## https://sploitus.com/exploit?id=3A85F4ED-A4C4-5FC1-ADA8-30E61D948C60
# CavalryHive
Autonomous web-security assessment toolkit for **authorized** penetration
testing, bug bounty hunting, and CTF work.
## Authorization & Ethics
CavalryHive is built exclusively for assessing systems you **own** or have
**explicit written permission** to test. Acceptable uses include:
- Your own infrastructure and applications.
- Targets covered by a bug bounty program's published scope document, within
its stated rules of engagement.
- CTF platforms, lab environments (such as the bundled GoatShop target), and
engagements covered by a signed authorization letter.
Unauthorized scanning of third-party systems is illegal in most
jurisdictions and violates this project's intent. The tool sends active
requests (including injection payloads) to whatever target you point it at;
you are responsible for ensuring that target is in scope. Rate limiting is
built in; respect program-specific constraints regardless.
## Components
| Path | Purpose |
|------|---------|
| `cavalryhive/recon.py` | Alive-check, header harvest, robots/sitemap parsing, depth-limited BFS crawl, form/param discovery |
| `cavalryhive/learn.py` | Fingerprinting + persistent cross-run target profiles (`~/.cavalryhive/profiles/.json`) |
| `cavalryhive/cve.py` | CVE lookup via OSV.dev and NVD API 2.0 with fallback and dedupe |
| `cavalryhive/checks/` | Vulnerability check plugins (XSS, open redirect, path traversal, SQLi, CORS, security headers, exposed files, GraphQL introspection) |
| `cavalryhive/deep.py` | Multi-round persistence loop until finding convergence |
| `cavalryhive/capture.py` | Playwright PoC evidence: full-page screenshot + video with dialog proof |
| `cavalryhive/report.py` | Markdown report generation with CVSS v3.1 scoring |
## Self-learning and false-positive suppression
`cavalry learn ` builds a profile per host that accumulates across
runs: observed technologies with first-seen dates, endpoint counts, past
findings, and past false positives. Later hunts use this profile to
prioritize checks and adapt payloads (for example, engine-specific SQLi
probes), and to skip anything you marked with `cavalry fp `.
Every finding carries recorded evidence: the request sent, a response
excerpt, the matched signature, and -- where applicable -- a differential
baseline. Confidence is computed from evidence strength; low-confidence
observations are quarantined under "needs review" instead of being reported.
## Usage
```bash
# demo target (deliberately vulnerable, local only)
.venv/bin/python -m uvicorn apps.goatshop.app:app --port 8321
cavalry learn http://127.0.0.1:8321 # fingerprint + build profile
cavalry recon http://127.0.0.1:8321 # map endpoints/forms/params
cavalry hunt http://127.0.0.1:8321 # single assessment pass
cavalry deep http://127.0.0.1:8321 --max-rounds 5 # loop until convergence
cavalry cve search starlette # OSV.dev + NVD advisory lookup
cavalry cve match http://127.0.0.1:8321 # advisories for learned technologies
cavalry poc "" --finding-id CH-XXXX # screenshot + video proof
cavalry report # markdown report from latest session
cavalry session # inspect current session state
cavalry fp CH-XXXX # mark a finding as false positive
```
## The GoatShop demo target
`apps/goatshop/` contains a deliberately vulnerable FastAPI application so
every check can be verified offline against real exploitable flaws. The full
inventory of planted flaws (and two safe control endpoints that must NOT be
flagged) lives in `apps/goatshop/FLOWS.md`. Never expose GoatShop to an
untrusted network.
A report generated from a live run against GoatShop is committed at
`docs/sample-report.md`, with captured browser evidence under
`reports/evidence/`.
## Development
```bash
python3 -m venv .venv && .venv/bin/pip install -e ".[dev,target,capture]"
.venv/bin/python -m pytest tests/ -q
```
Unit tests are network-free; check logic is exercised against canned HTTP
responses via a mock transport. GoatShop tests assert each planted flaw is
actually present and each safe control is actually safe.
## Limitations
- Checks are evidence-driven but heuristic; manually verify every finding
before acting on it.
- CVE lookups require network access and degrade gracefully (exit code 2)
when offline.
- PoC video capture requires the optional `playwright` dependency with
Chromium installed; without it, capture falls back to saving raw responses.