mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 07:11:28 +02:00
Yogesh Ojha
e035ca24d9
A new AI Detection stage in the Analysis group runs julius v1.4.19 over every web asset root and names model servers, AI gateways, AI applications, cloud AI endpoints and MCP servers, with the models they list. julius's MCP probe runs alone against /mcp and /api/mcp. Batches of eight roots are paced to the scan's rate, AI ports are probed first, and a minute budget and an asset cap are reported when they cut. Results live on http_assets.ai_* and fold onto hosts and onto services per ip:port, so an IP target with no host rows still carries them. Web asset and service rows show the service, the host and service grammars take ai: and ai.model:, the dashboard and target page count services per product through /ports/ai, two built-in exposure rules flag AI services and unauthenticated model lists, and compare watches ai_services. The AI default ports join WEB_PORTS. julius ignores -f without a positional target, so targets go on stdin.
131 lines
2.8 KiB
Python
131 lines
2.8 KiB
Python
import shlex
|
|
|
|
from pydantic import BaseModel
|
|
|
|
MAX_TOOL_OPTION_LEN = 1000
|
|
|
|
|
|
def parse_tool_args(raw: str) -> list[str]:
|
|
"""shlex-split custom tool args for execution."""
|
|
if not raw:
|
|
return []
|
|
try:
|
|
return shlex.split(raw)
|
|
except ValueError:
|
|
return []
|
|
|
|
|
|
class ToolSpec(BaseModel):
|
|
name: str
|
|
label: str
|
|
phase: str
|
|
example: str
|
|
|
|
|
|
SCAN_TOOLS: tuple[ToolSpec, ...] = (
|
|
ToolSpec(
|
|
name="subfinder",
|
|
label="Subfinder",
|
|
phase="Subdomain Discovery",
|
|
example="-all -recursive -timeout 30",
|
|
),
|
|
ToolSpec(
|
|
name="amass",
|
|
label="Amass",
|
|
phase="Subdomain Discovery",
|
|
example="-active",
|
|
),
|
|
ToolSpec(
|
|
name="github-subdomains",
|
|
label="GitHub Subdomains",
|
|
phase="Subdomain Discovery",
|
|
example="-e",
|
|
),
|
|
ToolSpec(
|
|
name="assetfinder",
|
|
label="Assetfinder",
|
|
phase="Subdomain Discovery",
|
|
example="--subs-only",
|
|
),
|
|
ToolSpec(
|
|
name="tlsx",
|
|
label="TLSX",
|
|
phase="TLS / Certificates",
|
|
example="-cn -san",
|
|
),
|
|
ToolSpec(
|
|
name="katana",
|
|
label="Katana",
|
|
phase="URL Discovery",
|
|
example="-jc -kf all -aff",
|
|
),
|
|
ToolSpec(
|
|
name="urlfinder",
|
|
label="URLFinder",
|
|
phase="URL Discovery",
|
|
example="-all",
|
|
),
|
|
ToolSpec(
|
|
name="dnsx",
|
|
label="DNSX",
|
|
phase="DNS Resolution",
|
|
example="-rcode noerror",
|
|
),
|
|
ToolSpec(
|
|
name="alterx",
|
|
label="Alterx",
|
|
phase="Subdomain Discovery",
|
|
example="-p '{{sub}}-{{word}}.{{suffix}}'",
|
|
),
|
|
ToolSpec(
|
|
name="naabu",
|
|
label="Naabu",
|
|
phase="Port Scan",
|
|
example="-scan-all-ips -sn",
|
|
),
|
|
ToolSpec(
|
|
name="httpx",
|
|
label="HTTPX",
|
|
phase="HTTP Probe",
|
|
example="-favicon -jarm",
|
|
),
|
|
ToolSpec(
|
|
name="nuclei",
|
|
label="Nuclei",
|
|
phase="Vulnerability Scan",
|
|
example="-etags intrusive -exclude-severity info",
|
|
),
|
|
ToolSpec(
|
|
name="dalfox",
|
|
label="Dalfox",
|
|
phase="Fuzzing",
|
|
example="--skip-ast-analysis",
|
|
),
|
|
ToolSpec(
|
|
name="ffuf",
|
|
label="ffuf",
|
|
phase="URL Discovery",
|
|
example="-mc 200,204,301,302",
|
|
),
|
|
ToolSpec(
|
|
name="wafw00f",
|
|
label="wafw00f",
|
|
phase="WAF Detection",
|
|
example="-a",
|
|
),
|
|
ToolSpec(
|
|
name="cdncheck",
|
|
label="cdncheck",
|
|
phase="CDN Attribution",
|
|
example="-resp",
|
|
),
|
|
ToolSpec(
|
|
name="julius",
|
|
label="julius",
|
|
phase="AI Detection",
|
|
example="--base-paths /api,/proxy",
|
|
),
|
|
)
|
|
|
|
TOOL_NAMES: frozenset[str] = frozenset(t.name for t in SCAN_TOOLS)
|