Add files via upload
This commit is contained in:
52 files changed
+33300
No files matched your search
@@ -0,0 +1,875 @@
|
||||
import type { MissionFamily } from '../resources/index.js';
|
||||
|
||||
export type ToolCategory =
|
||||
| 'core'
|
||||
| 'osint'
|
||||
| 'dns'
|
||||
| 'network'
|
||||
| 'web'
|
||||
| 'api'
|
||||
| 'vulnerability'
|
||||
| 'supply_chain'
|
||||
| 'cloud'
|
||||
| 'container'
|
||||
| 'ai_agent'
|
||||
| 'smart_contract'
|
||||
| 'crypto'
|
||||
| 'fuzzing'
|
||||
| 'mobile'
|
||||
| 'secrets'
|
||||
| 'reverse'
|
||||
| 'forensics'
|
||||
| 'credentials'
|
||||
| 'post_exploitation'
|
||||
| 'reporting';
|
||||
|
||||
export type ToolRisk = 'local_read' | 'passive' | 'active' | 'intrusive' | 'credential' | 'dangerous';
|
||||
export type ToolExecutionMode = 'safe_command' | 'receipt_required' | 'import_only' | 'catalog_only';
|
||||
|
||||
export interface ToolAdapter {
|
||||
id: string;
|
||||
binary: string;
|
||||
name: string;
|
||||
category: ToolCategory;
|
||||
families: MissionFamily[];
|
||||
risk: ToolRisk;
|
||||
execution: ToolExecutionMode;
|
||||
networked: boolean;
|
||||
evidenceKinds: string[];
|
||||
outputFormats: string[];
|
||||
installHint: string;
|
||||
commandHint: string;
|
||||
parserStatus: 'structured' | 'text' | 'planned';
|
||||
notes: string;
|
||||
}
|
||||
|
||||
const WEB_FAMILIES: MissionFamily[] = ['web_api', 'reporting_remediation'];
|
||||
const SUPPLY_FAMILIES: MissionFamily[] = ['code_supply_chain', 'reporting_remediation'];
|
||||
const CLOUD_FAMILIES: MissionFamily[] = ['cloud_infra', 'reporting_remediation'];
|
||||
const AI_FAMILIES: MissionFamily[] = ['ai_red_team', 'agent_warfare', 'reporting_remediation'];
|
||||
const SMART_CONTRACT_FAMILIES: MissionFamily[] = ['smart_contract', 'crypto_secrets', 'code_supply_chain', 'reporting_remediation'];
|
||||
const CRYPTO_FAMILIES: MissionFamily[] = ['crypto_secrets', 'code_supply_chain', 'reporting_remediation'];
|
||||
const REVERSE_FAMILIES: MissionFamily[] = ['reverse_binary', 'code_supply_chain', 'reporting_remediation'];
|
||||
|
||||
export const FRONTIER_ARSENAL_MILESTONE = 104;
|
||||
|
||||
export const TOOL_ADAPTERS: ToolAdapter[] = [
|
||||
{
|
||||
id: 'file',
|
||||
binary: 'file',
|
||||
name: 'file',
|
||||
category: 'core',
|
||||
families: ['code_supply_chain', 'reverse_binary', 'reporting_remediation'],
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['artifact_fingerprint'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'Usually preinstalled on Unix-like systems.',
|
||||
commandHint: 'file package.json',
|
||||
parserStatus: 'text',
|
||||
notes: 'Harmless local artifact identification used by smoke tests and ledgers.',
|
||||
},
|
||||
{
|
||||
id: 'curl',
|
||||
binary: 'curl',
|
||||
name: 'curl',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['http_request', 'http_response', 'header_probe'],
|
||||
outputFormats: ['text', 'headers'],
|
||||
installHint: 'Usually preinstalled on macOS and Linux.',
|
||||
commandHint: 'curl -I https://example.com',
|
||||
parserStatus: 'text',
|
||||
notes: 'General HTTP probe. External targets require ScopeGuard receipts.',
|
||||
},
|
||||
{
|
||||
id: 'dig',
|
||||
binary: 'dig',
|
||||
name: 'dig',
|
||||
category: 'dns',
|
||||
families: ['web_api', 'cloud_infra', 'social_osint', 'reporting_remediation'],
|
||||
risk: 'passive',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['dns_record'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'Install bind utilities, e.g. `brew install bind` or OS package equivalent.',
|
||||
commandHint: 'dig +short example.com',
|
||||
parserStatus: 'text',
|
||||
notes: 'DNS record collection for scoped targets.',
|
||||
},
|
||||
{
|
||||
id: 'host',
|
||||
binary: 'host',
|
||||
name: 'host',
|
||||
category: 'dns',
|
||||
families: ['web_api', 'cloud_infra', 'social_osint'],
|
||||
risk: 'passive',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['dns_record'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'Install bind utilities, e.g. `brew install bind` or OS package equivalent.',
|
||||
commandHint: 'host example.com',
|
||||
parserStatus: 'text',
|
||||
notes: 'Simple DNS lookup companion to dig.',
|
||||
},
|
||||
{
|
||||
id: 'whois',
|
||||
binary: 'whois',
|
||||
name: 'whois',
|
||||
category: 'osint',
|
||||
families: ['web_api', 'cloud_infra', 'social_osint'],
|
||||
risk: 'passive',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['registration_record'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'Usually preinstalled, or install via OS package manager.',
|
||||
commandHint: 'whois example.com',
|
||||
parserStatus: 'text',
|
||||
notes: 'Passive registration context for scoped assets.',
|
||||
},
|
||||
{
|
||||
id: 'nmap',
|
||||
binary: 'nmap',
|
||||
name: 'Nmap',
|
||||
category: 'network',
|
||||
families: ['web_api', 'cloud_infra', 'reporting_remediation'],
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['open_port', 'service_fingerprint'],
|
||||
outputFormats: ['text', 'xml'],
|
||||
installHint: 'brew install nmap',
|
||||
commandHint: 'nmap -sV --top-ports 100 --open 127.0.0.1',
|
||||
parserStatus: 'text',
|
||||
notes: 'Primary scoped port and service discovery engine.',
|
||||
},
|
||||
{
|
||||
id: 'subfinder',
|
||||
binary: 'subfinder',
|
||||
name: 'Subfinder',
|
||||
category: 'osint',
|
||||
families: ['web_api', 'cloud_infra', 'social_osint'],
|
||||
risk: 'passive',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['subdomain'],
|
||||
outputFormats: ['text', 'jsonl'],
|
||||
installHint: 'brew install projectdiscovery/tap/subfinder',
|
||||
commandHint: 'subfinder -d example.com -silent',
|
||||
parserStatus: 'planned',
|
||||
notes: 'High-value passive asset discovery adapter.',
|
||||
},
|
||||
{
|
||||
id: 'httpx',
|
||||
binary: 'httpx',
|
||||
name: 'httpx',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['http_service', 'technology_fingerprint'],
|
||||
outputFormats: ['jsonl', 'text'],
|
||||
installHint: 'brew install projectdiscovery/tap/httpx',
|
||||
commandHint: 'httpx -u https://example.com -status-code -title -tech-detect -json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'HTTP probing and technology detection for discovered assets.',
|
||||
},
|
||||
{
|
||||
id: 'naabu',
|
||||
binary: 'naabu',
|
||||
name: 'Naabu',
|
||||
category: 'network',
|
||||
families: ['web_api', 'cloud_infra'],
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['open_port'],
|
||||
outputFormats: ['jsonl', 'text'],
|
||||
installHint: 'brew install projectdiscovery/tap/naabu',
|
||||
commandHint: 'naabu -host 127.0.0.1 -top-ports 100',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Fast scoped port discovery; pair with nmap for service verification.',
|
||||
},
|
||||
{
|
||||
id: 'katana',
|
||||
binary: 'katana',
|
||||
name: 'Katana',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['endpoint', 'crawl_result'],
|
||||
outputFormats: ['jsonl', 'text'],
|
||||
installHint: 'brew install projectdiscovery/tap/katana',
|
||||
commandHint: 'katana -u https://example.com -jsonl -silent',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Crawler for endpoint discovery and attack-surface mapping.',
|
||||
},
|
||||
{
|
||||
id: 'nuclei',
|
||||
binary: 'nuclei',
|
||||
name: 'Nuclei',
|
||||
category: 'vulnerability',
|
||||
families: ['web_api', 'cloud_infra', 'code_supply_chain', 'reporting_remediation'],
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['scanner_finding', 'template_match'],
|
||||
outputFormats: ['jsonl'],
|
||||
installHint: 'brew install projectdiscovery/tap/nuclei',
|
||||
commandHint: 'nuclei -u https://example.com -severity medium,high,critical -jsonl',
|
||||
parserStatus: 'structured',
|
||||
notes: 'Template-driven scanner; findings should flow into validation and retest.',
|
||||
},
|
||||
{
|
||||
id: 'ffuf',
|
||||
binary: 'ffuf',
|
||||
name: 'FFUF',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['content_discovery'],
|
||||
outputFormats: ['json'],
|
||||
installHint: 'brew install ffuf',
|
||||
commandHint: 'ffuf -u https://example.com/FUZZ -w wordlist.txt -of json',
|
||||
parserStatus: 'structured',
|
||||
notes: 'Content and parameter discovery. Rate-limit on real targets.',
|
||||
},
|
||||
{
|
||||
id: 'gobuster',
|
||||
binary: 'gobuster',
|
||||
name: 'Gobuster',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['content_discovery', 'dns_bruteforce'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'brew install gobuster',
|
||||
commandHint: 'gobuster dir -u https://example.com -w wordlist.txt',
|
||||
parserStatus: 'text',
|
||||
notes: 'Directory and DNS brute-force companion to ffuf.',
|
||||
},
|
||||
{
|
||||
id: 'feroxbuster',
|
||||
binary: 'feroxbuster',
|
||||
name: 'Feroxbuster',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['content_discovery'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'brew install feroxbuster',
|
||||
commandHint: 'feroxbuster -u https://example.com --json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Recursive content discovery; useful when ffuf finds nested paths.',
|
||||
},
|
||||
{
|
||||
id: 'nikto',
|
||||
binary: 'nikto',
|
||||
name: 'Nikto',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['scanner_finding'],
|
||||
outputFormats: ['text', 'json'],
|
||||
installHint: 'brew install nikto',
|
||||
commandHint: 'nikto -h https://example.com',
|
||||
parserStatus: 'text',
|
||||
notes: 'Legacy web server checks; validate findings before reporting.',
|
||||
},
|
||||
{
|
||||
id: 'dalfox',
|
||||
binary: 'dalfox',
|
||||
name: 'Dalfox',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['xss_probe', 'scanner_finding'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'brew install dalfox',
|
||||
commandHint: 'dalfox url https://example.com?q=test -o result.json --format json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'XSS validation adapter for scoped endpoints.',
|
||||
},
|
||||
{
|
||||
id: 'sqlmap',
|
||||
binary: 'sqlmap',
|
||||
name: 'SQLMap',
|
||||
category: 'web',
|
||||
families: WEB_FAMILIES,
|
||||
risk: 'intrusive',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['sqli_validation'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'brew install sqlmap',
|
||||
commandHint: 'sqlmap -u "https://example.com/item?id=1" --batch --level=1 --risk=1',
|
||||
parserStatus: 'text',
|
||||
notes: 'Keep level/risk low unless the mission receipt explicitly permits intrusive testing.',
|
||||
},
|
||||
{
|
||||
id: 'semgrep',
|
||||
binary: 'semgrep',
|
||||
name: 'Semgrep',
|
||||
category: 'supply_chain',
|
||||
families: SUPPLY_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['static_analysis_finding', 'sarif'],
|
||||
outputFormats: ['json', 'sarif'],
|
||||
installHint: 'brew install semgrep or pipx install semgrep',
|
||||
commandHint: 'semgrep scan --config auto --json .',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Static analysis backbone for repository hardening.',
|
||||
},
|
||||
{
|
||||
id: 'gitleaks',
|
||||
binary: 'gitleaks',
|
||||
name: 'Gitleaks',
|
||||
category: 'secrets',
|
||||
families: SUPPLY_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['secret_finding'],
|
||||
outputFormats: ['json', 'sarif'],
|
||||
installHint: 'brew install gitleaks',
|
||||
commandHint: 'gitleaks detect --source . --report-format json --redact',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Secret detection must redact values before ledger insertion.',
|
||||
},
|
||||
{
|
||||
id: 'trufflehog',
|
||||
binary: 'trufflehog',
|
||||
name: 'TruffleHog',
|
||||
category: 'secrets',
|
||||
families: SUPPLY_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['secret_finding'],
|
||||
outputFormats: ['json'],
|
||||
installHint: 'brew install trufflehog',
|
||||
commandHint: 'trufflehog filesystem . --json --no-update',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Deep secret scanner. Keep verification/network modes explicit.',
|
||||
},
|
||||
{
|
||||
id: 'trivy',
|
||||
binary: 'trivy',
|
||||
name: 'Trivy',
|
||||
category: 'container',
|
||||
families: ['code_supply_chain', 'cloud_infra', 'reporting_remediation'],
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['dependency_vulnerability', 'container_vulnerability', 'iac_misconfig'],
|
||||
outputFormats: ['json', 'sarif'],
|
||||
installHint: 'brew install aquasecurity/trivy/trivy',
|
||||
commandHint: 'trivy fs --format json .',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Vulnerability and IaC scanner for repos and images.',
|
||||
},
|
||||
{
|
||||
id: 'syft',
|
||||
binary: 'syft',
|
||||
name: 'Syft',
|
||||
category: 'supply_chain',
|
||||
families: SUPPLY_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['sbom'],
|
||||
outputFormats: ['spdx-json', 'cyclonedx-json'],
|
||||
installHint: 'brew install syft',
|
||||
commandHint: 'syft dir:. -o cyclonedx-json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'SBOM generator feeding vulnerability and provenance workflows.',
|
||||
},
|
||||
{
|
||||
id: 'grype',
|
||||
binary: 'grype',
|
||||
name: 'Grype',
|
||||
category: 'supply_chain',
|
||||
families: SUPPLY_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['dependency_vulnerability'],
|
||||
outputFormats: ['json'],
|
||||
installHint: 'brew install grype',
|
||||
commandHint: 'grype dir:. -o json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Pairs well with Syft SBOMs for dependency vulnerability triage.',
|
||||
},
|
||||
{
|
||||
id: 'osv-scanner',
|
||||
binary: 'osv-scanner',
|
||||
name: 'OSV Scanner',
|
||||
category: 'supply_chain',
|
||||
families: SUPPLY_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: true,
|
||||
evidenceKinds: ['dependency_vulnerability'],
|
||||
outputFormats: ['json'],
|
||||
installHint: 'brew install osv-scanner',
|
||||
commandHint: 'osv-scanner --format json --recursive .',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Uses OSV vulnerability data; note network dependency in evidence.',
|
||||
},
|
||||
{
|
||||
id: 'checkov',
|
||||
binary: 'checkov',
|
||||
name: 'Checkov',
|
||||
category: 'cloud',
|
||||
families: CLOUD_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['iac_misconfig'],
|
||||
outputFormats: ['json', 'sarif'],
|
||||
installHint: 'brew install checkov or pipx install checkov',
|
||||
commandHint: 'checkov -d . -o json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'IaC policy scanner for Terraform, Kubernetes, and cloud templates.',
|
||||
},
|
||||
{
|
||||
id: 'prowler',
|
||||
binary: 'prowler',
|
||||
name: 'Prowler',
|
||||
category: 'cloud',
|
||||
families: CLOUD_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['cloud_control_finding'],
|
||||
outputFormats: ['json', 'csv'],
|
||||
installHint: 'pipx install prowler',
|
||||
commandHint: 'prowler aws --output-formats json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Cloud account assessment requires explicit account scope and credentials handling.',
|
||||
},
|
||||
{
|
||||
id: 'garak',
|
||||
binary: 'garak',
|
||||
name: 'Garak',
|
||||
category: 'ai_agent',
|
||||
families: AI_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['model_probe', 'prompt_test_result'],
|
||||
outputFormats: ['jsonl', 'report'],
|
||||
installHint: 'pipx install garak',
|
||||
commandHint: 'garak --model_type rest --model_name scoped-model',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Model/agent probing must use scoped models and redacted transcripts.',
|
||||
},
|
||||
{
|
||||
id: 'promptfoo',
|
||||
binary: 'promptfoo',
|
||||
name: 'promptfoo',
|
||||
category: 'ai_agent',
|
||||
families: AI_FAMILIES,
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['prompt_eval', 'regression_result'],
|
||||
outputFormats: ['json', 'junit'],
|
||||
installHint: 'npm install -g promptfoo',
|
||||
commandHint: 'promptfoo eval --output results.json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Best fit for repeatable prompt/tool/memory regression packs.',
|
||||
},
|
||||
{
|
||||
id: 'slither',
|
||||
binary: 'slither',
|
||||
name: 'Slither',
|
||||
category: 'smart_contract',
|
||||
families: SMART_CONTRACT_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['smart_contract_static_finding', 'solidity_call_graph'],
|
||||
outputFormats: ['json', 'sarif', 'text'],
|
||||
installHint: 'pipx install slither-analyzer',
|
||||
commandHint: 'slither . --json slither-report.json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Static-analysis backbone for Solidity and EVM contract review.',
|
||||
},
|
||||
{
|
||||
id: 'mythril',
|
||||
binary: 'myth',
|
||||
name: 'Mythril',
|
||||
category: 'smart_contract',
|
||||
families: SMART_CONTRACT_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['symbolic_execution_finding', 'smart_contract_trace'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'pipx install mythril',
|
||||
commandHint: 'myth analyze contracts/Target.sol -o json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Symbolic execution for scoped local contract artifacts.',
|
||||
},
|
||||
{
|
||||
id: 'echidna',
|
||||
binary: 'echidna',
|
||||
name: 'Echidna',
|
||||
category: 'smart_contract',
|
||||
families: SMART_CONTRACT_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['property_test_result', 'fuzz_counterexample'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'brew install crytic/tap/echidna',
|
||||
commandHint: 'echidna . --config echidna.yaml --format json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Property-based fuzzing for local smart-contract harnesses.',
|
||||
},
|
||||
{
|
||||
id: 'foundry-forge',
|
||||
binary: 'forge',
|
||||
name: 'Foundry Forge',
|
||||
category: 'smart_contract',
|
||||
families: SMART_CONTRACT_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['unit_test_result', 'fuzz_test_result', 'coverage_signal'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'Install Foundry with foundryup from https://book.getfoundry.sh/getting-started/installation',
|
||||
commandHint: 'forge test --json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Local EVM tests, invariant checks, and replay harnesses.',
|
||||
},
|
||||
{
|
||||
id: 'foundry-cast',
|
||||
binary: 'cast',
|
||||
name: 'Foundry Cast',
|
||||
category: 'smart_contract',
|
||||
families: ['smart_contract', 'crypto_secrets', 'reporting_remediation'],
|
||||
risk: 'active',
|
||||
execution: 'receipt_required',
|
||||
networked: true,
|
||||
evidenceKinds: ['chain_query', 'transaction_dry_run', 'abi_decode'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'Install Foundry with foundryup from https://book.getfoundry.sh/getting-started/installation',
|
||||
commandHint: 'cast call --rpc-url scoped-rpc.example 0x0000000000000000000000000000000000000000 "symbol()(string)"',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Chain interaction stays receipt-gated; prefer dry-run and read-only calls.',
|
||||
},
|
||||
{
|
||||
id: 'solhint',
|
||||
binary: 'solhint',
|
||||
name: 'Solhint',
|
||||
category: 'smart_contract',
|
||||
families: SMART_CONTRACT_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['solidity_lint_finding'],
|
||||
outputFormats: ['json', 'stylish', 'text'],
|
||||
installHint: 'npm install -g solhint',
|
||||
commandHint: 'solhint "contracts/**/*.sol" --formatter json',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Fast lint layer for Solidity hygiene before heavier analysis.',
|
||||
},
|
||||
{
|
||||
id: 'openssl',
|
||||
binary: 'openssl',
|
||||
name: 'OpenSSL',
|
||||
category: 'crypto',
|
||||
families: CRYPTO_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['certificate_metadata', 'crypto_material_fingerprint'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'Usually preinstalled, or install via `brew install openssl@3`.',
|
||||
commandHint: 'openssl x509 -in certificate.pem -noout -text',
|
||||
parserStatus: 'text',
|
||||
notes: 'Local certificate, key, and crypto-material inspection. Do not log private key values.',
|
||||
},
|
||||
{
|
||||
id: 'john',
|
||||
binary: 'john',
|
||||
name: 'John the Ripper',
|
||||
category: 'crypto',
|
||||
families: CRYPTO_FAMILIES,
|
||||
risk: 'credential',
|
||||
execution: 'receipt_required',
|
||||
networked: false,
|
||||
evidenceKinds: ['hash_audit_result', 'password_policy_signal'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'brew install john',
|
||||
commandHint: 'john --test',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Local hash-strength auditing only; cracking runs require explicit mission receipts and redacted evidence.',
|
||||
},
|
||||
{
|
||||
id: 'hashcat',
|
||||
binary: 'hashcat',
|
||||
name: 'Hashcat',
|
||||
category: 'crypto',
|
||||
families: CRYPTO_FAMILIES,
|
||||
risk: 'credential',
|
||||
execution: 'receipt_required',
|
||||
networked: false,
|
||||
evidenceKinds: ['hash_audit_result', 'gpu_cracking_benchmark'],
|
||||
outputFormats: ['text', 'json'],
|
||||
installHint: 'brew install hashcat',
|
||||
commandHint: 'hashcat --benchmark',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Receipt-gated local hash auditing and benchmark evidence; never store recovered secrets.',
|
||||
},
|
||||
{
|
||||
id: 'radamsa',
|
||||
binary: 'radamsa',
|
||||
name: 'Radamsa',
|
||||
category: 'fuzzing',
|
||||
families: ['reverse_binary', 'web_api', 'code_supply_chain', 'reporting_remediation'],
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['fuzz_case', 'mutation_seed'],
|
||||
outputFormats: ['binary', 'text'],
|
||||
installHint: 'brew install radamsa',
|
||||
commandHint: 'radamsa sample.txt -o fuzz-case.txt',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Local mutation engine for controlled parser and protocol harnesses.',
|
||||
},
|
||||
{
|
||||
id: 'afl-fuzz',
|
||||
binary: 'afl-fuzz',
|
||||
name: 'AFL++',
|
||||
category: 'fuzzing',
|
||||
families: REVERSE_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['crash_case', 'coverage_signal', 'fuzz_corpus'],
|
||||
outputFormats: ['directory', 'text'],
|
||||
installHint: 'brew install afl++',
|
||||
commandHint: 'afl-fuzz -i seeds -o findings -- ./target @@',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Local binary fuzzing harness; production targets require a lab fixture.',
|
||||
},
|
||||
{
|
||||
id: 'radare2',
|
||||
binary: 'r2',
|
||||
name: 'radare2',
|
||||
category: 'reverse',
|
||||
families: REVERSE_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['binary_analysis', 'function_graph', 'string_reference'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'brew install radare2',
|
||||
commandHint: 'r2 -q -c "iIj" artifact.bin',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Scriptable local reverse-engineering adapter for artifacts and firmware.',
|
||||
},
|
||||
{
|
||||
id: 'apktool',
|
||||
binary: 'apktool',
|
||||
name: 'Apktool',
|
||||
category: 'mobile',
|
||||
families: REVERSE_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['mobile_manifest', 'apk_resource_tree'],
|
||||
outputFormats: ['directory', 'text'],
|
||||
installHint: 'brew install apktool',
|
||||
commandHint: 'apktool d app.apk -o apk-out',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Mobile app unpacking for owned APKs and lab samples.',
|
||||
},
|
||||
{
|
||||
id: 'jadx',
|
||||
binary: 'jadx',
|
||||
name: 'JADX',
|
||||
category: 'mobile',
|
||||
families: REVERSE_FAMILIES,
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['decompiled_source', 'mobile_static_finding'],
|
||||
outputFormats: ['directory', 'text'],
|
||||
installHint: 'brew install jadx',
|
||||
commandHint: 'jadx --output-dir jadx-out app.apk',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Android decompilation for scoped local APK review.',
|
||||
},
|
||||
{
|
||||
id: 'exiftool',
|
||||
binary: 'exiftool',
|
||||
name: 'ExifTool',
|
||||
category: 'forensics',
|
||||
families: ['code_supply_chain', 'reverse_binary', 'reporting_remediation'],
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['metadata'],
|
||||
outputFormats: ['json', 'text'],
|
||||
installHint: 'brew install exiftool',
|
||||
commandHint: 'exiftool -json artifact.bin',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Metadata extraction for artifacts and reports.',
|
||||
},
|
||||
{
|
||||
id: 'binwalk',
|
||||
binary: 'binwalk',
|
||||
name: 'Binwalk',
|
||||
category: 'reverse',
|
||||
families: ['reverse_binary', 'reporting_remediation'],
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['firmware_signature', 'embedded_file'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'brew install binwalk',
|
||||
commandHint: 'binwalk firmware.bin',
|
||||
parserStatus: 'text',
|
||||
notes: 'Firmware and embedded-file triage.',
|
||||
},
|
||||
{
|
||||
id: 'metasploit',
|
||||
binary: 'msfconsole',
|
||||
name: 'Metasploit',
|
||||
category: 'post_exploitation',
|
||||
families: ['web_api', 'cloud_infra', 'reporting_remediation'],
|
||||
risk: 'dangerous',
|
||||
execution: 'catalog_only',
|
||||
networked: true,
|
||||
evidenceKinds: ['exploit_validation'],
|
||||
outputFormats: ['workspace_export'],
|
||||
installHint: 'brew install metasploit',
|
||||
commandHint: 'Catalog-only until a narrow module runner and receipt gate exist.',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Do not expose through generic command execution; needs per-module adapters.',
|
||||
},
|
||||
{
|
||||
id: 'hydra',
|
||||
binary: 'hydra',
|
||||
name: 'Hydra',
|
||||
category: 'credentials',
|
||||
families: ['web_api', 'cloud_infra', 'reporting_remediation'],
|
||||
risk: 'credential',
|
||||
execution: 'catalog_only',
|
||||
networked: true,
|
||||
evidenceKinds: ['auth_control_test'],
|
||||
outputFormats: ['text'],
|
||||
installHint: 'brew install hydra',
|
||||
commandHint: 'Catalog-only until account-lockout and written authorization gates exist.',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Credential attack tooling should be modeled, not generically executable.',
|
||||
},
|
||||
{
|
||||
id: 'bloodhound',
|
||||
binary: 'bloodhound',
|
||||
name: 'BloodHound',
|
||||
category: 'credentials',
|
||||
families: ['cloud_infra', 'reporting_remediation'],
|
||||
risk: 'credential',
|
||||
execution: 'import_only',
|
||||
networked: false,
|
||||
evidenceKinds: ['attack_path_graph'],
|
||||
outputFormats: ['json', 'graph'],
|
||||
installHint: 'Install BloodHound CE or compatible collectors.',
|
||||
commandHint: 'Import collector output; do not run collectors without AD scope receipts.',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Useful as graph evidence once collector output is explicitly authorized.',
|
||||
},
|
||||
{
|
||||
id: 'yara',
|
||||
binary: 'yara',
|
||||
name: 'YARA',
|
||||
category: 'forensics',
|
||||
families: ['reverse_binary', 'code_supply_chain', 'reporting_remediation'],
|
||||
risk: 'local_read',
|
||||
execution: 'safe_command',
|
||||
networked: false,
|
||||
evidenceKinds: ['artifact_signature'],
|
||||
outputFormats: ['text', 'json'],
|
||||
installHint: 'brew install yara',
|
||||
commandHint: 'yara rules.yar artifact.bin',
|
||||
parserStatus: 'planned',
|
||||
notes: 'Local artifact classification and malware-family matching.',
|
||||
},
|
||||
];
|
||||
|
||||
export const SAFE_COMMANDS = [
|
||||
...new Set(
|
||||
TOOL_ADAPTERS
|
||||
.filter(adapter => adapter.execution !== 'catalog_only' && adapter.execution !== 'import_only')
|
||||
.map(adapter => adapter.binary)
|
||||
),
|
||||
].sort();
|
||||
|
||||
export const NETWORK_COMMANDS = new Set(
|
||||
TOOL_ADAPTERS
|
||||
.filter(adapter => adapter.networked && adapter.execution !== 'catalog_only' && adapter.execution !== 'import_only')
|
||||
.map(adapter => adapter.binary)
|
||||
);
|
||||
|
||||
export function adaptersForFamily(family?: string): ToolAdapter[] {
|
||||
return family
|
||||
? TOOL_ADAPTERS.filter(adapter => adapter.families.includes(family as MissionFamily))
|
||||
: TOOL_ADAPTERS;
|
||||
}
|
||||
|
||||
export function adapterForBinary(binary: string): ToolAdapter | undefined {
|
||||
return TOOL_ADAPTERS.find(adapter => adapter.binary === binary || adapter.id === binary);
|
||||
}
|
||||
|
||||
export function summarizeToolCatalog(adapters = TOOL_ADAPTERS): Record<string, unknown> {
|
||||
const commandReady = adapters.filter(adapter => adapter.execution === 'safe_command' || adapter.execution === 'receipt_required').length;
|
||||
const byExecution = adapters.reduce<Record<string, number>>((acc, adapter) => {
|
||||
acc[adapter.execution] = (acc[adapter.execution] || 0) + 1;
|
||||
return acc;
|
||||
}, {});
|
||||
const byRisk = adapters.reduce<Record<string, number>>((acc, adapter) => {
|
||||
acc[adapter.risk] = (acc[adapter.risk] || 0) + 1;
|
||||
return acc;
|
||||
}, {});
|
||||
const byCategory = adapters.reduce<Record<string, number>>((acc, adapter) => {
|
||||
acc[adapter.category] = (acc[adapter.category] || 0) + 1;
|
||||
return acc;
|
||||
}, {});
|
||||
return {
|
||||
total: adapters.length,
|
||||
commandReady,
|
||||
catalogOnly: adapters.filter(adapter => adapter.execution === 'catalog_only').length,
|
||||
importOnly: adapters.filter(adapter => adapter.execution === 'import_only').length,
|
||||
unmodeled: adapters.length === 0 || commandReady === 0,
|
||||
byExecution,
|
||||
byRisk,
|
||||
byCategory,
|
||||
};
|
||||
}
|
||||
Reference in new issue
Block a user