Merge pull request #30 from h0tak88r/testing

Testing

Author: h0tak88r

Dockerfile

@@ -1,5 +1,5 @@
 # --- Builder stage: install Go-based security tools and build AutoAR bot ---
-FROM golang:1.26-bookworm AS builder
+FROM golang:1.25-bookworm AS builder
 
 WORKDIR /app
 
@@ -78,6 +78,7 @@ RUN curl -L https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts
 # Copy minimal application configuration and assets (source not required at runtime)
 COPY regexes/ ./regexes/
 COPY templates/ ./templates/
+COPY web/static/data/ ./web/static/data/
 COPY autoar.sample.yaml ./
 COPY env.example ./
 

README.md

@@ -21,35 +21,35 @@ Results are automatically uploaded to **Cloudflare R2 storage** and linked direc
 ![Dashboard](image.png)
 ---
 
-## ✨ Feature Highlights
+##  Feature Highlights
 
 
 | Category               | What AutoAR Does                                                                                                                       |
 | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| 🌐 **Subdomains**      | Enumerate using 15+ sources: Subfinder, CertSpotter, SecurityTrails, Chaos, crt.sh, OTX, VirusTotal, and more                          |
-| 🔍 **Live Hosts**      | Detect alive hosts using httpx with follow-redirects and status detection                                                              |
-| 🕳️ **DNS Takeovers**  | Detect CNAME, NS, Azure/AWS cloud, DNSReaper, dangling-IP, and **CF-1016 Cloudflare dangling record** vulnerabilities                  |
-| 💥 **Nuclei Scanning** | Automated vulnerability scanning using Nuclei templates with rate limiting                                                             |
-| 🧠 **Zero-Days**       | Smart scan configured for detected tech stacks — finds active CVEs                                                                     |
-| ☁️ **S3 Buckets**      | Enumerate and scan AWS S3 buckets for exposure and misconfig                                                                           |
-| 🔗 **JavaScript**      | Extract secrets, API endpoints, auth tokens from JS files                                                                              |
-| 🐙 **GitHub Recon**    | Org-level and repo-level scanning for secrets, dependency confusion                                                                    |
-| 📱 **APK Auditor**     | Browser-based Android analysis: DEX decompiler, manifest + cert parsing, tracker detection, MASVS mapping, and regex-driven findings with APX secret patterns. (Based on [apkauditor](https://github.com/thecybersandeep/apkauditor) by @thecybersandeep) |
-| 🔒 **MITM Patch**      | Fetch any Android app by Package ID → auto-patch `network_security_config.xml` → re-sign → R2 download link in one click             |
-| 📱 **IPA Auditor**     | Browser-based iOS IPA analysis: plist + Mach-O inspection, binary strings extraction, and findings tab powered by 200+ regex signatures plus MASVS-style rules. (Based on [ipaauditor](https://github.com/thecybersandeep/ipaauditor) by @thecybersandeep) |
-| 🖥️ **ADB Auditor**    | Browser-based ADB security tool: USB device inspection, app enumeration, logcat tailing, file pull, activity launching. (Based on [adbauditor](https://github.com/thecybersandeep/adbauditor) by @thecybersandeep) |
-| ⚙️ **Misconfigs**      | 100+ service misconfiguration checks                                                                                                   |
-| 🏴‍☠️ **BB Scope**     | Fetch scope from HackerOne, Bugcrowd, Intigriti, YesWeHack (token), Immunefi — CLI & **dashboard Targets page**                       |
-| 🔄 **Monitoring**      | Subdomain + URL change monitoring daemon with Discord alerts & DB history                                                              |
-| 🤖 **AI Agent**        | Full AI hunt loop (CLI + Discord `/ai` & `/brain`) — powered by **z-ai/glm-4.5-air:free via OpenRouter** — zero cost required          |
-| 📤 **R2 Storage**      | Auto-upload every non-empty result file to Cloudflare R2 and print the public URL                                                      |
-| 🔔 **Smart Alerts**    | Rich Discord notifications for zero-findings scans — no more empty files or spam                                                       |
-| 🖥️ **Web dashboard**  | **v4.1+** — Stats, scans, domains, monitors, R2 browser, Targets, APK/IPA/ADB Auditors, MITM remote scan, CF-1016 findings             |
+|  **Subdomains**      | Enumerate using 15+ sources: Subfinder, CertSpotter, SecurityTrails, Chaos, crt.sh, OTX, VirusTotal, and more                          |
+|  **Live Hosts**      | Detect alive hosts using httpx with follow-redirects and status detection                                                              |
+|  **DNS Takeovers**  | Detect CNAME, NS, Azure/AWS cloud, DNSReaper, dangling-IP, and **CF-1016 Cloudflare dangling record** vulnerabilities                  |
+|  **Nuclei Scanning** | Automated vulnerability scanning using Nuclei templates with rate limiting                                                             |
+|  **Zero-Days**       | Smart scan configured for detected tech stacks — finds active CVEs                                                                     |
+|  **S3 Buckets**      | Enumerate and scan AWS S3 buckets for exposure and misconfig                                                                           |
+|  **JavaScript**      | Extract secrets, API endpoints, auth tokens from JS files                                                                              |
+|  **GitHub Recon**    | Org-level and repo-level scanning for secrets, dependency confusion                                                                    |
+|  **APK Auditor**     | Browser-based Android analysis: DEX decompiler, manifest + cert parsing, tracker detection, MASVS mapping, and regex-driven findings with APX secret patterns. (Based on [apkauditor](https://github.com/thecybersandeep/apkauditor) by @thecybersandeep) |
+|  **MITM Patch**      | Fetch any Android app by Package ID → auto-patch `network_security_config.xml` → re-sign → R2 download link in one click             |
+|  **IPA Auditor**     | Browser-based iOS IPA analysis: plist + Mach-O inspection, binary strings extraction, and findings tab powered by 200+ regex signatures plus MASVS-style rules. (Based on [ipaauditor](https://github.com/thecybersandeep/ipaauditor) by @thecybersandeep) |
+|  **ADB Auditor**    | Browser-based ADB security tool: USB device inspection, app enumeration, logcat tailing, file pull, activity launching. (Based on [adbauditor](https://github.com/thecybersandeep/adbauditor) by @thecybersandeep) |
+|  **Misconfigs**      | 100+ service misconfiguration checks                                                                                                   |
+|  **BB Scope**     | Fetch scope from HackerOne, Bugcrowd, Intigriti, YesWeHack (token), Immunefi — CLI & **dashboard Targets page**                       |
+|  **Monitoring**      | Subdomain + URL change monitoring daemon with Discord alerts & DB history                                                              |
+|  **AI Agent**        | Full AI hunt loop (CLI + Discord `/ai` & `/brain`) — powered by **z-ai/glm-4.5-air:free via OpenRouter** — zero cost required          |
+|  **R2 Storage**      | Auto-upload every non-empty result file to Cloudflare R2 and print the public URL                                                      |
+|  **Smart Alerts**    | Rich Discord notifications for zero-findings scans — no more empty files or spam                                                       |
+|  **Web dashboard**  | **v4.1+** — Stats, scans, domains, monitors, R2 browser, Targets, APK/IPA/ADB Auditors, MITM remote scan, CF-1016 findings             |
 
 
 ---
 
-## 🗂️ Complete Command Reference
+##  Complete Command Reference
 
 ### Workflows (Start Here)
 
@@ -236,8 +236,8 @@ What happens:
 2. *(Optional)* Patches `network_security_config.xml` to trust user-installed CAs + disables certificate pinning
 3. Re-signs with `uber-apk-signer` and uploads the patched APK to R2
 4. Shows a **download panel** in the Auditor UI with direct R2 links for:
-   - 📦 Original APK
-   - 🔒 MITM Patched APK (if requested)
+   -  Original APK
+   -  MITM Patched APK (if requested)
 5. Automatically loads the APK into the browser auditor for analysis
 
 > **Scan records from APK Auditor are hidden from the main Scans dashboard** — they exist only within the Auditor context.
@@ -297,13 +297,13 @@ Options:
   -o <output>        Save output to a file
 ```
 
-**Dashboard — 🎯 Targets page:**
+**Dashboard —  Targets page:**
 
 The web dashboard includes a dedicated **Targets** page (sidebar → Targets) that:
 - Shows color-coded cards for each platform with credential status
 - Lets you paste credentials or relies on env vars (`H1_TOKEN`, `BUGCROWD_TOKEN`, `YWH_TOKEN`, `INTIGRITI_TOKEN`)
 - Fetches all in-scope root domains with one click
-- Provides per-domain **+ Add** (saves to Domains DB) and **▶ Scan** (opens new scan)
+- Provides per-domain **+ Add** (saves to Domains DB) and **> Scan** (opens new scan)
 - **+ Add All** saves all domains in one bulk request
 - **Copy List** copies to clipboard (works on both HTTP and HTTPS)
 
@@ -350,7 +350,7 @@ autoar status [--json]
 
 ---
 
-## 🤖 AI-Driven Security Framework — Free for Everyone
+##  AI-Driven Security Framework — Free for Everyone
 
 As of the latest release, AutoAR's AI engine runs on `**[stepfun/step-3.5-flash:free](https://openrouter.ai/stepfun/step-3.5-flash:free)**` via [OpenRouter](https://openrouter.ai). This is a **completely free model** — no credits, no billing required.
 
@@ -415,7 +415,7 @@ autoar both                Start Discord bot + API server simultaneously
 
 ---
 
-## 🛠️ Installation
+##  Installation
 
 ### Option 1 — Docker (Primary & Recommended)
 
@@ -475,7 +475,7 @@ go install github.com/h0tak88r/AutoAR/cmd/autoar@latest
 
 ---
 
-## ⚙️ Configuration
+##  Configuration
 
 Copy `.env.example` to `.env` and fill in your values:
 
@@ -558,7 +558,7 @@ H1_API_KEY=...           # HackerOne
 INTEGRITI_API_KEY=...    # Intigriti
 
 # AI analysis — only ONE key is needed
-# ✅ Recommended: OpenRouter free tier (no credit card required)
+#  Recommended: OpenRouter free tier (no credit card required)
 #    Sign up at https://openrouter.ai · Uses stepfun/step-3.5-flash:free automatically
 OPENROUTER_API_KEY=...   # Powers /ai, /brain, and `autoar agent` — completely free
 
@@ -588,7 +588,7 @@ AUTOAR_TIMEOUT_NUCLEI=0
 
 ---
 
-## 🚀 Quick Start (Docker)
+##  Quick Start (Docker)
 
 ```bash
 # 1. Setup
@@ -607,7 +607,7 @@ docker compose run --rm autoar-api domain run -d example.com
 
 ---
 
-## 📂 Results Directory Structure
+##  Results Directory Structure
 
 All scan results are saved to `./new-results/` and automatically uploaded to R2 if configured:
 
@@ -637,13 +637,13 @@ new-results/
 When **R2 is enabled**, each file is uploaded immediately after writing and the URL is printed:
 
 ```
-🔗 R2 Result: new-results/example.com/subs/subdomains.txt
+ R2 Result: new-results/example.com/subs/subdomains.txt
    URL: https://pub-xxxx.r2.dev/new-results/example.com/subs/subdomains.txt
 ```
 
 ---
 
-## 🤖 CoPaw AI Integration
+##  CoPaw AI Integration
 
 AutoAR is designed to work seamlessly with **CoPaw** AI assistant, enabling natural language control of your entire recon pipeline:
 
@@ -657,9 +657,9 @@ See the [CoPaw AutoAR Skill documentation](/blob/main/docs/copaw-skill.md) for f
 
 ---
 
-## 🐳 Docker & Compose Deep Dive
+##  Docker & Compose Deep Dive
 
-### 🏗️ Architecture & Internal Structure (v4.1+)
+###  Architecture & Internal Structure (v4.1+)
 
 AutoAR follows a strictly decoupled, package-based architecture designed for enterprise scaling and clean dependency management:
 
@@ -728,7 +728,7 @@ OPENROUTER_API_KEY=...
 
 ---
 
-## 🗄️ Database
+##  Database
 
 AutoAR supports two databases:
 
@@ -757,7 +757,7 @@ DB_HOST=./bughunt.db
 
 ---
 
-## 🔧 Troubleshooting
+##  Troubleshooting
 
 ### No Terminal Logs?
 
@@ -804,7 +804,7 @@ For PostgreSQL, ensure:
 
 ---
 
-## 🏷️ GitHub release (tag → CI)
+##  GitHub release (tag → CI)
 
 Versions are defined once in `[internal/version/version.go](internal/version/version.go)` (`Version`, no `v` prefix). To publish **v4.2.0**:
 
@@ -820,7 +820,7 @@ You need a Git remote with push access (HTTPS + token or SSH). No manual “Crea
 
 ---
 
-## 🤝 Contributing
+##  Contributing
 
 Contributions are welcome! Please:
 
@@ -831,21 +831,21 @@ Contributions are welcome! Please:
 
 ---
 
-## ⚠️ Legal Disclaimer
+##  Legal Disclaimer
 
 AutoAR is intended for **authorized security testing only**. Only use it on targets where you have explicit written permission, or on bug bounty programs where the target is in-scope. Unauthorized scanning of systems you do not own is illegal.
 
 The authors of AutoAR assume no liability for misuse of this tool.
 
 ---
 
-## 📄 License
+##  License
 
 MIT License — see [LICENSE](LICENSE) for details.
 
 ---
 
 
 
-Built with ❤️ for the bug bounty community · [GitHub](https://github.com/h0tak88r/AutoAR)
+Built with  for the bug bounty community · [GitHub](https://github.com/h0tak88r/AutoAR)
 

entrypoint

@@ -51,6 +51,37 @@ var (
 	resourceLimitsOnce   sync.Once
 )
 
+// safeEnvPrefixes lists environment variable prefixes that are safe to
+// pass through to child processes. Everything else is stripped to
+// prevent leaking secrets (API keys, tokens, passwords) via the
+// environment.
+var safeEnvPrefixes = []string{
+	"HOME=", "USER=", "LOGNAME=", "PATH=", "PWD=", "SHELL=", "TERM=", "LANG=", "LC_", "TZ=",
+	"GOPATH=", "GOROOT=", "GOPROXY=", "GOMODCACHE=", "GOFLAGS=",
+	"AUTOAR_", "DOCKER_", "KUBERNETES_",
+	"SSL_CERT_FILE=", "SSL_CERT_DIR=",
+	"HTTP_PROXY=", "HTTPS_PROXY=", "NO_PROXY=", "http_proxy=", "https_proxy=", "no_proxy=",
+}
+
+// sanitizeEnv filters os.Environ() to only keep safe variables and appends
+// the given key=value pair(s). This prevents secrets from leaking into child
+// processes.
+func sanitizeEnv(parentEnv []string, extra ...string) []string {
+	out := make([]string, 0, len(safeEnvPrefixes)+len(extra))
+	for _, ev := range parentEnv {
+		for _, prefix := range safeEnvPrefixes {
+			if len(ev) >= len(prefix) && ev[:len(prefix)] == prefix {
+				out = append(out, ev)
+				break
+			}
+		}
+	}
+	for _, e := range extra {
+		out = append(out, e)
+	}
+	return out
+}
+
 func scanResultSizeBytes(r *ScanResult) int64 {
 	if r == nil {
 		return 0
@@ -470,6 +501,9 @@ func SetupAPI() *gin.Engine {
 	r.GET("/scans", serveDashboardUI)
 	r.GET("/scans/*filepath", serveDashboardUI)
 
+	// Static data files (JSON reference tables)
+	r.GET("/static/data/*filepath", serveStaticData)
+
 	// Public: SPA reads these before login (no JWT).
 	r.GET("/api/config", apiConfigHandler)
 	r.POST("/api/settings", auth, apiUpdateSettingsHandler)
@@ -1394,9 +1428,7 @@ func executeScan(scanID string, command []string, scanType string) {
 	utils.SendScanNotification("start", scanID, target, scanType, "running", 0)
 
 	cmd := exec.Command(command[0], command[1:]...)
-	cmd.Env = append(os.Environ(),
-		fmt.Sprintf("AUTOAR_CURRENT_SCAN_ID=%s", scanID),
-	)
+	cmd.Env = sanitizeEnv(os.Environ(), "AUTOAR_CURRENT_SCAN_ID", scanID)
 	// Put the child in its own process group so that SIGTERM/SIGKILL can be
 	// sent to the whole tree (not just the direct child) on cancel.
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}

internal/api/api.go

@@ -1,29 +1,45 @@
 package api
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"fmt"
 	"net/http"
 	"os"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 )
 
+var (
+	localAuthSecret     []byte
+	localAuthSecretOnce sync.Once
+)
+
 // localAuthJWTSecret returns the HS256 signing secret for local JWTs.
 // Uses AUTOAR_JWT_SECRET; falls back to DASHBOARD_PASSWORD so a single
 // credential env-var is sufficient for simple setups.
+// If neither is set, generates a random 32-byte key that lasts for the
+// lifetime of the process.
 func localAuthJWTSecret() []byte {
 	if s := strings.TrimSpace(os.Getenv("AUTOAR_JWT_SECRET")); s != "" {
 		return []byte(s)
 	}
-	// Fallback — combined so it's hard to brute-force even with known password.
 	pw := strings.TrimSpace(os.Getenv("DASHBOARD_PASSWORD"))
 	if pw != "" {
 		return []byte("autoar-local-auth-" + pw)
 	}
-	return []byte("autoar-local-auth-insecure-default")
+	localAuthSecretOnce.Do(func() {
+		key := make([]byte, 32)
+		if _, err := rand.Read(key); err != nil {
+			panic("failed to generate local auth secret: " + err.Error())
+		}
+		localAuthSecret = []byte(hex.EncodeToString(key))
+	})
+	return localAuthSecret
 }
 
 // localAuthEnabled returns true when DASHBOARD_USER and DASHBOARD_PASSWORD are set.

internal/api/local_auth.go

@@ -189,7 +189,9 @@ func RunScanInProcess(scanID, scanType, target string, fn func() error) {
 
 	// Give SSE clients a moment to drain, then close the bus for this scan.
 	go func() {
-		time.Sleep(5 * time.Second)
-		globalLogBus.Close(scanID)
+		select {
+		case <-time.After(5 * time.Second):
+			globalLogBus.Close(scanID)
+		}
 	}()
 }

internal/api/scan_runner.go

@@ -83,11 +83,15 @@ func CancelScanByID(id string) error {
 			_ = scan.ExecCmd.Process.Signal(syscall.SIGTERM)
 		}
 		go func() {
-			time.Sleep(2 * time.Second)
-			if pgidErr == nil {
-				_ = syscall.Kill(-pgid, syscall.SIGKILL)
-			} else {
-				_ = scan.ExecCmd.Process.Kill()
+			timer := time.NewTimer(2 * time.Second)
+			defer timer.Stop()
+			select {
+			case <-timer.C:
+				if pgidErr == nil {
+					_ = syscall.Kill(-pgid, syscall.SIGKILL)
+				} else {
+					_ = scan.ExecCmd.Process.Kill()
+				}
 			}
 		}()
 	}