From 6e3c83803978394ac3da129e77a1ee1f3b03712e Mon Sep 17 00:00:00 2001
From: Nikhil Yadav <69293613+yadavnikhil17102004@users.noreply.github.com>
Date: Mon, 23 Mar 2026 18:56:20 +0530
Subject: [PATCH 6/7] Implement Code Review v2: Fix P0/P1/P2 bugs and add
enhancements
Fixes:
- P0: doPassiveScan thread pool bypass (now uses AnalyzeTask)
- P0: Semaphore deadlock fix (host sem first, then global)
- P0: _migrate_config crash (removed pre-init save_config)
- P1: _store_cached_findings blocking I/O (now async)
- P1: _async_save_cache race condition (proper flag handling)
- P1: Context menu raw threads (now uses ForcedAnalyzeTask)
- P1: MD5 to SHA-256 in hashing functions
- P1: Added AI param field display in findings
- P2: Security header categories in AI prompt
- P2: IDOR param name detection (id, user_id, etc)
- P2: Claude API actual connection test
Updated CHANGELOG with full technical details
---
CHANGELOG.md | 53 ++++++++++++++
silentchain_ai_community.py | 133 +++++++++++++++++++++++++++++-------
2 files changed, 160 insertions(+), 26 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49144f5..4a29bd6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
+### Fixed - Critical (P0)
+- **CRITICAL: `doPassiveScan()` bypasses thread pool** - Raw threading spawned in passive scan ignored the thread pool entirely
+ - Changed from `threading.Thread(target=self.analyze, ...)` to thread pool submission
+ - Now properly queues all passive scan analysis through `AnalyzeTask` and thread pool
+ - Prevents resource exhaustion from unlimited thread spawning
+- **CRITICAL: Semaphore deadlock risk** - Global and per-host semaphores acquired in wrong order
+ - Changed acquisition order: now acquires host semaphore before global (narrow before wide)
+ - Prevents threads holding global slots from blocking on host locks
+ - Eliminates silent hangs under concurrent load
+- **CRITICAL: `_migrate_config()` crashes on startup** - Calls `save_config()` before `stdout` wrapper is initialized
+ - Removed `save_config()` call from `_migrate_config()` — migration auto-persists on next settings save
+ - Prevents `AttributeError` on stdout access during initial config load
+
+### Fixed - High (P1)
+- **`_store_cached_findings()` blocks analysis threads with synchronous disk writes** - Every finding triggered immediate file I/O
+ - Changed to set `_cache_dirty = True` flag only, letting async timer handle writes
+ - Removed `self.save_vuln_cache()` blocking call
+ - Analysis threads now proceed without waiting for disk I/O
+- **`_async_save_cache()` race condition** - Cache dirty flag cleared before background write could complete
+ - Now clears flag optimistically before spawn (acceptable for async write)
+ - Background thread re-queues on failure by setting `_cache_dirty = True` again
+ - Added exception handling to prevent lost findings
+- **Context menu analysis still uses raw threading** - `analyzeFromContextMenu()` spawned threads instead of using pool
+ - Created `ForcedAnalyzeTask` runnable class for context menu operations
+ - Now submits through thread pool like passive scan (after fix)
+- **MD5 still used in 3 places** - Weak hash in request/finding signature generation
+ - `_get_url_hash()`: Changed MD5 → SHA-256 (took first 32 chars for compatibility)
+ - `_get_finding_hash()`: Changed MD5 → SHA-256 (full hash)
+ - `_analyzeFromContextMenuThread()`: Changed MD5 → SHA-256 for request hash
+ - Improves collision resistance and security posture
+- **AI response `param` field ignored** - Prompt asks AI to identify vulnerable parameters but findings never displayed them
+ - Added extraction of `ai_param = item.get("param", "")` from AI findings
+ - Now displays as `
Vulnerable Parameter (AI): {param}` in finding details
+ - Helps pentesters quickly identify the exact vulnerable parameter
+
+### Added - Medium (P2)
+- **Security header coverage** - Added AI prompt categories for common header misconfigurations
+ - New categories: "Missing security headers - CSP, HSTS, X-Frame-Options, X-Content-Type-Options"
+ - New categories: "Sensitive data in responses - PII, tokens, internal paths, debug info"
+ - New categories: "API versioning issues - v1/v2 endpoints with different access controls"
+ - AI now checks response headers systematically
+- **IDOR parameter detection** - Detects common IDOR-vulnerable parameter names
+ - Checks for patterns: `id`, `user_id`, `account_id`, `order_id`, `invoice_id`, `file_id`, `doc_id`, `record_id`, `item_id`, `uid`, `pid`, `customer_id`, `profile_id`, `token`, `ref`, `key`
+ - Generates IDOR signal when detected: `{"type": "idor_param_name", "name": "...", "value": "..."}`
+ - Complements numeric ID detection for better IDOR findings
+
+### Improved - Low (P3)
+- **Claude connection test was fake** - `_test_claude_connection()` hardcoded success without verifying API
+ - Now sends actual test request: `{"model": "...", "max_tokens": 5, "messages": [{"role": "user", "content": "ping"}]}`
+ - Properly handles HTTP 429 (rate limited but reachable) vs actual failures
+ - Prints clear feedback: "OK Claude API verified" or specific error message
+ - Catches both connection and rate-limit conditions
+
### Planned
- Stream AI responses for faster perceived performance
- Support for custom AI models (local fine-tuned models)
diff --git a/silentchain_ai_community.py b/silentchain_ai_community.py
index d5b3223..738c05a 100755
--- a/silentchain_ai_community.py
+++ b/silentchain_ai_community.py
@@ -96,6 +96,17 @@ def __init__(self, extender, messageInfo, url_str, task_id):
def run(self):
self.extender.analyze(self.messageInfo, self.url_str, self.task_id)
+class ForcedAnalyzeTask(Runnable):
+ """Runnable wrapper for forced analysis (context menu) that bypasses deduplication."""
+ def __init__(self, extender, messageInfo, url_str, task_id):
+ self.extender = extender
+ self.messageInfo = messageInfo
+ self.url_str = url_str
+ self.task_id = task_id
+
+ def run(self):
+ self.extender.analyze_forced(self.messageInfo, self.url_str, self.task_id)
+
class BurpExtender(IBurpExtender, IHttpListener, IScannerCheck, ITab, IContextMenuFactory):
def registerExtenderCallbacks(self, callbacks):
self.callbacks = callbacks
@@ -912,7 +923,8 @@ def _migrate_config(self, old_config, from_version):
"""Migrate config from old format to new."""
# v1 -> v2: No breaking changes in this release, just add version number
old_config["config_version"] = self.CONFIG_VERSION
- self.save_config() # Persist migrated version
+ # Don't call save_config() here — stdout not ready yet during initial load
+ # Migration will auto-persist when user saves settings
return old_config
def load_vuln_cache(self):
@@ -956,20 +968,23 @@ def save_vuln_cache(self):
return False
def _async_save_cache(self):
- """Non-blocking background write if cache is dirty. Safety: check before spawning thread."""
+ """Non-blocking background write if cache is dirty. Prevents race conditions during shutdown."""
if not self._cache_dirty:
return
+ self._cache_dirty = False # Optimistic clear before spawn
+
def background_save():
try:
self.save_vuln_cache()
- except:
- pass
+ except Exception as e:
+ # Re-queue on failure so we retry on next timer tick
+ self._cache_dirty = True
+ self.stderr.println("[!] Background cache save failed: %s" % e)
t = threading.Thread(target=background_save)
t.setDaemon(True)
t.start()
- self._cache_dirty = False
def _get_request_signature(self, data):
"""Build a stable request signature for persistent cache matching."""
@@ -1059,7 +1074,8 @@ def _store_cached_findings(self, signature, url, findings):
"findings": normalized
}
- self.save_vuln_cache()
+ # Set dirty flag for async write-behind (don't block analysis thread on disk I/O)
+ self._cache_dirty = True
self._ui_dirty = True
def save_config(self):
@@ -1751,7 +1767,8 @@ def _analyzeFromContextMenuThread(self, messages):
request_bytes = message.getRequest()
if request_bytes:
import hashlib
- request_hash = hashlib.md5(request_bytes.tostring()).hexdigest()[:8]
+ # Use SHA-256 instead of MD5 for better hash quality
+ request_hash = hashlib.sha256(bytes(request_bytes.tostring())).hexdigest()[:8]
unique_key = "%s|%s" % (url_str, request_hash)
else:
unique_key = url_str
@@ -1803,10 +1820,9 @@ def _analyzeFromContextMenuThread(self, messages):
self.stdout.println("[CONTEXT MENU] Running analysis...")
task_id = self.addTask("CONTEXT", url_str, "Queued", message)
- # Use special forced analysis that bypasses deduplication
- t = threading.Thread(target=self.analyze_forced, args=(message, url_str, task_id))
- t.setDaemon(True)
- t.start()
+ # Use thread pool for forced analysis (context menu always forces analysis)
+ task = ForcedAnalyzeTask(self, message, url_str, task_id)
+ self.thread_pool.submit(task)
except Exception as e:
self.stderr.println("[!] Context menu error: %s" % e)
@@ -1883,16 +1899,53 @@ def _test_openai_connection(self):
return False
def _test_claude_connection(self):
+ """Test Claude API connection with actual API call."""
if not self.API_KEY:
self.stderr.println("[!] Claude API key required")
return False
- self.available_models = [
- "claude-3-5-sonnet-20241022",
- "claude-3-opus-20240229",
- "claude-3-sonnet-20240229"
- ]
- self.stdout.println("[AI CONNECTION] OK Claude API configured")
+ try:
+ # Send actual test request to API
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({
+ "model": self.MODEL or "claude-3-5-sonnet-20241022",
+ "max_tokens": 5,
+ "messages": [{"role": "user", "content": "ping"}]
+ }).encode("utf-8"),
+ headers={
+ "Content-Type": "application/json",
+ "x-api-key": self.API_KEY,
+ "anthropic-version": "2023-06-01"
+ }
+ )
+
+ resp = urllib2.urlopen(req, timeout=10)
+ if resp.getcode() == 200:
+ self.stdout.println("[AI CONNECTION] OK Claude API verified")
+ # Parse response to get available models info
+ self.available_models = [
+ "claude-3-5-sonnet-20241022",
+ "claude-3-opus-20240229",
+ "claude-3-sonnet-20240229"
+ ]
+ return True
+ except urllib2.HTTPError as e:
+ if e.code == 429:
+ # Rate limited but key and endpoint are valid
+ self.stdout.println("[AI CONNECTION] OK Claude API reachable (rate limited)")
+ self.available_models = [
+ "claude-3-5-sonnet-20241022",
+ "claude-3-opus-20240229",
+ "claude-3-sonnet-20240229"
+ ]
+ return True
+ else:
+ self.stderr.println("[!] Claude API error: %s" % e)
+ return False
+ except Exception as e:
+ self.stderr.println("[!] Claude connection failed: %s" % e)
+ return False
return True
def _test_gemini_connection(self):
@@ -2054,9 +2107,9 @@ def doPassiveScan(self, baseRequestResponse):
url_str = "Unknown"
task_id = self.addTask("PASSIVE", url_str, "Queued", baseRequestResponse)
- t = threading.Thread(target=self.analyze, args=(baseRequestResponse, url_str, task_id))
- t.setDaemon(True)
- t.start()
+ # Use thread pool instead of raw threading to prevent resource exhaustion
+ task = AnalyzeTask(self, baseRequestResponse, url_str, task_id)
+ self.thread_pool.submit(task)
return None
def doActiveScan(self, baseRequestResponse, insertionPoint):
@@ -2144,10 +2197,11 @@ def analyze(self, messageInfo, url_str=None, task_id=None):
host = self._extract_host_from_url(url_str or "unknown")
host_sem = self.get_host_semaphore(host)
- # Acquire global pool cap first, then per-host limit
- self.global_semaphore.acquire()
+ # Acquire host semaphore first (narrow), then global (wide) to prevent deadlock
+ host_sem.acquire()
try:
- with host_sem:
+ self.global_semaphore.acquire()
+ try:
try:
time_since_last = time.time() - self.last_request_time
if time_since_last < self.min_delay:
@@ -2171,8 +2225,10 @@ def analyze(self, messageInfo, url_str=None, task_id=None):
self.updateStats("errors")
finally:
self.refreshUI()
+ finally:
+ self.global_semaphore.release()
finally:
- self.global_semaphore.release()
+ host_sem.release()
def analyze_forced(self, messageInfo, url_str=None, task_id=None):
"""
@@ -2300,6 +2356,21 @@ def extract_idor_signals(self, params_sample, url):
signals.append({"type": "numeric_param", "params": numeric_params[:3]})
if uuid_params:
signals.append({"type": "uuid_param", "params": uuid_params[:3]})
+
+ # Check for common IDOR parameter names (easy wins for pentesters)
+ IDOR_PARAM_NAMES = {
+ 'id', 'user_id', 'account_id', 'order_id', 'invoice_id',
+ 'file_id', 'doc_id', 'record_id', 'item_id', 'uid', 'pid',
+ 'customer_id', 'profile_id', 'token', 'ref', 'key'
+ }
+ idor_named_params = []
+ for p in params_sample:
+ name = p.get("name", "").lower()
+ # Check if param name matches common IDOR patterns
+ if any(idor_name == name or name.endswith('_' + idor_name) for idor_name in IDOR_PARAM_NAMES):
+ idor_named_params.append({"name": p.get("name"), "value": p.get("value", "")[:20]})
+ if idor_named_params:
+ signals.append({"type": "idor_param_name", "params": idor_named_params[:5]})
except:
pass
@@ -2309,11 +2380,13 @@ def extract_idor_signals(self, params_sample, url):
def _get_url_hash(self, url, params):
param_names = sorted([p.getName() for p in params])
normalized = str(url).split('?')[0] + '|' + '|'.join(param_names)
- return hashlib.md5(normalized.encode('utf-8')).hexdigest()
+ # Use SHA-256 instead of MD5 for better cryptographic security
+ return hashlib.sha256(normalized.encode('utf-8')).hexdigest()[:32]
def _get_finding_hash(self, url, title, cwe, param_name=""):
key = "%s|%s|%s|%s" % (str(url).split('?')[0], title.lower().strip(), cwe, param_name)
- return hashlib.md5(key.encode('utf-8')).hexdigest()
+ # Use SHA-256 instead of MD5 for better cryptographic security
+ return hashlib.sha256(key.encode('utf-8')).hexdigest()
def _parse_ai_response(self, ai_text):
"""Parse AI response into findings list. Handles repair of malformed JSON."""
@@ -2589,6 +2662,11 @@ def _perform_analysis(self, messageInfo, source, url_str=None, task_id=None, byp
detail_parts.append("
Description: %s
" % detail)
detail_parts.append("
AI Confidence: %d%%
" % ai_conf)
+ # Add AI-identified vulnerable parameter if present
+ ai_param = item.get("param", "")
+ if ai_param:
+ detail_parts.append("
Vulnerable Parameter (AI): %s" % ai_param)
+
# Add evidence field if present
if item.get("evidence"):
evidence_text = str(item.get("evidence", ""))[:500]
@@ -2651,6 +2729,9 @@ def build_prompt(self, data):
"10. Business Logic flaws - price/quantity params, role/permission params, discount logic\n"
"11. Information Disclosure - stack traces, internal IPs, API keys, secrets in responses\n"
"12. Prototype Pollution - __proto__, constructor in JSON params, Object.assign usage\n"
+ "13. Missing security headers - CSP, HSTS, X-Frame-Options, X-Content-Type-Options\n"
+ "14. Sensitive data in responses - PII, tokens, internal paths, debug info\n"
+ "15. API versioning issues - v1/v2 endpoints with different access controls\n"
"Flag confidence=0 if no evidence. Only report confidence>=50.\n"
"Format: [{\"title\":str,\"severity\":\"High|Medium|Low|Information\","
"\"confidence\":0-100,\"detail\":str,\"cwe\":str,"
From 55e42b1ae6a35b3750db5e57e515b0ab4a88e4ba Mon Sep 17 00:00:00 2001
From: Nikhil Yadav <69293613+yadavnikhil17102004@users.noreply.github.com>
Date: Tue, 24 Mar 2026 17:19:23 +0530
Subject: [PATCH 7/7] Reorganize repo layout: move guides, project docs, and
variants
---
.github/copilot-instructions.md | 45 +
BENCHMARK.md | 136 --
CHANGELOG.md | 18 +-
CONTRIBUTING.md | 29 -
INSTALLATION.md | 511 -----
NOTICE.md | 24 -
OPTIMIZATION_PLAN.md | 608 -----
QUICKSTART.md | 168 --
README.md | 526 +----
docs/DEVELOPER_WORKFLOW.md | 38 +
docs/INTERNAL_WORKING.md | 54 +
docs/guides/INSTALLATION.md | 72 +
docs/guides/QUICKSTART.md | 56 +
docs/project/BENCHMARK.md | 27 +
docs/project/CONTRIBUTING.md | 17 +
docs/project/NOTICE.md | 23 +
docs/project/OPTIMIZATION_PLAN.md | 52 +
variants/silentchain_v2_0_0.py | 2317 +++++++++++++++++++
variants/silentchain_v2_1_0_with_scope.py | 2532 +++++++++++++++++++++
variants/silentchain_v2_enhanced.py | 2317 +++++++++++++++++++
20 files changed, 7611 insertions(+), 1959 deletions(-)
create mode 100644 .github/copilot-instructions.md
delete mode 100644 BENCHMARK.md
delete mode 100755 CONTRIBUTING.md
delete mode 100644 INSTALLATION.md
delete mode 100644 NOTICE.md
delete mode 100644 OPTIMIZATION_PLAN.md
delete mode 100644 QUICKSTART.md
create mode 100644 docs/DEVELOPER_WORKFLOW.md
create mode 100644 docs/INTERNAL_WORKING.md
create mode 100644 docs/guides/INSTALLATION.md
create mode 100644 docs/guides/QUICKSTART.md
create mode 100644 docs/project/BENCHMARK.md
create mode 100644 docs/project/CONTRIBUTING.md
create mode 100644 docs/project/NOTICE.md
create mode 100644 docs/project/OPTIMIZATION_PLAN.md
create mode 100644 variants/silentchain_v2_0_0.py
create mode 100644 variants/silentchain_v2_1_0_with_scope.py
create mode 100644 variants/silentchain_v2_enhanced.py
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 0000000..7e8d7b7
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,45 @@
+# Project Guidelines
+
+## Code Style
+- Keep compatibility with Jython 2.7 and Burp extension APIs.
+- Prefer simple, defensive Python over modern Python 3-only features.
+- Preserve existing naming and class structure in `silentchain_ai_community.py`.
+- Keep UI changes EDT-safe: mutate Swing UI on `SwingUtilities.invokeLater`.
+
+## Architecture
+- Primary entry point is `silentchain_ai_community.py`.
+- `BurpExtender` owns lifecycle, UI, settings, provider dispatch, caching, and scan orchestration.
+- Passive analysis pipeline is `doPassiveScan/processHttpMessage -> AnalyzeTask -> analyze -> _perform_analysis -> ask_ai -> addScanIssue`.
+- Threading model uses fixed thread pool (`Executors.newFixedThreadPool(5)`) and semaphores:
+ - global cap: 5 concurrent AI calls
+ - per-host cap: 2 concurrent calls
+- Persistent files are in home directory:
+ - `~/.silentchain_config.json`
+ - `~/.silentchain_vuln_cache.json`
+
+## Build and Test
+- There is no local build/test harness; this is a Burp runtime extension.
+- Main verification path is manual load in Burp:
+ 1. `Extender -> Extensions -> Add -> Python`
+ 2. Load `silentchain_ai_community.py`
+ 3. Use Settings -> Test Connection
+- Optional Azure env validation:
+ - `./tools/test_azure_env.sh ./.env`
+
+## Conventions
+- Prefer new work in `silentchain_ai_community.py` unless a task explicitly targets v2 variants.
+- Keep exported CSV filename pattern unchanged: `SILENTCHAIN_Findings_YYYYMMDD_HHMMSS.csv`.
+- Preserve confidence mapping and severity normalization behavior.
+- Keep request signature logic stable unless intentional cache behavior change is requested.
+
+## Pitfalls
+- Burp/Jython imports will appear unresolved outside Burp; this is expected.
+- Avoid blocking calls on the UI thread.
+- Keep semaphore acquisition order in `analyze` (host, then global) to avoid deadlock regressions.
+- If changing config schema, update migration path and config versioning.
+
+## Documentation
+- Architecture internals: `docs/INTERNAL_WORKING.md`
+- Developer flow and release checks: `docs/DEVELOPER_WORKFLOW.md`
+- Setup and provider configuration: `docs/guides/QUICKSTART.md`, `docs/guides/INSTALLATION.md`
+- Change history and optimization rationale: `CHANGELOG.md`, `docs/project/OPTIMIZATION_PLAN.md`
diff --git a/BENCHMARK.md b/BENCHMARK.md
deleted file mode 100644
index c5e53c4..0000000
--- a/BENCHMARK.md
+++ /dev/null
@@ -1,136 +0,0 @@
-# SILENTCHAIN AI - Benchmark Report
-
-This document contains performance benchmarks and security scan results for SILENTCHAIN AI across different AI models, providers, and target applications.
-
----
-
-## Benchmark Results
-
-### Test 1: Ollama DeepSeek-V3.1 on ASP.NET TestInvicti
-
-| | |
-|---|---|
-| **Product** | SILENTCHAIN AI Professional v1.1.0 |
-| **AI Provider** | Ollama |
-| **Model** | `deepseek-v3.1:671b-cloud` |
-| **Target(s)** | aspnet.testinvicti.com |
-
-#### Performance
-| Metric | Value |
-|--------|-------|
-| Total Scan Time | 19.0 minutes |
-| AI Requests | 137 |
-| Avg Time/Request | 8.32s |
-| Total Tokens | 138,742 |
-| Avg Tokens/Request | 1,012 |
-
-#### Findings
-| Severity | Count |
-|----------|-------|
-| :red_circle: High | 16 |
-| :orange_circle: Medium | 37 |
-| :yellow_circle: Low | 63 |
-| 🔵 Info | 35 |
-| **Total** | **151** |
-| Verified (Phase 2) | 20 |
-
-#### Scan Coverage
-| Metric | Value |
-|--------|-------|
-| URLs Processed | 78 |
-| URLs Analyzed | 42 |
-| Skipped (Dup) | 50 |
-| Errors | 22 |
-
----
-
-## Benchmark History
-
-More benchmarks will be added here as additional models, providers, and target applications are tested.
-
-### Planned Tests
-- [ ] OpenAI GPT-4 on aspnet.testinvicti.com
-- [ ] Claude 3.5 Sonnet on aspnet.testinvicti.com
-- [ ] Google Gemini 1.5 Pro on aspnet.testinvicti.com
-- [ ] Ollama Llama 3.1 on various targets
-- [ ] Ollama Qwen 2.5 Coder on various targets
-- [ ] Comparative analysis across OWASP Juice Shop
-- [ ] Performance testing on large-scale applications
-
----
-
-## Methodology
-
-### Test Environment
-- **Burp Suite**: Professional Edition
-- **SILENTCHAIN**: Professional v1.1.0
-- **Network**: Standard broadband connection
-- **Hardware**: (To be documented per test)
-
-Before cloud-provider benchmarks, validate local Azure `.env` configuration:
-
-```bash
-./tools/test_azure_env.sh ./.env
-```
-
-Record whether the script returns `STATUS: VALID` with each benchmark run.
-
-### Test Targets
-- **aspnet.testinvicti.com**: ASP.NET vulnerable application for security testing
-- More targets will be added in future benchmarks
-
-### Metrics Explained
-
-#### Performance Metrics
-- **Total Scan Time**: Wall-clock time from first request to last finding
-- **AI Requests**: Number of API calls made to the AI provider
-- **Avg Time/Request**: Average response time per AI analysis
-- **Total Tokens**: Combined input + output tokens used
-- **Avg Tokens/Request**: Average token consumption per request
-
-#### Finding Metrics
-- **High Severity**: Critical vulnerabilities requiring immediate attention
-- **Medium Severity**: Important security issues with moderate risk
-- **Low Severity**: Minor vulnerabilities or security weaknesses
-- **Info**: Informational findings and security notes
-- **Verified (Phase 2)**: Findings confirmed through active exploitation (Professional only)
-
-#### Coverage Metrics
-- **URLs Processed**: Total unique URLs encountered
-- **URLs Analyzed**: URLs that underwent AI analysis
-- **Skipped (Dup)**: Duplicate URLs not re-analyzed
-- **Errors**: Requests that failed analysis
-
----
-
-## Contributing Benchmarks
-
-If you'd like to contribute benchmark results:
-
-1. Run SILENTCHAIN on a public vulnerable application (DVWA, Juice Shop, WebGoat, etc.)
-2. Document your test environment:
- - SILENTCHAIN version
- - AI provider and model
- - Target application
- - Hardware specs (CPU, RAM)
- - Network conditions
-3. Export benchmark report from SILENTCHAIN
-4. Submit via GitHub Issue or Pull Request
-
----
-
-## Notes
-
-- All benchmarks are performed on **publicly accessible test applications** designed for security testing
-- Results may vary based on:
- - AI model version and capabilities
- - Network latency
- - Hardware resources
- - Target application complexity
- - Burp Suite configuration
-- For **Ollama** benchmarks: Local hardware significantly impacts performance
-- For **Cloud AI** benchmarks: Network latency and API rate limits affect results
-
----
-
-**Copyright © 2026 SN1PERSECURITY LLC. All rights reserved.**
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a29bd6..13d7925 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -561,9 +561,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Documentation
- Comprehensive README with quick start
-- Detailed installation guide (INSTALLATION.md)
-- 5-minute quick start guide (QUICKSTART.md)
-- Contributing guidelines (CONTRIBUTING.md)
+- Detailed installation guide (docs/guides/INSTALLATION.md)
+- 5-minute quick start guide (docs/guides/QUICKSTART.md)
+- Contributing guidelines (docs/project/CONTRIBUTING.md)
- Settings verification guide (SETTINGS_VERIFICATION.md)
### Known Limitations
@@ -606,9 +606,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
```
silentchain_ai_community.py # Main extension file (1549 lines)
README.md # Project documentation
-INSTALLATION.md # Setup guide
-QUICKSTART.md # 5-minute guide
-CONTRIBUTING.md # Development guide
+docs/guides/INSTALLATION.md # Setup guide
+docs/guides/QUICKSTART.md # 5-minute guide
+docs/project/CONTRIBUTING.md # Development guide
LICENSE # MIT License
CHANGELOG.md # This file
```
@@ -704,7 +704,7 @@ Visit https://silentchain.ai for upgrade options.
## Contributing
-Found a bug? Have a feature request? See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+Found a bug? Have a feature request? See [docs/project/CONTRIBUTING.md](docs/project/CONTRIBUTING.md) for guidelines.
---
@@ -717,8 +717,8 @@ MIT License - See [LICENSE](LICENSE) file for details.
## Support
- **Community Support**: GitHub Issues
-- **Documentation**: https://github.com/silentchainai/SILENTCHAIN
-- **Professional Support**: support@silentchain.ai (Professional Edition only)
+- **Documentation**: See repository docs in this fork
+- **Support**: Use your fork's issue tracker
---
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
deleted file mode 100755
index 085e6a2..0000000
--- a/CONTRIBUTING.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Contributing to SILENTCHAIN AI™ Community Edition
-
-Thank you for your interest in SILENTCHAIN AI™ Community Edition.
-
-This project is **source-visible but proprietary**. To protect the integrity of the software and future commercial editions, we do **not accept outside contributions**.
-
-## Guidelines
-
-- Do not submit pull requests or patches.
-- Do not fork the repository for competing products.
-- Do not redistribute modified versions of the Software.
-
-## Contact
-
-For questions or support, please:
-
-- Open an issue on the GitHub repository
-- Join our [Discord community](https://discord.gg/silentchain)
-
-## Maintainer Validation
-
-For internal testing and release QA, validate Azure `.env` settings before manual Burp testing:
-
-```bash
-./tools/test_azure_env.sh ./.env
-```
-
-Expected result: `STATUS: VALID`.
-
diff --git a/INSTALLATION.md b/INSTALLATION.md
deleted file mode 100644
index 06e4dfa..0000000
--- a/INSTALLATION.md
+++ /dev/null
@@ -1,511 +0,0 @@
-# Installation Guide - SILENTCHAIN AI™ Community Edition
-
-Complete step-by-step installation and setup guide for SILENTCHAIN AI™.
-
----
-
-## Table of Contents
-
-1. [System Requirements](#system-requirements)
-2. [Installation Methods](#installation-methods)
-3. [AI Provider Setup](#ai-provider-setup)
-4. [First-Time Configuration](#first-time-configuration)
-5. [Verification](#verification)
-6. [Troubleshooting](#troubleshooting)
-
----
-
-## System Requirements
-
-### Required Software
-
-| Component | Requirement | Notes |
-|-----------|-------------|-------|
-| **Burp Suite** | Community or Professional (latest) | [Download here](https://portswigger.net/burp/communitydownload) |
-| **Java** | Version 8 or higher | Required by Burp Suite |
-| **Python** | 2.7 (Jython) | Included with Burp Suite |
-
-### AI Provider (Choose One)
-
-| Provider | Cost | Setup Complexity | Privacy |
-|----------|------|------------------|---------|
-| **Ollama** | Free | Easy | 100% Local |
-| **OpenAI** | Paid | Easy | Cloud |
-| **Claude** | Paid | Easy | Cloud |
-| **Gemini** | Free/Paid | Easy | Cloud |
-| **Azure Foundry** | Paid | Medium | Cloud |
-
-### System Resources
-
-- **RAM**: 4GB minimum, 8GB recommended
-- **Disk Space**: 2GB minimum (more for Ollama models)
-- **Network**: Internet connection (except for Ollama-only setups)
-
----
-
-## Installation Methods
-
-### Method 1: Direct Download (Recommended)
-
-#### Step 1: Download SILENTCHAIN
-
-```bash
-# Clone the repository
-git clone https://github.com/silentchainai/SILENTCHAIN.git
-
-# Or download ZIP
-# https://github.com/silentchainai/SILENTCHAIN/archive/refs/heads/main.zip
-```
-
-#### Step 2: Load in Burp Suite
-
-1. **Open Burp Suite**
- - Launch Burp Suite Community or Professional
-
-2. **Navigate to Extensions**
- ```
- Burp Menu → Extender → Extensions → Add
- ```
-
-3. **Configure Extension**
- - **Extension type**: Select `Python`
- - **Extension file**: Click `Select file...`
- - Navigate to `silentchain_ai_community.py`
- - Click `Open`
-
-4. **Verify Loading**
- - Extension should appear in the list
- - Check for errors in the `Errors` tab
- - Look for "SILENTCHAIN" tab in main Burp window
-
-#### Step 3: Verify Installation
-
-- A new `SILENTCHAIN` tab should appear in Burp
-- Console should display the SILENTCHAIN logo
-- Status bar should show extension loaded
-
----
-
-### Method 2: BApp Store (Coming Soon)
-
-SILENTCHAIN will be available in the Burp Suite BApp Store for one-click installation.
-
----
-
-## AI Provider Setup
-
-Choose and configure one AI provider below.
-
-### Option 1: Ollama (Recommended for Beginners)
-
-**Why Ollama?**
-- ✅ Completely free
-- ✅ 100% local and private
-- ✅ No API keys required
-- ✅ No usage limits
-
-#### Installation
-
-**macOS / Linux:**
-```bash
-curl -fsSL https://ollama.ai/install.sh | sh
-```
-
-**Windows:**
-1. Download installer from [ollama.ai/download](https://ollama.ai/download)
-2. Run the installer
-3. Restart terminal/command prompt
-
-#### Download a Model
-
-```bash
-# Recommended models:
-
-# Option 1: DeepSeek R1 (Best quality, larger size ~40GB)
-ollama pull deepseek-r1
-
-# Option 2: Llama 3 (Good balance ~4.7GB)
-ollama pull llama3
-
-# Option 3: Phi-3 (Lightweight ~2.3GB)
-ollama pull phi3
-```
-
-#### Verify Ollama
-
-```bash
-# Check Ollama is running
-ollama list
-
-# Test a model
-ollama run llama3 "Hello, test"
-```
-
-#### Configure in SILENTCHAIN
-
-1. Go to `SILENTCHAIN` → `⚙ Settings`
-2. **AI Provider**: Select `Ollama`
-3. **API URL**: `http://localhost:11434`
-4. **Model**: `llama3:latest` (or your chosen model)
-5. Click `Test Connection` → Should show "✓ Connected to Ollama"
-6. Click `Save`
-
----
-
-### Option 2: OpenAI
-
-#### Get API Key
-
-1. Visit [platform.openai.com](https://platform.openai.com)
-2. Sign up or log in
-3. Go to [API Keys](https://platform.openai.com/api-keys)
-4. Click `Create new secret key`
-5. Copy the key (starts with `sk-`)
-
-#### Configure in SILENTCHAIN
-
-1. Go to `SILENTCHAIN` → `⚙ Settings`
-2. **AI Provider**: Select `OpenAI`
-3. **API URL**: `https://api.openai.com/v1`
-4. **API Key**: Paste your key
-5. **Model**: Select `gpt-4` or `gpt-3.5-turbo`
-6. Click `Test Connection`
-7. Click `Save`
-
-#### Cost Estimation
-
-| Model | Cost per 1M tokens | Typical request |
-|-------|-------------------|-----------------|
-| GPT-4 | $30 input / $60 output | ~$0.10 |
-| GPT-3.5 Turbo | $3 input / $6 output | ~$0.01 |
-
-*Expect 50-100 requests per hour of active testing*
-
----
-
-### Option 3: Claude (Anthropic)
-
-#### Get API Key
-
-1. Visit [console.anthropic.com](https://console.anthropic.com)
-2. Sign up or log in
-3. Go to [API Keys](https://console.anthropic.com/account/keys)
-4. Click `Create Key`
-5. Copy the key
-
-#### Configure in SILENTCHAIN
-
-1. Go to `SILENTCHAIN` → `⚙ Settings`
-2. **AI Provider**: Select `Claude`
-3. **API URL**: `https://api.anthropic.com/v1`
-4. **API Key**: Paste your key
-5. **Model**: Select `claude-3-5-sonnet-20241022`
-6. Click `Test Connection`
-7. Click `Save`
-
-#### Recommended Models
-
-- **claude-3-5-sonnet-20241022**: Best for security analysis
-- **claude-3-opus-20240229**: Highest quality, slower
-- **claude-3-haiku-20240307**: Fast, economical
-
----
-
-### Option 4: Google Gemini
-
-#### Get API Key
-
-1. Visit [makersuite.google.com](https://makersuite.google.com/app/apikey)
-2. Sign in with Google account
-3. Click `Create API Key`
-4. Copy the key
-
-#### Configure in SILENTCHAIN
-
-1. Go to `SILENTCHAIN` → `⚙ Settings`
-2. **AI Provider**: Select `Gemini`
-3. **API URL**: `https://generativelanguage.googleapis.com/v1`
-4. **API Key**: Paste your key
-5. **Model**: Select `gemini-1.5-pro`
-6. Click `Test Connection`
-7. Click `Save`
-
----
-
-### Option 5: Azure Foundry (Azure OpenAI)
-
-#### Get API Key and Endpoint
-
-1. Open your Azure AI Foundry project (or Azure OpenAI resource)
-2. Copy your endpoint, for example:
- - `https://YOUR-RESOURCE.openai.azure.com`
-3. Copy your API key from the Keys/Endpoint page
-4. Confirm the deployment name you want to use (for example, `gpt-4o-security`)
-
-#### Configure in SILENTCHAIN
-
-1. Go to `SILENTCHAIN` → `⚙ Settings`
-2. **AI Provider**: Select `Azure Foundry`
-3. **API URL**: `https://YOUR-RESOURCE.openai.azure.com`
-4. **API Key**: Paste your Azure key
-5. **Model**: Enter your deployment name (not the raw model family name)
-6. Click `Test Connection`
-7. Click `Save`
-
----
-
-## First-Time Configuration
-
-### Step 1: Set Burp Scope
-
-SILENTCHAIN only analyzes in-scope targets:
-
-1. Go to `Target` → `Scope` in Burp
-2. Click `Add` under "Include in scope"
-3. Enter target(s):
- ```
- Example: https://testsite.com
- ```
-4. Configure protocol, host, and path as needed
-
-**Tip**: Start with a single test application to verify everything works.
-
-### Validate Azure .env (Optional but Recommended)
-
-If you are using Azure Foundry with a local `.env` file, run:
-
-```bash
-./tools/test_azure_env.sh ./.env
-```
-
-Proceed when the script reports `STATUS: VALID`.
-
-### Step 2: Configure Browser Proxy
-
-1. **Browser Settings** → **Network/Proxy**
-2. **Manual proxy configuration**:
- - HTTP Proxy: `127.0.0.1`
- - Port: `8080`
- - HTTPS Proxy: `127.0.0.1`
- - Port: `8080`
-
-3. **Install Burp CA Certificate**:
- - Browse to `http://burpsuite`
- - Click "CA Certificate"
- - Install in browser (important for HTTPS)
-
-### Step 3: Adjust SILENTCHAIN Settings
-
-1. Go to `SILENTCHAIN` → `⚙ Settings`
-
-2. **Advanced Tab**:
- - ☑ Verbose Logging (recommended initially)
-
-3. Click `Save`
-
-### Step 4: Test the Setup
-
-1. **Browse a test site** through your proxy-configured browser
-2. **Check SILENTCHAIN Console**:
- - Should show "[HTTP] URL: ..." messages
- - AI analysis logs
-3. **Check Findings Panel**:
- - Detected vulnerabilities appear here
-4. **Check Burp Issues**:
- - `Target` → `Issue Activity`
- - SILENTCHAIN findings appear alongside Burp Scanner
-
----
-
-## Verification
-
-### Health Check
-
-Run through this checklist to verify installation:
-
-- [ ] SILENTCHAIN tab visible in Burp
-- [ ] No errors in Extender → Errors tab
-- [ ] AI connection test passes (green ✓)
-- [ ] Console shows logo and initialization message
-- [ ] Target scope is configured
-- [ ] Browser proxy is set to Burp (127.0.0.1:8080)
-- [ ] Test request analyzed (check Console for "[HTTP]" logs)
-- [ ] Findings appear in Findings panel
-
-### Test Request
-
-Force analysis of a single request:
-
-1. Browse any in-scope URL
-2. Go to `Proxy` → `HTTP history`
-3. Right-click on a request
-4. Select `SILENTCHAIN - Analyze Request`
-5. Check Console for analysis logs
-6. Check Findings panel for results
-
----
-
-## Troubleshooting
-
-### Extension Won't Load
-
-**Error**: "Failed to load extension"
-
-**Solutions**:
-1. Check Python environment:
- ```
- Extender → Options → Python Environment
- Ensure "Jython standalone JAR file" is set
- ```
-2. Verify file permissions (must be readable)
-3. Check for syntax errors in `Extender` → `Errors`
-
----
-
-### AI Connection Fails
-
-**Error**: "AI connection test failed"
-
-**Solutions**:
-
-#### Ollama:
-```bash
-# Check if Ollama is running
-curl http://localhost:11434/api/tags
-
-# Restart Ollama
-# macOS/Linux:
-ollama serve
-
-# Windows: Restart Ollama from Start Menu
-```
-
-#### Cloud Providers:
-- Verify API key is correct (no extra spaces)
-- Check account has credits/active subscription
-- Verify API URL is exact (copy from provider docs)
-- Test with curl:
- ```bash
- # OpenAI
- curl https://api.openai.com/v1/models \
- -H "Authorization: Bearer YOUR_KEY"
- ```
-
----
-
-### No Findings Detected
-
-**Symptoms**: Traffic analyzed but no vulnerabilities found
-
-**Checklist**:
-1. **Verify target is in scope**:
- ```
- Target → Scope → Ensure URL is listed
- ```
-
-2. **Check traffic flow**:
- ```
- Proxy → HTTP history → Verify requests appear
- ```
-
-3. **Enable Verbose Logging**:
- ```
- Settings → Advanced → ☑ Verbose Logging
- Console will show detailed analysis
- ```
-
-4. **Test with known vulnerable site**:
- ```
- DVWA: http://dvwa.local
- WebGoat: http://localhost:8080/WebGoat
- ```
-
----
-
-### High Memory Usage
-
-**Symptoms**: Burp Suite consuming excessive RAM
-
-**Solutions**:
-1. **Reduce Max Tokens**:
- ```
- Settings → AI Provider → Max Tokens: 1024 (instead of 2048)
- ```
-
-2. **Use lighter AI model**:
- ```
- Ollama: phi3 instead of deepseek-r1
- OpenAI: gpt-3.5-turbo instead of gpt-4
- ```
-
-3. **Clear completed tasks**:
- ```
- Click "Clear Completed" button in SILENTCHAIN
- ```
-
-4. **Increase Burp memory**:
- ```
- # Edit burp.sh (Linux/Mac) or burpsuite_community.vmoptions (Windows)
- -Xmx4g # Increase to 4GB (or more)
- ```
-
----
-
-### Rate Limiting Issues
-
-**Symptoms**: "Skipped (Rate Limit)" messages
-
-**Explanation**: SILENTCHAIN enforces 4-second delay between AI requests to:
-- Prevent AI provider rate limits
-- Reduce costs (cloud providers)
-- Maintain system stability
-
-**Not a bug**: This is intentional design. Passive analysis doesn't require real-time speed.
-
----
-
-### Extension Crashes
-
-**Symptoms**: SILENTCHAIN stops responding, errors in console
-
-**Solutions**:
-1. **Check Burp logs**:
- ```
- Extender → Errors tab
- ```
-
-2. **Restart extension**:
- ```
- Extender → Extensions → Unload → Re-load
- ```
-
-3. **Report the bug**:
- - Copy error log
- - Create GitHub issue
- - Include: Burp version, AI provider, error message
-
----
-
-## Getting Help
-
-### Documentation
-- [Main README](README.md)
-- [User Guide](docs/USER_GUIDE.md)
-- [FAQ](docs/FAQ.md)
-
-### Community Support
-- [GitHub Issues](https://github.com/silentchainai/SILENTCHAIN/issues)
-- [Discord Community](https://discord.gg/silentchain)
-
----
-
-## Next Steps
-
-Once installation is complete:
-
-1. **Read the [User Guide](docs/USER_GUIDE.md)** for detailed usage
-2. **Review [Best Practices](docs/BEST_PRACTICES.md)** for effective testing
-3. **Join the [Discord Community](https://discord.gg/silentchain)** for tips and updates
-4. **Star the repository** to stay updated
-
-Happy hunting! 🔒🔗⛓️
diff --git a/NOTICE.md b/NOTICE.md
deleted file mode 100644
index 390d450..0000000
--- a/NOTICE.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Legal Notice for SILENTCHAIN AI™ Community Edition
-
-Last reviewed: 2026-03-18
-
-Copyright (c) 2026 SN1PERSECURITY LLC. All rights reserved.
-
-## Trademarks
-"SILENTCHAIN AI™", "SILENTCHAIN™", and the SILENTCHAIN AI logo are trademarks or trade names of SN1PERSECURITY LLC. This notice does not grant permission to use these trademarks, service marks, or logos for marketing, branding, or product naming without prior written permission.
-
-## License
-SILENTCHAIN AI™ Community Edition is source-visible but **proprietary software**. Use, distribution, and modification are governed by the SILENTCHAIN AI™ Community Edition License. See the LICENSE file for full terms.
-
-## Redistribution
-PortSwigger Ltd. and the Burp Suite BApp Store are granted a perpetual, royalty-free right to redistribute the Software in source or compiled form, host it on PortSwigger-controlled platforms, and bundle it with Burp Suite. Attribution to SN1PERSECURITY LLC is required.
-
-## Disclaimer of Warranty
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-
-## Limitation of Liability
-IN NO EVENT SHALL SN1PERSECURITY LLC OR ITS MEMBERS, OFFICERS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE.
-
-## Contact
-For commercial licensing, redistribution permissions, or inquiries: support@sn1persecurity.com
-
diff --git a/OPTIMIZATION_PLAN.md b/OPTIMIZATION_PLAN.md
deleted file mode 100644
index 4a13e32..0000000
--- a/OPTIMIZATION_PLAN.md
+++ /dev/null
@@ -1,608 +0,0 @@
-# SILENTCHAIN AI — Code Review & Optimization Plan
-
-**Status**: ✅ COMPLETED
-**Last Updated**: 2026-03-23
-**Total Changes**: 13 / 13 Implemented
-**Code Quality**: ✅ No syntax errors (Jython imports expected)
-
----
-
-## 🔴 Critical Issues (P0) — Must Fix
-
-### 1. Semaphore Bottleneck (Single-threaded AI calls)
-
-**Problem**: Global `Semaphore(1)` serializes ALL AI requests. Even with 10 discovered vulnerabilities, they queue behind one another. 5-10x throughput loss.
-
-**Current Code**:
-```python
-self.semaphore = threading.Semaphore(1)
-# In analyze():
-with self.semaphore:
- self._perform_analysis(...)
-```
-
-**Fix**: Per-host semaphores + global pool cap
-```python
-self.host_semaphores = {}
-self.host_semaphore_lock = threading.Lock()
-self.global_semaphore = threading.Semaphore(5) # max 5 concurrent
-
-def get_host_semaphore(self, host):
- with self.host_semaphore_lock:
- if host not in self.host_semaphores:
- self.host_semaphores[host] = threading.Semaphore(2)
- return self.host_semaphores[host]
-```
-
-**Impact**: 5-10x faster analysis throughput
-**Effort**: 30 min
-**Status**: `not-started`
-
----
-
-### 2. EDT Violations — Swing updates off Event Dispatch Thread
-
-**Problem**: Direct `setText()` from worker threads causes UI hangs and NullPointerExceptions.
-
-**Current Code**:
-```python
-self.providerStatusLabel.setText(self.AI_PROVIDER) # WRONG — called from worker
-```
-
-**Fix**: Wrap all Swing mutations in SwingUtilities.invokeLater
-```python
-def safe_swing_update(self, fn):
- class R(Runnable):
- def run(self_): fn()
- SwingUtilities.invokeLater(R())
-
-# Usage:
-self.safe_swing_update(lambda: self.providerStatusLabel.setText(self.AI_PROVIDER))
-```
-
-**Impact**: Prevents UI hangs, race conditions, crash loops
-**Effort**: 45 min (audit + wrap all Swing calls)
-**Status**: `not-started`
-
----
-
-### 3. Expanded AI Prompt for Bug Bounty Coverage
-
-**Problem**: Current prompt only covers OWASP Top 10 at surface level. Misses:
-- IDOR / Broken Object-Level Auth
-- Mass Assignment
-- SSRF
-- JWT weaknesses (alg:none, weak secrets)
-- GraphQL exploitation
-- OAuth misconfigs
-- HTTP Request Smuggling
-- Cache Poisoning
-- Business Logic flaws
-- Prototype Pollution
-
-**Current Code**:
-```python
-def build_prompt(self, data):
- return (
- "Security expert. Output ONLY JSON array...\n"
- "Analyze for OWASP Top 10, CWE.\n"
- # MISSING: IDOR, SSRF, JWT, etc.
- )
-```
-
-**Fix**: Expand prompt to cover all 12 categories + evidence field
-```python
-def build_prompt(self, data):
- return (
- "Security expert. Output ONLY JSON array. NO markdown.\n"
- "Analyze for ALL of the following:\n"
- "1. OWASP Top 10 (2021)\n"
- "2. IDOR/Broken Object Level Auth — look for numeric/sequential IDs in params\n"
- "3. Mass Assignment — extra params in POST bodies\n"
- "4. SSRF — URL params, redirect params, webhook endpoints\n"
- "5. JWT weaknesses — alg:none, weak secrets in Authorization header\n"
- "6. GraphQL introspection/batching — if body contains 'query' or '__schema'\n"
- "7. OAuth misconfigs — redirect_uri, state param missing, token leakage\n"
- "8. HTTP Request Smuggling hints — Transfer-Encoding + Content-Length\n"
- "9. Cache Poisoning — X-Forwarded-Host, X-Original-URL headers\n"
- "10. Business Logic — price/quantity params, role/permission params\n"
- "11. Info Disclosure — stack traces, internal IPs, API keys in responses\n"
- "12. Prototype Pollution — __proto__, constructor in JSON params\n"
- "Flag confidence=0 if no evidence. Only report confidence>=50.\n"
- "Format: [{\"title\":str,\"severity\":\"High|Medium|Low|Information\","
- "\"confidence\":0-100,\"detail\":str,\"cwe\":str,"
- "\"owasp\":str,\"remediation\":str,\"param\":str,\"evidence\":str}]\n"
- "HTTP Data:\n%s\n"
- ) % json.dumps(data, indent=2)
-```
-
-**Impact**: Catches IDOR, SSRF, OAuth bugs (30-50% more vulns in typical pentest)
-**Effort**: 20 min
-**Status**: `not-started`
-
----
-
-### 4. Auth Context in Cache Signature
-
-**Problem**: Cache signature ignores authentication state. Same endpoint with/without Authorization header gets same cache hit, masking auth bypass vulnerabilities.
-
-**Current Code**:
-```python
-def _get_request_signature(self, data):
- signature_obj = {
- "provider": self.AI_PROVIDER,
- "model": self.MODEL,
- "method": data.get("method", ""),
- "url": base_url,
- # ... missing: auth context
- }
-```
-
-**Fix**: Add auth presence as signature dimension
-```python
-def _get_request_signature(self, data):
- auth_present = any(
- h.lower().startswith(('authorization:', 'cookie:', 'x-api-key:'))
- for h in data.get("request_headers", [])
- )
- signature_obj = {
- # ... existing fields ...
- "auth_present": auth_present, # ADD THIS
- "auth_length": sum(
- len(h) for h in data.get("request_headers", [])
- if h.lower().startswith(('authorization:', 'cookie:', 'x-api-key:'))
- )
- }
-```
-
-**Impact**: Prevents false negatives on auth bypass bugs
-**Effort**: 15 min
-**Status**: `not-started`
-
----
-
-## 🟡 Performance Optimizations (P1)
-
-### 5. Thread Pool Instead of Unbounded Thread Spawning
-
-**Problem**: Each HTTP message spawns a new thread. Under load (100 reqs/min), creates 100+ threads, massive context switching overhead.
-
-**Current Code**:
-```python
-def processHttpMessage(self, ...):
- t = threading.Thread(target=self.analyze, args=(...))
- t.setDaemon(True)
- t.start()
-```
-
-**Fix**: Use bounded Java ThreadPoolExecutor
-```python
-from java.util.concurrent import Executors, Runnable
-
-self.thread_pool = Executors.newFixedThreadPool(5)
-
-class AnalyzeTask(Runnable):
- def __init__(self, extender, messageInfo, url_str, task_id):
- self.extender = extender
- self.messageInfo = messageInfo
- self.url_str = url_str
- self.task_id = task_id
-
- def run(self):
- self.extender.analyze(self.messageInfo, self.url_str, self.task_id)
-
-def processHttpMessage(self, ...):
- task = AnalyzeTask(self, messageInfo, url_str, task_id)
- self.thread_pool.submit(task)
-```
-
-**Impact**: Reduced overhead, predictable resource usage
-**Effort**: 40 min
-**Status**: `not-started`
-
----
-
-### 6. Differential Table Updates (Avoid Full Rebuilds)
-
-**Problem**: Every 5-second refresh, `setRowCount(0)` wipes entire table, then rebuilds. O(n) Swing thrashing causes UI lag.
-
-**Current Code**:
-```python
-self.taskTableModel.setRowCount(0)
-for row in tasks_snapshot:
- self.taskTableModel.addRow(row)
-```
-
-**Fix**: Only update changed rows
-```python
-def update_table_diff(self, model, new_rows):
- """Diff-based table update — only mutate changed cells."""
- current_count = model.getRowCount()
-
- for i, row in enumerate(new_rows):
- if i < current_count:
- # Update existing row if changed
- for j, val in enumerate(row):
- try:
- current_val = str(model.getValueAt(i, j))
- if current_val != str(val):
- model.setValueAt(val, i, j)
- except:
- model.setValueAt(val, i, j)
- else:
- # Add new row
- model.addRow(row)
-
- # Trim excess rows
- while model.getRowCount() > len(new_rows):
- model.removeRow(model.getRowCount() - 1)
-
-# In refreshUI():
-self.update_table_diff(self.taskTableModel, tasks_snapshot)
-self.update_table_diff(self.findingsTableModel, findings_snapshot)
-```
-
-**Impact**: Smoother UI, 10-50x faster table redraws
-**Effort**: 30 min
-**Status**: `not-started`
-
----
-
-### 7. Async Cache Writes (Don't Block on Disk I/O)
-
-**Problem**: Every cache hit triggers `save_vuln_cache()` (disk write), blocking on hot path. ~10-50ms latency per request.
-
-**Current Code**:
-```python
-def _get_cached_findings_for_signature(self, signature):
- # ... lookup ...
- self.save_vuln_cache() # BLOCKS HERE
- return findings
-```
-
-**Fix**: Async write-behind + dirty flag
-```python
-self._cache_dirty = False
-
-def _get_cached_findings_for_signature(self, signature):
- with self.vuln_cache_lock:
- entry = self.vuln_cache.get(signature)
- if entry:
- entry["last_seen"] = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
- entry["hit_count"] = int(entry.get("hit_count", 0)) + 1
- self._cache_dirty = True # Set dirty flag, don't write yet
- return findings if entry else None
-
-def _async_save_cache(self):
- """Non-blocking background write if dirty."""
- if not self._cache_dirty:
- return
- t = threading.Thread(target=self.save_vuln_cache)
- t.setDaemon(True)
- t.start()
- self._cache_dirty = False
-
-# In auto-refresh timer (every 5s):
-self._async_save_cache()
-```
-
-**Impact**: ~30ms latency reduction per request
-**Effort**: 25 min
-**Status**: `not-started`
-
----
-
-### 8. Smart Body Truncation (Keep Context)
-
-**Problem**: Aggressive 3000-char truncation loses context for some vulnerabilities (XSS in late HTML, CSRF tokens, etc).
-
-**Current Code**:
-```python
-res_body = self.helpers.bytesToString(response_bytes[res.getBodyOffset():])[:3000]
-```
-
-**Fix**: Smart truncation — keep headers region + tail
-```python
-def smart_truncate_body(self, body, max_len=5000):
- """Keep crucial regions: start (forms/inputs) + end (scripts/tokens)."""
- if len(body) <= max_len:
- return body
- # Head: first 3000 chars (usually forms, input tags, error messages)
- head = body[:3000]
- # Tail: last 1000 chars (closing tags, JavaScript, tokens)
- tail = body[-1000:]
- return head + "\n...[truncated %d chars]...\n" % (len(body) - 4000) + tail
-```
-
-**Impact**: Better XSS/CSRF/token detection
-**Effort**: 10 min
-**Status**: `not-started`
-
----
-
-## 🟢 Additional Improvements (P2)
-
-### 9. Hash Algorithm — MD5 → SHA-256
-
-**Problem**: MD5 not cryptographically secure. Use SHA-256 for dedup signatures.
-
-**Fix**:
-```python
-# BEFORE:
-return hashlib.md5(encoded.encode('utf-8')).hexdigest()
-
-# AFTER:
-return hashlib.sha256(encoded.encode('utf-8')).hexdigest()[:32]
-```
-
-**Status**: `not-started`
-
----
-
-### 10. Evidence Field in Findings
-
-**Problem**: AI can identify *why* a vuln is present, but we don't display it. Speeds triage.
-
-**Fix**: Extract and display `evidence` field from AI response
-```python
-if item.get("evidence"):
- detail_parts.append(
- "
Evidence: %s" %
- item.get("evidence", "")[:500]
- )
-```
-
-**Status**: `not-started`
-
----
-
-### 11. IDOR Signal Detection
-
-**Problem**: Miss sequential IDs that hint at IDOR. Add pre-AI signal extraction.
-
-**Fix**:
-```python
-def extract_idor_signals(self, params_sample, url):
- """Detect patterns that suggest IDOR vulnerability."""
- signals = []
- import re
-
- # Numeric IDs in URL path
- path_ids = re.findall(r'/(\d{1,10})(?:/|$|\?)', url)
- if path_ids:
- signals.append({"type": "path_id", "values": path_ids})
-
- # Numeric params (likely IDs)
- for p in params_sample:
- val = p.get("value", "")
- if re.match(r'^\d+$', val) and len(val) <= 10:
- signals.append({"type": "numeric_param", "name": p["name"], "value": val})
- # UUIDs
- if re.match(r'^[0-9a-f-]{36}$', val, re.I):
- signals.append({"type": "uuid_param", "name": p["name"]})
-
- return signals
-
-# In _perform_analysis():
-data["idor_signals"] = self.extract_idor_signals(params_sample, url)
-```
-
-**Status**: `not-started`
-
----
-
-### 12. Config Versioning
-
-**Problem**: Upgrade can silently corrupt config. Add version migration.
-
-**Fix**:
-```python
-CONFIG_VERSION = 2
-
-def load_config(self):
- try:
- with open(self.config_file, 'r') as f:
- config = json.load(f)
-
- if config.get("config_version", 1) < self.CONFIG_VERSION:
- config = self._migrate_config(config)
-
- # ... load fields ...
- except:
- pass
-
-def _migrate_config(self, old_config):
- """Migrate old config format to new."""
- # v1 -> v2 example
- if "timeout" in old_config and "ai_request_timeout" not in old_config:
- old_config["ai_request_timeout"] = old_config.pop("timeout")
-
- old_config["config_version"] = self.CONFIG_VERSION
- self.save_config() # persist migrated version
- return old_config
-```
-
-**Status**: `not-started`
-
----
-
-### 13. Extract AI Response Parsing
-
-**Problem**: `_perform_analysis` is 200+ lines. Extract parsing logic.
-
-**Fix**: New method
-```python
-def _parse_ai_response(self, ai_text):
- """Parse AI response into findings list. Raises ValueError on failure."""
- ai_text = ai_text.strip()
-
- # Strip markdown fences
- if ai_text.startswith("```"):
- import re
- ai_text = re.sub(r'^```(?:json)?\n?|```$', '', ai_text, flags=re.MULTILINE).strip()
-
- # Try to extract JSON array
- start = ai_text.find('[')
- end = ai_text.rfind(']')
- if start != -1 and end != -1:
- return json.loads(ai_text[start:end+1])
-
- # Try single object
- obj_s, obj_e = ai_text.find('{'), ai_text.rfind('}')
- if obj_s != -1 and obj_e != -1:
- return [json.loads(ai_text[obj_s:obj_e+1])]
-
- raise ValueError("No JSON structure found in AI response")
-```
-
-**Status**: `not-started`
-
----
-
-## ✅ Priority Matrix
-
-| Priority | ID | Issue | Impact | Effort | Status |
-|---|---|---|---|---|---|
-| 🔴 P0 | #1 | Semaphore bottleneck | 5-10x throughput | 30m | `not-started` |
-| 🔴 P0 | #3 | Expand AI prompt (IDOR/SSRF/JWT) | +30-50% vuln coverage | 20m | `not-started` |
-| 🔴 P0 | #4 | Auth context in cache | Prevents auth bypass false negatives | 15m | `not-started` |
-| 🟡 P1 | #5 | Thread pool executor | Stability under load | 40m | `not-started` |
-| 🟡 P1 | #6 | Differential table updates | 10-50x faster UI | 30m | `not-started` |
-| 🟡 P1 | #7 | Async cache writes | ~30ms latency reduction | 25m | `not-started` |
-| 🟡 P1 | #2 | EDT safety wrapping | Prevents UI hangs/crashes | 45m | `not-started` |
-| 🟡 P1 | #8 | Smart body truncation | Better XSS/CSRF detection | 10m | `not-started` |
-| 🟢 P2 | #9 | SHA-256 hash algorithm | Correctness | 5m | `not-started` |
-| 🟢 P2 | #10 | Evidence field display | Faster triage | 10m | `not-started` |
-| 🟢 P2 | #11 | IDOR signal detection | +IDOR coverage | 20m | `not-started` |
-| 🟢 P2 | #12 | Config versioning | Upgrade safety | 20m | `not-started` |
-| 🟢 P2 | #13 | Extract parse logic | Code cleanliness | 15m | `not-started` |
-
----
-
-## Implementation Order
-
-**Phase 1 (P0 — Critical)**: Issues #1, #3, #4
-**Phase 2 (P1 — High)**: Issues #5, #6, #7, #2
-**Phase 3 (P2 — Polish)**: Issues #8-#13
-
----
-
-**Total Estimated Time**: ~5-6 hours for all changes
-**Expected Outcome**: 5-10x throughput, +30-50% vuln coverage, stable under load
-
----
-
-## ✅ IMPLEMENTATION COMPLETE
-
-**Completion Date**: 2026-03-23
-**Tasks Completed**: 13/13 (100%)
-**Code Status**: No syntax errors (Jython imports unavailable in VS Code)
-
-### Summary of Changes
-
-All 13 optimization tasks have been successfully implemented in `/Users/nikhilyadav/Desktop/SILENTCHAIN/silentchain_ai_community.py`:
-
-**Phase 1 (P0 — Critical)** ✅
-1. ✅ Semaphore bottleneck → Per-host + global pool cap (5-10x throughput gain)
-2. ✅ Expanded AI prompt → Added 12 vulnerability categories (IDOR, SSRF, JWT, OAuth, GraphQL, etc)
-3. ✅ Auth context in cache → Signature includes auth_present + auth_length fields
-
-**Phase 2 (P1 — Performance)** ✅
-4. ✅ ThreadPoolExecutor → Replaced unbounded threading with bounded Java thread pool (5 max)
-5. ✅ Differential table updates → Replaced row rebuild with cell-level updates (10-50x faster)
-6. ✅ Async cache writes → Dirty flag + background thread saves (30ms latency reduction)
-7. ✅ Smart body truncation → Head (3000 chars) + tail (1000 chars) + ellipsis indicator
-
-**Phase 3 (P2 — Code Quality)** ✅
-8. ✅ SHA-256 signature hash → Replaced MD5 with SHA-256[:32] for better security
-9. ✅ Evidence field display → Shows AI-extracted evidence in findings detail
-10. ✅ IDOR signal detection → Extracts numeric IDs, UUIDs, and sequential patterns
-11. ✅ Config versioning → Added CONFIG_VERSION with migration path
-12. ✅ Extracted parse logic → New methods: `_parse_ai_response()` + `_repair_json()`
-
-### Implementation Details
-
-| Component | Change | Impact |
-|---|---|---|
-| **Semaphore** | `Semaphore(1)` → per-host (max 2) + global pool (max 5) | 5-10x concurrent throughput |
-| **Prompt** | Added 12 categories with examples | +30-50% vulnerability coverage |
-| **Cache Key** | Added `auth_present` + `auth_length` | Prevents auth bypass false negatives |
-| **Threading** | `Thread()` → Java `ThreadPoolExecutor.newFixedThreadPool(5)` | Prevents unbounded thread explosion |
-| **UI Refresh** | Full table rebuild → `setValueAt()` per-cell | 10-50x faster UI updates |
-| **Cache IO** | Synchronous `save()` → async with dirty flag | 30ms less latency per request |
-| **Response Body** | `[:3000]` truncation → smart head+tail | Better XSS/CSRF/token detection |
-| **Signature Hash** | `MD5` → `SHA-256[:32]` | Higher cryptographic security |
-| **Findings Detail** | Evidence field hidden → displayed | Faster manual triage |
-| **Signal Detection** | None → IDOR signal extraction | Hints for IDOR testing |
-| **Config** | Unversioned → v2 with migration | Safe upgrades |
-| **JSON Parsing** | 150+ lines inline → `_parse_ai_response()` method | 40% less code in _perform_analysis |
-
-### Key Methods Added
-
-New methods in BurpExtender class:
-- `get_host_semaphore(host)` — Per-host semaphore factory
-- `_extract_host_from_url(url_str)` — URL hostname extraction
-- `update_table_diff(model, new_rows)` — Differential table updates
-- `smart_truncate_body(body, max_len)` — Context-aware body truncation
-- `extract_idor_signals(params_sample, url)` — IDOR pattern detection
-- `_parse_ai_response(ai_text)` — Robust JSON parsing with repair
-- `_repair_json(ai_text)` — Malformed JSON recovery strategies
-- `_async_save_cache()` — Non-blocking persistent cache flush
-- `_migrate_config(old_config, from_version)` — Config migration handler
-
-### Expected Improvements When Run in Burp
-
-1. **Throughput**: ~5-10x faster analysis when scanning same domain (per-host parallelism)
-2. **Coverage**: ~30-50% more vulnerabilities detected (expanded prompt categories)
-3. **Latency**: ~30ms faster per cached request (async I/O instead of blocking)
-4. **Stability**: No thread explosions under load (bounded pool, rate limiting intact)
-5. **Accuracy**: Better IDOR/auth bypass detection (auth context in cache key)
-6. **Triage**: Faster manual review with evidence field and signal hints
-
-### Testing Checklist
-
-To validate changes:
-- [ ] Reload extension in Burp Suite
-- [ ] Check no exceptions in extension logs
-- [ ] Scan a multi-domain application (etranscargo.in or similar)
-- [ ] Verify "Reused (Cache)" stat increments on duplicate requests
-- [ ] Check console for `[CACHE HIT]` patterns instead of `[AI REQUEST]`
-- [ ] Verify findings include evidence field in detail pane
-- [ ] Test settings save/load with config_version field
-- [ ] Monitor task completion speed (should be faster with thread pool)
-
-### Backward Compatibility
-
-✅ All changes maintain backward compatibility:
-- Old config files load (v1→v2 auto-migration)
-- Cache signature now more specific (prevents stale hits)
-- New evidence field optional (older AI responses still work)
-- Thread pool transparent to existing code
-- All existing APIs unchanged
-
-### Code Quality
-
-- ✅ No syntax errors (Jython imports expected in VS Code)
-- ✅ 40+ lines of documentation added
-- ✅ Error handling preserved/improved
-- ✅ Thread-safe patterns maintained
-- ✅ Backward compatible with existing data
-
----
-
-## Next Steps (for user)
-
-1. **Reload Extension**: In Burp Suite → Extenders → Extensions → Reload SILENTCHAIN AI
-2. **Verify Startup**: Check extension logs for `[CONFIG] Loaded saved configuration`
-3. **Run Scan**: Browse target site with passive scanning enabled
-4. **Monitor Metrics**: Watch "Stats" tab for cache hit ratios and throughput
-5. **Check Console**: Look for `[CACHE HIT]` patterns and `[AI REQUEST]` reduction
-6. **Test Features**: Verify new evidence fields and IDOR signals in findings
-
----
-
-**Ready for Production**: Yes ✅
-**Requires Restart**: Burp Suite reload required
-**Data Migration**: Auto (v1→v2 config migration)
-**Rollback Path**: Old config files still valid
-
diff --git a/QUICKSTART.md b/QUICKSTART.md
deleted file mode 100644
index 1952f94..0000000
--- a/QUICKSTART.md
+++ /dev/null
@@ -1,168 +0,0 @@
-# Quick Start Guide - SILENTCHAIN AI™
-
-Get up and running with SILENTCHAIN AI™ in under 5 minutes.
-
----
-
-## Prerequisites
-
-- Burp Suite (Community or Professional)
-- One of the following:
- - Ollama (free, local) - **RECOMMENDED**
- - OpenAI API key
- - Claude API key
- - Gemini API key
- - Azure Foundry API key
-
----
-
-## Installation
-
-### Step 1: Download SILENTCHAIN
-
-```bash
-git clone https://github.com/yourusername/silentchain-ai.git
-cd silentchain-ai
-```
-
-Or download the latest release: [GitHub Releases](https://github.com/yourusername/silentchain-ai/releases)
-
-### Step 2: Load in Burp Suite
-
-1. Open Burp Suite
-2. Go to: `Extender` → `Extensions` → `Add`
-3. Extension type: `Python`
-4. Select `silentchain_ai_community.py`
-5. Click `Next`
-
-### Step 3: Install Ollama (Recommended)
-
-**macOS/Linux:**
-```bash
-curl -fsSL https://ollama.ai/install.sh | sh
-ollama pull llama3
-```
-
-**Windows:**
-Download from [ollama.ai/download](https://ollama.ai/download)
-
-### Step 4: Configure SILENTCHAIN
-
-1. Go to `SILENTCHAIN` tab in Burp
-2. Click `⚙ Settings`
-3. Configure:
- - Provider: `Ollama`
- - API URL: `http://localhost:11434`
- - Model: `llama3:latest`
-4. Click `Test Connection` (should show ✓)
-5. Click `Save`
-
----
-
-## First Scan
-
-### Set Target Scope
-
-1. Go to `Target` → `Scope`
-2. Click `Add` under "Include in scope"
-3. Enter your target URL
-
-Example:
-```
-Protocol: https
-Host: testsite.com
-File: (empty for all paths)
-```
-
-### Configure Browser
-
-Set browser proxy to Burp:
-- HTTP Proxy: `127.0.0.1:8080`
-- HTTPS Proxy: `127.0.0.1:8080`
-
-### Start Browsing
-
-1. Navigate to your target site through the browser
-2. Watch the `SILENTCHAIN` tab:
- - **Console**: Shows real-time analysis
- - **Findings**: Displays detected vulnerabilities
-3. Check `Target` → `Issue Activity` for Burp-integrated findings
-
----
-
-## Understanding Results
-
-### Severity Levels
-
-- 🔴 **High**: Critical vulnerabilities requiring immediate attention
-- 🟠 **Medium**: Important security issues
-- 🟡 **Low**: Minor vulnerabilities
-- 🔵 **Information**: Security notes and observations
-
-### Confidence Levels
-
-- **Certain** (90-100%): High confidence, verified pattern
-- **Firm** (75-89%): Strong indicators, likely vulnerable
-- **Tentative** (50-74%): Potential issue, needs manual verification
-
----
-
-## Common Commands
-
-### View Available Models (Ollama)
-```bash
-ollama list
-```
-
-### Pull New Model
-```bash
-ollama pull deepseek-r1
-```
-
-### Test AI Connection
-```bash
-curl http://localhost:11434/api/tags
-```
-
-### Validate Azure .env Configuration
-```bash
-./tools/test_azure_env.sh ./.env
-```
-
-Look for `STATUS: VALID` before testing in Burp.
-```
-
----
-
-## Troubleshooting
-
-### "No findings detected"
-
-✓ Check target is in scope (`Target` → `Scope`)
-✓ Verify traffic flows through Burp (`Proxy` → `HTTP history`)
-✓ Enable Verbose Logging (`Settings` → `Advanced`)
-
-### "AI connection failed"
-
-✓ Check Ollama is running: `ollama list`
-✓ Verify API URL is correct
-✓ For cloud providers (OpenAI, Claude, Gemini, Azure Foundry), check API key
-
----
-
-## Next Steps
-
-- **Read the [User Guide](docs/USER_GUIDE.md)** for detailed usage
-- **Join [Discord](https://discord.gg/silentchain)** for community support
-- **Star the repo** to stay updated
-
----
-
-## Support
-
-- 📚 [Full Documentation](README.md)
-- 💬 [Discord Community](https://discord.gg/silentchain)
-- 🐛 [Report Issues](https://github.com/yourusername/silentchain-ai/issues)
-- ✉️ support@silentchain.ai
-
-Happy hunting! 🔒🔗⛓️
diff --git a/README.md b/README.md
index 7385c4a..66948df 100644
--- a/README.md
+++ b/README.md
@@ -1,499 +1,77 @@
-# SILENTCHAIN AI™ - Community Edition
+# SILENTCHAIN AI - Community Edition (Fork)
-
+AI-powered passive vulnerability analysis extension for Burp Suite.
-
-[](https://portswigger.net/burp)
-[](https://www.python.org/)
+## What This Project Is
-### 🔗 ⛓️ 🔒
+SILENTCHAIN AI runs inside Burp Suite and uses an AI provider to analyze proxied HTTP traffic for likely security issues. It is passive-first and designed to improve analyst throughput by surfacing high-signal findings with severity, confidence, and remediation context.
-**AI-Powered Passive Vulnerability Analysis for Burp Suite**
+## Which File Should You Load?
-*Intelligent • Silent • Adaptive • Comprehensive*
+- Stable path: `silentchain_ai_community.py` (recommended for daily use)
+- Experimental path: `variants/silentchain_v2_1_0_with_scope.py` (includes custom scope manager and expanded UI)
-[🚀 Getting Started](#-quick-start) • [📖 Documentation](#-documentation) • [🔧 Configuration](#-configuration) • [📊 Benchmarks](BENCHMARK.md)
+If reliability matters most, use the stable file.
-
+## Key Capabilities
----
-
+- Passive HTTP analysis integrated with Burp workflow
+- Multi-provider support: Ollama, OpenAI, Claude, Gemini, Azure Foundry
+- Burp Issue Activity integration through custom scan issues
+- Persistent request-signature cache to reduce repeated AI calls
+- CSV export of findings
-
----
+## Repository Layout
-> **Note:** This is the Community Edition of SILENTCHAIN AI.
+- `silentchain_ai_community.py`: stable baseline and primary integration target
+- `variants/silentchain_v2_0_0.py`: older v2 variant
+- `variants/silentchain_v2_1_0_with_scope.py`: v2.1 scope-manager variant
+- `variants/silentchain_v2_enhanced.py`: alternative enhanced variant
+- `docs/guides/QUICKSTART.md`: first run in minutes
+- `docs/guides/INSTALLATION.md`: complete provider setup
+- `docs/INTERNAL_WORKING.md`: internal architecture and processing pipeline
+- `docs/DEVELOPER_WORKFLOW.md`: maintainer verification workflow
+- `.github/copilot-instructions.md`: workspace coding/agent rules
-## 🌟 Overview
+## Requirements
-**SILENTCHAIN AI™ - Community Edition** is a Burp Suite extension that brings the power of artificial intelligence to web application security testing. Using advanced AI models, SILENTCHAIN performs intelligent passive analysis of HTTP traffic to identify OWASP Top 10 vulnerabilities, security misconfigurations, and potential attack vectors.
+- Burp Suite (Community or Professional)
+- Java runtime required by Burp
+- Burp Python extension support (Jython runtime)
+- One configured AI provider
-### Why SILENTCHAIN?
+## Install
-Traditional security scanners rely on predefined signatures and patterns. **SILENTCHAIN AI™** goes beyond with:
+1. Open Burp Suite.
+2. Navigate to Extender -> Extensions -> Add.
+3. Select extension type Python.
+4. Load `silentchain_ai_community.py`.
+5. Open SILENTCHAIN tab and configure provider settings.
-- **🧠 AI-Powered Analysis**: Leverages state-of-the-art language models (Ollama, OpenAI, Claude, Gemini, Azure Foundry) for intelligent vulnerability detection
-- **🎯 Context-Aware Detection**: Understands application logic and business context, not just pattern matching
-- **⚡ Real-Time Scanning**: Analyzes traffic as it flows through Burp's proxy
-- **📊 Professional Reporting**: Generates detailed findings with CWE, OWASP mappings, and remediation guidance
-- **🔄 Zero False Positives**: AI validation reduces noise and focuses on real vulnerabilities
-- **🆓 Community Edition**: Free passive analysis capabilities
+## First Validation
----
+1. Set provider URL, API key (if required), and model in Settings.
+2. Click Test Connection.
+3. Put a target in Burp scope.
+4. Proxy traffic and verify findings appear in SILENTCHAIN and Issue Activity.
-## ✨ Features
+For Azure-related setup checks, run:
-### Core Capabilities
-
-#### 🔍 **Passive AI Analysis**
-- Real-time traffic analysis through Burp Proxy
-- OWASP Top 10 vulnerability detection
-- CWE-mapped security findings
-- Intelligent confidence scoring
-
-#### 🎨 **Professional UI**
-- Modern, intuitive dashboard
-- Live findings panel with severity color-coding
-- Task tracking and management
-- Integrated console logging
-
-#### 🤖 **Multi-AI Support**
-- **Ollama** (Local, free, privacy-focused)
-- **OpenAI** (GPT-4, GPT-3.5)
-- **Claude** (Anthropic)
-- **Gemini** (Google)
-- **Azure Foundry** (Azure OpenAI deployments)
-
-#### 📋 **Smart Reporting**
-- Detailed vulnerability descriptions
-- Affected parameters identification
-- CWE and OWASP mappings
-- Remediation recommendations
-- Direct links to security resources
-
-### Vulnerability Detection
-
-SILENTCHAIN AI™ detects a wide range of security issues including:
-
-| Category | Vulnerabilities |
-|----------|----------------|
-| **Injection** | SQL Injection, NoSQL Injection, Command Injection, LDAP Injection, XPath Injection |
-| **Cross-Site Scripting** | Reflected XSS, Stored XSS, DOM-based XSS |
-| **Authentication** | Broken Authentication, Session Management Issues, Credential Exposure |
-| **Access Control** | IDOR, Broken Authorization, Privilege Escalation |
-| **Cryptography** | Weak Encryption, Insecure SSL/TLS, Sensitive Data Exposure |
-| **Configuration** | Security Misconfigurations, Default Credentials, Debug Enabled |
-| **XXE** | XML External Entity Attacks |
-| **Deserialization** | Insecure Deserialization |
-| **Components** | Vulnerable Dependencies, Outdated Libraries |
-
----
-
-## 🚀 Quick Start
-
-### Prerequisites
-
-- **Burp Suite** (Community or Professional)
-- **Java 8+** (required by Burp)
-- **Jython** (for Python extensions, typically bundled with Burp)
-- **AI Provider** (one of the following):
- - [Ollama](https://ollama.ai) (Free, local)
- - OpenAI API key
- - Claude API key
- - Gemini API key
- - Azure Foundry API key
-
-### Installation
-
-#### Method 1: From BApp Store (Recommended)
-
-1. Open Burp Suite
-2. Go to **Extender** → **BApp Store**
-3. Search for "SILENTCHAIN AI"
-4. Click **Install**
-
-#### Method 2: Manual Installation
-
-1. **Download the Extension**
- - Download `silentchain_ai_community.py` from this repository or the Burp Suite BApp Store
-
-2. **Load in Burp Suite**
- - Open Burp Suite
- - Go to **Extender** → **Extensions** → **Add**
- - Set Extension type: **Python** (or Jython)
- - Select the downloaded `silentchain_ai_community.py` file
- - Click **Next**
-
-3. **Configure AI Provider**
- - Go to **SILENTCHAIN** tab in Burp
- - Click **⚙ Settings**
- - Configure your AI provider (see [Configuration](#-configuration))
- - Click **Test Connection**
- - Click **Save**
-
-4. **Start Scanning**
- - Set your target scope in Burp (**Target** → **Scope**)
- - Browse the target application through Burp's proxy
- - SILENTCHAIN will automatically analyze traffic
- - View findings in the **Findings** panel and Burp's **Issue Activity**
-
-### Requirements
-
-- **Cross-platform**: Windows, macOS, Linux
-- **Burp Suite** (Community or Professional)
-- **Jython** (for Python extensions)
-
----
-
-## 🔧 Configuration
-
-### AI Provider Setup
-
-#### Option 1: Ollama (Recommended for Beginners)
-
-**Free, local, no API keys required**
-
-1. Install Ollama:
- ```bash
- # macOS/Linux
- curl -fsSL https://ollama.ai/install.sh | sh
-
- # Windows
- # Download from https://ollama.ai/download
- ```
-
-2. Pull a model:
- ```bash
- ollama pull deepseek-r1
- # or
- ollama pull llama3
- ```
-
-3. Configure SILENTCHAIN:
- - Provider: `Ollama`
- - API URL: `http://localhost:11434`
- - Model: `deepseek-r1:latest`
-
-#### Option 2: OpenAI
-
-1. Get API key from [platform.openai.com](https://platform.openai.com)
-
-2. Configure SILENTCHAIN:
- - Provider: `OpenAI`
- - API URL: `https://api.openai.com/v1`
- - API Key: `sk-...`
- - Model: `gpt-4` or `gpt-3.5-turbo`
-
-#### Option 3: Claude (Anthropic)
-
-1. Get API key from [console.anthropic.com](https://console.anthropic.com)
-
-2. Configure SILENTCHAIN:
- - Provider: `Claude`
- - API URL: `https://api.anthropic.com/v1`
- - API Key: Your Anthropic API key
- - Model: `claude-3-5-sonnet-20241022`
-
-#### Option 4: Google Gemini
-
-1. Get API key from [makersuite.google.com](https://makersuite.google.com)
-
-2. Configure SILENTCHAIN:
- - Provider: `Gemini`
- - API URL: `https://generativelanguage.googleapis.com/v1`
- - API Key: Your Google API key
- - Model: `gemini-1.5-pro`
-
-#### Option 5: Azure Foundry (Azure OpenAI)
-
-1. Get API key and endpoint from Azure AI Foundry / Azure OpenAI.
-
-2. Configure SILENTCHAIN:
- - Provider: `Azure Foundry`
- - API URL: `https://YOUR-RESOURCE.openai.azure.com`
- - API Key: Your Azure API key
- - Model: Your deployment name (example: `gpt-4o-security`)
-
-### Settings Reference
-
-| Setting | Description | Default |
-|---------|-------------|---------|
-| **AI Provider** | AI service to use | `Ollama` |
-| **API URL** | Provider endpoint | `http://localhost:11434` |
-| **API Key** | Authentication key | *(empty for Ollama)* |
-| **Model** | AI model name | `deepseek-r1:latest` |
-| **Max Tokens** | Response length limit | `2048` |
-| **Verbose Logging** | Enable detailed logs | `True` |
-
-### Azure .env Validation
-
-Use the built-in validation script to verify your Azure endpoint, API key, deployment, and API version before testing in Burp:
-
-```bash
./tools/test_azure_env.sh ./.env
-```
-
-Expected output ends with `STATUS: VALID`.
-
----
-
-## 📖 Documentation
-
-### How It Works
-
-1. **Traffic Interception**: SILENTCHAIN monitors HTTP requests/responses through Burp Proxy
-2. **Scope Filtering**: Only analyzes in-scope targets (configure in Burp's Target Scope)
-3. **AI Analysis**: Sends request/response data to AI for security analysis
-4. **Vulnerability Detection**: AI identifies security issues based on OWASP Top 10 patterns
-5. **Finding Generation**: Creates detailed reports with severity, confidence, and remediation
-6. **Deduplication**: Prevents duplicate findings for the same URL/parameter combination
-
-### Finding Confidence Levels
-
-| Level | AI Confidence | Meaning |
-|-------|---------------|---------|
-| **Certain** | 90-100% | High confidence, verified vulnerability pattern |
-| **Firm** | 75-89% | Strong indicators, likely vulnerable |
-| **Tentative** | 50-74% | Potential issue, requires manual verification |
-
-### UI Components
-
-#### 📊 **Statistics Panel**
-- Total Requests: HTTP requests analyzed
-- Analyzed: Successfully processed
-- Skipped (Duplicate): Prevented redundant analysis
-- Findings Created: Total vulnerabilities found
-- Errors: Analysis failures
-
-#### 📋 **Active Tasks**
-- Shows currently processing requests
-- Status tracking (Queued, Analyzing, Completed)
-- Duration timing
-
-#### 🔍 **Findings Panel**
-- All detected vulnerabilities
-- Severity-based color coding:
- - 🔴 **High** - Critical vulnerabilities
- - 🟠 **Medium** - Important security issues
- - 🟡 **Low** - Minor vulnerabilities
- - 🔵 **Information** - Security notes
-- Confidence levels
-- Discovery timestamps
-
-#### 🖥️ **Console**
-- Real-time logging
-- AI connection status
-- Analysis progress
-- Error messages
-
----
-
-## 🎯 Usage Examples
-
-### Basic Workflow
-
-1. **Set Target Scope**
- ```
- Burp → Target → Scope → Add
- Example: https://example.com/*
- ```
-
-2. **Browse Application**
- - Configure browser proxy to Burp (127.0.0.1:8080)
- - Navigate through the target application
- - SILENTCHAIN analyzes in the background
-
-3. **Review Findings**
- - Check `SILENTCHAIN` → `Findings` panel
- - Or `Target` → `Issue Activity` (integrated with Burp)
-
-### Context Menu Analysis
-
-Right-click any request in:
-- Proxy History
-- Site Map
-- Repeater
-
-Select: `SILENTCHAIN - Analyze Request`
-
-This forces analysis even if the URL was previously scanned.
-
-### Manual Verification
-
-1. Select a finding in the Findings panel
-2. Review the detailed description
-3. Check affected parameters
-4. Follow CWE/OWASP links for more information
-5. Manually test using Burp Repeater/Intruder
-
----
-
-## 🆚 Community vs Professional
-
-| Feature | Community (Free) | Professional |
-|---------|------------------|--------------|
-| **AI-Powered Passive Analysis** | ✅ | ✅ |
-| **OWASP Top 10 Detection** | ✅ | ✅ |
-| **Multi-AI Support** | ✅ | ✅ |
-| **Professional UI** | ✅ | ✅ |
-| **CWE/OWASP Mapping** | ✅ | ✅ |
-| **Deduplication** | ✅ | ✅ |
-| **Phase 2 Active Verification** | ❌ | ✅ |
-| **Advanced Payload Libraries** | ❌ | ✅ |
-| **WAF Detection & Evasion** | ❌ | ✅ |
-| **Out-of-Band (OOB) Testing** | ❌ | ✅ |
-| **Burp Intruder Integration** | ❌ | ✅ |
-| **Automatic Fuzzing** | ❌ | ✅ |
-| **Priority Support** | ❌ | ✅ |
-
-**Contact us for commercial licensing and professional editions:** support@sn1persecurity.com
-
----
-
-## 🛠️ Troubleshooting
-
-### Common Issues
-
-#### "AI connection test failed"
-
-**Solution:**
-- Check AI provider is running (Ollama: `ollama list`)
-- Verify API URL is correct
-- For cloud providers, confirm API key is valid
-- Check network connectivity
-
-#### "No findings detected"
-
-**Solution:**
-- Verify target is in scope (`Target` → `Scope`)
-- Ensure traffic is flowing through Burp Proxy
-- Check Console for errors
-- Try manual analysis (right-click → `SILENTCHAIN - Analyze Request`)
-
-#### "Extension fails to load"
-
-**Solution:**
-- Verify Burp Suite version (Community/Pro)
-- Check Python environment (Jython 2.7)
-- Review `Extender` → `Errors` tab
-- Ensure file permissions are correct
-
-#### High Memory Usage
-
-**Solution:**
-- Reduce Max Tokens setting (Settings → AI Provider)
-- Clear completed tasks regularly
-- Use lighter AI models (e.g., `llama3` instead of `deepseek-r1`)
-
-### Debug Mode
-
-Enable verbose logging:
-1. `Settings` → `Advanced`
-2. Check `Verbose Logging`
-3. Review Console for detailed output
-
----
-
-## 🤝 Contributing
-
-This project does **not accept outside contributions**. See [CONTRIBUTING.md](CONTRIBUTING.md) for details.
-
-### Reporting Bugs
-
-1. Check [existing issues](https://github.com/silentchainai/SILENTCHAIN/issues)
-2. Create a new issue with:
- - Burp Suite version
- - SILENTCHAIN version
- - AI provider/model
- - Steps to reproduce
- - Error messages (from Console)
-
-### Feature Requests
-
-Open an issue with tag `enhancement`:
-- Describe the feature
-- Explain use case
-- Provide examples if possible
-
----
-
-## 📄 License
-
-SILENTCHAIN AI™ CE is **source-visible but proprietary software**. By using this software, you agree to the terms in the [LICENSE](LICENSE) file.
-
-### PortSwigger BApp Store
-
-PortSwigger Ltd. is granted explicit permission to redistribute, host, and bundle this software within Burp Suite and the BApp Store free of charge to users. All other redistribution is prohibited without written permission.
-
----
-
-## ⚖️ Responsible Use
-
-**Do not use this software for unauthorized access or activities outside systems you own or have explicit permission to test.**
-
-### Data Handling
-
-- **Local Processing**: SILENTCHAIN runs entirely within Burp Suite
-- **No Data Collection**: We don't collect or transmit usage data
-- **AI Provider Privacy**:
- - **Ollama**: Completely local, no external communication
- - **Cloud Providers**: Data sent to respective AI services (OpenAI, Claude, Gemini)
-
-### Best Practices
-
-1. **Use Ollama** for sensitive testing (100% local, private)
-2. **Review AI Provider Terms** before using cloud services
-3. **Never test production** without authorization
-4. **Sanitize Data** if sharing logs/findings
-
----
-
-## 💬 Support & Community
-
-### Get Help
-
-- 📚 **Documentation**: [Documentation](#-documentation)
-- 🐛 **Issues**: [GitHub Issues](https://github.com/silentchainai/SILENTCHAIN/issues)
-- ✉️ **Email**: support@silentchain.ai
-
-### Stay Updated
-
-- ⭐ **Star** this repository
-- 👁️ **Watch** for updates
-- 🐦 **Twitter**: [@SilentChainAI](https://twitter.com/SilentChainAI)
-
----
-
-## 🙏 Acknowledgments
-
-Built by:
-- [@xer0dayz](https://x.com/xer0dayz) at [@Sn1perSecurity](https://sn1persecurity.com) LLC
-
-Built with:
-- [Burp Suite](https://portswigger.net/burp) by PortSwigger
-- [Ollama](https://ollama.ai) for local AI
-- [OpenAI](https://openai.com) for GPT models
-- [Anthropic](https://anthropic.com) for Claude
-- [Google](https://ai.google) for Gemini
-
-Inspired by the security community's dedication to making the web safer.
-
----
-
-## ™️ Trademark Notice
-
-"SILENTCHAIN AI™", "SILENTCHAIN™", and the SILENTCHAIN AI logo are trademarks of SN1PERSECURITY LLC. Unauthorized use is prohibited.
-
----
-
+## Documentation Index
-### 🔗 ⛓️ 🔒
+- Setup: `docs/guides/QUICKSTART.md`, `docs/guides/INSTALLATION.md`
+- Internal behavior: `docs/INTERNAL_WORKING.md`
+- Maintenance flow: `docs/DEVELOPER_WORKFLOW.md`
+- Change history: `CHANGELOG.md`
+- Optimization context: `docs/project/OPTIMIZATION_PLAN.md`
+- Legal/license: `docs/project/NOTICE.md`, `LICENSE`
-**SILENTCHAIN AI™** - *Intelligent Security Testing for the Modern Web*
+## Responsible Use
-[Documentation](#-documentation) • [Issues](https://github.com/SILENTCHAIN/silentchain-ai/issues) • [Discord Community](https://discord.gg/silentchain)
+Use only on systems you own or are explicitly authorized to test.
-**Copyright © 2026 SN1PERSECURITY LLC. All rights reserved.**
+## Fork Notes
-
\ No newline at end of file
+This repository is a maintained fork with sanitized ownership/contact references. Track support and issues through this fork's issue tracker.
diff --git a/docs/DEVELOPER_WORKFLOW.md b/docs/DEVELOPER_WORKFLOW.md
new file mode 100644
index 0000000..c964108
--- /dev/null
+++ b/docs/DEVELOPER_WORKFLOW.md
@@ -0,0 +1,38 @@
+# Developer Workflow
+
+This workflow is for maintainers of this fork.
+
+## 1. Change Target
+
+- Default to `silentchain_ai_community.py` for production-facing fixes.
+- Treat v2 files as experimental unless explicitly promoted.
+
+## 2. Verification Path
+
+There is no standalone build/test harness. Validation is Burp runtime based.
+
+1. Load extension in Burp (Extender -> Extensions -> Add -> Python).
+2. Open SILENTCHAIN tab.
+3. Run Settings -> Test Connection.
+4. Proxy in-scope traffic and verify findings/issue activity behavior.
+
+## 3. Azure Validation (When Applicable)
+
+./tools/test_azure_env.sh ./.env
+
+Expected: STATUS: VALID
+
+## 4. Regression Checklist
+
+- Scope filtering remains correct
+- Static extension skipping remains correct
+- Semaphore behavior does not deadlock
+- Cache hit/reuse behavior remains intact
+- Confidence mapping and severity normalization remain unchanged
+- CSV naming pattern remains unchanged
+
+## 5. Release Hygiene
+
+- Update `CHANGELOG.md` for user-visible behavior changes.
+- Update docs for setup or workflow changes.
+- If config schema changes, update migration logic and config versioning.
diff --git a/docs/INTERNAL_WORKING.md b/docs/INTERNAL_WORKING.md
new file mode 100644
index 0000000..131bd76
--- /dev/null
+++ b/docs/INTERNAL_WORKING.md
@@ -0,0 +1,54 @@
+# Internal Working
+
+This document explains the runtime flow and architectural constraints of SILENTCHAIN.
+
+## Runtime Context
+
+- Burp extension running on Jython 2.7
+- Main entry point: `silentchain_ai_community.py`
+
+## Core Pipeline
+
+1. Burp traffic enters passive handlers.
+2. Requests are scope-filtered and static assets are skipped.
+3. Tasks are submitted to a fixed thread pool.
+4. Analysis acquires semaphores and applies request pacing.
+5. Request signature is generated for cache lookup.
+6. Cache hit reuses findings; cache miss calls selected AI provider.
+7. AI response is parsed/normalized.
+8. Findings are deduplicated and emitted as Burp issues and UI entries.
+
+## Concurrency Model
+
+- Fixed worker pool for analysis tasks
+- Global semaphore cap for total AI concurrency
+- Per-host semaphore cap for host fairness
+- Preserve acquisition order in standard analysis flow: host then global
+
+## Persistence
+
+- Config: `~/.silentchain_config.json`
+- Cache: `~/.silentchain_vuln_cache.json`
+
+## Provider Dispatch
+
+The provider router calls one adapter per selected provider:
+
+- Ollama
+- OpenAI
+- Claude
+- Gemini
+- Azure Foundry
+
+## Output Artifacts
+
+- Burp Issue Activity entries
+- Findings table in SILENTCHAIN UI
+- CSV export with format `SILENTCHAIN_Findings_YYYYMMDD_HHMMSS.csv`
+
+## Safe-Change Constraints
+
+- Keep Jython 2.7 compatibility
+- Keep UI updates EDT-safe
+- Preserve confidence/severity mapping behavior
+- Preserve cache signature semantics unless intentionally changing reuse behavior
diff --git a/docs/guides/INSTALLATION.md b/docs/guides/INSTALLATION.md
new file mode 100644
index 0000000..f88383c
--- /dev/null
+++ b/docs/guides/INSTALLATION.md
@@ -0,0 +1,72 @@
+# Installation and Provider Configuration
+
+This guide covers full setup for each supported AI provider.
+
+## System Requirements
+
+- Burp Suite (Community or Professional)
+- Java 8+
+- Burp Python extension support (Jython runtime)
+
+## Install Extension
+
+1. Open Burp.
+2. Extender -> Extensions -> Add.
+3. Extension type: Python.
+4. Load `silentchain_ai_community.py`.
+
+## Provider Setup
+
+### Ollama (Local)
+
+- API URL: `http://localhost:11434`
+- API key: not required
+- Model examples: `llama3:latest`, `deepseek-r1:latest`
+
+### OpenAI
+
+- API URL: `https://api.openai.com/v1`
+- API key: required
+- Model examples: `gpt-4o`, `gpt-4o-mini`
+
+### Claude
+
+- API URL: `https://api.anthropic.com/v1`
+- API key: required
+- Model example: `claude-3-5-sonnet-20241022`
+
+### Gemini
+
+- API URL: `https://generativelanguage.googleapis.com/v1`
+- API key: required
+- Model examples: `gemini-1.5-pro`, `gemini-1.5-flash`
+
+### Azure Foundry
+
+- API URL: Azure OpenAI-compatible endpoint
+- API key: required
+- Model: Azure deployment name
+
+## Connection Validation
+
+After provider configuration, run Settings -> Test Connection.
+
+If using Azure environment variables, validate before Burp testing:
+
+./tools/test_azure_env.sh ./.env
+
+Expected result: STATUS: VALID
+
+## Common Failures
+
+- Wrong endpoint path or API version
+- Wrong deployment/model name
+- Invalid API key
+- Provider service unreachable
+
+## Documentation
+
+- `README.md`
+- `docs/guides/QUICKSTART.md`
+- `docs/INTERNAL_WORKING.md`
+- `docs/DEVELOPER_WORKFLOW.md`
diff --git a/docs/guides/QUICKSTART.md b/docs/guides/QUICKSTART.md
new file mode 100644
index 0000000..04f5e43
--- /dev/null
+++ b/docs/guides/QUICKSTART.md
@@ -0,0 +1,56 @@
+# Quick Start - SILENTCHAIN AI
+
+Get the extension running quickly with a stable baseline configuration.
+
+## Prerequisites
+
+- Burp Suite
+- One AI provider (Ollama recommended for local/private usage)
+
+## 1. Clone and Open
+
+git clone
+cd
+
+## 2. Load Extension in Burp
+
+1. Open Burp.
+2. Go to Extender -> Extensions -> Add.
+3. Choose Python extension type.
+4. Load `silentchain_ai_community.py`.
+
+## 3. Configure Provider
+
+In SILENTCHAIN Settings:
+
+- Provider: choose one of Ollama/OpenAI/Claude/Gemini/Azure Foundry
+- API URL: provider endpoint
+- API key: if required
+- Model: provider model/deployment name
+
+Run Test Connection, then Save.
+
+## 4. Define Scope and Browse
+
+1. Set target scope in Burp (Target -> Scope).
+2. Route browser traffic through Burp proxy.
+3. Browse target endpoints.
+4. Watch SILENTCHAIN findings and Burp Issue Activity.
+
+## 5. Verify Azure Environment (If Using Azure)
+
+./tools/test_azure_env.sh ./.env
+
+Expected: STATUS: VALID
+
+## Troubleshooting Fast Path
+
+- No findings: verify scope and proxy flow
+- Connection failure: verify URL/key/model
+- Extension load issues: check Extender -> Errors
+
+## Next Reading
+
+- Internal architecture: `docs/INTERNAL_WORKING.md`
+- Maintainer workflow: `docs/DEVELOPER_WORKFLOW.md`
+- Full installation matrix: `docs/guides/INSTALLATION.md`
diff --git a/docs/project/BENCHMARK.md b/docs/project/BENCHMARK.md
new file mode 100644
index 0000000..5c6dff8
--- /dev/null
+++ b/docs/project/BENCHMARK.md
@@ -0,0 +1,27 @@
+# Benchmark Notes
+
+This file tracks practical scan performance observations. Treat values as environment-dependent and not absolute throughput guarantees.
+
+## Baseline Method
+
+- Runtime: Burp + Jython extension
+- Scan mode: passive traffic analysis
+- AI request path: provider chat/completions equivalent
+- Cache behavior: request-signature cache enabled
+
+## Result Table Template
+
+| Provider | Model/Deployment | Target Profile | Total Requests | AI Calls | Cache Hits | Duration | Notes |
+|----------|------------------|----------------|----------------|----------|------------|----------|-------|
+| Ollama | deepseek-r1:latest | local test app | TBD | TBD | TBD | TBD | baseline local |
+| OpenAI | gpt-4o-mini | local test app | TBD | TBD | TBD | TBD | cloud latency |
+| Claude | claude-3-5-sonnet | local test app | TBD | TBD | TBD | TBD | cloud latency |
+| Gemini | gemini-1.5-pro | local test app | TBD | TBD | TBD | TBD | cloud latency |
+| Azure Foundry | deployment-name | local test app | TBD | TBD | TBD | TBD | endpoint/version sensitive |
+
+## Measurement Guidance
+
+- Capture cache hit ratio to avoid misleading provider comparisons.
+- Record request mix (static vs dynamic endpoints).
+- Record provider timeout and model token settings.
+- Run with same scope and identical traffic replay for fair comparison.
diff --git a/docs/project/CONTRIBUTING.md b/docs/project/CONTRIBUTING.md
new file mode 100644
index 0000000..5756309
--- /dev/null
+++ b/docs/project/CONTRIBUTING.md
@@ -0,0 +1,17 @@
+# Contributing
+
+This fork is source-visible but maintained as a controlled codebase.
+
+## Contribution Model
+
+- External pull requests are not accepted.
+- Issues and reproducible bug reports are welcome via this fork's issue tracker.
+- Security-relevant findings should include clear reproduction steps and sanitized evidence.
+
+## Maintainer Validation
+
+Before manual Burp verification for Azure provider setups:
+
+./tools/test_azure_env.sh ./.env
+
+Expected output includes STATUS: VALID.
diff --git a/docs/project/NOTICE.md b/docs/project/NOTICE.md
new file mode 100644
index 0000000..2cdf86c
--- /dev/null
+++ b/docs/project/NOTICE.md
@@ -0,0 +1,23 @@
+# Legal Notice - SILENTCHAIN AI Fork
+
+Last reviewed: 2026-03-24
+
+## Ownership
+
+This repository is maintained as a fork. Historical owner/contact references were sanitized in this fork documentation.
+
+## License
+
+Use, redistribution, and modification are governed by `LICENSE` in this repository.
+
+## Warranty Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.
+
+## Liability
+
+IN NO EVENT SHALL AUTHORS OR CONTRIBUTORS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM THE SOFTWARE OR ITS USE.
+
+## Support
+
+Use this fork's issue tracker for support.
diff --git a/docs/project/OPTIMIZATION_PLAN.md b/docs/project/OPTIMIZATION_PLAN.md
new file mode 100644
index 0000000..20715b2
--- /dev/null
+++ b/docs/project/OPTIMIZATION_PLAN.md
@@ -0,0 +1,52 @@
+# Optimization Plan and Historical Status
+
+This file documents optimization work and its current status against the stable baseline.
+
+## Current Baseline
+
+- Primary runtime file: `silentchain_ai_community.py`
+- Version in runtime metadata: 1.1.4
+
+## Completed Optimizations (Implemented)
+
+1. Concurrency controls
+- Fixed-size thread pool for analysis tasks
+- Global semaphore cap for AI calls
+- Per-host semaphore caps to reduce host-level request bursts
+
+2. Persistent caching and reuse
+- Request-signature hashing to skip repeated AI calls
+- Persistent cache on disk with dirty-flag write strategy
+
+3. Provider dispatch hardening
+- Provider-specific adapters and connection checks
+- Configurable timeout for outbound provider requests
+
+4. Response parsing resilience
+- Structured JSON parsing with repair fallback for malformed model output
+
+5. Export and operational usability
+- CSV export with stable filename pattern
+- Console/task visibility for runtime behavior
+
+## Active Risk Areas
+
+1. UI thread safety regressions
+- Continue enforcing Swing updates on EDT only
+
+2. Semaphore ordering regressions
+- Maintain host semaphore acquisition before global semaphore in standard analysis path
+
+3. Config/schema migration drift
+- Keep `CONFIG_VERSION` and migration logic aligned
+
+## Forward Work
+
+1. Consolidate variant strategy
+- Decide whether v2 variants should be promoted or remain experimental
+
+2. Expand repeatable benchmark matrix
+- Capture comparable provider performance with fixed traffic sets
+
+3. Optional test harness strategy
+- Add non-Burp helper checks where feasible (parser/unit helpers)
diff --git a/variants/silentchain_v2_0_0.py b/variants/silentchain_v2_0_0.py
new file mode 100644
index 0000000..0ed27ac
--- /dev/null
+++ b/variants/silentchain_v2_0_0.py
@@ -0,0 +1,2317 @@
+# -*- coding: utf-8 -*-
+# Burp Suite Python Extension: SILENTCHAIN AI - COMMUNITY EDITION
+# Version: 2.0.0
+# Enhanced Edition: Full Vulnerability Detail Panel + Exploitation + PoC
+# License: MIT License
+
+from burp import IBurpExtender, IHttpListener, IScannerCheck, IScanIssue, ITab, IContextMenuFactory
+from java.io import PrintWriter
+from java.awt import (BorderLayout, GridBagLayout, GridBagConstraints, Insets,
+ Dimension, Font, Color, FlowLayout, Cursor)
+from java.awt.event import MouseAdapter
+from javax.swing import (JPanel, JScrollPane, JTextArea, JTable, JLabel, JSplitPane,
+ BorderFactory, SwingUtilities, JButton, BoxLayout, Box,
+ JMenuItem, JTextPane, JTabbedPane, UIManager, SwingConstants,
+ JEditorPane)
+from javax.swing.table import DefaultTableModel, DefaultTableCellRenderer
+from javax.swing.text import SimpleAttributeSet, StyleConstants
+from javax.swing.border import EmptyBorder
+from java.lang import Runnable
+from java.util import ArrayList
+from java.util.concurrent import Executors
+import json
+import threading
+import urllib2
+import urllib
+import time
+import hashlib
+from datetime import datetime
+
+# ─────────────────────────────────────────────
+# DESIGN TOKENS (change once → applies everywhere)
+# ─────────────────────────────────────────────
+class Theme:
+ # Primary palette — dark terminal aesthetic
+ BG_DARKEST = Color(0x0D, 0x11, 0x17) # near-black
+ BG_DARK = Color(0x13, 0x19, 0x22) # panel bg
+ BG_MID = Color(0x1C, 0x24, 0x30) # card bg
+ BG_LIGHT = Color(0x24, 0x30, 0x3E) # hover / selected
+ BORDER = Color(0x2E, 0x3D, 0x4F) # subtle border
+
+ # Accent — electric cyan
+ ACCENT = Color(0x00, 0xD4, 0xFF)
+ ACCENT_DIM = Color(0x00, 0x7A, 0x99)
+
+ # Text
+ TEXT_PRIMARY = Color(0xE2, 0xE8, 0xF0)
+ TEXT_MUTED = Color(0x64, 0x74, 0x8B)
+ TEXT_CODE = Color(0x7D, 0xD3, 0xFC)
+
+ # Severity
+ SEV_CRITICAL = Color(0xFF, 0x17, 0x44)
+ SEV_HIGH = Color(0xFF, 0x45, 0x00)
+ SEV_MED = Color(0xFF, 0xA5, 0x00)
+ SEV_LOW = Color(0xFF, 0xD7, 0x00)
+ SEV_INFO = Color(0x38, 0xBD, 0xF8)
+
+ # Confidence
+ CONF_CERTAIN = Color(0x10, 0xB9, 0x81)
+ CONF_FIRM = Color(0x38, 0xBD, 0xF8)
+ CONF_TENTATIVE = Color(0xFF, 0xA5, 0x00)
+
+ FONT_MONO = Font("Monospaced", Font.PLAIN, 12)
+ FONT_MONO_B= Font("Monospaced", Font.BOLD, 12)
+ FONT_MONO_L= Font("Monospaced", Font.PLAIN, 11)
+ FONT_HEAD = Font("Monospaced", Font.BOLD, 14)
+ FONT_TITLE = Font("Monospaced", Font.BOLD, 16)
+
+
+VALID_SEVERITIES = {
+ "high": "High", "medium": "Medium", "low": "Low",
+ "information": "Information", "informational": "Information",
+ "info": "Information", "inform": "Information",
+ "critical": "High"
+}
+
+def map_confidence(v):
+ try: v = int(v)
+ except: v = 50
+ if v < 50: return None
+ if v < 75: return "Tentative"
+ if v < 90: return "Firm"
+ return "Certain"
+
+def severity_color(sev):
+ return {
+ "High": Theme.SEV_HIGH,
+ "Medium": Theme.SEV_MED,
+ "Low": Theme.SEV_LOW,
+ "Information": Theme.SEV_INFO,
+ }.get(sev, Theme.TEXT_MUTED)
+
+def confidence_color(conf):
+ return {
+ "Certain": Theme.CONF_CERTAIN,
+ "Firm": Theme.CONF_FIRM,
+ "Tentative": Theme.CONF_TENTATIVE,
+ }.get(conf, Theme.TEXT_MUTED)
+
+
+# ─────────────────────────────────────────────
+# HELPER: apply dark bg/fg recursively
+# ─────────────────────────────────────────────
+def dark(component, bg=None, fg=None):
+ bg = bg or Theme.BG_DARK
+ fg = fg or Theme.TEXT_PRIMARY
+ try:
+ component.setBackground(bg)
+ component.setForeground(fg)
+ component.setOpaque(True)
+ except: pass
+ return component
+
+def styled_btn(text, bg, fg=Color.WHITE, action=None):
+ btn = JButton(text)
+ btn.setBackground(bg)
+ btn.setForeground(fg)
+ btn.setFont(Theme.FONT_MONO_B)
+ btn.setOpaque(True)
+ btn.setBorderPainted(False)
+ btn.setFocusPainted(False)
+ btn.setCursor(Cursor(Cursor.HAND_CURSOR))
+ if action:
+ btn.addActionListener(action)
+ return btn
+
+def titled_panel(title, layout=None):
+ p = JPanel(layout or BorderLayout())
+ p.setBackground(Theme.BG_MID)
+ border = BorderFactory.createCompoundBorder(
+ BorderFactory.createLineBorder(Theme.BORDER, 1),
+ BorderFactory.createEmptyBorder(4, 6, 4, 6)
+ )
+ titled = BorderFactory.createTitledBorder(
+ border, title,
+ 0, 0,
+ Theme.FONT_MONO_B, Theme.ACCENT
+ )
+ p.setBorder(titled)
+ return p
+
+
+# ─────────────────────────────────────────────
+# CONSOLE WRITER
+# ─────────────────────────────────────────────
+class ConsolePrintWriter:
+ def __init__(self, original_writer, extender_ref):
+ self.original = original_writer
+ self.extender = extender_ref
+
+ def println(self, message):
+ self.original.println(message)
+ if hasattr(self.extender, 'log_to_console'):
+ try: self.extender.log_to_console(str(message))
+ except: pass
+
+ def print_(self, m): self.original.print_(m)
+ def write(self, d): self.original.write(d)
+ def flush(self): self.original.flush()
+
+
+# ─────────────────────────────────────────────
+# THREAD POOL TASK WRAPPERS
+# ─────────────────────────────────────────────
+class AnalyzeTask(Runnable):
+ def __init__(self, extender, messageInfo, url_str, task_id, forced=False):
+ self.extender = extender
+ self.messageInfo = messageInfo
+ self.url_str = url_str
+ self.task_id = task_id
+ self.forced = forced
+
+ def run(self):
+ if self.forced:
+ self.extender.analyze_forced(self.messageInfo, self.url_str, self.task_id)
+ else:
+ self.extender.analyze(self.messageInfo, self.url_str, self.task_id)
+
+
+# ─────────────────────────────────────────────
+# CELL RENDERERS
+# ─────────────────────────────────────────────
+class DarkCellRenderer(DefaultTableCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DefaultTableCellRenderer.getTableCellRendererComponent(
+ self, table, value, sel, focus, row, col)
+ c.setBackground(Theme.BG_LIGHT if sel else (Theme.BG_MID if row % 2 == 0 else Theme.BG_DARK))
+ c.setForeground(Theme.TEXT_PRIMARY)
+ c.setFont(Theme.FONT_MONO_L)
+ c.setBorder(EmptyBorder(2, 6, 2, 6))
+ return c
+
+class StatusRenderer(DarkCellRenderer):
+ COLORS = {
+ "Cancelled": Theme.SEV_CRITICAL,
+ "Paused": Theme.SEV_LOW,
+ "Error": Theme.SEV_HIGH,
+ "Skipped": Theme.SEV_MED,
+ "Completed": Theme.CONF_CERTAIN,
+ "Analyzing": Theme.ACCENT,
+ "Waiting": Theme.ACCENT_DIM,
+ "Queued": Theme.TEXT_MUTED,
+ }
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ for k, color in self.COLORS.items():
+ if k in str(value):
+ c.setForeground(color)
+ c.setFont(Theme.FONT_MONO_B)
+ break
+ return c
+
+class SeverityRenderer(DarkCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ sev = str(value)
+ color = severity_color(sev)
+ c.setForeground(color)
+ c.setFont(Theme.FONT_MONO_B)
+ return c
+
+class ConfidenceRenderer(DarkCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ c.setForeground(confidence_color(str(value)))
+ c.setFont(Theme.FONT_MONO_B)
+ return c
+
+
+# ─────────────────────────────────────────────
+# VULN DETAIL PANEL ← new core component
+# ─────────────────────────────────────────────
+class VulnDetailPanel(JPanel):
+ """
+ Tabbed detail view shown when a finding row is selected.
+ Tabs: Overview | Exploitation | PoC | Remediation | Raw JSON
+ """
+ def __init__(self):
+ JPanel.__init__(self, BorderLayout())
+ self.setBackground(Theme.BG_DARKEST)
+ self._current_finding = None
+ self._build_ui()
+
+ def _build_ui(self):
+ # Header bar
+ self.header = JPanel(BorderLayout())
+ self.header.setBackground(Theme.BG_MID)
+ self.header.setBorder(EmptyBorder(8, 12, 8, 12))
+
+ self.title_label = JLabel("Select a finding to view details")
+ self.title_label.setFont(Theme.FONT_HEAD)
+ self.title_label.setForeground(Theme.TEXT_PRIMARY)
+
+ self.severity_badge = JLabel("")
+ self.severity_badge.setFont(Theme.FONT_MONO_B)
+ self.severity_badge.setHorizontalAlignment(SwingConstants.RIGHT)
+
+ self.header.add(self.title_label, BorderLayout.CENTER)
+ self.header.add(self.severity_badge, BorderLayout.EAST)
+ self.add(self.header, BorderLayout.NORTH)
+
+ # Tabs
+ self.tabs = JTabbedPane()
+ self.tabs.setBackground(Theme.BG_DARK)
+ self.tabs.setForeground(Theme.TEXT_PRIMARY)
+ self.tabs.setFont(Theme.FONT_MONO_B)
+
+ self.overview_pane = self._make_html_pane()
+ self.exploit_pane = self._make_html_pane()
+ self.poc_pane = self._make_code_pane()
+ self.remediation_pane = self._make_html_pane()
+ self.raw_pane = self._make_code_pane()
+
+ self.tabs.addTab("Overview", JScrollPane(self.overview_pane))
+ self.tabs.addTab("Exploitation", JScrollPane(self.exploit_pane))
+ self.tabs.addTab("PoC Template", JScrollPane(self.poc_pane))
+ self.tabs.addTab("Remediation", JScrollPane(self.remediation_pane))
+ self.tabs.addTab("Raw JSON", JScrollPane(self.raw_pane))
+
+ # Style tab scrollpanes
+ for i in range(self.tabs.getTabCount()):
+ sp = self.tabs.getComponentAt(i)
+ if isinstance(sp, JScrollPane):
+ sp.setBackground(Theme.BG_DARK)
+ sp.getViewport().setBackground(Theme.BG_DARK)
+
+ self.add(self.tabs, BorderLayout.CENTER)
+
+ # Empty state message
+ self.empty_label = JLabel("← Click any finding row to see full details, exploitation paths and PoC",
+ SwingConstants.CENTER)
+ self.empty_label.setFont(Theme.FONT_MONO)
+ self.empty_label.setForeground(Theme.TEXT_MUTED)
+
+ self._show_empty()
+
+ def _make_html_pane(self):
+ pane = JEditorPane("text/html", "")
+ pane.setEditable(False)
+ pane.setBackground(Theme.BG_DARK)
+ pane.setForeground(Theme.TEXT_PRIMARY)
+ pane.setFont(Theme.FONT_MONO)
+ pane.putClientProperty(JEditorPane.HONOR_DISPLAY_PROPERTIES, True)
+ return pane
+
+ def _make_code_pane(self):
+ area = JTextArea()
+ area.setEditable(False)
+ area.setBackground(Theme.BG_DARKEST)
+ area.setForeground(Theme.TEXT_CODE)
+ area.setFont(Theme.FONT_MONO)
+ area.setLineWrap(True)
+ area.setWrapStyleWord(False)
+ area.setBorder(EmptyBorder(8, 10, 8, 10))
+ return area
+
+ def _show_empty(self):
+ self.title_label.setText("Select a finding to view details")
+ self.severity_badge.setText("")
+ for pane in [self.overview_pane, self.exploit_pane, self.remediation_pane]:
+ pane.setText("")
+ for area in [self.poc_pane, self.raw_pane]:
+ area.setText("")
+
+ def _css(self):
+ return """
+
+ """
+
+ def load_finding(self, finding):
+ """Called when a row is selected in the findings table."""
+ self._current_finding = finding
+ self._render_finding(finding)
+
+ def _render_finding(self, f):
+ title = f.get("title", "Unknown Finding")
+ severity = f.get("severity", "Information")
+ conf = f.get("confidence", "")
+ url = f.get("url", "")
+ detail = f.get("detail", "")
+ cwe = f.get("cwe", "")
+ owasp = f.get("owasp", "")
+ remediation = f.get("remediation", "")
+ evidence = f.get("evidence", "")
+ exploit_path = f.get("exploit_path", "")
+ exploit_steps = f.get("exploit_steps", [])
+ poc_template = f.get("poc_template", "")
+ poc_curl = f.get("poc_curl", "")
+ poc_python = f.get("poc_python", "")
+ affected_params = f.get("affected_params", [])
+ business_impact = f.get("business_impact", "")
+ cvss = f.get("cvss_score", "")
+ references = f.get("references", [])
+
+ sev_cls = severity.lower() if severity.lower() in ["high","medium","low"] else "info"
+
+ # ── Header ──
+ self.title_label.setText(title)
+ badge_text = severity
+ if cvss:
+ badge_text += " CVSS: %s" % cvss
+ self.severity_badge.setText(badge_text)
+ self.severity_badge.setForeground(severity_color(severity))
+
+ # ── Overview Tab ──
+ sev_html = '%s ' % (sev_cls, severity)
+ conf_html = '%s ' % conf if conf else ""
+
+ params_html = ""
+ if affected_params:
+ params_html = "".join(['%s ' % p for p in affected_params])
+ elif f.get("param"):
+ params_html = '%s ' % f.get("param")
+
+ cwe_html = ""
+ if cwe:
+ cwe_id = cwe.replace("CWE-", "")
+ cwe_html = '%s ' % (cwe_id, cwe)
+
+ refs_html = ""
+ if references:
+ refs_html = "References "
+ for ref in references[:5]:
+ refs_html += '%s "
+
+ evidence_html = ""
+ if evidence:
+ evidence_html = "Evidence %s " % evidence[:1000]
+
+ overview = """{css}
+
+
Finding Summary
+
+ Severity: {sev} Confidence: {conf} URL: {url}
+
+
Description
+
{detail}
+
CWE: %s OWASP: %s CVSS: %s Affected Parameters %s
" % params_html if params_html else "",
+ evidence_html=evidence_html,
+ refs_html=refs_html
+ )
+ self.overview_pane.setText(overview)
+ self.overview_pane.setCaretPosition(0)
+
+ # ── Exploitation Tab ──
+ steps_html = ""
+ if exploit_steps and isinstance(exploit_steps, list):
+ steps_html = "Step-by-Step Exploitation "
+ for i, step in enumerate(exploit_steps):
+ steps_html += "%s " % step
+ steps_html += " "
+
+ impact_html = ""
+ if business_impact:
+ impact_html = "Business Impact %s
" % business_impact
+
+ exploit_html = """{css}
+
+
Attack Vector
+
{exploit_path}
+
+
Exploitation Prerequisites
+
+ Access to target application (authenticated or unauthenticated depending on vuln type)
+ Ability to intercept/modify HTTP requests (Burp Suite proxy)
+ {extra_prereqs}
+
+
No exploitation path provided by AI — re-analyze with context menu to refresh ",
+ steps_html=steps_html,
+ impact_html=impact_html,
+ extra_prereqs="Valid session token / API key (if endpoint is authenticated) " if "auth" in title.lower() or "idor" in title.lower() else ""
+ )
+ self.exploit_pane.setText(exploit_html)
+ self.exploit_pane.setCaretPosition(0)
+
+ # ── PoC Tab ──
+ poc_parts = []
+ if poc_curl:
+ poc_parts.append("# ── cURL PoC ──\n%s" % poc_curl)
+ if poc_python:
+ poc_parts.append("# ── Python PoC ──\n%s" % poc_python)
+ if poc_template and not poc_curl and not poc_python:
+ poc_parts.append("# ── PoC Template ──\n%s" % poc_template)
+ if not poc_parts:
+ poc_parts.append("# No PoC generated yet.\n# Right-click the request in Burp → Analyze Request\n# to trigger a fresh AI analysis with PoC generation.")
+
+ self.poc_pane.setText("\n\n".join(poc_parts))
+ self.poc_pane.setCaretPosition(0)
+
+ # ── Remediation Tab ──
+ rem_html = """{css}
+
+
Remediation
+
{remediation}
+
+
Verification Steps
+
+ Apply the fix in a development environment
+ Re-run the same request via Burp → Analyze Request
+ Confirm the AI no longer flags the vulnerability
+ Run a full regression test on the affected endpoint
+
+
+
Secure Code Reference
+
See OWASP Cheat Sheet Series
+ for language-specific secure coding guidance related to {owasp}.
+
" + "".join("%s " % s for s in exploit_steps) + " "
+
+ poc_html = ""
+ if f.get("poc_curl"):
+ poc_html += "cURL %s " % f["poc_curl"]
+ if f.get("poc_python"):
+ poc_html += "Python %s " % f["poc_python"]
+ if f.get("poc_template") and not poc_html:
+ poc_html = "%s " % f["poc_template"]
+
+ cards_html += """
+
+
+
+ {url}
+ {cwe_span}
+ {owasp_span}
+
+
+
+ Description
+ Exploitation
+ PoC
+ Remediation
+
+
+
{detail}
+ {evidence}
+ {impact}
+
+
+
{exploit_path}
+ {steps_html}
+
+
+ {poc_html}
+
+
+
+
%s ' % f["cwe"] if f.get("cwe") else "",
+ owasp_span='%s ' % f["owasp"] if f.get("owasp") else "",
+ detail=f.get("detail",""),
+ evidence='' % f["evidence"] if f.get("evidence") else "",
+ impact='Business Impact: %s
' % f["business_impact"] if f.get("business_impact") else "",
+ exploit_path=f.get("exploit_path","No exploitation path recorded."),
+ steps_html=steps_html,
+ poc_html=poc_html or "No PoC available. Re-analyze to generate.
",
+ remediation=f.get("remediation","")
+ )
+
+ return """
+
+
+SILENTCHAIN AI Report — {ts}
+
+
+
+SILENTCHAIN AI — Security Report
+Generated: {ts} | Model: {model} | Community Edition
+
+{cards}
+
+
+""".format(
+ ts=ts, model=self.MODEL, cards=cards_html,
+ total=len(findings),
+ high=counts["High"], med=counts["Medium"],
+ low=counts["Low"], info=counts["Information"]
+ )
+
+ # ─────────────────────────
+ # EXPORT: CSV (kept)
+ # ─────────────────────────
+ def exportFindings(self, event):
+ if self.findingsTableModel.getRowCount() == 0:
+ self.stdout.println("[EXPORT] No findings"); return
+ try:
+ from javax.swing import JFileChooser
+ from java.io import File
+ fc = JFileChooser()
+ fc.setSelectedFile(File("SILENTCHAIN_%s.csv" % time.strftime("%Y%m%d_%H%M%S")))
+ if fc.showSaveDialog(self.panel) != JFileChooser.APPROVE_OPTION: return
+ path = str(fc.getSelectedFile().getAbsolutePath())
+ with open(path, 'w') as f:
+ headers = [self.findingsTableModel.getColumnName(c)
+ for c in range(self.findingsTableModel.getColumnCount())]
+ f.write(','.join(['"'+h+'"' for h in headers]) + '\n')
+ for r in range(self.findingsTableModel.getRowCount()):
+ vals = ['"' + str(self.findingsTableModel.getValueAt(r, c)).replace('"','""') + '"'
+ for c in range(self.findingsTableModel.getColumnCount())]
+ f.write(','.join(vals) + '\n')
+ self.stdout.println("[EXPORT] CSV saved: %s" % path)
+ except Exception as e:
+ self.stderr.println("[!] CSV export failed: %s" % e)
+
+ # ─────────────────────────
+ # SETTINGS DIALOG
+ # ─────────────────────────
+ def openSettings(self, event):
+ from javax.swing import (JDialog, JTabbedPane, JTextField, JComboBox,
+ JPasswordField, JCheckBox)
+ dialog = JDialog()
+ dialog.setTitle("SILENTCHAIN Settings v%s" % self.VERSION)
+ dialog.setModal(True)
+ dialog.setSize(700, 580)
+ dialog.setLocationRelativeTo(None)
+ dialog.getContentPane().setBackground(Theme.BG_DARK)
+
+ tabs = JTabbedPane()
+ tabs.setBackground(Theme.BG_DARK)
+ tabs.setForeground(Theme.TEXT_PRIMARY)
+
+ # AI Provider tab
+ aiPanel = JPanel(GridBagLayout())
+ aiPanel.setBackground(Theme.BG_DARK)
+ gbc = GridBagConstraints()
+ gbc.insets = Insets(6, 8, 6, 8)
+ gbc.anchor = GridBagConstraints.WEST
+ gbc.fill = GridBagConstraints.HORIZONTAL
+
+ def add_row(panel, row, label_text, field):
+ gbc.gridx = 0; gbc.gridy = row; gbc.gridwidth = 1
+ lbl = JLabel(label_text)
+ lbl.setForeground(Theme.TEXT_MUTED)
+ lbl.setFont(Theme.FONT_MONO)
+ panel.add(lbl, gbc)
+ gbc.gridx = 1; gbc.gridwidth = 2
+ panel.add(field, gbc)
+ gbc.gridwidth = 1
+
+ providerCombo = JComboBox(["Ollama","OpenAI","Claude","Gemini","Azure Foundry"])
+ providerCombo.setSelectedItem(self.AI_PROVIDER)
+ apiUrlField = JTextField(self.API_URL, 30)
+ apiKeyField = JPasswordField(self.API_KEY, 30)
+ maxTokensField = JTextField(str(self.MAX_TOKENS), 10)
+
+ models_list = self.available_models if self.available_models else [self.MODEL]
+ modelCombo = JComboBox(models_list)
+ if self.MODEL in models_list: modelCombo.setSelectedItem(self.MODEL)
+
+ for fld in [apiUrlField, apiKeyField, maxTokensField]:
+ fld.setBackground(Theme.BG_MID)
+ fld.setForeground(Theme.TEXT_PRIMARY)
+ fld.setCaretColor(Theme.ACCENT)
+ fld.setFont(Theme.FONT_MONO)
+
+ from java.awt.event import ActionListener
+ class ProviderListener(ActionListener):
+ def __init__(self, f): self.f = f
+ def actionPerformed(self, e):
+ urls = {"Ollama":"http://localhost:11434","OpenAI":"https://api.openai.com/v1",
+ "Claude":"https://api.anthropic.com/v1",
+ "Gemini":"https://generativelanguage.googleapis.com/v1",
+ "Azure Foundry":"https://YOUR-RESOURCE.openai.azure.com"}
+ p = str(e.getSource().getSelectedItem())
+ if p in urls: self.f.setText(urls[p])
+ providerCombo.addActionListener(ProviderListener(apiUrlField))
+
+ add_row(aiPanel, 0, "AI Provider:", providerCombo)
+ add_row(aiPanel, 1, "API URL:", apiUrlField)
+ add_row(aiPanel, 2, "API Key:", apiKeyField)
+ add_row(aiPanel, 3, "Model:", modelCombo)
+ add_row(aiPanel, 4, "Max Tokens:", maxTokensField)
+
+ gbc.gridx=0; gbc.gridy=5; gbc.gridwidth=3
+ testBtn = styled_btn("Test Connection", Theme.ACCENT_DIM, Color.WHITE)
+ ext_ref = self
+ def do_test(e):
+ testBtn.setEnabled(False); testBtn.setText("Testing...")
+ old = (ext_ref.AI_PROVIDER, ext_ref.API_URL, ext_ref.API_KEY)
+ ext_ref.AI_PROVIDER = str(providerCombo.getSelectedItem())
+ ext_ref.API_URL = apiUrlField.getText()
+ ext_ref.API_KEY = "".join(apiKeyField.getPassword())
+ def run():
+ try:
+ if not ext_ref.test_ai_connection():
+ ext_ref.AI_PROVIDER, ext_ref.API_URL, ext_ref.API_KEY = old
+ finally:
+ SwingUtilities.invokeLater(lambda: (testBtn.setEnabled(True), testBtn.setText("Test Connection")))
+ threading.Thread(target=run, daemon=True).start()
+ testBtn.addActionListener(do_test)
+ aiPanel.add(testBtn, gbc)
+ tabs.addTab("AI Provider", aiPanel)
+
+ # Advanced tab
+ advPanel = JPanel(GridBagLayout())
+ advPanel.setBackground(Theme.BG_DARK)
+ gbc2 = GridBagConstraints()
+ gbc2.insets = Insets(6,8,6,8); gbc2.anchor=GridBagConstraints.WEST
+ gbc2.fill = GridBagConstraints.HORIZONTAL
+
+ passiveChk = JCheckBox("Enable passive scanning", self.PASSIVE_SCANNING_ENABLED)
+ verboseChk = JCheckBox("Verbose logging", self.VERBOSE)
+ timeoutFld = JTextField(str(self.AI_REQUEST_TIMEOUT), 10)
+
+ for w in [passiveChk, verboseChk]:
+ w.setBackground(Theme.BG_DARK); w.setForeground(Theme.TEXT_PRIMARY)
+ w.setFont(Theme.FONT_MONO)
+ timeoutFld.setBackground(Theme.BG_MID); timeoutFld.setForeground(Theme.TEXT_PRIMARY)
+ timeoutFld.setFont(Theme.FONT_MONO)
+
+ rows_adv = [(0,"Passive Scan:", passiveChk),(1,"Verbose:", verboseChk),(2,"Timeout (s):", timeoutFld)]
+ for r, lbl_txt, widget in rows_adv:
+ gbc2.gridx=0; gbc2.gridy=r; gbc2.gridwidth=1
+ l = JLabel(lbl_txt); l.setForeground(Theme.TEXT_MUTED); l.setFont(Theme.FONT_MONO)
+ advPanel.add(l, gbc2)
+ gbc2.gridx=1; gbc2.gridwidth=2; advPanel.add(widget, gbc2); gbc2.gridwidth=1
+
+ tabs.addTab("Advanced", advPanel)
+
+ # Save / Cancel
+ btnRow = JPanel(FlowLayout(FlowLayout.RIGHT, 8, 8))
+ btnRow.setBackground(Theme.BG_MID)
+ saveBtn = styled_btn("Save", Theme.CONF_CERTAIN)
+ cancelBtn = styled_btn("Cancel", Theme.BG_LIGHT, fg=Theme.TEXT_MUTED)
+
+ def do_save(e):
+ self.AI_PROVIDER = str(providerCombo.getSelectedItem())
+ self.API_URL = apiUrlField.getText()
+ self.API_KEY = "".join(apiKeyField.getPassword())
+ self.MODEL = str(modelCombo.getSelectedItem())
+ try: self.MAX_TOKENS = max(512, int(maxTokensField.getText()))
+ except: self.MAX_TOKENS = 3072
+ self.PASSIVE_SCANNING_ENABLED = passiveChk.isSelected()
+ self.VERBOSE = verboseChk.isSelected()
+ try:
+ t = int(timeoutFld.getText())
+ self.AI_REQUEST_TIMEOUT = max(10, min(99999, t))
+ except: self.AI_REQUEST_TIMEOUT = 60
+ self._sync_scanning_button()
+ self.save_config()
+ self.refreshUI()
+ dialog.dispose()
+
+ saveBtn.addActionListener(do_save)
+ cancelBtn.addActionListener(lambda e: dialog.dispose())
+ btnRow.add(saveBtn); btnRow.add(cancelBtn)
+
+ from javax.swing import JPanel as JP
+ wrapper = JP(BorderLayout())
+ wrapper.setBackground(Theme.BG_DARK)
+ wrapper.add(tabs, BorderLayout.CENTER)
+ wrapper.add(btnRow, BorderLayout.SOUTH)
+ dialog.add(wrapper)
+ dialog.setVisible(True)
+
+ # ─────────────────────────
+ # CONFIG I/O
+ # ─────────────────────────
+ def load_config(self):
+ try:
+ import os
+ if not os.path.exists(self.config_file): return
+ with open(self.config_file, 'r') as f:
+ cfg = json.load(f)
+ self.AI_PROVIDER = cfg.get("ai_provider", self.AI_PROVIDER)
+ self.API_URL = cfg.get("api_url", self.API_URL)
+ self.API_KEY = cfg.get("api_key", self.API_KEY)
+ self.MODEL = cfg.get("model", self.MODEL)
+ self.MAX_TOKENS = cfg.get("max_tokens", self.MAX_TOKENS)
+ self.AI_REQUEST_TIMEOUT = cfg.get("ai_request_timeout", self.AI_REQUEST_TIMEOUT)
+ self.VERBOSE = cfg.get("verbose", self.VERBOSE)
+ self.PASSIVE_SCANNING_ENABLED = cfg.get("passive_scanning_enabled", self.PASSIVE_SCANNING_ENABLED)
+ self.AZURE_API_VERSION = cfg.get("azure_api_version", self.AZURE_API_VERSION)
+ except Exception as e:
+ pass # stdout not ready yet
+
+ def save_config(self):
+ try:
+ cfg = {
+ "config_version": self.CONFIG_VERSION,
+ "ai_provider": self.AI_PROVIDER, "api_url": self.API_URL,
+ "api_key": self.API_KEY, "model": self.MODEL,
+ "max_tokens": self.MAX_TOKENS, "ai_request_timeout": self.AI_REQUEST_TIMEOUT,
+ "verbose": self.VERBOSE, "passive_scanning_enabled": self.PASSIVE_SCANNING_ENABLED,
+ "azure_api_version": self.AZURE_API_VERSION,
+ "version": self.VERSION, "last_saved": datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ }
+ with open(self.config_file, 'w') as f:
+ json.dump(cfg, f, indent=2)
+ return True
+ except Exception as e:
+ self.stderr.println("[!] Save config failed: %s" % e)
+ return False
+
+ def apply_environment_config(self):
+ try:
+ import os
+ az_ep = os.environ.get("AZURE_OPENAI_ENDPOINT","").strip()
+ az_key = os.environ.get("AZURE_OPENAI_API_KEY","").strip()
+ az_dep = os.environ.get("AZURE_OPENAI_DEPLOYMENT","").strip()
+ az_ver = os.environ.get("OPENAI_API_VERSION","").strip()
+ if az_ver: self.AZURE_API_VERSION = az_ver
+ if az_ep and az_key and (self.AI_PROVIDER == "Ollama" or not self.API_KEY):
+ self.AI_PROVIDER = "Azure Foundry"
+ self.API_URL = az_ep; self.API_KEY = az_key
+ if az_dep: self.MODEL = az_dep
+ except: pass
+
+ def _load_dotenv_values(self):
+ values = {}
+ try:
+ import os
+ paths = [os.path.join(os.getcwd(), ".env"),
+ os.path.join(os.path.expanduser("~"), ".silentchain.env")]
+ for p in paths:
+ if p and os.path.isfile(p):
+ with open(p,'r') as f:
+ for line in f:
+ line = line.strip()
+ if not line or line.startswith('#') or '=' not in line: continue
+ k, v = line.split('=', 1)
+ k = k.strip().lstrip("export").strip()
+ v = v.strip().strip('"').strip("'")
+ if k: values[k] = v
+ break
+ except: pass
+ return values
+
+ # ─────────────────────────
+ # CACHE I/O
+ # ─────────────────────────
+ def load_vuln_cache(self):
+ try:
+ import os
+ if not os.path.exists(self.vuln_cache_file): return
+ with open(self.vuln_cache_file, 'r') as f:
+ payload = json.load(f)
+ entries = payload.get("entries", {}) if isinstance(payload, dict) else {}
+ with self.vuln_cache_lock:
+ self.vuln_cache = entries if isinstance(entries, dict) else {}
+ self.stdout.println("[CACHE] Loaded %d entries" % len(self.vuln_cache))
+ self._ui_dirty = True
+ except Exception as e:
+ self.stderr.println("[!] Cache load failed: %s" % e)
+
+ def save_vuln_cache(self):
+ try:
+ with self.vuln_cache_lock:
+ snap = dict(self.vuln_cache)
+ with open(self.vuln_cache_file, 'w') as f:
+ json.dump({"version": self.VERSION,
+ "last_updated": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "entries": snap}, f, indent=2)
+ return True
+ except Exception as e:
+ self.stderr.println("[!] Cache save failed: %s" % e)
+ return False
+
+ def _async_save_cache(self):
+ if not self._cache_dirty: return
+ self._cache_dirty = False
+ def run():
+ try: self.save_vuln_cache()
+ except: self._cache_dirty = True
+ t = threading.Thread(target=run); t.setDaemon(True); t.start()
+
+ # ─────────────────────────
+ # CACHE KEY / LOOKUP
+ # ─────────────────────────
+ def _get_request_signature(self, data):
+ req_hdrs = [str(h).split(':',1)[0].strip().lower() for h in data.get("request_headers",[])[:10]]
+ res_hdrs = [str(h).split(':',1)[0].strip().lower() for h in data.get("response_headers",[])[:10]]
+ auth_present = any(h.lower().startswith(('authorization:','cookie:','x-api-key:'))
+ for h in data.get("request_headers",[]))
+ auth_len = sum(len(h) for h in data.get("request_headers",[])
+ if h.lower().startswith(('authorization:','cookie:','x-api-key:')))
+ sig = {"provider": self.AI_PROVIDER, "model": self.MODEL,
+ "method": data.get("method",""), "url": str(data.get("url","")).split('?',1)[0],
+ "status": data.get("status",0), "mime_type": data.get("mime_type",""),
+ "param_names": sorted([p.get("name","") for p in data.get("params_sample",[]) if p.get("name")]),
+ "req_headers": sorted(req_hdrs), "res_headers": sorted(res_hdrs),
+ "auth_present": auth_present, "auth_len": auth_len}
+ return hashlib.sha256(json.dumps(sig, sort_keys=True).encode('utf-8')).hexdigest()[:32]
+
+ def _get_cached_findings(self, sig):
+ with self.vuln_cache_lock:
+ entry = self.vuln_cache.get(sig)
+ if not entry: return None
+ entry["last_seen"] = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ entry["hit_count"] = int(entry.get("hit_count",0)) + 1
+ findings = entry.get("findings", [])
+ self._cache_dirty = True
+ return findings if isinstance(findings, list) else []
+
+ def _store_cached_findings(self, sig, url, findings):
+ if isinstance(findings, dict): findings = [findings]
+ normalized = [f for f in findings if isinstance(f, dict)]
+ if not normalized: return
+ with self.vuln_cache_lock:
+ self.vuln_cache[sig] = {
+ "url": str(url).split('?',1)[0],
+ "updated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "hit_count": 0, "findings": normalized
+ }
+ self._cache_dirty = True
+ self._ui_dirty = True
+
+ # ─────────────────────────
+ # HASHING
+ # ─────────────────────────
+ def _get_url_hash(self, url, params):
+ param_names = sorted([p.getName() for p in params])
+ raw = str(url).split('?')[0] + '|' + '|'.join(param_names)
+ return hashlib.sha256(raw.encode('utf-8')).hexdigest()[:32]
+
+ def _get_finding_hash(self, url, title, cwe, param_name=""):
+ raw = "%s|%s|%s|%s" % (str(url).split('?')[0], title.lower().strip(), cwe, param_name)
+ return hashlib.sha256(raw.encode('utf-8')).hexdigest()[:32]
+
+ # ─────────────────────────
+ # TASK TRACKING
+ # ─────────────────────────
+ def addTask(self, task_type, url, status="Queued", messageInfo=None):
+ with self.tasks_lock:
+ task = {"timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "type": task_type, "url": url, "status": status,
+ "start_time": time.time(), "messageInfo": messageInfo}
+ self.tasks.append(task)
+ with self.stats_lock: self.stats["total_requests"] += 1
+ self._ui_dirty = True
+ return len(self.tasks) - 1
+
+ def updateTask(self, task_id, status, error=None):
+ with self.tasks_lock:
+ if task_id < len(self.tasks):
+ self.tasks[task_id]["status"] = status
+ self.tasks[task_id]["end_time"] = time.time()
+ if error: self.tasks[task_id]["error"] = error
+ self._ui_dirty = True
+
+ def updateStats(self, key, n=1):
+ with self.stats_lock:
+ self.stats[key] = self.stats.get(key, 0) + n
+ self._ui_dirty = True
+
+ def log_to_console(self, msg):
+ with self.console_lock:
+ ts = datetime.now().strftime("%H:%M:%S")
+ s = str(msg)
+ if len(s) > 160: s = s[:157] + "..."
+ self.console_messages.append("[%s] %s" % (ts, s))
+ if len(self.console_messages) > self.max_console_messages:
+ self.console_messages = self.console_messages[-self.max_console_messages:]
+ self._ui_dirty = True
+
+ def add_finding(self, finding_dict):
+ """Store full rich finding dict (includes exploit/poc fields)."""
+ with self.findings_lock_ui:
+ self.findings_list.append(finding_dict)
+ self._ui_dirty = True
+
+ # ─────────────────────────
+ # BURP INTERFACE
+ # ─────────────────────────
+ def getTabCaption(self): return "SILENTCHAIN"
+ def getUiComponent(self): return self.panel
+
+ def createMenuItems(self, invocation):
+ ctx = invocation.getInvocationContext()
+ allowed = [invocation.CONTEXT_MESSAGE_EDITOR_REQUEST,
+ invocation.CONTEXT_MESSAGE_VIEWER_REQUEST,
+ invocation.CONTEXT_PROXY_HISTORY,
+ invocation.CONTEXT_TARGET_SITE_MAP_TABLE,
+ invocation.CONTEXT_TARGET_SITE_MAP_TREE]
+ if ctx not in allowed: return None
+ msgs = invocation.getSelectedMessages()
+ if not msgs or len(msgs) == 0: return None
+ menu_list = ArrayList()
+ item = JMenuItem("SILENTCHAIN: Analyze Request")
+ item.setForeground(Theme.ACCENT)
+ item.addActionListener(lambda x: self.analyzeFromContextMenu(msgs))
+ menu_list.add(item)
+ return menu_list
+
+ def analyzeFromContextMenu(self, messages):
+ t = threading.Thread(target=self._contextMenuThread, args=(messages,))
+ t.setDaemon(True); t.start()
+
+ def _contextMenuThread(self, messages):
+ seen = set()
+ for message in messages:
+ try:
+ req = self.helpers.analyzeRequest(message)
+ url_str = str(req.getUrl())
+ rb = message.getRequest()
+ key = "%s|%s" % (url_str, hashlib.sha256(bytes(rb.tostring())).hexdigest()[:8] if rb else "")
+ now = time.time()
+ with self.context_menu_lock:
+ if now - self.context_menu_last_invoke.get(key, 0) < self.context_menu_debounce_time:
+ continue
+ self.context_menu_last_invoke[key] = now
+ if key in seen: continue
+ seen.add(key)
+
+ if message.getResponse() is None:
+ resp = self.callbacks.makeHttpRequest(message.getHttpService(), rb)
+ if resp is None or resp.getResponse() is None: continue
+ message = resp
+
+ task_id = self.addTask("CONTEXT", url_str, "Queued", message)
+ self.thread_pool.submit(AnalyzeTask(self, message, url_str, task_id, forced=True))
+ except Exception as e:
+ self.stderr.println("[!] Context menu error: %s" % e)
+
+ def doPassiveScan(self, baseRequestResponse):
+ if not self.PASSIVE_SCANNING_ENABLED: return None
+ try:
+ req = self.helpers.analyzeRequest(baseRequestResponse)
+ url_str = str(req.getUrl())
+ if not self.is_in_scope(url_str): return None
+ if self.should_skip_extension(url_str): return None
+ except: url_str = "Unknown"
+ task_id = self.addTask("PASSIVE", url_str, "Queued", baseRequestResponse)
+ self.thread_pool.submit(AnalyzeTask(self, baseRequestResponse, url_str, task_id))
+ return None
+
+ def doActiveScan(self, brr, ip): return []
+ def consolidateDuplicateIssues(self, a, b): return 0
+
+ def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
+ if messageIsRequest or not self.PASSIVE_SCANNING_ENABLED: return
+ if toolFlag != 4: return # TOOL_PROXY = 4
+ try:
+ req = self.helpers.analyzeRequest(messageInfo)
+ url_str = str(req.getUrl())
+ if not self.is_in_scope(url_str): return
+ if self.should_skip_extension(url_str): return
+ except: url_str = "Unknown"
+ task_id = self.addTask("HTTP", url_str, "Queued", messageInfo)
+ self.thread_pool.submit(AnalyzeTask(self, messageInfo, url_str, task_id))
+
+ def is_in_scope(self, url):
+ try:
+ from java.net import URL as JavaURL
+ return self.callbacks.isInScope(JavaURL(url))
+ except: return False
+
+ def should_skip_extension(self, url):
+ try:
+ path = url.split('?')[0].lower()
+ fname = path.split('/')[-1] if '/' in path else path
+ if '.' in fname:
+ ext = fname.split('.')[-1]
+ if ext in self.SKIP_EXTENSIONS: return True
+ except: pass
+ return False
+
+ # ─────────────────────────
+ # ANALYSIS ENGINE
+ # ─────────────────────────
+ def analyze(self, messageInfo, url_str=None, task_id=None):
+ host = self._host_from_url(url_str or "unknown")
+ host_sem = self.get_host_semaphore(host)
+ host_sem.acquire()
+ try:
+ self.global_semaphore.acquire()
+ try:
+ self._rate_limit(task_id, "Waiting (Rate Limit)")
+ if task_id is not None: self.updateTask(task_id, "Analyzing")
+ self._perform_analysis(messageInfo, "HTTP", url_str, task_id)
+ if task_id is not None: self.updateTask(task_id, "Completed")
+ except Exception as e:
+ self.stderr.println("[!] Analysis error: %s" % e)
+ if task_id is not None: self.updateTask(task_id, "Error: %s" % str(e)[:30])
+ self.updateStats("errors")
+ finally:
+ self.global_semaphore.release()
+ self.refreshUI()
+ finally:
+ host_sem.release()
+
+ def analyze_forced(self, messageInfo, url_str=None, task_id=None):
+ host = self._host_from_url(url_str or "unknown")
+ host_sem = self.get_host_semaphore(host)
+ host_sem.acquire()
+ try:
+ self.global_semaphore.acquire()
+ try:
+ self._rate_limit(task_id, "Waiting (Rate Limit)")
+ if task_id is not None: self.updateTask(task_id, "Analyzing (Forced)")
+ self._perform_analysis(messageInfo, "CONTEXT", url_str, task_id, bypass_dedup=True)
+ if task_id is not None: self.updateTask(task_id, "Completed")
+ except Exception as e:
+ self.stderr.println("[!] Forced analysis error: %s" % e)
+ if task_id is not None: self.updateTask(task_id, "Error: %s" % str(e)[:30])
+ self.updateStats("errors")
+ finally:
+ self.global_semaphore.release()
+ self.refreshUI()
+ finally:
+ host_sem.release()
+
+ def _rate_limit(self, task_id, status_msg):
+ wait = self.min_delay - (time.time() - self.last_request_time)
+ if wait > 0:
+ if task_id is not None: self.updateTask(task_id, status_msg)
+ time.sleep(wait)
+ self.last_request_time = time.time()
+
+ def get_host_semaphore(self, host):
+ with self.host_semaphore_lock:
+ if host not in self.host_semaphores:
+ self.host_semaphores[host] = threading.Semaphore(2)
+ return self.host_semaphores[host]
+
+ def _host_from_url(self, url_str):
+ try:
+ import re
+ m = re.match(r'https?://([^:/]+)', str(url_str))
+ return m.group(1) if m else "unknown"
+ except: return "unknown"
+
+ def _perform_analysis(self, messageInfo, source, url_str=None, task_id=None, bypass_dedup=False):
+ try:
+ req = self.helpers.analyzeRequest(messageInfo)
+ res = self.helpers.analyzeResponse(messageInfo.getResponse())
+ url = str(req.getUrl())
+ if not url_str: url_str = url
+
+ params = req.getParameters()
+ url_hash = self._get_url_hash(url, params)
+
+ if not bypass_dedup:
+ with self.url_lock:
+ if url_hash in self.processed_urls:
+ if task_id is not None: self.updateTask(task_id, "Skipped (Duplicate)")
+ self.updateStats("skipped_duplicate")
+ return
+ self.processed_urls.add(url_hash)
+
+ req_bytes = messageInfo.getRequest()
+ req_body = ""
+ try: req_body = self.helpers.bytesToString(req_bytes[req.getBodyOffset():])[:2000]
+ except: req_body = "[binary]"
+
+ req_hdrs = [str(h) for h in req.getHeaders()[:10]]
+
+ res_bytes = messageInfo.getResponse()
+ res_body = ""
+ try:
+ raw = self.helpers.bytesToString(res_bytes[res.getBodyOffset():])
+ res_body = self.smart_truncate(raw)
+ except: res_body = "[binary]"
+
+ res_hdrs = [str(h) for h in res.getHeaders()[:10]]
+ params_sample = [{"name": p.getName(), "value": p.getValue()[:150],
+ "type": str(p.getType())} for p in params[:5]]
+ idor_signals = self.extract_idor_signals(params_sample, url)
+
+ data = {"url": url, "method": req.getMethod(), "status": res.getStatusCode(),
+ "mime_type": res.getStatedMimeType(), "params_count": len(params),
+ "params_sample": params_sample, "request_headers": req_hdrs,
+ "request_body": req_body, "response_headers": res_hdrs,
+ "response_body": res_body, "idor_signals": idor_signals}
+
+ sig = self._get_request_signature(data)
+ cached = None if bypass_dedup else self._get_cached_findings(sig)
+
+ if cached is not None:
+ findings = cached
+ self.updateStats("cached_reused")
+ self.updateStats("analyzed")
+ self.log_to_console("[%s] CACHE HIT %s (%d findings)" % (source, url_str[:60], len(findings)))
+ else:
+ ai_text = self.ask_ai(self.build_prompt(data))
+ if not ai_text:
+ if task_id is not None: self.updateTask(task_id, "Error (No AI response)")
+ self.updateStats("errors"); return
+
+ self.updateStats("analyzed")
+ findings = self._parse_ai_response(ai_text)
+ if not findings:
+ if task_id is not None: self.updateTask(task_id, "Error (JSON parse)")
+ self.updateStats("errors"); return
+
+ self._store_cached_findings(sig, url, findings)
+
+ if not isinstance(findings, list): findings = [findings]
+
+ created = 0
+ for item in findings:
+ if not isinstance(item, dict): continue
+ title = item.get("title", "AI Finding")
+ severity = VALID_SEVERITIES.get(item.get("severity","information").lower().strip(), "Information")
+ ai_conf = item.get("confidence", 50)
+ try: ai_conf = int(ai_conf)
+ except: ai_conf = 50
+ cwe = item.get("cwe","")
+ burp_conf = map_confidence(ai_conf)
+ if not burp_conf:
+ self.updateStats("skipped_low_confidence"); continue
+
+ param_name = params_sample[0].get("name","") if params_sample else ""
+ fhash = self._get_finding_hash(url, title, cwe, param_name)
+ with self.findings_lock:
+ if fhash in self.findings_cache:
+ self.updateStats("skipped_duplicate"); continue
+ self.findings_cache[fhash] = True
+
+ # Build rich finding dict — this powers the detail panel
+ rich_finding = {
+ "discovered_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "url": url,
+ "title": title,
+ "severity": severity,
+ "confidence": burp_conf,
+ "detail": item.get("detail",""),
+ "cwe": cwe,
+ "owasp": item.get("owasp",""),
+ "remediation": item.get("remediation",""),
+ "evidence": item.get("evidence",""),
+ "param": item.get("param",""),
+ "affected_params": item.get("affected_params", []),
+ "exploit_path": item.get("exploit_path",""),
+ "exploit_steps": item.get("exploit_steps", []),
+ "poc_template": item.get("poc_template",""),
+ "poc_curl": item.get("poc_curl",""),
+ "poc_python": item.get("poc_python",""),
+ "business_impact": item.get("business_impact",""),
+ "cvss_score": item.get("cvss_score",""),
+ "references": item.get("references", []),
+ }
+ self.add_finding(rich_finding)
+
+ # Also add to Burp scanner
+ detail_html = self._build_burp_detail(rich_finding, params_sample)
+ issue = CustomScanIssue(messageInfo.getHttpService(), req.getUrl(),
+ [messageInfo], title, detail_html, severity, burp_conf)
+ self.callbacks.addScanIssue(issue)
+ self.updateStats("findings_created")
+ created += 1
+
+ self.log_to_console("[%s] %s → %d finding(s)" % (source, url_str[:60], created))
+ except Exception as e:
+ self.stderr.println("[!] _perform_analysis error: %s" % e)
+ self.updateStats("errors")
+
+ def _build_burp_detail(self, f, params_sample):
+ """Build HTML detail string for Burp's Issues panel."""
+ parts = ["Description: AI Confidence: %d%%" % f.get("ai_conf", 50))
+ if f.get("evidence"):
+ parts.append("Evidence: %s" % f["evidence"][:500])
+ if f.get("exploit_path"):
+ parts.append("Exploitation: %s " % s for s in f["exploit_steps"])
+ parts.append("%s " % steps)
+ if f.get("poc_curl"):
+ parts.append("PoC (curl): %s " % f["poc_curl"][:800])
+ if f.get("remediation"):
+ parts.append("Remediation: CWE: %s " % (cid, f["cwe"]))
+ if f.get("owasp"):
+ parts.append("OWASP: %s" % f["owasp"])
+ return "".join(parts)
+
+ # ─────────────────────────
+ # PROMPT (expanded for exploitation + PoC)
+ # ─────────────────────────
+ def build_prompt(self, data):
+ return (
+ "You are a senior penetration tester. Output ONLY a JSON array. NO markdown, NO text outside JSON.\n\n"
+ "Analyze the HTTP request/response below for ALL of:\n"
+ "1. OWASP Top 10 (2021) — SQLi, XSS, Broken Auth, etc.\n"
+ "2. IDOR / BOLA — numeric/UUID IDs in params, sequential IDs in paths\n"
+ "3. Mass Assignment — unexpected POST params not validated server-side\n"
+ "4. SSRF — URL/redirect/webhook params pointing to internal resources\n"
+ "5. JWT weaknesses — alg:none, HS256 weak secret, missing validation\n"
+ "6. GraphQL — introspection, batch abuse, __schema in body\n"
+ "7. OAuth/OIDC misconfigs — open redirect_uri, missing state, token leak\n"
+ "8. HTTP Request Smuggling — TE+CL conflicts, chunked encoding abuse\n"
+ "9. Cache Poisoning — X-Forwarded-Host, X-Original-URL, fat GET\n"
+ "10. Business Logic — price/qty tampering, role param, discount abuse\n"
+ "11. Information Disclosure — stack traces, secrets, internal IPs\n"
+ "12. Prototype Pollution — __proto__, constructor.prototype in JSON\n"
+ "13. Missing Security Headers — CSP, HSTS, X-Frame-Options absent\n"
+ "14. API Versioning — v1 vs v2 access control gaps\n\n"
+ "For each finding with confidence >= 50, output a JSON object with ALL fields:\n"
+ "{\n"
+ " \"title\": \"short vuln name\",\n"
+ " \"severity\": \"High|Medium|Low|Information\",\n"
+ " \"confidence\": 50-100,\n"
+ " \"detail\": \"technical description of the vulnerability\",\n"
+ " \"cwe\": \"CWE-XXX\",\n"
+ " \"owasp\": \"AXX:2021 Name\",\n"
+ " \"cvss_score\": \"7.5\",\n"
+ " \"param\": \"vulnerable_parameter_name\",\n"
+ " \"affected_params\": [\"param1\", \"param2\"],\n"
+ " \"evidence\": \"exact snippet from request/response proving the issue\",\n"
+ " \"exploit_path\": \"one-paragraph description of how an attacker exploits this\",\n"
+ " \"exploit_steps\": [\n"
+ " \"Step 1: Intercept the request to /api/users/123\",\n"
+ " \"Step 2: Change the numeric ID to another user's ID\",\n"
+ " \"Step 3: Observe the server returns another user's data\"\n"
+ " ],\n"
+ " \"poc_curl\": \"curl -X GET 'https://target.com/api/users/124' -H 'Authorization: Bearer '\",\n"
+ " \"poc_python\": \"import requests\\nrequests.get('https://target.com/api/users/124', headers={'Authorization': 'Bearer TOKEN'})\",\n"
+ " \"poc_template\": \"burp-style request with [INJECT] marker\",\n"
+ " \"business_impact\": \"what an attacker can achieve if exploited\",\n"
+ " \"remediation\": \"specific fix with code example if possible\",\n"
+ " \"references\": [\"https://owasp.org/...\", \"https://portswigger.net/...\"]\n"
+ "}\n\n"
+ "Rules:\n"
+ "- Output [] if no issues found with confidence >= 50\n"
+ "- Do NOT fabricate evidence — only report what is visible in the data\n"
+ "- exploit_steps must be concrete and actionable, not generic\n"
+ "- poc_curl must be a real runnable command using values from the request\n\n"
+ "HTTP Data:\n%s\n"
+ ) % json.dumps(data, indent=2)
+
+ # ─────────────────────────
+ # AI RESPONSE PARSING
+ # ─────────────────────────
+ def _parse_ai_response(self, ai_text):
+ ai_text = ai_text.strip()
+ import re
+ if ai_text.startswith("```"):
+ ai_text = re.sub(r'^```(?:json)?\n?|```$', '', ai_text, flags=re.MULTILINE).strip()
+ # Strip ... tags (DeepSeek)
+ ai_text = re.sub(r'.*? ', '', ai_text, flags=re.DOTALL).strip()
+
+ start = ai_text.find('[')
+ end = ai_text.rfind(']')
+ if start != -1 and end != -1:
+ try:
+ r = json.loads(ai_text[start:end+1])
+ return r if isinstance(r, list) else [r]
+ except: pass
+
+ obj_s = ai_text.find('{')
+ obj_e = ai_text.rfind('}')
+ if obj_s != -1 and obj_e != -1:
+ try:
+ r = json.loads('[' + ai_text[obj_s:obj_e+1] + ']')
+ return r if isinstance(r, list) else [r]
+ except: pass
+
+ return self._repair_json(ai_text)
+
+ def _repair_json(self, text):
+ try:
+ import re
+ text = re.sub(r',(\s*[}\]])', r'\1', text)
+ text = text.strip()
+ if not text.startswith('['):
+ s = text.find('{')
+ if s != -1: text = '[' + text[s:]
+ if not text.endswith(']'):
+ e = text.rfind('}')
+ if e != -1: text = text[:e+1] + ']'
+ return json.loads(text)
+ except:
+ return []
+
+ # ─────────────────────────
+ # AI PROVIDERS
+ # ─────────────────────────
+ def ask_ai(self, prompt):
+ try:
+ return {
+ "Ollama": self._ask_ollama,
+ "OpenAI": self._ask_openai,
+ "Claude": self._ask_claude,
+ "Gemini": self._ask_gemini,
+ "Azure Foundry":self._ask_azure_foundry,
+ }[self.AI_PROVIDER](prompt)
+ except KeyError:
+ self.stderr.println("[!] Unknown provider: %s" % self.AI_PROVIDER)
+ except Exception as e:
+ self.stderr.println("[!] AI error: %s" % e)
+ return None
+
+ def _ask_ollama(self, prompt):
+ url = self.API_URL.rstrip('/') + "/api/generate"
+ payload = {"model": self.MODEL, "prompt": prompt, "stream": False,
+ "format": "json", "options": {"temperature": 0.0, "num_predict": self.MAX_TOKENS}}
+ for attempt in range(3):
+ try:
+ req = urllib2.Request(url, data=json.dumps(payload).encode("utf-8"),
+ headers={"Content-Type": "application/json"})
+ resp = urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT)
+ data = json.loads(resp.read().decode("utf-8","ignore"))
+ text = data.get("response","").strip()
+ if data.get("done_reason") == "length":
+ text = self._fix_truncated(text)
+ return text
+ except urllib2.URLError as e:
+ if attempt < 2 and ("timed out" in str(e) or "timeout" in str(e).lower()):
+ self.stderr.println("[!] Timeout, retry %d/2" % (attempt+1)); time.sleep(2)
+ else: raise
+ return None
+
+ def _ask_openai(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/chat/completions",
+ data=json.dumps({"model": self.MODEL, "max_tokens": self.MAX_TOKENS, "temperature": 0.0,
+ "messages": [{"role":"user","content": prompt}]}).encode("utf-8"),
+ headers={"Content-Type":"application/json","Authorization":"Bearer "+self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["choices"][0]["message"]["content"]
+
+ def _ask_claude(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({"model": self.MODEL, "max_tokens": self.MAX_TOKENS,
+ "messages": [{"role":"user","content": prompt}]}).encode("utf-8"),
+ headers={"Content-Type":"application/json","x-api-key": self.API_KEY,
+ "anthropic-version":"2023-06-01"})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["content"][0]["text"]
+
+ def _ask_gemini(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/models/%s:generateContent?key=%s" % (self.MODEL, self.API_KEY),
+ data=json.dumps({"contents":[{"parts":[{"text":prompt}]}],
+ "generationConfig":{"maxOutputTokens":self.MAX_TOKENS,"temperature":0.0}
+ }).encode("utf-8"),
+ headers={"Content-Type":"application/json"})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["candidates"][0]["content"]["parts"][0]["text"]
+
+ def _ask_azure_foundry(self, prompt):
+ if not self.API_KEY or not self.API_URL: raise Exception("Azure config incomplete")
+ base = self.API_URL.split('?',1)[0].rstrip('/')
+ chat_url = self._build_azure_url(base)
+ if "api-version=" not in chat_url:
+ sep = '&' if '?' in chat_url else '?'
+ chat_url += sep + "api-version=" + (self.AZURE_API_VERSION or "2024-06-01")
+ req = urllib2.Request(chat_url,
+ data=json.dumps({"messages":[{"role":"user","content":prompt}],
+ "max_tokens":self.MAX_TOKENS,"temperature":0.0}).encode("utf-8"),
+ headers={"Content-Type":"application/json","api-key":self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["choices"][0]["message"]["content"]
+
+ def _build_azure_url(self, base):
+ if "/chat/completions" in base: return base
+ if "/openai/deployments/" in base: return base + "/chat/completions"
+ if not self.MODEL: raise Exception("Azure deployment name required in Model field")
+ return "%s/openai/deployments/%s/chat/completions" % (base, urllib.quote(self.MODEL, safe=''))
+
+ def _fix_truncated(self, text):
+ if not text: return "[]"
+ try: json.loads(text); return text
+ except: pass
+ e = text.rfind('}')
+ if e > 0:
+ p = text[:e+1]
+ if p.count('[') > p.count(']'):
+ try: json.loads(p+']'); return p+']'
+ except: pass
+ return "[]"
+
+ # ─────────────────────────
+ # CONNECTION TESTS
+ # ─────────────────────────
+ def test_ai_connection(self):
+ self.stdout.println("[CONN] Testing %s @ %s" % (self.AI_PROVIDER, self.API_URL))
+ try:
+ return {
+ "Ollama": self._test_ollama, "OpenAI": self._test_openai,
+ "Claude": self._test_claude, "Gemini": self._test_gemini,
+ "Azure Foundry": self._test_azure,
+ }[self.AI_PROVIDER]()
+ except KeyError:
+ self.stderr.println("[!] Unknown provider"); return False
+ except Exception as e:
+ self.stderr.println("[!] Connection failed: %s" % e); return False
+
+ def _test_ollama(self):
+ url = self.API_URL.rstrip('/api/generate').rstrip('/') + "/api/tags"
+ resp = urllib2.urlopen(urllib2.Request(url), timeout=10)
+ data = json.loads(resp.read())
+ if 'models' in data:
+ self.available_models = [m['name'] for m in data['models']]
+ self.stdout.println("[CONN] Ollama OK — %d models" % len(self.available_models))
+ if self.MODEL not in self.available_models and self.available_models:
+ self.MODEL = self.available_models[0]
+ return True
+ return False
+
+ def _test_openai(self):
+ if not self.API_KEY: self.stderr.println("[!] OpenAI key required"); return False
+ req = urllib2.Request("https://api.openai.com/v1/models",
+ headers={"Authorization":"Bearer "+self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=10).read())
+ if 'data' in data:
+ self.available_models = [m['id'] for m in data['data'] if 'gpt' in m.get('id','')]
+ self.stdout.println("[CONN] OpenAI OK"); return True
+ return False
+
+ def _test_claude(self):
+ if not self.API_KEY: self.stderr.println("[!] Claude key required"); return False
+ try:
+ req = urllib2.Request(self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({"model": self.MODEL or "claude-3-5-sonnet-20241022",
+ "max_tokens":5,"messages":[{"role":"user","content":"ping"}]}).encode(),
+ headers={"Content-Type":"application/json","x-api-key":self.API_KEY,"anthropic-version":"2023-06-01"})
+ resp = urllib2.urlopen(req, timeout=10)
+ if resp.getcode() == 200:
+ self.available_models = ["claude-opus-4-6","claude-sonnet-4-6","claude-haiku-4-5-20251001"]
+ self.stdout.println("[CONN] Claude OK"); return True
+ except urllib2.HTTPError as e:
+ if e.code == 429:
+ self.stdout.println("[CONN] Claude OK (rate-limited)"); return True
+ raise
+ return False
+
+ def _test_gemini(self):
+ if not self.API_KEY: self.stderr.println("[!] Gemini key required"); return False
+ self.available_models = ["gemini-1.5-pro","gemini-1.5-flash","gemini-pro"]
+ self.stdout.println("[CONN] Gemini configured"); return True
+
+ def _test_azure(self):
+ if not self.API_KEY or not self.API_URL: self.stderr.println("[!] Azure config incomplete"); return False
+ self.available_models = [self.MODEL] if self.MODEL else []
+ self.stdout.println("[CONN] Azure Foundry configured"); return True
+
+ # ─────────────────────────
+ # UTILITY
+ # ─────────────────────────
+ def smart_truncate(self, body, max_len=5000):
+ if len(body) <= max_len: return body
+ head, tail = 3500, 1000
+ trunc = len(body) - head - tail
+ return body[:head] + "\n...[%d chars truncated]...\n" % trunc + body[-tail:]
+
+ def extract_idor_signals(self, params_sample, url):
+ signals = []
+ try:
+ import re
+ IDOR_NAMES = {'id','user_id','account_id','order_id','invoice_id','file_id',
+ 'doc_id','record_id','item_id','uid','pid','customer_id','profile_id','ref'}
+ path_ids = re.findall(r'/(\d{1,10})(?:/|$|\?)', str(url))
+ if path_ids: signals.append({"type":"path_numeric_id","values":path_ids[:3]})
+ if re.search(r'[0-9a-f-]{36}', str(url), re.I): signals.append({"type":"path_uuid"})
+ for p in params_sample:
+ v = p.get("value",""); n = p.get("name","")
+ if re.match(r'^\d+$', v) and len(v) <= 10:
+ signals.append({"type":"numeric_param","name":n,"value":v})
+ elif re.match(r'^[0-9a-f-]{36}$', v, re.I):
+ signals.append({"type":"uuid_param","name":n})
+ elif n.lower() in IDOR_NAMES:
+ signals.append({"type":"idor_name_match","name":n,"value":v[:20]})
+ except: pass
+ return signals
+
+ def print_logo(self):
+ self.stdout.println("=" * 60)
+ self.stdout.println(" SILENTCHAIN AI v%s — Community Edition" % self.VERSION)
+ self.stdout.println(" Dark terminal UI | Exploitation paths | PoC templates")
+ self.stdout.println(" Provider: %s | Model: %s" % (self.AI_PROVIDER, self.MODEL))
+ self.stdout.println("=" * 60)
diff --git a/variants/silentchain_v2_1_0_with_scope.py b/variants/silentchain_v2_1_0_with_scope.py
new file mode 100644
index 0000000..4bfceac
--- /dev/null
+++ b/variants/silentchain_v2_1_0_with_scope.py
@@ -0,0 +1,2532 @@
+# -*- coding: utf-8 -*-
+# Burp Suite Python Extension: SILENTCHAIN AI - COMMUNITY EDITION
+# Version: 2.1.0
+# Enhanced Edition: Full Vulnerability Detail Panel + Exploitation + PoC + Scope Manager
+# License: MIT License
+
+from burp import IBurpExtender, IHttpListener, IScannerCheck, IScanIssue, ITab, IContextMenuFactory
+from java.io import PrintWriter
+from java.awt import (BorderLayout, GridBagLayout, GridBagConstraints, Insets,
+ Dimension, Font, Color, FlowLayout, Cursor)
+from java.awt.event import MouseAdapter
+from javax.swing import (JPanel, JScrollPane, JTextArea, JTable, JLabel, JSplitPane,
+ BorderFactory, SwingUtilities, JButton, BoxLayout, Box,
+ JMenuItem, JTextPane, JTabbedPane, UIManager, SwingConstants,
+ JEditorPane)
+from javax.swing.table import DefaultTableModel, DefaultTableCellRenderer
+from javax.swing.text import SimpleAttributeSet, StyleConstants
+from javax.swing.border import EmptyBorder
+from java.lang import Runnable
+from java.util import ArrayList
+from java.util.concurrent import Executors
+import json
+import threading
+import urllib2
+import urllib
+import time
+import hashlib
+from datetime import datetime
+
+# ─────────────────────────────────────────────
+# DESIGN TOKENS (change once → applies everywhere)
+# ─────────────────────────────────────────────
+class Theme:
+ # Primary palette — dark terminal aesthetic
+ BG_DARKEST = Color(0x0D, 0x11, 0x17) # near-black
+ BG_DARK = Color(0x13, 0x19, 0x22) # panel bg
+ BG_MID = Color(0x1C, 0x24, 0x30) # card bg
+ BG_LIGHT = Color(0x24, 0x30, 0x3E) # hover / selected
+ BORDER = Color(0x2E, 0x3D, 0x4F) # subtle border
+
+ # Accent — electric cyan
+ ACCENT = Color(0x00, 0xD4, 0xFF)
+ ACCENT_DIM = Color(0x00, 0x7A, 0x99)
+
+ # Text
+ TEXT_PRIMARY = Color(0xE2, 0xE8, 0xF0)
+ TEXT_MUTED = Color(0x64, 0x74, 0x8B)
+ TEXT_CODE = Color(0x7D, 0xD3, 0xFC)
+
+ # Severity
+ SEV_CRITICAL = Color(0xFF, 0x17, 0x44)
+ SEV_HIGH = Color(0xFF, 0x45, 0x00)
+ SEV_MED = Color(0xFF, 0xA5, 0x00)
+ SEV_LOW = Color(0xFF, 0xD7, 0x00)
+ SEV_INFO = Color(0x38, 0xBD, 0xF8)
+
+ # Confidence
+ CONF_CERTAIN = Color(0x10, 0xB9, 0x81)
+ CONF_FIRM = Color(0x38, 0xBD, 0xF8)
+ CONF_TENTATIVE = Color(0xFF, 0xA5, 0x00)
+
+ FONT_MONO = Font("Monospaced", Font.PLAIN, 12)
+ FONT_MONO_B= Font("Monospaced", Font.BOLD, 12)
+ FONT_MONO_L= Font("Monospaced", Font.PLAIN, 11)
+ FONT_HEAD = Font("Monospaced", Font.BOLD, 14)
+ FONT_TITLE = Font("Monospaced", Font.BOLD, 16)
+
+
+VALID_SEVERITIES = {
+ "high": "High", "medium": "Medium", "low": "Low",
+ "information": "Information", "informational": "Information",
+ "info": "Information", "inform": "Information",
+ "critical": "High"
+}
+
+def map_confidence(v):
+ try: v = int(v)
+ except: v = 50
+ if v < 50: return None
+ if v < 75: return "Tentative"
+ if v < 90: return "Firm"
+ return "Certain"
+
+def severity_color(sev):
+ return {
+ "High": Theme.SEV_HIGH,
+ "Medium": Theme.SEV_MED,
+ "Low": Theme.SEV_LOW,
+ "Information": Theme.SEV_INFO,
+ }.get(sev, Theme.TEXT_MUTED)
+
+def confidence_color(conf):
+ return {
+ "Certain": Theme.CONF_CERTAIN,
+ "Firm": Theme.CONF_FIRM,
+ "Tentative": Theme.CONF_TENTATIVE,
+ }.get(conf, Theme.TEXT_MUTED)
+
+
+# ─────────────────────────────────────────────
+# HELPER: apply dark bg/fg recursively
+# ─────────────────────────────────────────────
+def dark(component, bg=None, fg=None):
+ bg = bg or Theme.BG_DARK
+ fg = fg or Theme.TEXT_PRIMARY
+ try:
+ component.setBackground(bg)
+ component.setForeground(fg)
+ component.setOpaque(True)
+ except: pass
+ return component
+
+def styled_btn(text, bg, fg=Color.WHITE, action=None):
+ btn = JButton(text)
+ btn.setBackground(bg)
+ btn.setForeground(fg)
+ btn.setFont(Theme.FONT_MONO_B)
+ btn.setOpaque(True)
+ btn.setBorderPainted(False)
+ btn.setFocusPainted(False)
+ btn.setCursor(Cursor(Cursor.HAND_CURSOR))
+ if action:
+ btn.addActionListener(action)
+ return btn
+
+def titled_panel(title, layout=None):
+ p = JPanel(layout or BorderLayout())
+ p.setBackground(Theme.BG_MID)
+ border = BorderFactory.createCompoundBorder(
+ BorderFactory.createLineBorder(Theme.BORDER, 1),
+ BorderFactory.createEmptyBorder(4, 6, 4, 6)
+ )
+ titled = BorderFactory.createTitledBorder(
+ border, title,
+ 0, 0,
+ Theme.FONT_MONO_B, Theme.ACCENT
+ )
+ p.setBorder(titled)
+ return p
+
+
+# ─────────────────────────────────────────────
+# CONSOLE WRITER
+# ─────────────────────────────────────────────
+class ConsolePrintWriter:
+ def __init__(self, original_writer, extender_ref):
+ self.original = original_writer
+ self.extender = extender_ref
+
+ def println(self, message):
+ self.original.println(message)
+ if hasattr(self.extender, 'log_to_console'):
+ try: self.extender.log_to_console(str(message))
+ except: pass
+
+ def print_(self, m): self.original.print_(m)
+ def write(self, d): self.original.write(d)
+ def flush(self): self.original.flush()
+
+
+# ─────────────────────────────────────────────
+# THREAD POOL TASK WRAPPERS
+# ─────────────────────────────────────────────
+class AnalyzeTask(Runnable):
+ def __init__(self, extender, messageInfo, url_str, task_id, forced=False):
+ self.extender = extender
+ self.messageInfo = messageInfo
+ self.url_str = url_str
+ self.task_id = task_id
+ self.forced = forced
+
+ def run(self):
+ if self.forced:
+ self.extender.analyze_forced(self.messageInfo, self.url_str, self.task_id)
+ else:
+ self.extender.analyze(self.messageInfo, self.url_str, self.task_id)
+
+
+# ─────────────────────────────────────────────
+# CELL RENDERERS
+# ─────────────────────────────────────────────
+class DarkCellRenderer(DefaultTableCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DefaultTableCellRenderer.getTableCellRendererComponent(
+ self, table, value, sel, focus, row, col)
+ c.setBackground(Theme.BG_LIGHT if sel else (Theme.BG_MID if row % 2 == 0 else Theme.BG_DARK))
+ c.setForeground(Theme.TEXT_PRIMARY)
+ c.setFont(Theme.FONT_MONO_L)
+ c.setBorder(EmptyBorder(2, 6, 2, 6))
+ return c
+
+class StatusRenderer(DarkCellRenderer):
+ COLORS = {
+ "Cancelled": Theme.SEV_CRITICAL,
+ "Paused": Theme.SEV_LOW,
+ "Error": Theme.SEV_HIGH,
+ "Skipped": Theme.SEV_MED,
+ "Completed": Theme.CONF_CERTAIN,
+ "Analyzing": Theme.ACCENT,
+ "Waiting": Theme.ACCENT_DIM,
+ "Queued": Theme.TEXT_MUTED,
+ }
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ for k, color in self.COLORS.items():
+ if k in str(value):
+ c.setForeground(color)
+ c.setFont(Theme.FONT_MONO_B)
+ break
+ return c
+
+class SeverityRenderer(DarkCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ sev = str(value)
+ color = severity_color(sev)
+ c.setForeground(color)
+ c.setFont(Theme.FONT_MONO_B)
+ return c
+
+class ConfidenceRenderer(DarkCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ c.setForeground(confidence_color(str(value)))
+ c.setFont(Theme.FONT_MONO_B)
+ return c
+
+
+# ─────────────────────────────────────────────
+# VULN DETAIL PANEL ← new core component
+# ─────────────────────────────────────────────
+class VulnDetailPanel(JPanel):
+ """
+ Tabbed detail view shown when a finding row is selected.
+ Tabs: Overview | Exploitation | PoC | Remediation | Raw JSON
+ """
+ def __init__(self):
+ JPanel.__init__(self, BorderLayout())
+ self.setBackground(Theme.BG_DARKEST)
+ self._current_finding = None
+ self._build_ui()
+
+ def _build_ui(self):
+ # Header bar
+ self.header = JPanel(BorderLayout())
+ self.header.setBackground(Theme.BG_MID)
+ self.header.setBorder(EmptyBorder(8, 12, 8, 12))
+
+ self.title_label = JLabel("Select a finding to view details")
+ self.title_label.setFont(Theme.FONT_HEAD)
+ self.title_label.setForeground(Theme.TEXT_PRIMARY)
+
+ self.severity_badge = JLabel("")
+ self.severity_badge.setFont(Theme.FONT_MONO_B)
+ self.severity_badge.setHorizontalAlignment(SwingConstants.RIGHT)
+
+ self.header.add(self.title_label, BorderLayout.CENTER)
+ self.header.add(self.severity_badge, BorderLayout.EAST)
+ self.add(self.header, BorderLayout.NORTH)
+
+ # Tabs
+ self.tabs = JTabbedPane()
+ self.tabs.setBackground(Theme.BG_DARK)
+ self.tabs.setForeground(Theme.TEXT_PRIMARY)
+ self.tabs.setFont(Theme.FONT_MONO_B)
+
+ self.overview_pane = self._make_html_pane()
+ self.exploit_pane = self._make_html_pane()
+ self.poc_pane = self._make_code_pane()
+ self.remediation_pane = self._make_html_pane()
+ self.raw_pane = self._make_code_pane()
+
+ self.tabs.addTab("Overview", JScrollPane(self.overview_pane))
+ self.tabs.addTab("Exploitation", JScrollPane(self.exploit_pane))
+ self.tabs.addTab("PoC Template", JScrollPane(self.poc_pane))
+ self.tabs.addTab("Remediation", JScrollPane(self.remediation_pane))
+ self.tabs.addTab("Raw JSON", JScrollPane(self.raw_pane))
+
+ # Style tab scrollpanes
+ for i in range(self.tabs.getTabCount()):
+ sp = self.tabs.getComponentAt(i)
+ if isinstance(sp, JScrollPane):
+ sp.setBackground(Theme.BG_DARK)
+ sp.getViewport().setBackground(Theme.BG_DARK)
+
+ self.add(self.tabs, BorderLayout.CENTER)
+
+ # Empty state message
+ self.empty_label = JLabel("← Click any finding row to see full details, exploitation paths and PoC",
+ SwingConstants.CENTER)
+ self.empty_label.setFont(Theme.FONT_MONO)
+ self.empty_label.setForeground(Theme.TEXT_MUTED)
+
+ self._show_empty()
+
+ def _make_html_pane(self):
+ pane = JEditorPane("text/html", "")
+ pane.setEditable(False)
+ pane.setBackground(Theme.BG_DARK)
+ pane.setForeground(Theme.TEXT_PRIMARY)
+ pane.setFont(Theme.FONT_MONO)
+ pane.putClientProperty(JEditorPane.HONOR_DISPLAY_PROPERTIES, True)
+ return pane
+
+ def _make_code_pane(self):
+ area = JTextArea()
+ area.setEditable(False)
+ area.setBackground(Theme.BG_DARKEST)
+ area.setForeground(Theme.TEXT_CODE)
+ area.setFont(Theme.FONT_MONO)
+ area.setLineWrap(True)
+ area.setWrapStyleWord(False)
+ area.setBorder(EmptyBorder(8, 10, 8, 10))
+ return area
+
+ def _show_empty(self):
+ self.title_label.setText("Select a finding to view details")
+ self.severity_badge.setText("")
+ for pane in [self.overview_pane, self.exploit_pane, self.remediation_pane]:
+ pane.setText("")
+ for area in [self.poc_pane, self.raw_pane]:
+ area.setText("")
+
+ def _css(self):
+ return """
+
+ """
+
+ def load_finding(self, finding):
+ """Called when a row is selected in the findings table."""
+ self._current_finding = finding
+ self._render_finding(finding)
+
+ def _render_finding(self, f):
+ title = f.get("title", "Unknown Finding")
+ severity = f.get("severity", "Information")
+ conf = f.get("confidence", "")
+ url = f.get("url", "")
+ detail = f.get("detail", "")
+ cwe = f.get("cwe", "")
+ owasp = f.get("owasp", "")
+ remediation = f.get("remediation", "")
+ evidence = f.get("evidence", "")
+ exploit_path = f.get("exploit_path", "")
+ exploit_steps = f.get("exploit_steps", [])
+ poc_template = f.get("poc_template", "")
+ poc_curl = f.get("poc_curl", "")
+ poc_python = f.get("poc_python", "")
+ affected_params = f.get("affected_params", [])
+ business_impact = f.get("business_impact", "")
+ cvss = f.get("cvss_score", "")
+ references = f.get("references", [])
+
+ sev_cls = severity.lower() if severity.lower() in ["high","medium","low"] else "info"
+
+ # ── Header ──
+ self.title_label.setText(title)
+ badge_text = severity
+ if cvss:
+ badge_text += " CVSS: %s" % cvss
+ self.severity_badge.setText(badge_text)
+ self.severity_badge.setForeground(severity_color(severity))
+
+ # ── Overview Tab ──
+ sev_html = '%s ' % (sev_cls, severity)
+ conf_html = '%s ' % conf if conf else ""
+
+ params_html = ""
+ if affected_params:
+ params_html = "".join(['%s ' % p for p in affected_params])
+ elif f.get("param"):
+ params_html = '%s ' % f.get("param")
+
+ cwe_html = ""
+ if cwe:
+ cwe_id = cwe.replace("CWE-", "")
+ cwe_html = '%s ' % (cwe_id, cwe)
+
+ refs_html = ""
+ if references:
+ refs_html = "References "
+ for ref in references[:5]:
+ refs_html += '%s "
+
+ evidence_html = ""
+ if evidence:
+ evidence_html = "Evidence %s " % evidence[:1000]
+
+ overview = """{css}
+
+
Finding Summary
+
+ Severity: {sev} Confidence: {conf} URL: {url}
+
+
Description
+
{detail}
+
CWE: %s OWASP: %s CVSS: %s Affected Parameters %s
" % params_html if params_html else "",
+ evidence_html=evidence_html,
+ refs_html=refs_html
+ )
+ self.overview_pane.setText(overview)
+ self.overview_pane.setCaretPosition(0)
+
+ # ── Exploitation Tab ──
+ steps_html = ""
+ if exploit_steps and isinstance(exploit_steps, list):
+ steps_html = "Step-by-Step Exploitation "
+ for i, step in enumerate(exploit_steps):
+ steps_html += "%s " % step
+ steps_html += " "
+
+ impact_html = ""
+ if business_impact:
+ impact_html = "Business Impact %s
" % business_impact
+
+ exploit_html = """{css}
+
+
Attack Vector
+
{exploit_path}
+
+
Exploitation Prerequisites
+
+ Access to target application (authenticated or unauthenticated depending on vuln type)
+ Ability to intercept/modify HTTP requests (Burp Suite proxy)
+ {extra_prereqs}
+
+
No exploitation path provided by AI — re-analyze with context menu to refresh ",
+ steps_html=steps_html,
+ impact_html=impact_html,
+ extra_prereqs="Valid session token / API key (if endpoint is authenticated) " if "auth" in title.lower() or "idor" in title.lower() else ""
+ )
+ self.exploit_pane.setText(exploit_html)
+ self.exploit_pane.setCaretPosition(0)
+
+ # ── PoC Tab ──
+ poc_parts = []
+ if poc_curl:
+ poc_parts.append("# ── cURL PoC ──\n%s" % poc_curl)
+ if poc_python:
+ poc_parts.append("# ── Python PoC ──\n%s" % poc_python)
+ if poc_template and not poc_curl and not poc_python:
+ poc_parts.append("# ── PoC Template ──\n%s" % poc_template)
+ if not poc_parts:
+ poc_parts.append("# No PoC generated yet.\n# Right-click the request in Burp → Analyze Request\n# to trigger a fresh AI analysis with PoC generation.")
+
+ self.poc_pane.setText("\n\n".join(poc_parts))
+ self.poc_pane.setCaretPosition(0)
+
+ # ── Remediation Tab ──
+ rem_html = """{css}
+
+
Remediation
+
{remediation}
+
+
Verification Steps
+
+ Apply the fix in a development environment
+ Re-run the same request via Burp → Analyze Request
+ Confirm the AI no longer flags the vulnerability
+ Run a full regression test on the affected endpoint
+
+
+
Secure Code Reference
+
See OWASP Cheat Sheet Series
+ for language-specific secure coding guidance related to {owasp}.
+
" + "".join("%s " % s for s in exploit_steps) + " "
+
+ poc_html = ""
+ if f.get("poc_curl"):
+ poc_html += "cURL %s " % f["poc_curl"]
+ if f.get("poc_python"):
+ poc_html += "Python %s " % f["poc_python"]
+ if f.get("poc_template") and not poc_html:
+ poc_html = "%s " % f["poc_template"]
+
+ cards_html += """
+
+
+
+ {url}
+ {cwe_span}
+ {owasp_span}
+
+
+
+ Description
+ Exploitation
+ PoC
+ Remediation
+
+
+
{detail}
+ {evidence}
+ {impact}
+
+
+
{exploit_path}
+ {steps_html}
+
+
+ {poc_html}
+
+
+
+
%s ' % f["cwe"] if f.get("cwe") else "",
+ owasp_span='%s ' % f["owasp"] if f.get("owasp") else "",
+ detail=f.get("detail",""),
+ evidence='' % f["evidence"] if f.get("evidence") else "",
+ impact='Business Impact: %s
' % f["business_impact"] if f.get("business_impact") else "",
+ exploit_path=f.get("exploit_path","No exploitation path recorded."),
+ steps_html=steps_html,
+ poc_html=poc_html or "No PoC available. Re-analyze to generate.
",
+ remediation=f.get("remediation","")
+ )
+
+ return """
+
+
+SILENTCHAIN AI Report — {ts}
+
+
+
+SILENTCHAIN AI — Security Report
+Generated: {ts} | Model: {model} | Community Edition
+
+{cards}
+
+
+""".format(
+ ts=ts, model=self.MODEL, cards=cards_html,
+ total=len(findings),
+ high=counts["High"], med=counts["Medium"],
+ low=counts["Low"], info=counts["Information"]
+ )
+
+ # ─────────────────────────
+ # EXPORT: CSV (kept)
+ # ─────────────────────────
+ def exportFindings(self, event):
+ if self.findingsTableModel.getRowCount() == 0:
+ self.stdout.println("[EXPORT] No findings"); return
+ try:
+ from javax.swing import JFileChooser
+ from java.io import File
+ fc = JFileChooser()
+ fc.setSelectedFile(File("SILENTCHAIN_%s.csv" % time.strftime("%Y%m%d_%H%M%S")))
+ if fc.showSaveDialog(self.panel) != JFileChooser.APPROVE_OPTION: return
+ path = str(fc.getSelectedFile().getAbsolutePath())
+ with open(path, 'w') as f:
+ headers = [self.findingsTableModel.getColumnName(c)
+ for c in range(self.findingsTableModel.getColumnCount())]
+ f.write(','.join(['"'+h+'"' for h in headers]) + '\n')
+ for r in range(self.findingsTableModel.getRowCount()):
+ vals = ['"' + str(self.findingsTableModel.getValueAt(r, c)).replace('"','""') + '"'
+ for c in range(self.findingsTableModel.getColumnCount())]
+ f.write(','.join(vals) + '\n')
+ self.stdout.println("[EXPORT] CSV saved: %s" % path)
+ except Exception as e:
+ self.stderr.println("[!] CSV export failed: %s" % e)
+
+ # ─────────────────────────
+ # SCOPE MANAGEMENT
+ # ─────────────────────────
+ def load_scope(self):
+ """Load custom scope entries from file."""
+ try:
+ import os
+ if os.path.exists(self.scope_file):
+ with open(self.scope_file, 'r') as f:
+ data = json.load(f)
+ self.scope_entries = data.get("entries", [])
+ self.log_to_console("[SCOPE] Loaded %d custom scope entries" % len(self.scope_entries))
+ except Exception as e:
+ pass # Silently fail on first load
+
+ def save_scope(self):
+ """Save custom scope entries to file."""
+ try:
+ with self.scope_lock:
+ data = {"entries": self.scope_entries, "version": self.CONFIG_VERSION}
+ with open(self.scope_file, 'w') as f:
+ json.dump(data, f, indent=2)
+ self.stdout.println("[SCOPE] Saved %d entries" % len(self.scope_entries))
+ except Exception as e:
+ self.stderr.println("[!] Scope save error: %s" % e)
+
+ def openScopeManager(self, event):
+ """Open scope manager dialog to add/remove/manage targets."""
+ try:
+ from javax.swing import (JDialog, JTextField, JButton, JList, JScrollPane,
+ DefaultListModel, JPanel, JLabel, BoxLayout, Box)
+ from java.awt.event import ActionListener
+
+ dialog = JDialog()
+ dialog.setTitle("SILENTCHAIN - Scope Manager v%s" % self.VERSION)
+ dialog.setModal(True)
+ dialog.setSize(650, 500)
+ dialog.setLocationRelativeTo(None)
+ cp = dialog.getContentPane()
+ cp.setBackground(Theme.BG_DARK)
+ cp.setLayout(BoxLayout(cp, BoxLayout.Y_AXIS))
+
+ # Header
+ header = JLabel("Custom Target Scope Manager")
+ header.setFont(Theme.FONT_TITLE)
+ header.setForeground(Theme.ACCENT)
+ header.setBorder(EmptyBorder(12, 12, 8, 12))
+ cp.add(header)
+
+ # Instructions
+ instr = JLabel("Add domains/URLs to limit passive scanning. Burp's built-in scope is also checked.")
+ instr.setFont(Theme.FONT_MONO_L)
+ instr.setForeground(Theme.TEXT_MUTED)
+ instr.setBorder(EmptyBorder(0, 12, 12, 12))
+ cp.add(instr)
+
+ # Input panel
+ inputPanel = JPanel()
+ inputPanel.setBackground(Theme.BG_MID)
+ inputPanel.setLayout(BoxLayout(inputPanel, BoxLayout.X_AXIS))
+ inputPanel.setBorder(EmptyBorder(8, 12, 8, 12))
+
+ urlLabel = JLabel("URL:")
+ urlLabel.setFont(Theme.FONT_MONO_B)
+ urlLabel.setForeground(Theme.TEXT_PRIMARY)
+ urlLabel.setPreferredSize(Dimension(60, 28))
+ inputPanel.add(urlLabel)
+
+ urlField = JTextField()
+ urlField.setBackground(Theme.BG_DARKEST)
+ urlField.setForeground(Theme.TEXT_PRIMARY)
+ urlField.setCaretColor(Theme.TEXT_PRIMARY)
+ urlField.setFont(Theme.FONT_MONO)
+ urlField.setText("https://example.com")
+ inputPanel.add(urlField)
+
+ cp.add(inputPanel)
+
+ # Scope list
+ listLabel = JLabel("Scope Entries:")
+ listLabel.setFont(Theme.FONT_MONO_B)
+ listLabel.setForeground(Theme.TEXT_PRIMARY)
+ listLabel.setBorder(EmptyBorder(8, 12, 4, 12))
+ cp.add(listLabel)
+
+ listModel = DefaultListModel()
+ with self.scope_lock:
+ for entry in self.scope_entries:
+ enabled_str = "[ON]" if entry.get("enabled", True) else "[OFF]"
+ listModel.addElement("%s %s" % (enabled_str, entry.get("url", "")))
+
+ scopeList = JList(listModel)
+ scopeList.setBackground(Theme.BG_MID)
+ scopeList.setForeground(Theme.TEXT_PRIMARY)
+ scopeList.setFont(Theme.FONT_MONO_L)
+ scopeList.setSelectionBackground(Theme.BG_LIGHT)
+ scopeList.setSelectionForeground(Theme.TEXT_PRIMARY)
+
+ scrollPane = JScrollPane(scopeList)
+ scrollPane.setBackground(Theme.BG_DARK)
+ scrollPane.setBorder(EmptyBorder(4, 12, 8, 12))
+ scrollPane.setPreferredSize(Dimension(600, 250))
+ cp.add(scrollPane)
+
+ # Button panel
+ btnPanel = JPanel()
+ btnPanel.setBackground(Theme.BG_DARK)
+ btnPanel.setLayout(BoxLayout(btnPanel, BoxLayout.X_AXIS))
+ btnPanel.setBorder(EmptyBorder(8, 12, 12, 12))
+
+ extender_ref = self
+ dialog_ref = [dialog] # Mutable to close from handler
+
+ def refresh_list():
+ listModel.clear()
+ with extender_ref.scope_lock:
+ for entry in extender_ref.scope_entries:
+ enabled_str = "[ON]" if entry.get("enabled", True) else "[OFF]"
+ listModel.addElement("%s %s" % (enabled_str, entry.get("url", "")))
+
+ class AddHandler(ActionListener):
+ def actionPerformed(self, e):
+ url = urlField.getText().strip()
+ if not url:
+ return
+ if not url.startswith('http'):
+ url = 'https://' + url
+ with extender_ref.scope_lock:
+ # Check for duplicates
+ for entry in extender_ref.scope_entries:
+ if entry.get("url") == url:
+ return # Already exists
+ extender_ref.scope_entries.append({"url": url, "enabled": True})
+ extender_ref.save_scope()
+ refresh_list()
+ urlField.setText("")
+ extender_ref.log_to_console("[SCOPE] Added: %s" % url)
+
+ class RemoveHandler(ActionListener):
+ def actionPerformed(self, e):
+ idx = scopeList.getSelectedIndex()
+ if idx < 0:
+ return
+ with extender_ref.scope_lock:
+ if idx < len(extender_ref.scope_entries):
+ removed = extender_ref.scope_entries.pop(idx)
+ extender_ref.log_to_console("[SCOPE] Removed: %s" % removed.get("url"))
+ extender_ref.save_scope()
+ refresh_list()
+
+ class ToggleHandler(ActionListener):
+ def actionPerformed(self, e):
+ idx = scopeList.getSelectedIndex()
+ if idx < 0:
+ return
+ with extender_ref.scope_lock:
+ if idx < len(extender_ref.scope_entries):
+ entry = extender_ref.scope_entries[idx]
+ entry["enabled"] = not entry.get("enabled", True)
+ status = "Enabled" if entry["enabled"] else "Disabled"
+ extender_ref.log_to_console("[SCOPE] %s: %s" % (status, entry.get("url")))
+ extender_ref.save_scope()
+ refresh_list()
+
+ class ClearHandler(ActionListener):
+ def actionPerformed(self, e):
+ with extender_ref.scope_lock:
+ extender_ref.scope_entries = []
+ extender_ref.save_scope()
+ refresh_list()
+ extender_ref.log_to_console("[SCOPE] Cleared all entries")
+
+ class CloseHandler(ActionListener):
+ def actionPerformed(self, e):
+ dialog_ref[0].dispose()
+
+ addBtn = styled_btn("Add", Theme.CONF_CERTAIN, action=AddHandler())
+ removeBtn = styled_btn("Remove", Theme.SEV_HIGH, action=RemoveHandler())
+ toggleBtn = styled_btn("Toggle", Theme.SEV_MED, action=ToggleHandler())
+ clearBtn = styled_btn("Clear All", Color(0xFF, 0x17, 0x44), action=ClearHandler())
+ closeBtn = styled_btn("Close", Theme.BG_LIGHT, fg=Theme.TEXT_PRIMARY, action=CloseHandler())
+
+ for b in [addBtn, removeBtn, toggleBtn, clearBtn, Box.createHorizontalGlue(), closeBtn]:
+ btnPanel.add(b)
+
+ cp.add(btnPanel)
+ dialog.setVisible(True)
+
+ except Exception as e:
+ self.stderr.println("[!] Scope manager error: %s" % e)
+
+ # ─────────────────────────
+ # SETTINGS DIALOG
+ # ─────────────────────────
+ def openSettings(self, event):
+ from javax.swing import (JDialog, JTabbedPane, JTextField, JComboBox,
+ JPasswordField, JCheckBox)
+ dialog = JDialog()
+ dialog.setTitle("SILENTCHAIN Settings v%s" % self.VERSION)
+ dialog.setModal(True)
+ dialog.setSize(700, 580)
+ dialog.setLocationRelativeTo(None)
+ dialog.getContentPane().setBackground(Theme.BG_DARK)
+
+ tabs = JTabbedPane()
+ tabs.setBackground(Theme.BG_DARK)
+ tabs.setForeground(Theme.TEXT_PRIMARY)
+
+ # AI Provider tab
+ aiPanel = JPanel(GridBagLayout())
+ aiPanel.setBackground(Theme.BG_DARK)
+ gbc = GridBagConstraints()
+ gbc.insets = Insets(6, 8, 6, 8)
+ gbc.anchor = GridBagConstraints.WEST
+ gbc.fill = GridBagConstraints.HORIZONTAL
+
+ def add_row(panel, row, label_text, field):
+ gbc.gridx = 0; gbc.gridy = row; gbc.gridwidth = 1
+ lbl = JLabel(label_text)
+ lbl.setForeground(Theme.TEXT_MUTED)
+ lbl.setFont(Theme.FONT_MONO)
+ panel.add(lbl, gbc)
+ gbc.gridx = 1; gbc.gridwidth = 2
+ panel.add(field, gbc)
+ gbc.gridwidth = 1
+
+ providerCombo = JComboBox(["Ollama","OpenAI","Claude","Gemini","Azure Foundry"])
+ providerCombo.setSelectedItem(self.AI_PROVIDER)
+ apiUrlField = JTextField(self.API_URL, 30)
+ apiKeyField = JPasswordField(self.API_KEY, 30)
+ maxTokensField = JTextField(str(self.MAX_TOKENS), 10)
+
+ models_list = self.available_models if self.available_models else [self.MODEL]
+ modelCombo = JComboBox(models_list)
+ if self.MODEL in models_list: modelCombo.setSelectedItem(self.MODEL)
+
+ for fld in [apiUrlField, apiKeyField, maxTokensField]:
+ fld.setBackground(Theme.BG_MID)
+ fld.setForeground(Theme.TEXT_PRIMARY)
+ fld.setCaretColor(Theme.ACCENT)
+ fld.setFont(Theme.FONT_MONO)
+
+ from java.awt.event import ActionListener
+ class ProviderListener(ActionListener):
+ def __init__(self, f): self.f = f
+ def actionPerformed(self, e):
+ urls = {"Ollama":"http://localhost:11434","OpenAI":"https://api.openai.com/v1",
+ "Claude":"https://api.anthropic.com/v1",
+ "Gemini":"https://generativelanguage.googleapis.com/v1",
+ "Azure Foundry":"https://YOUR-RESOURCE.openai.azure.com"}
+ p = str(e.getSource().getSelectedItem())
+ if p in urls: self.f.setText(urls[p])
+ providerCombo.addActionListener(ProviderListener(apiUrlField))
+
+ add_row(aiPanel, 0, "AI Provider:", providerCombo)
+ add_row(aiPanel, 1, "API URL:", apiUrlField)
+ add_row(aiPanel, 2, "API Key:", apiKeyField)
+ add_row(aiPanel, 3, "Model:", modelCombo)
+ add_row(aiPanel, 4, "Max Tokens:", maxTokensField)
+
+ gbc.gridx=0; gbc.gridy=5; gbc.gridwidth=3
+ testBtn = styled_btn("Test Connection", Theme.ACCENT_DIM, Color.WHITE)
+ ext_ref = self
+ def do_test(e):
+ testBtn.setEnabled(False); testBtn.setText("Testing...")
+ old = (ext_ref.AI_PROVIDER, ext_ref.API_URL, ext_ref.API_KEY)
+ ext_ref.AI_PROVIDER = str(providerCombo.getSelectedItem())
+ ext_ref.API_URL = apiUrlField.getText()
+ ext_ref.API_KEY = "".join(apiKeyField.getPassword())
+ def run():
+ try:
+ if not ext_ref.test_ai_connection():
+ ext_ref.AI_PROVIDER, ext_ref.API_URL, ext_ref.API_KEY = old
+ finally:
+ SwingUtilities.invokeLater(lambda: (testBtn.setEnabled(True), testBtn.setText("Test Connection")))
+ threading.Thread(target=run, daemon=True).start()
+ testBtn.addActionListener(do_test)
+ aiPanel.add(testBtn, gbc)
+ tabs.addTab("AI Provider", aiPanel)
+
+ # Advanced tab
+ advPanel = JPanel(GridBagLayout())
+ advPanel.setBackground(Theme.BG_DARK)
+ gbc2 = GridBagConstraints()
+ gbc2.insets = Insets(6,8,6,8); gbc2.anchor=GridBagConstraints.WEST
+ gbc2.fill = GridBagConstraints.HORIZONTAL
+
+ passiveChk = JCheckBox("Enable passive scanning", self.PASSIVE_SCANNING_ENABLED)
+ verboseChk = JCheckBox("Verbose logging", self.VERBOSE)
+ timeoutFld = JTextField(str(self.AI_REQUEST_TIMEOUT), 10)
+
+ for w in [passiveChk, verboseChk]:
+ w.setBackground(Theme.BG_DARK); w.setForeground(Theme.TEXT_PRIMARY)
+ w.setFont(Theme.FONT_MONO)
+ timeoutFld.setBackground(Theme.BG_MID); timeoutFld.setForeground(Theme.TEXT_PRIMARY)
+ timeoutFld.setFont(Theme.FONT_MONO)
+
+ rows_adv = [(0,"Passive Scan:", passiveChk),(1,"Verbose:", verboseChk),(2,"Timeout (s):", timeoutFld)]
+ for r, lbl_txt, widget in rows_adv:
+ gbc2.gridx=0; gbc2.gridy=r; gbc2.gridwidth=1
+ l = JLabel(lbl_txt); l.setForeground(Theme.TEXT_MUTED); l.setFont(Theme.FONT_MONO)
+ advPanel.add(l, gbc2)
+ gbc2.gridx=1; gbc2.gridwidth=2; advPanel.add(widget, gbc2); gbc2.gridwidth=1
+
+ tabs.addTab("Advanced", advPanel)
+
+ # Save / Cancel
+ btnRow = JPanel(FlowLayout(FlowLayout.RIGHT, 8, 8))
+ btnRow.setBackground(Theme.BG_MID)
+ saveBtn = styled_btn("Save", Theme.CONF_CERTAIN)
+ cancelBtn = styled_btn("Cancel", Theme.BG_LIGHT, fg=Theme.TEXT_MUTED)
+
+ def do_save(e):
+ self.AI_PROVIDER = str(providerCombo.getSelectedItem())
+ self.API_URL = apiUrlField.getText()
+ self.API_KEY = "".join(apiKeyField.getPassword())
+ self.MODEL = str(modelCombo.getSelectedItem())
+ try: self.MAX_TOKENS = max(512, int(maxTokensField.getText()))
+ except: self.MAX_TOKENS = 3072
+ self.PASSIVE_SCANNING_ENABLED = passiveChk.isSelected()
+ self.VERBOSE = verboseChk.isSelected()
+ try:
+ t = int(timeoutFld.getText())
+ self.AI_REQUEST_TIMEOUT = max(10, min(99999, t))
+ except: self.AI_REQUEST_TIMEOUT = 60
+ self._sync_scanning_button()
+ self.save_config()
+ self.refreshUI()
+ dialog.dispose()
+
+ saveBtn.addActionListener(do_save)
+ cancelBtn.addActionListener(lambda e: dialog.dispose())
+ btnRow.add(saveBtn); btnRow.add(cancelBtn)
+
+ from javax.swing import JPanel as JP
+ wrapper = JP(BorderLayout())
+ wrapper.setBackground(Theme.BG_DARK)
+ wrapper.add(tabs, BorderLayout.CENTER)
+ wrapper.add(btnRow, BorderLayout.SOUTH)
+ dialog.add(wrapper)
+ dialog.setVisible(True)
+
+ # ─────────────────────────
+ # CONFIG I/O
+ # ─────────────────────────
+ def load_config(self):
+ try:
+ import os
+ if not os.path.exists(self.config_file): return
+ with open(self.config_file, 'r') as f:
+ cfg = json.load(f)
+ self.AI_PROVIDER = cfg.get("ai_provider", self.AI_PROVIDER)
+ self.API_URL = cfg.get("api_url", self.API_URL)
+ self.API_KEY = cfg.get("api_key", self.API_KEY)
+ self.MODEL = cfg.get("model", self.MODEL)
+ self.MAX_TOKENS = cfg.get("max_tokens", self.MAX_TOKENS)
+ self.AI_REQUEST_TIMEOUT = cfg.get("ai_request_timeout", self.AI_REQUEST_TIMEOUT)
+ self.VERBOSE = cfg.get("verbose", self.VERBOSE)
+ self.PASSIVE_SCANNING_ENABLED = cfg.get("passive_scanning_enabled", self.PASSIVE_SCANNING_ENABLED)
+ self.AZURE_API_VERSION = cfg.get("azure_api_version", self.AZURE_API_VERSION)
+ except Exception as e:
+ pass # stdout not ready yet
+
+ def save_config(self):
+ try:
+ cfg = {
+ "config_version": self.CONFIG_VERSION,
+ "ai_provider": self.AI_PROVIDER, "api_url": self.API_URL,
+ "api_key": self.API_KEY, "model": self.MODEL,
+ "max_tokens": self.MAX_TOKENS, "ai_request_timeout": self.AI_REQUEST_TIMEOUT,
+ "verbose": self.VERBOSE, "passive_scanning_enabled": self.PASSIVE_SCANNING_ENABLED,
+ "azure_api_version": self.AZURE_API_VERSION,
+ "version": self.VERSION, "last_saved": datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ }
+ with open(self.config_file, 'w') as f:
+ json.dump(cfg, f, indent=2)
+ return True
+ except Exception as e:
+ self.stderr.println("[!] Save config failed: %s" % e)
+ return False
+
+ def apply_environment_config(self):
+ try:
+ import os
+ az_ep = os.environ.get("AZURE_OPENAI_ENDPOINT","").strip()
+ az_key = os.environ.get("AZURE_OPENAI_API_KEY","").strip()
+ az_dep = os.environ.get("AZURE_OPENAI_DEPLOYMENT","").strip()
+ az_ver = os.environ.get("OPENAI_API_VERSION","").strip()
+ if az_ver: self.AZURE_API_VERSION = az_ver
+ if az_ep and az_key and (self.AI_PROVIDER == "Ollama" or not self.API_KEY):
+ self.AI_PROVIDER = "Azure Foundry"
+ self.API_URL = az_ep; self.API_KEY = az_key
+ if az_dep: self.MODEL = az_dep
+ except: pass
+
+ def _load_dotenv_values(self):
+ values = {}
+ try:
+ import os
+ paths = [os.path.join(os.getcwd(), ".env"),
+ os.path.join(os.path.expanduser("~"), ".silentchain.env")]
+ for p in paths:
+ if p and os.path.isfile(p):
+ with open(p,'r') as f:
+ for line in f:
+ line = line.strip()
+ if not line or line.startswith('#') or '=' not in line: continue
+ k, v = line.split('=', 1)
+ k = k.strip().lstrip("export").strip()
+ v = v.strip().strip('"').strip("'")
+ if k: values[k] = v
+ break
+ except: pass
+ return values
+
+ # ─────────────────────────
+ # CACHE I/O
+ # ─────────────────────────
+ def load_vuln_cache(self):
+ try:
+ import os
+ if not os.path.exists(self.vuln_cache_file): return
+ with open(self.vuln_cache_file, 'r') as f:
+ payload = json.load(f)
+ entries = payload.get("entries", {}) if isinstance(payload, dict) else {}
+ with self.vuln_cache_lock:
+ self.vuln_cache = entries if isinstance(entries, dict) else {}
+ self.stdout.println("[CACHE] Loaded %d entries" % len(self.vuln_cache))
+ self._ui_dirty = True
+ except Exception as e:
+ self.stderr.println("[!] Cache load failed: %s" % e)
+
+ def save_vuln_cache(self):
+ try:
+ with self.vuln_cache_lock:
+ snap = dict(self.vuln_cache)
+ with open(self.vuln_cache_file, 'w') as f:
+ json.dump({"version": self.VERSION,
+ "last_updated": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "entries": snap}, f, indent=2)
+ return True
+ except Exception as e:
+ self.stderr.println("[!] Cache save failed: %s" % e)
+ return False
+
+ def _async_save_cache(self):
+ if not self._cache_dirty: return
+ self._cache_dirty = False
+ def run():
+ try: self.save_vuln_cache()
+ except: self._cache_dirty = True
+ t = threading.Thread(target=run); t.setDaemon(True); t.start()
+
+ # ─────────────────────────
+ # CACHE KEY / LOOKUP
+ # ─────────────────────────
+ def _get_request_signature(self, data):
+ req_hdrs = [str(h).split(':',1)[0].strip().lower() for h in data.get("request_headers",[])[:10]]
+ res_hdrs = [str(h).split(':',1)[0].strip().lower() for h in data.get("response_headers",[])[:10]]
+ auth_present = any(h.lower().startswith(('authorization:','cookie:','x-api-key:'))
+ for h in data.get("request_headers",[]))
+ auth_len = sum(len(h) for h in data.get("request_headers",[])
+ if h.lower().startswith(('authorization:','cookie:','x-api-key:')))
+ sig = {"provider": self.AI_PROVIDER, "model": self.MODEL,
+ "method": data.get("method",""), "url": str(data.get("url","")).split('?',1)[0],
+ "status": data.get("status",0), "mime_type": data.get("mime_type",""),
+ "param_names": sorted([p.get("name","") for p in data.get("params_sample",[]) if p.get("name")]),
+ "req_headers": sorted(req_hdrs), "res_headers": sorted(res_hdrs),
+ "auth_present": auth_present, "auth_len": auth_len}
+ return hashlib.sha256(json.dumps(sig, sort_keys=True).encode('utf-8')).hexdigest()[:32]
+
+ def _get_cached_findings(self, sig):
+ with self.vuln_cache_lock:
+ entry = self.vuln_cache.get(sig)
+ if not entry: return None
+ entry["last_seen"] = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ entry["hit_count"] = int(entry.get("hit_count",0)) + 1
+ findings = entry.get("findings", [])
+ self._cache_dirty = True
+ return findings if isinstance(findings, list) else []
+
+ def _store_cached_findings(self, sig, url, findings):
+ if isinstance(findings, dict): findings = [findings]
+ normalized = [f for f in findings if isinstance(f, dict)]
+ if not normalized: return
+ with self.vuln_cache_lock:
+ self.vuln_cache[sig] = {
+ "url": str(url).split('?',1)[0],
+ "updated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "hit_count": 0, "findings": normalized
+ }
+ self._cache_dirty = True
+ self._ui_dirty = True
+
+ # ─────────────────────────
+ # HASHING
+ # ─────────────────────────
+ def _get_url_hash(self, url, params):
+ param_names = sorted([p.getName() for p in params])
+ raw = str(url).split('?')[0] + '|' + '|'.join(param_names)
+ return hashlib.sha256(raw.encode('utf-8')).hexdigest()[:32]
+
+ def _get_finding_hash(self, url, title, cwe, param_name=""):
+ raw = "%s|%s|%s|%s" % (str(url).split('?')[0], title.lower().strip(), cwe, param_name)
+ return hashlib.sha256(raw.encode('utf-8')).hexdigest()[:32]
+
+ # ─────────────────────────
+ # TASK TRACKING
+ # ─────────────────────────
+ def addTask(self, task_type, url, status="Queued", messageInfo=None):
+ with self.tasks_lock:
+ task = {"timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "type": task_type, "url": url, "status": status,
+ "start_time": time.time(), "messageInfo": messageInfo}
+ self.tasks.append(task)
+ with self.stats_lock: self.stats["total_requests"] += 1
+ self._ui_dirty = True
+ return len(self.tasks) - 1
+
+ def updateTask(self, task_id, status, error=None):
+ with self.tasks_lock:
+ if task_id < len(self.tasks):
+ self.tasks[task_id]["status"] = status
+ self.tasks[task_id]["end_time"] = time.time()
+ if error: self.tasks[task_id]["error"] = error
+ self._ui_dirty = True
+
+ def updateStats(self, key, n=1):
+ with self.stats_lock:
+ self.stats[key] = self.stats.get(key, 0) + n
+ self._ui_dirty = True
+
+ def log_to_console(self, msg):
+ with self.console_lock:
+ ts = datetime.now().strftime("%H:%M:%S")
+ s = str(msg)
+ if len(s) > 160: s = s[:157] + "..."
+ self.console_messages.append("[%s] %s" % (ts, s))
+ if len(self.console_messages) > self.max_console_messages:
+ self.console_messages = self.console_messages[-self.max_console_messages:]
+ self._ui_dirty = True
+
+ def add_finding(self, finding_dict):
+ """Store full rich finding dict (includes exploit/poc fields)."""
+ with self.findings_lock_ui:
+ self.findings_list.append(finding_dict)
+ self._ui_dirty = True
+
+ # ─────────────────────────
+ # BURP INTERFACE
+ # ─────────────────────────
+ def getTabCaption(self): return "SILENTCHAIN"
+ def getUiComponent(self): return self.panel
+
+ def createMenuItems(self, invocation):
+ ctx = invocation.getInvocationContext()
+ allowed = [invocation.CONTEXT_MESSAGE_EDITOR_REQUEST,
+ invocation.CONTEXT_MESSAGE_VIEWER_REQUEST,
+ invocation.CONTEXT_PROXY_HISTORY,
+ invocation.CONTEXT_TARGET_SITE_MAP_TABLE,
+ invocation.CONTEXT_TARGET_SITE_MAP_TREE]
+ if ctx not in allowed: return None
+ msgs = invocation.getSelectedMessages()
+ if not msgs or len(msgs) == 0: return None
+ menu_list = ArrayList()
+ item = JMenuItem("SILENTCHAIN: Analyze Request")
+ item.setForeground(Theme.ACCENT)
+ item.addActionListener(lambda x: self.analyzeFromContextMenu(msgs))
+ menu_list.add(item)
+ return menu_list
+
+ def analyzeFromContextMenu(self, messages):
+ t = threading.Thread(target=self._contextMenuThread, args=(messages,))
+ t.setDaemon(True); t.start()
+
+ def _contextMenuThread(self, messages):
+ seen = set()
+ for message in messages:
+ try:
+ req = self.helpers.analyzeRequest(message)
+ url_str = str(req.getUrl())
+ rb = message.getRequest()
+ key = "%s|%s" % (url_str, hashlib.sha256(bytes(rb.tostring())).hexdigest()[:8] if rb else "")
+ now = time.time()
+ with self.context_menu_lock:
+ if now - self.context_menu_last_invoke.get(key, 0) < self.context_menu_debounce_time:
+ continue
+ self.context_menu_last_invoke[key] = now
+ if key in seen: continue
+ seen.add(key)
+
+ if message.getResponse() is None:
+ resp = self.callbacks.makeHttpRequest(message.getHttpService(), rb)
+ if resp is None or resp.getResponse() is None: continue
+ message = resp
+
+ task_id = self.addTask("CONTEXT", url_str, "Queued", message)
+ self.thread_pool.submit(AnalyzeTask(self, message, url_str, task_id, forced=True))
+ except Exception as e:
+ self.stderr.println("[!] Context menu error: %s" % e)
+
+ def doPassiveScan(self, baseRequestResponse):
+ if not self.PASSIVE_SCANNING_ENABLED: return None
+ try:
+ req = self.helpers.analyzeRequest(baseRequestResponse)
+ url_str = str(req.getUrl())
+ if not self.is_in_scope(url_str): return None
+ if self.should_skip_extension(url_str): return None
+ except: url_str = "Unknown"
+ task_id = self.addTask("PASSIVE", url_str, "Queued", baseRequestResponse)
+ self.thread_pool.submit(AnalyzeTask(self, baseRequestResponse, url_str, task_id))
+ return None
+
+ def doActiveScan(self, brr, ip): return []
+ def consolidateDuplicateIssues(self, a, b): return 0
+
+ def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
+ if messageIsRequest or not self.PASSIVE_SCANNING_ENABLED: return
+ if toolFlag != 4: return # TOOL_PROXY = 4
+ try:
+ req = self.helpers.analyzeRequest(messageInfo)
+ url_str = str(req.getUrl())
+ if not self.is_in_scope(url_str): return
+ if self.should_skip_extension(url_str): return
+ except: url_str = "Unknown"
+ task_id = self.addTask("HTTP", url_str, "Queued", messageInfo)
+ self.thread_pool.submit(AnalyzeTask(self, messageInfo, url_str, task_id))
+
+ def is_in_scope(self, url):
+ """Check if URL is in Burp scope OR custom scope entries."""
+ try:
+ # Check Burp's built-in scope first
+ from java.net import URL as JavaURL
+ if self.callbacks.isInScope(JavaURL(url)):
+ return True
+ except:
+ pass
+ # Check custom scope entries
+ try:
+ url_base = url.split('?')[0].rstrip('/')
+ with self.scope_lock:
+ for entry in self.scope_entries:
+ if not entry.get("enabled", True):
+ continue
+ scope_url = entry.get("url", "").rstrip('/')
+ if url.startswith(scope_url) or url_base == scope_url:
+ return True
+ except:
+ pass
+ return False
+
+ def should_skip_extension(self, url):
+ try:
+ path = url.split('?')[0].lower()
+ fname = path.split('/')[-1] if '/' in path else path
+ if '.' in fname:
+ ext = fname.split('.')[-1]
+ if ext in self.SKIP_EXTENSIONS: return True
+ except: pass
+ return False
+
+ # ─────────────────────────
+ # ANALYSIS ENGINE
+ # ─────────────────────────
+ def analyze(self, messageInfo, url_str=None, task_id=None):
+ host = self._host_from_url(url_str or "unknown")
+ host_sem = self.get_host_semaphore(host)
+ host_sem.acquire()
+ try:
+ self.global_semaphore.acquire()
+ try:
+ self._rate_limit(task_id, "Waiting (Rate Limit)")
+ if task_id is not None: self.updateTask(task_id, "Analyzing")
+ self._perform_analysis(messageInfo, "HTTP", url_str, task_id)
+ if task_id is not None: self.updateTask(task_id, "Completed")
+ except Exception as e:
+ self.stderr.println("[!] Analysis error: %s" % e)
+ if task_id is not None: self.updateTask(task_id, "Error: %s" % str(e)[:30])
+ self.updateStats("errors")
+ finally:
+ self.global_semaphore.release()
+ self.refreshUI()
+ finally:
+ host_sem.release()
+
+ def analyze_forced(self, messageInfo, url_str=None, task_id=None):
+ host = self._host_from_url(url_str or "unknown")
+ host_sem = self.get_host_semaphore(host)
+ host_sem.acquire()
+ try:
+ self.global_semaphore.acquire()
+ try:
+ self._rate_limit(task_id, "Waiting (Rate Limit)")
+ if task_id is not None: self.updateTask(task_id, "Analyzing (Forced)")
+ self._perform_analysis(messageInfo, "CONTEXT", url_str, task_id, bypass_dedup=True)
+ if task_id is not None: self.updateTask(task_id, "Completed")
+ except Exception as e:
+ self.stderr.println("[!] Forced analysis error: %s" % e)
+ if task_id is not None: self.updateTask(task_id, "Error: %s" % str(e)[:30])
+ self.updateStats("errors")
+ finally:
+ self.global_semaphore.release()
+ self.refreshUI()
+ finally:
+ host_sem.release()
+
+ def _rate_limit(self, task_id, status_msg):
+ wait = self.min_delay - (time.time() - self.last_request_time)
+ if wait > 0:
+ if task_id is not None: self.updateTask(task_id, status_msg)
+ time.sleep(wait)
+ self.last_request_time = time.time()
+
+ def get_host_semaphore(self, host):
+ with self.host_semaphore_lock:
+ if host not in self.host_semaphores:
+ self.host_semaphores[host] = threading.Semaphore(2)
+ return self.host_semaphores[host]
+
+ def _host_from_url(self, url_str):
+ try:
+ import re
+ m = re.match(r'https?://([^:/]+)', str(url_str))
+ return m.group(1) if m else "unknown"
+ except: return "unknown"
+
+ def _perform_analysis(self, messageInfo, source, url_str=None, task_id=None, bypass_dedup=False):
+ try:
+ req = self.helpers.analyzeRequest(messageInfo)
+ res = self.helpers.analyzeResponse(messageInfo.getResponse())
+ url = str(req.getUrl())
+ if not url_str: url_str = url
+
+ params = req.getParameters()
+ url_hash = self._get_url_hash(url, params)
+
+ if not bypass_dedup:
+ with self.url_lock:
+ if url_hash in self.processed_urls:
+ if task_id is not None: self.updateTask(task_id, "Skipped (Duplicate)")
+ self.updateStats("skipped_duplicate")
+ return
+ self.processed_urls.add(url_hash)
+
+ req_bytes = messageInfo.getRequest()
+ req_body = ""
+ try: req_body = self.helpers.bytesToString(req_bytes[req.getBodyOffset():])[:2000]
+ except: req_body = "[binary]"
+
+ req_hdrs = [str(h) for h in req.getHeaders()[:10]]
+
+ res_bytes = messageInfo.getResponse()
+ res_body = ""
+ try:
+ raw = self.helpers.bytesToString(res_bytes[res.getBodyOffset():])
+ res_body = self.smart_truncate(raw)
+ except: res_body = "[binary]"
+
+ res_hdrs = [str(h) for h in res.getHeaders()[:10]]
+ params_sample = [{"name": p.getName(), "value": p.getValue()[:150],
+ "type": str(p.getType())} for p in params[:5]]
+ idor_signals = self.extract_idor_signals(params_sample, url)
+
+ data = {"url": url, "method": req.getMethod(), "status": res.getStatusCode(),
+ "mime_type": res.getStatedMimeType(), "params_count": len(params),
+ "params_sample": params_sample, "request_headers": req_hdrs,
+ "request_body": req_body, "response_headers": res_hdrs,
+ "response_body": res_body, "idor_signals": idor_signals}
+
+ sig = self._get_request_signature(data)
+ cached = None if bypass_dedup else self._get_cached_findings(sig)
+
+ if cached is not None:
+ findings = cached
+ self.updateStats("cached_reused")
+ self.updateStats("analyzed")
+ self.log_to_console("[%s] CACHE HIT %s (%d findings)" % (source, url_str[:60], len(findings)))
+ else:
+ ai_text = self.ask_ai(self.build_prompt(data))
+ if not ai_text:
+ if task_id is not None: self.updateTask(task_id, "Error (No AI response)")
+ self.updateStats("errors"); return
+
+ self.updateStats("analyzed")
+ findings = self._parse_ai_response(ai_text)
+ if not findings:
+ if task_id is not None: self.updateTask(task_id, "Error (JSON parse)")
+ self.updateStats("errors"); return
+
+ self._store_cached_findings(sig, url, findings)
+
+ if not isinstance(findings, list): findings = [findings]
+
+ created = 0
+ for item in findings:
+ if not isinstance(item, dict): continue
+ title = item.get("title", "AI Finding")
+ severity = VALID_SEVERITIES.get(item.get("severity","information").lower().strip(), "Information")
+ ai_conf = item.get("confidence", 50)
+ try: ai_conf = int(ai_conf)
+ except: ai_conf = 50
+ cwe = item.get("cwe","")
+ burp_conf = map_confidence(ai_conf)
+ if not burp_conf:
+ self.updateStats("skipped_low_confidence"); continue
+
+ param_name = params_sample[0].get("name","") if params_sample else ""
+ fhash = self._get_finding_hash(url, title, cwe, param_name)
+ with self.findings_lock:
+ if fhash in self.findings_cache:
+ self.updateStats("skipped_duplicate"); continue
+ self.findings_cache[fhash] = True
+
+ # Build rich finding dict — this powers the detail panel
+ rich_finding = {
+ "discovered_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "url": url,
+ "title": title,
+ "severity": severity,
+ "confidence": burp_conf,
+ "detail": item.get("detail",""),
+ "cwe": cwe,
+ "owasp": item.get("owasp",""),
+ "remediation": item.get("remediation",""),
+ "evidence": item.get("evidence",""),
+ "param": item.get("param",""),
+ "affected_params": item.get("affected_params", []),
+ "exploit_path": item.get("exploit_path",""),
+ "exploit_steps": item.get("exploit_steps", []),
+ "poc_template": item.get("poc_template",""),
+ "poc_curl": item.get("poc_curl",""),
+ "poc_python": item.get("poc_python",""),
+ "business_impact": item.get("business_impact",""),
+ "cvss_score": item.get("cvss_score",""),
+ "references": item.get("references", []),
+ }
+ self.add_finding(rich_finding)
+
+ # Also add to Burp scanner
+ detail_html = self._build_burp_detail(rich_finding, params_sample)
+ issue = CustomScanIssue(messageInfo.getHttpService(), req.getUrl(),
+ [messageInfo], title, detail_html, severity, burp_conf)
+ self.callbacks.addScanIssue(issue)
+ self.updateStats("findings_created")
+ created += 1
+
+ self.log_to_console("[%s] %s → %d finding(s)" % (source, url_str[:60], created))
+ except Exception as e:
+ self.stderr.println("[!] _perform_analysis error: %s" % e)
+ self.updateStats("errors")
+
+ def _build_burp_detail(self, f, params_sample):
+ """Build HTML detail string for Burp's Issues panel."""
+ parts = ["Description: AI Confidence: %d%%" % f.get("ai_conf", 50))
+ if f.get("evidence"):
+ parts.append("Evidence: %s" % f["evidence"][:500])
+ if f.get("exploit_path"):
+ parts.append("Exploitation: %s " % s for s in f["exploit_steps"])
+ parts.append("%s " % steps)
+ if f.get("poc_curl"):
+ parts.append("PoC (curl): %s " % f["poc_curl"][:800])
+ if f.get("remediation"):
+ parts.append("Remediation: CWE: %s " % (cid, f["cwe"]))
+ if f.get("owasp"):
+ parts.append("OWASP: %s" % f["owasp"])
+ return "".join(parts)
+
+ # ─────────────────────────
+ # PROMPT (expanded for exploitation + PoC)
+ # ─────────────────────────
+ def build_prompt(self, data):
+ return (
+ "You are a senior penetration tester. Output ONLY a JSON array. NO markdown, NO text outside JSON.\n\n"
+ "Analyze the HTTP request/response below for ALL of:\n"
+ "1. OWASP Top 10 (2021) — SQLi, XSS, Broken Auth, etc.\n"
+ "2. IDOR / BOLA — numeric/UUID IDs in params, sequential IDs in paths\n"
+ "3. Mass Assignment — unexpected POST params not validated server-side\n"
+ "4. SSRF — URL/redirect/webhook params pointing to internal resources\n"
+ "5. JWT weaknesses — alg:none, HS256 weak secret, missing validation\n"
+ "6. GraphQL — introspection, batch abuse, __schema in body\n"
+ "7. OAuth/OIDC misconfigs — open redirect_uri, missing state, token leak\n"
+ "8. HTTP Request Smuggling — TE+CL conflicts, chunked encoding abuse\n"
+ "9. Cache Poisoning — X-Forwarded-Host, X-Original-URL, fat GET\n"
+ "10. Business Logic — price/qty tampering, role param, discount abuse\n"
+ "11. Information Disclosure — stack traces, secrets, internal IPs\n"
+ "12. Prototype Pollution — __proto__, constructor.prototype in JSON\n"
+ "13. Missing Security Headers — CSP, HSTS, X-Frame-Options absent\n"
+ "14. API Versioning — v1 vs v2 access control gaps\n\n"
+ "For each finding with confidence >= 50, output a JSON object with ALL fields:\n"
+ "{\n"
+ " \"title\": \"short vuln name\",\n"
+ " \"severity\": \"High|Medium|Low|Information\",\n"
+ " \"confidence\": 50-100,\n"
+ " \"detail\": \"technical description of the vulnerability\",\n"
+ " \"cwe\": \"CWE-XXX\",\n"
+ " \"owasp\": \"AXX:2021 Name\",\n"
+ " \"cvss_score\": \"7.5\",\n"
+ " \"param\": \"vulnerable_parameter_name\",\n"
+ " \"affected_params\": [\"param1\", \"param2\"],\n"
+ " \"evidence\": \"exact snippet from request/response proving the issue\",\n"
+ " \"exploit_path\": \"one-paragraph description of how an attacker exploits this\",\n"
+ " \"exploit_steps\": [\n"
+ " \"Step 1: Intercept the request to /api/users/123\",\n"
+ " \"Step 2: Change the numeric ID to another user's ID\",\n"
+ " \"Step 3: Observe the server returns another user's data\"\n"
+ " ],\n"
+ " \"poc_curl\": \"curl -X GET 'https://target.com/api/users/124' -H 'Authorization: Bearer '\",\n"
+ " \"poc_python\": \"import requests\\nrequests.get('https://target.com/api/users/124', headers={'Authorization': 'Bearer TOKEN'})\",\n"
+ " \"poc_template\": \"burp-style request with [INJECT] marker\",\n"
+ " \"business_impact\": \"what an attacker can achieve if exploited\",\n"
+ " \"remediation\": \"specific fix with code example if possible\",\n"
+ " \"references\": [\"https://owasp.org/...\", \"https://portswigger.net/...\"]\n"
+ "}\n\n"
+ "Rules:\n"
+ "- Output [] if no issues found with confidence >= 50\n"
+ "- Do NOT fabricate evidence — only report what is visible in the data\n"
+ "- exploit_steps must be concrete and actionable, not generic\n"
+ "- poc_curl must be a real runnable command using values from the request\n\n"
+ "HTTP Data:\n%s\n"
+ ) % json.dumps(data, indent=2)
+
+ # ─────────────────────────
+ # AI RESPONSE PARSING
+ # ─────────────────────────
+ def _parse_ai_response(self, ai_text):
+ ai_text = ai_text.strip()
+ import re
+ if ai_text.startswith("```"):
+ ai_text = re.sub(r'^```(?:json)?\n?|```$', '', ai_text, flags=re.MULTILINE).strip()
+ # Strip ... tags (DeepSeek)
+ ai_text = re.sub(r'.*? ', '', ai_text, flags=re.DOTALL).strip()
+
+ start = ai_text.find('[')
+ end = ai_text.rfind(']')
+ if start != -1 and end != -1:
+ try:
+ r = json.loads(ai_text[start:end+1])
+ return r if isinstance(r, list) else [r]
+ except: pass
+
+ obj_s = ai_text.find('{')
+ obj_e = ai_text.rfind('}')
+ if obj_s != -1 and obj_e != -1:
+ try:
+ r = json.loads('[' + ai_text[obj_s:obj_e+1] + ']')
+ return r if isinstance(r, list) else [r]
+ except: pass
+
+ return self._repair_json(ai_text)
+
+ def _repair_json(self, text):
+ try:
+ import re
+ text = re.sub(r',(\s*[}\]])', r'\1', text)
+ text = text.strip()
+ if not text.startswith('['):
+ s = text.find('{')
+ if s != -1: text = '[' + text[s:]
+ if not text.endswith(']'):
+ e = text.rfind('}')
+ if e != -1: text = text[:e+1] + ']'
+ return json.loads(text)
+ except:
+ return []
+
+ # ─────────────────────────
+ # AI PROVIDERS
+ # ─────────────────────────
+ def ask_ai(self, prompt):
+ try:
+ return {
+ "Ollama": self._ask_ollama,
+ "OpenAI": self._ask_openai,
+ "Claude": self._ask_claude,
+ "Gemini": self._ask_gemini,
+ "Azure Foundry":self._ask_azure_foundry,
+ }[self.AI_PROVIDER](prompt)
+ except KeyError:
+ self.stderr.println("[!] Unknown provider: %s" % self.AI_PROVIDER)
+ except Exception as e:
+ self.stderr.println("[!] AI error: %s" % e)
+ return None
+
+ def _ask_ollama(self, prompt):
+ url = self.API_URL.rstrip('/') + "/api/generate"
+ payload = {"model": self.MODEL, "prompt": prompt, "stream": False,
+ "format": "json", "options": {"temperature": 0.0, "num_predict": self.MAX_TOKENS}}
+ for attempt in range(3):
+ try:
+ req = urllib2.Request(url, data=json.dumps(payload).encode("utf-8"),
+ headers={"Content-Type": "application/json"})
+ resp = urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT)
+ data = json.loads(resp.read().decode("utf-8","ignore"))
+ text = data.get("response","").strip()
+ if data.get("done_reason") == "length":
+ text = self._fix_truncated(text)
+ return text
+ except urllib2.URLError as e:
+ if attempt < 2 and ("timed out" in str(e) or "timeout" in str(e).lower()):
+ self.stderr.println("[!] Timeout, retry %d/2" % (attempt+1)); time.sleep(2)
+ else: raise
+ return None
+
+ def _ask_openai(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/chat/completions",
+ data=json.dumps({"model": self.MODEL, "max_tokens": self.MAX_TOKENS, "temperature": 0.0,
+ "messages": [{"role":"user","content": prompt}]}).encode("utf-8"),
+ headers={"Content-Type":"application/json","Authorization":"Bearer "+self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["choices"][0]["message"]["content"]
+
+ def _ask_claude(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({"model": self.MODEL, "max_tokens": self.MAX_TOKENS,
+ "messages": [{"role":"user","content": prompt}]}).encode("utf-8"),
+ headers={"Content-Type":"application/json","x-api-key": self.API_KEY,
+ "anthropic-version":"2023-06-01"})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["content"][0]["text"]
+
+ def _ask_gemini(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/models/%s:generateContent?key=%s" % (self.MODEL, self.API_KEY),
+ data=json.dumps({"contents":[{"parts":[{"text":prompt}]}],
+ "generationConfig":{"maxOutputTokens":self.MAX_TOKENS,"temperature":0.0}
+ }).encode("utf-8"),
+ headers={"Content-Type":"application/json"})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["candidates"][0]["content"]["parts"][0]["text"]
+
+ def _ask_azure_foundry(self, prompt):
+ if not self.API_KEY or not self.API_URL: raise Exception("Azure config incomplete")
+ base = self.API_URL.split('?',1)[0].rstrip('/')
+ chat_url = self._build_azure_url(base)
+ if "api-version=" not in chat_url:
+ sep = '&' if '?' in chat_url else '?'
+ chat_url += sep + "api-version=" + (self.AZURE_API_VERSION or "2024-06-01")
+ req = urllib2.Request(chat_url,
+ data=json.dumps({"messages":[{"role":"user","content":prompt}],
+ "max_tokens":self.MAX_TOKENS,"temperature":0.0}).encode("utf-8"),
+ headers={"Content-Type":"application/json","api-key":self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["choices"][0]["message"]["content"]
+
+ def _build_azure_url(self, base):
+ if "/chat/completions" in base: return base
+ if "/openai/deployments/" in base: return base + "/chat/completions"
+ if not self.MODEL: raise Exception("Azure deployment name required in Model field")
+ return "%s/openai/deployments/%s/chat/completions" % (base, urllib.quote(self.MODEL, safe=''))
+
+ def _fix_truncated(self, text):
+ if not text: return "[]"
+ try: json.loads(text); return text
+ except: pass
+ e = text.rfind('}')
+ if e > 0:
+ p = text[:e+1]
+ if p.count('[') > p.count(']'):
+ try: json.loads(p+']'); return p+']'
+ except: pass
+ return "[]"
+
+ # ─────────────────────────
+ # CONNECTION TESTS
+ # ─────────────────────────
+ def test_ai_connection(self):
+ self.stdout.println("[CONN] Testing %s @ %s" % (self.AI_PROVIDER, self.API_URL))
+ try:
+ return {
+ "Ollama": self._test_ollama, "OpenAI": self._test_openai,
+ "Claude": self._test_claude, "Gemini": self._test_gemini,
+ "Azure Foundry": self._test_azure,
+ }[self.AI_PROVIDER]()
+ except KeyError:
+ self.stderr.println("[!] Unknown provider"); return False
+ except Exception as e:
+ self.stderr.println("[!] Connection failed: %s" % e); return False
+
+ def _test_ollama(self):
+ url = self.API_URL.rstrip('/api/generate').rstrip('/') + "/api/tags"
+ resp = urllib2.urlopen(urllib2.Request(url), timeout=10)
+ data = json.loads(resp.read())
+ if 'models' in data:
+ self.available_models = [m['name'] for m in data['models']]
+ self.stdout.println("[CONN] Ollama OK — %d models" % len(self.available_models))
+ if self.MODEL not in self.available_models and self.available_models:
+ self.MODEL = self.available_models[0]
+ return True
+ return False
+
+ def _test_openai(self):
+ if not self.API_KEY: self.stderr.println("[!] OpenAI key required"); return False
+ req = urllib2.Request("https://api.openai.com/v1/models",
+ headers={"Authorization":"Bearer "+self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=10).read())
+ if 'data' in data:
+ self.available_models = [m['id'] for m in data['data'] if 'gpt' in m.get('id','')]
+ self.stdout.println("[CONN] OpenAI OK"); return True
+ return False
+
+ def _test_claude(self):
+ if not self.API_KEY: self.stderr.println("[!] Claude key required"); return False
+ try:
+ req = urllib2.Request(self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({"model": self.MODEL or "claude-3-5-sonnet-20241022",
+ "max_tokens":5,"messages":[{"role":"user","content":"ping"}]}).encode(),
+ headers={"Content-Type":"application/json","x-api-key":self.API_KEY,"anthropic-version":"2023-06-01"})
+ resp = urllib2.urlopen(req, timeout=10)
+ if resp.getcode() == 200:
+ self.available_models = ["claude-opus-4-6","claude-sonnet-4-6","claude-haiku-4-5-20251001"]
+ self.stdout.println("[CONN] Claude OK"); return True
+ except urllib2.HTTPError as e:
+ if e.code == 429:
+ self.stdout.println("[CONN] Claude OK (rate-limited)"); return True
+ raise
+ return False
+
+ def _test_gemini(self):
+ if not self.API_KEY: self.stderr.println("[!] Gemini key required"); return False
+ self.available_models = ["gemini-1.5-pro","gemini-1.5-flash","gemini-pro"]
+ self.stdout.println("[CONN] Gemini configured"); return True
+
+ def _test_azure(self):
+ if not self.API_KEY or not self.API_URL: self.stderr.println("[!] Azure config incomplete"); return False
+ self.available_models = [self.MODEL] if self.MODEL else []
+ self.stdout.println("[CONN] Azure Foundry configured"); return True
+
+ # ─────────────────────────
+ # UTILITY
+ # ─────────────────────────
+ def smart_truncate(self, body, max_len=5000):
+ if len(body) <= max_len: return body
+ head, tail = 3500, 1000
+ trunc = len(body) - head - tail
+ return body[:head] + "\n...[%d chars truncated]...\n" % trunc + body[-tail:]
+
+ def extract_idor_signals(self, params_sample, url):
+ signals = []
+ try:
+ import re
+ IDOR_NAMES = {'id','user_id','account_id','order_id','invoice_id','file_id',
+ 'doc_id','record_id','item_id','uid','pid','customer_id','profile_id','ref'}
+ path_ids = re.findall(r'/(\d{1,10})(?:/|$|\?)', str(url))
+ if path_ids: signals.append({"type":"path_numeric_id","values":path_ids[:3]})
+ if re.search(r'[0-9a-f-]{36}', str(url), re.I): signals.append({"type":"path_uuid"})
+ for p in params_sample:
+ v = p.get("value",""); n = p.get("name","")
+ if re.match(r'^\d+$', v) and len(v) <= 10:
+ signals.append({"type":"numeric_param","name":n,"value":v})
+ elif re.match(r'^[0-9a-f-]{36}$', v, re.I):
+ signals.append({"type":"uuid_param","name":n})
+ elif n.lower() in IDOR_NAMES:
+ signals.append({"type":"idor_name_match","name":n,"value":v[:20]})
+ except: pass
+ return signals
+
+ def print_logo(self):
+ self.stdout.println("=" * 60)
+ self.stdout.println(" SILENTCHAIN AI v%s — Community Edition" % self.VERSION)
+ self.stdout.println(" Dark terminal UI | Exploitation paths | PoC templates")
+ self.stdout.println(" Provider: %s | Model: %s" % (self.AI_PROVIDER, self.MODEL))
+ self.stdout.println("=" * 60)
diff --git a/variants/silentchain_v2_enhanced.py b/variants/silentchain_v2_enhanced.py
new file mode 100644
index 0000000..0ed27ac
--- /dev/null
+++ b/variants/silentchain_v2_enhanced.py
@@ -0,0 +1,2317 @@
+# -*- coding: utf-8 -*-
+# Burp Suite Python Extension: SILENTCHAIN AI - COMMUNITY EDITION
+# Version: 2.0.0
+# Enhanced Edition: Full Vulnerability Detail Panel + Exploitation + PoC
+# License: MIT License
+
+from burp import IBurpExtender, IHttpListener, IScannerCheck, IScanIssue, ITab, IContextMenuFactory
+from java.io import PrintWriter
+from java.awt import (BorderLayout, GridBagLayout, GridBagConstraints, Insets,
+ Dimension, Font, Color, FlowLayout, Cursor)
+from java.awt.event import MouseAdapter
+from javax.swing import (JPanel, JScrollPane, JTextArea, JTable, JLabel, JSplitPane,
+ BorderFactory, SwingUtilities, JButton, BoxLayout, Box,
+ JMenuItem, JTextPane, JTabbedPane, UIManager, SwingConstants,
+ JEditorPane)
+from javax.swing.table import DefaultTableModel, DefaultTableCellRenderer
+from javax.swing.text import SimpleAttributeSet, StyleConstants
+from javax.swing.border import EmptyBorder
+from java.lang import Runnable
+from java.util import ArrayList
+from java.util.concurrent import Executors
+import json
+import threading
+import urllib2
+import urllib
+import time
+import hashlib
+from datetime import datetime
+
+# ─────────────────────────────────────────────
+# DESIGN TOKENS (change once → applies everywhere)
+# ─────────────────────────────────────────────
+class Theme:
+ # Primary palette — dark terminal aesthetic
+ BG_DARKEST = Color(0x0D, 0x11, 0x17) # near-black
+ BG_DARK = Color(0x13, 0x19, 0x22) # panel bg
+ BG_MID = Color(0x1C, 0x24, 0x30) # card bg
+ BG_LIGHT = Color(0x24, 0x30, 0x3E) # hover / selected
+ BORDER = Color(0x2E, 0x3D, 0x4F) # subtle border
+
+ # Accent — electric cyan
+ ACCENT = Color(0x00, 0xD4, 0xFF)
+ ACCENT_DIM = Color(0x00, 0x7A, 0x99)
+
+ # Text
+ TEXT_PRIMARY = Color(0xE2, 0xE8, 0xF0)
+ TEXT_MUTED = Color(0x64, 0x74, 0x8B)
+ TEXT_CODE = Color(0x7D, 0xD3, 0xFC)
+
+ # Severity
+ SEV_CRITICAL = Color(0xFF, 0x17, 0x44)
+ SEV_HIGH = Color(0xFF, 0x45, 0x00)
+ SEV_MED = Color(0xFF, 0xA5, 0x00)
+ SEV_LOW = Color(0xFF, 0xD7, 0x00)
+ SEV_INFO = Color(0x38, 0xBD, 0xF8)
+
+ # Confidence
+ CONF_CERTAIN = Color(0x10, 0xB9, 0x81)
+ CONF_FIRM = Color(0x38, 0xBD, 0xF8)
+ CONF_TENTATIVE = Color(0xFF, 0xA5, 0x00)
+
+ FONT_MONO = Font("Monospaced", Font.PLAIN, 12)
+ FONT_MONO_B= Font("Monospaced", Font.BOLD, 12)
+ FONT_MONO_L= Font("Monospaced", Font.PLAIN, 11)
+ FONT_HEAD = Font("Monospaced", Font.BOLD, 14)
+ FONT_TITLE = Font("Monospaced", Font.BOLD, 16)
+
+
+VALID_SEVERITIES = {
+ "high": "High", "medium": "Medium", "low": "Low",
+ "information": "Information", "informational": "Information",
+ "info": "Information", "inform": "Information",
+ "critical": "High"
+}
+
+def map_confidence(v):
+ try: v = int(v)
+ except: v = 50
+ if v < 50: return None
+ if v < 75: return "Tentative"
+ if v < 90: return "Firm"
+ return "Certain"
+
+def severity_color(sev):
+ return {
+ "High": Theme.SEV_HIGH,
+ "Medium": Theme.SEV_MED,
+ "Low": Theme.SEV_LOW,
+ "Information": Theme.SEV_INFO,
+ }.get(sev, Theme.TEXT_MUTED)
+
+def confidence_color(conf):
+ return {
+ "Certain": Theme.CONF_CERTAIN,
+ "Firm": Theme.CONF_FIRM,
+ "Tentative": Theme.CONF_TENTATIVE,
+ }.get(conf, Theme.TEXT_MUTED)
+
+
+# ─────────────────────────────────────────────
+# HELPER: apply dark bg/fg recursively
+# ─────────────────────────────────────────────
+def dark(component, bg=None, fg=None):
+ bg = bg or Theme.BG_DARK
+ fg = fg or Theme.TEXT_PRIMARY
+ try:
+ component.setBackground(bg)
+ component.setForeground(fg)
+ component.setOpaque(True)
+ except: pass
+ return component
+
+def styled_btn(text, bg, fg=Color.WHITE, action=None):
+ btn = JButton(text)
+ btn.setBackground(bg)
+ btn.setForeground(fg)
+ btn.setFont(Theme.FONT_MONO_B)
+ btn.setOpaque(True)
+ btn.setBorderPainted(False)
+ btn.setFocusPainted(False)
+ btn.setCursor(Cursor(Cursor.HAND_CURSOR))
+ if action:
+ btn.addActionListener(action)
+ return btn
+
+def titled_panel(title, layout=None):
+ p = JPanel(layout or BorderLayout())
+ p.setBackground(Theme.BG_MID)
+ border = BorderFactory.createCompoundBorder(
+ BorderFactory.createLineBorder(Theme.BORDER, 1),
+ BorderFactory.createEmptyBorder(4, 6, 4, 6)
+ )
+ titled = BorderFactory.createTitledBorder(
+ border, title,
+ 0, 0,
+ Theme.FONT_MONO_B, Theme.ACCENT
+ )
+ p.setBorder(titled)
+ return p
+
+
+# ─────────────────────────────────────────────
+# CONSOLE WRITER
+# ─────────────────────────────────────────────
+class ConsolePrintWriter:
+ def __init__(self, original_writer, extender_ref):
+ self.original = original_writer
+ self.extender = extender_ref
+
+ def println(self, message):
+ self.original.println(message)
+ if hasattr(self.extender, 'log_to_console'):
+ try: self.extender.log_to_console(str(message))
+ except: pass
+
+ def print_(self, m): self.original.print_(m)
+ def write(self, d): self.original.write(d)
+ def flush(self): self.original.flush()
+
+
+# ─────────────────────────────────────────────
+# THREAD POOL TASK WRAPPERS
+# ─────────────────────────────────────────────
+class AnalyzeTask(Runnable):
+ def __init__(self, extender, messageInfo, url_str, task_id, forced=False):
+ self.extender = extender
+ self.messageInfo = messageInfo
+ self.url_str = url_str
+ self.task_id = task_id
+ self.forced = forced
+
+ def run(self):
+ if self.forced:
+ self.extender.analyze_forced(self.messageInfo, self.url_str, self.task_id)
+ else:
+ self.extender.analyze(self.messageInfo, self.url_str, self.task_id)
+
+
+# ─────────────────────────────────────────────
+# CELL RENDERERS
+# ─────────────────────────────────────────────
+class DarkCellRenderer(DefaultTableCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DefaultTableCellRenderer.getTableCellRendererComponent(
+ self, table, value, sel, focus, row, col)
+ c.setBackground(Theme.BG_LIGHT if sel else (Theme.BG_MID if row % 2 == 0 else Theme.BG_DARK))
+ c.setForeground(Theme.TEXT_PRIMARY)
+ c.setFont(Theme.FONT_MONO_L)
+ c.setBorder(EmptyBorder(2, 6, 2, 6))
+ return c
+
+class StatusRenderer(DarkCellRenderer):
+ COLORS = {
+ "Cancelled": Theme.SEV_CRITICAL,
+ "Paused": Theme.SEV_LOW,
+ "Error": Theme.SEV_HIGH,
+ "Skipped": Theme.SEV_MED,
+ "Completed": Theme.CONF_CERTAIN,
+ "Analyzing": Theme.ACCENT,
+ "Waiting": Theme.ACCENT_DIM,
+ "Queued": Theme.TEXT_MUTED,
+ }
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ for k, color in self.COLORS.items():
+ if k in str(value):
+ c.setForeground(color)
+ c.setFont(Theme.FONT_MONO_B)
+ break
+ return c
+
+class SeverityRenderer(DarkCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ sev = str(value)
+ color = severity_color(sev)
+ c.setForeground(color)
+ c.setFont(Theme.FONT_MONO_B)
+ return c
+
+class ConfidenceRenderer(DarkCellRenderer):
+ def getTableCellRendererComponent(self, table, value, sel, focus, row, col):
+ c = DarkCellRenderer.getTableCellRendererComponent(self, table, value, sel, focus, row, col)
+ if value:
+ c.setForeground(confidence_color(str(value)))
+ c.setFont(Theme.FONT_MONO_B)
+ return c
+
+
+# ─────────────────────────────────────────────
+# VULN DETAIL PANEL ← new core component
+# ─────────────────────────────────────────────
+class VulnDetailPanel(JPanel):
+ """
+ Tabbed detail view shown when a finding row is selected.
+ Tabs: Overview | Exploitation | PoC | Remediation | Raw JSON
+ """
+ def __init__(self):
+ JPanel.__init__(self, BorderLayout())
+ self.setBackground(Theme.BG_DARKEST)
+ self._current_finding = None
+ self._build_ui()
+
+ def _build_ui(self):
+ # Header bar
+ self.header = JPanel(BorderLayout())
+ self.header.setBackground(Theme.BG_MID)
+ self.header.setBorder(EmptyBorder(8, 12, 8, 12))
+
+ self.title_label = JLabel("Select a finding to view details")
+ self.title_label.setFont(Theme.FONT_HEAD)
+ self.title_label.setForeground(Theme.TEXT_PRIMARY)
+
+ self.severity_badge = JLabel("")
+ self.severity_badge.setFont(Theme.FONT_MONO_B)
+ self.severity_badge.setHorizontalAlignment(SwingConstants.RIGHT)
+
+ self.header.add(self.title_label, BorderLayout.CENTER)
+ self.header.add(self.severity_badge, BorderLayout.EAST)
+ self.add(self.header, BorderLayout.NORTH)
+
+ # Tabs
+ self.tabs = JTabbedPane()
+ self.tabs.setBackground(Theme.BG_DARK)
+ self.tabs.setForeground(Theme.TEXT_PRIMARY)
+ self.tabs.setFont(Theme.FONT_MONO_B)
+
+ self.overview_pane = self._make_html_pane()
+ self.exploit_pane = self._make_html_pane()
+ self.poc_pane = self._make_code_pane()
+ self.remediation_pane = self._make_html_pane()
+ self.raw_pane = self._make_code_pane()
+
+ self.tabs.addTab("Overview", JScrollPane(self.overview_pane))
+ self.tabs.addTab("Exploitation", JScrollPane(self.exploit_pane))
+ self.tabs.addTab("PoC Template", JScrollPane(self.poc_pane))
+ self.tabs.addTab("Remediation", JScrollPane(self.remediation_pane))
+ self.tabs.addTab("Raw JSON", JScrollPane(self.raw_pane))
+
+ # Style tab scrollpanes
+ for i in range(self.tabs.getTabCount()):
+ sp = self.tabs.getComponentAt(i)
+ if isinstance(sp, JScrollPane):
+ sp.setBackground(Theme.BG_DARK)
+ sp.getViewport().setBackground(Theme.BG_DARK)
+
+ self.add(self.tabs, BorderLayout.CENTER)
+
+ # Empty state message
+ self.empty_label = JLabel("← Click any finding row to see full details, exploitation paths and PoC",
+ SwingConstants.CENTER)
+ self.empty_label.setFont(Theme.FONT_MONO)
+ self.empty_label.setForeground(Theme.TEXT_MUTED)
+
+ self._show_empty()
+
+ def _make_html_pane(self):
+ pane = JEditorPane("text/html", "")
+ pane.setEditable(False)
+ pane.setBackground(Theme.BG_DARK)
+ pane.setForeground(Theme.TEXT_PRIMARY)
+ pane.setFont(Theme.FONT_MONO)
+ pane.putClientProperty(JEditorPane.HONOR_DISPLAY_PROPERTIES, True)
+ return pane
+
+ def _make_code_pane(self):
+ area = JTextArea()
+ area.setEditable(False)
+ area.setBackground(Theme.BG_DARKEST)
+ area.setForeground(Theme.TEXT_CODE)
+ area.setFont(Theme.FONT_MONO)
+ area.setLineWrap(True)
+ area.setWrapStyleWord(False)
+ area.setBorder(EmptyBorder(8, 10, 8, 10))
+ return area
+
+ def _show_empty(self):
+ self.title_label.setText("Select a finding to view details")
+ self.severity_badge.setText("")
+ for pane in [self.overview_pane, self.exploit_pane, self.remediation_pane]:
+ pane.setText("")
+ for area in [self.poc_pane, self.raw_pane]:
+ area.setText("")
+
+ def _css(self):
+ return """
+
+ """
+
+ def load_finding(self, finding):
+ """Called when a row is selected in the findings table."""
+ self._current_finding = finding
+ self._render_finding(finding)
+
+ def _render_finding(self, f):
+ title = f.get("title", "Unknown Finding")
+ severity = f.get("severity", "Information")
+ conf = f.get("confidence", "")
+ url = f.get("url", "")
+ detail = f.get("detail", "")
+ cwe = f.get("cwe", "")
+ owasp = f.get("owasp", "")
+ remediation = f.get("remediation", "")
+ evidence = f.get("evidence", "")
+ exploit_path = f.get("exploit_path", "")
+ exploit_steps = f.get("exploit_steps", [])
+ poc_template = f.get("poc_template", "")
+ poc_curl = f.get("poc_curl", "")
+ poc_python = f.get("poc_python", "")
+ affected_params = f.get("affected_params", [])
+ business_impact = f.get("business_impact", "")
+ cvss = f.get("cvss_score", "")
+ references = f.get("references", [])
+
+ sev_cls = severity.lower() if severity.lower() in ["high","medium","low"] else "info"
+
+ # ── Header ──
+ self.title_label.setText(title)
+ badge_text = severity
+ if cvss:
+ badge_text += " CVSS: %s" % cvss
+ self.severity_badge.setText(badge_text)
+ self.severity_badge.setForeground(severity_color(severity))
+
+ # ── Overview Tab ──
+ sev_html = '%s ' % (sev_cls, severity)
+ conf_html = '%s ' % conf if conf else ""
+
+ params_html = ""
+ if affected_params:
+ params_html = "".join(['%s ' % p for p in affected_params])
+ elif f.get("param"):
+ params_html = '%s ' % f.get("param")
+
+ cwe_html = ""
+ if cwe:
+ cwe_id = cwe.replace("CWE-", "")
+ cwe_html = '%s ' % (cwe_id, cwe)
+
+ refs_html = ""
+ if references:
+ refs_html = "References "
+ for ref in references[:5]:
+ refs_html += '%s "
+
+ evidence_html = ""
+ if evidence:
+ evidence_html = "Evidence %s " % evidence[:1000]
+
+ overview = """{css}
+
+
Finding Summary
+
+ Severity: {sev} Confidence: {conf} URL: {url}
+
+
Description
+
{detail}
+
CWE: %s OWASP: %s CVSS: %s Affected Parameters %s
" % params_html if params_html else "",
+ evidence_html=evidence_html,
+ refs_html=refs_html
+ )
+ self.overview_pane.setText(overview)
+ self.overview_pane.setCaretPosition(0)
+
+ # ── Exploitation Tab ──
+ steps_html = ""
+ if exploit_steps and isinstance(exploit_steps, list):
+ steps_html = "Step-by-Step Exploitation "
+ for i, step in enumerate(exploit_steps):
+ steps_html += "%s " % step
+ steps_html += " "
+
+ impact_html = ""
+ if business_impact:
+ impact_html = "Business Impact %s
" % business_impact
+
+ exploit_html = """{css}
+
+
Attack Vector
+
{exploit_path}
+
+
Exploitation Prerequisites
+
+ Access to target application (authenticated or unauthenticated depending on vuln type)
+ Ability to intercept/modify HTTP requests (Burp Suite proxy)
+ {extra_prereqs}
+
+
No exploitation path provided by AI — re-analyze with context menu to refresh ",
+ steps_html=steps_html,
+ impact_html=impact_html,
+ extra_prereqs="Valid session token / API key (if endpoint is authenticated) " if "auth" in title.lower() or "idor" in title.lower() else ""
+ )
+ self.exploit_pane.setText(exploit_html)
+ self.exploit_pane.setCaretPosition(0)
+
+ # ── PoC Tab ──
+ poc_parts = []
+ if poc_curl:
+ poc_parts.append("# ── cURL PoC ──\n%s" % poc_curl)
+ if poc_python:
+ poc_parts.append("# ── Python PoC ──\n%s" % poc_python)
+ if poc_template and not poc_curl and not poc_python:
+ poc_parts.append("# ── PoC Template ──\n%s" % poc_template)
+ if not poc_parts:
+ poc_parts.append("# No PoC generated yet.\n# Right-click the request in Burp → Analyze Request\n# to trigger a fresh AI analysis with PoC generation.")
+
+ self.poc_pane.setText("\n\n".join(poc_parts))
+ self.poc_pane.setCaretPosition(0)
+
+ # ── Remediation Tab ──
+ rem_html = """{css}
+
+
Remediation
+
{remediation}
+
+
Verification Steps
+
+ Apply the fix in a development environment
+ Re-run the same request via Burp → Analyze Request
+ Confirm the AI no longer flags the vulnerability
+ Run a full regression test on the affected endpoint
+
+
+
Secure Code Reference
+
See OWASP Cheat Sheet Series
+ for language-specific secure coding guidance related to {owasp}.
+
" + "".join("%s " % s for s in exploit_steps) + " "
+
+ poc_html = ""
+ if f.get("poc_curl"):
+ poc_html += "cURL %s " % f["poc_curl"]
+ if f.get("poc_python"):
+ poc_html += "Python %s " % f["poc_python"]
+ if f.get("poc_template") and not poc_html:
+ poc_html = "%s " % f["poc_template"]
+
+ cards_html += """
+
+
+
+ {url}
+ {cwe_span}
+ {owasp_span}
+
+
+
+ Description
+ Exploitation
+ PoC
+ Remediation
+
+
+
{detail}
+ {evidence}
+ {impact}
+
+
+
{exploit_path}
+ {steps_html}
+
+
+ {poc_html}
+
+
+
+
%s ' % f["cwe"] if f.get("cwe") else "",
+ owasp_span='%s ' % f["owasp"] if f.get("owasp") else "",
+ detail=f.get("detail",""),
+ evidence='' % f["evidence"] if f.get("evidence") else "",
+ impact='Business Impact: %s
' % f["business_impact"] if f.get("business_impact") else "",
+ exploit_path=f.get("exploit_path","No exploitation path recorded."),
+ steps_html=steps_html,
+ poc_html=poc_html or "No PoC available. Re-analyze to generate.
",
+ remediation=f.get("remediation","")
+ )
+
+ return """
+
+
+SILENTCHAIN AI Report — {ts}
+
+
+
+SILENTCHAIN AI — Security Report
+Generated: {ts} | Model: {model} | Community Edition
+
+{cards}
+
+
+""".format(
+ ts=ts, model=self.MODEL, cards=cards_html,
+ total=len(findings),
+ high=counts["High"], med=counts["Medium"],
+ low=counts["Low"], info=counts["Information"]
+ )
+
+ # ─────────────────────────
+ # EXPORT: CSV (kept)
+ # ─────────────────────────
+ def exportFindings(self, event):
+ if self.findingsTableModel.getRowCount() == 0:
+ self.stdout.println("[EXPORT] No findings"); return
+ try:
+ from javax.swing import JFileChooser
+ from java.io import File
+ fc = JFileChooser()
+ fc.setSelectedFile(File("SILENTCHAIN_%s.csv" % time.strftime("%Y%m%d_%H%M%S")))
+ if fc.showSaveDialog(self.panel) != JFileChooser.APPROVE_OPTION: return
+ path = str(fc.getSelectedFile().getAbsolutePath())
+ with open(path, 'w') as f:
+ headers = [self.findingsTableModel.getColumnName(c)
+ for c in range(self.findingsTableModel.getColumnCount())]
+ f.write(','.join(['"'+h+'"' for h in headers]) + '\n')
+ for r in range(self.findingsTableModel.getRowCount()):
+ vals = ['"' + str(self.findingsTableModel.getValueAt(r, c)).replace('"','""') + '"'
+ for c in range(self.findingsTableModel.getColumnCount())]
+ f.write(','.join(vals) + '\n')
+ self.stdout.println("[EXPORT] CSV saved: %s" % path)
+ except Exception as e:
+ self.stderr.println("[!] CSV export failed: %s" % e)
+
+ # ─────────────────────────
+ # SETTINGS DIALOG
+ # ─────────────────────────
+ def openSettings(self, event):
+ from javax.swing import (JDialog, JTabbedPane, JTextField, JComboBox,
+ JPasswordField, JCheckBox)
+ dialog = JDialog()
+ dialog.setTitle("SILENTCHAIN Settings v%s" % self.VERSION)
+ dialog.setModal(True)
+ dialog.setSize(700, 580)
+ dialog.setLocationRelativeTo(None)
+ dialog.getContentPane().setBackground(Theme.BG_DARK)
+
+ tabs = JTabbedPane()
+ tabs.setBackground(Theme.BG_DARK)
+ tabs.setForeground(Theme.TEXT_PRIMARY)
+
+ # AI Provider tab
+ aiPanel = JPanel(GridBagLayout())
+ aiPanel.setBackground(Theme.BG_DARK)
+ gbc = GridBagConstraints()
+ gbc.insets = Insets(6, 8, 6, 8)
+ gbc.anchor = GridBagConstraints.WEST
+ gbc.fill = GridBagConstraints.HORIZONTAL
+
+ def add_row(panel, row, label_text, field):
+ gbc.gridx = 0; gbc.gridy = row; gbc.gridwidth = 1
+ lbl = JLabel(label_text)
+ lbl.setForeground(Theme.TEXT_MUTED)
+ lbl.setFont(Theme.FONT_MONO)
+ panel.add(lbl, gbc)
+ gbc.gridx = 1; gbc.gridwidth = 2
+ panel.add(field, gbc)
+ gbc.gridwidth = 1
+
+ providerCombo = JComboBox(["Ollama","OpenAI","Claude","Gemini","Azure Foundry"])
+ providerCombo.setSelectedItem(self.AI_PROVIDER)
+ apiUrlField = JTextField(self.API_URL, 30)
+ apiKeyField = JPasswordField(self.API_KEY, 30)
+ maxTokensField = JTextField(str(self.MAX_TOKENS), 10)
+
+ models_list = self.available_models if self.available_models else [self.MODEL]
+ modelCombo = JComboBox(models_list)
+ if self.MODEL in models_list: modelCombo.setSelectedItem(self.MODEL)
+
+ for fld in [apiUrlField, apiKeyField, maxTokensField]:
+ fld.setBackground(Theme.BG_MID)
+ fld.setForeground(Theme.TEXT_PRIMARY)
+ fld.setCaretColor(Theme.ACCENT)
+ fld.setFont(Theme.FONT_MONO)
+
+ from java.awt.event import ActionListener
+ class ProviderListener(ActionListener):
+ def __init__(self, f): self.f = f
+ def actionPerformed(self, e):
+ urls = {"Ollama":"http://localhost:11434","OpenAI":"https://api.openai.com/v1",
+ "Claude":"https://api.anthropic.com/v1",
+ "Gemini":"https://generativelanguage.googleapis.com/v1",
+ "Azure Foundry":"https://YOUR-RESOURCE.openai.azure.com"}
+ p = str(e.getSource().getSelectedItem())
+ if p in urls: self.f.setText(urls[p])
+ providerCombo.addActionListener(ProviderListener(apiUrlField))
+
+ add_row(aiPanel, 0, "AI Provider:", providerCombo)
+ add_row(aiPanel, 1, "API URL:", apiUrlField)
+ add_row(aiPanel, 2, "API Key:", apiKeyField)
+ add_row(aiPanel, 3, "Model:", modelCombo)
+ add_row(aiPanel, 4, "Max Tokens:", maxTokensField)
+
+ gbc.gridx=0; gbc.gridy=5; gbc.gridwidth=3
+ testBtn = styled_btn("Test Connection", Theme.ACCENT_DIM, Color.WHITE)
+ ext_ref = self
+ def do_test(e):
+ testBtn.setEnabled(False); testBtn.setText("Testing...")
+ old = (ext_ref.AI_PROVIDER, ext_ref.API_URL, ext_ref.API_KEY)
+ ext_ref.AI_PROVIDER = str(providerCombo.getSelectedItem())
+ ext_ref.API_URL = apiUrlField.getText()
+ ext_ref.API_KEY = "".join(apiKeyField.getPassword())
+ def run():
+ try:
+ if not ext_ref.test_ai_connection():
+ ext_ref.AI_PROVIDER, ext_ref.API_URL, ext_ref.API_KEY = old
+ finally:
+ SwingUtilities.invokeLater(lambda: (testBtn.setEnabled(True), testBtn.setText("Test Connection")))
+ threading.Thread(target=run, daemon=True).start()
+ testBtn.addActionListener(do_test)
+ aiPanel.add(testBtn, gbc)
+ tabs.addTab("AI Provider", aiPanel)
+
+ # Advanced tab
+ advPanel = JPanel(GridBagLayout())
+ advPanel.setBackground(Theme.BG_DARK)
+ gbc2 = GridBagConstraints()
+ gbc2.insets = Insets(6,8,6,8); gbc2.anchor=GridBagConstraints.WEST
+ gbc2.fill = GridBagConstraints.HORIZONTAL
+
+ passiveChk = JCheckBox("Enable passive scanning", self.PASSIVE_SCANNING_ENABLED)
+ verboseChk = JCheckBox("Verbose logging", self.VERBOSE)
+ timeoutFld = JTextField(str(self.AI_REQUEST_TIMEOUT), 10)
+
+ for w in [passiveChk, verboseChk]:
+ w.setBackground(Theme.BG_DARK); w.setForeground(Theme.TEXT_PRIMARY)
+ w.setFont(Theme.FONT_MONO)
+ timeoutFld.setBackground(Theme.BG_MID); timeoutFld.setForeground(Theme.TEXT_PRIMARY)
+ timeoutFld.setFont(Theme.FONT_MONO)
+
+ rows_adv = [(0,"Passive Scan:", passiveChk),(1,"Verbose:", verboseChk),(2,"Timeout (s):", timeoutFld)]
+ for r, lbl_txt, widget in rows_adv:
+ gbc2.gridx=0; gbc2.gridy=r; gbc2.gridwidth=1
+ l = JLabel(lbl_txt); l.setForeground(Theme.TEXT_MUTED); l.setFont(Theme.FONT_MONO)
+ advPanel.add(l, gbc2)
+ gbc2.gridx=1; gbc2.gridwidth=2; advPanel.add(widget, gbc2); gbc2.gridwidth=1
+
+ tabs.addTab("Advanced", advPanel)
+
+ # Save / Cancel
+ btnRow = JPanel(FlowLayout(FlowLayout.RIGHT, 8, 8))
+ btnRow.setBackground(Theme.BG_MID)
+ saveBtn = styled_btn("Save", Theme.CONF_CERTAIN)
+ cancelBtn = styled_btn("Cancel", Theme.BG_LIGHT, fg=Theme.TEXT_MUTED)
+
+ def do_save(e):
+ self.AI_PROVIDER = str(providerCombo.getSelectedItem())
+ self.API_URL = apiUrlField.getText()
+ self.API_KEY = "".join(apiKeyField.getPassword())
+ self.MODEL = str(modelCombo.getSelectedItem())
+ try: self.MAX_TOKENS = max(512, int(maxTokensField.getText()))
+ except: self.MAX_TOKENS = 3072
+ self.PASSIVE_SCANNING_ENABLED = passiveChk.isSelected()
+ self.VERBOSE = verboseChk.isSelected()
+ try:
+ t = int(timeoutFld.getText())
+ self.AI_REQUEST_TIMEOUT = max(10, min(99999, t))
+ except: self.AI_REQUEST_TIMEOUT = 60
+ self._sync_scanning_button()
+ self.save_config()
+ self.refreshUI()
+ dialog.dispose()
+
+ saveBtn.addActionListener(do_save)
+ cancelBtn.addActionListener(lambda e: dialog.dispose())
+ btnRow.add(saveBtn); btnRow.add(cancelBtn)
+
+ from javax.swing import JPanel as JP
+ wrapper = JP(BorderLayout())
+ wrapper.setBackground(Theme.BG_DARK)
+ wrapper.add(tabs, BorderLayout.CENTER)
+ wrapper.add(btnRow, BorderLayout.SOUTH)
+ dialog.add(wrapper)
+ dialog.setVisible(True)
+
+ # ─────────────────────────
+ # CONFIG I/O
+ # ─────────────────────────
+ def load_config(self):
+ try:
+ import os
+ if not os.path.exists(self.config_file): return
+ with open(self.config_file, 'r') as f:
+ cfg = json.load(f)
+ self.AI_PROVIDER = cfg.get("ai_provider", self.AI_PROVIDER)
+ self.API_URL = cfg.get("api_url", self.API_URL)
+ self.API_KEY = cfg.get("api_key", self.API_KEY)
+ self.MODEL = cfg.get("model", self.MODEL)
+ self.MAX_TOKENS = cfg.get("max_tokens", self.MAX_TOKENS)
+ self.AI_REQUEST_TIMEOUT = cfg.get("ai_request_timeout", self.AI_REQUEST_TIMEOUT)
+ self.VERBOSE = cfg.get("verbose", self.VERBOSE)
+ self.PASSIVE_SCANNING_ENABLED = cfg.get("passive_scanning_enabled", self.PASSIVE_SCANNING_ENABLED)
+ self.AZURE_API_VERSION = cfg.get("azure_api_version", self.AZURE_API_VERSION)
+ except Exception as e:
+ pass # stdout not ready yet
+
+ def save_config(self):
+ try:
+ cfg = {
+ "config_version": self.CONFIG_VERSION,
+ "ai_provider": self.AI_PROVIDER, "api_url": self.API_URL,
+ "api_key": self.API_KEY, "model": self.MODEL,
+ "max_tokens": self.MAX_TOKENS, "ai_request_timeout": self.AI_REQUEST_TIMEOUT,
+ "verbose": self.VERBOSE, "passive_scanning_enabled": self.PASSIVE_SCANNING_ENABLED,
+ "azure_api_version": self.AZURE_API_VERSION,
+ "version": self.VERSION, "last_saved": datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ }
+ with open(self.config_file, 'w') as f:
+ json.dump(cfg, f, indent=2)
+ return True
+ except Exception as e:
+ self.stderr.println("[!] Save config failed: %s" % e)
+ return False
+
+ def apply_environment_config(self):
+ try:
+ import os
+ az_ep = os.environ.get("AZURE_OPENAI_ENDPOINT","").strip()
+ az_key = os.environ.get("AZURE_OPENAI_API_KEY","").strip()
+ az_dep = os.environ.get("AZURE_OPENAI_DEPLOYMENT","").strip()
+ az_ver = os.environ.get("OPENAI_API_VERSION","").strip()
+ if az_ver: self.AZURE_API_VERSION = az_ver
+ if az_ep and az_key and (self.AI_PROVIDER == "Ollama" or not self.API_KEY):
+ self.AI_PROVIDER = "Azure Foundry"
+ self.API_URL = az_ep; self.API_KEY = az_key
+ if az_dep: self.MODEL = az_dep
+ except: pass
+
+ def _load_dotenv_values(self):
+ values = {}
+ try:
+ import os
+ paths = [os.path.join(os.getcwd(), ".env"),
+ os.path.join(os.path.expanduser("~"), ".silentchain.env")]
+ for p in paths:
+ if p and os.path.isfile(p):
+ with open(p,'r') as f:
+ for line in f:
+ line = line.strip()
+ if not line or line.startswith('#') or '=' not in line: continue
+ k, v = line.split('=', 1)
+ k = k.strip().lstrip("export").strip()
+ v = v.strip().strip('"').strip("'")
+ if k: values[k] = v
+ break
+ except: pass
+ return values
+
+ # ─────────────────────────
+ # CACHE I/O
+ # ─────────────────────────
+ def load_vuln_cache(self):
+ try:
+ import os
+ if not os.path.exists(self.vuln_cache_file): return
+ with open(self.vuln_cache_file, 'r') as f:
+ payload = json.load(f)
+ entries = payload.get("entries", {}) if isinstance(payload, dict) else {}
+ with self.vuln_cache_lock:
+ self.vuln_cache = entries if isinstance(entries, dict) else {}
+ self.stdout.println("[CACHE] Loaded %d entries" % len(self.vuln_cache))
+ self._ui_dirty = True
+ except Exception as e:
+ self.stderr.println("[!] Cache load failed: %s" % e)
+
+ def save_vuln_cache(self):
+ try:
+ with self.vuln_cache_lock:
+ snap = dict(self.vuln_cache)
+ with open(self.vuln_cache_file, 'w') as f:
+ json.dump({"version": self.VERSION,
+ "last_updated": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "entries": snap}, f, indent=2)
+ return True
+ except Exception as e:
+ self.stderr.println("[!] Cache save failed: %s" % e)
+ return False
+
+ def _async_save_cache(self):
+ if not self._cache_dirty: return
+ self._cache_dirty = False
+ def run():
+ try: self.save_vuln_cache()
+ except: self._cache_dirty = True
+ t = threading.Thread(target=run); t.setDaemon(True); t.start()
+
+ # ─────────────────────────
+ # CACHE KEY / LOOKUP
+ # ─────────────────────────
+ def _get_request_signature(self, data):
+ req_hdrs = [str(h).split(':',1)[0].strip().lower() for h in data.get("request_headers",[])[:10]]
+ res_hdrs = [str(h).split(':',1)[0].strip().lower() for h in data.get("response_headers",[])[:10]]
+ auth_present = any(h.lower().startswith(('authorization:','cookie:','x-api-key:'))
+ for h in data.get("request_headers",[]))
+ auth_len = sum(len(h) for h in data.get("request_headers",[])
+ if h.lower().startswith(('authorization:','cookie:','x-api-key:')))
+ sig = {"provider": self.AI_PROVIDER, "model": self.MODEL,
+ "method": data.get("method",""), "url": str(data.get("url","")).split('?',1)[0],
+ "status": data.get("status",0), "mime_type": data.get("mime_type",""),
+ "param_names": sorted([p.get("name","") for p in data.get("params_sample",[]) if p.get("name")]),
+ "req_headers": sorted(req_hdrs), "res_headers": sorted(res_hdrs),
+ "auth_present": auth_present, "auth_len": auth_len}
+ return hashlib.sha256(json.dumps(sig, sort_keys=True).encode('utf-8')).hexdigest()[:32]
+
+ def _get_cached_findings(self, sig):
+ with self.vuln_cache_lock:
+ entry = self.vuln_cache.get(sig)
+ if not entry: return None
+ entry["last_seen"] = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+ entry["hit_count"] = int(entry.get("hit_count",0)) + 1
+ findings = entry.get("findings", [])
+ self._cache_dirty = True
+ return findings if isinstance(findings, list) else []
+
+ def _store_cached_findings(self, sig, url, findings):
+ if isinstance(findings, dict): findings = [findings]
+ normalized = [f for f in findings if isinstance(f, dict)]
+ if not normalized: return
+ with self.vuln_cache_lock:
+ self.vuln_cache[sig] = {
+ "url": str(url).split('?',1)[0],
+ "updated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "hit_count": 0, "findings": normalized
+ }
+ self._cache_dirty = True
+ self._ui_dirty = True
+
+ # ─────────────────────────
+ # HASHING
+ # ─────────────────────────
+ def _get_url_hash(self, url, params):
+ param_names = sorted([p.getName() for p in params])
+ raw = str(url).split('?')[0] + '|' + '|'.join(param_names)
+ return hashlib.sha256(raw.encode('utf-8')).hexdigest()[:32]
+
+ def _get_finding_hash(self, url, title, cwe, param_name=""):
+ raw = "%s|%s|%s|%s" % (str(url).split('?')[0], title.lower().strip(), cwe, param_name)
+ return hashlib.sha256(raw.encode('utf-8')).hexdigest()[:32]
+
+ # ─────────────────────────
+ # TASK TRACKING
+ # ─────────────────────────
+ def addTask(self, task_type, url, status="Queued", messageInfo=None):
+ with self.tasks_lock:
+ task = {"timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "type": task_type, "url": url, "status": status,
+ "start_time": time.time(), "messageInfo": messageInfo}
+ self.tasks.append(task)
+ with self.stats_lock: self.stats["total_requests"] += 1
+ self._ui_dirty = True
+ return len(self.tasks) - 1
+
+ def updateTask(self, task_id, status, error=None):
+ with self.tasks_lock:
+ if task_id < len(self.tasks):
+ self.tasks[task_id]["status"] = status
+ self.tasks[task_id]["end_time"] = time.time()
+ if error: self.tasks[task_id]["error"] = error
+ self._ui_dirty = True
+
+ def updateStats(self, key, n=1):
+ with self.stats_lock:
+ self.stats[key] = self.stats.get(key, 0) + n
+ self._ui_dirty = True
+
+ def log_to_console(self, msg):
+ with self.console_lock:
+ ts = datetime.now().strftime("%H:%M:%S")
+ s = str(msg)
+ if len(s) > 160: s = s[:157] + "..."
+ self.console_messages.append("[%s] %s" % (ts, s))
+ if len(self.console_messages) > self.max_console_messages:
+ self.console_messages = self.console_messages[-self.max_console_messages:]
+ self._ui_dirty = True
+
+ def add_finding(self, finding_dict):
+ """Store full rich finding dict (includes exploit/poc fields)."""
+ with self.findings_lock_ui:
+ self.findings_list.append(finding_dict)
+ self._ui_dirty = True
+
+ # ─────────────────────────
+ # BURP INTERFACE
+ # ─────────────────────────
+ def getTabCaption(self): return "SILENTCHAIN"
+ def getUiComponent(self): return self.panel
+
+ def createMenuItems(self, invocation):
+ ctx = invocation.getInvocationContext()
+ allowed = [invocation.CONTEXT_MESSAGE_EDITOR_REQUEST,
+ invocation.CONTEXT_MESSAGE_VIEWER_REQUEST,
+ invocation.CONTEXT_PROXY_HISTORY,
+ invocation.CONTEXT_TARGET_SITE_MAP_TABLE,
+ invocation.CONTEXT_TARGET_SITE_MAP_TREE]
+ if ctx not in allowed: return None
+ msgs = invocation.getSelectedMessages()
+ if not msgs or len(msgs) == 0: return None
+ menu_list = ArrayList()
+ item = JMenuItem("SILENTCHAIN: Analyze Request")
+ item.setForeground(Theme.ACCENT)
+ item.addActionListener(lambda x: self.analyzeFromContextMenu(msgs))
+ menu_list.add(item)
+ return menu_list
+
+ def analyzeFromContextMenu(self, messages):
+ t = threading.Thread(target=self._contextMenuThread, args=(messages,))
+ t.setDaemon(True); t.start()
+
+ def _contextMenuThread(self, messages):
+ seen = set()
+ for message in messages:
+ try:
+ req = self.helpers.analyzeRequest(message)
+ url_str = str(req.getUrl())
+ rb = message.getRequest()
+ key = "%s|%s" % (url_str, hashlib.sha256(bytes(rb.tostring())).hexdigest()[:8] if rb else "")
+ now = time.time()
+ with self.context_menu_lock:
+ if now - self.context_menu_last_invoke.get(key, 0) < self.context_menu_debounce_time:
+ continue
+ self.context_menu_last_invoke[key] = now
+ if key in seen: continue
+ seen.add(key)
+
+ if message.getResponse() is None:
+ resp = self.callbacks.makeHttpRequest(message.getHttpService(), rb)
+ if resp is None or resp.getResponse() is None: continue
+ message = resp
+
+ task_id = self.addTask("CONTEXT", url_str, "Queued", message)
+ self.thread_pool.submit(AnalyzeTask(self, message, url_str, task_id, forced=True))
+ except Exception as e:
+ self.stderr.println("[!] Context menu error: %s" % e)
+
+ def doPassiveScan(self, baseRequestResponse):
+ if not self.PASSIVE_SCANNING_ENABLED: return None
+ try:
+ req = self.helpers.analyzeRequest(baseRequestResponse)
+ url_str = str(req.getUrl())
+ if not self.is_in_scope(url_str): return None
+ if self.should_skip_extension(url_str): return None
+ except: url_str = "Unknown"
+ task_id = self.addTask("PASSIVE", url_str, "Queued", baseRequestResponse)
+ self.thread_pool.submit(AnalyzeTask(self, baseRequestResponse, url_str, task_id))
+ return None
+
+ def doActiveScan(self, brr, ip): return []
+ def consolidateDuplicateIssues(self, a, b): return 0
+
+ def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
+ if messageIsRequest or not self.PASSIVE_SCANNING_ENABLED: return
+ if toolFlag != 4: return # TOOL_PROXY = 4
+ try:
+ req = self.helpers.analyzeRequest(messageInfo)
+ url_str = str(req.getUrl())
+ if not self.is_in_scope(url_str): return
+ if self.should_skip_extension(url_str): return
+ except: url_str = "Unknown"
+ task_id = self.addTask("HTTP", url_str, "Queued", messageInfo)
+ self.thread_pool.submit(AnalyzeTask(self, messageInfo, url_str, task_id))
+
+ def is_in_scope(self, url):
+ try:
+ from java.net import URL as JavaURL
+ return self.callbacks.isInScope(JavaURL(url))
+ except: return False
+
+ def should_skip_extension(self, url):
+ try:
+ path = url.split('?')[0].lower()
+ fname = path.split('/')[-1] if '/' in path else path
+ if '.' in fname:
+ ext = fname.split('.')[-1]
+ if ext in self.SKIP_EXTENSIONS: return True
+ except: pass
+ return False
+
+ # ─────────────────────────
+ # ANALYSIS ENGINE
+ # ─────────────────────────
+ def analyze(self, messageInfo, url_str=None, task_id=None):
+ host = self._host_from_url(url_str or "unknown")
+ host_sem = self.get_host_semaphore(host)
+ host_sem.acquire()
+ try:
+ self.global_semaphore.acquire()
+ try:
+ self._rate_limit(task_id, "Waiting (Rate Limit)")
+ if task_id is not None: self.updateTask(task_id, "Analyzing")
+ self._perform_analysis(messageInfo, "HTTP", url_str, task_id)
+ if task_id is not None: self.updateTask(task_id, "Completed")
+ except Exception as e:
+ self.stderr.println("[!] Analysis error: %s" % e)
+ if task_id is not None: self.updateTask(task_id, "Error: %s" % str(e)[:30])
+ self.updateStats("errors")
+ finally:
+ self.global_semaphore.release()
+ self.refreshUI()
+ finally:
+ host_sem.release()
+
+ def analyze_forced(self, messageInfo, url_str=None, task_id=None):
+ host = self._host_from_url(url_str or "unknown")
+ host_sem = self.get_host_semaphore(host)
+ host_sem.acquire()
+ try:
+ self.global_semaphore.acquire()
+ try:
+ self._rate_limit(task_id, "Waiting (Rate Limit)")
+ if task_id is not None: self.updateTask(task_id, "Analyzing (Forced)")
+ self._perform_analysis(messageInfo, "CONTEXT", url_str, task_id, bypass_dedup=True)
+ if task_id is not None: self.updateTask(task_id, "Completed")
+ except Exception as e:
+ self.stderr.println("[!] Forced analysis error: %s" % e)
+ if task_id is not None: self.updateTask(task_id, "Error: %s" % str(e)[:30])
+ self.updateStats("errors")
+ finally:
+ self.global_semaphore.release()
+ self.refreshUI()
+ finally:
+ host_sem.release()
+
+ def _rate_limit(self, task_id, status_msg):
+ wait = self.min_delay - (time.time() - self.last_request_time)
+ if wait > 0:
+ if task_id is not None: self.updateTask(task_id, status_msg)
+ time.sleep(wait)
+ self.last_request_time = time.time()
+
+ def get_host_semaphore(self, host):
+ with self.host_semaphore_lock:
+ if host not in self.host_semaphores:
+ self.host_semaphores[host] = threading.Semaphore(2)
+ return self.host_semaphores[host]
+
+ def _host_from_url(self, url_str):
+ try:
+ import re
+ m = re.match(r'https?://([^:/]+)', str(url_str))
+ return m.group(1) if m else "unknown"
+ except: return "unknown"
+
+ def _perform_analysis(self, messageInfo, source, url_str=None, task_id=None, bypass_dedup=False):
+ try:
+ req = self.helpers.analyzeRequest(messageInfo)
+ res = self.helpers.analyzeResponse(messageInfo.getResponse())
+ url = str(req.getUrl())
+ if not url_str: url_str = url
+
+ params = req.getParameters()
+ url_hash = self._get_url_hash(url, params)
+
+ if not bypass_dedup:
+ with self.url_lock:
+ if url_hash in self.processed_urls:
+ if task_id is not None: self.updateTask(task_id, "Skipped (Duplicate)")
+ self.updateStats("skipped_duplicate")
+ return
+ self.processed_urls.add(url_hash)
+
+ req_bytes = messageInfo.getRequest()
+ req_body = ""
+ try: req_body = self.helpers.bytesToString(req_bytes[req.getBodyOffset():])[:2000]
+ except: req_body = "[binary]"
+
+ req_hdrs = [str(h) for h in req.getHeaders()[:10]]
+
+ res_bytes = messageInfo.getResponse()
+ res_body = ""
+ try:
+ raw = self.helpers.bytesToString(res_bytes[res.getBodyOffset():])
+ res_body = self.smart_truncate(raw)
+ except: res_body = "[binary]"
+
+ res_hdrs = [str(h) for h in res.getHeaders()[:10]]
+ params_sample = [{"name": p.getName(), "value": p.getValue()[:150],
+ "type": str(p.getType())} for p in params[:5]]
+ idor_signals = self.extract_idor_signals(params_sample, url)
+
+ data = {"url": url, "method": req.getMethod(), "status": res.getStatusCode(),
+ "mime_type": res.getStatedMimeType(), "params_count": len(params),
+ "params_sample": params_sample, "request_headers": req_hdrs,
+ "request_body": req_body, "response_headers": res_hdrs,
+ "response_body": res_body, "idor_signals": idor_signals}
+
+ sig = self._get_request_signature(data)
+ cached = None if bypass_dedup else self._get_cached_findings(sig)
+
+ if cached is not None:
+ findings = cached
+ self.updateStats("cached_reused")
+ self.updateStats("analyzed")
+ self.log_to_console("[%s] CACHE HIT %s (%d findings)" % (source, url_str[:60], len(findings)))
+ else:
+ ai_text = self.ask_ai(self.build_prompt(data))
+ if not ai_text:
+ if task_id is not None: self.updateTask(task_id, "Error (No AI response)")
+ self.updateStats("errors"); return
+
+ self.updateStats("analyzed")
+ findings = self._parse_ai_response(ai_text)
+ if not findings:
+ if task_id is not None: self.updateTask(task_id, "Error (JSON parse)")
+ self.updateStats("errors"); return
+
+ self._store_cached_findings(sig, url, findings)
+
+ if not isinstance(findings, list): findings = [findings]
+
+ created = 0
+ for item in findings:
+ if not isinstance(item, dict): continue
+ title = item.get("title", "AI Finding")
+ severity = VALID_SEVERITIES.get(item.get("severity","information").lower().strip(), "Information")
+ ai_conf = item.get("confidence", 50)
+ try: ai_conf = int(ai_conf)
+ except: ai_conf = 50
+ cwe = item.get("cwe","")
+ burp_conf = map_confidence(ai_conf)
+ if not burp_conf:
+ self.updateStats("skipped_low_confidence"); continue
+
+ param_name = params_sample[0].get("name","") if params_sample else ""
+ fhash = self._get_finding_hash(url, title, cwe, param_name)
+ with self.findings_lock:
+ if fhash in self.findings_cache:
+ self.updateStats("skipped_duplicate"); continue
+ self.findings_cache[fhash] = True
+
+ # Build rich finding dict — this powers the detail panel
+ rich_finding = {
+ "discovered_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+ "url": url,
+ "title": title,
+ "severity": severity,
+ "confidence": burp_conf,
+ "detail": item.get("detail",""),
+ "cwe": cwe,
+ "owasp": item.get("owasp",""),
+ "remediation": item.get("remediation",""),
+ "evidence": item.get("evidence",""),
+ "param": item.get("param",""),
+ "affected_params": item.get("affected_params", []),
+ "exploit_path": item.get("exploit_path",""),
+ "exploit_steps": item.get("exploit_steps", []),
+ "poc_template": item.get("poc_template",""),
+ "poc_curl": item.get("poc_curl",""),
+ "poc_python": item.get("poc_python",""),
+ "business_impact": item.get("business_impact",""),
+ "cvss_score": item.get("cvss_score",""),
+ "references": item.get("references", []),
+ }
+ self.add_finding(rich_finding)
+
+ # Also add to Burp scanner
+ detail_html = self._build_burp_detail(rich_finding, params_sample)
+ issue = CustomScanIssue(messageInfo.getHttpService(), req.getUrl(),
+ [messageInfo], title, detail_html, severity, burp_conf)
+ self.callbacks.addScanIssue(issue)
+ self.updateStats("findings_created")
+ created += 1
+
+ self.log_to_console("[%s] %s → %d finding(s)" % (source, url_str[:60], created))
+ except Exception as e:
+ self.stderr.println("[!] _perform_analysis error: %s" % e)
+ self.updateStats("errors")
+
+ def _build_burp_detail(self, f, params_sample):
+ """Build HTML detail string for Burp's Issues panel."""
+ parts = ["Description: AI Confidence: %d%%" % f.get("ai_conf", 50))
+ if f.get("evidence"):
+ parts.append("Evidence: %s" % f["evidence"][:500])
+ if f.get("exploit_path"):
+ parts.append("Exploitation: %s " % s for s in f["exploit_steps"])
+ parts.append("%s " % steps)
+ if f.get("poc_curl"):
+ parts.append("PoC (curl): %s " % f["poc_curl"][:800])
+ if f.get("remediation"):
+ parts.append("Remediation: CWE: %s " % (cid, f["cwe"]))
+ if f.get("owasp"):
+ parts.append("OWASP: %s" % f["owasp"])
+ return "".join(parts)
+
+ # ─────────────────────────
+ # PROMPT (expanded for exploitation + PoC)
+ # ─────────────────────────
+ def build_prompt(self, data):
+ return (
+ "You are a senior penetration tester. Output ONLY a JSON array. NO markdown, NO text outside JSON.\n\n"
+ "Analyze the HTTP request/response below for ALL of:\n"
+ "1. OWASP Top 10 (2021) — SQLi, XSS, Broken Auth, etc.\n"
+ "2. IDOR / BOLA — numeric/UUID IDs in params, sequential IDs in paths\n"
+ "3. Mass Assignment — unexpected POST params not validated server-side\n"
+ "4. SSRF — URL/redirect/webhook params pointing to internal resources\n"
+ "5. JWT weaknesses — alg:none, HS256 weak secret, missing validation\n"
+ "6. GraphQL — introspection, batch abuse, __schema in body\n"
+ "7. OAuth/OIDC misconfigs — open redirect_uri, missing state, token leak\n"
+ "8. HTTP Request Smuggling — TE+CL conflicts, chunked encoding abuse\n"
+ "9. Cache Poisoning — X-Forwarded-Host, X-Original-URL, fat GET\n"
+ "10. Business Logic — price/qty tampering, role param, discount abuse\n"
+ "11. Information Disclosure — stack traces, secrets, internal IPs\n"
+ "12. Prototype Pollution — __proto__, constructor.prototype in JSON\n"
+ "13. Missing Security Headers — CSP, HSTS, X-Frame-Options absent\n"
+ "14. API Versioning — v1 vs v2 access control gaps\n\n"
+ "For each finding with confidence >= 50, output a JSON object with ALL fields:\n"
+ "{\n"
+ " \"title\": \"short vuln name\",\n"
+ " \"severity\": \"High|Medium|Low|Information\",\n"
+ " \"confidence\": 50-100,\n"
+ " \"detail\": \"technical description of the vulnerability\",\n"
+ " \"cwe\": \"CWE-XXX\",\n"
+ " \"owasp\": \"AXX:2021 Name\",\n"
+ " \"cvss_score\": \"7.5\",\n"
+ " \"param\": \"vulnerable_parameter_name\",\n"
+ " \"affected_params\": [\"param1\", \"param2\"],\n"
+ " \"evidence\": \"exact snippet from request/response proving the issue\",\n"
+ " \"exploit_path\": \"one-paragraph description of how an attacker exploits this\",\n"
+ " \"exploit_steps\": [\n"
+ " \"Step 1: Intercept the request to /api/users/123\",\n"
+ " \"Step 2: Change the numeric ID to another user's ID\",\n"
+ " \"Step 3: Observe the server returns another user's data\"\n"
+ " ],\n"
+ " \"poc_curl\": \"curl -X GET 'https://target.com/api/users/124' -H 'Authorization: Bearer '\",\n"
+ " \"poc_python\": \"import requests\\nrequests.get('https://target.com/api/users/124', headers={'Authorization': 'Bearer TOKEN'})\",\n"
+ " \"poc_template\": \"burp-style request with [INJECT] marker\",\n"
+ " \"business_impact\": \"what an attacker can achieve if exploited\",\n"
+ " \"remediation\": \"specific fix with code example if possible\",\n"
+ " \"references\": [\"https://owasp.org/...\", \"https://portswigger.net/...\"]\n"
+ "}\n\n"
+ "Rules:\n"
+ "- Output [] if no issues found with confidence >= 50\n"
+ "- Do NOT fabricate evidence — only report what is visible in the data\n"
+ "- exploit_steps must be concrete and actionable, not generic\n"
+ "- poc_curl must be a real runnable command using values from the request\n\n"
+ "HTTP Data:\n%s\n"
+ ) % json.dumps(data, indent=2)
+
+ # ─────────────────────────
+ # AI RESPONSE PARSING
+ # ─────────────────────────
+ def _parse_ai_response(self, ai_text):
+ ai_text = ai_text.strip()
+ import re
+ if ai_text.startswith("```"):
+ ai_text = re.sub(r'^```(?:json)?\n?|```$', '', ai_text, flags=re.MULTILINE).strip()
+ # Strip ... tags (DeepSeek)
+ ai_text = re.sub(r'.*? ', '', ai_text, flags=re.DOTALL).strip()
+
+ start = ai_text.find('[')
+ end = ai_text.rfind(']')
+ if start != -1 and end != -1:
+ try:
+ r = json.loads(ai_text[start:end+1])
+ return r if isinstance(r, list) else [r]
+ except: pass
+
+ obj_s = ai_text.find('{')
+ obj_e = ai_text.rfind('}')
+ if obj_s != -1 and obj_e != -1:
+ try:
+ r = json.loads('[' + ai_text[obj_s:obj_e+1] + ']')
+ return r if isinstance(r, list) else [r]
+ except: pass
+
+ return self._repair_json(ai_text)
+
+ def _repair_json(self, text):
+ try:
+ import re
+ text = re.sub(r',(\s*[}\]])', r'\1', text)
+ text = text.strip()
+ if not text.startswith('['):
+ s = text.find('{')
+ if s != -1: text = '[' + text[s:]
+ if not text.endswith(']'):
+ e = text.rfind('}')
+ if e != -1: text = text[:e+1] + ']'
+ return json.loads(text)
+ except:
+ return []
+
+ # ─────────────────────────
+ # AI PROVIDERS
+ # ─────────────────────────
+ def ask_ai(self, prompt):
+ try:
+ return {
+ "Ollama": self._ask_ollama,
+ "OpenAI": self._ask_openai,
+ "Claude": self._ask_claude,
+ "Gemini": self._ask_gemini,
+ "Azure Foundry":self._ask_azure_foundry,
+ }[self.AI_PROVIDER](prompt)
+ except KeyError:
+ self.stderr.println("[!] Unknown provider: %s" % self.AI_PROVIDER)
+ except Exception as e:
+ self.stderr.println("[!] AI error: %s" % e)
+ return None
+
+ def _ask_ollama(self, prompt):
+ url = self.API_URL.rstrip('/') + "/api/generate"
+ payload = {"model": self.MODEL, "prompt": prompt, "stream": False,
+ "format": "json", "options": {"temperature": 0.0, "num_predict": self.MAX_TOKENS}}
+ for attempt in range(3):
+ try:
+ req = urllib2.Request(url, data=json.dumps(payload).encode("utf-8"),
+ headers={"Content-Type": "application/json"})
+ resp = urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT)
+ data = json.loads(resp.read().decode("utf-8","ignore"))
+ text = data.get("response","").strip()
+ if data.get("done_reason") == "length":
+ text = self._fix_truncated(text)
+ return text
+ except urllib2.URLError as e:
+ if attempt < 2 and ("timed out" in str(e) or "timeout" in str(e).lower()):
+ self.stderr.println("[!] Timeout, retry %d/2" % (attempt+1)); time.sleep(2)
+ else: raise
+ return None
+
+ def _ask_openai(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/chat/completions",
+ data=json.dumps({"model": self.MODEL, "max_tokens": self.MAX_TOKENS, "temperature": 0.0,
+ "messages": [{"role":"user","content": prompt}]}).encode("utf-8"),
+ headers={"Content-Type":"application/json","Authorization":"Bearer "+self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["choices"][0]["message"]["content"]
+
+ def _ask_claude(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({"model": self.MODEL, "max_tokens": self.MAX_TOKENS,
+ "messages": [{"role":"user","content": prompt}]}).encode("utf-8"),
+ headers={"Content-Type":"application/json","x-api-key": self.API_KEY,
+ "anthropic-version":"2023-06-01"})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["content"][0]["text"]
+
+ def _ask_gemini(self, prompt):
+ req = urllib2.Request(
+ self.API_URL.rstrip('/') + "/models/%s:generateContent?key=%s" % (self.MODEL, self.API_KEY),
+ data=json.dumps({"contents":[{"parts":[{"text":prompt}]}],
+ "generationConfig":{"maxOutputTokens":self.MAX_TOKENS,"temperature":0.0}
+ }).encode("utf-8"),
+ headers={"Content-Type":"application/json"})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["candidates"][0]["content"]["parts"][0]["text"]
+
+ def _ask_azure_foundry(self, prompt):
+ if not self.API_KEY or not self.API_URL: raise Exception("Azure config incomplete")
+ base = self.API_URL.split('?',1)[0].rstrip('/')
+ chat_url = self._build_azure_url(base)
+ if "api-version=" not in chat_url:
+ sep = '&' if '?' in chat_url else '?'
+ chat_url += sep + "api-version=" + (self.AZURE_API_VERSION or "2024-06-01")
+ req = urllib2.Request(chat_url,
+ data=json.dumps({"messages":[{"role":"user","content":prompt}],
+ "max_tokens":self.MAX_TOKENS,"temperature":0.0}).encode("utf-8"),
+ headers={"Content-Type":"application/json","api-key":self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=self.AI_REQUEST_TIMEOUT).read())
+ return data["choices"][0]["message"]["content"]
+
+ def _build_azure_url(self, base):
+ if "/chat/completions" in base: return base
+ if "/openai/deployments/" in base: return base + "/chat/completions"
+ if not self.MODEL: raise Exception("Azure deployment name required in Model field")
+ return "%s/openai/deployments/%s/chat/completions" % (base, urllib.quote(self.MODEL, safe=''))
+
+ def _fix_truncated(self, text):
+ if not text: return "[]"
+ try: json.loads(text); return text
+ except: pass
+ e = text.rfind('}')
+ if e > 0:
+ p = text[:e+1]
+ if p.count('[') > p.count(']'):
+ try: json.loads(p+']'); return p+']'
+ except: pass
+ return "[]"
+
+ # ─────────────────────────
+ # CONNECTION TESTS
+ # ─────────────────────────
+ def test_ai_connection(self):
+ self.stdout.println("[CONN] Testing %s @ %s" % (self.AI_PROVIDER, self.API_URL))
+ try:
+ return {
+ "Ollama": self._test_ollama, "OpenAI": self._test_openai,
+ "Claude": self._test_claude, "Gemini": self._test_gemini,
+ "Azure Foundry": self._test_azure,
+ }[self.AI_PROVIDER]()
+ except KeyError:
+ self.stderr.println("[!] Unknown provider"); return False
+ except Exception as e:
+ self.stderr.println("[!] Connection failed: %s" % e); return False
+
+ def _test_ollama(self):
+ url = self.API_URL.rstrip('/api/generate').rstrip('/') + "/api/tags"
+ resp = urllib2.urlopen(urllib2.Request(url), timeout=10)
+ data = json.loads(resp.read())
+ if 'models' in data:
+ self.available_models = [m['name'] for m in data['models']]
+ self.stdout.println("[CONN] Ollama OK — %d models" % len(self.available_models))
+ if self.MODEL not in self.available_models and self.available_models:
+ self.MODEL = self.available_models[0]
+ return True
+ return False
+
+ def _test_openai(self):
+ if not self.API_KEY: self.stderr.println("[!] OpenAI key required"); return False
+ req = urllib2.Request("https://api.openai.com/v1/models",
+ headers={"Authorization":"Bearer "+self.API_KEY})
+ data = json.loads(urllib2.urlopen(req, timeout=10).read())
+ if 'data' in data:
+ self.available_models = [m['id'] for m in data['data'] if 'gpt' in m.get('id','')]
+ self.stdout.println("[CONN] OpenAI OK"); return True
+ return False
+
+ def _test_claude(self):
+ if not self.API_KEY: self.stderr.println("[!] Claude key required"); return False
+ try:
+ req = urllib2.Request(self.API_URL.rstrip('/') + "/messages",
+ data=json.dumps({"model": self.MODEL or "claude-3-5-sonnet-20241022",
+ "max_tokens":5,"messages":[{"role":"user","content":"ping"}]}).encode(),
+ headers={"Content-Type":"application/json","x-api-key":self.API_KEY,"anthropic-version":"2023-06-01"})
+ resp = urllib2.urlopen(req, timeout=10)
+ if resp.getcode() == 200:
+ self.available_models = ["claude-opus-4-6","claude-sonnet-4-6","claude-haiku-4-5-20251001"]
+ self.stdout.println("[CONN] Claude OK"); return True
+ except urllib2.HTTPError as e:
+ if e.code == 429:
+ self.stdout.println("[CONN] Claude OK (rate-limited)"); return True
+ raise
+ return False
+
+ def _test_gemini(self):
+ if not self.API_KEY: self.stderr.println("[!] Gemini key required"); return False
+ self.available_models = ["gemini-1.5-pro","gemini-1.5-flash","gemini-pro"]
+ self.stdout.println("[CONN] Gemini configured"); return True
+
+ def _test_azure(self):
+ if not self.API_KEY or not self.API_URL: self.stderr.println("[!] Azure config incomplete"); return False
+ self.available_models = [self.MODEL] if self.MODEL else []
+ self.stdout.println("[CONN] Azure Foundry configured"); return True
+
+ # ─────────────────────────
+ # UTILITY
+ # ─────────────────────────
+ def smart_truncate(self, body, max_len=5000):
+ if len(body) <= max_len: return body
+ head, tail = 3500, 1000
+ trunc = len(body) - head - tail
+ return body[:head] + "\n...[%d chars truncated]...\n" % trunc + body[-tail:]
+
+ def extract_idor_signals(self, params_sample, url):
+ signals = []
+ try:
+ import re
+ IDOR_NAMES = {'id','user_id','account_id','order_id','invoice_id','file_id',
+ 'doc_id','record_id','item_id','uid','pid','customer_id','profile_id','ref'}
+ path_ids = re.findall(r'/(\d{1,10})(?:/|$|\?)', str(url))
+ if path_ids: signals.append({"type":"path_numeric_id","values":path_ids[:3]})
+ if re.search(r'[0-9a-f-]{36}', str(url), re.I): signals.append({"type":"path_uuid"})
+ for p in params_sample:
+ v = p.get("value",""); n = p.get("name","")
+ if re.match(r'^\d+$', v) and len(v) <= 10:
+ signals.append({"type":"numeric_param","name":n,"value":v})
+ elif re.match(r'^[0-9a-f-]{36}$', v, re.I):
+ signals.append({"type":"uuid_param","name":n})
+ elif n.lower() in IDOR_NAMES:
+ signals.append({"type":"idor_name_match","name":n,"value":v[:20]})
+ except: pass
+ return signals
+
+ def print_logo(self):
+ self.stdout.println("=" * 60)
+ self.stdout.println(" SILENTCHAIN AI v%s — Community Edition" % self.VERSION)
+ self.stdout.println(" Dark terminal UI | Exploitation paths | PoC templates")
+ self.stdout.println(" Provider: %s | Model: %s" % (self.AI_PROVIDER, self.MODEL))
+ self.stdout.println("=" * 60)