Exploit for kill-chain-vulnerability-scanner

## https://sploitus.com/exploit?id=495259AA-45B4-55E9-9BBC-F811E79CB6A1
# Kill Chain Scanner

A Python-based **automated web application vulnerability scanner** built as a Bachelor thesis project. It combines **SAST (Static Application Security Testing)** with **DAST (Dynamic Application Security Testing)** in a unified kill-chain pipeline to detect and validate security vulnerabilities in Python web applications.

## Features

- **SAST Engine** — AST-based taint analysis to trace user-controlled data from sources to dangerous sinks
  - SQL Injection, XSS, Path Traversal, Command Injection, SSRF, Open Redirect, and more
  - Hardcoded secret detection via regex patterns
  - Severity ranking: `CRITICAL` → `HIGH` → `MEDIUM` → `LOW` → `INFO`
- **Exploitation Engine (DAST)** — Validates SAST findings by actually firing HTTP exploits
  - Three weaponization strategies: `hardcoded` payloads, `template`-based, and `llm`-assisted (via OpenRouter API)
  - Confirms true positives and filters out false positives
- **Hybrid Mode** — Runs SAST then DAST in sequence for a full kill-chain assessment
- **Reports** — Outputs structured JSON and/or visual HTML reports

## Project Structure

```
thesis_Scanner/
├── scanner_tool/
│   ├── killchain/              # Main scanner package
│   │   ├── scanner.py          # SAST engine (AST taint analysis + secret regex)
│   │   ├── exploiter.py        # DAST / exploitation engine
│   │   ├── main.py             # CLI entry point
│   │   ├── models.py           # Vulnerability data models
│   │   ├── report.py           # JSON report builder
│   │   └── report_html.py      # HTML report builder
│   └── killchain_legacy.py     # Earlier prototype (kept for reference)
└── test_targets/               # Intentionally vulnerable apps used for evaluation
    ├── DSVW/                   # Damn Small Vulnerable Web
    ├── django.nv/              # Django.nv (vulnerable Django app)
    ├── vulpy/                  # Vulpy vulnerable Flask app
    ├── pygoat/                 # PyGoat (OWASP vulnerable Python app)
    ├── secure_hr/              # Secure HR app (negative test case)
    └── custom_apps/            # Custom vulnerable apps built for this thesis
```

## Installation

```bash
# Clone the repo (with submodules for test targets)
git clone --recurse-submodules https://github.com/Mostafa-ElShinawi/kill-chain-vulnerability-scanner.git
cd kill-chain-vulnerability-scanner

# (Recommended) Create a virtual environment
python -m venv .venv
source .venv/bin/activate        # Linux/macOS
.venv\Scripts\activate           # Windows

# Install dependencies
pip install -r requirements.txt
```

## Configuration

The LLM-assisted exploitation mode requires an [OpenRouter](https://openrouter.ai/) API key:

```bash
# Set as an environment variable (never hardcode it!)
export OPENROUTER_API_KEY=your_key_here        # Linux/macOS
set OPENROUTER_API_KEY=your_key_here           # Windows CMD
$env:OPENROUTER_API_KEY="your_key_here"        # Windows PowerShell
```

## Usage

```bash
# SAST only — scan a target directory
python -m killchain -t path/to/target -m scan

# DAST only — exploit known findings
python -m killchain -t path/to/target -m exploit --weapon llm

# Hybrid — full kill-chain (SAST + DAST)
python -m killchain -t path/to/target -m hybrid --weapon all

# Save results to JSON and HTML reports
python -m killchain -t path/to/target -m hybrid \
    --report results.json \
    --html-report results.html

# Verbose output for debugging
python -m killchain -t path/to/target -m scan --verbose
```

### Weaponization Strategies

| Strategy      | Description                                                        |
|---------------|--------------------------------------------------------------------|
| `hardcoded`   | Uses a fixed dictionary of known SQL injection payloads            |
| `template`    | Builds payloads from parameterized templates based on sink context |
| `llm`         | Uses an LLM (via OpenRouter) to generate context-aware payloads   |
| `all`         | Runs all three strategies and compares results                     |

## Vulnerability Types Detected

- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Path Traversal
- Command Injection
- Server-Side Request Forgery (SSRF)
- Open Redirect
- Hardcoded Secrets

## Test Targets

The `test_targets/` directory contains intentionally vulnerable Python web applications used to evaluate the scanner. These include publicly available benchmarks (DSVW, Django.nv, Vulpy, PyGoat) as well as custom applications developed for this thesis. Ground-truth JSON files are included for precision/recall evaluation.

> **Warning:** The applications in `test_targets/` are **intentionally insecure**. Do NOT deploy them in a production environment or expose them to a network.

## Evaluation

The scanner was evaluated against multiple benchmarks. Ground truth files (`ground_truth_*.json`) define the expected vulnerabilities per target, enabling automated precision and recall measurement via `evaluate.py`.

## License

This project is released for academic purposes as part of a Bachelor thesis at the German University in Cairo (GUC).