Skip to content

feat(replay): HTTP replay engine + credential management + vuln agent integration #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
badchars merged 66 commits into from
Aug 24, 2026
Merged

feat(replay): HTTP replay engine + credential management + vuln agent integration #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
66 commits
Select commit Hold shift + click to select a range
bd71ebc
ignore: update download stats 2026-08-12
actions-user Aug 12, 2026
bf78f6a
Merge branch 'dev'
badchars Aug 13, 2026
8c4af35
Merge branch 'dev'
badchars Aug 13, 2026
c881964
release: v1.1.16
cyberstrike-bot[bot] Aug 13, 2026
f33f696
ignore: update download stats 2026-08-13
actions-user Aug 13, 2026
63b56c2
ignore: update download stats 2026-08-14
actions-user Aug 14, 2026
f289250
ignore: update download stats 2026-08-15
actions-user Aug 15, 2026
9ec7df9
ignore: update download stats 2026-08-16
actions-user Aug 16, 2026
0cee701
ignore: update download stats 2026-08-17
actions-user Aug 17, 2026
d3a0829
ignore: update download stats 2026-08-18
actions-user Aug 18, 2026
93ee6e0
ignore: update download stats 2026-08-19
actions-user Aug 19, 2026
2f957fc
ignore: update download stats 2026-08-20
actions-user Aug 20, 2026
8b5f0ed
ignore: update download stats 2026-08-21
actions-user Aug 21, 2026
2ffd3d8
ignore: update download stats 2026-08-22
actions-user Aug 22, 2026
08f1ba0
Merge branch 'dev'
badchars Aug 22, 2026
17f82a4
Merge branch 'main' of https://github.com/CyberStrikeus/CyberStrike
badchars Aug 22, 2026
65a6a0d
docs: add HTTP replay engine design (#83)
badchars Aug 22, 2026
b390a5c
feat(replay): lossless HTTP message model (#83)
badchars Aug 22, 2026
2681624
feat(replay): field-level request mutation (query, headers, body) (#83)
badchars Aug 22, 2026
1546557
feat(replay): composable encoding toolkit (#83)
badchars Aug 22, 2026
c9482e1
feat(replay): structured error taxonomy and retry/idempotency policy …
badchars Aug 22, 2026
900add1
feat(replay): concurrency & rate governance primitives (#83)
badchars Aug 22, 2026
7380d3e
feat(replay): response parser and unified send-result shape (#83)
badchars Aug 22, 2026
e807ed6
fix(replay): classify Bun-native fetch error codes (#83)
badchars Aug 22, 2026
32c99f5
feat(replay): backend A — structured send via native fetch (#83)
badchars Aug 22, 2026
2aac782
feat(replay): backend B — byte-exact send over raw TCP/TLS socket (#83)
badchars Aug 22, 2026
1417a5c
feat(replay): response observation and baseline diff (#83)
badchars Aug 23, 2026
512fab9
feat(replay): governed send with retry, idempotency guard & circuit/b…
badchars Aug 23, 2026
0f4db11
feat(replay): bounded-concurrency batch runner (#83)
badchars Aug 23, 2026
b730e58
docs: record engine-core progress and remaining integration steps (#83)
badchars Aug 23, 2026
b36b22c
feat(replay): mutation application and curl-equivalent export (#83)
badchars Aug 23, 2026
ff55a99
feat(replay): http_replay / http_replay_raw tool surface (#83)
badchars Aug 23, 2026
98672db
fix(replay): typecheck — number-typed governor ctor params + BodyInit…
badchars Aug 23, 2026
819cb03
feat(replay): register http_replay tools and permit them for vuln tes…
badchars Aug 23, 2026
132d08c
feat(replay): §4 funnel enforcement behind experimental.http_replay_f…
badchars Aug 23, 2026
a456548
feat(replay): guide injection tester to use http_replay over curl (#83)
badchars Aug 23, 2026
67f6e3e
feat(replay): make http_replay mandatory for vuln testers — deny curl…
badchars Aug 23, 2026
a613813
feat(replay): prioritize http_replay in idor, authz, mass-assignment …
badchars Aug 23, 2026
f06e4c6
feat(replay): soften curl deny + enable skill tool for vuln testers
badchars Aug 23, 2026
940e543
feat(prompts): add dynamic skill discovery and fix http_replay fallba…
badchars Aug 23, 2026
e12e46f
feat(prompts): add http_replay examples to authn prompt
badchars Aug 23, 2026
6bbabe6
feat(prompts): add http_replay examples to business-logic prompt
badchars Aug 23, 2026
b4b28b4
feat(prompts): add http_replay examples to ssrf prompt
badchars Aug 23, 2026
be154be
feat(prompts): add http_replay examples to file-attacks prompt
badchars Aug 23, 2026
6f39b6d
feat(prompts): add http_replay examples to llm prompt
badchars Aug 23, 2026
6a2310a
refactor(scripts): remove 8 Python scripts replaced by http_replay en…
badchars Aug 23, 2026
e2f36ff
refactor(scripts): update attack_script registry and methodology prompt
badchars Aug 23, 2026
3f8d079
feat(replay): add body/cookie/path mutations and followRedirects
badchars Aug 23, 2026
b9b194d
feat(tool): add web_update_credential tool
badchars Aug 23, 2026
dce74ba
feat(credential): add recipe schema, DB column, and execution engine
badchars Aug 23, 2026
3444630
feat(tool): add credential_set_recipe, credential_mint, credential_va…
badchars Aug 23, 2026
137dd50
feat(replay): add credential/compare/sweep modes and auto-refresh on 401
badchars Aug 23, 2026
37e689d
feat(authn): add credential management workflow to authn agent prompt
badchars Aug 23, 2026
64671a5
fix(recipe): template validation, form body support, status checks, p…
badchars Aug 23, 2026
e8b8172
fix(replay): auto-refresh mutex, proactive TTL refresh, header merge,…
badchars Aug 23, 2026
523c308
fix(tools): credential-validate scope guard and redirect detection, c…
badchars Aug 23, 2026
fd96310
fix(tools): resolve tsgo metadata type inconsistencies in credential …
badchars Aug 23, 2026
58f6b7e
feat(prompts): mandate http_replay for all HTTP sends, ban curl/Pytho…
badchars Aug 23, 2026
b4b7192
feat(agents): permission-enforce http_replay — deny curl/Python/webfe…
badchars Aug 23, 2026
b4e6595
feat(recipe): resolve {{variable}} templates in mutation values and o…
badchars Aug 23, 2026
26569ad
feat(prompts): remove curl/webfetch fallback from all 9 vuln agent pr…
badchars Aug 23, 2026
da2a7f9
fix(prompts): remove curl/webfetch fallback from methodology prompt
badchars Aug 23, 2026
3dadcc0
feat(analyzer): replace curl with http_replay for HTML page fetch
badchars Aug 23, 2026
2314fe6
fix(permission): block bun/node/nc/socat bash bypasses in vuln agent …
badchars Aug 23, 2026
da53ce7
fix(recipe): treat empty-string bag values as resolved in template
badchars Aug 23, 2026
6916a49
fix(mutate): bodyMerge returns unchanged request when body is not JSON
badchars Aug 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions STATS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,3 +327,14 @@
| 2026-08-09 | 3,305 (+48) | 0 (+0) | 3,305 (+48) |
| 2026-08-10 | 3,376 (+71) | 0 (+0) | 3,376 (+71) |
| 2026-08-11 | 3,439 (+63) | 0 (+0) | 3,439 (+63) |
| 2026-08-12 | 3,503 (+64) | 0 (+0) | 3,503 (+64) |
| 2026-08-13 | 3,710 (+207) | 0 (+0) | 3,710 (+207) |
| 2026-08-14 | 3,820 (+110) | 0 (+0) | 3,820 (+110) |
| 2026-08-15 | 3,876 (+56) | 0 (+0) | 3,876 (+56) |
| 2026-08-16 | 3,935 (+59) | 0 (+0) | 3,935 (+59) |
| 2026-08-17 | 4,019 (+84) | 0 (+0) | 4,019 (+84) |
| 2026-08-18 | 4,144 (+125) | 0 (+0) | 4,144 (+125) |
| 2026-08-19 | 4,207 (+63) | 0 (+0) | 4,207 (+63) |
| 2026-08-20 | 4,288 (+81) | 0 (+0) | 4,288 (+81) |
| 2026-08-21 | 4,421 (+133) | 0 (+0) | 4,421 (+133) |
| 2026-08-22 | 4,509 (+88) | 0 (+0) | 4,509 (+88) |
28 changes: 14 additions & 14 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading