Files

131 lines
4.2 KiB
YAML

name: vulnerability-flow
kind: flow
desc: Vulnerability assessment flow with discovery, scanning, and reporting modules
params:
- name: threads
value: "25"
- name: severity
value: "medium,high,critical"
- name: templates
value: "{{Data}}/nuclei-templates"
modules:
# Module 1: Discovery - Find attack surface
- name: discovery
condition: "true"
steps:
- name: init-discovery
type: bash
commands:
- mkdir -p {{Output}}/discovery
- mkdir -p {{Output}}/endpoints
exports:
discovery_dir: "{{Output}}/discovery"
endpoints_dir: "{{Output}}/endpoints"
- name: find-endpoints
type: bash
parallel_commands:
- "{{Binaries}}/waybackurls {{Target}} > {{endpoints_dir}}/wayback.txt"
- "{{Binaries}}/gau {{Target}} > {{endpoints_dir}}/gau.txt"
- "{{Binaries}}/katana -u {{Target}} -silent -o {{endpoints_dir}}/katana.txt"
timeout: 900
on_error: continue
- name: merge-endpoints
type: bash
command: |
cat {{endpoints_dir}}/*.txt | sort -u > {{discovery_dir}}/all-endpoints.txt
grep -E '\.(php|asp|aspx|jsp|cgi)' {{discovery_dir}}/all-endpoints.txt > {{discovery_dir}}/dynamic-endpoints.txt || true
exports:
all_endpoints: "{{discovery_dir}}/all-endpoints.txt"
dynamic_endpoints: "{{discovery_dir}}/dynamic-endpoints.txt"
# Module 2: Scanning - Run vulnerability scanners
- name: scanning
depends_on:
- discovery
condition: "fileLength('{{all_endpoints}}') > 0"
steps:
- name: init-scanning
type: bash
commands:
- mkdir -p {{Output}}/vulns
- mkdir -p {{Output}}/findings
exports:
vulns_dir: "{{Output}}/vulns"
findings_dir: "{{Output}}/findings"
- name: nuclei-scan
type: bash
command: "{{Binaries}}/nuclei -l {{all_endpoints}} -t {{templates}} -severity {{severity}} -c {{threads}} -o {{vulns_dir}}/nuclei.json -jsonl"
timeout: 7200
on_error: continue
exports:
nuclei_results: "{{vulns_dir}}/nuclei.json"
- name: additional-scans
type: parallel-steps
parallel_steps:
- name: xss-scan
type: bash
command: "cat {{dynamic_endpoints}} | {{Binaries}}/dalfox pipe -o {{vulns_dir}}/xss.txt"
timeout: 3600
on_error: continue
- name: sqli-check
type: bash
command: "{{Binaries}}/sqlmap -m {{dynamic_endpoints}} --batch --output-dir={{vulns_dir}}/sqli"
timeout: 3600
on_error: continue
# Module 3: Reporting - Generate vulnerability reports
- name: reporting
depends_on:
- scanning
condition: "true"
steps:
- name: init-reports
type: bash
command: mkdir -p {{Output}}/reports
- name: aggregate-findings
type: function
script: |
var findings = [];
var nucleiFile = "{{nuclei_results}}";
if (fileExists(nucleiFile)) {
var content = readFile(nucleiFile);
var lines = content.split("\n").filter(function(l) { return l.trim().length > 0; });
findings = lines.map(function(l) {
try { return JSON.parse(l); } catch(e) { return {raw: l}; }
});
}
log_info("Total findings aggregated: " + findings.length);
writeFile("{{Output}}/reports/findings.json", JSON.stringify(findings, null, 2));
return findings.length;
exports:
finding_count: "{{Result}}"
- name: generate-report
type: bash
command: |
cat > {{Output}}/reports/vulnerability-report.md << EOF
# Vulnerability Assessment Report
**Target:** {{Target}}
**Date:** $(date)
**Severity Filter:** {{severity}}
## Summary
- Total Findings: {{finding_count}}
- Endpoints Scanned: $(wc -l < {{all_endpoints}})
## Detailed Findings
See findings.json for complete details.
EOF
exports:
final_report: "{{Output}}/reports/vulnerability-report.md"