pekko-dast/.env.example at main · hanishi/pekko-dast · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# pekko-dast configuration — copy this file to `.env` and fill in real values.
#
#   cp .env.example .env
#
# DastConfig reads `.env` as KEY=VALUE (resolution order: real env var, then
# .env, then JVM -D property), so no `export` is needed. `.env` itself is
# gitignored — never commit real keys. All values below are PLACEHOLDERS.

# ──────────────────────────────────────────────────────────────────────────
# LLM provider (the planners that direct XSS / IDOR / navigation)
# ──────────────────────────────────────────────────────────────────────────
# Which API the LLM-directed steps call: anthropic (default) | openai | gemini.
# Without a key the LLM steps fail closed and are skipped; deterministic checks
# (headers, cookies, SQLi, SSRF, spec-driven access control) still run.
DAST_LLM_PROVIDER=anthropic

# --- Anthropic (default provider) ---
ANTHROPIC_API_KEY=sk-ant-REPLACE_ME
# Default claude-sonnet-4-6: catches the cross-account IDOR step at ~1/5 of
# Opus's cost (cheaper Haiku tiers were seen to miss it). Override for max
# reasoning (claude-opus-4-8) or lower cost.
# ANTHROPIC_MODEL=claude-sonnet-4-6

# --- OpenAI (only when DAST_LLM_PROVIDER=openai) ---
# OPENAI_API_KEY=sk-proj-REPLACE_ME
# OPENAI_MODEL=gpt-4o

# --- Gemini (only when DAST_LLM_PROVIDER=gemini) ---
# GEMINI_API_KEY=REPLACE_ME
# Thinking tiers (e.g. gemini-2.5-pro / -flash) are supported; default is the
# non-thinking flash. Cheap tiers may miss the cross-account IDOR.
# GEMINI_MODEL=gemini-2.0-flash

# ──────────────────────────────────────────────────────────────────────────
# Authorization — REQUIRED for any active probing
# ──────────────────────────────────────────────────────────────────────────
# Comma-separated hosts you are authorized to ACTIVELY probe. Leave empty and
# every run is observe-only (capture + security headers; no XSS/SQLi/IDOR/etc).
# Only add hosts you have explicit permission to test.
DAST_AUTHORIZED_HOSTS=

# Base URL of an out-of-band listener the target can call back to. Required for
# SSRF detection; unset = SSRF skipped (no guessing).
# DAST_OAST_BASE_URL=http://your-oast-listener:8000

# ──────────────────────────────────────────────────────────────────────────
# Output (both opt-in, off when unset)
# ──────────────────────────────────────────────────────────────────────────
# JSON-Lines evidence transcript: every target HTTP request + verdict.
# DAST_EVIDENCE_FILE=/tmp/dast-evidence.jsonl
# Self-contained HTML report (findings + evidence) you can open or share.
# DAST_REPORT_FILE=/tmp/dast-report.html
# Markdown remediation brief: each confirmed finding rewritten as a task for a
# coding agent (CWE/OWASP, root cause, where to look, how to fix, how to verify).
# DAST_REMEDIATION_FILE=/tmp/dast-remediation.md

# ──────────────────────────────────────────────────────────────────────────
# Identity / IDOR spec (see scripts/idor-spec.example.json)
# ──────────────────────────────────────────────────────────────────────────
# Fallback spec path if you don't pass one as a CLI argument.
# DAST_ACCESS_SPEC=scripts/your-target.local.json

# ──────────────────────────────────────────────────────────────────────────
# Tuning (defaults shown; uncomment to change)
# ──────────────────────────────────────────────────────────────────────────
# DAST_NAV_TIMEOUT_MS=30000   # per-navigation timeout
# DAST_MAX_PAGES=20           # crawl page cap (Site, Idor)
# DAST_MAX_DEPTH=2            # crawl depth (Site, Idor)
# DAST_MAX_HOPS=4            # LLM navigation hops (Idor=4, SpaIdor=6)
# DAST_POST_BUDGET=3         # max POST navigation actions per run
# DAST_MAX_CLICKS=8          # click budget for SpaIdor (0 disables clicking)
# DAST_MAX_CONCURRENCY=4     # in-flight request cap against the target