source

package
v0.4.9 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 20, 2026 License: MIT Imports: 41 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GetTotal

func GetTotal(src InputSource) int64

GetTotal returns the total count from a source if it implements Countable, otherwise 0.

func IsEOF

func IsEOF(err error) bool

IsEOF checks if an error indicates end of source.

func IsTargetListFormat

func IsTargetListFormat(name string) bool

IsTargetListFormat reports whether the given -I/--input-mode name or alias names a format whose file is a list of target URLs. An empty name resolves to the "urls" default, matching resolveFormat; an unknown name is not a target list (resolveFormat rejects it separately).

Callers use it to decide whether a file's contents can be promoted into Options.Targets. It reads the same registry row resolveFormat does, so an alias added there is promoted without a second edit — a hand-copied alias list that missed one would parse the file fine and then leave every target-seeded phase with nothing, which is the bug this predicate exists to prevent.

func ParseFileRecords

func ParseFileRecords(filePath, formatName string, max int) ([]*httpmsg.HttpRequestResponse, error)

ParseFileRecords parses the file at filePath using the named input format and returns the discovered HTTP records. It is the synchronous, pull-everything convenience wrapper over the format registry for callers that just want the records in a slice (e.g. the autopilot knowledge-base traffic loader) rather than the streaming FileSource/Next() API. formatName accepts any canonical name or alias resolveFormat understands ("har", "burpxml", "openapi", …); an unknown name is a hard error. When max > 0 parsing stops after max records. A non-nil parse error is returned alongside whatever records were gathered before it (a partially-parseable file still yields its good records).

func SupportedFormatNames

func SupportedFormatNames() []string

SupportedFormatNames returns the canonical input-format names in display order.

func SupportedFormats

func SupportedFormats() string

SupportedFormats returns a comma-separated list of the canonical input-format names, derived from the single formatRegistry source of truth so it can never drift from the set resolveFormat actually accepts.

Types

type ConcurrentMultiSource

type ConcurrentMultiSource struct {
	// contains filtered or unexported fields
}

ConcurrentMultiSource merges multiple InputSources by reading from all concurrently. Unlike MultiSource which drains sources sequentially, ConcurrentMultiSource reads from all sources in parallel via goroutines pushing to a shared channel. This is required when some sources block indefinitely (e.g., queue sources).

func NewConcurrentMultiSource

func NewConcurrentMultiSource(sources ...InputSource) *ConcurrentMultiSource

NewConcurrentMultiSource creates a ConcurrentMultiSource that reads from all provided sources concurrently.

func (*ConcurrentMultiSource) Close

func (cs *ConcurrentMultiSource) Close() error

Close cancels all source goroutines and closes all underlying sources.

func (*ConcurrentMultiSource) Next

Next returns the next work item from any of the underlying sources.

type Countable

type Countable interface {
	Count() int64
}

Countable is an optional interface for sources that can report total item count.

type DeparosDiscoveryConfig

type DeparosDiscoveryConfig struct {
	Targets       []string      // Target URLs
	Concurrency   int           // Worker threads (from -t flag); default: 25
	MaxDuration   time.Duration // default: 1h
	EnableModules []string      // Module selection for WorkItems

	// Full deparos settings (from YAML config)
	Mode             string // "files_and_dirs" | "files_only" | "dirs_only"
	ScopeMode        string // "any" | "subdomain" | "exact"
	RecursionEnabled bool   // default: true
	RecursionDepth   int    // default: 5
	SaveResponseBody bool   // default: true

	// Wordlists
	ShortFilePath        string
	LongFilePath         string
	ShortDirPath         string
	LongDirPath          string
	FuzzWordlistPath     string
	UseObservedNames     bool
	UseObservedPaths     bool
	UseObservedFiles     bool
	EnableNumericFuzzing bool

	// Extensions
	TestCustom           bool
	CustomList           []string
	TestObserved         bool
	TestBackupExtensions bool
	BackupExtensions     []string
	TestNoExtension      bool

	// Confirmation-gated extension fuzzing. When ConfirmRequired is set, a
	// server-side extension (php/asp/aspx/jsp/action/cgi/…) is only wordlist-
	// fuzzed once the app is confirmed to serve it as a valid route via the
	// enabled sources below. Candidates/ProbeFilenames override the built-ins.
	ConfirmRequired       bool
	ConfirmViaObserved    bool
	ConfirmViaFingerprint bool
	ConfirmViaProbe       bool
	Candidates            []string
	ProbeFilenames        []string

	// JSBundleSweep enables the SPA-gated JS-bundle name sweep (main.js,
	// admin.js, config.js, …) on monolith apps; hits are fed to jstangle.
	// JSBundleNames overrides the curated name list (empty = built-in).
	JSBundleSweep bool
	JSBundleNames []string

	// Engine
	CaseSensitivity string // "auto_detect" | "sensitive" | "insensitive"
	EngineTimeout   time.Duration
	CustomHeaders   map[string]string
	// BrowserSessions carries WAF/bot-cleared sessions harvested by the spidering
	// browser, keyed by lowercased hostname. buildDeparosConfig injects the
	// session matching each target host (Cookie + optional pinned User-Agent) into
	// that target's request headers so content discovery crawls with the same
	// cleared session — set-if-absent, so a configured header always wins.
	BrowserSessions         map[string]httpmsg.CarriedSession
	EnableCookieJar         bool
	ProxyURL                string // HTTP proxy URL for discovery requests
	MaxConsecutiveErrors    int
	MaxConsecutiveWAFBlocks int
	ObservedMaxItems        int
	JSTangle                *deparosconfig.JSTangleConfig

	// Per-prefix circuit breaker (zero values = use deparos defaults).
	PrefixBreakerEnabled        *bool   // nil = default (true)
	PrefixBreakerMinSamples     int     // 0 = default
	PrefixBreakerTripRatio      float64 // 0 = default
	PrefixBreakerPrefixSegments int     // 0 = default
	PrefixBreakerLengthBucket   int64   // 0 = default

	// Malformed path probe
	EnableMalformedPathProbe bool

	// DedupClusterCap caps the number of near-identical responses kept per
	// cluster (same host/status/content-type, body size & word count within
	// 0.5%). 0 = use default (defaultDedupClusterCap); negative = disabled;
	// positive = that cap. Resolved via resolveClusterCap.
	DedupClusterCap int

	// DB import: if set, results are saved to vigolium's http_records table
	Repository  RecordSaver
	ProjectUUID string
}

DeparosDiscoveryConfig configures the deparos content discovery source.

type DeparosDiscoverySource

type DeparosDiscoverySource struct {
	// contains filtered or unexported fields
}

DeparosDiscoverySource uses the deparos library to discover content, then converts results to input for scanning.

func NewDeparosDiscoverySource

func NewDeparosDiscoverySource(cfg DeparosDiscoveryConfig) (*DeparosDiscoverySource, error)

NewDeparosDiscoverySource creates a new DeparosDiscoverySource.

func (*DeparosDiscoverySource) Close

func (d *DeparosDiscoverySource) Close() error

Close releases resources and stops discovery.

func (*DeparosDiscoverySource) Next

Next returns the next discovered item. It lazily starts the discovery process on first call.

func (*DeparosDiscoverySource) Stats

Stats returns the discovery statistics (safe to call after the source is exhausted).

type DiscoveryStats

type DiscoveryStats struct {
	TotalDiscovered    int
	HardDedupRemoved   int
	FuzzyCappedRemoved int // records dropped by the near-identical cluster cap
	ClusterCap         int // effective per-cluster cap used (0 = disabled)
	Imported           int
	AllCodes           [5]int // index 0=1xx, 1=2xx, 2=3xx, 3=4xx, 4=5xx
	DedupedCodes       [5]int // status codes of hard-dedup removed records
	CappedCodes        [5]int // status codes of cluster-capped removed records
}

DiscoveryStats tracks status code statistics for discovered and deduplicated records.

type ExternalHarvesterInputSource

type ExternalHarvesterInputSource struct {
	// contains filtered or unexported fields
}

ExternalHarvesterInputSource adapts the external harvester into an InputSource. It lazily starts harvesting from external intelligence sources on the first Next() call.

func NewExternalHarvesterInputSource

func NewExternalHarvesterInputSource(h *harvester.Harvester, domains []string, enableModules []string) *ExternalHarvesterInputSource

NewExternalHarvesterInputSource creates a new ExternalHarvesterInputSource.

func (*ExternalHarvesterInputSource) Close

Close releases resources and stops external harvesting.

func (*ExternalHarvesterInputSource) Next

Next returns the next externally harvested item as a WorkItem. It lazily starts the external harvesting process on first call.

type FileSource

type FileSource struct {
	// contains filtered or unexported fields
}

FileSource provides lazy-loading input from files using format parsers. It wraps the existing Format interface and converts push-based callback to pull-based Next().

func FirstFileSource

func FirstFileSource(src InputSource) *FileSource

FirstFileSource returns the first *FileSource reachable from src, unwrapping a MultiSource (the shape NewInputSource produces when targets/-t and a file/-i are combined). Returns nil when there is none. Callers use it to configure format-specific options (OpenAPI BaseURL, WSDL endpoint) on the file parser after the source is built — a bare `inputSource.(*FileSource)` misses the parser whenever -t is also present, silently dropping the override.

func NewFileSource

func NewFileSource(cfg FileSourceConfig) (*FileSource, error)

NewFileSource creates a new FileSource for the given file and format.

func (*FileSource) Close

func (f *FileSource) Close() error

Close releases resources and stops parsing.

func (*FileSource) Count

func (f *FileSource) Count() int64

Count returns the total item count if the underlying format supports counting.

func (*FileSource) Format

func (f *FileSource) Format() formats.Format

Format returns the underlying format parser. This allows callers to configure format-specific options after creation.

func (*FileSource) Next

func (f *FileSource) Next(ctx context.Context) (*work.WorkItem, error)

Next returns the next item from the file. It blocks until an item is available or the file is exhausted.

type FileSourceConfig

type FileSourceConfig struct {
	FilePath      string
	Format        string // "urls", "nuclei-output", "spitolas", "openapi", etc.
	BufferSize    int    // Channel buffer size (default: 100)
	EnableModules []string
	FormatOptions formats.InputFormatOptions
}

FileSourceConfig configures FileSource behavior.

type InputSource

type InputSource interface {
	// Next returns the next work item from the source.
	// It blocks until an item is available (for queue-based sources).
	//
	// Returns:
	//   - (*work.WorkItem, nil) - next item
	//   - (nil, io.EOF) - source exhausted, no more items
	//   - (nil, context.Canceled) - context was cancelled
	//   - (nil, error) - other error occurred
	Next(ctx context.Context) (*work.WorkItem, error)

	// Close releases any resources held by the source.
	// After Close, Next will return io.EOF.
	Close() error
}

InputSource provides a stream of work items for scanning. This is a pull-based interface where consumers call Next() to get items. Implementations must be safe for concurrent Next() calls from multiple goroutines.

func NewInputSource

func NewInputSource(cfg SourceConfig) (InputSource, error)

NewInputSource creates appropriate InputSource based on config. Combines multiple sources if needed (e.g., -u flags + -l file + stdin).

type MultiSource

type MultiSource struct {
	// contains filtered or unexported fields
}

MultiSource combines multiple InputSource into one. It drains sources in order: exhausts the first source before moving to the next.

func NewMultiSource

func NewMultiSource(sources ...InputSource) *MultiSource

NewMultiSource creates a MultiSource from multiple InputSources.

func (*MultiSource) Close

func (m *MultiSource) Close() error

Close closes all underlying sources.

func (*MultiSource) Count

func (m *MultiSource) Count() int64

Count returns the sum of counts from all sources that implement Countable.

func (*MultiSource) Next

func (m *MultiSource) Next(ctx context.Context) (*work.WorkItem, error)

Next returns the next item from the current source, advancing to the next source when exhausted.

type RecordSaver

type RecordSaver interface {
	SaveRecord(ctx context.Context, httpRR *httpmsg.HttpRequestResponse, source string, projectUUID string) (string, error)
	SaveRecordBatch(ctx context.Context, records []*httpmsg.HttpRequestResponse, source string, projectUUID string) ([]string, error)
}

RecordSaver persists HTTP request/response pairs to a database. This avoids importing pkg/database directly.

type SingleSource

type SingleSource struct {
	// contains filtered or unexported fields
}

SingleSource is an InputSource that yields exactly one WorkItem, then returns io.EOF. Used by scan-url and scan-request commands for single-target scanning.

func NewSingleSource

func NewSingleSource(rr *httpmsg.HttpRequestResponse, enableModules []string) *SingleSource

NewSingleSource creates a SingleSource from a single HttpRequestResponse.

func (*SingleSource) Close

func (s *SingleSource) Close() error

Close is a no-op for SingleSource.

func (*SingleSource) Count

func (s *SingleSource) Count() int64

Count returns 1 (implements Countable).

func (*SingleSource) Next

func (s *SingleSource) Next(ctx context.Context) (*work.WorkItem, error)

Next returns the single work item on first call, then io.EOF on subsequent calls.

type SliceSource

type SliceSource struct {
	// contains filtered or unexported fields
}

SliceSource is an InputSource that yields work items from a slice of HttpRequestResponse. Implements InputSource and Countable.

func NewSliceSource

func NewSliceSource(items []*httpmsg.HttpRequestResponse, enableModules []string) *SliceSource

NewSliceSource creates a SliceSource from a slice of HttpRequestResponse items.

func (*SliceSource) Close

func (s *SliceSource) Close() error

Close is a no-op for SliceSource.

func (*SliceSource) Count

func (s *SliceSource) Count() int64

Count returns the number of items in the source (implements Countable).

func (*SliceSource) Next

func (s *SliceSource) Next(ctx context.Context) (*work.WorkItem, error)

Next returns the next work item, or io.EOF when all items have been consumed.

type SourceConfig

type SourceConfig struct {
	// Direct targets (from -u flag)
	Targets []string

	// File-based input. FilePath is a single input file (e.g. -i/--input).
	// FilePaths carries additional files (e.g. repeated -T/--target-file); every
	// listed file is read and its items merged into the stream.
	FilePath  string
	FilePaths []string
	Format    string // "urls", "nuclei", "openapi", etc.

	// Stdin
	UseStdin bool
	Stdin    io.Reader // defaults to os.Stdin

	// Format options
	SkipFormatValidation  bool
	FormatUseRequiredOnly bool

	// Buffer size for channels
	BufferSize int

	// EnableModules for per-item module filtering (from -m flag)
	EnableModules []string
}

SourceConfig holds configuration for creating an InputSource.

type StdinSource

type StdinSource struct {
	// contains filtered or unexported fields
}

StdinSource reads URLs line-by-line from a reader (typically stdin).

func NewStdinSource

func NewStdinSource(reader io.Reader, enableModules []string) *StdinSource

NewStdinSource creates a StdinSource from an io.Reader.

func (*StdinSource) Close

func (s *StdinSource) Close() error

Close marks the source as closed.

func (*StdinSource) Next

func (s *StdinSource) Next(ctx context.Context) (*work.WorkItem, error)

Next returns the next URL as WorkItem.

type TargetSource

type TargetSource struct {
	// contains filtered or unexported fields
}

TargetSource provides input from direct URL targets (from -u flag).

func NewTargetSource

func NewTargetSource(targets []string, enableModules []string) *TargetSource

NewTargetSource creates a TargetSource from a slice of URLs.

func (*TargetSource) Close

func (t *TargetSource) Close() error

Close marks the source as closed.

func (*TargetSource) Count

func (t *TargetSource) Count() int64

Count returns the total number of targets (known upfront).

func (*TargetSource) Next

func (t *TargetSource) Next(ctx context.Context) (*work.WorkItem, error)

Next returns the next URL as WorkItem.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL