Mahdi Salmanzadeh Asl
de7ee804e6
Adds whatweb, wafw00f, amass, dnsx, testssl.sh, and waybackurls to the
arsenal catalog — all keyless, non-dangerous recon/OSINT tools that fill
live gaps in web fingerprinting, WAF detection, passive attack-surface
mapping, DNS validation, TLS posture, and historical-URL discovery.
Each adapter follows the CONTRIBUTING.md checklist and each gets an explicit
ARG_TEMPLATES entry in adapter-tools.ts, so:
- amass uses the required `enum -passive -d <target>` form (not a bare
positional), and dnsx passes the target via `-d` with resolve flags —
both fixing the broken default-positional invocation flagged in review.
- all six are accounted-for (templated), so they never land in the
arsenal-count-honesty guard's UNACCOUNTED set — no KNOWN_DEBT needed.
Scoped to the six adapters and their templates only. typecheck clean,
tests pass.
1276 lines
43 KiB
TypeScript
1276 lines
43 KiB
TypeScript
import type { MissionFamily } from '../resources/index.js';
|
|
|
|
export type ToolCategory =
|
|
| 'core'
|
|
| 'osint'
|
|
| 'dns'
|
|
| 'network'
|
|
| 'web'
|
|
| 'api'
|
|
| 'vulnerability'
|
|
| 'supply_chain'
|
|
| 'cloud'
|
|
| 'container'
|
|
| 'ai_agent'
|
|
| 'smart_contract'
|
|
| 'crypto'
|
|
| 'fuzzing'
|
|
| 'mobile'
|
|
| 'secrets'
|
|
| 'reverse'
|
|
| 'forensics'
|
|
| 'credentials'
|
|
| 'post_exploitation'
|
|
| 'reporting';
|
|
|
|
export type ToolRisk = 'local_read' | 'passive' | 'active' | 'intrusive' | 'credential' | 'dangerous';
|
|
export type ToolExecutionMode = 'safe_command' | 'receipt_required' | 'import_only' | 'catalog_only';
|
|
|
|
export interface ToolAdapter {
|
|
id: string;
|
|
binary: string;
|
|
name: string;
|
|
category: ToolCategory;
|
|
families: MissionFamily[];
|
|
risk: ToolRisk;
|
|
execution: ToolExecutionMode;
|
|
networked: boolean;
|
|
evidenceKinds: string[];
|
|
outputFormats: string[];
|
|
installHint: string;
|
|
commandHint: string;
|
|
parserStatus: 'structured' | 'text' | 'planned';
|
|
notes: string;
|
|
}
|
|
|
|
const WEB_FAMILIES: MissionFamily[] = ['web_api', 'reporting_remediation'];
|
|
const SUPPLY_FAMILIES: MissionFamily[] = ['code_supply_chain', 'reporting_remediation'];
|
|
const CLOUD_FAMILIES: MissionFamily[] = ['cloud_infra', 'reporting_remediation'];
|
|
const AI_FAMILIES: MissionFamily[] = ['ai_red_team', 'agent_warfare', 'reporting_remediation'];
|
|
const SMART_CONTRACT_FAMILIES: MissionFamily[] = ['smart_contract', 'crypto_secrets', 'code_supply_chain', 'reporting_remediation'];
|
|
const CRYPTO_FAMILIES: MissionFamily[] = ['crypto_secrets', 'code_supply_chain', 'reporting_remediation'];
|
|
const REVERSE_FAMILIES: MissionFamily[] = ['reverse_binary', 'code_supply_chain', 'reporting_remediation'];
|
|
|
|
export const FRONTIER_ARSENAL_MILESTONE = 104;
|
|
|
|
export const TOOL_ADAPTERS: ToolAdapter[] = [
|
|
{
|
|
id: 'file',
|
|
binary: 'file',
|
|
name: 'file',
|
|
category: 'core',
|
|
families: ['code_supply_chain', 'reverse_binary', 'reporting_remediation'],
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['artifact_fingerprint'],
|
|
outputFormats: ['text'],
|
|
installHint: 'Usually preinstalled on Unix-like systems.',
|
|
commandHint: 'file package.json',
|
|
parserStatus: 'text',
|
|
notes: 'Harmless local artifact identification used by smoke tests and ledgers.',
|
|
},
|
|
{
|
|
id: 'curl',
|
|
binary: 'curl',
|
|
name: 'curl',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['http_request', 'http_response', 'header_probe'],
|
|
outputFormats: ['text', 'headers'],
|
|
installHint: 'Usually preinstalled on macOS and Linux.',
|
|
commandHint: 'curl -I https://example.com',
|
|
parserStatus: 'text',
|
|
notes: 'General HTTP probe. External targets require ScopeGuard receipts.',
|
|
},
|
|
{
|
|
id: 'dig',
|
|
binary: 'dig',
|
|
name: 'dig',
|
|
category: 'dns',
|
|
families: ['web_api', 'cloud_infra', 'social_osint', 'reporting_remediation'],
|
|
risk: 'passive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['dns_record'],
|
|
outputFormats: ['text'],
|
|
installHint: 'Install bind utilities, e.g. `brew install bind` or OS package equivalent.',
|
|
commandHint: 'dig +short example.com',
|
|
parserStatus: 'text',
|
|
notes: 'DNS record collection for scoped targets.',
|
|
},
|
|
{
|
|
id: 'host',
|
|
binary: 'host',
|
|
name: 'host',
|
|
category: 'dns',
|
|
families: ['web_api', 'cloud_infra', 'social_osint'],
|
|
risk: 'passive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['dns_record'],
|
|
outputFormats: ['text'],
|
|
installHint: 'Install bind utilities, e.g. `brew install bind` or OS package equivalent.',
|
|
commandHint: 'host example.com',
|
|
parserStatus: 'text',
|
|
notes: 'Simple DNS lookup companion to dig.',
|
|
},
|
|
{
|
|
id: 'whois',
|
|
binary: 'whois',
|
|
name: 'whois',
|
|
category: 'osint',
|
|
families: ['web_api', 'cloud_infra', 'social_osint'],
|
|
risk: 'passive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['registration_record'],
|
|
outputFormats: ['text'],
|
|
installHint: 'Usually preinstalled, or install via OS package manager.',
|
|
commandHint: 'whois example.com',
|
|
parserStatus: 'text',
|
|
notes: 'Passive registration context for scoped assets.',
|
|
},
|
|
{
|
|
id: 'nmap',
|
|
binary: 'nmap',
|
|
name: 'Nmap',
|
|
category: 'network',
|
|
families: ['web_api', 'cloud_infra', 'reporting_remediation'],
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['open_port', 'service_fingerprint'],
|
|
outputFormats: ['text', 'xml'],
|
|
installHint: 'brew install nmap',
|
|
commandHint: 'nmap -sV --top-ports 100 --open 127.0.0.1',
|
|
parserStatus: 'text',
|
|
notes: 'Primary scoped port and service discovery engine.',
|
|
},
|
|
{
|
|
id: 'subfinder',
|
|
binary: 'subfinder',
|
|
name: 'Subfinder',
|
|
category: 'osint',
|
|
families: ['web_api', 'cloud_infra', 'social_osint'],
|
|
risk: 'passive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['subdomain'],
|
|
outputFormats: ['text', 'jsonl'],
|
|
installHint: 'brew install projectdiscovery/tap/subfinder',
|
|
commandHint: 'subfinder -d example.com -silent',
|
|
parserStatus: 'planned',
|
|
notes: 'High-value passive asset discovery adapter.',
|
|
},
|
|
{
|
|
id: 'httpx',
|
|
binary: 'httpx',
|
|
name: 'httpx',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['http_service', 'technology_fingerprint'],
|
|
outputFormats: ['jsonl', 'text'],
|
|
installHint: 'brew install projectdiscovery/tap/httpx',
|
|
commandHint: 'httpx -u https://example.com -status-code -title -tech-detect -json',
|
|
parserStatus: 'planned',
|
|
notes: 'HTTP probing and technology detection for discovered assets.',
|
|
},
|
|
{
|
|
id: 'naabu',
|
|
binary: 'naabu',
|
|
name: 'Naabu',
|
|
category: 'network',
|
|
families: ['web_api', 'cloud_infra'],
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['open_port'],
|
|
outputFormats: ['jsonl', 'text'],
|
|
installHint: 'brew install projectdiscovery/tap/naabu',
|
|
commandHint: 'naabu -host 127.0.0.1 -top-ports 100',
|
|
parserStatus: 'planned',
|
|
notes: 'Fast scoped port discovery; pair with nmap for service verification.',
|
|
},
|
|
{
|
|
id: 'katana',
|
|
binary: 'katana',
|
|
name: 'Katana',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['endpoint', 'crawl_result'],
|
|
outputFormats: ['jsonl', 'text'],
|
|
installHint: 'brew install projectdiscovery/tap/katana',
|
|
commandHint: 'katana -u https://example.com -jsonl -silent',
|
|
parserStatus: 'planned',
|
|
notes: 'Crawler for endpoint discovery and attack-surface mapping.',
|
|
},
|
|
{
|
|
id: 'nuclei',
|
|
binary: 'nuclei',
|
|
name: 'Nuclei',
|
|
category: 'vulnerability',
|
|
families: ['web_api', 'cloud_infra', 'code_supply_chain', 'reporting_remediation'],
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['scanner_finding', 'template_match'],
|
|
outputFormats: ['jsonl'],
|
|
installHint: 'brew install projectdiscovery/tap/nuclei',
|
|
commandHint: 'nuclei -u https://example.com -severity medium,high,critical -jsonl',
|
|
parserStatus: 'structured',
|
|
notes: 'Template-driven scanner; findings should flow into validation and retest.',
|
|
},
|
|
{
|
|
id: 'ffuf',
|
|
binary: 'ffuf',
|
|
name: 'FFUF',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['content_discovery'],
|
|
outputFormats: ['json'],
|
|
installHint: 'brew install ffuf',
|
|
commandHint: 'ffuf -u https://example.com/FUZZ -w wordlist.txt -of json',
|
|
parserStatus: 'structured',
|
|
notes: 'Content and parameter discovery. Rate-limit on real targets.',
|
|
},
|
|
{
|
|
id: 'gobuster',
|
|
binary: 'gobuster',
|
|
name: 'Gobuster',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['content_discovery', 'dns_bruteforce'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install gobuster',
|
|
commandHint: 'gobuster dir -u https://example.com -w wordlist.txt',
|
|
parserStatus: 'text',
|
|
notes: 'Directory and DNS brute-force companion to ffuf.',
|
|
},
|
|
{
|
|
id: 'feroxbuster',
|
|
binary: 'feroxbuster',
|
|
name: 'Feroxbuster',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['content_discovery'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install feroxbuster',
|
|
commandHint: 'feroxbuster -u https://example.com --json',
|
|
parserStatus: 'planned',
|
|
notes: 'Recursive content discovery; useful when ffuf finds nested paths.',
|
|
},
|
|
{
|
|
id: 'nikto',
|
|
binary: 'nikto',
|
|
name: 'Nikto',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['scanner_finding'],
|
|
outputFormats: ['text', 'json'],
|
|
installHint: 'brew install nikto',
|
|
commandHint: 'nikto -h https://example.com',
|
|
parserStatus: 'text',
|
|
notes: 'Legacy web server checks; validate findings before reporting.',
|
|
},
|
|
{
|
|
id: 'dalfox',
|
|
binary: 'dalfox',
|
|
name: 'Dalfox',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['xss_probe', 'scanner_finding'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install dalfox',
|
|
commandHint: 'dalfox url https://example.com?q=test -o result.json --format json',
|
|
parserStatus: 'planned',
|
|
notes: 'XSS validation adapter for scoped endpoints.',
|
|
},
|
|
{
|
|
id: 'sqlmap',
|
|
binary: 'sqlmap',
|
|
name: 'SQLMap',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'intrusive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['sqli_validation'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install sqlmap',
|
|
commandHint: 'sqlmap -u "https://example.com/item?id=1" --batch --level=1 --risk=1',
|
|
parserStatus: 'text',
|
|
notes: 'Keep level/risk low unless the mission receipt explicitly permits intrusive testing.',
|
|
},
|
|
{
|
|
id: 'semgrep',
|
|
binary: 'semgrep',
|
|
name: 'Semgrep',
|
|
category: 'supply_chain',
|
|
families: SUPPLY_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['static_analysis_finding', 'sarif'],
|
|
outputFormats: ['json', 'sarif'],
|
|
installHint: 'brew install semgrep or pipx install semgrep',
|
|
commandHint: 'semgrep scan --config auto --json .',
|
|
parserStatus: 'planned',
|
|
notes: 'Static analysis backbone for repository hardening.',
|
|
},
|
|
{
|
|
id: 'gitleaks',
|
|
binary: 'gitleaks',
|
|
name: 'Gitleaks',
|
|
category: 'secrets',
|
|
families: SUPPLY_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['secret_finding'],
|
|
outputFormats: ['json', 'sarif'],
|
|
installHint: 'brew install gitleaks',
|
|
commandHint: 'gitleaks detect --source . --report-format json --redact',
|
|
parserStatus: 'planned',
|
|
notes: 'Secret detection must redact values before ledger insertion.',
|
|
},
|
|
{
|
|
id: 'trufflehog',
|
|
binary: 'trufflehog',
|
|
name: 'TruffleHog',
|
|
category: 'secrets',
|
|
families: SUPPLY_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['secret_finding'],
|
|
outputFormats: ['json'],
|
|
installHint: 'brew install trufflehog',
|
|
commandHint: 'trufflehog filesystem . --json --no-update',
|
|
parserStatus: 'planned',
|
|
notes: 'Deep secret scanner. Keep verification/network modes explicit.',
|
|
},
|
|
{
|
|
id: 'trivy',
|
|
binary: 'trivy',
|
|
name: 'Trivy',
|
|
category: 'container',
|
|
families: ['code_supply_chain', 'cloud_infra', 'reporting_remediation'],
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['dependency_vulnerability', 'container_vulnerability', 'iac_misconfig'],
|
|
outputFormats: ['json', 'sarif'],
|
|
installHint: 'brew install aquasecurity/trivy/trivy',
|
|
commandHint: 'trivy fs --format json .',
|
|
parserStatus: 'planned',
|
|
notes: 'Vulnerability and IaC scanner for repos and images.',
|
|
},
|
|
{
|
|
id: 'syft',
|
|
binary: 'syft',
|
|
name: 'Syft',
|
|
category: 'supply_chain',
|
|
families: SUPPLY_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['sbom'],
|
|
outputFormats: ['spdx-json', 'cyclonedx-json'],
|
|
installHint: 'brew install syft',
|
|
commandHint: 'syft dir:. -o cyclonedx-json',
|
|
parserStatus: 'planned',
|
|
notes: 'SBOM generator feeding vulnerability and provenance workflows.',
|
|
},
|
|
{
|
|
id: 'grype',
|
|
binary: 'grype',
|
|
name: 'Grype',
|
|
category: 'supply_chain',
|
|
families: SUPPLY_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['dependency_vulnerability'],
|
|
outputFormats: ['json'],
|
|
installHint: 'brew install grype',
|
|
commandHint: 'grype dir:. -o json',
|
|
parserStatus: 'planned',
|
|
notes: 'Pairs well with Syft SBOMs for dependency vulnerability triage.',
|
|
},
|
|
{
|
|
id: 'osv-scanner',
|
|
binary: 'osv-scanner',
|
|
name: 'OSV Scanner',
|
|
category: 'supply_chain',
|
|
families: SUPPLY_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: true,
|
|
evidenceKinds: ['dependency_vulnerability'],
|
|
outputFormats: ['json'],
|
|
installHint: 'brew install osv-scanner',
|
|
commandHint: 'osv-scanner --format json --recursive .',
|
|
parserStatus: 'planned',
|
|
notes: 'Uses OSV vulnerability data; note network dependency in evidence.',
|
|
},
|
|
{
|
|
id: 'checkov',
|
|
binary: 'checkov',
|
|
name: 'Checkov',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['iac_misconfig'],
|
|
outputFormats: ['json', 'sarif'],
|
|
installHint: 'brew install checkov or pipx install checkov',
|
|
commandHint: 'checkov -d . -o json',
|
|
parserStatus: 'planned',
|
|
notes: 'IaC policy scanner for Terraform, Kubernetes, and cloud templates.',
|
|
},
|
|
{
|
|
id: 'prowler',
|
|
binary: 'prowler',
|
|
name: 'Prowler',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['cloud_control_finding'],
|
|
outputFormats: ['json', 'csv'],
|
|
installHint: 'pipx install prowler',
|
|
commandHint: 'prowler aws --output-formats json',
|
|
parserStatus: 'planned',
|
|
notes: 'Cloud account assessment requires explicit account scope and credentials handling.',
|
|
},
|
|
{
|
|
id: 'scoutsuite',
|
|
binary: 'scout',
|
|
name: 'ScoutSuite',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['cloud_control_finding', 'iam_misconfig'],
|
|
outputFormats: ['json', 'html'],
|
|
installHint: 'pipx install scoutsuite',
|
|
commandHint: 'scout aws --report-dir ./scout (read-only posture; needs account creds + explicit scope)',
|
|
parserStatus: 'planned',
|
|
notes: 'Multi-cloud (AWS/Azure/GCP) posture assessment; read-only API reads under authorized credentials + account scope.',
|
|
},
|
|
{
|
|
id: 'cloudfox',
|
|
binary: 'cloudfox',
|
|
name: 'CloudFox',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['cloud_attack_path', 'iam_misconfig'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install cloudfox',
|
|
commandHint: 'cloudfox aws all-checks (enumerates exploitable paths; needs creds + scope)',
|
|
parserStatus: 'planned',
|
|
notes: 'Offensive cloud enumeration — surfaces IAM/privesc/attack paths across AWS/Azure/GCP via read-only API calls under authorized credentials.',
|
|
},
|
|
{
|
|
id: 'pmapper',
|
|
binary: 'pmapper',
|
|
name: 'PMapper',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['iam_privesc_path'],
|
|
outputFormats: ['json', 'dot'],
|
|
installHint: 'pipx install principalmapper',
|
|
commandHint: 'pmapper graph create && pmapper query "preset privesc *" (read-only IAM introspection; needs AWS creds + scope)',
|
|
parserStatus: 'planned',
|
|
notes: 'Maps AWS IAM privilege-escalation paths from read-only IAM introspection under authorized credentials.',
|
|
},
|
|
{
|
|
id: 'pacu',
|
|
binary: 'pacu',
|
|
name: 'Pacu',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'dangerous',
|
|
execution: 'catalog_only',
|
|
networked: true,
|
|
evidenceKinds: ['exploit_validation'],
|
|
outputFormats: ['session_export'],
|
|
installHint: 'pipx install pacu',
|
|
commandHint: 'Catalog-only until a narrow per-module runner and receipt gate exist.',
|
|
parserStatus: 'planned',
|
|
notes: 'AWS exploitation framework (privesc, persistence, exfil). Do not expose through generic command execution; needs per-module adapters + explicit approval — same gating as metasploit.',
|
|
},
|
|
{
|
|
id: 'aws-cli',
|
|
binary: 'aws',
|
|
name: 'AWS CLI',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['cloud_enumeration', 'iam_state', 'resource_inventory'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install awscli',
|
|
commandHint: 'aws sts get-caller-identity / aws iam list-users / aws s3 ls (read enum; needs creds + scope)',
|
|
parserStatus: 'planned',
|
|
notes: 'Base AWS enumeration primitive. Read-only list/describe API calls under authorized credentials + account scope.',
|
|
},
|
|
{
|
|
id: 'az-cli',
|
|
binary: 'az',
|
|
name: 'Azure CLI',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['cloud_enumeration', 'iam_state'],
|
|
outputFormats: ['json'],
|
|
installHint: 'brew install azure-cli',
|
|
commandHint: 'az account show / az role assignment list / az storage account list (read enum; needs creds + scope)',
|
|
parserStatus: 'planned',
|
|
notes: 'Base Azure enumeration primitive. Read-only under authorized credentials + subscription scope.',
|
|
},
|
|
{
|
|
id: 'gcloud-cli',
|
|
binary: 'gcloud',
|
|
name: 'gcloud CLI',
|
|
category: 'cloud',
|
|
families: CLOUD_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['cloud_enumeration', 'iam_state'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install --cask google-cloud-sdk',
|
|
commandHint: 'gcloud projects list / gcloud iam roles list / gcloud storage ls (read enum; needs auth + scope)',
|
|
parserStatus: 'planned',
|
|
notes: 'Base GCP enumeration primitive. Read-only under authorized credentials + project scope.',
|
|
},
|
|
{
|
|
id: 'garak',
|
|
binary: 'garak',
|
|
name: 'Garak',
|
|
category: 'ai_agent',
|
|
families: AI_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['model_probe', 'prompt_test_result'],
|
|
outputFormats: ['jsonl', 'report'],
|
|
installHint: 'pipx install garak',
|
|
commandHint: 'garak --model_type rest --model_name scoped-model',
|
|
parserStatus: 'planned',
|
|
notes: 'Model/agent probing must use scoped models and redacted transcripts.',
|
|
},
|
|
{
|
|
id: 'promptfoo',
|
|
binary: 'promptfoo',
|
|
name: 'promptfoo',
|
|
category: 'ai_agent',
|
|
families: AI_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['prompt_eval', 'regression_result'],
|
|
outputFormats: ['json', 'junit'],
|
|
installHint: 'npm install -g promptfoo',
|
|
commandHint: 'promptfoo eval --output results.json',
|
|
parserStatus: 'planned',
|
|
notes: 'Best fit for repeatable prompt/tool/memory regression packs.',
|
|
},
|
|
{
|
|
id: 'slither',
|
|
binary: 'slither',
|
|
name: 'Slither',
|
|
category: 'smart_contract',
|
|
families: SMART_CONTRACT_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['smart_contract_static_finding', 'solidity_call_graph'],
|
|
outputFormats: ['json', 'sarif', 'text'],
|
|
installHint: 'pipx install slither-analyzer',
|
|
commandHint: 'slither . --json slither-report.json',
|
|
parserStatus: 'planned',
|
|
notes: 'Static-analysis backbone for Solidity and EVM contract review.',
|
|
},
|
|
{
|
|
id: 'mythril',
|
|
binary: 'myth',
|
|
name: 'Mythril',
|
|
category: 'smart_contract',
|
|
families: SMART_CONTRACT_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['symbolic_execution_finding', 'smart_contract_trace'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'pipx install mythril',
|
|
commandHint: 'myth analyze contracts/Target.sol -o json',
|
|
parserStatus: 'planned',
|
|
notes: 'Symbolic execution for scoped local contract artifacts.',
|
|
},
|
|
{
|
|
id: 'echidna',
|
|
binary: 'echidna',
|
|
name: 'Echidna',
|
|
category: 'smart_contract',
|
|
families: SMART_CONTRACT_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['property_test_result', 'fuzz_counterexample'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install crytic/tap/echidna',
|
|
commandHint: 'echidna . --config echidna.yaml --format json',
|
|
parserStatus: 'planned',
|
|
notes: 'Property-based fuzzing for local smart-contract harnesses.',
|
|
},
|
|
{
|
|
id: 'foundry-forge',
|
|
binary: 'forge',
|
|
name: 'Foundry Forge',
|
|
category: 'smart_contract',
|
|
families: SMART_CONTRACT_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['unit_test_result', 'fuzz_test_result', 'coverage_signal'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'Install Foundry with foundryup from https://book.getfoundry.sh/getting-started/installation',
|
|
commandHint: 'forge test --json',
|
|
parserStatus: 'planned',
|
|
notes: 'Local EVM tests, invariant checks, and replay harnesses.',
|
|
},
|
|
{
|
|
id: 'foundry-cast',
|
|
binary: 'cast',
|
|
name: 'Foundry Cast',
|
|
category: 'smart_contract',
|
|
families: ['smart_contract', 'crypto_secrets', 'reporting_remediation'],
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['chain_query', 'transaction_dry_run', 'abi_decode'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'Install Foundry with foundryup from https://book.getfoundry.sh/getting-started/installation',
|
|
commandHint: 'cast call --rpc-url scoped-rpc.example 0x0000000000000000000000000000000000000000 "symbol()(string)"',
|
|
parserStatus: 'planned',
|
|
notes: 'Chain interaction stays receipt-gated; prefer dry-run and read-only calls.',
|
|
},
|
|
{
|
|
id: 'solhint',
|
|
binary: 'solhint',
|
|
name: 'Solhint',
|
|
category: 'smart_contract',
|
|
families: SMART_CONTRACT_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['solidity_lint_finding'],
|
|
outputFormats: ['json', 'stylish', 'text'],
|
|
installHint: 'npm install -g solhint',
|
|
commandHint: 'solhint "contracts/**/*.sol" --formatter json',
|
|
parserStatus: 'planned',
|
|
notes: 'Fast lint layer for Solidity hygiene before heavier analysis.',
|
|
},
|
|
{
|
|
id: 'openssl',
|
|
binary: 'openssl',
|
|
name: 'OpenSSL',
|
|
category: 'crypto',
|
|
families: CRYPTO_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['certificate_metadata', 'crypto_material_fingerprint'],
|
|
outputFormats: ['text'],
|
|
installHint: 'Usually preinstalled, or install via `brew install openssl@3`.',
|
|
commandHint: 'openssl x509 -in certificate.pem -noout -text',
|
|
parserStatus: 'text',
|
|
notes: 'Local certificate, key, and crypto-material inspection. Do not log private key values.',
|
|
},
|
|
{
|
|
id: 'john',
|
|
binary: 'john',
|
|
name: 'John the Ripper',
|
|
category: 'crypto',
|
|
families: CRYPTO_FAMILIES,
|
|
risk: 'credential',
|
|
execution: 'receipt_required',
|
|
networked: false,
|
|
evidenceKinds: ['hash_audit_result', 'password_policy_signal'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install john',
|
|
commandHint: 'john --test',
|
|
parserStatus: 'planned',
|
|
notes: 'Local hash-strength auditing only; cracking runs require explicit mission receipts and redacted evidence.',
|
|
},
|
|
{
|
|
id: 'hashcat',
|
|
binary: 'hashcat',
|
|
name: 'Hashcat',
|
|
category: 'crypto',
|
|
families: CRYPTO_FAMILIES,
|
|
risk: 'credential',
|
|
execution: 'receipt_required',
|
|
networked: false,
|
|
evidenceKinds: ['hash_audit_result', 'gpu_cracking_benchmark'],
|
|
outputFormats: ['text', 'json'],
|
|
installHint: 'brew install hashcat',
|
|
commandHint: 'hashcat --benchmark',
|
|
parserStatus: 'planned',
|
|
notes: 'Receipt-gated local hash auditing and benchmark evidence; never store recovered secrets.',
|
|
},
|
|
{
|
|
id: 'radamsa',
|
|
binary: 'radamsa',
|
|
name: 'Radamsa',
|
|
category: 'fuzzing',
|
|
families: ['reverse_binary', 'web_api', 'code_supply_chain', 'reporting_remediation'],
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['fuzz_case', 'mutation_seed'],
|
|
outputFormats: ['binary', 'text'],
|
|
installHint: 'brew install radamsa',
|
|
commandHint: 'radamsa sample.txt -o fuzz-case.txt',
|
|
parserStatus: 'planned',
|
|
notes: 'Local mutation engine for controlled parser and protocol harnesses.',
|
|
},
|
|
{
|
|
id: 'afl-fuzz',
|
|
binary: 'afl-fuzz',
|
|
name: 'AFL++',
|
|
category: 'fuzzing',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['crash_case', 'coverage_signal', 'fuzz_corpus'],
|
|
outputFormats: ['directory', 'text'],
|
|
installHint: 'brew install afl++',
|
|
commandHint: 'afl-fuzz -i seeds -o findings -- ./target @@',
|
|
parserStatus: 'planned',
|
|
notes: 'Local binary fuzzing harness; production targets require a lab fixture.',
|
|
},
|
|
{
|
|
id: 'radare2',
|
|
binary: 'r2',
|
|
name: 'radare2',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['binary_analysis', 'function_graph', 'string_reference'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install radare2',
|
|
commandHint: 'r2 -q -c "iIj" artifact.bin',
|
|
parserStatus: 'planned',
|
|
notes: 'Scriptable local reverse-engineering adapter for artifacts and firmware.',
|
|
},
|
|
{
|
|
id: 'ghidra',
|
|
binary: 'analyzeHeadless',
|
|
name: 'Ghidra (headless)',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['decompiled_pseudocode', 'function_graph', 'binary_analysis'],
|
|
outputFormats: ['text', 'xml'],
|
|
installHint: 'brew install ghidra # provides analyzeHeadless',
|
|
commandHint: 'analyzeHeadless <proj> tmp -import artifact.bin -postScript DecompileScript.java',
|
|
parserStatus: 'planned',
|
|
notes: 'Headless decompiler — static pseudocode reconstruction from an owned/lab binary. Read-only, no execution.',
|
|
},
|
|
{
|
|
id: 'objdump',
|
|
binary: 'objdump',
|
|
name: 'objdump',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['disassembly', 'symbol_table', 'section_headers'],
|
|
outputFormats: ['text'],
|
|
installHint: 'binutils (brew install binutils)',
|
|
commandHint: 'objdump -d -M intel artifact.bin',
|
|
parserStatus: 'text',
|
|
notes: 'Static disassembly + section/symbol inspection of an owned binary. Read-only.',
|
|
},
|
|
{
|
|
id: 'gdb',
|
|
binary: 'gdb',
|
|
name: 'GDB',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: false,
|
|
evidenceKinds: ['runtime_state', 'crash_analysis'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install gdb',
|
|
commandHint: 'gdb -batch -ex run -ex bt --args ./artifact (EXECUTES the target — owned/lab binary + approval)',
|
|
parserStatus: 'text',
|
|
notes: 'Debugger — runs/attaches to a target binary. Executes code, so gated: owned/lab binary + explicit approval.',
|
|
},
|
|
{
|
|
id: 'checksec',
|
|
binary: 'checksec',
|
|
name: 'checksec',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['binary_protections'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install checksec',
|
|
commandHint: 'checksec --file=./artifact',
|
|
parserStatus: 'text',
|
|
notes: 'Static triage of binary hardening (NX, PIE, stack canary, RELRO, Fortify). Read-only — the first RE step.',
|
|
},
|
|
{
|
|
id: 'strings',
|
|
binary: 'strings',
|
|
name: 'strings',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['string_reference'],
|
|
outputFormats: ['text'],
|
|
installHint: 'binutils (preinstalled on most systems)',
|
|
commandHint: 'strings -n 6 artifact.bin',
|
|
parserStatus: 'text',
|
|
notes: 'Extract printable strings for triage (hardcoded creds, URLs, format specifiers). Read-only.',
|
|
},
|
|
{
|
|
id: 'readelf',
|
|
binary: 'readelf',
|
|
name: 'readelf',
|
|
category: 'reverse',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['elf_headers', 'symbol_table'],
|
|
outputFormats: ['text'],
|
|
installHint: 'binutils (brew install binutils)',
|
|
commandHint: 'readelf -a artifact.bin',
|
|
parserStatus: 'text',
|
|
notes: 'ELF header/section/symbol/dynamic inspection. Read-only, complements objdump.',
|
|
},
|
|
{
|
|
id: 'apktool',
|
|
binary: 'apktool',
|
|
name: 'Apktool',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['mobile_manifest', 'apk_resource_tree'],
|
|
outputFormats: ['directory', 'text'],
|
|
installHint: 'brew install apktool',
|
|
commandHint: 'apktool d app.apk -o apk-out',
|
|
parserStatus: 'planned',
|
|
notes: 'Mobile app unpacking for owned APKs and lab samples.',
|
|
},
|
|
{
|
|
id: 'jadx',
|
|
binary: 'jadx',
|
|
name: 'JADX',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['decompiled_source', 'mobile_static_finding'],
|
|
outputFormats: ['directory', 'text'],
|
|
installHint: 'brew install jadx',
|
|
commandHint: 'jadx --output-dir jadx-out app.apk',
|
|
parserStatus: 'planned',
|
|
notes: 'Android decompilation for scoped local APK review.',
|
|
},
|
|
{
|
|
id: 'apkleaks',
|
|
binary: 'apkleaks',
|
|
name: 'APKLeaks',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['mobile_secret', 'exposed_endpoint'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'pipx install apkleaks',
|
|
commandHint: 'apkleaks -f app.apk -o out.json',
|
|
parserStatus: 'planned',
|
|
notes: 'Static scan of an APK for hardcoded secrets, URIs, and endpoints. Local read-only.',
|
|
},
|
|
{
|
|
id: 'mobsfscan',
|
|
binary: 'mobsfscan',
|
|
name: 'mobsfscan',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['mobile_static_finding', 'insecure_api_usage'],
|
|
outputFormats: ['json', 'sarif'],
|
|
installHint: 'pipx install mobsfscan',
|
|
commandHint: 'mobsfscan --json <app-source-or-decompiled-dir>',
|
|
parserStatus: 'planned',
|
|
notes: 'Static analyzer for Android/iOS source + manifests (insecure API usage, weak crypto, hardcoded secrets). Local read-only. (The full MobSF framework is a separate server, not a PATH binary.)',
|
|
},
|
|
{
|
|
id: 'objection',
|
|
binary: 'objection',
|
|
name: 'Objection',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'intrusive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['runtime_hook', 'mobile_dynamic_finding'],
|
|
outputFormats: ['text'],
|
|
installHint: 'pipx install objection',
|
|
commandHint: 'objection -g <app> explore (Frida-based runtime; needs an owned/rooted device + approval)',
|
|
parserStatus: 'planned',
|
|
notes: 'Runtime mobile exploration built on Frida (SSL-pinning/root-detection bypass, keychain dump). Requires an owned device + explicit approval.',
|
|
},
|
|
{
|
|
id: 'frida',
|
|
binary: 'frida',
|
|
name: 'Frida',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'dangerous',
|
|
execution: 'catalog_only',
|
|
networked: true,
|
|
evidenceKinds: ['runtime_hook'],
|
|
outputFormats: ['script_output'],
|
|
installHint: 'pipx install frida-tools',
|
|
commandHint: 'Catalog-only: runtime code injection into a live process; needs a per-script receipt + a device you own.',
|
|
parserStatus: 'planned',
|
|
notes: 'Dynamic instrumentation toolkit — injects into running processes. Do not expose through generic execution; needs explicit approval + an owned device — same gating as metasploit.',
|
|
},
|
|
{
|
|
id: 'drozer',
|
|
binary: 'drozer',
|
|
name: 'drozer',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'intrusive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['mobile_attack_surface', 'ipc_exposure'],
|
|
outputFormats: ['text'],
|
|
installHint: 'pipx install drozer',
|
|
commandHint: 'drozer console connect (probes exported IPC/content-providers; needs an owned device + agent + approval)',
|
|
parserStatus: 'text',
|
|
notes: 'Android attack-surface + IPC/content-provider testing via an on-device agent. Owned device + explicit approval.',
|
|
},
|
|
{
|
|
id: 'class-dump',
|
|
binary: 'class-dump',
|
|
name: 'class-dump',
|
|
category: 'mobile',
|
|
families: REVERSE_FAMILIES,
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['ios_class_headers', 'decompiled_source'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install class-dump',
|
|
commandHint: 'class-dump -H App.app/App -o headers/',
|
|
parserStatus: 'text',
|
|
notes: 'iOS static — dumps Objective-C class/method headers from a Mach-O binary for scoped review. Read-only.',
|
|
},
|
|
{
|
|
id: 'exiftool',
|
|
binary: 'exiftool',
|
|
name: 'ExifTool',
|
|
category: 'forensics',
|
|
families: ['code_supply_chain', 'reverse_binary', 'reporting_remediation'],
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['metadata'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install exiftool',
|
|
commandHint: 'exiftool -json artifact.bin',
|
|
parserStatus: 'planned',
|
|
notes: 'Metadata extraction for artifacts and reports.',
|
|
},
|
|
{
|
|
id: 'binwalk',
|
|
binary: 'binwalk',
|
|
name: 'Binwalk',
|
|
category: 'reverse',
|
|
families: ['reverse_binary', 'reporting_remediation'],
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['firmware_signature', 'embedded_file'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install binwalk',
|
|
commandHint: 'binwalk firmware.bin',
|
|
parserStatus: 'text',
|
|
notes: 'Firmware and embedded-file triage.',
|
|
},
|
|
{
|
|
id: 'metasploit',
|
|
binary: 'msfconsole',
|
|
name: 'Metasploit',
|
|
category: 'post_exploitation',
|
|
families: ['web_api', 'cloud_infra', 'reporting_remediation'],
|
|
risk: 'dangerous',
|
|
execution: 'catalog_only',
|
|
networked: true,
|
|
evidenceKinds: ['exploit_validation'],
|
|
outputFormats: ['workspace_export'],
|
|
installHint: 'brew install metasploit',
|
|
commandHint: 'Catalog-only until a narrow module runner and receipt gate exist.',
|
|
parserStatus: 'planned',
|
|
notes: 'Do not expose through generic command execution; needs per-module adapters.',
|
|
},
|
|
{
|
|
id: 'hydra',
|
|
binary: 'hydra',
|
|
name: 'Hydra',
|
|
category: 'credentials',
|
|
families: ['web_api', 'cloud_infra', 'reporting_remediation'],
|
|
risk: 'credential',
|
|
execution: 'catalog_only',
|
|
networked: true,
|
|
evidenceKinds: ['auth_control_test'],
|
|
outputFormats: ['text'],
|
|
installHint: 'brew install hydra',
|
|
commandHint: 'Catalog-only until account-lockout and written authorization gates exist.',
|
|
parserStatus: 'planned',
|
|
notes: 'Credential attack tooling should be modeled, not generically executable.',
|
|
},
|
|
{
|
|
id: 'bloodhound',
|
|
binary: 'bloodhound',
|
|
name: 'BloodHound',
|
|
category: 'credentials',
|
|
families: ['cloud_infra', 'reporting_remediation'],
|
|
risk: 'credential',
|
|
execution: 'import_only',
|
|
networked: false,
|
|
evidenceKinds: ['attack_path_graph'],
|
|
outputFormats: ['json', 'graph'],
|
|
installHint: 'Install BloodHound CE or compatible collectors.',
|
|
commandHint: 'Import collector output; do not run collectors without AD scope receipts.',
|
|
parserStatus: 'planned',
|
|
notes: 'Useful as graph evidence once collector output is explicitly authorized.',
|
|
},
|
|
{
|
|
id: 'yara',
|
|
binary: 'yara',
|
|
name: 'YARA',
|
|
category: 'forensics',
|
|
families: ['reverse_binary', 'code_supply_chain', 'reporting_remediation'],
|
|
risk: 'local_read',
|
|
execution: 'safe_command',
|
|
networked: false,
|
|
evidenceKinds: ['artifact_signature'],
|
|
outputFormats: ['text', 'json'],
|
|
installHint: 'brew install yara',
|
|
commandHint: 'yara rules.yar artifact.bin',
|
|
parserStatus: 'planned',
|
|
notes: 'Local artifact classification and malware-family matching.',
|
|
},
|
|
{
|
|
id: 'whatweb',
|
|
binary: 'whatweb',
|
|
name: 'WhatWeb',
|
|
category: 'web',
|
|
families: ['web_api', 'social_osint', 'reporting_remediation'],
|
|
risk: 'active',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['technology_fingerprint', 'http_service'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install whatweb # or: gem install whatweb',
|
|
commandHint: 'whatweb --log-json=- https://example.com',
|
|
parserStatus: 'text',
|
|
notes: 'Web stack fingerprinting (CMS, framework, server) to seed targeted follow-up.',
|
|
},
|
|
{
|
|
id: 'wafw00f',
|
|
binary: 'wafw00f',
|
|
name: 'wafw00f',
|
|
category: 'web',
|
|
families: WEB_FAMILIES,
|
|
risk: 'passive',
|
|
execution: 'safe_command',
|
|
networked: true,
|
|
evidenceKinds: ['waf_fingerprint'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'pipx install wafw00f',
|
|
commandHint: 'wafw00f https://example.com -f json -o -',
|
|
parserStatus: 'text',
|
|
notes: 'Detects and fingerprints the WAF in front of a target so probes can be tuned or throttled.',
|
|
},
|
|
{
|
|
id: 'amass',
|
|
binary: 'amass',
|
|
name: 'OWASP Amass',
|
|
category: 'osint',
|
|
families: ['web_api', 'cloud_infra', 'social_osint'],
|
|
risk: 'passive',
|
|
execution: 'receipt_required',
|
|
networked: true,
|
|
evidenceKinds: ['subdomain', 'asn', 'dns_record'],
|
|
outputFormats: ['jsonl', 'text'],
|
|
installHint: 'brew install amass',
|
|
commandHint: 'amass enum -passive -d example.com',
|
|
parserStatus: 'text',
|
|
notes: 'Deep passive attack-surface mapping; complements subfinder with ASN and infra correlation.',
|
|
},
|
|
{
|
|
id: 'dnsx',
|
|
binary: 'dnsx',
|
|
name: 'dnsx',
|
|
category: 'dns',
|
|
families: ['web_api', 'cloud_infra', 'social_osint'],
|
|
risk: 'passive',
|
|
execution: 'safe_command',
|
|
networked: true,
|
|
evidenceKinds: ['dns_record', 'subdomain'],
|
|
outputFormats: ['jsonl', 'text'],
|
|
installHint: 'brew install projectdiscovery/tap/dnsx',
|
|
commandHint: 'dnsx -d example.com -a -aaaa -cname -resp -json',
|
|
parserStatus: 'text',
|
|
notes: 'Fast DNS resolution/validation to confirm live records from discovered candidate hosts.',
|
|
},
|
|
{
|
|
id: 'testssl',
|
|
binary: 'testssl.sh',
|
|
name: 'testssl.sh',
|
|
category: 'crypto',
|
|
families: ['web_api', 'crypto_secrets', 'reporting_remediation'],
|
|
risk: 'active',
|
|
execution: 'safe_command',
|
|
networked: true,
|
|
evidenceKinds: ['tls_config', 'cipher_weakness', 'certificate_finding'],
|
|
outputFormats: ['json', 'text'],
|
|
installHint: 'brew install testssl',
|
|
commandHint: 'testssl.sh --jsonfile-pretty - https://example.com:443',
|
|
parserStatus: 'text',
|
|
notes: 'TLS/SSL posture check (protocols, ciphers, cert, known CVEs) against an authorized endpoint.',
|
|
},
|
|
{
|
|
id: 'waybackurls',
|
|
binary: 'waybackurls',
|
|
name: 'waybackurls',
|
|
category: 'osint',
|
|
families: ['web_api', 'social_osint', 'reporting_remediation'],
|
|
risk: 'passive',
|
|
execution: 'safe_command',
|
|
networked: true,
|
|
evidenceKinds: ['historical_url', 'endpoint'],
|
|
outputFormats: ['text'],
|
|
installHint: 'go install github.com/tomnomnom/waybackurls@latest',
|
|
commandHint: 'waybackurls example.com',
|
|
parserStatus: 'text',
|
|
notes: 'Pulls historical URLs from the Wayback Machine to surface forgotten endpoints and parameters.',
|
|
},
|
|
];
|
|
|
|
export const SAFE_COMMANDS = [
|
|
...new Set(
|
|
TOOL_ADAPTERS
|
|
.filter(adapter => adapter.execution !== 'catalog_only' && adapter.execution !== 'import_only')
|
|
.map(adapter => adapter.binary)
|
|
),
|
|
].sort();
|
|
|
|
export const NETWORK_COMMANDS = new Set(
|
|
TOOL_ADAPTERS
|
|
.filter(adapter => adapter.networked && adapter.execution !== 'catalog_only' && adapter.execution !== 'import_only')
|
|
.map(adapter => adapter.binary)
|
|
);
|
|
|
|
export function adaptersForFamily(family?: string): ToolAdapter[] {
|
|
return family
|
|
? TOOL_ADAPTERS.filter(adapter => adapter.families.includes(family as MissionFamily))
|
|
: TOOL_ADAPTERS;
|
|
}
|
|
|
|
export function adapterForBinary(binary: string): ToolAdapter | undefined {
|
|
return TOOL_ADAPTERS.find(adapter => adapter.binary === binary || adapter.id === binary);
|
|
}
|
|
|
|
export function summarizeToolCatalog(adapters = TOOL_ADAPTERS): Record<string, unknown> {
|
|
const commandReady = adapters.filter(adapter => adapter.execution === 'safe_command' || adapter.execution === 'receipt_required').length;
|
|
const byExecution = adapters.reduce<Record<string, number>>((acc, adapter) => {
|
|
acc[adapter.execution] = (acc[adapter.execution] || 0) + 1;
|
|
return acc;
|
|
}, {});
|
|
const byRisk = adapters.reduce<Record<string, number>>((acc, adapter) => {
|
|
acc[adapter.risk] = (acc[adapter.risk] || 0) + 1;
|
|
return acc;
|
|
}, {});
|
|
const byCategory = adapters.reduce<Record<string, number>>((acc, adapter) => {
|
|
acc[adapter.category] = (acc[adapter.category] || 0) + 1;
|
|
return acc;
|
|
}, {});
|
|
return {
|
|
total: adapters.length,
|
|
commandReady,
|
|
catalogOnly: adapters.filter(adapter => adapter.execution === 'catalog_only').length,
|
|
importOnly: adapters.filter(adapter => adapter.execution === 'import_only').length,
|
|
unmodeled: adapters.length === 0 || commandReady === 0,
|
|
byExecution,
|
|
byRisk,
|
|
byCategory,
|
|
};
|
|
}
|