mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-09-14 14:09:04 +02:00
ajmallesh
98c66e051d
Wire Agentic SAST and reconciliation into the main pipeline, persist their durable state, and add the Miscellaneous finding and exploitation lane. Make scan completion, cancellation, partial outcomes, resume identity, and report recovery use the integrated final workflow contract. Introduce the atomic finalization, ordering, renumbering, compaction, and output services that workflow calls. Keep completed Miscellaneous work and report drafts idempotent across resume, preserve public main's default-on exploit SARIF behavior, and describe stage-fallback candidates without claiming they were exported. BREAKING CHANGE: `vuln_classes` has been removed. Configs containing it now fail validation, and all five core pentest classes run on every scan. Workspaces created by Shannon 2.x cannot be resumed. Finish or discard in-flight scans before upgrading, then start a new workspace name.
113 lines
3.9 KiB
YAML
113 lines
3.9 KiB
YAML
# Example configuration file for pentest-agent
|
|
# Copy this file and modify it for your specific testing needs
|
|
|
|
# Description of the target environment (optional, max 500 chars)
|
|
description: "Next.js e-commerce app on PostgreSQL. Local dev environment — .env files contain local-only credentials, not deployed to production."
|
|
|
|
# Every scan runs all five vulnerability classes: injection, xss, auth, authz, and ssrf.
|
|
# There is no setting to narrow that.
|
|
|
|
# Agentic static analysis (optional, default: "false").
|
|
# Reads the repository for vulnerabilities before the pentest and feeds them into exploitation.
|
|
# It costs extra model time, and if it fails the scan finishes as "partial" without its findings.
|
|
# agentic_sast:
|
|
# enabled: "true"
|
|
|
|
# Skip the exploitation phase (optional, default: "true")
|
|
# exploit: "false"
|
|
|
|
# Free-form engagement rules applied to analysis and exploitation agents (optional).
|
|
# Example below is illustrative; edit, remove, or add sections as needed.
|
|
# rules_of_engagement: |
|
|
# Forbidden techniques:
|
|
# - No password brute-force or credential stuffing. Cap login attempts at 5 per account.
|
|
# - ...
|
|
#
|
|
# Operational:
|
|
# - Throttle to under 5 requests per second per endpoint. Back off 60 seconds on any 429 response.
|
|
# - ...
|
|
#
|
|
# Data handling:
|
|
# - Do not include actual values in deliverables — use placeholders like [order_id] or [user_email].
|
|
# - ...
|
|
|
|
authentication:
|
|
login_type: form # Options: 'form' or 'sso'
|
|
login_url: "https://example.com/login"
|
|
credentials:
|
|
username: "testuser"
|
|
password: "testpassword"
|
|
totp_secret: "JBSWY3DPEHPK3PXP" # Optional TOTP secret for 2FA
|
|
|
|
# Optional mailbox credentials for magic-link / email-OTP flows.
|
|
# email_login:
|
|
# address: "inbox@example.com"
|
|
# password: "mailbox-password"
|
|
# totp_secret: "JBSWY3DPEHPK3PXP"
|
|
|
|
# Natural language instructions for login flow
|
|
login_flow:
|
|
- "Type $username into the email field"
|
|
- "Type $password into the password field"
|
|
- "Click the 'Sign In' button"
|
|
- "Enter $totp in the verification code field"
|
|
- "Click 'Verify'"
|
|
|
|
success_condition:
|
|
type: url_contains # Options: 'url_contains' or 'element_present'
|
|
value: "/dashboard"
|
|
|
|
rules:
|
|
# Supported types: url_path, subdomain, domain, method, header, parameter, code_path
|
|
avoid:
|
|
- description: "Do not test the marketing site subdomain"
|
|
type: subdomain
|
|
value: "www"
|
|
|
|
- description: "Skip logout functionality"
|
|
type: url_path
|
|
value: "/logout"
|
|
|
|
- description: "No DELETE operations on user API"
|
|
type: url_path
|
|
value: "/api/v1/users/*"
|
|
|
|
# code_path values are repo-relative file paths or globs (e.g. "src/auth.ts", "test/**").
|
|
# - description: "Test fixtures and specs (not production code)"
|
|
# type: code_path
|
|
# value: "test/**"
|
|
#
|
|
# - description: "Generated migrations"
|
|
# type: code_path
|
|
# value: "db/migrations/**"
|
|
|
|
focus:
|
|
- description: "Prioritize beta admin panel subdomain"
|
|
type: subdomain
|
|
value: "beta-admin"
|
|
|
|
- description: "Focus on user profile updates"
|
|
type: url_path
|
|
value: "/api/v2/user-profile"
|
|
|
|
# code_path values are repo-relative file paths or globs (e.g. "src/auth.ts", "routes/*.ts").
|
|
# - description: "Express route handlers"
|
|
# type: code_path
|
|
# value: "routes/*.ts"
|
|
#
|
|
# - description: "Sequelize ORM model definitions"
|
|
# type: code_path
|
|
# value: "models/*.ts"
|
|
|
|
# Report filters applied by the report agent when assembling the final report (optional).
|
|
# Example below is illustrative; edit, remove, or add sections as needed.
|
|
# report:
|
|
# # SARIF 2.1.0 log (report.sarif) beside the report. On by default for exploit runs;
|
|
# # set "false" to opt out. Ignored when exploit is "false".
|
|
# sarif: "false"
|
|
# min_severity: low
|
|
# min_confidence: low
|
|
# guidance: |
|
|
# Drop findings about missing security headers and rate-limit gaps.
|
|
# ...
|