS (reflected + form) | [OK] |
224
+ | LFI | [OK] |
225
+ | RFI | [OK] |
226
+ | SSRF | [OK] |
227
+ | Command Injection | [OK] |
228
+ | SSTI | [OK] |
229
+ | Open Redirect | [OK] |
230
+ | File upload to shell | [OK] |
231
+ | SSL/TLS analysis | [OK] |
232
+ | Structured JSON output | [OK] |
233
+
234
+ ---
235
+
236
+ ## Author | المؤلف
237
+
238
+ - **Email:** adojod1231@gmail.com
239
+ - **Telegram:** [@yy22ff](https://t.me/yy22ff)
240
+ - **PyPI:** [yy22ff](https://pypi.org/project/yy22ff/)
241
+
242
+ ---
243
+
244
+ ## License | الترخيص
245
+
246
+ MIT © yy22ff
247
+
248
+ ---
249
+
250
+ **Built with focus. Tested on real targets.**
251
+
252
+ **صُنعت بدقة. مختبرة على أهداف حقيقية.**
@@ -0,0 +1,3 @@
1
+ [build-system]
2
+ requires = ["setuptools>=61.0", "wheel"]
3
+ build-backend = "setuptools.build_meta"
yy22ff-1.0.0/setup.cfg ADDED
@@ -0,0 +1,4 @@
1
+ [egg_info]
2
+ tag_build =
3
+ tag_date = 0
4
+
yy22ff-1.0.0/setup.py ADDED
@@ -0,0 +1,40 @@
1
+ from setuptools import setup, find_packages
2
+
3
+ with open("README.md", "r", encoding="utf-8") as f:
4
+ long_description = f.read()
5
+
6
+ setup(
7
+ name="yy22ff",
8
+ version="1.0.0",
9
+ author="yy22ff",
10
+ author_email="adojod1231@gmail.com",
11
+ description="Full-auto web vulnerability scanner: crawling, fingerprinting, SQLi, XSS, LFI, RFI, SSRF, CMDi, SSTI, file-upload exploitation, TLS analysis.",
12
+ long_description=long_description,
13
+ long_description_content_type="text/markdown",
14
+ url="https://t.me/yy22ff",
15
+ packages=find_packages(),
16
+ classifiers=[
17
+ "Programming Language :: Python :: 3",
18
+ "Programming Language :: Python :: 3.7",
19
+ "Programming Language :: Python :: 3.8",
20
+ "Programming Language :: Python :: 3.9",
21
+ "Programming Language :: Python :: 3.10",
22
+ "Programming Language :: Python :: 3.11",
23
+ "Programming Language :: Python :: 3.12",
24
+ "License :: OSI Approved :: MIT License",
25
+ "Operating System :: OS Independent",
26
+ "Natural Language :: Arabic",
27
+ "Intended Audience :: Developers",
28
+ "Topic :: Security",
29
+ ],
30
+ python_requires=">=3.7",
31
+ install_requires=[
32
+ "requests>=2.25.0",
33
+ "colorama>=0.4.4",
34
+ ],
35
+ entry_points={
36
+ "console_scripts": [
37
+ "yy22ff=yy22ff:cli",
38
+ ],
39
+ },
40
+ )
@@ -0,0 +1,7 @@
1
+ from .scanner import scan, cli
2
+
3
+ __version__ = "1.0.0"
4
+ __author__ = "yy22ff"
5
+ __email__ = "adojod1231@gmail.com"
6
+ __telegram__ = "@yy22ff"
7
+ __all__ = ["scan", "cli"]