mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 15:51:30 +02:00
Yogesh OjhaandClaude Opus 5
56fe4d4b00
The wordlist field was a free-text absolute path, so the only lists anyone could actually use were the two baked into the image. Changing that meant a bind mount or a docker cp — a sysadmin action, not a product one — which in practice meant every install guessed from the same list. Bruteforce quality is almost entirely wordlist quality, so the knob was there and nobody could reach it. Wordlists are now a library, on the same shape as the nuclei check library. Shipped lists stay in the image and are indexed on read so the picker never starts empty; uploads land under a `wordlists` volume shared by api and worker. A config field holds a slug, never a path — `stages/config.py:wordlist(kind)` declares one the way `threads()` and `rate()` declare theirs, and carries the kind the picker filters on so a DNS stage is never offered a list of URL paths. `lookup()` still accepts the absolute paths older engines stored, so an existing engine keeps working. The UI is the Arsenal's second tab, which is why the Arsenal is now "what your scans run with" rather than only scanners and their checks: upload, filter by what the words are, preview the first 200 in the order a scan will read them, delete an upload. Every list shows the name an engine refers to it by, because that is the thing you type into a YAML document. `resolve_path()` refuses anything resolving outside its origin's root and `delete_custom()` refuses a shipped list — the guard the template library learned the hard way. A stage that cannot find its list says so and reports PARTIAL rather than quietly guessing from a different one; that is how the shared volume being absent was caught during the end-to-end run. Verified end to end: a seven-word list uploaded through the API, selected by slug, every passive source disabled — the scan returned six hosts, all attributed to bruteforce. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DPueZXQMbjLXMokXeA8LFP
77 lines
2.3 KiB
Python
77 lines
2.3 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel
|
|
from pydantic import Field as PydanticField
|
|
from sqlmodel import Field, SQLModel
|
|
|
|
from shared.definitions.wordlists import (
|
|
MAX_SLUG_LENGTH,
|
|
MAX_WORDLIST_UPLOAD,
|
|
WordlistKind,
|
|
WordlistOrigin,
|
|
)
|
|
from shared.utils.datetime import utc_now
|
|
|
|
|
|
class Wordlist(SQLModel, table=True):
|
|
"""One list a guessing stage can read. Shipped lists and uploads share the row shape."""
|
|
|
|
__tablename__ = "wordlists"
|
|
|
|
id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
|
|
slug: str = Field(max_length=MAX_SLUG_LENGTH, unique=True, index=True)
|
|
name: str = Field(max_length=200)
|
|
description: str = Field(default="", max_length=1000)
|
|
origin: str = Field(default=WordlistOrigin.CUSTOM.value, max_length=16, index=True)
|
|
kind: str = Field(default=WordlistKind.SUBDOMAIN.value, max_length=16, index=True)
|
|
# relative to the root its origin names, never an absolute path
|
|
filename: str = Field(max_length=200)
|
|
words: int = Field(default=0)
|
|
bytes: int = Field(default=0)
|
|
uploaded_by: uuid.UUID | None = Field(default=None)
|
|
created_at: datetime = Field(default_factory=utc_now)
|
|
updated_at: datetime = Field(default_factory=utc_now)
|
|
|
|
|
|
class WordlistRead(BaseModel):
|
|
id: uuid.UUID
|
|
slug: str
|
|
name: str
|
|
description: str
|
|
origin: str
|
|
kind: str
|
|
words: int
|
|
bytes: int
|
|
created_at: datetime
|
|
updated_at: datetime
|
|
|
|
|
|
class WordlistUpdate(BaseModel):
|
|
name: str | None = PydanticField(default=None, max_length=200)
|
|
description: str | None = PydanticField(default=None, max_length=1000)
|
|
|
|
|
|
class WordlistFile(BaseModel):
|
|
filename: str = PydanticField(max_length=200)
|
|
content: str
|
|
name: str | None = PydanticField(default=None, max_length=200)
|
|
description: str | None = PydanticField(default=None, max_length=1000)
|
|
|
|
|
|
class WordlistUploadRequest(BaseModel):
|
|
kind: str = WordlistKind.SUBDOMAIN.value
|
|
files: list[WordlistFile] = PydanticField(
|
|
default_factory=list, max_length=MAX_WORDLIST_UPLOAD
|
|
)
|
|
|
|
|
|
class WordlistRejection(BaseModel):
|
|
filename: str
|
|
reason: str
|
|
|
|
|
|
class WordlistUploadResult(BaseModel):
|
|
stored: list[WordlistRead] = PydanticField(default_factory=list)
|
|
rejected: list[WordlistRejection] = PydanticField(default_factory=list)
|