Documentation
¶
Overview ¶
Package all is the batteries-included registration entry point for the reusable kits. The granular Register* helpers let a host register only what its ports support; RegisterFull is the one-shot that registers everything and therefore requires every port (including a SessionManager for the session-driven kits).
Index ¶
- func Register(reg *capkit.Registry) error
- func RegisterCloud(reg *capkit.Registry) error
- func RegisterContainer(reg *capkit.Registry) error
- func RegisterCred(reg *capkit.Registry) error
- func RegisterEnterprise(reg *capkit.Registry, resolver enterprisekit.ProviderResolver) error
- func RegisterExploit(reg *capkit.Registry) error
- func RegisterFingerprint(reg *capkit.Registry) error
- func RegisterFull(reg *capkit.Registry) error
- func RegisterGithub(reg *capkit.Registry) error
- func RegisterHTTP(reg *capkit.Registry) error
- func RegisterICP(reg *capkit.Registry) error
- func RegisterIdentity(reg *capkit.Registry, flows *identitykit.AuthFlowRegistry) error
- func RegisterLateral(reg *capkit.Registry) error
- func RegisterNuclei(reg *capkit.Registry) error
- func RegisterOAST(reg *capkit.Registry) error
- func RegisterPlaybook(reg *capkit.Registry) error
- func RegisterPostExploitation(reg *capkit.Registry) error
- func RegisterRecon(reg *capkit.Registry) error
- func RegisterSession(reg *capkit.Registry) error
- func RegisterSessionWithDeployer(reg *capkit.Registry, deployer shellkit.WebShellDeployer) error
- func RegisterSpacemap(reg *capkit.Registry) error
- func RegisterTemplate(reg *capkit.Registry) error
- func RegisterToolParse(reg *capkit.Registry) error
- func RegisterVerify(reg *capkit.Registry) error
- func RegisterWebShellOpener(mgr *sessionkit.Manager, exec session.Executor) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Register ¶
Register registers the minimal, port-free baseline: the HTTP probe and the nuclei runner. Everything else declares a port and is registered by the more specific helpers (or by RegisterFull).
func RegisterCloud ¶
RegisterCloud registers the five cloud-asset tools (cloud_ak_verify, cloud_asset_list, cloud_iam_list, cloud_storage_list, cloud_run_command). The runtime must supply an HTTPDoer; credentials arrive per call and are never retained, and every vendor request stays behind the host's scope/rate/audit gates. cloud_run_command is high risk and therefore approval-gated.
Provider coverage is honest rather than uniform: AWS, Alibaba and Tencent implement all five; Huawei implements verify, asset listing and IAM listing, and reports cloud_storage_list / cloud_run_command as unsupported because the OBS SDK and the ECS cloud-assistant API are outside huaweicloud-sdk-go-v3.
func RegisterContainer ¶
RegisterContainer registers the container/k8s detection and escape-triage kit. The runtime must supply an HTTPDoer (for the four network probes) and, for container_escape_check, a capkit.SessionManager.
func RegisterCred ¶
RegisterCred registers the credential-use kit (cloud AK/SK, db, ssh live verification). The runtime must be given a Fetcher (for cloud verification; proxy/timeout/rate/audit policy applies). db/ssh probes are direct TCP/SSH and rely on the host's target authorization gate.
func RegisterEnterprise ¶
func RegisterEnterprise(reg *capkit.Registry, resolver enterprisekit.ProviderResolver) error
RegisterEnterprise registers the enterprise-data-source tools. The resolver is host-supplied (it resolves cookies/keys from the host's session vault), so this helper takes it explicitly rather than reading it from capkit.Deps.
func RegisterExploit ¶
RegisterExploit registers the deterministic web-entry exploit probes (cmdi/ssti/lfi/sqli/ssrf + redis/msf/deser helpers). All ten tools are exposed to the agent. The runtime must supply an HTTPDoer; a ProcessRunner is needed only for msf_execute and deser_generate (otherwise those two return unavailable).
func RegisterFingerprint ¶
RegisterFingerprint registers the fingerprint detection tool. The runtime must supply an HTTPDoer; rules come from Deps.Fingerprints when the host already built a *fingerprintkit.Provider.
func RegisterFull ¶
RegisterFull additionally registers verifykit, githubkit, oastkit, spacemapkit, icpkit, exploitkit, shellkit's session tools, the post- exploitation kits (privesc/internalnet/persist/cleanup/av), containerkit, latkit and cloudkit. Only use it when the host supplies fingerprints/templates/ template_engines/fetcher/settings/a SessionManager/a ProcessRunner/an HTTPDoer and has an approval gate configured (the session, lateral-movement, exploit and cloud-assistant tools are high risk).
reconkit and enterprisekit are deliberately NOT here: both need host-injected collaborators that capkit.Deps cannot carry (an AssetSink/provider set for recon, a ProviderResolver for enterprise), so hosts register them with RegisterRecon / RegisterEnterprise instead.
func RegisterGithub ¶
RegisterGithub registers the GitHub secret-search kit. The runtime must be given a Fetcher and Settings with github.token.
func RegisterHTTP ¶
RegisterHTTP registers the HTTP capability only.
func RegisterICP ¶
RegisterICP registers the MIIT (工信部) ICP filing lookup kit. The runtime must be given a Fetcher (beian.miit.gov.cn is an external data source).
func RegisterIdentity ¶
func RegisterIdentity(reg *capkit.Registry, flows *identitykit.AuthFlowRegistry) error
RegisterIdentity registers the three identity tools (identity_login, identity_csrf, identity_token_check). The flow registry is host-supplied, so this helper takes it explicitly rather than reading it from capkit.Deps — the same reason RegisterEnterprise takes a resolver.
A host assembles site logins on the registry and hands it here; identity_login then resolves the agent's `kind` against it. An empty registry is legal: the tools still register, and identity_login reports the kind as unregistered instead of pretending to log in. The kit also needs an HTTPDoer (Manifest.Requires "http") for identity_csrf.
func RegisterLateral ¶
RegisterLateral registers the lateral-movement argv builders (psexec/wmiexec/ smbexec, pass-the-hash, WinRM, Kerberoast/AS-REP/DCSync). Every tool is a subprocess invocation, so the runtime must supply a ProcessRunner; the impacket/NetExec binaries themselves stay outside this module (docs §6.2: copyleft code is never imported).
func RegisterNuclei ¶
RegisterNuclei registers the nuclei execution capability.
func RegisterOAST ¶
RegisterOAST registers the dnslog.cn OAST kit. The runtime must be given a Fetcher.
func RegisterPlaybook ¶
RegisterPlaybook registers deterministic playbook execution.
func RegisterPostExploitation ¶
RegisterPostExploitation registers the five session-driven kits: privesckit (enumeration + advice), internalnetkit, persistkit, cleanupkit and avkit (AV/EDR identification). Every one of them resolves its target from Deps.Sessions, so they share the same gate chain (scope → approval → ratelimit → audit) as session_open.
cleanupkit never runs without an explicit preview + plan_id + confirm, and persistkit's apply tool requires confirm=true; both are additionally gated by the runtime's approval gate because they are high risk.
func RegisterRecon ¶
RegisterRecon registers the reconnaissance pipeline. The host must wire providers and an AssetSink into the capability after construction.
func RegisterSession ¶
RegisterSession registers the foothold/session tools (session_open/exec/ upload/download, tunnel_open, list, close). The runtime must supply a capkit.SessionManager (Deps.Sessions) with at least one opener registered.
func RegisterSessionWithDeployer ¶
func RegisterSessionWithDeployer(reg *capkit.Registry, deployer shellkit.WebShellDeployer) error
RegisterSessionWithDeployer registers the session tools plus webshell_deploy, which needs a host delivery channel. The deployer is a shellkit type, so it cannot ride in capkit.Deps — the same reason RegisterEnterprise takes a resolver. Use this when the host has a way to drop a shell on a target; RegisterSession alone leaves webshell_deploy reporting tool_missing.
func RegisterSpacemap ¶
RegisterSpacemap registers the five-engine space-mapping kit. The runtime must be given a Fetcher; keys come from resolvers, settings or env.
func RegisterTemplate ¶
RegisterTemplate registers the read-only template catalog tools. Execution stays in the template engines (verifykit/nucleikit).
func RegisterToolParse ¶
RegisterToolParse registers the external-CLI output parsers.
func RegisterVerify ¶
RegisterVerify registers verifykit. The runtime must be given a FingerprintProvider, a TemplateCatalog and at least one TemplateEngine.
func RegisterWebShellOpener ¶
func RegisterWebShellOpener(mgr *sessionkit.Manager, exec session.Executor) error
RegisterWebShellOpener wires shellkit's WebShellOpener into a sessionkit Manager under kind "webshell". It exists so a host assembles a WebShell foothold in one line: after this, session_open(kind="webshell", host=<shell URL>, options={"shell_type":...}, secret=<password>) drives the given Executor through the same Session contract SSH and WinRM use.
It lives here rather than in either kit because it needs both: shellkit owns the opener, sessionkit owns the Manager, and a kit may not import another kit.
Types ¶
This section is empty.
Source Files