feat: AnarCry v2.2.0 - WAF stealth, cookie cache, UI fixes, scanner expansion by Bulletdev · Pull Request #36 · effront/anarcry

Bulletdev · 2026-11-10T21:03:54Z

Summary

Major scanner expansion adding 13 new vulnerability detection modules, out-of-band testing infrastructure, SARIF export, false positive reduction, WAF bypass improvements, and UI fixes.

New Scanner Modules

CSRF -- Token validation, SameSite cookie check, referer/origin bypass testing
Secrets -- 17 regex patterns (AWS, GCP, GitHub, Slack, JWTs, private keys, generic API keys)
Race Condition -- Concurrent request analysis for state inconsistency (disabled by default)
NoSQL Injection -- MongoDB operator injection ($gt, $ne, $regex, $where), auth bypass
Deserialization -- Java/PHP/Python/.NET gadget detection, content-type analysis
File Upload Bypass -- Extension, content-type, magic byte manipulation (disabled by default)
Subdomain Takeover -- Dangling CNAME detection, service fingerprinting (GitHub Pages, Heroku, S3, Azure, Shopify)
WebSocket -- Origin validation, unauthenticated endpoint detection, message injection
Prototype Pollution -- proto, constructor.prototype injection in JSON bodies and query params
Cloud Misconfiguration -- S3/Azure/GCS public access checks, metadata endpoint exposure

JWT++ Probes

x5c chain -- Self-signed certificate chain injection
x5u cert -- Attacker-controlled certificate URL (OAST-enabled)
Key confusion -- RSA public key as HMAC secret (RS256 -> HS256 variant)

OAST Infrastructure

OastServer with HTTP/DNS callback handling
OastCorrelator for blind vulnerability confirmation
Integrated into SSRF, XXE, SQLi, CmdInjection modules

Module Enhancements

GraphQL++ -- Mutation testing, nested query DoS, batching bypass, field suggestion leak
XXE++ -- SVG upload, SAML, XInclude, content-type switching
HTTP/2 Smuggling -- H2.CL, H2.TE, header manipulation, CRLF injection

WAF Bypass and Stealth

PlaywrightStealth -- Anti-detection scripts for headless Chromium (navigator.webdriver removal, chrome runtime stub, plugins/languages spoofing, WebGL vendor override, connection RTT)
ChallengeSolver -- Stealth context, viewport 1920x1080, increased Vercel timeout (60s), click verification elements, waitForFunction polling
BrowserTransport -- Stealth scripts + proper Playwright context options
CookieCache -- Persist challenge cookies to ~/.anarcry/cookies.json (2h TTL), loaded before ChallengeSolver to skip redundant solves
Global WAF throttle -- +300ms/request when WAF detected without clearance (WafState.wafDelayMs)
BrowserTransport dispatch fix -- isChallengeResolved() prevents routing through stuck Chromium

UI Improvements

Debug toggle relocation -- Moved from ModulesPanel to LogPane/LogPanel (floating 28x28 bug icon in log area corner)
Auto-scroll fix -- DefaultCaret.NEVER_UPDATE prevents log pane from pulling user back to bottom while reading
Icon drift fix -- isOptimizedDrawingEnabled=false fixes z-ordering for overlay button
Smart auto-scroll -- Only follows new logs when user is already at bottom (GUI + TUI)

Other

SARIF v2.1.0 export with full CWE/CVSS mapping
FP reduction -- echo detection, module-specific validation hooks, structural HTML comparison
Knowledge base expanded from 25 to 34 entries
Version: 2.2.0

Test Plan

spotlessCheck + checkstyleMain + spotbugsMain + test -- all pass
Pre-push hook (Spotless + Checkstyle + SpotBugs + Semgrep) -- passed
Integration scan against Vercel-protected target with stealth bypass
Cookie cache round-trip: solve challenge, verify persistence, reuse on next scan
SARIF schema validation
Verify RaceCondition and FileUpload disabled by default

github-actions · 2026-11-10T21:04:37Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	2
Warnings	2

⚠️ High confidence issues found. Please review.

github-actions · 2026-11-10T21:05:00Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

codacy-production · 2026-11-10T21:05:07Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 109 complexity · 8 duplication

Metric Results

Complexity 109

Duplication 8

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

github-actions · 2026-11-10T21:05:08Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

…t, FP reduction New scanner modules: - CSRF detection (token validation, SameSite, referer bypass) - Secrets/credential discovery (17 patterns: AWS, GCP, GitHub, Slack, etc.) - Race condition scanner (concurrent request analysis, state inconsistency) - NoSQL injection (MongoDB operator injection, auth bypass) - Insecure deserialization (Java, PHP, Python, .NET gadget detection) - File upload bypass (extension, content-type, magic byte manipulation) - Subdomain takeover (dangling CNAME detection, service fingerprinting) - WebSocket security (origin validation, unauth endpoint detection) - Prototype pollution (__proto__, constructor.prototype injection) - Cloud misconfiguration (S3/Azure/GCS public access, metadata endpoint) OAST infrastructure: - OastServer with HTTP/DNS callback handling - OastCorrelator for blind vulnerability confirmation - Integrated into SSRF, XXE, SQLi, CmdInjection modules Module enhancements: - JWT++: x5c chain, x5u cert, key confusion (RS256->HS256) probes - GraphQL++: mutation testing, nested DoS, batching bypass, field suggestion leak - XXE++: SVG upload, SAML, XInclude, content-type switching - HTTP/2 Smuggling: H2.CL, H2.TE, header manipulation, CRLF injection SARIF v2.1.0 export with full CWE/CVSS mapping FP reduction: echo detection, module-specific validation hooks, structural HTML comparison, statistical timing analysis

…erals False positives -- the scanner intentionally references ws:// URIs to detect insecure WebSocket connections on targets.

…tation

codacy-production

Pull Request Overview

⚠️ Resolve issues before merging

This PR has blocking correctness and safety issues. The JWT x5c probe currently cannot compile, the CSRF module may perform destructive authenticated state changes, and the x5u probe can report vulnerabilities from generic errors or timing noise. The command-injection DNS OAST path is also nonfunctional because the payload and server do not support DNS callbacks.

The primary end-to-end acceptance paths remain unverified: OAST-backed scanner integration, SARIF schema compliance, JWT x5c execution, default module disablement, and false-positive reduction behavior lack the required tests. The complex report and TUI/module areas have no reported coverage data, increasing regression risk, though no additional agent finding targets those files.

About this PR

Add automated integration coverage for newly registered scanner modules and the end-to-end OAST and SARIF flows before relying on this expansion.

Test suggestions

Compile and execute the JWT x5c probe, including certificate generation and token signing.
Verify OAST HTTP and DNS callbacks are accepted and correlated.
Verify SSRF, XXE, SQLi, and command-injection modules register OAST payloads and produce correlated findings.
Validate generated SARIF against the SARIF 2.1.0 schema, including rules, locations, levels, CWE, and CVSS properties.
Verify RaceCondition and FileUpload are disabled by default in CLI, GUI, and TUI.
Test module-aware baseline thresholds, structural HTML comparison, echo detection, and statistical timing behavior.
Test OAST configuration, correlation, callback URL generation, and HTTP server behavior.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Compile and execute the JWT x5c probe, including certificate generation and token signing.
2. Verify OAST HTTP and DNS callbacks are accepted and correlated.
3. Verify SSRF, XXE, SQLi, and command-injection modules register OAST payloads and produce correlated findings.
4. Validate generated SARIF against the SARIF 2.1.0 schema, including rules, locations, levels, CWE, and CVSS properties.
5. Verify RaceCondition and FileUpload are disabled by default in CLI, GUI, and TUI.
6. Test module-aware baseline thresholds, structural HTML comparison, echo detection, and statistical timing behavior.
7. Test OAST configuration, correlation, callback URL generation, and HTTP server behavior.

Make this review better

_{TIP Add a ticket key to the branch or title so the reviewer can check the PR against it. Or tell us which ticket tracker you use here.}
_{TIP Add Codacy review.md instructions or an AGENTS.md so the reviewer knows your conventions.}

_{TIP How was this review? Give us feedback}

codacy-production · 2026-11-10T21:05:33Z

+                            || probeBody.contains("connect timed out") || probeBody.contains("ECONNREFUSED")
+                            || probeBody.contains("connection_refused");
+
+                    if (accepted || serverError || timingAnomaly || connectionError) {


_{🔴 HIGH RISK}

Require a controlled callback or a differential response specifically demonstrating x5u retrieval, rather than reporting solely from generic errors or timing changes.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-11-10T21:05:33Z

+        String cbHost = cbBase.replaceFirst("^https?://", "").replaceFirst("/.*$", "");
+
+        // curl-based callbacks (HTTP)
+        String[] separators = {"; ", "| ", "$("};
+        String[] suffixes = {"", "", ")"};
+        for (int i = 0; i < separators.length; i++) {
+            String payloadId = OastCorrelator.generatePayloadId();
+            String curlUrl = oast.callbackUrl(payloadId);
+            String payload = "testvalue" + separators[i] + "curl " + curlUrl + suffixes[i];
+            injectSingleOob(ctx, hc, oast, base, path, param, payloadId, payload, "curl-" + i, log);
+        }
+
+        // nslookup-based callback (DNS)
+        String dnsId = OastCorrelator.generatePayloadId();
+        String dnsPayload = "testvalue; nslookup " + dnsId + "." + cbHost;
+        injectSingleOob(ctx, hc, oast, base, path, param, dnsId, dnsPayload, "nslookup", log);


_{🔴 HIGH RISK}

Use only the callback hostname in DNS payloads, retain the port for HTTP URLs, and implement a DNS listener/correlation path or remove DNS callback claims.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-11-10T21:05:33Z

+        String actionUrl = resolveUrl(baseUrl, form.action());
+
+        // Get baseline: submit with valid token
+        int baselineStatus = submitForm(ctx, hc, actionUrl, form.tokenName(), form.tokenValue());


_{🔴 HIGH RISK}

Use a non-destructive validation approach, or require an explicit opt-in/sandbox target before sending state-changing authenticated requests.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-11-10T21:05:33Z

+import org.bouncycastle.asn1.x509.Time;
+import org.bouncycastle.asn1.x509.V3TBSCertificateGenerator;


_{🔴 HIGH RISK}

Replace the invalid placeholder import with the intended Bouncy Castle type and add the required Time import used by the certificate construction.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-11-10T21:05:33Z

+
+                        String encoded = URLEncoder.encode(param + op.suffix(), "UTF-8");
+                        // Operator payloads use the param[$op]=value format
+                        String url = base + path + "?" + param + URLEncoder.encode(op.suffix(), "UTF-8");


_{🟡 MEDIUM RISK}

Encode the parameter name and operator value separately while preserving the bracket syntax, such as param + "[$ne]=" + encodedValue.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

github-actions · 2026-11-10T21:10:04Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-11-10T21:10:13Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	2
Warnings	2

⚠️ High confidence issues found. Please review.

github-actions · 2026-11-10T21:10:22Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

… relocation - PlaywrightStealth: anti-detection scripts for headless Chromium (navigator.webdriver removal, chrome runtime stub, plugins/languages spoofing, WebGL vendor override, connection RTT) - ChallengeSolver: stealth context, viewport 1920x1080, increased Vercel timeout to 60s, click verification elements, waitForFunction polling - BrowserTransport: stealth scripts + proper context options - CookieCache: persist challenge cookies to ~/.anarcry/cookies.json (2h TTL), loaded before ChallengeSolver to skip redundant solves - WafState: global wafDelayMs throttle (+300ms/req when WAF active without clearance cookies) - Http.send: applies wafDelayMs on top of config delay - LogPane: DefaultCaret.NEVER_UPDATE fixes auto-scroll pulling user back to bottom while reading logs during scan - Debug toggle moved from ModulesPanel to LogPane/LogPanel (floating 28x28 bug icon in log area corner) - LogPane: isOptimizedDrawingEnabled=false fixes debug icon drift on scroll - Smart auto-scroll in both GUI (isScrolledToBottom check) and TUI (wasAtBottom pattern already present)

github-actions · 2026-11-11T11:16:45Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	2
Warnings	2

⚠️ High confidence issues found. Please review.

github-actions · 2026-11-11T11:16:56Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-11-11T11:17:08Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

Bulletdev added 3 commits November 10, 2026 18:05

fix: add nosemgrep annotations for WebSocket scanner ws:// string lit…

6c77987

…erals False positives -- the scanner intentionally references ws:// URIs to detect insecure WebSocket connections on targets.

fix: resolve checkstyle line-length in WebSocketModule nosemgrep anno…

6ad5fa7

…tation

codacy-production Bot reviewed Nov 10, 2026

View reviewed changes

Bulletdev force-pushed the feat/v2.1-scanner-expansion branch from 7c03bef to 6ad5fa7 Compare November 10, 2026 21:09

Bulletdev self-assigned this Nov 11, 2026

Bulletdev changed the title ~~feat: AnarCry v2.1.0 - Scanner expansion (13 modules, OAST, SARIF, FP reduction)~~ feat: AnarCry v2.2.0 - Scanner expansion (13 modules, OAST, SARIF, FP reduction) Nov 11, 2026

Bulletdev changed the title ~~feat: AnarCry v2.2.0 - Scanner expansion (13 modules, OAST, SARIF, FP reduction)~~ feat: AnarCry v2.1.1 - WAF stealth, cookie cache, UI fixes, scanner expansion Nov 11, 2026

Bulletdev changed the title ~~feat: AnarCry v2.1.1 - WAF stealth, cookie cache, UI fixes, scanner expansion~~ feat: AnarCry v2.2.0 - WAF stealth, cookie cache, UI fixes, scanner expansion Nov 11, 2026

Bulletdev merged commit a22bee5 into main Nov 11, 2026
9 checks passed

		import org.bouncycastle.asn1.x509.Time;
		import org.bouncycastle.asn1.x509.V3TBSCertificateGenerator;

Conversation

Bulletdev commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New Scanner Modules

JWT++ Probes

OAST Infrastructure

Module Enhancements

WAF Bypass and Stealth

UI Improvements

Other

Test Plan

Uh oh!

github-actions Bot commented Nov 10, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Nov 10, 2026

SpotBugs + FindSecBugs

Uh oh!

codacy-production Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

github-actions Bot commented Nov 10, 2026

Security Scan Summary

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Nov 10, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Nov 10, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Nov 10, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Nov 10, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Nov 10, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Nov 10, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Nov 10, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Nov 10, 2026

Security Scan Summary

Uh oh!

github-actions Bot commented Nov 11, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Nov 11, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Nov 11, 2026

Security Scan Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bulletdev commented Nov 10, 2026 •

edited

Loading

codacy-production Bot commented Nov 10, 2026 •

edited

Loading