@bhaveshbhardwaj7/adbis-sentinel

ADBIS Sentinel — Automated security scanner for the ADBIS control-plane. Discovers endpoints and simulates real-world hacker attack vectors to find vulnerabilities before attackers do.

Features

• 🔍 Auto-Discovery — Probes all known ADBIS endpoints to map the attack surface
• ⚔️ 17 Attack Modules — Covers OWASP Top 10 categories for dynamic scanning (DAST)
• 📝 Static Analysis (SAST) — Scans your frontend and backend code for hardcoded API keys and insecure configurations
• 📊 Structured Reports — JSON or rich console output with OWASP categorization
• 🔑 Auth-Aware — Tests both authenticated and unauthenticated attack vectors
• 🏗️ Extensible — Select specific modules or run the full suite

Attack Modules

| Module | Category | Description | |--------|----------|-------------| | oversized-payload | A05 | Tests body size limits with >1MB payloads | | malformed-json | A03 | Broken JSON to test error handling | | sql-injection | A03 | SQL payloads in URL params | | nosql-injection | A03 | MongoDB-style operators in JSON bodies | | path-traversal | A01 | ../ sequences in URL path segments | | xss-injection | A03 | <script> and event handler payloads | | prototype-pollution | A08 | __proto__ / constructor key injection | | header-injection | A03 | CRLF injection via forwarded headers | | auth-bypass | A01 | Missing/malformed auth tokens | | rate-limit-flood | A05 | 150+ rapid concurrent requests | | ssrf-probe | A10 | Internal IPs in source fields | | enum-ids | A01 | Predictable ID guessing | | schema-violation | A05 | Missing fields, wrong types, oversized arrays | | replay-attack | A08 | Stale-dated envelopes | | timestamp-manipulation | A08 | Future-dated events | | sse-abuse | A05 | 120 concurrent SSE connections | | containment-escalation | A01 | Spoofed actor identity in containment |

Quick Start

```bash
# Scan your local ADBIS instance (DAST)
npx tsx packages/adbis-sentinel/src/cli.ts scan --target http://localhost:8000

# Scan your local project code for flaws and leaked keys (SAST)
npx tsx packages/adbis-sentinel/src/cli.ts analyze --dir ./my-app-src

# Scan with authentication
npx tsx packages/adbis-sentinel/src/cli.ts scan --target http://localhost:8000 --api-key YOUR_SECRET

# Run specific modules only
npx tsx packages/adbis-sentinel/src/cli.ts scan --modules auth-bypass,sql-injection,rate-limit-flood

# Export JSON report
npx tsx packages/adbis-sentinel/src/cli.ts scan --json > report.json

# List all modules
npx tsx packages/adbis-sentinel/src/cli.ts modules

Programmatic Usage

import { ADBISSentinel } from "@bhaveshbhardwaj7/adbis-sentinel";

const sentinel = new ADBISSentinel({
  target: "http://localhost:8000",
  apiKey: "my-secret",
});

const report = await sentinel.scan();
console.log(`Found ${report.summary.total} vulnerabilities`);
console.log(`Critical: ${report.summary.critical}, High: ${report.summary.high}`);

🌐 Universal Web Architecture

ADBIS is a completely framework-agnostic universal security product. It does not depend on any specific application structure, backend framework, or frontend library. It is completely decoupled from any hardcoded application logic and works with any website.