backend/scanners/__init__.py

"""
__init__.py — Scanner pipeline dispatcher.
Maps scan_type -> ordered list of scanner module classes.
"""
from .headers_scanner          import HeadersScanner
from .nmap_scanner             import NmapScanner
from .sslyze_scanner           import SslyzeScanner
from .tech_scanner             import TechScanner
from .whois_scanner            import WhoisScanner
from .fuzzer_scanner           import FuzzerScanner
from .path_traversal_scanner   import PathTraversalScanner
from .nikto_scanner            import NiktoScanner
from .subdomain_scanner        import SubdomainScanner
from .waf_scanner              import WafScanner
from .cors_scanner             import CorsScanner
from .robots_scanner           import RobotsScanner
from .directory_scanner        import DirectoryScanner
from .zap_scanner              import ZapScanner
from .nuclei_scanner           import NucleiScanner
from .api_scanner              import ApiScanner
from .secrets_scanner          import SecretsScanner
from .cloud_scanner            import CloudScanner
from .cve_scanner              import CveScanner
from .xxe_scanner              import XxeScanner
from .ssrf_scanner             import SsrfScanner
from .jwt_scanner              import JwtScanner
from .idor_scanner             import IdorScanner
from .graphql_scanner          import GraphqlScanner
from .race_condition_scanner   import RaceConditionScanner
from .request_smuggling_scanner import RequestSmugglingScanner
from .business_logic_scanner   import BusinessLogicScanner
from .sql_injection_scanner    import SqlInjectionScanner
from .websocket_scanner        import WebsocketScanner
from .rate_limiting_scanner    import RateLimitingScanner
from .whatweb_scanner          import WhatWebScanner
from .dns_security_scanner     import DNSSecurityScanner
from .custom_website_scanner   import CustomWebsiteScanner
# ── Batch 1 (added previously) ────────────────────────────────────────────
from .ssti_scanner             import SstiScanner
from .open_redirect_scanner    import OpenRedirectScanner
from .cookie_scanner           import CookieScanner
from .csrf_scanner             import CsrfScanner
from .lfi_scanner              import LfiScanner
# ── Batch 2 (new) ─────────────────────────────────────────────────────────
from .auth_scanner             import AuthScanner
from .session_scanner          import SessionScanner
from .csp_scanner              import CspScanner
from .clickjacking_scanner     import ClickjackingScanner
from .git_exposure_scanner     import GitExposureScanner
from .dependency_scanner       import DependencyScanner
from .attack_surface_scanner   import AttackSurfaceScanner
from .compliance_scanner       import ComplianceScanner
from .ai_remediation_scanner   import AiRemediationScanner

# ── Batch 3: High Priority Gaps ───────────────────────────────────────────
from .subdomain_takeover_scanner import SubdomainTakeoverScanner
from .host_header_scanner      import HostHeaderScanner
from .deserialization_scanner  import DeserializationScanner
from .command_injection_scanner import CommandInjectionScanner
from .crlf_scanner             import CrlfScanner
from .cms_scanner              import CmsScanner
from .file_upload_scanner      import FileUploadScanner

# ── Batch 4: Medium Priority ──────────────────────────────────────────────
from .nosql_scanner             import NosqlScanner
from .cache_poisoning_scanner   import CachePoisoningScanner
from .oauth_scanner             import OauthScanner
from .prototype_pollution_scanner import PrototypePollutionScanner
from .source_map_scanner        import SourceMapScanner
from .swagger_scanner           import SwaggerScanner
from .email_security_scanner    import EmailSecurityScanner
from .xpath_scanner             import XpathScanner

# ── Batch 5: Lower Priority ───────────────────────────────────────────────
from .broken_link_scanner       import BrokenLinkScanner
from .sri_scanner               import SriScanner
from .mfa_bypass_scanner        import MfaBypassScanner
from .mass_assignment_scanner   import MassAssignmentScanner
from .http_pollution_scanner    import HttpPollutionScanner
from .dns_rebinding_scanner     import DnsRebindingScanner
from .exif_scanner              import ExifScanner
from .tls_weakness_scanner      import TlsWeaknessScanner
from .cert_transparency_scanner import CertTransparencyScanner
from .redos_scanner             import RedosScanner

# ── Batch 6: New Distinct Attack Vectors ─────────────────────────────────
from .dom_xss_scanner           import DomXssScanner
from .saml_scanner              import SamlScanner
from .web_cache_deception_scanner import WebCacheDeceptionScanner
from .http_method_tampering_scanner import HttpMethodTamperingScanner
from .bypass_403_scanner        import Bypass403Scanner
from .ldap_scanner              import LdapScanner
from .blind_xss_scanner         import BlindXssScanner
from .admin_panel_scanner       import AdminPanelScanner

# ── Batch 7: Client-Side & Logic Gaps ────────────────────────────────────
from .csti_scanner              import CstiScanner
from .postmessage_scanner       import PostmessageScanner
from .password_reset_scanner    import PasswordResetScanner
from .cache_control_scanner     import CacheControlScanner
from .second_order_scanner      import SecondOrderScanner
from .webrtc_leak_scanner       import WebrtcLeakScanner
from .service_worker_scanner    import ServiceWorkerScanner

# ── Batch 8: Advanced Attack Techniques ──────────────────────────────────
from .http2_desync_scanner       import Http2DesyncScanner
from .js_supply_chain_scanner    import JsSupplyChainScanner
from .api_security_scanner       import ApiSecurityScanner

# ---------------------------------------------------------------------------
# Pipeline definitions — order matters, runs top-to-bottom
# AiRemediationScanner always runs LAST (post-processor)
# ---------------------------------------------------------------------------
PIPELINES = {
    # ── Quick: fast, non-intrusive checks (~2 min) ─────────────────────────
    "Quick": [
        ("headers",       HeadersScanner,      {}),
        ("nmap",          NmapScanner,         {"mode": "quick"}),
        ("sslyze",        SslyzeScanner,       {}),
        ("tech",          TechScanner,         {}),
        ("whois",         WhoisScanner,        {}),
        ("waf",           WafScanner,          {}),
        ("dns_security",  DNSSecurityScanner,  {}),
        ("cookies",       CookieScanner,       {}),
        ("csp",           CspScanner,          {}),
        ("clickjacking",  ClickjackingScanner, {}),
        ("git_exposure",  GitExposureScanner,  {}),
        ("compliance",    ComplianceScanner,   {}),
        ("ai_remediation",AiRemediationScanner,{}),
    ],

    # ── Advanced: core vulnerability audit (~10-20 min) ────────────────────────
    "Advanced": [
        ("headers",          HeadersScanner,        {}),
        ("nmap",             NmapScanner,           {"mode": "standard"}),
        ("sslyze",           SslyzeScanner,         {}),
        ("tech",             TechScanner,           {}),
        ("whois",            WhoisScanner,          {}),
        ("waf",              WafScanner,            {}),
        ("dns_security",     DNSSecurityScanner,    {}),
        ("cookies",          CookieScanner,         {}),
        ("csp",              CspScanner,            {}),
        ("clickjacking",     ClickjackingScanner,   {}),
        ("git_exposure",     GitExposureScanner,    {}),
        ("compliance",       ComplianceScanner,     {}),
        ("whatweb",          WhatWebScanner,        {}),
        ("cors",             CorsScanner,           {}),
        ("robots",           RobotsScanner,         {}),
        ("auth",             AuthScanner,           {}),
        ("session",          SessionScanner,        {}),
        ("dependency",       DependencyScanner,     {}),
        ("fuzzer",           FuzzerScanner,         {}),
        ("path_traversal",   PathTraversalScanner,  {}),
        ("lfi",              LfiScanner,            {}),
        ("nikto",            NiktoScanner,          {}),
        ("sql_injection",    SqlInjectionScanner,   {}),
        ("subdom",           SubdomainScanner,      {}),
        ("custom_website",   CustomWebsiteScanner,  {}),
        ("attack_surface",   AttackSurfaceScanner,  {}),
        ("api",              ApiScanner,            {}),
        ("cloud",            CloudScanner,          {}),
        ("secrets",          SecretsScanner,        {}),
        ("cve",              CveScanner,            {}),
        ("ssrf",             SsrfScanner,           {}),
        ("jwt",              JwtScanner,            {}),
        ("csrf",             CsrfScanner,           {}),
        ("open_redirect",    OpenRedirectScanner,   {}),
        ("rate_limiting",    RateLimitingScanner,   {}),
        ("ai_remediation",   AiRemediationScanner,  {}),
    ],

    # ── Deep: exhaustive + ZAP active (~2 h) ──────────────────────────────
    "Deep": [
        ("headers",           HeadersScanner,        {}),
        ("nmap",              NmapScanner,           {"mode": "deep"}),
        ("sslyze",            SslyzeScanner,         {}),
        ("tech",              TechScanner,           {}),
        ("whatweb",           WhatWebScanner,        {}),
        ("whois",             WhoisScanner,          {}),
        ("dns_security",      DNSSecurityScanner,    {}),
        ("cookies",           CookieScanner,         {}),
        ("csp",               CspScanner,            {}),
        ("clickjacking",      ClickjackingScanner,   {}),
        ("cors",              CorsScanner,           {}),
        ("robots",            RobotsScanner,         {}),
        ("directory",         DirectoryScanner,      {}),
        ("waf",               WafScanner,            {}),
        ("auth",              AuthScanner,           {}),
        ("session",           SessionScanner,        {}),
        ("git_exposure",      GitExposureScanner,    {}),
        ("dependency",        DependencyScanner,     {}),
        ("fuzzer",            FuzzerScanner,         {"red_team": True}),
        ("path_traversal",    PathTraversalScanner,  {}),
        ("lfi",               LfiScanner,            {}),
        ("nikto",             NiktoScanner,          {}),
        ("subdom",            SubdomainScanner,      {}),
        ("custom_website",    CustomWebsiteScanner,  {}),
        ("attack_surface",    AttackSurfaceScanner,  {}),
        ("api",               ApiScanner,            {}),
        ("cloud",             CloudScanner,          {}),
        ("secrets",           SecretsScanner,        {}),
        ("cve",               CveScanner,            {}),
        ("xxe",               XxeScanner,            {}),
        ("ssrf",              SsrfScanner,           {}),
        ("jwt",               JwtScanner,            {}),
        ("ssti",              SstiScanner,           {}),
        ("csrf",              CsrfScanner,           {}),
        ("open_redirect",     OpenRedirectScanner,   {}),
        ("idor",              IdorScanner,           {}),
        ("graphql",           GraphqlScanner,        {}),
        ("race_condition",    RaceConditionScanner,  {}),
        ("request_smuggling", RequestSmugglingScanner,{}),
        ("business_logic",    BusinessLogicScanner,  {}),
        ("websocket",         WebsocketScanner,      {}),
        ("rate_limiting",     RateLimitingScanner,   {}),
        ("subdomain_takeover",SubdomainTakeoverScanner,{}),
        ("host_header",       HostHeaderScanner,     {}),
        ("deserialization",   DeserializationScanner,{}),
        ("command_injection", CommandInjectionScanner,{}),
        ("sql_injection",     SqlInjectionScanner,   {}),
        ("crlf",              CrlfScanner,           {}),
        ("cms",               CmsScanner,            {}),
        ("file_upload",       FileUploadScanner,     {}),
        ("nosql",             NosqlScanner,          {}),
        ("cache_poisoning",   CachePoisoningScanner, {}),
        ("oauth",             OauthScanner,          {}),
        ("prototype_pollution",PrototypePollutionScanner,{}),
        ("source_map",        SourceMapScanner,      {}),
        ("swagger",           SwaggerScanner,        {}),
        ("email_security",    EmailSecurityScanner,  {}),
        ("xpath",             XpathScanner,          {}),
        ("broken_link",       BrokenLinkScanner,     {}),
        ("sri",               SriScanner,            {}),
        ("mfa_bypass",        MfaBypassScanner,      {}),
        ("mass_assignment",   MassAssignmentScanner, {}),
        ("http_pollution",    HttpPollutionScanner,  {}),
        ("dns_rebinding",     DnsRebindingScanner,   {}),
        ("exif",              ExifScanner,           {}),
        ("tls_weakness",      TlsWeaknessScanner,    {}),
        ("cert_transparency", CertTransparencyScanner,{}),
        ("redos",             RedosScanner,          {}),
        ("dom_xss",           DomXssScanner,         {}),
        ("saml",              SamlScanner,           {}),
        ("cache_deception",   WebCacheDeceptionScanner,{}),
        ("http_methods",      HttpMethodTamperingScanner,{}),
        ("bypass_403",        Bypass403Scanner,      {}),
        ("ldap",              LdapScanner,           {}),
        ("blind_xss",         BlindXssScanner,       {}),
        ("admin_panel",       AdminPanelScanner,     {}),
        ("csti",              CstiScanner,           {}),
        ("postmessage",       PostmessageScanner,    {}),
        ("password_reset",    PasswordResetScanner,  {}),
        ("cache_control",     CacheControlScanner,   {}),
        ("second_order",      SecondOrderScanner,    {}),
        ("webrtc",            WebrtcLeakScanner,     {}),
        ("service_worker",    ServiceWorkerScanner,  {}),
        ("compliance",        ComplianceScanner,     {}),
        ("nuclei",            NucleiScanner,         {"severity": "critical,high,medium,low"}),
        ("zap",               ZapScanner,            {"mode": "active"}),
        # ── Advanced Techniques ────────────────────────────────
        ("h2_desync",         Http2DesyncScanner,    {}),
        ("js_supply_chain",   JsSupplyChainScanner,  {}),
        ("api_security",      ApiSecurityScanner,    {}),
        ("ai_remediation",    AiRemediationScanner,  {}),   # LAST
    ],

    # Legacy aliases
    "Standard": None,
    "Full":     None,
    "SSL":      None,
    "OWASP":    None,
    "Port":     None,
}

# Resolve aliases
PIPELINES["Standard"] = PIPELINES["Advanced"]
PIPELINES["Full"]     = PIPELINES["Advanced"]
PIPELINES["OWASP"]    = PIPELINES["Advanced"]
PIPELINES["Port"]     = [("nmap", NmapScanner, {"mode": "standard"})]
PIPELINES["SSL"]      = [
    ("sslyze",     SslyzeScanner,  {}),
    ("headers",    HeadersScanner, {}),
    ("csp",        CspScanner,     {}),
    ("clickjacking",ClickjackingScanner, {}),
]


CRAWLER_SCANNERS = frozenset({
    "fuzzer", "path_traversal", "lfi", "ssti",
    "open_redirect", "csrf", "attack_surface",
    "sql_injection",
})

SCAN_TYPE_DEFAULT_DEPTH = {
    "Quick":    3,
    "Advanced": 10,
    "Deep":     20,
    "Standard": 10,
}


# ---------------------------------------------------------------------------
# Phase definitions — controls execution order within each scan type.
# Each phase runs its modules CONCURRENTLY, phases run SEQUENTIALLY.
# AI remediation is always last; heavy tools (ZAP/Nuclei) are second-to-last.
# ---------------------------------------------------------------------------
SCAN_PHASES = {
    # ── Quick (2 phases, ~2 min total) ─────────────────────────────────────
    "Quick": [
        {
            "name": "Phase 1: Recon & Headers",
            "keys": {"headers", "nmap", "sslyze", "tech", "whois", "waf",
                     "dns_security", "git_exposure"},
        },
        {
            "name": "Phase 2: Config & Policy",
            "keys": {"cookies", "csp", "clickjacking", "compliance", "ai_remediation"},
        },
    ],

    # ── Advanced (4 phases, ~10-20 min total) ───────────────────────────────
    "Advanced": [
        {
            "name": "Phase 1: Recon & Fingerprinting",
            "keys": {"headers", "nmap", "sslyze", "tech", "whatweb", "whois",
                     "waf", "dns_security", "git_exposure", "cloud", "cve",
                     "robots", "cors"},
        },
        {
            "name": "Phase 2: Auth & Session",
            "keys": {"auth", "session", "cookies", "csp", "clickjacking",
                     "compliance", "dependency", "jwt", "csrf"},
        },
        {
            "name": "Phase 3: Injection & Crawl",
            "keys": {"sql_injection", "ssrf", "fuzzer", "path_traversal",
                     "lfi", "nikto", "open_redirect", "subdom",
                     "custom_website", "attack_surface", "api",
                     "secrets", "rate_limiting"},
        },
        {
            "name": "Phase 4: AI Analysis",
            "keys": {"ai_remediation"},
        },
    ],

    # ── Deep (8 phases, ~2h total) ─────────────────────────────────────────
    "Deep": [
        {
            "name": "Phase 1: Recon & Fingerprinting",
            "keys": {"headers", "nmap", "sslyze", "tech", "whatweb", "whois",
                     "dns_security", "waf", "cloud", "cve", "cert_transparency",
                     "robots", "tls_weakness", "exif", "source_map",
                     "email_security", "sri"},
        },
        {
            "name": "Phase 2: Auth, Session & Config",
            "keys": {"auth", "session", "cookies", "csp", "clickjacking",
                     "git_exposure", "dependency", "compliance", "cors",
                     "jwt", "oauth", "saml", "mfa_bypass", "password_reset"},
        },
        {
            "name": "Phase 3: Injection Attacks",
            "keys": {"sql_injection", "xxe", "ssrf", "ssti", "command_injection",
                     "nosql", "xpath", "ldap", "crlf", "lfi",
                     "path_traversal", "deserialization", "redos"},
        },
        {
            "name": "Phase 4: Crawl, Directory & Discovery",
            "keys": {"fuzzer", "directory", "subdom", "subdomain_takeover",
                     "attack_surface", "custom_website", "api", "swagger",
                     "nikto", "broken_link", "admin_panel", "cms",
                     "graphql", "api_security"},
        },
        {
            "name": "Phase 5: Logic, Access Control & Rate",
            "keys": {"idor", "csrf", "open_redirect", "business_logic",
                     "race_condition", "rate_limiting", "mass_assignment",
                     "bypass_403", "request_smuggling", "websocket",
                     "file_upload", "second_order"},
        },
        {
            "name": "Phase 6: Client-Side & Protocol",
            "keys": {"host_header", "http_methods", "http_pollution",
                     "cache_poisoning", "cache_deception", "cache_control",
                     "dom_xss", "blind_xss", "csti", "postmessage",
                     "prototype_pollution", "dns_rebinding", "h2_desync",
                     "js_supply_chain", "service_worker", "webrtc",
                     "secrets"},
        },
        {
            "name": "Phase 7: Heavy Scanners (ZAP & Nuclei)",
            "keys": {"nuclei", "zap"},
        },
        {
            "name": "Phase 8: AI Analysis",
            "keys": {"ai_remediation"},
        },
    ],
}

# Resolve aliases for phases
SCAN_PHASES["Standard"] = SCAN_PHASES["Advanced"]
SCAN_PHASES["Full"]     = SCAN_PHASES["Advanced"]
SCAN_PHASES["OWASP"]    = SCAN_PHASES["Advanced"]
SCAN_PHASES["SSL"]      = [
    {"name": "Phase 1: SSL/TLS Checks",
     "keys": {"sslyze", "headers", "csp", "clickjacking"}},
]
SCAN_PHASES["Port"] = [
    {"name": "Phase 1: Port Scan",
     "keys": {"nmap"}},
]


def get_phases(scan_type: str) -> list:
    """Return the ordered phase list for the given scan type."""
    return SCAN_PHASES.get(scan_type, SCAN_PHASES["Advanced"])


def get_pipeline(scan_type: str) -> list:
    """Return the scanner pipeline for the given scan_type string."""
    return PIPELINES.get(scan_type, PIPELINES["Advanced"])


def apply_scan_options(pipeline: list, scan_type: str, scan_options: dict | None) -> list:
    """Merge user scan options (crawl depth, exclusions, red-team) into pipeline kwargs."""
    options     = scan_options or {}
    crawl_depth = options.get("crawl_depth")
    if crawl_depth is None:
        crawl_depth = SCAN_TYPE_DEFAULT_DEPTH.get(scan_type, 10)
    else:
        crawl_depth = max(1, min(int(crawl_depth), 20))

    exclude_paths   = options.get("exclude_paths") or []
    enable_red_team = options.get("enable_red_team", False)

    updated = []
    for name, cls, kwargs in pipeline:
        merged = dict(kwargs)
        if name in CRAWLER_SCANNERS:
            merged["max_depth"]     = crawl_depth
            merged["exclude_paths"] = exclude_paths
        if name == "fuzzer" and (enable_red_team or merged.get("red_team")):
            merged["red_team"] = True
        updated.append((name, cls, merged))
    return updated


def build_scanner(name, cls, kwargs, scan_id, target, domain, auth_headers=None):
    """Instantiate a scanner with the correct kwargs."""
    return cls(scan_id=scan_id, target=target, domain=domain,
               auth_headers=auth_headers, **kwargs)