Documentation
¶
Overview ¶
Package validator scans BadUSB/DuckyScript payloads for patterns that the operator would want to see before the Flipper types them on a real target. The intent is not to *block* payloads (PromptZero is a pentest tool and the full keyboard is the point) but to surface what they do, so the risk gate can ask an informed question.
Severity ladder:
- Critical — irreversible, destructive, or unambiguously malicious (rm -rf /, reverse shells, defender disable).
- Warn — persistence, elevation, sensitive APIs that need intent.
- Info — benign but notable (long typing runs, REM obfuscation).
Findings are line-keyed so the /debug and audit output can point the operator at the exact DuckyScript statement that tripped the rule.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Finding ¶
type Finding struct {
Severity Severity
Rule string // short rule id: "rm_rf_root", "reverse_shell", etc.
Message string // human-facing one-liner
Line int // 1-based line number in the source payload
Excerpt string // the offending line, trimmed, possibly truncated
}
Finding is one rule hit inside a payload.
type Report ¶
Report is the full validation result. The top-level Severity is the highest severity across Findings; an empty report is SeverityInfo.
func Validate ¶
Validate parses a DuckyScript payload and returns the Report. Pass the payload filename (for display) and the raw content. Callers should have already Storage-Read'd the file off the Flipper.
func ValidateEvilPortal ¶ added in v0.3.1
ValidateEvilPortal scans an Evil Portal HTML payload and returns a Report. Findings mirror the BadUSB shape so upstream risk-gating code can treat them uniformly. The report's top-level Severity is the highest individual finding.
The function is deliberately lenient about whitespace and attribute ordering — real operator-authored pages don't always match the canonical shape letter-for-letter, but they must at least carry the four load-bearing pieces (form present, action=/get, method=GET, email+password fields).
func (Report) RenderText ¶
RenderText formats a Report as the human-readable block shown in REPL output and the risk gate prompt. Empty reports render "no findings".
Source Files