Kirankk7/friday-recon

# friday-recon  一个**本地优先、AI 辅助的侦察与 bug-bounty 工具包** — [FRIDAY (JARVIS)](https://github.com/Kirankk7/FRIDAY) 助手的 offensive-security 核心， 提取为一个专注且轻量依赖的 CLI。相同的引擎（*Ultron* agent）， 没有 Flask / HUD / 语音。 通过 [Ollama](https://ollama.com) 完全在本地 LLM 上运行 — 无需云端，无需用于推理的 API keys。安装包约 30 MB，无需 GPU。 ## 功能说明 ``` recon nmap (scan diffing) · subfinder · httpx · katana · nuclei intel NVD CVE search · VirusTotal · CVE → asset correlation bug bounty full pipeline → 7-question validation gate (kills noise) → platform-ready PoC report traffic ingest a Burp Suite (Community) HTTP-history export → endpoint/param inventory + auto-tagging (JWT / GraphQL / API / auth-boundary / tech) memory per-target profiles (scans, findings, endpoints, typed intel, evidence) across hunts evidence re-probe a finding → capture confirmed request/response evidence for the report authz auth-matrix (endpoint × principal → BFLA + BOLA) · idor/bola oracle · jwt analyzer confirm OAST out-of-band (ssrf/cmdi/xxe) · headless-browser XSS execution · CORS · subdomain takeover secrets GitHub org/user repo hunt → flag secret-prone files → TruffleHog deep-scan methodology RAG over 87 real bug-bounty / OSINT methodology notes (local TF-IDF, cited) fleet 180+ HackingTool index, gated to ~25 runnable (capability allowlist, offensive blocked) blue-team host monitor: baseline listening ports + processes, flag new/suspicious ``` ## 安装说明 ``` pip install -r requirements.txt ollama pull qwen2.5:7b # local reasoning model # PATH 上的可选 recon binaries: nmap, subfinder, httpx, nuclei, katana # 可选: 用于 180+ HackingTool 集群的 WSL 或 Docker ``` ## 使用说明 ``` # recon python cli.py scan example.com # nmap port scan (with scan diffing) python cli.py recon example.com [--discover] # full pipeline: nmap→subfinder→httpx→nuclei→katana→sitemap # subfinder auto-apexes (www.x.com→x.com); sitemap.xml+robots # paths always in the report; --discover adds ffuf/gobuster brute python cli.py discover example.com # content discovery (ffuf/gobuster), standalone python cli.py spacrawl example.com # render SPA → capture API surface python cli.py crawl example.com # multi-page BFS crawl → parameterized URLs # bug bounty python cli.py bugbounty example.com [--discover] # full hunt → validated PoC report on your Desktop (--discover = +dir-brute) python cli.py proxy --port 8081 # live-capture proxy (browse authed → inventory) python cli.py capture example.com # show the captured endpoint/param inventory python cli.py scan-captured example.com # IDOR/BOLA across captured object-id endpoints python cli.py graphql https://t.com/graphql # GraphQL introspection + privileged-mutation hunt python cli.py idor https://t.com/api/1 --owner userA --attacker userB # read IDOR/BOLA check (owner vs attacker vs anon) python cli.py write-bola https://t.com/api/user/1 --field email --owner userA --attacker userB [--verify-url ] # OPT-IN write-BOLA: attacker mutates owner's field, verify+revert (benign fields only) python cli.py session-set bob # register a principal for authz testing python cli.py sessions # list authz-test sessions python cli.py evidence https://t.com/find # re-probe a finding → capture evidence python cli.py auth-matrix example.com # Auth Matrix: endpoint × principal → BFLA + BOLA (set sessions first) python cli.py jwt # analyze a JWT — alg:none / weak-HS / jku-SSRF / kid / exp / claims (no cracking) python cli.py cors https://t.com # CORS misconfig probe (Origin reflection + credentials) over target + crawled URLs python cli.py takeover sub.example.com # subdomain-takeover check (dangling-service fingerprints; host, comma-list, or @file) python cli.py secrets example.com # scan crawled JS for hard-coded keys + probe exposed files (.git/.env/.DS_Store) python cli.py xss-confirm https://t.com/r # confirm reflected XSS by EXECUTION in a headless browser (candidate→confirmed) python cli.py oast https://t.com --kind ssrf # confirm a BLIND class via an out-of-band callback (ssrf|cmdi|xxe) # F4 执行时间线 (不可变运行记录 → replay → submission package) python cli.py timeline [] # list recent runs, or render one run's stage timeline python cli.py replay [--step full|recon|probe] # rerun a recorded run (active scan) python cli.py package # zip run (timeline+artifacts+report+evidence) → submission # intel python cli.py cve log4j # NVD CVE lookup python cli.py threat-intel 1.2.3.4 # IOC reputation across feeds (IP/domain/URL/hash) python cli.py kb "how do I test for subdomain takeover" # methodology KB (cited) python cli.py playbook "ssrf" # recall attack techniques (proven + KB + PortSwigger) python cli.py ingest-writeup # learn a public bug-bounty writeup → playbook (local) python cli.py ingest-feed # ingest a writeup-index page → learn each article # data / memory python cli.py burp export.xml # ingest Burp Community "Save items" XML python cli.py github-hunt acme # org repo secret hunt python cli.py profile example.com # what we know about a target, across hunts python cli.py targets # list profiled targets python cli.py scope # show in/out-of-scope rules python cli.py scope-setup policy.txt # parse a program policy → set scope python cli.py defensive # blue-team host scan python cli.py wordlist # list bundled wordlists ``` ## 安全态势 这是一个 offensive 工具，因此它自身的攻击面已在 **[THREAT_MODEL.md](THREAT_MODEL.md)** 中公开记录 — 信任边界、攻击者模型（间接 prompt injection 是主要威胁）、控制措施以及带有修复方案的弱点。内置的安全加固包括：通过 **argv 数组（无 shell）** 执行工具，一个 **capability allowlist**（禁止 offensive 类别，无 `--command/--force/--privileged`），以及一个**感知重定向和编码的 SSRF 防护**。 ## 测试 ``` pytest -q # offline (no Ollama/network needed) ``` 每次推送时都会运行 CI（`.github/workflows/test.yml`）。 ## 致谢 基于优秀的开源组件进行的集成/编排工作 — 感谢以下作者： AutoTune 采样 (elder-plinius/G0DM0D3)、SSRF 防护模式 (OpenJarvis)、HackingTool 索引 (Z4nzu/hackingtool via AKCodez)、validation-gate 纪律 (shuvonsec/claude-bug-bounty)， 以及方法论知识包 (SnailSploit/Claude-Red, hack-with-rohit, jivoi/awesome-osint, sidhusec/Rudrascan)。请参阅 `agents/ultron/knowledge/CREDITS.md`。

标签：AI风险缓解, 动态插桩, 安全侦察, 安全规则引擎, 实时处理, 密码管理, 插件系统, 数据泄露, 本地大模型, 自动化利用, 运行时操纵, 逆向工具