feat: 侦察期匿名泄露与 WAF 画像闭环 + 审核降过杀救援 - #47
Open
moliyu1101 wants to merge 2 commits into
Open
Conversation
worker 进场前新增两步被动能力，把侦察期已实锤的信号在首包就带给 LLM： 1) 匿名泄露嗅探：对侦察收集的 anon_open 匿名端点做敏感数据正文特征识别（凭证/token/ 私钥/云凭证/数据库连接串等），结果写 target_meta['anon_leak_leads'] 并据此打 recon_anon_leak 锚点； 2) WAF/风控画像：对拦截应答(401/403/406/429+拦截页)做被动聚类，复用 waf_advisor 识别目标 WAF 厂商，产出 header_variants(X-Forwarded-For/X-Real-IP/UA) 供首包 针对性变形降低被拦概率，结果写 target_meta['waf_profile'] 并打 recon_waf_present 锚点。 两者均纯本地尽力而为，任何失败不阻断进场；线索经 _recon_leads_block 注入首轮。 SelfCheck 新增 recon_anon_leak / recon_waf_present 两个审核救援锚点字段。
避免「证据残缺但高价值」的发现因失控过杀被直接 ignored 造成漏报： 1) 匿名泄露救援 _maybe_rescue_recon_anon_leak：当发现带 recon_anon_leak 锚点、 中/低危、被 ignored 且证据残缺时，改判 deepen，指令 worker 沿匿名端点复现 响应并脱敏取证敏感字段； 2) WAF 实锤救援 _maybe_rescue_recon_waf：当发现带 recon_waf_present 锚点、 证据至少一点但被 ignored 时，改判 deepen 并附绕过变形头(X-Forwarded-For / X-Real-IP / UA)重试坐实。 救援链次序：anon_leak 救援 > waf 救援 > 通用救援，互不冲突。worker 侧已依据 发现类型把侦察锚点写入 SelfCheck，此处作为审核看板的救援锚点兜底。
Owner
|
等待审查 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
强化「侦察→挖洞→审核」流水线闭环，解决两类实战痛点（首轮忽略敏感信号 / 首包被风控拦；证据残缺但高价值的发现被过杀）。两个闭环合并为一：
SelfCheck 新增 recon_anon_leak / recon_waf_present 两个审核救援锚点字段。
救援链次序：anon_leak > waf > 通用，互不冲突。
新增 tests/test_recon_anon_leak.py、tests/test_recon_waf_profile.py、tests/test_reviewer_low_medium_rescue.py，共 31 条用例通过。