mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 00:23:15 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.8 KiB
1.8 KiB
API Reference: IDOR Vulnerability Testing Agent
Dependencies
| Library | Version | Purpose |
|---|---|---|
| requests | >=2.28 | HTTP client for API endpoint testing |
CLI Usage
python scripts/agent.py \
--url https://target.example.com \
--token-a "eyJ..." --token-b "eyJ..." \
--endpoints "/api/v1/users/{id}/profile" "/api/v1/orders/{id}" \
--own-id 101 --other-id 102 \
--output idor_report.json
IDORTester Class
__init__(base_url, user_a_token, user_b_token, verify_ssl)
Creates two requests.Session objects with different Bearer tokens for cross-user testing.
test_horizontal_idor(endpoint_template, own_id, other_id, method) -> dict
Accesses own resource then another user's resource with the same token. IDOR confirmed when both return 200 with different content.
test_vertical_idor(endpoint, method) -> dict
Accesses admin-only endpoints with a regular user token. Status 200 indicates missing authorization.
test_id_enumeration(endpoint_template, id_range, method) -> dict
Iterates over an ID range to discover valid objects. Returns count and sample IDs.
test_write_idor(endpoint_template, other_id, payload) -> dict
Sends PUT with another user's ID to test write-based IDOR. Status 200/201/204 indicates vulnerability.
test_cross_session(endpoint_template, resource_id) -> dict
Compares response hashes between two sessions for the same resource to detect missing authorization checks.
generate_report() -> dict
Returns all accumulated findings with severity assessment.
Output Schema
{
"target": "https://target.example.com",
"total_findings": 2,
"findings": [{"type": "horizontal", "endpoint": "/api/v1/users/{id}/profile", "vulnerable": true}],
"severity": "High"
}