import type { MissionFamily } from '../resources/index.js'; export type ToolCategory = | 'core' | 'osint' | 'dns' | 'network' | 'web' | 'api' | 'vulnerability' | 'supply_chain' | 'cloud' | 'container' | 'ai_agent' | 'smart_contract' | 'crypto' | 'fuzzing' | 'mobile' | 'secrets' | 'reverse' | 'forensics' | 'credentials' | 'post_exploitation' | 'reporting'; export type ToolRisk = 'local_read' | 'passive' | 'active' | 'intrusive' | 'credential' | 'dangerous'; export type ToolExecutionMode = 'safe_command' | 'receipt_required' | 'import_only' | 'catalog_only'; export interface ToolAdapter { id: string; binary: string; name: string; category: ToolCategory; families: MissionFamily[]; risk: ToolRisk; execution: ToolExecutionMode; networked: boolean; evidenceKinds: string[]; outputFormats: string[]; installHint: string; commandHint: string; parserStatus: 'structured' | 'text' | 'planned'; notes: string; } const WEB_FAMILIES: MissionFamily[] = ['web_api', 'reporting_remediation']; const SUPPLY_FAMILIES: MissionFamily[] = ['code_supply_chain', 'reporting_remediation']; const CLOUD_FAMILIES: MissionFamily[] = ['cloud_infra', 'reporting_remediation']; const AI_FAMILIES: MissionFamily[] = ['ai_red_team', 'agent_warfare', 'reporting_remediation']; const SMART_CONTRACT_FAMILIES: MissionFamily[] = ['smart_contract', 'crypto_secrets', 'code_supply_chain', 'reporting_remediation']; const CRYPTO_FAMILIES: MissionFamily[] = ['crypto_secrets', 'code_supply_chain', 'reporting_remediation']; const REVERSE_FAMILIES: MissionFamily[] = ['reverse_binary', 'code_supply_chain', 'reporting_remediation']; export const FRONTIER_ARSENAL_MILESTONE = 104; export const TOOL_ADAPTERS: ToolAdapter[] = [ { id: 'file', binary: 'file', name: 'file', category: 'core', families: ['code_supply_chain', 'reverse_binary', 'reporting_remediation'], risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['artifact_fingerprint'], outputFormats: ['text'], installHint: 'Usually preinstalled on Unix-like systems.', commandHint: 'file package.json', parserStatus: 'text', notes: 'Harmless local artifact identification used by smoke tests and ledgers.', }, { id: 'curl', binary: 'curl', name: 'curl', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['http_request', 'http_response', 'header_probe'], outputFormats: ['text', 'headers'], installHint: 'Usually preinstalled on macOS and Linux.', commandHint: 'curl -I https://example.com', parserStatus: 'text', notes: 'General HTTP probe. External targets require ScopeGuard receipts.', }, { id: 'dig', binary: 'dig', name: 'dig', category: 'dns', families: ['web_api', 'cloud_infra', 'social_osint', 'reporting_remediation'], risk: 'passive', execution: 'receipt_required', networked: true, evidenceKinds: ['dns_record'], outputFormats: ['text'], installHint: 'Install bind utilities, e.g. `brew install bind` or OS package equivalent.', commandHint: 'dig +short example.com', parserStatus: 'text', notes: 'DNS record collection for scoped targets.', }, { id: 'host', binary: 'host', name: 'host', category: 'dns', families: ['web_api', 'cloud_infra', 'social_osint'], risk: 'passive', execution: 'receipt_required', networked: true, evidenceKinds: ['dns_record'], outputFormats: ['text'], installHint: 'Install bind utilities, e.g. `brew install bind` or OS package equivalent.', commandHint: 'host example.com', parserStatus: 'text', notes: 'Simple DNS lookup companion to dig.', }, { id: 'whois', binary: 'whois', name: 'whois', category: 'osint', families: ['web_api', 'cloud_infra', 'social_osint'], risk: 'passive', execution: 'receipt_required', networked: true, evidenceKinds: ['registration_record'], outputFormats: ['text'], installHint: 'Usually preinstalled, or install via OS package manager.', commandHint: 'whois example.com', parserStatus: 'text', notes: 'Passive registration context for scoped assets.', }, { id: 'nmap', binary: 'nmap', name: 'Nmap', category: 'network', families: ['web_api', 'cloud_infra', 'reporting_remediation'], risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['open_port', 'service_fingerprint'], outputFormats: ['text', 'xml'], installHint: 'brew install nmap', commandHint: 'nmap -sV --top-ports 100 --open 127.0.0.1', parserStatus: 'text', notes: 'Primary scoped port and service discovery engine.', }, { id: 'subfinder', binary: 'subfinder', name: 'Subfinder', category: 'osint', families: ['web_api', 'cloud_infra', 'social_osint'], risk: 'passive', execution: 'receipt_required', networked: true, evidenceKinds: ['subdomain'], outputFormats: ['text', 'jsonl'], installHint: 'brew install projectdiscovery/tap/subfinder', commandHint: 'subfinder -d example.com -silent', parserStatus: 'planned', notes: 'High-value passive asset discovery adapter.', }, { id: 'httpx', binary: 'httpx', name: 'httpx', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['http_service', 'technology_fingerprint'], outputFormats: ['jsonl', 'text'], installHint: 'brew install projectdiscovery/tap/httpx', commandHint: 'httpx -u https://example.com -status-code -title -tech-detect -json', parserStatus: 'planned', notes: 'HTTP probing and technology detection for discovered assets.', }, { id: 'naabu', binary: 'naabu', name: 'Naabu', category: 'network', families: ['web_api', 'cloud_infra'], risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['open_port'], outputFormats: ['jsonl', 'text'], installHint: 'brew install projectdiscovery/tap/naabu', commandHint: 'naabu -host 127.0.0.1 -top-ports 100', parserStatus: 'planned', notes: 'Fast scoped port discovery; pair with nmap for service verification.', }, { id: 'katana', binary: 'katana', name: 'Katana', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['endpoint', 'crawl_result'], outputFormats: ['jsonl', 'text'], installHint: 'brew install projectdiscovery/tap/katana', commandHint: 'katana -u https://example.com -jsonl -silent', parserStatus: 'planned', notes: 'Crawler for endpoint discovery and attack-surface mapping.', }, { id: 'nuclei', binary: 'nuclei', name: 'Nuclei', category: 'vulnerability', families: ['web_api', 'cloud_infra', 'code_supply_chain', 'reporting_remediation'], risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['scanner_finding', 'template_match'], outputFormats: ['jsonl'], installHint: 'brew install projectdiscovery/tap/nuclei', commandHint: 'nuclei -u https://example.com -severity medium,high,critical -jsonl', parserStatus: 'structured', notes: 'Template-driven scanner; findings should flow into validation and retest.', }, { id: 'ffuf', binary: 'ffuf', name: 'FFUF', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['content_discovery'], outputFormats: ['json'], installHint: 'brew install ffuf', commandHint: 'ffuf -u https://example.com/FUZZ -w wordlist.txt -of json', parserStatus: 'structured', notes: 'Content and parameter discovery. Rate-limit on real targets.', }, { id: 'gobuster', binary: 'gobuster', name: 'Gobuster', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['content_discovery', 'dns_bruteforce'], outputFormats: ['text'], installHint: 'brew install gobuster', commandHint: 'gobuster dir -u https://example.com -w wordlist.txt', parserStatus: 'text', notes: 'Directory and DNS brute-force companion to ffuf.', }, { id: 'feroxbuster', binary: 'feroxbuster', name: 'Feroxbuster', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['content_discovery'], outputFormats: ['json', 'text'], installHint: 'brew install feroxbuster', commandHint: 'feroxbuster -u https://example.com --json', parserStatus: 'planned', notes: 'Recursive content discovery; useful when ffuf finds nested paths.', }, { id: 'nikto', binary: 'nikto', name: 'Nikto', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['scanner_finding'], outputFormats: ['text', 'json'], installHint: 'brew install nikto', commandHint: 'nikto -h https://example.com', parserStatus: 'text', notes: 'Legacy web server checks; validate findings before reporting.', }, { id: 'dalfox', binary: 'dalfox', name: 'Dalfox', category: 'web', families: WEB_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['xss_probe', 'scanner_finding'], outputFormats: ['json', 'text'], installHint: 'brew install dalfox', commandHint: 'dalfox url https://example.com?q=test -o result.json --format json', parserStatus: 'planned', notes: 'XSS validation adapter for scoped endpoints.', }, { id: 'sqlmap', binary: 'sqlmap', name: 'SQLMap', category: 'web', families: WEB_FAMILIES, risk: 'intrusive', execution: 'receipt_required', networked: true, evidenceKinds: ['sqli_validation'], outputFormats: ['text'], installHint: 'brew install sqlmap', commandHint: 'sqlmap -u "https://example.com/item?id=1" --batch --level=1 --risk=1', parserStatus: 'text', notes: 'Keep level/risk low unless the mission receipt explicitly permits intrusive testing.', }, { id: 'semgrep', binary: 'semgrep', name: 'Semgrep', category: 'supply_chain', families: SUPPLY_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['static_analysis_finding', 'sarif'], outputFormats: ['json', 'sarif'], installHint: 'brew install semgrep or pipx install semgrep', commandHint: 'semgrep scan --config auto --json .', parserStatus: 'planned', notes: 'Static analysis backbone for repository hardening.', }, { id: 'gitleaks', binary: 'gitleaks', name: 'Gitleaks', category: 'secrets', families: SUPPLY_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['secret_finding'], outputFormats: ['json', 'sarif'], installHint: 'brew install gitleaks', commandHint: 'gitleaks detect --source . --report-format json --redact', parserStatus: 'planned', notes: 'Secret detection must redact values before ledger insertion.', }, { id: 'trufflehog', binary: 'trufflehog', name: 'TruffleHog', category: 'secrets', families: SUPPLY_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['secret_finding'], outputFormats: ['json'], installHint: 'brew install trufflehog', commandHint: 'trufflehog filesystem . --json --no-update', parserStatus: 'planned', notes: 'Deep secret scanner. Keep verification/network modes explicit.', }, { id: 'trivy', binary: 'trivy', name: 'Trivy', category: 'container', families: ['code_supply_chain', 'cloud_infra', 'reporting_remediation'], risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['dependency_vulnerability', 'container_vulnerability', 'iac_misconfig'], outputFormats: ['json', 'sarif'], installHint: 'brew install aquasecurity/trivy/trivy', commandHint: 'trivy fs --format json .', parserStatus: 'planned', notes: 'Vulnerability and IaC scanner for repos and images.', }, { id: 'syft', binary: 'syft', name: 'Syft', category: 'supply_chain', families: SUPPLY_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['sbom'], outputFormats: ['spdx-json', 'cyclonedx-json'], installHint: 'brew install syft', commandHint: 'syft dir:. -o cyclonedx-json', parserStatus: 'planned', notes: 'SBOM generator feeding vulnerability and provenance workflows.', }, { id: 'grype', binary: 'grype', name: 'Grype', category: 'supply_chain', families: SUPPLY_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['dependency_vulnerability'], outputFormats: ['json'], installHint: 'brew install grype', commandHint: 'grype dir:. -o json', parserStatus: 'planned', notes: 'Pairs well with Syft SBOMs for dependency vulnerability triage.', }, { id: 'osv-scanner', binary: 'osv-scanner', name: 'OSV Scanner', category: 'supply_chain', families: SUPPLY_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: true, evidenceKinds: ['dependency_vulnerability'], outputFormats: ['json'], installHint: 'brew install osv-scanner', commandHint: 'osv-scanner --format json --recursive .', parserStatus: 'planned', notes: 'Uses OSV vulnerability data; note network dependency in evidence.', }, { id: 'checkov', binary: 'checkov', name: 'Checkov', category: 'cloud', families: CLOUD_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['iac_misconfig'], outputFormats: ['json', 'sarif'], installHint: 'brew install checkov or pipx install checkov', commandHint: 'checkov -d . -o json', parserStatus: 'planned', notes: 'IaC policy scanner for Terraform, Kubernetes, and cloud templates.', }, { id: 'prowler', binary: 'prowler', name: 'Prowler', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['cloud_control_finding'], outputFormats: ['json', 'csv'], installHint: 'pipx install prowler', commandHint: 'prowler aws --output-formats json', parserStatus: 'planned', notes: 'Cloud account assessment requires explicit account scope and credentials handling.', }, { id: 'scoutsuite', binary: 'scout', name: 'ScoutSuite', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['cloud_control_finding', 'iam_misconfig'], outputFormats: ['json', 'html'], installHint: 'pipx install scoutsuite', commandHint: 'scout aws --report-dir ./scout (read-only posture; needs account creds + explicit scope)', parserStatus: 'planned', notes: 'Multi-cloud (AWS/Azure/GCP) posture assessment; read-only API reads under authorized credentials + account scope.', }, { id: 'cloudfox', binary: 'cloudfox', name: 'CloudFox', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['cloud_attack_path', 'iam_misconfig'], outputFormats: ['json', 'text'], installHint: 'brew install cloudfox', commandHint: 'cloudfox aws all-checks (enumerates exploitable paths; needs creds + scope)', parserStatus: 'planned', notes: 'Offensive cloud enumeration — surfaces IAM/privesc/attack paths across AWS/Azure/GCP via read-only API calls under authorized credentials.', }, { id: 'pmapper', binary: 'pmapper', name: 'PMapper', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['iam_privesc_path'], outputFormats: ['json', 'dot'], installHint: 'pipx install principalmapper', commandHint: 'pmapper graph create && pmapper query "preset privesc *" (read-only IAM introspection; needs AWS creds + scope)', parserStatus: 'planned', notes: 'Maps AWS IAM privilege-escalation paths from read-only IAM introspection under authorized credentials.', }, { id: 'pacu', binary: 'pacu', name: 'Pacu', category: 'cloud', families: CLOUD_FAMILIES, risk: 'dangerous', execution: 'catalog_only', networked: true, evidenceKinds: ['exploit_validation'], outputFormats: ['session_export'], installHint: 'pipx install pacu', commandHint: 'Catalog-only until a narrow per-module runner and receipt gate exist.', parserStatus: 'planned', notes: 'AWS exploitation framework (privesc, persistence, exfil). Do not expose through generic command execution; needs per-module adapters + explicit approval — same gating as metasploit.', }, { id: 'aws-cli', binary: 'aws', name: 'AWS CLI', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['cloud_enumeration', 'iam_state', 'resource_inventory'], outputFormats: ['json', 'text'], installHint: 'brew install awscli', commandHint: 'aws sts get-caller-identity / aws iam list-users / aws s3 ls (read enum; needs creds + scope)', parserStatus: 'planned', notes: 'Base AWS enumeration primitive. Read-only list/describe API calls under authorized credentials + account scope.', }, { id: 'az-cli', binary: 'az', name: 'Azure CLI', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['cloud_enumeration', 'iam_state'], outputFormats: ['json'], installHint: 'brew install azure-cli', commandHint: 'az account show / az role assignment list / az storage account list (read enum; needs creds + scope)', parserStatus: 'planned', notes: 'Base Azure enumeration primitive. Read-only under authorized credentials + subscription scope.', }, { id: 'gcloud-cli', binary: 'gcloud', name: 'gcloud CLI', category: 'cloud', families: CLOUD_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['cloud_enumeration', 'iam_state'], outputFormats: ['json', 'text'], installHint: 'brew install --cask google-cloud-sdk', commandHint: 'gcloud projects list / gcloud iam roles list / gcloud storage ls (read enum; needs auth + scope)', parserStatus: 'planned', notes: 'Base GCP enumeration primitive. Read-only under authorized credentials + project scope.', }, { id: 'garak', binary: 'garak', name: 'Garak', category: 'ai_agent', families: AI_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['model_probe', 'prompt_test_result'], outputFormats: ['jsonl', 'report'], installHint: 'pipx install garak', commandHint: 'garak --model_type rest --model_name scoped-model', parserStatus: 'planned', notes: 'Model/agent probing must use scoped models and redacted transcripts.', }, { id: 'promptfoo', binary: 'promptfoo', name: 'promptfoo', category: 'ai_agent', families: AI_FAMILIES, risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['prompt_eval', 'regression_result'], outputFormats: ['json', 'junit'], installHint: 'npm install -g promptfoo', commandHint: 'promptfoo eval --output results.json', parserStatus: 'planned', notes: 'Best fit for repeatable prompt/tool/memory regression packs.', }, { id: 'slither', binary: 'slither', name: 'Slither', category: 'smart_contract', families: SMART_CONTRACT_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['smart_contract_static_finding', 'solidity_call_graph'], outputFormats: ['json', 'sarif', 'text'], installHint: 'pipx install slither-analyzer', commandHint: 'slither . --json slither-report.json', parserStatus: 'planned', notes: 'Static-analysis backbone for Solidity and EVM contract review.', }, { id: 'mythril', binary: 'myth', name: 'Mythril', category: 'smart_contract', families: SMART_CONTRACT_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['symbolic_execution_finding', 'smart_contract_trace'], outputFormats: ['json', 'text'], installHint: 'pipx install mythril', commandHint: 'myth analyze contracts/Target.sol -o json', parserStatus: 'planned', notes: 'Symbolic execution for scoped local contract artifacts.', }, { id: 'echidna', binary: 'echidna', name: 'Echidna', category: 'smart_contract', families: SMART_CONTRACT_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['property_test_result', 'fuzz_counterexample'], outputFormats: ['json', 'text'], installHint: 'brew install crytic/tap/echidna', commandHint: 'echidna . --config echidna.yaml --format json', parserStatus: 'planned', notes: 'Property-based fuzzing for local smart-contract harnesses.', }, { id: 'foundry-forge', binary: 'forge', name: 'Foundry Forge', category: 'smart_contract', families: SMART_CONTRACT_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['unit_test_result', 'fuzz_test_result', 'coverage_signal'], outputFormats: ['json', 'text'], installHint: 'Install Foundry with foundryup from https://book.getfoundry.sh/getting-started/installation', commandHint: 'forge test --json', parserStatus: 'planned', notes: 'Local EVM tests, invariant checks, and replay harnesses.', }, { id: 'foundry-cast', binary: 'cast', name: 'Foundry Cast', category: 'smart_contract', families: ['smart_contract', 'crypto_secrets', 'reporting_remediation'], risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['chain_query', 'transaction_dry_run', 'abi_decode'], outputFormats: ['json', 'text'], installHint: 'Install Foundry with foundryup from https://book.getfoundry.sh/getting-started/installation', commandHint: 'cast call --rpc-url scoped-rpc.example 0x0000000000000000000000000000000000000000 "symbol()(string)"', parserStatus: 'planned', notes: 'Chain interaction stays receipt-gated; prefer dry-run and read-only calls.', }, { id: 'solhint', binary: 'solhint', name: 'Solhint', category: 'smart_contract', families: SMART_CONTRACT_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['solidity_lint_finding'], outputFormats: ['json', 'stylish', 'text'], installHint: 'npm install -g solhint', commandHint: 'solhint "contracts/**/*.sol" --formatter json', parserStatus: 'planned', notes: 'Fast lint layer for Solidity hygiene before heavier analysis.', }, { id: 'openssl', binary: 'openssl', name: 'OpenSSL', category: 'crypto', families: CRYPTO_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['certificate_metadata', 'crypto_material_fingerprint'], outputFormats: ['text'], installHint: 'Usually preinstalled, or install via `brew install openssl@3`.', commandHint: 'openssl x509 -in certificate.pem -noout -text', parserStatus: 'text', notes: 'Local certificate, key, and crypto-material inspection. Do not log private key values.', }, { id: 'john', binary: 'john', name: 'John the Ripper', category: 'crypto', families: CRYPTO_FAMILIES, risk: 'credential', execution: 'receipt_required', networked: false, evidenceKinds: ['hash_audit_result', 'password_policy_signal'], outputFormats: ['text'], installHint: 'brew install john', commandHint: 'john --test', parserStatus: 'planned', notes: 'Local hash-strength auditing only; cracking runs require explicit mission receipts and redacted evidence.', }, { id: 'hashcat', binary: 'hashcat', name: 'Hashcat', category: 'crypto', families: CRYPTO_FAMILIES, risk: 'credential', execution: 'receipt_required', networked: false, evidenceKinds: ['hash_audit_result', 'gpu_cracking_benchmark'], outputFormats: ['text', 'json'], installHint: 'brew install hashcat', commandHint: 'hashcat --benchmark', parserStatus: 'planned', notes: 'Receipt-gated local hash auditing and benchmark evidence; never store recovered secrets.', }, { id: 'radamsa', binary: 'radamsa', name: 'Radamsa', category: 'fuzzing', families: ['reverse_binary', 'web_api', 'code_supply_chain', 'reporting_remediation'], risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['fuzz_case', 'mutation_seed'], outputFormats: ['binary', 'text'], installHint: 'brew install radamsa', commandHint: 'radamsa sample.txt -o fuzz-case.txt', parserStatus: 'planned', notes: 'Local mutation engine for controlled parser and protocol harnesses.', }, { id: 'afl-fuzz', binary: 'afl-fuzz', name: 'AFL++', category: 'fuzzing', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['crash_case', 'coverage_signal', 'fuzz_corpus'], outputFormats: ['directory', 'text'], installHint: 'brew install afl++', commandHint: 'afl-fuzz -i seeds -o findings -- ./target @@', parserStatus: 'planned', notes: 'Local binary fuzzing harness; production targets require a lab fixture.', }, { id: 'radare2', binary: 'r2', name: 'radare2', category: 'reverse', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['binary_analysis', 'function_graph', 'string_reference'], outputFormats: ['json', 'text'], installHint: 'brew install radare2', commandHint: 'r2 -q -c "iIj" artifact.bin', parserStatus: 'planned', notes: 'Scriptable local reverse-engineering adapter for artifacts and firmware.', }, { id: 'ghidra', binary: 'analyzeHeadless', name: 'Ghidra (headless)', category: 'reverse', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['decompiled_pseudocode', 'function_graph', 'binary_analysis'], outputFormats: ['text', 'xml'], installHint: 'brew install ghidra # provides analyzeHeadless', commandHint: 'analyzeHeadless tmp -import artifact.bin -postScript DecompileScript.java', parserStatus: 'planned', notes: 'Headless decompiler — static pseudocode reconstruction from an owned/lab binary. Read-only, no execution.', }, { id: 'objdump', binary: 'objdump', name: 'objdump', category: 'reverse', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['disassembly', 'symbol_table', 'section_headers'], outputFormats: ['text'], installHint: 'binutils (brew install binutils)', commandHint: 'objdump -d -M intel artifact.bin', parserStatus: 'text', notes: 'Static disassembly + section/symbol inspection of an owned binary. Read-only.', }, { id: 'gdb', binary: 'gdb', name: 'GDB', category: 'reverse', families: REVERSE_FAMILIES, risk: 'active', execution: 'receipt_required', networked: false, evidenceKinds: ['runtime_state', 'crash_analysis'], outputFormats: ['text'], installHint: 'brew install gdb', commandHint: 'gdb -batch -ex run -ex bt --args ./artifact (EXECUTES the target — owned/lab binary + approval)', parserStatus: 'text', notes: 'Debugger — runs/attaches to a target binary. Executes code, so gated: owned/lab binary + explicit approval.', }, { id: 'checksec', binary: 'checksec', name: 'checksec', category: 'reverse', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['binary_protections'], outputFormats: ['json', 'text'], installHint: 'brew install checksec', commandHint: 'checksec --file=./artifact', parserStatus: 'text', notes: 'Static triage of binary hardening (NX, PIE, stack canary, RELRO, Fortify). Read-only — the first RE step.', }, { id: 'strings', binary: 'strings', name: 'strings', category: 'reverse', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['string_reference'], outputFormats: ['text'], installHint: 'binutils (preinstalled on most systems)', commandHint: 'strings -n 6 artifact.bin', parserStatus: 'text', notes: 'Extract printable strings for triage (hardcoded creds, URLs, format specifiers). Read-only.', }, { id: 'readelf', binary: 'readelf', name: 'readelf', category: 'reverse', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['elf_headers', 'symbol_table'], outputFormats: ['text'], installHint: 'binutils (brew install binutils)', commandHint: 'readelf -a artifact.bin', parserStatus: 'text', notes: 'ELF header/section/symbol/dynamic inspection. Read-only, complements objdump.', }, { id: 'apktool', binary: 'apktool', name: 'Apktool', category: 'mobile', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['mobile_manifest', 'apk_resource_tree'], outputFormats: ['directory', 'text'], installHint: 'brew install apktool', commandHint: 'apktool d app.apk -o apk-out', parserStatus: 'planned', notes: 'Mobile app unpacking for owned APKs and lab samples.', }, { id: 'jadx', binary: 'jadx', name: 'JADX', category: 'mobile', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['decompiled_source', 'mobile_static_finding'], outputFormats: ['directory', 'text'], installHint: 'brew install jadx', commandHint: 'jadx --output-dir jadx-out app.apk', parserStatus: 'planned', notes: 'Android decompilation for scoped local APK review.', }, { id: 'apkleaks', binary: 'apkleaks', name: 'APKLeaks', category: 'mobile', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['mobile_secret', 'exposed_endpoint'], outputFormats: ['json', 'text'], installHint: 'pipx install apkleaks', commandHint: 'apkleaks -f app.apk -o out.json', parserStatus: 'planned', notes: 'Static scan of an APK for hardcoded secrets, URIs, and endpoints. Local read-only.', }, { id: 'mobsfscan', binary: 'mobsfscan', name: 'mobsfscan', category: 'mobile', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['mobile_static_finding', 'insecure_api_usage'], outputFormats: ['json', 'sarif'], installHint: 'pipx install mobsfscan', commandHint: 'mobsfscan --json ', parserStatus: 'planned', notes: 'Static analyzer for Android/iOS source + manifests (insecure API usage, weak crypto, hardcoded secrets). Local read-only. (The full MobSF framework is a separate server, not a PATH binary.)', }, { id: 'objection', binary: 'objection', name: 'Objection', category: 'mobile', families: REVERSE_FAMILIES, risk: 'intrusive', execution: 'receipt_required', networked: true, evidenceKinds: ['runtime_hook', 'mobile_dynamic_finding'], outputFormats: ['text'], installHint: 'pipx install objection', commandHint: 'objection -g explore (Frida-based runtime; needs an owned/rooted device + approval)', parserStatus: 'planned', notes: 'Runtime mobile exploration built on Frida (SSL-pinning/root-detection bypass, keychain dump). Requires an owned device + explicit approval.', }, { id: 'frida', binary: 'frida', name: 'Frida', category: 'mobile', families: REVERSE_FAMILIES, risk: 'dangerous', execution: 'catalog_only', networked: true, evidenceKinds: ['runtime_hook'], outputFormats: ['script_output'], installHint: 'pipx install frida-tools', commandHint: 'Catalog-only: runtime code injection into a live process; needs a per-script receipt + a device you own.', parserStatus: 'planned', notes: 'Dynamic instrumentation toolkit — injects into running processes. Do not expose through generic execution; needs explicit approval + an owned device — same gating as metasploit.', }, { id: 'drozer', binary: 'drozer', name: 'drozer', category: 'mobile', families: REVERSE_FAMILIES, risk: 'intrusive', execution: 'receipt_required', networked: true, evidenceKinds: ['mobile_attack_surface', 'ipc_exposure'], outputFormats: ['text'], installHint: 'pipx install drozer', commandHint: 'drozer console connect (probes exported IPC/content-providers; needs an owned device + agent + approval)', parserStatus: 'text', notes: 'Android attack-surface + IPC/content-provider testing via an on-device agent. Owned device + explicit approval.', }, { id: 'class-dump', binary: 'class-dump', name: 'class-dump', category: 'mobile', families: REVERSE_FAMILIES, risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['ios_class_headers', 'decompiled_source'], outputFormats: ['text'], installHint: 'brew install class-dump', commandHint: 'class-dump -H App.app/App -o headers/', parserStatus: 'text', notes: 'iOS static — dumps Objective-C class/method headers from a Mach-O binary for scoped review. Read-only.', }, { id: 'exiftool', binary: 'exiftool', name: 'ExifTool', category: 'forensics', families: ['code_supply_chain', 'reverse_binary', 'reporting_remediation'], risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['metadata'], outputFormats: ['json', 'text'], installHint: 'brew install exiftool', commandHint: 'exiftool -json artifact.bin', parserStatus: 'planned', notes: 'Metadata extraction for artifacts and reports.', }, { id: 'binwalk', binary: 'binwalk', name: 'Binwalk', category: 'reverse', families: ['reverse_binary', 'reporting_remediation'], risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['firmware_signature', 'embedded_file'], outputFormats: ['text'], installHint: 'brew install binwalk', commandHint: 'binwalk firmware.bin', parserStatus: 'text', notes: 'Firmware and embedded-file triage.', }, { id: 'metasploit', binary: 'msfconsole', name: 'Metasploit', category: 'post_exploitation', families: ['web_api', 'cloud_infra', 'reporting_remediation'], risk: 'dangerous', execution: 'catalog_only', networked: true, evidenceKinds: ['exploit_validation'], outputFormats: ['workspace_export'], installHint: 'brew install metasploit', commandHint: 'Catalog-only until a narrow module runner and receipt gate exist.', parserStatus: 'planned', notes: 'Do not expose through generic command execution; needs per-module adapters.', }, { id: 'hydra', binary: 'hydra', name: 'Hydra', category: 'credentials', families: ['web_api', 'cloud_infra', 'reporting_remediation'], risk: 'credential', execution: 'catalog_only', networked: true, evidenceKinds: ['auth_control_test'], outputFormats: ['text'], installHint: 'brew install hydra', commandHint: 'Catalog-only until account-lockout and written authorization gates exist.', parserStatus: 'planned', notes: 'Credential attack tooling should be modeled, not generically executable.', }, { id: 'bloodhound', binary: 'bloodhound', name: 'BloodHound', category: 'credentials', families: ['cloud_infra', 'reporting_remediation'], risk: 'credential', execution: 'import_only', networked: false, evidenceKinds: ['attack_path_graph'], outputFormats: ['json', 'graph'], installHint: 'Install BloodHound CE or compatible collectors.', commandHint: 'Import collector output; do not run collectors without AD scope receipts.', parserStatus: 'planned', notes: 'Useful as graph evidence once collector output is explicitly authorized.', }, { id: 'yara', binary: 'yara', name: 'YARA', category: 'forensics', families: ['reverse_binary', 'code_supply_chain', 'reporting_remediation'], risk: 'local_read', execution: 'safe_command', networked: false, evidenceKinds: ['artifact_signature'], outputFormats: ['text', 'json'], installHint: 'brew install yara', commandHint: 'yara rules.yar artifact.bin', parserStatus: 'planned', notes: 'Local artifact classification and malware-family matching.', }, { id: 'whatweb', binary: 'whatweb', name: 'WhatWeb', category: 'web', families: ['web_api', 'social_osint', 'reporting_remediation'], risk: 'active', execution: 'receipt_required', networked: true, evidenceKinds: ['technology_fingerprint', 'http_service'], outputFormats: ['json', 'text'], installHint: 'brew install whatweb # or: gem install whatweb', commandHint: 'whatweb --log-json=- https://example.com', parserStatus: 'text', notes: 'Web stack fingerprinting (CMS, framework, server) to seed targeted follow-up.', }, { id: 'wafw00f', binary: 'wafw00f', name: 'wafw00f', category: 'web', families: WEB_FAMILIES, risk: 'passive', execution: 'safe_command', networked: true, evidenceKinds: ['waf_fingerprint'], outputFormats: ['json', 'text'], installHint: 'pipx install wafw00f', commandHint: 'wafw00f https://example.com -f json -o -', parserStatus: 'text', notes: 'Detects and fingerprints the WAF in front of a target so probes can be tuned or throttled.', }, { id: 'amass', binary: 'amass', name: 'OWASP Amass', category: 'osint', families: ['web_api', 'cloud_infra', 'social_osint'], risk: 'passive', execution: 'receipt_required', networked: true, evidenceKinds: ['subdomain', 'asn', 'dns_record'], outputFormats: ['jsonl', 'text'], installHint: 'brew install amass', commandHint: 'amass enum -passive -d example.com', parserStatus: 'text', notes: 'Deep passive attack-surface mapping; complements subfinder with ASN and infra correlation.', }, { id: 'dnsx', binary: 'dnsx', name: 'dnsx', category: 'dns', families: ['web_api', 'cloud_infra', 'social_osint'], risk: 'passive', execution: 'safe_command', networked: true, evidenceKinds: ['dns_record', 'subdomain'], outputFormats: ['jsonl', 'text'], installHint: 'brew install projectdiscovery/tap/dnsx', commandHint: 'dnsx -d example.com -a -aaaa -cname -resp -json', parserStatus: 'text', notes: 'Fast DNS resolution/validation to confirm live records from discovered candidate hosts.', }, { id: 'testssl', binary: 'testssl.sh', name: 'testssl.sh', category: 'crypto', families: ['web_api', 'crypto_secrets', 'reporting_remediation'], risk: 'active', execution: 'safe_command', networked: true, evidenceKinds: ['tls_config', 'cipher_weakness', 'certificate_finding'], outputFormats: ['json', 'text'], installHint: 'brew install testssl', commandHint: 'testssl.sh --jsonfile-pretty - https://example.com:443', parserStatus: 'text', notes: 'TLS/SSL posture check (protocols, ciphers, cert, known CVEs) against an authorized endpoint.', }, { id: 'waybackurls', binary: 'waybackurls', name: 'waybackurls', category: 'osint', families: ['web_api', 'social_osint', 'reporting_remediation'], risk: 'passive', execution: 'safe_command', networked: true, evidenceKinds: ['historical_url', 'endpoint'], outputFormats: ['text'], installHint: 'go install github.com/tomnomnom/waybackurls@latest', commandHint: 'waybackurls example.com', parserStatus: 'text', notes: 'Pulls historical URLs from the Wayback Machine to surface forgotten endpoints and parameters.', }, ]; export const SAFE_COMMANDS = [ ...new Set( TOOL_ADAPTERS .filter(adapter => adapter.execution !== 'catalog_only' && adapter.execution !== 'import_only') .map(adapter => adapter.binary) ), ].sort(); export const NETWORK_COMMANDS = new Set( TOOL_ADAPTERS .filter(adapter => adapter.networked && adapter.execution !== 'catalog_only' && adapter.execution !== 'import_only') .map(adapter => adapter.binary) ); export function adaptersForFamily(family?: string): ToolAdapter[] { return family ? TOOL_ADAPTERS.filter(adapter => adapter.families.includes(family as MissionFamily)) : TOOL_ADAPTERS; } export function adapterForBinary(binary: string): ToolAdapter | undefined { return TOOL_ADAPTERS.find(adapter => adapter.binary === binary || adapter.id === binary); } export function summarizeToolCatalog(adapters = TOOL_ADAPTERS): Record { const commandReady = adapters.filter(adapter => adapter.execution === 'safe_command' || adapter.execution === 'receipt_required').length; const byExecution = adapters.reduce>((acc, adapter) => { acc[adapter.execution] = (acc[adapter.execution] || 0) + 1; return acc; }, {}); const byRisk = adapters.reduce>((acc, adapter) => { acc[adapter.risk] = (acc[adapter.risk] || 0) + 1; return acc; }, {}); const byCategory = adapters.reduce>((acc, adapter) => { acc[adapter.category] = (acc[adapter.category] || 0) + 1; return acc; }, {}); return { total: adapters.length, commandReady, catalogOnly: adapters.filter(adapter => adapter.execution === 'catalog_only').length, importOnly: adapters.filter(adapter => adapter.execution === 'import_only').length, unmodeled: adapters.length === 0 || commandReady === 0, byExecution, byRisk, byCategory, }; }