Complete rewrite and re-architecture Osmedeus Engine in v5

2026-09-10 03:37:46 +02:00 · 2026-01-18 19:32:24 +08:00
commit 7a2c5a5dc9
743 changed files with 99767 additions and 0 deletions
@@ -0,0 +1,130 @@
+name: vulnerability-flow
+kind: flow
+desc: Vulnerability assessment flow with discovery, scanning, and reporting modules
+
+params:
+  - name: threads
+    value: "25"
+  - name: severity
+    value: "medium,high,critical"
+  - name: templates
+    value: "{{Data}}/nuclei-templates"
+
+modules:
+  # Module 1: Discovery - Find attack surface
+  - name: discovery
+    condition: "true"
+    steps:
+      - name: init-discovery
+        type: bash
+        commands:
+          - mkdir -p {{Output}}/discovery
+          - mkdir -p {{Output}}/endpoints
+        exports:
+          discovery_dir: "{{Output}}/discovery"
+          endpoints_dir: "{{Output}}/endpoints"
+
+      - name: find-endpoints
+        type: bash
+        parallel_commands:
+          - "{{Binaries}}/waybackurls {{Target}} > {{endpoints_dir}}/wayback.txt"
+          - "{{Binaries}}/gau {{Target}} > {{endpoints_dir}}/gau.txt"
+          - "{{Binaries}}/katana -u {{Target}} -silent -o {{endpoints_dir}}/katana.txt"
+        timeout: 900
+        on_error: continue
+
+      - name: merge-endpoints
+        type: bash
+        command: |
+          cat {{endpoints_dir}}/*.txt | sort -u > {{discovery_dir}}/all-endpoints.txt
+          grep -E '\.(php|asp|aspx|jsp|cgi)' {{discovery_dir}}/all-endpoints.txt > {{discovery_dir}}/dynamic-endpoints.txt || true
+        exports:
+          all_endpoints: "{{discovery_dir}}/all-endpoints.txt"
+          dynamic_endpoints: "{{discovery_dir}}/dynamic-endpoints.txt"
+
+  # Module 2: Scanning - Run vulnerability scanners
+  - name: scanning
+    depends_on:
+      - discovery
+    condition: "fileLength('{{all_endpoints}}') > 0"
+    steps:
+      - name: init-scanning
+        type: bash
+        commands:
+          - mkdir -p {{Output}}/vulns
+          - mkdir -p {{Output}}/findings
+        exports:
+          vulns_dir: "{{Output}}/vulns"
+          findings_dir: "{{Output}}/findings"
+
+      - name: nuclei-scan
+        type: bash
+        command: "{{Binaries}}/nuclei -l {{all_endpoints}} -t {{templates}} -severity {{severity}} -c {{threads}} -o {{vulns_dir}}/nuclei.json -jsonl"
+        timeout: 7200
+        on_error: continue
+        exports:
+          nuclei_results: "{{vulns_dir}}/nuclei.json"
+
+      - name: additional-scans
+        type: parallel-steps
+        parallel_steps:
+          - name: xss-scan
+            type: bash
+            command: "cat {{dynamic_endpoints}} | {{Binaries}}/dalfox pipe -o {{vulns_dir}}/xss.txt"
+            timeout: 3600
+            on_error: continue
+          - name: sqli-check
+            type: bash
+            command: "{{Binaries}}/sqlmap -m {{dynamic_endpoints}} --batch --output-dir={{vulns_dir}}/sqli"
+            timeout: 3600
+            on_error: continue
+
+  # Module 3: Reporting - Generate vulnerability reports
+  - name: reporting
+    depends_on:
+      - scanning
+    condition: "true"
+    steps:
+      - name: init-reports
+        type: bash
+        command: mkdir -p {{Output}}/reports
+
+      - name: aggregate-findings
+        type: function
+        script: |
+          var findings = [];
+          var nucleiFile = "{{nuclei_results}}";
+
+          if (fileExists(nucleiFile)) {
+            var content = readFile(nucleiFile);
+            var lines = content.split("\n").filter(function(l) { return l.trim().length > 0; });
+            findings = lines.map(function(l) {
+              try { return JSON.parse(l); } catch(e) { return {raw: l}; }
+            });
+          }
+
+          log_info("Total findings aggregated: " + findings.length);
+          writeFile("{{Output}}/reports/findings.json", JSON.stringify(findings, null, 2));
+          return findings.length;
+        exports:
+          finding_count: "{{Result}}"
+
+      - name: generate-report
+        type: bash
+        command: |
+          cat > {{Output}}/reports/vulnerability-report.md << EOF
+          # Vulnerability Assessment Report
+
+          **Target:** {{Target}}
+          **Date:** $(date)
+          **Severity Filter:** {{severity}}
+
+          ## Summary
+          - Total Findings: {{finding_count}}
+          - Endpoints Scanned: $(wc -l < {{all_endpoints}})
+
+          ## Detailed Findings
+          See findings.json for complete details.
+          EOF
+        exports:
+          final_report: "{{Output}}/reports/vulnerability-report.md"