fuzz

type AnomalyConfig struct {
	// Threshold is the score at or above which a result is reported.
	Threshold int
	// MinPopulation is how many results must be seen before population-based
	// signals (rarity, outliers) are trusted. Below it, only baseline-relative
	// signals contribute — a "rare" status among four samples means nothing.
	MinPopulation int
}

type AnomalyReason struct {
	Signal string `json:"signal"`
	Detail string `json:"detail,omitempty"`
	Weight int    `json:"weight"`
}

type AttackMode int

type Baseline struct {
	Status int    `json:"status"`
	Length int    `json:"length"`
	Words  int    `json:"words"`
	Lines  int    `json:"lines"`
	Hash   string `json:"content_hash,omitempty"`
	Error  string `json:"error,omitempty"`

	// Timing statistics over Samples sends of the un-fuzzed request. A single
	// sample can't distinguish "this payload made the server work harder" from
	// "the network hiccuped", which is the whole difficulty of time-based
	// blind detection; a mean and a standard deviation can.
	TimeMs      int64   `json:"time_ms"`
	TimeStdDev  float64 `json:"time_stddev_ms,omitempty"`
	Samples     int     `json:"samples,omitempty"`
	TimeSamples []int64 `json:"time_samples,omitempty"`
}

type Case struct {
	Assignments []CaseAssignment
}

type CaseAssignment struct {
	Position Position
	Payload  string
}

type Criteria struct {
	AllStatus bool // --match-status-code all
	Status    NumPredicates
	Sizes     NumPredicates
	Words     NumPredicates
	Lines     NumPredicates
	TimeMs    NumPredicates
	Regex     *regexp.Regexp // matched against the response body
	Headers   []HeaderMatcher
	// TimeZ matches on standard deviations above the baseline mean rather
	// than absolute milliseconds.
	TimeZ NumPredicates
	Mode  MatchMode
}

type Filters = Criteria

type HeaderMatcher struct {
	Name  string
	Value *regexp.Regexp
}

type Job struct {
	Raw      []byte
	Scheme   string
	Hostname string
	Port     int

	// Positions and Payloads are the simple form: every position gets every
	// payload (sniper). Cases, when set, replaces them with an explicit plan —
	// which is how the multi-position modes express a send that varies several
	// markers at once.
	Positions []Position
	Payloads  []string
	Cases     []Case

	Matchers Matchers
	Filters  Filters
	// BaselineSamples is how many times the un-fuzzed request is sent to build
	// the timing statistics. 1 (the default) skips deviation entirely.
	BaselineSamples int

	// Anomaly, when non-nil, turns on anomaly detection: each response is
	// scored against the baseline and against the run's own population, and
	// (when no explicit Matchers are set) the score replaces "keep everything"
	// as the gate. Detection retains response bodies until the run ends so it
	// can rescore against the finished population.
	Anomaly *AnomalyConfig

	// AutoCalibrate learns the target's wildcard/catch-all response signature
	// from a few improbable probe values and suppresses matching results. This
	// is the primitive's one concession to the catch-all FP problem; it never
	// promotes a result to a finding, only demotes noise.
	AutoCalibrate bool

	Client      *gohttp.Client
	NoRedirects bool
	ExcerptCap  int

	// Sender, when non-nil, replaces the default replay.SendRaw transport for
	// every send (baseline, calibration probes, and each payload variant). It
	// lets the caller route the exact request bytes through an external engine
	// (the Burp bridge) that preserves malformed requests. Must be safe for
	// concurrent use — the engine sends from up to Concurrency goroutines. When
	// set, Client is not required.
	Sender func(context.Context, []byte) *replay.Summary

	Concurrency int
	DelayMs     int

	// OnResult, if set, is called once per send as results complete. It is
	// invoked from multiple goroutines; the callback must be safe to call
	// concurrently (the CLI serializes it behind a mutex).
	OnResult func(Result)

	// OnMatch, if set, is called only for results that pass the matcher/filter
	// gate, with the exact request bytes that were sent — Result carries only
	// signals, so this is how a caller recovers a matched request (e.g. to hand
	// it to Burp's Organizer). Invoked on the same serialized path as OnResult;
	// keep it cheap (append, don't do blocking I/O here).
	OnMatch func(r Result, rawRequest []byte)
}

type MatchMode int

type Matchers = Criteria

type NumPredicate struct {
	// contains filtered or unexported fields
}

type NumPredicates []NumPredicate

type Overrides struct {
	Method      string   // replaces the request-line verb
	Headers     []string // "Name: value", added or replaced
	Body        string   // replaces the body, refreshing Content-Length
	QueryAppend string   // appended to the request-line query string (curl's -G)
}

type Position struct {
	// Name identifies the position: the parameter/header/cookie name for
	// insertion points, the keyword for markers, or "method".
	Name string
	// Label is a stable, human/agent-readable position type, e.g.
	// "URL_PARAM", "HEADER", "COOKIE", "MARKER", "METHOD".
	Label string
	// Base is the original value at this position (empty for markers/method).
	Base string
	// contains filtered or unexported fields
}

type Report struct {
	Baseline   Baseline `json:"baseline"`
	Sent       int      `json:"sent"`
	Matched    int      `json:"matched"`
	Calibrated int      `json:"calibrated"`
	Errors     int      `json:"errors"`

	// Anomalies are the results the --anomaly detector flagged, scored
	// against the completed population and sorted most-interesting first.
	// Empty when detection is off.
	Anomalies []Result `json:"anomalies,omitempty"`
	// AnomaliesElided counts anomalies dropped by the report cap.
	AnomaliesElided int `json:"anomalies_elided,omitempty"`
}

type Result struct {
	Position     string `json:"position"`
	PositionType string `json:"position_type"`
	Payload      string `json:"payload"`

	Status      int    `json:"status"`
	Length      int    `json:"length"`
	Words       int    `json:"words"`
	Lines       int    `json:"lines"`
	TimeMs      int64  `json:"time_ms"`
	ContentHash string `json:"content_hash,omitempty"`

	// Reflected is true when the payload appears in the response at all —
	// verbatim or in an escaped/encoded form (a cheap, honest signal, not a
	// vulnerability verdict).
	Reflected bool `json:"reflected"`
	// ReflectedRaw narrows that to a verbatim appearance. The distinction is
	// the whole game for injection classes: a payload echoed back HTML-escaped
	// is the application defending itself, and reporting it identically to an
	// unescaped echo is what buries the real signal.
	ReflectedRaw bool `json:"reflected_raw,omitempty"`
	// ReflectedIn names where it appeared: "body", or "header:Location".
	// Header reflection is invisible to body-only checks yet is exactly the
	// signal behind open redirect and response-splitting.
	ReflectedIn []string `json:"reflected_in,omitempty"`

	// Signals vs the baseline response.
	StatusChanged bool `json:"status_changed"`
	LengthDelta   int  `json:"length_delta"`
	// TimeZ is how many baseline standard deviations this response's time sits
	// above the baseline mean. It is what makes a time-based signal
	// expressible without hand-tuning a millisecond threshold per target:
	// --match-time-z 4 means "slower than this endpoint's own jitter
	// explains". Zero when the baseline wasn't sampled enough to have a
	// deviation.
	TimeZ float64 `json:"time_z,omitempty"`

	// AnomalyScore is the --anomaly detector's score for this response; 0
	// when detection is off. AnomalyReasons explains it.
	AnomalyScore   int             `json:"anomaly_score,omitempty"`
	AnomalyReasons []AnomalyReason `json:"anomaly_reasons,omitempty"`

	// Matched is true when the result passed the matcher/filter gate and was
	// not suppressed by auto-calibration — i.e. the caller asked to see it.
	Matched bool `json:"matched"`
	// Calibrated is true when auto-calibration classified the response as a
	// wildcard/catch-all and suppressed it. Surfaced (not hidden) so the
	// agent can tell "filtered by me" from "looked like the catch-all".
	Calibrated bool `json:"calibrated,omitempty"`

	Error string `json:"error,omitempty"`
}

type Selectors struct {
	Mode        string
	NamedPoints []string
	HeaderNames []string
	Keyword     string
}