"""Pure constants — no I/O, no imports beyond stdlib. This module is the single source of truth for the topic catalog, the difficulty / module maps, and the small strings the backend embeds verbatim in HTTP responses (HTML fallback, terminal help text, etc.). """ import os # --------------------------------------------------------------------------- # # Topic catalog (module key -> human-readable name + category + path) # # --------------------------------------------------------------------------- # MODULE_TOPIC_MAP = { "xss": "ثغرات XSS (Cross-Site Scripting) - هجمات الحقن البرمجي في المتصفح", "sql-injection": "ثغرات SQL Injection - حقن استعلامات خبيثة في قاعدة البيانات", "csrf": "ثغرات CSRF (Cross-Site Request Forgery) - تزوير الطلبات عبر المواقع", "auth-bypass": "ثغرات المصادقة - تجاوز أنظمة تسجيل الدخول", "misconfig": "التكوين الأمني الخاطئ - إعدادات غير آمنة", "packet-analysis": "تحليل حزم الشبكة Network Packet Analysis", "firewall": "جدران الحماية Firewall Configuration", "scanning": "مسح الشبكات Network Scanning", "encryption-basics": "أساسيات التشفير Encryption", "hash-cracking": "كسر الهاش Hash Cracking", "log-analysis": "تحليل سجلات الخادم Log Analysis", "forensics": "الأدلة الرقمية Forensics", } CYBER_SECURITY_TOPICS = { # 1. Web Security "xss": {"name": "ثغرات XSS (Cross-Site Scripting)", "category": "Web Security", "path": "web-security"}, "sql-injection": {"name": "ثغرات SQL Injection", "category": "Web Security", "path": "web-security"}, "csrf": {"name": "ثغرات CSRF (Cross-Site Request Forgery)", "category": "Web Security", "path": "web-security"}, "ssrf": {"name": "ثغرات SSRF (Server-Side Request Forgery)", "category": "Web Security", "path": "web-security"}, "idor": {"name": "ثغرات IDOR (Insecure Direct Object Reference)", "category": "Web Security", "path": "web-security"}, "lfi-rfi": {"name": "ثغرات تضمين الملفات LFI/RFI", "category": "Web Security", "path": "web-security"}, "xxe": {"name": "ثغرات XML External Entity (XXE)", "category": "Web Security", "path": "web-security"}, "command-injection": {"name": "حقن الأوامر البرمجية Command Injection", "category": "Web Security", "path": "web-security"}, # New 10-module set (replaces the 13 above) "sqli": {"name": "ثغرات SQL Injection", "category": "Web Security", "path": "web-security"}, "cmdi": {"name": "حقن الأوامر Command Injection","category": "Web Security", "path": "web-security"}, "auth": {"name": "ثغرات المصادقة Auth Flaws", "category": "Web Security", "path": "web-security"}, "upload": {"name": "رفع الملفات الخبيثة Upload", "category": "Web Security", "path": "web-security"}, # 2. Network Security "packet-analysis": {"name": "تحليل حزم الشبكات Packet Analysis", "category": "Network Security", "path": "network-security"}, "firewall": {"name": "إعدادات وجدران الحماية Firewall", "category": "Network Security", "path": "network-security"}, "scanning": {"name": "مسح وتفحص الشبكات Network Scanning", "category": "Network Security", "path": "network-security"}, "mitm": {"name": "هجمات رجل في المنتصف MITM Attacks", "category": "Network Security", "path": "network-security"}, "dns-poisoning": {"name": "تسميم سجلات الـ DNS", "category": "Network Security", "path": "network-security"}, # 3. Cryptography "encryption-basics": {"name": "أساسيات التشفير وفك الترميز", "category": "Cryptography", "path": "cryptography"}, "hash-cracking": {"name": "كسر شفرات الهاش Hash Cracking", "category": "Cryptography", "path": "cryptography"}, "rsa-aes": {"name": "خوارزميات التشفير المتقدمة RSA/AES", "category": "Cryptography", "path": "cryptography"}, "steganography": {"name": "إخفاء المعلومات في الوسائط Steganography", "category": "Cryptography", "path": "cryptography"}, # 4. Reverse Engineering & Binaries "binary-analysis": {"name": "تحليل الملفات الثنائية Binary Analysis", "category": "Reverse Engineering", "path": "reverse-engineering"}, "assembly-cracking": {"name": "هندسة الأكواد العكسية وقراءة الأسمبلي", "category": "Reverse Engineering", "path": "reverse-engineering"}, # 5. OS & Systems Security "linux-privesc": {"name": "تصعيد الصلاحيات في أنظمة Linux", "category": "Systems Security", "path": "systems-security"}, "windows-privesc": {"name": "تصعيد الصلاحيات في أنظمة Windows", "category": "Systems Security", "path": "systems-security"}, "active-directory": {"name": "اختراق وإدارة بيئة الـ Active Directory", "category": "Systems Security", "path": "systems-security"}, # 6. Mobile Security "android-ios": {"name": "أمن تطبيقات الهواتف الذكية Android/iOS", "category": "Mobile Security", "path": "mobile-security"}, # 7. Cloud Security "cloud-config": {"name": "أمن الخدمات السحابية وتهيئة الحاويات Docker/Kubernetes", "category": "Cloud Security", "path": "cloud-security"}, # 8. Digital Forensics & Log Analysis "log-analysis": {"name": "تحليل سجلات الخادم والأنظمة Log Analysis", "category": "Digital Forensics", "path": "forensics"}, "memory-forensics": {"name": "تحليل الذاكرة العشوائية Memory Forensics", "category": "Digital Forensics", "path": "forensics"}, # 9. Code Fixing (Blue Team) "code-fixing": {"name": "تصحيح الكود المصاب بثغرات أمنية", "category": "تصحيح الكود (Code Fixing)", "path": "code-fixing"}, "web-security": {"name": "تصحيح الكود المصاب بثغرات أمنية", "category": "تصحيح الكود (Code Fixing)", "path": "code-fixing"}, "systems-security": {"name": "تصحيح الكود المصاب بثغرات أمنية", "category": "تصحيح الكود (Code Fixing)", "path": "code-fixing"}, # 10. Vulnerability Hunter (Blue Team) "vulnerability-hunter": {"name": "صياد الثغرات Vulnerability Hunter", "category": "Vulnerability Hunter", "path": "vulnerability-hunter"}, # 11. Web Exploitation (Red Team) "web-exploitation": {"name": "استغلال تطبيقات الويب", "category": "Web Exploitation", "path": "web-exploitation"}, "xss": {"name": "ثغرات XSS", "category": "Web Exploitation", "path": "web-exploitation"}, "sqli": {"name": "ثغرات SQL Injection", "category": "Web Exploitation", "path": "web-exploitation"}, "csrf": {"name": "ثغرات CSRF", "category": "Web Exploitation", "path": "web-exploitation"}, "ssrf": {"name": "ثغرات SSRF", "category": "Web Exploitation", "path": "web-exploitation"}, "idor": {"name": "ثغرات IDOR", "category": "Web Exploitation", "path": "web-exploitation"}, "lfi": {"name": "ثغرات LFI/RFI", "category": "Web Exploitation", "path": "web-exploitation"}, "xxe": {"name": "ثغرات XXE", "category": "Web Exploitation", "path": "web-exploitation"}, "cmdi": {"name": "حقن الأوامر", "category": "Web Exploitation", "path": "web-exploitation"}, "auth": {"name": "ثغرات المصادقة", "category": "Web Exploitation", "path": "web-exploitation"}, "upload": {"name": "رفع الملفات", "category": "Web Exploitation", "path": "web-exploitation"}, } TOPIC_KEYWORDS = { "xss": ["xss", "cross-site", "حقن نصوص", "innerHTML", "script", "تعليق", "textContent"], "sql-injection": ["sql", "injection", "استعلام", "قاعدة بيانات", "database", "query", "select", "union"], "csrf": ["csrf", "forgery", "تزوير الطلبات", "طلب عبر المواقع", "token", "رمز الحماية"], "ssrf": ["ssrf", "server-side request", "تزوير الطلب من جانب الخادم", "طلب داخلي", "fetch"], "idor": ["idor", "direct object", "معرف", "رابط مباشر", "projectId", "userId", "OID"], "lfi-rfi": ["lfi", "rfi", "تضمين", "ملفات", "include", "file inclusion"], "xxe": ["xxe", "xml", "external entity", "كيان خارجي", "entity"], "command-injection": ["command", "أوامر", "exec", "system", "حقن الأوامر"], "packet-analysis": ["packet", "حزم", "شبكة", "pcap", "wireshark", "تحليل حزم"], "firewall": ["firewall", "جدار حماية", "جدران حماية", "قواعد المرور", "port", "منفذ"], "scanning": ["scan", "مسح", "فحص شبكات", "nmap", "منفذ مفتوح", "ports"], "mitm": ["mitm", "رجل في المنتصف", "منصف", "تسميم", "arp poisoning", "dns poisoning"], "dns-poisoning": ["dns", "poisoning", "تسميم سجلات", "نظام أسماء النطاقات"], "encryption-basics": ["encryption", "تشفير", "فك ترميز", "base64", "rot13", "caesar", "cipher"], "hash-cracking": ["hash", "هاش", "md5", "sha", "cracking", "كسر"], "rsa-aes": ["rsa", "aes", "خوارزميات التشفير المتقدمة"], "steganography": ["steganography", "إخفاء", "وسائط", "صورة", "ملف مخفي"], "binary-analysis": ["binary", "ثنائي", "ملف ثنائي", "قراءة الملفات الثنائية"], "assembly-cracking": ["assembly", "أسمبلي", "عكسي", "هندسة عكسية"], "linux-privesc": ["linux", "صلاحيات root", "تصعيد", "privilege escalation"], "windows-privesc": ["windows", "صلاحيات", "تصعيد", "administrator"], "active-directory": ["active directory", "دليل نشط", "kerberos", "domain controller"], "android-ios": ["android", "ios", "هاتف", "تطبيق ذكي", "موبايل"], "cloud-config": ["cloud", "docker", "kubernetes", "سحابية", "حاويات"], "log-analysis": ["log", "سجل", "سجلات", "خادم", "تحليل سجلات"], "memory-forensics": ["memory", "ذاكرة عشوائية", "forensics", "volatility"], } # Web exploitation module set (Red Team offensive) — used by # app.core.module_router.challenge_type_for_module. WEB_EXPLOIT_MODULES = { "xss", "sqli", "csrf", "ssrf", "idor", "lfi-rfi", "xxe", "cmdi", "auth", "upload", } # --------------------------------------------------------------------------- # # Embedded HTML / text the backend serves when AI generation fails # # --------------------------------------------------------------------------- # FALLBACK_HTML = """

🔐 منصة APEX للتدريب

بيئة التدريب التفاعلية جاهزة. اتبع التعليمات في لوحة المهام على اليمين لإكمال التحدي.

""" HELP_TEXT = """الأوامر الأساسية (تعمل دائماً): ls, cat , pwd, echo , whoami, clear, help sha256sum , md5sum , sha1sum base64 [-d] ترميز/فك Base64 xxd عرض hex tr SET1 SET2 استبدال أحرف الأدوات الخارجية (مفعّلة لهذا التحدي): انظر whitelist في Cheat Sheet. مثال: python -c "print('hello')" openssl enc -d -aes-256-cbc -in f.enc -k SECRET """ # --------------------------------------------------------------------------- # # Certificate system tuning # # --------------------------------------------------------------------------- # CERT_REQUIRED_COMPLETIONS = 50 CERT_VERIFY_BASE_URL = os.environ.get("CERT_VERIFY_BASE_URL", "").rstrip("/")