@hover-dev/pentest

The discovery half of Hover security — the red "pentest mode". Where @hover-dev/security crystallizes confirmed access-control findings into a CI .security.spec.ts (the orange "security mode", business / authorization), pentest hunts vulnerabilities + attack classes (SQLi, XSS, SSTI, SSRF, path-traversal, XXE, deserialization, RCE, open-redirect, CORS, JWT, …) and turns a session's recorded checks into a findings report.

• Authorized, own-app only. Scoped to the dev origin you're building — no third-party targets, no DoS, no detection-evasion. Entering red mode is the authorization.
• In-band confirmation. Findings are confirmed by timing, body-diff, or reflected internal content — not external out-of-band callbacks.
• No secrets in the report. Cookies / tokens / PII are stripped; request bodies/headers are referenced, never dumped; URLs are sanitized.
• Says what it didn't test. Every report carries a "Not tested" section so it's never mistaken for full coverage.

Coverage

Probes come from the shared @hover-dev/probe-engine seed set (built-ins + your .hover/rules/). Built-in offensive seeds today:

| Class | Built-in seed | How it's confirmed (in-band) | |---|---|---| | SQL injection | sqli-error-boolean | error fragment / boolean body-diff / SLEEP delay | | Reflected XSS | xss-reflected | canary reflects unencoded in an executable context | | SSTI | ssti-template-injection | {{7*7}} → 49 in the response | | SSRF | ssrf-url-param | internal/metadata content or a timing delta | | Open redirect | open-redirect | 3xx Location to an external origin | | Path traversal | path-traversal | file contents (e.g. /etc/passwd) in the response | | GraphQL | graphql-introspection | __schema returned (introspection left on) |

Plus the authz seeds shared with security mode (IDOR, BFLA, mass-assignment, auth-bypass — the latter also covers JWT tampering / alg:none).

Deliberately out of scope (so the report's honesty holds): recon / OSINT / subdomain enumeration (we test the app you're building, not its attack surface), cloud-misconfig, and anything that can only be confirmed out-of-band (Collaborator-style callbacks) — those are reported as suspected, never confirmed. CORS and JWT live as cross-flow / header checks rather than per-flow seeds for now. Growing the seed set is the main expansion path — add to .hover/rules/ or the engine built-ins.

Standing on the shoulders of giants

Pentest mode's offensive web-vulnerability methodology — the per-class detection signals, exploitation techniques, the validation gate, the report shape — is adapted (with thanks) from Claude-BugHunter by Sachin Sharma (MIT):

https://github.com/elementalsouls/Claude-BugHunter

We rewrote the material into Hover's probe-seed + report format and scoped it to authorized own-app testing (dropping the bug-bounty / external-target / OOB and enterprise-appliance parts). Credit and gratitude to that project.

License

Apache-2.0 © Hyperyond Studio