Updated JS_Scan and GraphQL_Scan - #14
Merged
Merged
Conversation
- Add SessionFixation_Test module: probes top 20 common session cookie names, flags echo-back of injected values (session fixation) and significant response diffs (cookie-based access control) - Merge ./modules with PentestTools/modules: copy JSSecrets, OCSP, OpenDirectory, React2Shell, DomainTakeover into ./modules; sync all shared files to PentestTools/modules as canonical source Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- GraphQL_Scan: introspection-based schema mapper with 700+ endpoint wordlist, auth support (cookies/headers), depth control, and debug mode - JS_Scan: JavaScript surface recon tool — discovers bundles via HTML crawl and asset-manifest, mines for secrets, API endpoints, hostnames, config, and auth artefacts - Both available as standalone CLI scripts (modules/) and framework modules (PentestTools/modules/) returning TestResult objects - Registered in module_metadata.py with title, severity, and recommendation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GraphQL_Scan and JS_Scan were writing .txt/.json files to the working directory, which fails with Permission denied in Docker containers. Framework modules should never write files; all output goes through TestResult.details and the framework's output formatters. - Drop file writes and -o flag from PentestTools/modules versions - -v flag prints schema map / report to stdout for interactive use - JS_Scan surfaces top critical/high secrets inline in details Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GraphQL_Scan: replace multiline schema_map string in details (which broke the table) with query_names/mutation_names/subscription_names lists. JS_Scan: replace bare counts with actual found values per category (endpoints, hostnames, secrets with severity label, config, auth). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… in JS_Scan details Both modules now return complete, untruncated data in the details dict. GraphQL_Scan includes full arg/return signatures for every query, mutation, and subscription. JS_Scan includes every finding across SECRETS, ENDPOINTS, HOSTNAMES, CONFIG, and AUTH with no item limits or value truncation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… source Each finding in details (secrets, endpoints, hostnames, config, auth) is now a dict with all available fields instead of a flat string, giving clean JSON output that mirrors the verbose terminal report. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add _format_details_table() to result.py that renders list-of-dicts findings (label, value, context, source) as indented human-readable lines instead of a raw JSON blob. Enable HRuleStyle.ALL row separators so multi-line detail cells are clearly bounded. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Set max_table_width to terminal columns so the table never overflows. Handle nested dict values (e.g. PortScan open_ports) by showing only non-empty sub-fields as a compact comma-separated summary instead of the raw Python dict repr. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
max_table_width compressed all columns proportionally which squished Target/Check/Status to single characters. Instead, clip each Details line to 90 chars in _format_details_table so the table width is naturally bounded without distorting other columns. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…le formatter - Skip None/empty string/list/dict values entirely (no blank lines) - For list-of-dicts without label/value keys (e.g. os_detection), use _compact_dict() to render non-empty fields as a summary line - Skip empty dicts like traceroute/vendor entirely - List values inside dicts rendered as JSON, not raw repr Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…one' JS_Scan details now always includes all five categories (secrets, endpoints, hostnames, config, auth) regardless of whether findings exist, so the table gives a complete enumeration picture per scan. _format_details_table now distinguishes empty list (shows 'key: none') from empty dict (still silently skipped), so empty categories are visible while PortScan's empty traceroute/vendor dicts stay hidden. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add 'App Route' endpoint pattern to catch href-based routes (/checkout, /account, /products, etc.) that aren't covered by the API path pattern. Add 'Frontend Env Var Accessed' config pattern to detect compiled env var access (process.env.NEXT_PUBLIC_*, t.env.NEXT_PUBLIC_*, etc.) since Turbopack/Next.js never emits KEY = "value" assignments in bundles. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix Private IP regex: proper 0-255 octet validation via _OCT constant eliminates SVG coordinate false positives (e.g. stripe.com path data) - SECRETS: add AWS Secret Access Key, Sentry DSN, Mapbox public token, PostHog key, Pusher key, reCAPTCHA site key, Stripe publishable key, Shopify storefront token, Netlify access token - ENDPOINTS: add WebSocket URL (wss?://), GraphQL operation names, API base URL config var, tRPC route prefix; expand app routes (sign-in, sign-up, pricing, billing, support, forgot-password, etc.) - HOSTNAMES: add Staging/Dev subdomain pattern detection - CONFIG: add GA4 ID (G-xxx), GTM ID (GTM-xxx), Sentry DSN config assignment, Supabase project URL, Cloudinary cloud name, feature flags - AUTH: add Keycloak realm URL, Clerk publishable key, Supabase anon key, Cognito Identity Pool ID; expand OAuth endpoint to include /realms - NOISE_HOSTNAMES: add 13 more framework/doc domains (nextjs.org, react.dev, tailwindcss.com, vercel.com, etc.) to reduce hostname noise Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
10.x.x.x pattern was missing the fourth octet, causing 3-part SVG path coordinates (e.g. "C0 10.4.6 11") to match as private IPs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Strip scheme/port from target URL before DNS resolution so inputs like https://turbopentest.com:443 resolve correctly instead of failing NXDOMAIN - Replace root-domain DKIM TXT lookup (always wrong) with a selector probe across common selectors (google, mail, s1, selector1, etc.) at {selector}._domainkey.{domain}; reports which selector matched Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Updated JS_Scan and GraphQL_Scan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.