oast

Documentation

Overview

Package oast provides Out-of-Application Security Testing (OAST) functionality for detecting blind vulnerabilities through callback interactions.

Index

• type Callback
• type Client
  • func NewClient(cfg Config, eventBus EventBus, logger *logging.AuditLogger) (*Client, error)
  • func (c *Client) CheckInteractions(ctx context.Context, callbackID string) ([]*local.Interaction, error)
  • func (c *Client) GenerateCallback(ctx context.Context, testID string) (*Callback, error)
  • func (c *Client) GenerateCallbackWithPath(ctx context.Context, testID, path string) (*Callback, error)
  • func (c *Client) GetBaseURL() string
  • func (c *Client) GetInteractionsByTestID(ctx context.Context, testID string) ([]*local.Interaction, error)
  • func (c *Client) GetMode() Mode
  • func (c *Client) GetPort() int
  • func (c *Client) GetStats() (*local.Stats, error)
  • func (c *Client) GetStorage() *local.Storage
  • func (c *Client) GetURLBuilder() *local.URLBuilder
  • func (c *Client) HasInteraction(ctx context.Context, callbackID string) (bool, error)
  • func (c *Client) IsEnabled() bool
  • func (c *Client) Start(ctx context.Context) error
  • func (c *Client) Stop(ctx context.Context) error
  • func (c *Client) WaitForInteraction(ctx context.Context, callbackID string, timeout time.Duration) (*local.Interaction, error)
• type Config
  • func DefaultConfig() Config
• type EventBus
• type Evidence
• type Finding
• type Mode
• type Tester
  • func NewTester(client *Client, logger *logging.AuditLogger) *Tester
  • func (t *Tester) SetTimeout(timeout time.Duration)
  • func (t *Tester) TestBlindCommandInjection(ctx context.Context, req *http.Request, param, testID string) (*Finding, error)
  • func (t *Tester) TestBlindSQLi(ctx context.Context, req *http.Request, param, testID string) (*Finding, error)
  • func (t *Tester) TestBlindSSRF(ctx context.Context, req *http.Request, testID string) (*Finding, error)
  • func (t *Tester) TestBlindXSS(ctx context.Context, req *http.Request, param, testID string) (*Finding, error)
  • func (t *Tester) TestBlindXXE(ctx context.Context, req *http.Request, testID string) (*Finding, error)

Types

type Callback

type Callback struct {
	ID      string
	URL     string
	TestID  string
	Created time.Time
}

Callback represents a generated OAST callback.

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client provides a unified interface for OAST operations.

func NewClient

func NewClient(cfg Config, eventBus EventBus, logger *logging.AuditLogger) (*Client, error)

NewClient creates a new OAST client with the specified configuration.

func (*Client) CheckInteractions

func (c *Client) CheckInteractions(ctx context.Context, callbackID string) ([]*local.Interaction, error)

CheckInteractions retrieves all interactions for a callback ID.

func (*Client) GenerateCallback

func (c *Client) GenerateCallback(ctx context.Context, testID string) (*Callback, error)

GenerateCallback creates a new OAST callback URL.

func (*Client) GenerateCallbackWithPath

func (c *Client) GenerateCallbackWithPath(ctx context.Context, testID, path string) (*Callback, error)

GenerateCallbackWithPath creates a callback URL with an additional path.

func (*Client) GetBaseURL

func (c *Client) GetBaseURL() string

GetBaseURL returns the base URL for callbacks.

func (*Client) GetInteractionsByTestID

func (c *Client) GetInteractionsByTestID(ctx context.Context, testID string) ([]*local.Interaction, error)

GetInteractionsByTestID retrieves all interactions for a test ID.

func (*Client) GetMode

func (c *Client) GetMode() Mode

GetMode returns the current OAST mode.

func (*Client) GetPort

func (c *Client) GetPort() int

GetPort returns the listening port (for local mode).

func (*Client) GetStats

func (c *Client) GetStats() (*local.Stats, error)

GetStats returns statistics about stored interactions.

func (*Client) GetStorage

func (c *Client) GetStorage() *local.Storage

GetStorage returns the underlying storage (for advanced use).

func (*Client) GetURLBuilder

func (c *Client) GetURLBuilder() *local.URLBuilder

GetURLBuilder returns the URL builder (for advanced use).

func (*Client) HasInteraction

func (c *Client) HasInteraction(ctx context.Context, callbackID string) (bool, error)

HasInteraction checks if any interaction exists for a callback ID.

func (*Client) IsEnabled

func (c *Client) IsEnabled() bool

IsEnabled returns true if OAST functionality is enabled.

func (*Client) Start

func (c *Client) Start(ctx context.Context) error

Start starts the OAST server (for local mode).

func (*Client) Stop

func (c *Client) Stop(ctx context.Context) error

Stop stops the OAST server.

func (*Client) WaitForInteraction

func (c *Client) WaitForInteraction(ctx context.Context, callbackID string, timeout time.Duration) (*local.Interaction, error)

WaitForInteraction blocks until an interaction is received or timeout.

type Config

type Config struct {
	Mode    Mode
	Port    int    // For local mode (0 = random)
	Host    string // For local mode
	BaseURL string // For selfhosted/cloud modes
	Timeout int    // Seconds to wait for callback
}

Config holds configuration for the OAST client.

func DefaultConfig

func DefaultConfig() Config

DefaultConfig returns the default OAST configuration.

type EventBus

type EventBus interface {
	Publish(eventType string, data interface{})
}

EventBus defines the interface for publishing OAST events.

type Evidence

type Evidence struct {
	Request     string
	Parameter   string
	Payload     string
	Callback    string
	Interaction string
}

Evidence contains the proof of a finding.

type Finding

type Finding struct {
	Type        string
	Severity    string
	CWE         string
	CVSS        float64
	Confidence  string
	Description string
	Evidence    Evidence
	Remediation string
}

Finding represents a security finding from OAST testing.

type Mode

type Mode string

Mode represents the OAST operating mode.

const (
	// ModeDisabled disables OAST functionality.
	ModeDisabled Mode = "disabled"
	// ModeLocal runs a local OAST server.
	ModeLocal Mode = "local"
	// ModeSelfHosted uses a self-hosted OAST server (future).
	ModeSelfHosted Mode = "selfhosted"
	// ModeCloud uses a cloud OAST service (future).
	ModeCloud Mode = "cloud"
)

type Tester

type Tester struct {
	// contains filtered or unexported fields
}

Tester provides OAST-based testing for blind vulnerabilities.

func NewTester

func NewTester(client *Client, logger *logging.AuditLogger) *Tester

NewTester creates a new OAST tester.

func (*Tester) SetTimeout

func (t *Tester) SetTimeout(timeout time.Duration)

SetTimeout sets the timeout for waiting for callbacks.

func (*Tester) TestBlindCommandInjection

func (t *Tester) TestBlindCommandInjection(ctx context.Context, req *http.Request, param, testID string) (*Finding, error)

TestBlindCommandInjection tests for blind command injection using OAST.

func (*Tester) TestBlindSQLi

func (t *Tester) TestBlindSQLi(ctx context.Context, req *http.Request, param, testID string) (*Finding, error)

TestBlindSQLi tests for blind SQL injection using OAST.

func (*Tester) TestBlindSSRF

func (t *Tester) TestBlindSSRF(ctx context.Context, req *http.Request, testID string) (*Finding, error)

TestBlindSSRF tests for Server-Side Request Forgery using OAST.

func (*Tester) TestBlindXSS

func (t *Tester) TestBlindXSS(ctx context.Context, req *http.Request, param, testID string) (*Finding, error)

TestBlindXSS tests for blind cross-site scripting using OAST.

func (*Tester) TestBlindXXE

func (t *Tester) TestBlindXXE(ctx context.Context, req *http.Request, testID string) (*Finding, error)

TestBlindXXE tests for blind XML External Entity injection using OAST.