Dockerfile

FROM golang:1.24-bookworm AS go-builder

# Install Go-based security tools
RUN go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest && \
    go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest && \
    go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
    go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest && \
    go install -v github.com/ffuf/ffuf/v2@latest && \
    go install -v github.com/hahwul/dalfox/v2@latest && \
    go install -v github.com/lc/gau/v2/cmd/gau@latest && \
    go install -v github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest

# Build nosqli from source (no go install path available)
RUN git clone --depth 1 https://github.com/Charlie-belmer/nosqli.git /tmp/nosqli && \
    cd /tmp/nosqli && go build -o /go/bin/nosqli . && \
    rm -rf /tmp/nosqli

# ---

FROM python:3.12-slim-bookworm

# Install system dependencies and security tools available via apt
RUN apt-get update && apt-get install -y --no-install-recommends \
    nmap \
    curl \
    git \
    dnsutils \
    jq \
    ruby \
    ruby-dev \
    build-essential \
    libssl-dev \
    zlib1g-dev \
    procps \
    bsdmainutils \
    ca-certificates \
    libnet-ssleay-perl \
    hydra \
    && rm -rf /var/lib/apt/lists/*

# Install nikto from source (not available in bookworm slim repos)
RUN git clone --depth 1 https://github.com/sullo/nikto.git /opt/nikto && \
    ln -s /opt/nikto/program/nikto.pl /usr/local/bin/nikto && \
    chmod +x /opt/nikto/program/nikto.pl

# Install whatweb from source (gem not available in all repos)
RUN git clone --depth 1 https://github.com/urbanadventurer/WhatWeb.git /opt/whatweb && \
    cd /opt/whatweb && gem install bundler --no-document && bundle install --without development test 2>/dev/null || \
    gem install addressable json --no-document && \
    ln -s /opt/whatweb/whatweb /usr/local/bin/whatweb && \
    chmod +x /opt/whatweb/whatweb

# Install testssl.sh
RUN git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh && \
    ln -s /opt/testssl.sh/testssl.sh /usr/local/bin/testssl

# Install Python-based security tools (PyPI packages)
# setuptools<78 is needed for pkg_resources (required by google-cloud-dns used by dnsreaper)
RUN pip install --no-cache-dir \
    'setuptools<78' \
    sqlmap \
    arjun \
    commix \
    wapiti3 \
    corscanner

# Install jwt_tool
RUN pip install --no-cache-dir jwt_tool || \
    (git clone --depth 1 https://github.com/ticarpi/jwt_tool.git /opt/jwt_tool && \
     pip install --no-cache-dir -r /opt/jwt_tool/requirements.txt && \
     ln -s /opt/jwt_tool/jwt_tool.py /usr/local/bin/jwt_tool && \
     chmod +x /opt/jwt_tool/jwt_tool.py)

# Install graphql-cop from source (not on PyPI)
RUN git clone --depth 1 https://github.com/dolevf/graphql-cop.git /opt/graphql-cop && \
    pip install --no-cache-dir -r /opt/graphql-cop/requirements.txt && \
    ln -s /opt/graphql-cop/graphql-cop.py /usr/local/bin/graphql-cop && \
    chmod +x /opt/graphql-cop/graphql-cop.py

# Install SSTImap from source
RUN git clone --depth 1 https://github.com/vladko312/SSTImap.git /opt/sstimap && \
    pip install --no-cache-dir -r /opt/sstimap/requirements.txt && \
    ln -s /opt/sstimap/sstimap.py /usr/local/bin/sstimap && \
    chmod +x /opt/sstimap/sstimap.py

# Install SSRFmap from source
RUN git clone --depth 1 https://github.com/swisskyrepo/SSRFmap.git /opt/ssrfmap && \
    pip install --no-cache-dir -r /opt/ssrfmap/requirements.txt && \
    ln -s /opt/ssrfmap/ssrfmap.py /usr/local/bin/ssrfmap && \
    chmod +x /opt/ssrfmap/ssrfmap.py

# Install smuggler from source (no pip dependencies)
RUN git clone --depth 1 https://github.com/defparam/smuggler.git /opt/smuggler && \
    ln -s /opt/smuggler/smuggler.py /usr/local/bin/smuggler && \
    chmod +x /opt/smuggler/smuggler.py

# Install dnsreaper from source (not on PyPI)
# Note: dnsreaper pins dnspython==2.2.1 but wapiti3 needs >=2.6. Install without strict pins.
RUN git clone --depth 1 https://github.com/punk-security/dnsReaper.git /opt/dnsreaper && \
    pip install --no-cache-dir -r /opt/dnsreaper/requirements.txt 2>/dev/null || \
    pip install --no-cache-dir asyncwhois boto3 cloudflare azure-mgmt-dns azure-identity msrestazure google-cloud-dns aiohttp && \
    ln -s /opt/dnsreaper/main.py /usr/local/bin/dnsreaper && \
    chmod +x /opt/dnsreaper/main.py

# Install Playwright + Chromium for headless browser authentication
# Enables automated login for JavaScript-rendered auth pages (Auth0, Keycloak themes, etc.)
RUN pip install --no-cache-dir playwright && \
    playwright install chromium --with-deps

# Install pre-built binaries: websocat and feroxbuster
RUN ARCH=$(dpkg --print-architecture) && \
    if [ "$ARCH" = "amd64" ]; then \
        WEBSOCAT_TARGET="x86_64-unknown-linux-musl"; \
        curl -sL "https://github.com/vi/websocat/releases/download/v1.14.1/websocat.${WEBSOCAT_TARGET}" \
             -o /usr/local/bin/websocat && \
        chmod +x /usr/local/bin/websocat && \
        curl -sL "https://github.com/epi052/feroxbuster/releases/download/v2.13.1/x86_64-linux-feroxbuster.tar.gz" \
             | tar -xz -C /usr/local/bin && \
        chmod +x /usr/local/bin/feroxbuster; \
    elif [ "$ARCH" = "arm64" ]; then \
        WEBSOCAT_TARGET="aarch64-unknown-linux-musl"; \
        curl -sL "https://github.com/vi/websocat/releases/download/v1.14.1/websocat.${WEBSOCAT_TARGET}" \
             -o /usr/local/bin/websocat && \
        chmod +x /usr/local/bin/websocat && \
        curl -sL "https://github.com/epi052/feroxbuster/releases/download/v2.13.1/aarch64-linux-feroxbuster.zip" \
             -o /tmp/feroxbuster.zip && \
        apt-get update && apt-get install -y --no-install-recommends unzip && \
        unzip -o /tmp/feroxbuster.zip -d /usr/local/bin && \
        chmod +x /usr/local/bin/feroxbuster && \
        rm /tmp/feroxbuster.zip && apt-get remove -y unzip && rm -rf /var/lib/apt/lists/*; \
    else \
        echo "Unsupported architecture: $ARCH" && exit 1; \
    fi

# Copy Go binaries from builder stage
COPY --from=go-builder /go/bin/nuclei /usr/local/bin/
COPY --from=go-builder /go/bin/httpx /usr/local/bin/
COPY --from=go-builder /go/bin/katana /usr/local/bin/
COPY --from=go-builder /go/bin/subfinder /usr/local/bin/
COPY --from=go-builder /go/bin/ffuf /usr/local/bin/
COPY --from=go-builder /go/bin/dalfox /usr/local/bin/
COPY --from=go-builder /go/bin/gau /usr/local/bin/
COPY --from=go-builder /go/bin/crlfuzz /usr/local/bin/
COPY --from=go-builder /go/bin/nosqli /usr/local/bin/

# Install uv for the WSTG MCP server
RUN pip install --no-cache-dir uv

# Create directory for Burp CA certificate
RUN mkdir -p /usr/local/share/ca-certificates/burp

# Script to import Burp CA cert if provided
RUN echo '#!/bin/bash\n\
if [ -f /app/burp-ca.der ]; then\n\
    openssl x509 -inform DER -in /app/burp-ca.der -out /usr/local/share/ca-certificates/burp/burp-ca.crt 2>/dev/null\n\
    update-ca-certificates 2>/dev/null\n\
    echo "[+] Burp CA certificate imported"\n\
elif [ -f /app/burp-ca.crt ]; then\n\
    cp /app/burp-ca.crt /usr/local/share/ca-certificates/burp/burp-ca.crt\n\
    update-ca-certificates 2>/dev/null\n\
    echo "[+] Burp CA certificate imported"\n\
fi' > /usr/local/bin/import-burp-ca && chmod +x /usr/local/bin/import-burp-ca

# Set up working directory
WORKDIR /app

# Copy project files
COPY . .

# Install MCP server dependencies
RUN cd server && uv sync

# Update nuclei templates
RUN nuclei -update-templates -silent 2>/dev/null || true

# Verify all tools are installed (check binary exists + print version)
RUN echo "=== Tool Verification ===" && \
    echo "--- Original 15 tools ---" && \
    command -v nuclei && nuclei -version 2>&1 | head -1 && \
    command -v httpx && \
    command -v katana && \
    command -v ffuf && ffuf -V 2>&1 | head -1 && \
    command -v subfinder && \
    command -v dalfox && dalfox version 2>&1 | head -1 && \
    command -v gau && \
    command -v sqlmap && sqlmap --version 2>&1 | head -1 && \
    command -v nikto && nikto -Version 2>&1 | head -1 && \
    command -v nmap && nmap --version 2>&1 | head -1 && \
    command -v testssl && \
    command -v whatweb && \
    command -v arjun && \
    command -v commix && \
    echo "--- New 12 tools ---" && \
    command -v crlfuzz && crlfuzz -version 2>&1 | head -1 && \
    command -v nosqli && \
    command -v websocat && websocat --version 2>&1 | head -1 && \
    command -v feroxbuster && feroxbuster --version 2>&1 | head -1 && \
    command -v graphql-cop && \
    command -v sstimap && \
    command -v ssrfmap && \
    command -v smuggler && \
    command -v wapiti && wapiti --version 2>&1 | head -1 && \
    command -v hydra && hydra -h 2>&1 | head -3 && \
    command -v corscanner 2>/dev/null || command -v cors_scan && \
    command -v dnsreaper && \
    echo "--- Browser automation ---" && \
    python3 -c "from playwright.sync_api import sync_playwright; print('[+] playwright: installed')" && \
    echo "[+] All 27 tools + Playwright installed successfully"

# Burp proxy config — env vars applied at RUNTIME only (after all build-time downloads)
# Uses host.docker.internal to reach Burp on the host from inside the container.
# On macOS/Windows Docker Desktop, host.docker.internal resolves to the host IP automatically.
# On Linux, the install script adds --add-host host.docker.internal:host-gateway.
ENV BURP_PROXY_HOST=host.docker.internal
ENV BURP_PROXY_PORT=8080
ENV HTTP_PROXY=http://host.docker.internal:8080
ENV HTTPS_PROXY=http://host.docker.internal:8080
ENV http_proxy=http://host.docker.internal:8080
ENV https_proxy=http://host.docker.internal:8080
# Don't proxy requests to localhost (for tools that talk to local services)
ENV NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal
ENV no_proxy=localhost,127.0.0.1,::1,host.docker.internal

# Default: keep container alive for `docker exec` usage
CMD ["sleep", "infinity"]