{ "llm": { "conf": 0.9968201, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 1, "prob": 0.99525386, "class": "hostile" }, "outcome": "hostile", "interpretation": "Autonomous offensive security tool" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.99525386, "rte": "az", "prob": 0.99525386 }, { "cls": 0, "raw": 0.92991817, "rte": "az/whl", "prob": 0.92991817 } ], "prob": 0.99525386, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.99525386095047, "type": "whl" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00001710653305053711, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00003420313078095205, "type": "python" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000018656253814697266, "type": "python" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00001952052116394043, "type": "python" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.000016460815459140576, "type": "python" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000030507644623867236, "type": "python" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.000016738971680752002, "type": "python" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.00004647175592253916, "type": "python" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000035703182220458984, "type": "python" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.0000795125961303711, "type": "python" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.0013503333320841193, "type": "python" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000056614477216498926, "type": "python" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.000042249757825629786, "type": "python" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.00008312860882142559, "type": "python" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.00021146734070498496, "type": "python" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.00004394849020172842, "type": "python" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.00004984935003449209, "type": "python" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000017752250641933642, "type": "python" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.000016301870346069336, "type": "python" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.00003428260606597178, "type": "python" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.00003210703653167002, "type": "python" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.00013694167137145996, "type": "python" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.00004417697709868662, "type": "python" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.00024190545082092285, "type": "python" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.000012993812561035156, "type": "python" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.00011522571003297344, "type": "python" }, { "id": 45, "lvl": -1, "conf": 0, "prob": 0.00003711382669280283, "type": "python" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.00004635254663298838, "type": "python" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.000021626552552334033, "type": "python" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.000017990669221035205, "type": "python" }, { "id": 53, "lvl": -1, "conf": 0, "prob": 0.00002907713314925786, "type": "python" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.00016177694487851113, "type": "python" }, { "id": 58, "lvl": -1, "conf": 0, "prob": 0.00001671910285949707, "type": "python" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.000017970800399780273, "type": "python" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.000024656454115756787, "type": "python" }, { "id": 63, "lvl": -1, "conf": 0, "prob": 0.000021149715394130908, "type": "python" }, { "id": 65, "lvl": -1, "conf": 0, "prob": 0.0000288387145701563, "type": "python" }, { "id": 66, "lvl": -1, "conf": 0, "prob": 0.000021745761841884814, "type": "python" }, { "id": 67, "lvl": -1, "conf": 0, "prob": 0.00008040666580200195, "type": "python" }, { "id": 69, "lvl": -1, "conf": 0, "prob": 0.000021884838133701123, "type": "python" }, { "id": 70, "lvl": -1, "conf": 0, "prob": 0.00002911686897277832, "type": "python" }, { "id": 75, "lvl": -1, "conf": 0, "prob": 0.00002714991569519043, "type": "python" }, { "id": 76, "lvl": -1, "conf": 0, "prob": 0.000019947687178500928, "type": "python" }, { "id": 77, "lvl": -1, "conf": 0, "prob": 0.000019311904907226562, "type": "python" }, { "id": 78, "lvl": -1, "conf": 0, "prob": 0.00009111563122132793, "type": "python" }, { "id": 80, "lvl": -1, "conf": 0, "prob": 0.000029673179597011767, "type": "python" }, { "id": 81, "lvl": -1, "conf": 0, "prob": 0.000018328428268432617, "type": "python" }, { "id": 83, "lvl": -1, "conf": 0, "prob": 0.00001868605613708496, "type": "python" }, { "id": 84, "lvl": -1, "conf": 0, "prob": 0.000020722547560581006, "type": "python" }, { "id": 86, "lvl": -1, "conf": 0, "prob": 0.00013083219528198242, "type": "python" }, { "id": 87, "lvl": -1, "conf": 0, "prob": 0.00002520283123885747, "type": "python" }, { "id": 88, "lvl": -1, "conf": 0, "prob": 0.0002212822437286377, "type": "python" }, { "id": 90, "lvl": -1, "conf": 0, "prob": 0.000016669431715854444, "type": "python" }, { "id": 96, "lvl": -1, "conf": 0, "prob": 0.000013639529242936987, "type": "python" }, { "id": 97, "lvl": -1, "conf": 0, "prob": 0.000014175971045915503, "type": "python" }, { "id": 98, "lvl": -1, "conf": 0, "prob": 0.0008209447260014713, "type": "python" }, { "id": 100, "lvl": -1, "conf": 0, "prob": 0.0000158846378326416, "type": "python" }, { "id": 101, "lvl": -1, "conf": 0, "prob": 0.000013907750144426245, "type": "python" }, { "id": 102, "lvl": -1, "conf": 0, "prob": 0.00001523892115073977, "type": "python" }, { "id": 103, "lvl": -1, "conf": 0, "prob": 0.000034997861803276464, "type": "python" }, { "id": 105, "lvl": -1, "conf": 0, "prob": 0.000022699436158291064, "type": "python" }, { "id": 107, "lvl": -1, "conf": 0, "prob": 0.000015944242477416992, "type": "python" }, { "id": 108, "lvl": -1, "conf": 0, "prob": 0.00019496679306030273, "type": "python" }, { "id": 109, "lvl": -1, "conf": 0, "prob": 0.00001473228167014895, "type": "python" }, { "id": 110, "lvl": -1, "conf": 0, "prob": 0.000013679265975952148, "type": "python" }, { "id": 111, "lvl": -1, "conf": 0, "prob": 0.00009122490882873535, "type": "python" }, { "id": 112, "lvl": -1, "conf": 0, "prob": 0.000015954175978549756, "type": "python" }, { "id": 113, "lvl": -1, "conf": 0, "prob": 0.00006766120350221172, "type": "python" }, { "id": 115, "lvl": -1, "conf": 0, "prob": 0.00007193287456175312, "type": "python" }, { "id": 116, "lvl": -1, "conf": 0, "prob": 0.000012665987014770508, "type": "python" }, { "id": 118, "lvl": -1, "conf": 0, "prob": 0.000016182661056518555, "type": "python" }, { "id": 119, "lvl": -1, "conf": 0, "prob": 0.000017176071196445264, "type": "python" }, { "id": 120, "lvl": -1, "conf": 0, "prob": 0.000015209118828352075, "type": "python" }, { "id": 121, "lvl": -1, "conf": 0, "prob": 0.000014930963516235352, "type": "python" }, { "id": 122, "lvl": -1, "conf": 0, "prob": 0.00006807843601563945, "type": "python" }, { "id": 123, "lvl": -1, "conf": 0, "prob": 0.00019424159836489707, "type": "python" }, { "id": 125, "lvl": -1, "conf": 0, "prob": 0.000016321739167324267, "type": "python" }, { "id": 126, "lvl": -1, "conf": 0, "prob": 0.0018076697597280145, "type": "python" }, { "id": 127, "lvl": -1, "conf": 0, "prob": 0.000015020370483398438, "type": "python" }, { "id": 128, "lvl": -1, "conf": 0, "prob": 0.00001700719258224126, "type": "python" }, { "id": 129, "lvl": -1, "conf": 0, "prob": 0.000014265378013078589, "type": "python" }, { "id": 130, "lvl": -1, "conf": 0, "prob": 0.000017354885130771436, "type": "python" }, { "id": 131, "lvl": -1, "conf": 0, "prob": 0.00007565816486021504, "type": "python" }, { "id": 132, "lvl": -1, "conf": 0, "prob": 0.00011121233546873555, "type": "python" }, { "id": 133, "lvl": -1, "conf": 0, "prob": 0.000028192996978759766, "type": "python" }, { "id": 134, "lvl": -1, "conf": 0, "prob": 0.000016589960068813525, "type": "python" }, { "id": 135, "lvl": -1, "conf": 0, "prob": 0.00001424551010131836, "type": "python" }, { "id": 136, "lvl": -1, "conf": 0, "prob": 0.000018437704056850635, "type": "python" }, { "id": 137, "lvl": -1, "conf": 0, "prob": 0.000013212363228376489, "type": "python" }, { "id": 138, "lvl": -1, "conf": 0, "prob": 0.00001580516436661128, "type": "python" }, { "id": 139, "lvl": -1, "conf": 0, "prob": 0.0000231166686717188, "type": "python" }, { "id": 140, "lvl": -1, "conf": 0, "prob": 0.000017911195755004883, "type": "python" }, { "id": 143, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 144, "lvl": -1, "conf": 0, "prob": 0.000019311904907226562, "type": "python" }, { "id": 149, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 150, "lvl": -1, "conf": 0, "prob": 0.000027070442229160108, "type": "python" }, { "id": 155, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 156, "lvl": -1, "conf": 0, "prob": 0.000020772218704223633, "type": "python" }, { "id": 161, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 162, "lvl": -1, "conf": 0, "prob": 0.00002244114875793457, "type": "python" }, { "id": 167, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 168, "lvl": -1, "conf": 0, "prob": 0.00004742543023894541, "type": "python" }, { "id": 173, "lvl": -1, "conf": 0, "prob": 0.000021149715394130908, "type": "python" }, { "id": 174, "lvl": -1, "conf": 0, "prob": 0.00004317362981964834, "type": "python" }, { "id": 179, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 180, "lvl": -1, "conf": 0, "prob": 0.00003407398980925791, "type": "python" }, { "id": 185, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 186, "lvl": -1, "conf": 0, "prob": 0.00002171595951949712, "type": "python" }, { "id": 190, "lvl": -1, "conf": 0, "prob": 0.000017305215806118213, "type": "python" }, { "id": 193, "lvl": -1, "conf": 0, "prob": 0.00005302826684783213, "type": "python" }, { "id": 196, "lvl": -1, "conf": 0, "prob": 0.00004031260687042959, "type": "python" }, { "id": 197, "lvl": -1, "conf": 0, "prob": 0.000021219253540039062, "type": "python" }, { "id": 198, "lvl": -1, "conf": 0, "prob": 0.000019441047697910108, "type": "python" }, { "id": 199, "lvl": -1, "conf": 0, "prob": 0.000021626552552334033, "type": "python" }, { "id": 201, "lvl": -1, "conf": 0, "prob": 0.000022063652068027295, "type": "python" }, { "id": 204, "lvl": -1, "conf": 0, "prob": 0.00003191828727722168, "type": "python" }, { "id": 205, "lvl": -1, "conf": 0, "prob": 0.000022133192032924853, "type": "python" }, { "id": 207, "lvl": -1, "conf": 0, "prob": 0.00002256035804748535, "type": "python" }, { "id": 208, "lvl": -1, "conf": 0, "prob": 0.00005411108213593252, "type": "python" }, { "id": 209, "lvl": -1, "conf": 0, "prob": 0.000020603338271030225, "type": "python" }, { "id": 210, "lvl": -1, "conf": 0, "prob": 0.00002876917460525874, "type": "python" }, { "id": 211, "lvl": -1, "conf": 0, "prob": 0.000031073886930244043, "type": "python" }, { "id": 212, "lvl": -1, "conf": 0, "prob": 0.000046630699216620997, "type": "python" }, { "id": 213, "lvl": -1, "conf": 0, "prob": 0.000037163496017456055, "type": "python" }, { "id": 215, "lvl": -1, "conf": 0, "prob": 0.0000241696834564209, "type": "python" }, { "id": 218, "lvl": -1, "conf": 0, "prob": 0.000025659799575805664, "type": "python" }, { "id": 219, "lvl": -1, "conf": 0, "prob": 0.000026345252990722656, "type": "python" }, { "id": 220, "lvl": -1, "conf": 0, "prob": 0.000026851892471313477, "type": "python" }, { "id": 221, "lvl": -1, "conf": 0, "prob": 0.0000239411983784521, "type": "python" }, { "id": 223, "lvl": -1, "conf": 0, "prob": 0.000026792287826538086, "type": "python" }, { "id": 225, "lvl": -1, "conf": 0, "prob": 0.00001850724220275879, "type": "python" }, { "id": 226, "lvl": -1, "conf": 0, "prob": 0.0000357826538674999, "type": "python" }, { "id": 228, "lvl": -1, "conf": 0, "prob": 0.000020702680558315478, "type": "python" }, { "id": 230, "lvl": -1, "conf": 0, "prob": 0.000013828277587890625, "type": "python" }, { "id": 232, "lvl": -1, "conf": 0, "prob": 0.00003178914266754873, "type": "python" }, { "id": 233, "lvl": -1, "conf": 0, "prob": 0.00002000729182327632, "type": "python" }, { "id": 241, "lvl": -1, "conf": 0, "prob": 0.00008211532986024395, "type": "python" }, { "id": 242, "lvl": -1, "conf": 0, "prob": 0.00002495447733963374, "type": "python" }, { "id": 243, "lvl": -1, "conf": 0, "prob": 0.00011374553287168965, "type": "python" }, { "id": 246, "lvl": -1, "conf": 0, "prob": 0.00012049078941345215, "type": "python" }, { "id": 248, "lvl": -1, "conf": 0, "prob": 0.000019550323486328125, "type": "python" }, { "id": 250, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 251, "lvl": -1, "conf": 0, "prob": 0.000025679668397060595, "type": "python" }, { "id": 256, "lvl": -1, "conf": 0, "prob": 0.000020553668946377002, "type": "python" }, { "id": 257, "lvl": -1, "conf": 0, "prob": 0.00003770987314055674, "type": "python" }, { "id": 262, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 263, "lvl": -1, "conf": 0, "prob": 0.000024984279662021436, "type": "python" }, { "id": 268, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 269, "lvl": -1, "conf": 0, "prob": 0.000034560758649604395, "type": "python" }, { "id": 274, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 275, "lvl": -1, "conf": 0, "prob": 0.000030020872145541944, "type": "python" }, { "id": 280, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 281, "lvl": -1, "conf": 0, "prob": 0.000036716461181640625, "type": "python" }, { "id": 288, "lvl": -1, "conf": 0, "prob": 0.00002238154411315918, "type": "python" }, { "id": 289, "lvl": -1, "conf": 0, "prob": 0.0001125037670135498, "type": "python" }, { "id": 290, "lvl": -1, "conf": 0, "prob": 0.00003143151479889639, "type": "python" }, { "id": 291, "lvl": -1, "conf": 0, "prob": 0.000035703182220458984, "type": "python" }, { "id": 292, "lvl": -1, "conf": 0, "prob": 0.00002489487269485835, "type": "python" }, { "id": 293, "lvl": -1, "conf": 0, "prob": 0.00004227956014801748, "type": "python" }, { "id": 296, "lvl": -1, "conf": 0, "prob": 0.000020553668946377002, "type": "python" }, { "id": 297, "lvl": -1, "conf": 0, "prob": 0.0004906157846562564, "type": "python" }, { "id": 302, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 308, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 309, "lvl": -1, "conf": 0, "prob": 0.000024537244826206006, "type": "python" }, { "id": 314, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 315, "lvl": -1, "conf": 0, "prob": 0.00001872579196060542, "type": "python" }, { "id": 320, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 326, "lvl": -1, "conf": 0, "prob": 0.00003272294998168945, "type": "python" }, { "id": 327, "lvl": -1, "conf": 0, "prob": 0.000025153160095214844, "type": "python" }, { "id": 332, "lvl": -1, "conf": 0, "prob": 0.00003272294998168945, "type": "python" }, { "id": 333, "lvl": -1, "conf": 0, "prob": 0.00003104408460785635, "type": "python" }, { "id": 338, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 339, "lvl": -1, "conf": 0, "prob": 0.0000423888377554249, "type": "python" }, { "id": 344, "lvl": -1, "conf": 0, "prob": 0.000020811954527744092, "type": "python" }, { "id": 345, "lvl": -1, "conf": 0, "prob": 0.00003483891487121582, "type": "python" }, { "id": 346, "lvl": -1, "conf": 0, "prob": 0.000015795230865478516, "type": "json" }, { "id": 351, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 352, "lvl": -1, "conf": 0, "prob": 0.000021149715394130908, "type": "python" }, { "id": 357, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 358, "lvl": -1, "conf": 0, "prob": 0.000019709268599399365, "type": "python" }, { "id": 363, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 364, "lvl": -1, "conf": 0, "prob": 0.0000415046997659374, "type": "python" }, { "id": 369, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 370, "lvl": -1, "conf": 0, "prob": 0.00004009405893157236, "type": "python" }, { "id": 374, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 375, "lvl": -1, "conf": 0, "prob": 0.00002343455889786128, "type": "python" }, { "id": 380, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 381, "lvl": -1, "conf": 0, "prob": 0.00003484885019133799, "type": "python" }, { "id": 386, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 387, "lvl": -1, "conf": 0, "prob": 0.00002559026142989751, "type": "python" }, { "id": 392, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 393, "lvl": -1, "conf": 0, "prob": 0.000026901563614956103, "type": "python" }, { "id": 398, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 399, "lvl": -1, "conf": 0, "prob": 0.00002400080302322749, "type": "python" }, { "id": 404, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 405, "lvl": -1, "conf": 0, "prob": 0.000026752552003017627, "type": "python" }, { "id": 410, "lvl": -1, "conf": 0, "prob": 0.00002298752406204585, "type": "python" }, { "id": 411, "lvl": -1, "conf": 0, "prob": 0.00003777940946747549, "type": "python" }, { "id": 416, "lvl": -1, "conf": 0, "prob": 0.000023971000700839795, "type": "python" }, { "id": 417, "lvl": -1, "conf": 0, "prob": 0.000025898218154907227, "type": "python" }, { "id": 418, "lvl": -1, "conf": 0, "prob": 0.000018715858459472656, "type": "json" }, { "id": 419, "lvl": -1, "conf": 0, "prob": 0.000014166037544782739, "type": "json" }, { "id": 420, "lvl": -1, "conf": 0, "prob": 0.000014911095604475122, "type": "markdown" }, { "id": 422, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 423, "lvl": -1, "conf": 0, "prob": 0.00003503759580780752, "type": "python" }, { "id": 428, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 429, "lvl": -1, "conf": 0, "prob": 0.000022709369659423828, "type": "python" }, { "id": 434, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 435, "lvl": -1, "conf": 0, "prob": 0.000019391378373256885, "type": "python" }, { "id": 440, "lvl": -1, "conf": 0, "prob": 0.000020176172256469727, "type": "python" }, { "id": 441, "lvl": -1, "conf": 0, "prob": 0.000032007694244384766, "type": "python" }, { "id": 446, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 447, "lvl": -1, "conf": 0, "prob": 0.000018487373381503858, "type": "python" }, { "id": 452, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 453, "lvl": -1, "conf": 0, "prob": 0.000032454729080200195, "type": "python" }, { "id": 458, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 459, "lvl": -1, "conf": 0, "prob": 0.00003329912942717783, "type": "python" }, { "id": 464, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 470, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 471, "lvl": -1, "conf": 0, "prob": 0.00002674261668289546, "type": "python" }, { "id": 476, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 477, "lvl": -1, "conf": 0, "prob": 0.00001846750637923833, "type": "python" }, { "id": 482, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 488, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 489, "lvl": -1, "conf": 0, "prob": 0.00003281235694885254, "type": "python" }, { "id": 493, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 494, "lvl": -1, "conf": 0, "prob": 0.000026047229766845703, "type": "python" }, { "id": 499, "lvl": -1, "conf": 0, "prob": 0.00002298752406204585, "type": "python" }, { "id": 500, "lvl": -1, "conf": 0, "prob": 0.00003381570058991201, "type": "python" }, { "id": 505, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 506, "lvl": -1, "conf": 0, "prob": 0.00003594160079956055, "type": "python" }, { "id": 511, "lvl": -1, "conf": 0, "prob": 0.00002298752406204585, "type": "python" }, { "id": 512, "lvl": -1, "conf": 0, "prob": 0.000020037094145664014, "type": "python" }, { "id": 517, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 523, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 524, "lvl": -1, "conf": 0, "prob": 0.000018735727280727588, "type": "python" }, { "id": 529, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 535, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 536, "lvl": -1, "conf": 0, "prob": 0.00002266963383590337, "type": "python" }, { "id": 541, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 547, "lvl": -1, "conf": 0, "prob": 0.000020553668946377002, "type": "python" }, { "id": 548, "lvl": -1, "conf": 0, "prob": 0.000027348598450771533, "type": "python" }, { "id": 553, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 554, "lvl": -1, "conf": 0, "prob": 0.000024149814635165967, "type": "python" }, { "id": 559, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 560, "lvl": -1, "conf": 0, "prob": 0.000021884838133701123, "type": "python" }, { "id": 565, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 566, "lvl": -1, "conf": 0, "prob": 0.00003408392149140127, "type": "python" }, { "id": 571, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 572, "lvl": -1, "conf": 0, "prob": 0.00001809994319046382, "type": "python" }, { "id": 577, "lvl": -1, "conf": 0, "prob": 0.000028342008590698242, "type": "python" }, { "id": 578, "lvl": -1, "conf": 0, "prob": 0.00011899074161192402, "type": "python" }, { "id": 583, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 584, "lvl": -1, "conf": 0, "prob": 0.000018437704056850635, "type": "python" }, { "id": 589, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 590, "lvl": -1, "conf": 0, "prob": 0.00002031525036727544, "type": "python" }, { "id": 595, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 596, "lvl": -1, "conf": 0, "prob": 0.00002446770668029785, "type": "python" }, { "id": 601, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 602, "lvl": -1, "conf": 0, "prob": 0.000029414892196655273, "type": "python" }, { "id": 606, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 607, "lvl": -1, "conf": 0, "prob": 0.000019282102584838867, "type": "python" }, { "id": 612, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 613, "lvl": -1, "conf": 0, "prob": 0.00006528695666929707, "type": "python" }, { "id": 617, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 618, "lvl": -1, "conf": 0, "prob": 0.00003362695497344248, "type": "python" }, { "id": 623, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 624, "lvl": -1, "conf": 0, "prob": 0.00003452102464507334, "type": "python" }, { "id": 629, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 630, "lvl": -1, "conf": 0, "prob": 0.0001952846796484664, "type": "python" }, { "id": 634, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 635, "lvl": -1, "conf": 0, "prob": 0.00016197562217712402, "type": "python" }, { "id": 640, "lvl": -1, "conf": 0, "prob": 0.00002298752406204585, "type": "python" }, { "id": 641, "lvl": -1, "conf": 0, "prob": 0.000022689500838168897, "type": "python" }, { "id": 649, "lvl": -1, "conf": 0, "prob": 0.000026027360945590772, "type": "python" }, { "id": 650, "lvl": -1, "conf": 0, "prob": 0.000026265779524692334, "type": "python" }, { "id": 651, "lvl": -1, "conf": 0, "prob": 0.000029424825697788037, "type": "python" }, { "id": 652, "lvl": -1, "conf": 0, "prob": 0.00003532568734954111, "type": "python" }, { "id": 654, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 655, "lvl": -1, "conf": 0, "prob": 0.000017583370208740234, "type": "python" }, { "id": 660, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 661, "lvl": -1, "conf": 0, "prob": 0.00003195802491973154, "type": "python" }, { "id": 665, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 671, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 672, "lvl": -1, "conf": 0, "prob": 0.000028401613235473633, "type": "python" }, { "id": 677, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 678, "lvl": -1, "conf": 0, "prob": 0.000042299430788261816, "type": "python" }, { "id": 683, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 684, "lvl": -1, "conf": 0, "prob": 0.00004079937934875488, "type": "python" }, { "id": 689, "lvl": -1, "conf": 0, "prob": 0.000020603338271030225, "type": "python" }, { "id": 690, "lvl": -1, "conf": 0, "prob": 0.000035881996154785156, "type": "python" }, { "id": 695, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 696, "lvl": -1, "conf": 0, "prob": 0.000030934810638427734, "type": "python" }, { "id": 701, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 702, "lvl": -1, "conf": 0, "prob": 0.000036150217056274414, "type": "python" }, { "id": 707, "lvl": -1, "conf": 0, "prob": 0.000022580226868740283, "type": "python" }, { "id": 708, "lvl": -1, "conf": 0, "prob": 0.0000294645633402979, "type": "python" }, { "id": 713, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 714, "lvl": -1, "conf": 0, "prob": 0.000029246011763461865, "type": "python" }, { "id": 717, "lvl": -1, "conf": 0, "prob": 0.000013311703696672339, "type": "markdown" }, { "id": 719, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 720, "lvl": -1, "conf": 0, "prob": 0.000031441450119018555, "type": "python" }, { "id": 725, "lvl": -1, "conf": 0, "prob": 0.000020394722014316358, "type": "python" }, { "id": 726, "lvl": -1, "conf": 0, "prob": 0.00003960728645324707, "type": "python" }, { "id": 731, "lvl": -1, "conf": 0, "prob": 0.000019510587662807666, "type": "python" }, { "id": 732, "lvl": -1, "conf": 0, "prob": 0.0000188450012501562, "type": "python" }, { "id": 737, "lvl": -1, "conf": 0, "prob": 0.00002298752406204585, "type": "python" }, { "id": 738, "lvl": -1, "conf": 0, "prob": 0.000020196041077724658, "type": "python" }, { "id": 743, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 744, "lvl": -1, "conf": 0, "prob": 0.000030308961868286133, "type": "python" }, { "id": 748, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 749, "lvl": -1, "conf": 0, "prob": 0.000026891628294833936, "type": "python" }, { "id": 753, "lvl": -1, "conf": 0, "prob": 0.000018805265426635742, "type": "python" }, { "id": 756, "lvl": -1, "conf": 0, "prob": 0.00002014636993408203, "type": "python" }, { "id": 757, "lvl": -1, "conf": 0, "prob": 0.00002954403498733882, "type": "python" }, { "id": 758, "lvl": -1, "conf": 0, "prob": 0.0002532204089220613, "type": "python" }, { "id": 759, "lvl": -1, "conf": 0, "prob": 0.0002020696847466752, "type": "python" }, { "id": 760, "lvl": -1, "conf": 0, "prob": 0.000017315149307250977, "type": "python" }, { "id": 761, "lvl": -1, "conf": 0, "prob": 0.00021652381110470742, "type": "python" }, { "id": 762, "lvl": -1, "conf": 0, "prob": 0.00002193450927734375, "type": "python" }, { "id": 763, "lvl": -1, "conf": 0, "prob": 0.0000207523498829687, "type": "python" }, { "id": 764, "lvl": -1, "conf": 0, "prob": 0.00004955132681061514, "type": "python" }, { "id": 765, "lvl": -1, "conf": 0, "prob": 0.00015704830002505332, "type": "python" }, { "id": 766, "lvl": -1, "conf": 0, "prob": 0.000035434961318969727, "type": "python" }, { "id": 767, "lvl": -1, "conf": 0, "prob": 0.00003052751344512217, "type": "python" }, { "id": 768, "lvl": -1, "conf": 0, "prob": 0.00002094109913741704, "type": "python" }, { "id": 769, "lvl": -1, "conf": 0, "prob": 0.00004967053610016592, "type": "python" }, { "id": 770, "lvl": -1, "conf": 0, "prob": 0.000028421482056728564, "type": "python" }, { "id": 771, "lvl": -1, "conf": 0, "prob": 0.000054955482482910156, "type": "python" }, { "id": 772, "lvl": -1, "conf": 0, "prob": 0.000023732582121738233, "type": "python" }, { "id": 773, "lvl": -1, "conf": 0, "prob": 0.00010081132495542988, "type": "python" }, { "id": 775, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 781, "lvl": -1, "conf": 0, "prob": 0.000020553668946377002, "type": "python" }, { "id": 782, "lvl": -1, "conf": 0, "prob": 0.00071621936513111, "type": "python" }, { "id": 787, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 788, "lvl": -1, "conf": 0, "prob": 0.00003954768180847168, "type": "python" }, { "id": 792, "lvl": -1, "conf": 0, "prob": 0.00001667936703597661, "type": "python" }, { "id": 796, "lvl": -1, "conf": 0, "prob": 0.00003035863301192876, "type": "python" }, { "id": 798, "lvl": -1, "conf": 0, "prob": 0.000016460815459140576, "type": "python" }, { "id": 801, "lvl": -1, "conf": 0, "prob": 0.00003409385681152344, "type": "python" }, { "id": 802, "lvl": -1, "conf": 0, "prob": 0.000023980936020961963, "type": "python" }, { "id": 803, "lvl": -1, "conf": 0, "prob": 0.000029991069823154248, "type": "python" }, { "id": 804, "lvl": -1, "conf": 0, "prob": 0.000038762886106269434, "type": "python" }, { "id": 805, "lvl": -1, "conf": 0, "prob": 0.000025550523787387647, "type": "python" }, { "id": 807, "lvl": -1, "conf": 0, "prob": 0.000019649663954623975, "type": "python" }, { "id": 809, "lvl": -1, "conf": 0, "prob": 0.000014921029105607886, "type": "python" }, { "id": 810, "lvl": -1, "conf": 0, "prob": 0.000027646621674648486, "type": "python" }, { "id": 811, "lvl": -1, "conf": 0, "prob": 0.00002171595951949712, "type": "python" }, { "id": 813, "lvl": -1, "conf": 0, "prob": 0.000022192796677700244, "type": "python" }, { "id": 816, "lvl": -1, "conf": 0, "prob": 0.000014662742614746094, "type": "python" }, { "id": 818, "lvl": -1, "conf": 0, "prob": 0.00002380212208663579, "type": "python" }, { "id": 820, "lvl": -1, "conf": 0, "prob": 0.000038991373003227636, "type": "python" }, { "id": 821, "lvl": -1, "conf": 0, "prob": 0.0000235140323638916, "type": "python" }, { "id": 822, "lvl": -1, "conf": 0, "prob": 0.000043779611587524414, "type": "python" }, { "id": 823, "lvl": -1, "conf": 0, "prob": 0.00009964903438230976, "type": "python" }, { "id": 825, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 826, "lvl": -1, "conf": 0, "prob": 0.000018795331925502978, "type": "python" }, { "id": 831, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 832, "lvl": -1, "conf": 0, "prob": 0.00003216664117644541, "type": "python" }, { "id": 837, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 838, "lvl": -1, "conf": 0, "prob": 0.000023076931029208936, "type": "python" }, { "id": 842, "lvl": -1, "conf": 0, "prob": 0.000013252099051896948, "type": "python" }, { "id": 844, "lvl": -1, "conf": 0, "prob": 0.000024368366212002002, "type": "python" }, { "id": 845, "lvl": -1, "conf": 0, "prob": 0.000025471052140346728, "type": "python" }, { "id": 847, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 848, "lvl": -1, "conf": 0, "prob": 0.000024646520614624023, "type": "python" }, { "id": 853, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 859, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 860, "lvl": -1, "conf": 0, "prob": 0.00003906090933014639, "type": "python" }, { "id": 865, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 866, "lvl": -1, "conf": 0, "prob": 0.000019818544387817383, "type": "python" }, { "id": 871, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 872, "lvl": -1, "conf": 0, "prob": 0.000026553869247436523, "type": "python" }, { "id": 877, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 878, "lvl": -1, "conf": 0, "prob": 0.000025937953978427686, "type": "python" }, { "id": 883, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 884, "lvl": -1, "conf": 0, "prob": 0.00003587206083466299, "type": "python" }, { "id": 888, "lvl": -1, "conf": 0, "prob": 0.000013977289199829102, "type": "python" }, { "id": 890, "lvl": -1, "conf": 0, "prob": 0.00002763668635452632, "type": "python" }, { "id": 893, "lvl": -1, "conf": 0, "prob": 0.00001917282679642085, "type": "python" }, { "id": 894, "lvl": -1, "conf": 0, "prob": 0.00001726547816360835, "type": "python" }, { "id": 895, "lvl": -1, "conf": 0, "prob": 0.00002915660479629878, "type": "python" }, { "id": 896, "lvl": -1, "conf": 0, "prob": 0.00009541710460325703, "type": "python" }, { "id": 899, "lvl": -1, "conf": 0, "prob": 0.000034232933103339747, "type": "python" }, { "id": 900, "lvl": -1, "conf": 0, "prob": 0.00002777576446533203, "type": "python" }, { "id": 904, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 905, "lvl": -1, "conf": 0, "prob": 0.00002432862856949214, "type": "python" }, { "id": 910, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 911, "lvl": -1, "conf": 0, "prob": 0.000030140081435092725, "type": "python" }, { "id": 916, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 917, "lvl": -1, "conf": 0, "prob": 0.000023076931029208936, "type": "python" }, { "id": 922, "lvl": -1, "conf": 0, "prob": 0.000020394722014316358, "type": "python" }, { "id": 923, "lvl": -1, "conf": 0, "prob": 0.00002335508725082036, "type": "python" }, { "id": 928, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 929, "lvl": -1, "conf": 0, "prob": 0.000022461017579189502, "type": "python" }, { "id": 934, "lvl": -1, "conf": 0, "prob": 0.00002008676528930664, "type": "python" }, { "id": 935, "lvl": -1, "conf": 0, "prob": 0.000026702880859375, "type": "python" }, { "id": 940, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 941, "lvl": -1, "conf": 0, "prob": 0.000025898218154907227, "type": "python" }, { "id": 946, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 952, "lvl": -1, "conf": 0, "prob": 0.00001856684684753418, "type": "python" }, { "id": 955, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 956, "lvl": -1, "conf": 0, "prob": 0.000034332275390625, "type": "python" }, { "id": 960, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 961, "lvl": -1, "conf": 0, "prob": 0.00003606081008911133, "type": "python" }, { "id": 966, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 967, "lvl": -1, "conf": 0, "prob": 0.000037471454561455175, "type": "python" }, { "id": 972, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 973, "lvl": -1, "conf": 0, "prob": 0.000023633241653442383, "type": "python" }, { "id": 978, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 979, "lvl": -1, "conf": 0, "prob": 0.000019858280211337842, "type": "python" }, { "id": 984, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 985, "lvl": -1, "conf": 0, "prob": 0.00003447135168244131, "type": "python" }, { "id": 990, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 991, "lvl": -1, "conf": 0, "prob": 0.00001940131187438965, "type": "python" }, { "id": 996, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 997, "lvl": -1, "conf": 0, "prob": 0.000026394924134365283, "type": "python" }, { "id": 1002, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 1003, "lvl": -1, "conf": 0, "prob": 0.00001961986163223628, "type": "python" }, { "id": 1008, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1009, "lvl": -1, "conf": 0, "prob": 0.000048279762268066406, "type": "python" }, { "id": 1014, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1015, "lvl": -1, "conf": 0, "prob": 0.000023225942641147412, "type": "python" }, { "id": 1020, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 1021, "lvl": -1, "conf": 0, "prob": 0.00003415346145629883, "type": "python" }, { "id": 1026, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1027, "lvl": -1, "conf": 0, "prob": 0.000027974447220913135, "type": "python" }, { "id": 1031, "lvl": -1, "conf": 0, "prob": 0.00001564621925354004, "type": "python" }, { "id": 1036, "lvl": -1, "conf": 0, "prob": 0.000028272470444790088, "type": "python" }, { "id": 1037, "lvl": -1, "conf": 0, "prob": 0.00004608432573149912, "type": "python" }, { "id": 1039, "lvl": -1, "conf": 0, "prob": 0.00010474523151060566, "type": "python" }, { "id": 1041, "lvl": -1, "conf": 0, "prob": 0.00004934271055390127, "type": "python" }, { "id": 1042, "lvl": -1, "conf": 0, "prob": 0.000023851791411289014, "type": "python" }, { "id": 1044, "lvl": -1, "conf": 0, "prob": 0.00009938081348082051, "type": "python" }, { "id": 1045, "lvl": -1, "conf": 0, "prob": 0.000040918588638305664, "type": "python" }, { "id": 1046, "lvl": -1, "conf": 0, "prob": 0.000051776569307548925, "type": "python" }, { "id": 1047, "lvl": -1, "conf": 0, "prob": 0.000020017227143398486, "type": "python" }, { "id": 1048, "lvl": -1, "conf": 0, "prob": 0.000039130449295043945, "type": "python" }, { "id": 1049, "lvl": -1, "conf": 0, "prob": 0.000025351842850795947, "type": "python" }, { "id": 1050, "lvl": -1, "conf": 0, "prob": 0.000041852395952446386, "type": "python" }, { "id": 1051, "lvl": -1, "conf": 0, "prob": 0.00004266699033905752, "type": "python" }, { "id": 1052, "lvl": -1, "conf": 0, "prob": 0.00012726585555355996, "type": "python" }, { "id": 1053, "lvl": -1, "conf": 0, "prob": 0.000029246011763461865, "type": "python" }, { "id": 1054, "lvl": -1, "conf": 0, "prob": 0.000022818645447841845, "type": "python" }, { "id": 1055, "lvl": -1, "conf": 0, "prob": 0.000018457571059116162, "type": "python" }, { "id": 1056, "lvl": -1, "conf": 0, "prob": 0.000030060609788051806, "type": "python" }, { "id": 1057, "lvl": -1, "conf": 0, "prob": 0.00045264759683050215, "type": "python" }, { "id": 1058, "lvl": -1, "conf": 0, "prob": 0.000018596649169921875, "type": "python" }, { "id": 1059, "lvl": -1, "conf": 0, "prob": 0.000025471052140346728, "type": "python" }, { "id": 1060, "lvl": -1, "conf": 0, "prob": 0.000023196140318759717, "type": "python" }, { "id": 1061, "lvl": -1, "conf": 0, "prob": 0.00027097263955511153, "type": "python" }, { "id": 1063, "lvl": -1, "conf": 0, "prob": 0.000022113323211669922, "type": "python" }, { "id": 1064, "lvl": -1, "conf": 0, "prob": 0.000023573637008666992, "type": "python" }, { "id": 1065, "lvl": -1, "conf": 0, "prob": 0.00002086162567138672, "type": "python" }, { "id": 1069, "lvl": -1, "conf": 0, "prob": 0.000017136335372924805, "type": "python" }, { "id": 1070, "lvl": -1, "conf": 0, "prob": 0.00004056096076965332, "type": "python" }, { "id": 1071, "lvl": -1, "conf": 0, "prob": 0.000020503997802734375, "type": "python" }, { "id": 1072, "lvl": -1, "conf": 0, "prob": 0.000018755594282993115, "type": "python" }, { "id": 1073, "lvl": -1, "conf": 0, "prob": 0.00001728534698486328, "type": "python" }, { "id": 1075, "lvl": -1, "conf": 0, "prob": 0.000034242868423461914, "type": "python" }, { "id": 1076, "lvl": -1, "conf": 0, "prob": 0.000027567148208618164, "type": "python" }, { "id": 1077, "lvl": -1, "conf": 0, "prob": 0.00004026293754577637, "type": "python" }, { "id": 1079, "lvl": -1, "conf": 0, "prob": 0.000023464361220248975, "type": "python" }, { "id": 1081, "lvl": -1, "conf": 0, "prob": 0.000027080377549282275, "type": "python" }, { "id": 1082, "lvl": -1, "conf": 0, "prob": 0.00002298752406204585, "type": "python" }, { "id": 1083, "lvl": -1, "conf": 0, "prob": 0.0000905593260540627, "type": "python" }, { "id": 1086, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1087, "lvl": -1, "conf": 0, "prob": 0.00003695487976074219, "type": "python" }, { "id": 1092, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1098, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 1104, "lvl": -1, "conf": 0, "prob": 0.00002232193946838379, "type": "python" }, { "id": 1105, "lvl": -1, "conf": 0, "prob": 0.000034928321838378906, "type": "python" }, { "id": 1110, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1111, "lvl": -1, "conf": 0, "prob": 0.00002814332583511714, "type": "python" }, { "id": 1116, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1117, "lvl": -1, "conf": 0, "prob": 0.00003109375757048838, "type": "python" }, { "id": 1122, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1123, "lvl": -1, "conf": 0, "prob": 0.000027219453841098584, "type": "python" }, { "id": 1127, "lvl": -1, "conf": 0, "prob": 0.000019500652342685498, "type": "python" }, { "id": 1128, "lvl": -1, "conf": 0, "prob": 0.00003333886343170889, "type": "python" }, { "id": 1133, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1134, "lvl": -1, "conf": 0, "prob": 0.00002388159373367671, "type": "python" }, { "id": 1139, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1140, "lvl": -1, "conf": 0, "prob": 0.00003885229307343252, "type": "python" }, { "id": 1145, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1151, "lvl": -1, "conf": 0, "prob": 0.000020096698790439405, "type": "python" }, { "id": 1157, "lvl": -1, "conf": 0, "prob": 0.000020394722014316358, "type": "python" }, { "id": 1158, "lvl": -1, "conf": 0, "prob": 0.000025898218154907227, "type": "python" }, { "id": 1165, "lvl": -1, "conf": 0, "prob": 0.000014026959433977026, "type": "pkg_info" }, { "id": 1166, "lvl": -1, "conf": 0, "prob": 0.00001644094845687505, "type": "text" }, { "id": 1168, "lvl": -1, "conf": 0, "prob": 0.00001424551010131836, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-07T19:14:10Z" }, "path": "suijin-6.6.0-py3-none-any.whl", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MMn$b3=NQ1\u003cXH%005#2000Si0047.x\u003e?v1fje72zFsi1uOlqyzbJVq*B%hK(Lf/\u0026a{OBrujC$SWG.4aIx.F\u003cc\u003e]\u0026*txzoRc0dvpqY\u003cy6{9y.JCag\u003e=GgbcxC4L]ZqTricT/2%C)\u003cm+QG*9$vve", "ln": 0 }, { "b": "faPy?)rHgK4[gF7?==Ir(U8B\u0026!nO8^8)Gzj.dGN)8nB]L6i\u0026RHTA0}q^[PBIB4Bi2@}#Q!u7V?vEp/d2t0n%\u0026:oUjkkBAKQ]\u0026vx%=ZUhGfkllUDzc:bRPg!\u003cE54i\u0026lT?*1KqusCru1-sCAhV3U(oJ2aAReFs%\u003eKfCq8yYGy{bRoV+!=a=o588a-hANp3a1(wUx%4My/4C\u0026f{bAsK\u0026j0KEEz^6wcU]\u003cymJNk9AC!Rf(AoB!uF\u003ea\u003cMt{?cQ#2Cm6NVo5Oh(wvTF8j]RjEtJ*tZ!CL4D-!WXoskR6VbNNW=y[2\u003eq}NneurR}rLq{7tV705:UhbR[DrP%eQo+/fC.Q-6aW9Vy6GO24y3HTsoq.OtalJ$-yY\u003cp[-ypH=PH%DVB:M6{Mq[8StVze\u003eL\u003c(h}3)Xb=vXtN]NuoikY1\u0026=Y1(P", "ln": 153 } ], "mol": "K₃(Te₅Am₂Li)O₁₀(C₇AsCa₄ErLaP₂Xe₆Co₂Dy₃Pr₂)H₉(Os₃₄Cm₈₅Cr₈Db₃₁F₃₂HfPo₃₈TiU₃)Md₃(Pa₄)Th₂", "sha": "c96bc3509bd0634fdea89013fc3680ad3367728e6c7366640426a3f7e3d0f1d4", "path": "suijin-6.6.0-py3-none-any.whl", "risk": 801, "size": 1334022, "type": "whl", "facts": { "metrics": { "whl": { "native_extension_count": 0 }, "file": { "size": 1334022, "entropy": 7.91 }, "binary": { "peak_region_bytes": 1238016, "peak_region_entropy": 7.84 }, "archive": { "file_count": 1167, "member_count": 1167, "script_count": 740, "zip_bomb_ratio": 4.69, "compressed_size": 1160578, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.38, "hidden_file_count": 0, "uncompressed_size": 3074610, "crc_collision_count": 136, "entry_comment_count": 0, "max_filename_length": 64, "rtlo_filename_count": 0, "format.regular_count": 1167, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 2, "timing.mtime_unique_ratio": 0, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 6, "timing.mtime_dominant_count": 1161, "timing.mtime_spread_seconds": 10, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.99, "compression.method_counts.deflate": 1167 }, "consistency": { "cloned_summary": 0, "name_typosquat": 0, "self_dependency": 0, "metadata_identity_mismatch": 0 } } }, "ident": { "name": { "value": "suijin", "source": "whl.distribution", "verified": false }, "trust": "unsigned", "authors": [ { "name": "William Jiang", "role": "author", "source": "whl.author" } ], "version": { "value": "6.6.0", "source": "whl.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/tls::curl-insecure", "mbc": "C0005", "conf": 0.95, "crit": 3, "desc": "curl disables TLS certificate verification" }, { "id": "micro-behaviors/process/fd/stdio::py-stdout-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdout to custom stream", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/fs/chmod/modify::python-chmod-call-with-exec-bit", "atk": "T1222", "mbc": "E1222", "conf": 0.95, "crit": 3, "desc": "Python chmod call sets the executable bit" }, { "id": "micro-behaviors/data/db/sql::sql-update", "conf": 0.5, "crit": 3, "desc": "SQL UPDATE syntax reference", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/endpoints::ingest-api-path", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Ingest or upload API endpoint path", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlopen-response-body-read", "conf": 0.9, "crit": 3, "desc": "Reads urllib response body", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl output file source" }, { "id": "micro-behaviors/os/syscall/invoke::linux-kernel-extra-tree-directory", "atk": "T1106", "conf": 0.98, "crit": 2, "desc": "Linux-kernel extra-tree directory component", "from": [ { "file": 1031 } ] }, { "id": "objectives/discovery/network/enumeration::subdomain-result-split", "conf": 0.86, "crit": 3, "desc": "Splits discovered subdomain results", "from": [ { "file": 333 } ] }, { "id": "micro-behaviors/os/firewall/iptables::iptables", "conf": 0.9, "crit": 3, "desc": "iptables command", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/login::http-login-credential-post", "atk": "T1071.001", "conf": 0.92, "crit": 3, "desc": "HTTP login credentials submitted by POST", "from": [ { "file": 771 } ], "uses": [ 517, 598 ] }, { "id": "micro-behaviors/os/service/control::service-auto-start-setting", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Windows service automatic-start setting", "from": [ { "off": 2725, "file": 123, "line": 74 } ], "uses": [ 600 ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 103 } ], "uses": [ 64 ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-cmdline", "conf": 0.66, "crit": 3, "desc": "References own command-line procfs path", "from": [ { "file": 122 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::inline-python-reverse-shell", "atk": "T1059.006", "mbc": "B0030.002", "conf": 0.99, "crit": 5, "desc": "Inline Python socket dup2 reverse shell", "from": [ { "off": 2643, "file": 39, "line": 77 }, { "off": 744, "file": 98, "line": 32 }, { "off": 140, "file": 126, "line": 8 }, { "file": 213 }, { "off": 516, "file": 782, "line": 17 }, { "off": 2949, "file": 1079, "line": 77 } ], "uses": [ 76, 111, 564 ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "from": [ { "file": 2 } ] }, { "id": "objectives/execution/interpreter/cmd/injection::python-dev-tcp-payload", "atk": "T1059.006", "conf": 0.98, "crit": 4, "desc": "Python embeds dev-tcp endpoint", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--fastly", "conf": 0.4, "crit": 1, "desc": "Public cloud provider name (Fastly)", "from": [ { "file": 1009 } ] }, { "id": "micro-behaviors/communications/socket/bind/address::python-http-server-all-interfaces", "conf": 0.88, "crit": 3, "desc": "Python HTTP server binds all interfaces", "from": [ { "file": 208 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-create-connection-text", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python socket create_connection in text", "from": [ { "file": 54 } ] }, { "id": "metadata/package/testing/scripted::pytest", "conf": 0.95, "crit": 3, "desc": "pytest test framework", "from": [ { "file": 289 } ], "uses": [ 115 ] }, { "id": "micro-behaviors/data/compress/library::python-base64-gzip-encode", "conf": 0.95, "crit": 3, "desc": "Python encodes gzip data as Base64", "from": [ { "file": 782 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method", "conf": 0.85, "crit": 3, "desc": "Python socket-like connect call", "from": [ { "file": 126 }, { "file": 208 }, { "file": 782 }, { "off": 455, "file": 985, "line": 15 } ], "uses": [ 247 ] }, { "id": "micro-behaviors/process/interpreter/python::eval-builtin", "atk": "T1059.006", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Python eval() built-in function", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-editable-content-selector-sweep", "conf": 0.94, "crit": 3, "desc": "Targets form fields and editable page content", "from": [ { "off": 7895, "file": 690, "line": 189 } ], "uses": [ 37, 163, 583 ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Invokes a Windows shell in command mode", "from": [ { "file": 103 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 471 } ] }, { "id": "micro-behaviors/communications/http/graphql::api-route", "conf": 0.92, "crit": 3, "desc": "GraphQL API route request", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/crypto/hash/digest::python-md5-digest", "conf": 0.9, "crit": 3, "desc": "Computes an MD5 digest in Python", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::getaddrinfo", "conf": 0.85, "crit": 3, "desc": "socket.getaddrinfo() DNS lookup", "from": [ { "file": 393 } ] }, { "id": "micro-behaviors/os/sysinfo/performance/monitoring::python-psutil-process-metrics", "conf": 0.9, "crit": 3, "desc": "Python psutil process metrics", "from": [ { "file": 822 } ] }, { "id": "micro-behaviors/data/control-flow/loop::python-range-loop-long-span", "conf": 0.85, "crit": 3, "desc": "Uses a long Python range span", "from": [ { "file": 1083 } ] }, { "id": "micro-behaviors/communications/http/url/php-endpoint::url-php-endpoint-script", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "URL targets .php endpoint", "from": [ { "file": 131 } ] }, { "id": "third_party/bartblaze/hacktools/Impacket/impacket", "conf": 0.9, "crit": 4, "desc": "Identifies Impacket, a collection of Python classes for working with network protocols." }, { "id": "micro-behaviors/communications/http/llm::llm-token-usage-json--rx-9", "atk": "T1071.001", "conf": 0.65, "crit": 1, "desc": "LLM input-token count field", "from": [ { "file": 289 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-textarea-selector", "conf": 0.9, "crit": 1, "desc": "Browser selector targets textarea elements" }, { "id": "micro-behaviors/process/create/subprocess::call", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.75, "crit": 3, "desc": "subprocess.call call" }, { "id": "micro-behaviors/communications/http/lib/requests::content-attribute-access", "conf": 0.8, "crit": 1, "desc": "Accesses an object's .content attribute", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/data/decode/hex::python-fromhex", "conf": 0.8, "crit": 3, "desc": "Python bytes.fromhex decode", "from": [ { "file": 339 } ] }, { "id": "objectives/collection/stealer/ctf::ctf-flag-stealer-regex", "atk": "T1005", "conf": 0.95, "crit": 3, "desc": "CTF flag-format pattern in source", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::while-loop", "conf": 0.3, "crit": 2, "desc": "While-loop control flow", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/package-manager/install::subprocess-pip-install-list", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Subprocess argument list invokes pip install", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::python-directory-listing", "atk": "T1083", "conf": 0.86, "crit": 3, "desc": "Python lists directory entries", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/data/parse/command::python-shlex-command-split", "conf": 0.9, "crit": 3, "desc": "Python parses shell-like command words", "from": [ { "file": 275 } ] }, { "id": "micro-behaviors/communications/proxy/target::local-ipv4-target", "atk": "T1090,T1572", "conf": 0.94, "crit": 3, "desc": "Target host is loopback or wildcard IPv4", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/data/decode/hex::hex-decode-int-16", "conf": 0.7, "crit": 3, "desc": "Hex decoding via int(x, 16)", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/os/env/vars/credentials::python-environ-credential-keyword-filter", "conf": 0.9, "crit": 3, "desc": "Python environment access uses credential-named keys", "from": [ { "file": 193 }, { "file": 804 }, { "file": 820 }, { "file": 844 }, { "file": 941 }, { "file": 1053 } ], "uses": [ 53, 377 ] }, { "id": "micro-behaviors/communications/http/llm::llm-token-usage-json", "atk": "T1071.001", "conf": 0.65, "crit": 1, "desc": "LLM token usage JSON fields", "from": [ { "off": 59112, "file": 289, "line": 1626 }, { "off": 11764, "file": 293, "line": 314 }, { "off": 14709, "file": 759, "line": 384 }, { "off": 1697, "file": 844, "line": 42 }, { "off": 9243, "file": 896, "line": 259 }, { "off": 37345, "file": 900, "line": 857 }, { "off": 15120, "file": 902, "line": 393 }, { "off": 8397, "file": 1071, "line": 205 } ], "uses": [ 36, 114, 546, 674 ] }, { "id": "objectives/credential-access/theft/keywords::password-field-name", "conf": 0.96, "crit": 1, "desc": "Password field name in structured data", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/container/runtime::serviceaccount-token", "conf": 0.8, "crit": 3, "desc": "Kubernetes service-account token path" }, { "id": "micro-behaviors/os/env/vars/credentials::python-env-keyword-token", "conf": 0.88, "crit": 1, "desc": "Python getenv name contains TOKEN", "from": [ { "file": 193 } ] }, { "id": "objectives/credential-access/files/config::credential-path-table--rx-8", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "NPM or PyPI credential-file path literal", "from": [ { "file": 471 } ] }, { "id": "micro-behaviors/os/registry/keys::currentversion-run", "conf": 0.75, "crit": 3, "desc": "Accesses Windows CurrentVersion Run key", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-hexdigest", "conf": 0.9, "crit": 3, "desc": "Computes a SHA-256 hex digest in Python", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name", "conf": 0.4, "crit": 1, "desc": "Repeated public cloud provider name", "from": [ { "file": 31 } ], "uses": [ 17, 615, 646, 719 ] }, { "id": "micro-behaviors/communications/ip/parse::cidr-host-expansion", "conf": 0.9, "crit": 3, "desc": "Expands a CIDR network to host addresses", "from": [ { "off": 147, "file": 590, "line": 8 }, { "off": 8468, "file": 766, "line": 221 } ], "uses": [ 153, 697 ] }, { "id": "micro-behaviors/os/env/vars/credentials::python-env-get-call", "conf": 0.8, "crit": 1, "desc": "Python reads an environment variable", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/privilege/query::proc-status-capability-mask", "conf": 0.9, "crit": 3, "desc": "Reads CapEff from own proc status", "from": [ { "file": 297 } ] }, { "id": "metadata/file/string/application-name::chrome-browser-name-literal", "conf": 0.4, "crit": 1, "desc": "String literal names the Chrome browser", "from": [ { "file": 803 } ] }, { "id": "micro-behaviors/communications/http/url/tld::reserved-documentation-tld-url", "conf": 0.95, "crit": 3, "desc": "URL uses RFC 2606 reserved documentation TLD", "from": [ { "file": 213 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-keywords", "conf": 1.0, "crit": 1, "desc": "Container runtime name literal present", "from": [ { "file": 269 }, { "file": 297 }, { "file": 826 } ], "uses": [ 262, 653 ] }, { "id": "micro-behaviors/process/create/shell/script-host::cmd-exe-c-command", "conf": 0.85, "crit": 3, "desc": "Runs commands through cmd.exe /c", "from": [ { "file": 103 } ] }, { "id": "micro-behaviors/data/archive/open/tar::python-tarfile-open", "atk": "T1560.001", "conf": 0.9, "crit": 3, "desc": "Python opens tar archive", "from": [ { "file": 650 } ] }, { "id": "well-known/tool/offensive/metasploit::console-marker", "conf": 0.99, "crit": 3, "desc": "Metasploit command-line launcher marker", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "from": [ { "file": 111 } ] }, { "id": "objectives/credential-access/theft/keywords::access-token-field-name", "conf": 0.96, "crit": 1, "desc": "Access-token field name in structured data", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/crypto/hash/file::hash-mismatch-abort", "conf": 0.9, "crit": 3, "desc": "Reports a downloaded digest mismatch", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/os/container/runtime::container-runtime-secrets-path", "conf": 0.82, "crit": 3, "desc": "Container runtime secrets path" }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/os/event/kernel/select::python-select-call", "conf": 0.9, "crit": 3, "desc": "Python select I/O multiplexing call", "from": [ { "file": 211 } ] }, { "id": "micro-behaviors/communications/http/request/client::requests-get-url-literal", "conf": 0.8, "crit": 3, "desc": "Literal URL passed to requests.get/httpx.get", "from": [ { "file": 387 } ] }, { "id": "micro-behaviors/os/env/vars/access::python-environ-items-loop", "conf": 0.88, "crit": 3, "desc": "Iterates over Python environment entries", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/websocket/handler::websocket-import-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "WebSocket Python import reference", "from": [ { "file": 1123 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::inline-python-subprocess-shell", "conf": 0.95, "crit": 4, "desc": "Inline Python interactive shell launch" }, { "id": "micro-behaviors/communications/proxy/target::target-connect-python", "atk": "T1090,T1572", "conf": 0.94, "crit": 3, "desc": "Python connects to target variable", "from": [ { "file": 720 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-3", "conf": 0.8, "crit": 2, "desc": "English function-word token \"that\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/sql::sql-delete", "conf": 0.5, "crit": 3, "desc": "SQL DELETE statement with clause", "from": [ { "off": 13217, "file": 28, "line": 278 } ], "uses": [ 432 ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdio-dup2", "conf": 0.8, "crit": 3, "desc": "Python duplicates descriptor to stdio" }, { "id": "objectives/lateral-movement/exploit/scanner::exploit-endpoint", "atk": "T1210", "conf": 0.85, "crit": 4, "desc": "Exploit endpoint used with scanner context", "from": [ { "file": 42 }, { "file": 90 }, { "file": 108 }, { "file": 226 }, { "file": 1044 } ], "uses": [ 144, 451, 651 ] }, { "id": "micro-behaviors/communications/http/server/framework::fastapi-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "FastAPI framework import", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/fs/disk/partition::mount-staged-root", "conf": 0.9, "crit": 3, "desc": "Shell mounts a filesystem under /mnt" }, { "id": "micro-behaviors/communications/socket/ssl::python-ssl-default-context", "conf": 0.85, "crit": 3, "desc": "Python creates a default TLS context", "from": [ { "file": 985 } ] }, { "id": "micro-behaviors/communications/http/url/build::python-fstring-url-host", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "URL f-string from host", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/ip/assignment::python-ipv4-string-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns an IPv4 address string in Python" }, { "id": "micro-behaviors/data/llm::system-role-marker", "conf": 0.72, "crit": 1, "desc": "LLM system-role value", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-exec", "conf": 0.7, "crit": 3, "desc": "References the Bash shell", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/process/create/agent-permission::agent-auto-approve-enabled", "atk": "T1562.001", "conf": 0.9, "crit": 3, "desc": "Agent auto-approval setting enabled", "from": [ { "file": 213 } ] }, { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-list", "atk": "T1033", "conf": 0.85, "crit": 3, "desc": "sudo -l privilege enumeration" }, { "id": "micro-behaviors/process/create/subprocess::python-bash-argv-launch", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.96, "crit": 3, "desc": "Python launches Bash with command-line arguments", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-glob-call", "conf": 0.84, "crit": 3, "desc": "Calls Python glob for file enumeration", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/process/interpreter/shell::shell-init-path", "conf": 0.84, "crit": 3, "desc": "Shell startup file path reference", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-echo-pipe", "conf": 0.9, "crit": 3, "desc": "Echoes a generated entry into crontab", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-google-cloud-provider-name", "conf": 0.82, "crit": 1, "desc": "Repeated Google Cloud provider name", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/communications/http/services/aws::python-secrets-manager-reference", "conf": 0.95, "crit": 3, "desc": "Python references AWS Secrets Manager", "from": [ { "file": 174 } ] }, { "id": "objectives/lateral-movement/exploit/scanner::shell-endpoint", "atk": "T1210", "conf": 0.6, "crit": 1, "desc": "Webshell path (shell.php/jsp) in URL", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6, "crit": 3, "desc": "Home-relative hidden directory path literal", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/fs/path/config/environment::env-file-path", "conf": 0.9, "crit": 3, "desc": "References dotenv configuration file path", "from": [ { "file": 112 } ] }, { "id": "micro-behaviors/communications/ssh/keys::authorized-keys-append-operation", "conf": 0.9, "crit": 1, "desc": "SSH authorized_keys append operation", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-post", "conf": 0.85, "crit": 3, "desc": "Calls requests.post() in Python", "from": [ { "file": 494 } ] }, { "id": "micro-behaviors/data/manipulation::python-open-write-call", "conf": 0.9, "crit": 3, "desc": "Python writes through open handle", "from": [ { "file": 108 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-name-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package name", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/process/create/thread::python-thread-create", "conf": 0.65, "crit": 3, "desc": "Creates a thread in Python", "from": [ { "file": 29 } ] }, { "id": "metadata/file/catalog/service::messaging-mail-service-names", "conf": 0.82, "crit": 1, "desc": "Messaging and mail service names", "from": [ { "file": 76 }, { "file": 769 }, { "file": 900 }, { "file": 929 } ], "uses": [ 515 ] }, { "id": "micro-behaviors/fs/path/sensitive/ssh::bash-history-artifact", "conf": 0.9, "crit": 3, "desc": "Bash history artifact path", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call-symbol", "conf": 0.85, "crit": 3, "desc": "Calls fully qualified urllib urlopen", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/upload::curl-upload-file", "conf": 0.9, "crit": 3, "desc": "curl file-upload flag (-T/-F/--upload-file)", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/data/db/sql::sql-create-table", "conf": 0.5, "crit": 3, "desc": "SQL CREATE TABLE syntax reference", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/data/db/sql::sqlite-master-ref", "conf": 1.0, "crit": 3, "desc": "SQLite sqlite_master reference", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/process/create/subprocess::variable-command-argument", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Subprocess runs a variable-held command" }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-token-usage-json--rx-5", "atk": "T1071.001", "conf": 0.65, "crit": 1, "desc": "LLM completion-token count field", "from": [ { "file": 844 } ] }, { "id": "metadata/package/testing/scripted::pytest-with-assert", "conf": 0.8, "crit": 2, "desc": "pytest markers with assert statement", "from": [ { "off": 2593, "file": 168, "line": 54 }, { "off": 343, "file": 221, "line": 13 }, { "off": 40999, "file": 289, "line": 1123 }, { "off": 6005, "file": 760, "line": 139 } ], "uses": [ 272, 490 ] }, { "id": "micro-behaviors/communications/http/websocket::ws-scheme", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "References an unencrypted ws:// WebSocket URL", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/data/db/sql::sql-keywords", "conf": 0.5, "crit": 3, "desc": "Contains several SQL statement types", "from": [ { "file": 28 } ], "uses": [ 3, 79, 109, 177, 375 ] }, { "id": "micro-behaviors/communications/http/request/resource-action::http-authorization-denial-status", "conf": 0.96, "crit": 3, "desc": "References HTTP 403 denial status", "from": [ { "file": 251 } ] }, { "id": "micro-behaviors/data/manipulation::sensitive-token-redaction", "conf": 0.8, "crit": 3, "desc": "Redacts a token or secret value", "from": [ { "file": 289 } ] }, { "id": "well-known/tool/offensive/metasploit::console-noninteractive-commands", "conf": 0.9, "crit": 3, "desc": "Metasploit console driven non-interactively", "from": [ { "file": 1057 } ] }, { "id": "objectives/credential-access/cloud/token/files::azure-metadata-header", "atk": "T1552.005", "conf": 0.7, "crit": 3, "desc": "Azure Metadata header", "from": [ { "file": 132 } ] }, { "id": "well-known/app/ai/coding-agent/localcode::untrusted-data-wrapper-call", "conf": 0.99, "crit": 3, "desc": "LocalCode wrap_untrusted injection defense call", "from": [ { "file": 80 } ] }, { "id": "micro-behaviors/communications/dns/doh::doh-cloudflare-ip-1-1-1-1", "atk": "T1071.004", "mbc": "C0011", "conf": 0.75, "crit": 3, "desc": "Cloudflare DoH IP endpoint", "from": [ { "file": 375 } ] }, { "id": "micro-behaviors/process/create/shell/guard::destructive-action-prohibition-phrase", "conf": 0.88, "crit": 3, "desc": "Destructive action prohibition phrase", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-web-file", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "raw.githubusercontent.com web file URL", "from": [ { "file": 652 } ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/server/framework::http-server-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Imports from Python's http.server module", "from": [ { "file": 208 } ] }, { "id": "objectives/impact/destroy/keywords::destroy-verb--files", "conf": 0.9, "crit": 1, "desc": "Destroy action targeting files or directories", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/os/container/namespace::nsenter-pid-one", "atk": "T1611", "conf": 0.95, "crit": 4, "desc": "Enters host PID 1 namespace", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/communications/proxy/mitm::mitmproxy-command--mitmdump", "conf": 0.9, "crit": 3, "desc": "mitmproxy command invocation (mitmdump)", "from": [ { "file": 714 } ] }, { "id": "micro-behaviors/communications/http/keywords::webhook-service-word", "conf": 0.9, "crit": 1, "desc": "Mentions 'webhook' (HTTP callback)", "from": [ { "file": 29 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::reverse-shell-shell", "atk": "T1059.004", "conf": 0.95, "crit": 4, "desc": "Bash reverse shell via /dev/tcp" }, { "id": "metadata/file/profile/language::lang-english--atom-6", "conf": 0.8, "crit": 2, "desc": "English function-word token \"with\"", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/interpreter/python::exec-variable", "atk": "T1059.006", "mbc": "E1059", "conf": 0.94, "crit": 3, "desc": "Python exec() executes a variable value", "from": [ { "file": 860 } ] }, { "id": "micro-behaviors/os/kernel/netlink::ovs-conntrack-builder-call", "conf": 0.9, "crit": 3, "desc": "Builds an OVS conntrack action", "from": [ { "file": 896 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlretrieve-dup", "atk": "T1105", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "urllib.request.urlretrieve call" }, { "id": "micro-behaviors/data/archive/zip::python-zipfile-writer", "conf": 0.9, "crit": 3, "desc": "Python writes files into a ZIP archive", "from": [ { "file": 767 } ] }, { "id": "micro-behaviors/data/decode/table::python-maketrans-table", "atk": "T1027", "mbc": "C0026", "conf": 0.8, "crit": 3, "desc": "Builds a str.maketrans translation table", "from": [ { "file": 1083 } ] }, { "id": "micro-behaviors/os/module/search-path::sys-path-mutate", "conf": 0.86, "crit": 3, "desc": "Modifies module search path (sys.path)", "from": [ { "file": 2 } ] }, { "id": "objectives/discovery/system/fingerprint/os::os-release-open", "atk": "T1082", "mbc": "B0012", "conf": 0.7, "crit": 3, "desc": "Open os-release file", "from": [ { "file": 1037 } ] }, { "id": "micro-behaviors/fs/file/copy::python-write-file-helper-call", "conf": 0.9, "crit": 3, "desc": "Python calls a write_file helper", "from": [ { "file": 1044 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::python-platform-machine", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Queries CPU architecture with platform.machine()", "from": [ { "file": 289 } ] }, { "id": "micro-behaviors/communications/socket/ssl::tls-validation-fully-disabled", "conf": 0.95, "crit": 3, "desc": "TLS hostname and certificate validation both disabled", "from": [ { "off": 21512, "file": 1050, "line": 529 } ], "uses": [ 688, 703 ] }, { "id": "objectives/lateral-movement/exploit/scanner::shell-exec-pattern", "atk": "T1210", "conf": 0.6, "crit": 4, "desc": "Shell command execution pattern", "from": [ { "file": 108 } ] }, { "id": "well-known/tool/offensive/metasploit::meterpreter-reverse-payload", "atk": "T1071", "mbc": "B0030", "conf": 0.9, "crit": 4, "desc": "Meterpreter reverse or bind payload module", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/crypto/kdf/algorithm::pbkdf2", "conf": 0.75, "crit": 3, "desc": "PBKDF2 key-derivation reference", "from": [ { "file": 761 } ] }, { "id": "micro-behaviors/data/serialize/json::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "from": [ { "file": 66 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-body-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP body-capable request line", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/os/env/config::messaging-service-token-key", "conf": 0.82, "crit": 3, "desc": "Messaging service token config key", "from": [ { "file": 471 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-pkce-code-challenge", "conf": 0.8, "crit": 3, "desc": "OAuth PKCE code-challenge field", "from": [ { "file": 119 } ] }, { "id": "micro-behaviors/os/security/capabilities::systemd-ptrace-capability", "conf": 0.95, "crit": 3, "desc": "systemd service requests CAP_SYS_PTRACE" }, { "id": "micro-behaviors/communications/http/server/framework::python-loopback-host-parameter", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python host parameter selects loopback", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/ip/parse::network-host-address-iteration", "conf": 0.8, "crit": 1, "desc": "Network object host-address iteration", "from": [ { "file": 590 } ] }, { "id": "micro-behaviors/process/create/sudo::sudo-noninteractive", "conf": 0.9, "crit": 3, "desc": "Runs sudo without a password prompt", "from": [ { "file": 232 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-create-connection-call", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python socket create_connection call", "from": [ { "file": 720 } ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/Soft", "conf": 0.9, "crit": 5, "desc": "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228" }, { "id": "micro-behaviors/data/compress/library::gzip-compress-call", "conf": 0.9, "crit": 3, "desc": "Python gzip.compress call", "from": [ { "file": 782 } ] }, { "id": "micro-behaviors/communications/http/request/wordpress::rest-endpoint-url", "atk": "T1071.001", "mbc": "E1071", "conf": 0.95, "crit": 3, "desc": "References a WordPress REST API endpoint URL", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/request/payload::post-chunking-marker", "conf": 0.92, "crit": 3, "desc": "HTTP POST carries a chunking marker", "from": [ { "file": 111 } ] }, { "id": "micro-behaviors/data/string/conversion::python-bytes-string-conversion", "conf": 0.86, "crit": 3, "desc": "Python bytes/string encoding conversion", "from": [ { "file": 761 } ] }, { "id": "micro-behaviors/data/string/search::jwt-compact-regex", "conf": 0.9, "crit": 3, "desc": "JWT compact-token regex", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-framework", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 3, "desc": "Flask web framework usage", "from": [ { "file": 25 } ], "uses": [ 736, 752 ] }, { "id": "micro-behaviors/ui/window/form-input::browser-contenteditable-selector", "conf": 0.92, "crit": 1, "desc": "Browser selector targets editable page content" }, { "id": "micro-behaviors/process/create/subprocess::check-output", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.8, "crit": 3, "desc": "subprocess.check_output call", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-var-temp", "conf": 0.7, "crit": 2, "desc": "Unix /var/tmp/ path reference", "from": [ { "file": 813 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-install-command", "conf": 0.9, "crit": 3, "desc": "Python installs crontab from standard input", "from": [ { "file": 764 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command" }, { "id": "micro-behaviors/communications/http/url/query::password-query-parameter", "conf": 0.8, "crit": 3, "desc": "URL password query parameter", "from": [ { "file": 759 } ] }, { "id": "micro-behaviors/os/package-manager/config::npmrc-user-config-path", "conf": 0.9, "crit": 3, "desc": "npm user configuration file path", "from": [ { "file": 471 } ] }, { "id": "micro-behaviors/communications/socket/bind/function::python-short-socket-bind-method", "mbc": "C0001", "conf": 0.82, "crit": 3, "desc": "Python short-name socket bind call", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::python-platform-branch", "atk": "T1082", "conf": 0.82, "crit": 3, "desc": "Python branches on OS platform", "from": [ { "file": 822 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::authorized-keys-public-key-reverse", "atk": "T1552.001", "conf": 0.9, "crit": 2, "desc": "public_key before authorized_keys doc", "from": [ { "file": 123 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-socket-fileno-short", "conf": 0.65, "crit": 1, "desc": "Python short socket fileno" }, { "id": "micro-behaviors/crypto/hash/file::computed-digest-compare", "conf": 0.92, "crit": 3, "desc": "Compares a computed digest against a constant", "from": [ { "file": 263 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/ip-notation::url-with-hex-ip", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 4, "desc": "URL with hex-encoded IPv4", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/data/encode/base64::urlsafe-b64encode-call", "conf": 0.9, "crit": 3, "desc": "Calls base64.urlsafe_b64encode (Python)", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6, "crit": 2, "desc": "SQL SELECT syntax reference", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh-interactive", "conf": 0.9, "crit": 3, "desc": "Interactive shell references (/bin/sh -i)", "from": [ { "file": 782 } ] }, { "id": "objectives/credential-access/files/config::source-control-token-paths", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "Source control credential paths", "from": [ { "file": 471 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-dup2-shell", "atk": "T1059.006", "conf": 0.95, "crit": 4, "desc": "Python reverse shell via os.dup2 FD hijack", "from": [ { "off": 2643, "file": 39, "line": 77 }, { "off": 744, "file": 98, "line": 32 }, { "file": 126 }, { "file": 213 }, { "off": 724, "file": 782, "line": 21 }, { "off": 2949, "file": 1079, "line": 77 } ], "uses": [ 38, 111, 191 ] }, { "id": "objectives/credential-access/files/config::login-secret-file-paths--rx-4", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "SSH private-key or known-hosts path literal", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/ipc/rpc::jsonrpc-2-protocol-object", "conf": 0.9, "crit": 3, "desc": "JSON-RPC 2.0 protocol object", "from": [ { "file": 290 } ] }, { "id": "micro-behaviors/fs/read/file::file-open-content", "atk": "T1005", "mbc": "E1005", "conf": 0.86, "crit": 2, "desc": "Opens file in default read mode" }, { "id": "micro-behaviors/communications/http/headers::authorization-header-index-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Authorization header property assignment", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text", "atk": "T1105", "conf": 0.86, "crit": 1, "desc": "curl text contains silent or fail flags" }, { "id": "micro-behaviors/os/package-manager/install::python-runtime-pip-install", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python invokes pip module install", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-response-body-access", "conf": 0.9, "crit": 3, "desc": "Reads a requests response body", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-suppresses-stdio", "atk": "T1059.006", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Python subprocess stdio suppression", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/communications/ipc/mcp::mcp-protocol-version-field", "conf": 0.88, "crit": 1, "desc": "MCP protocolVersion field", "from": [ { "file": 290 } ] }, { "id": "micro-behaviors/os/network/status::ss", "conf": 0.9, "crit": 3, "desc": "ss socket statistics", "from": [ { "file": 87 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-dup2-io-redirect", "atk": "T1059.006", "conf": 0.9, "crit": 4, "desc": "Python os.dup2 socket FD redirect (stdin/stdout/stderr)", "from": [ { "file": 126 }, { "file": 208 }, { "file": 782 }, { "file": 985 } ], "uses": [ 22, 261, 448 ] }, { "id": "micro-behaviors/process/io/stream::process-stdout-stderr-result-fields", "conf": 0.97, "crit": 3, "desc": "Captures both process output streams", "from": [ { "off": 18064, "file": 28, "line": 372 }, { "off": 10223, "file": 196, "line": 281 }, { "off": 1316, "file": 1070, "line": 49 } ], "uses": [ 455, 668 ] }, { "id": "metadata/package/manifest/ecosystem::pypi-basic-metadata", "conf": 0.95, "crit": 2, "desc": "PyPI package declares name, version, summary", "from": [ { "off": 35, "file": 1165, "line": 3 } ], "uses": [ 103, 197, 458, 762 ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-container-list-path", "conf": 0.9, "crit": 3, "desc": "Docker Engine container-list API path", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/process/create/subprocess::asyncio-create-subprocess-exec", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.85, "crit": 3, "desc": "asyncio subprocess execution call", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/communications/http/services/aws::iam-credentials-path-reference", "conf": 0.7, "crit": 3, "desc": "AWS IAM credentials metadata path", "from": [ { "file": 132 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-version-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package version", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/communications/http/xmlrpc::wordpress-login-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.97, "crit": 3, "desc": "WordPress XML-RPC login method", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/data/encode/base32::python-b32encode-call", "mbc": "C0026", "conf": 0.93, "crit": 3, "desc": "Python calls the Base32 encoder", "from": [ { "file": 411 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::python-dns-cli-resolver", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Python invokes a DNS CLI resolver" }, { "id": "micro-behaviors/process/create/subprocess::variable-command-shell-true", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Variable command passed to shell" }, { "id": "objectives/credential-access/files/config::login-secret-file-paths--rx-5", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "ECDSA or Ed25519 SSH key path literal", "from": [ { "file": 123 } ] }, { "id": "metadata/file/string/application-name::firefox-browser-name-literal", "conf": 0.4, "crit": 1, "desc": "String literal names the Firefox browser", "from": [ { "file": 803 } ] }, { "id": "micro-behaviors/ui/dialog/prompt::press-to-continue", "conf": 0.75, "crit": 3, "desc": "Prompts the user to continue", "from": [ { "file": 2 } ] }, { "id": "objectives/credential-access/cracking/password::kerberos-spn-list", "atk": "T1558.003", "conf": 0.88, "crit": 3, "desc": "Maintains a list of Kerberos SPN targets", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/serialize/object::python-username-variable-object-field", "conf": 0.92, "crit": 3, "desc": "Python object maps username variable", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::gethostbyname", "conf": 0.85, "crit": 3, "desc": "socket.gethostbyname() DNS lookup", "from": [ { "file": 393 } ] }, { "id": "micro-behaviors/fs/enumerate/permissions::suid-sgid-file-discovery-command", "conf": 0.97, "crit": 3, "desc": "Find enumerates SUID or SGID files" }, { "id": "micro-behaviors/data/string/conversion::python-chr-call", "conf": 0.9, "crit": 3, "desc": "Python chr() character conversion" }, { "id": "micro-behaviors/fs/proc/container::runtime-orchestrator-keywords--kubepods", "conf": 0.82, "crit": 1, "desc": "Container orchestrator name literal (kubepods)", "from": [ { "file": 297 } ] }, { "id": "objectives/privilege-escalation/exploit/vulnerabilities::dirtycow", "atk": "T1068", "conf": 0.95, "crit": 3, "desc": "DirtyCow exploit reference" }, { "id": "micro-behaviors/communications/socket/receive::socket-recv-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.recv() call", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/data/db/config::db-key-user", "conf": 0.85, "crit": 1, "desc": "Connection user key", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-keyword", "atk": "T1105", "conf": 0.7, "crit": 1, "desc": "curl command keyword" }, { "id": "micro-behaviors/process/create/agent::ai-agent-shell-tool-name", "atk": "T1059", "mbc": "B0022", "conf": 0.85, "crit": 1, "desc": "Shell tool name", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-session", "conf": 0.8, "crit": 3, "desc": "requests.Session() persistent HTTP session", "from": [ { "file": 375 } ] }, { "id": "objectives/credential-access/files/config::credential-path-table--rx-9", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "Git credential-file path literal", "from": [ { "file": 471 } ] }, { "id": "objectives/execution/automation/agent::skill-exfil-action", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Skill sends collected data", "from": [ { "file": 349 } ], "uses": [ 317 ] }, { "id": "micro-behaviors/communications/websocket/library::python-websocket-client", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python websocket-client connection usage", "from": [ { "file": 1123 } ], "uses": [ 426, 708 ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-request", "conf": 0.85, "crit": 3, "desc": "Calls requests.request in Python", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/fs/file/write/direct::py-write", "conf": 0.5, "crit": 2, "desc": "Python write method call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-sock", "conf": 0.7, "crit": 3, "desc": "Docker socket path", "from": [ { "file": 98 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::head-20-limit", "conf": 0.8, "crit": 3, "desc": "Limits command output to 20 lines" }, { "id": "micro-behaviors/communications/http/endpoints::health-check-path", "conf": 0.9, "crit": 3, "desc": "HTTP health-check endpoint path", "from": [ { "file": 26 } ] }, { "id": "objectives/discovery/network/enumeration::subdomain-result-field", "conf": 0.86, "crit": 3, "desc": "Certificate subdomain result field", "from": [ { "file": 327 } ] }, { "id": "objectives/execution/automation/agent::skill-exfil-destination", "atk": "T1059", "conf": 0.9, "crit": 1, "desc": "Skill exfiltration names a destination", "from": [ { "file": 349 }, { "off": 2882, "file": 982, "line": 83 } ], "uses": [ 373 ] }, { "id": "micro-behaviors/communications/http/server/framework::python-http-route-basic-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python basic HTTP route decorator", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/data/serialize/json::json-load-call", "conf": 0.9, "crit": 3, "desc": "Python json.load call", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-aux", "atk": "T1057", "conf": 0.6, "crit": 3, "desc": "ps aux command", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/request/client::requests-post-json-payload", "conf": 0.85, "crit": 3, "desc": "Sends JSON with Python requests.post()", "from": [ { "file": 769 } ] }, { "id": "micro-behaviors/communications/http/user-agent::truncated-macos-catalina-webkit-ua", "conf": 0.9, "crit": 3, "desc": "Truncated macOS Catalina WebKit User-Agent", "from": [ { "file": 757 } ] }, { "id": "micro-behaviors/data/format/string::kerberos-tgs-hash-format", "conf": 0.96, "crit": 3, "desc": "Kerberos TGS hash artifact format", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen", "conf": 0.7, "crit": 3, "desc": "Calls urllib.request.urlopen", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/url/encoded::percent-encoded-url-query-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Percent-encoded URL query parameter", "from": [ { "file": 327 } ] }, { "id": "micro-behaviors/os/random/prng/stdlib::random-integer-call", "conf": 0.88, "crit": 3, "desc": "Python random integer generation call", "from": [ { "file": 226 } ] }, { "id": "metadata/package/manifest/ecosystem::pypi-runtime-metadata", "conf": 0.94, "crit": 2, "desc": "PyPI package declares Python and dependencies", "from": [ { "off": 371, "file": 1165, "line": 12 } ], "uses": [ 458, 580, 699 ] }, { "id": "micro-behaviors/data/llm::llm-code-generation-verb", "conf": 0.88, "crit": 3, "desc": "LLM code-generation verb", "from": [ { "file": 842 } ] }, { "id": "micro-behaviors/communications/websocket/handler::websocket-library-api-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "WebSocket library or handler API reference", "from": [ { "file": 1123 } ], "uses": [ 75 ] }, { "id": "objectives/execution/exploit/http-desync::repeated-content-length-request", "atk": "T1190", "mbc": "E1190", "conf": 0.98, "crit": 4, "desc": "Duplicate Content-Length headers in one request template", "from": [ { "off": 888, "file": 32, "line": 27 }, { "off": 501, "file": 111, "line": 32 } ], "uses": [ 148, 351, 360 ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name", "conf": 0.9, "crit": 3, "desc": "References high-risk Windows token privilege", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-request-target", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP client requests a cleartext URL", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/socket/ssl::python-wrap-socket-server-hostname", "conf": 0.85, "crit": 3, "desc": "Python TLS socket server_hostname", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/data/db/config::db-key-database", "conf": 0.85, "crit": 1, "desc": "Connection database key", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "from": [ { "file": 28 } ], "uses": [ 101, 136, 270, 493, 673, 769 ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method-short", "conf": 0.85, "crit": 3, "desc": "Short Python socket connect call" }, { "id": "objectives/persistence/system/cron/schedule::echo-cron-fields", "atk": "T1053.003", "conf": 0.5, "crit": 1, "desc": "echo cron numeric schedule command", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/socket/receive::socket-receive", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python receives data from a socket", "from": [ { "file": 1050 } ], "uses": [ 212 ] }, { "id": "micro-behaviors/communications/http/request/wordpress::admin-ajax-endpoint", "atk": "T1071.001", "mbc": "E1071", "conf": 0.97, "crit": 3, "desc": "Targets WordPress admin AJAX endpoint", "from": [ { "file": 42 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-license-file", "conf": 0.9, "crit": 1, "desc": "Declares Python package license file", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/data/db/sql::python-sql-f-string", "conf": 0.9, "crit": 3, "desc": "Builds SQL with Python f-string interpolation", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/request/client::python-http-post-any", "conf": 0.8, "crit": 3, "desc": "Python HTTP POST method usage", "from": [ { "file": 494 }, { "file": 769 }, { "file": 838 }, { "file": 1081 } ], "uses": [ 101 ] }, { "id": "objectives/credential-access/files/config::login-secret-file-paths--rx-6", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "Authorized-keys or shadow-file path literal" }, { "id": "micro-behaviors/os/security/auth/password::python-container-password-reset-command", "conf": 0.92, "crit": 3, "desc": "Python sends container password reset", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/crypto/asymmetric/signature::signable-artifact-name", "conf": 0.95, "crit": 3, "desc": "Checksum manifest or detached signature filename", "from": [ { "file": 1077 } ] }, { "id": "micro-behaviors/process/create/shell/lang::python-c-flag", "conf": 0.9, "crit": 3, "desc": "Python inline command launch" }, { "id": "metadata/lang/source::linux-kernel-secondary-tree-path", "conf": 0.98, "crit": 2, "desc": "Linux kernel secondary source tree path", "from": [ { "file": 819 } ] }, { "id": "metadata/file/metrics::cve-pattern-many", "conf": 0.85, "crit": 3, "desc": "File contains six or more CVE references", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/communications/http/server/framework::uvicorn-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Imports the Uvicorn ASGI server", "from": [ { "file": 293 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-fileno", "conf": 0.7, "crit": 1, "desc": "Python socket fileno() FD extraction", "from": [ { "file": 126 }, { "file": 782 } ], "uses": [ 173 ] }, { "id": "micro-behaviors/fs/proc/container::runtime-orchestrator-keywords", "conf": 0.82, "crit": 1, "desc": "Container orchestrator name literal present", "from": [ { "file": 297 } ], "uses": [ 210 ] }, { "id": "micro-behaviors/os/syscall/invoke::linux-kernel-tree-path-scripts", "atk": "T1106", "conf": 0.98, "crit": 2, "desc": "Linux kernel source-tree directory marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/url/reference::python-comment-url-reference", "conf": 0.9, "crit": 1, "desc": "Python comment contains a URL", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "from": [ { "file": 2 } ], "uses": [ 15, 38, 164, 316, 392, 500, 672 ] }, { "id": "micro-behaviors/process/fd/stdio::python-custom-stdio", "conf": 0.8, "crit": 3, "desc": "Python subprocess custom stdio streams", "from": [ { "off": 1028, "file": 696, "line": 36 }, { "off": 4085, "file": 822, "line": 124 }, { "off": 1087, "file": 1048, "line": 44 }, { "off": 1087, "file": 1070, "line": 41 } ], "uses": [ 1, 325, 755 ] }, { "id": "well-known/tool/offensive/projectdiscovery::attribution-script", "conf": 0.95, "crit": 3, "desc": "Attribution to ProjectDiscovery in script", "from": [ { "file": 1037 } ] }, { "id": "objectives/command-and-control/backdoor/shell/reverse::stdin-redirect-dup", "atk": "T1059", "conf": 0.7, "crit": 1, "desc": "Stdin redirection (reverse shell indicator)" }, { "id": "micro-behaviors/crypto/symmetric/decrypt::python-decrypt-method-call", "atk": "T1027", "mbc": "C0027", "conf": 0.7, "crit": 3, "desc": "Python decrypt method call", "from": [ { "file": 38 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call", "conf": 0.82, "crit": 3, "desc": "Calls Python urllib urlopen", "from": [ { "file": 28 }, { "file": 47 }, { "file": 193 }, { "off": 56521, "file": 289, "line": 1556 }, { "file": 489 }, { "file": 744 }, { "file": 758 } ], "uses": [ 107, 234 ] }, { "id": "micro-behaviors/communications/http/auth::token-object-field", "conf": 0.93, "crit": 3, "desc": "OAuth token object member", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/control-flow/assert::python-assert-statement", "conf": 0.95, "crit": 2, "desc": "Checks condition using Python assert" }, { "id": "metadata/package/testing/scripted::pytest-word", "conf": 0.7, "crit": 2, "desc": "pytest reference", "from": [ { "file": 168 } ] }, { "id": "micro-behaviors/process/fd/stdio::stderr-string", "conf": 0.3, "crit": 2, "desc": "References the stderr stream name", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/subprocess::os-execv", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.85, "crit": 3, "desc": "os.execv - execute with argv list" }, { "id": "micro-behaviors/os/container/runtime::api-pods-path", "conf": 0.8, "crit": 3, "desc": "Kubernetes pods API path" }, { "id": "micro-behaviors/os/container/namespace::host-root-chroot-command", "atk": "T1611", "conf": 0.96, "crit": 3, "desc": "Command enters a mounted host root" }, { "id": "objectives/persistence/system/cron/schedule::echo-command", "atk": "T1053.003", "conf": 0.5, "crit": 1, "desc": "echo cron schedule command", "from": [ { "off": 2258, "file": 123, "line": 66 } ], "uses": [ 248 ] }, { "id": "objectives/discovery/cloud/metadata::aws-user-data", "atk": "T1552.005", "conf": 0.85, "crit": 3, "desc": "AWS EC2 user-data endpoint", "from": [ { "file": 1061 } ] }, { "id": "micro-behaviors/os/container/runtime::projected-serviceaccount-token", "conf": 0.82, "crit": 3, "desc": "Kubernetes projected service-account path" }, { "id": "micro-behaviors/communications/http/url/build::python-fstring-url-server", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "URL f-string from server", "from": [ { "file": 399 } ] }, { "id": "metadata/file/catalog/service::service-name-github", "conf": 0.6, "crit": 1, "desc": "GitHub service name", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/communications/http/header/custom::x-forwarded-host", "conf": 0.9, "crit": 3, "desc": "X-Forwarded-Host proxy header", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/http/response::source-redirect-admin-path", "conf": 0.82, "crit": 3, "desc": "Redirects request to admin path", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/create/launch::sys-executable-module-launch", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.9, "crit": 3, "desc": "Launches Python module with interpreter", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-cli-run-create", "conf": 0.82, "crit": 3, "desc": "Docker CLI run or create command", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/server/framework::builtin-http-server", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 2, "desc": "Built-in Python HTTP server modules", "from": [ { "off": 798, "file": 208, "line": 22 } ], "uses": [ 127 ] }, { "id": "well-known/tool/offensive/metasploit::multi-handler-module", "atk": "T1071", "mbc": "B0030", "conf": 0.9, "crit": 4, "desc": "Metasploit multi/handler listener module", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/data/runtime/keywords::pipe-to-cmd", "conf": 0.9, "crit": 1, "desc": "Pipe to cmd interpreter", "from": [ { "file": 1052 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 1, "desc": "Python JSON content type", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/data/decode/base64::multiple-b64decode-calls", "conf": 0.97, "crit": 3, "desc": "Multiple Python Base64 decoder calls", "from": [ { "file": 761 } ] }, { "id": "micro-behaviors/communications/http/llm::loopback-host-with-llm-port", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Loopback host with Ollama port or hostname", "from": [ { "file": 845 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-loaded-module-exec-module", "conf": 0.92, "crit": 3, "desc": "Executes a dynamically loaded Python module", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/subprocess::shell-true", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.7, "crit": 3, "desc": "Subprocess call enables shell parsing" }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-chat-completions-path", "atk": "T1071.001", "conf": 0.76, "crit": 3, "desc": "OpenAI-compatible chat completions path", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/os/network/status::lsof-i", "conf": 0.9, "crit": 3, "desc": "lsof network listing", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name-beyond-debug", "conf": 0.9, "crit": 3, "desc": "High-risk privilege beyond SeDebug named", "from": [ { "file": 123 } ] }, { "id": "metadata/file/catalog/service::service-name-discord", "conf": 0.6, "crit": 1, "desc": "Discord service name", "from": [ { "file": 769 } ] }, { "id": "micro-behaviors/process/create/shell/interactive::sh-interactive", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Interactive shell invocation (sh -i)", "from": [ { "file": 98 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 888 } ], "uses": [ 410 ] }, { "id": "micro-behaviors/fs/file/copy::shutil-copy", "conf": 0.8, "crit": 3, "desc": "Python shutil copies a file", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/proxy/mitm::mitmproxy-command--mitmproxy", "conf": 0.9, "crit": 3, "desc": "mitmproxy command invocation (mitmproxy)", "from": [ { "file": 714 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-container-inspect-path", "conf": 0.9, "crit": 3, "desc": "Docker Engine container-inspect API path", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/communications/http/webhook::python-webhook-post", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Python posts data to a webhook", "from": [ { "file": 29 } ], "uses": [ 131, 773 ] }, { "id": "metadata/package/testing/harness/fixture::multiple-token-assignments", "conf": 0.95, "crit": 3, "desc": "Multiple token assignments", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/fs/file/write/direct::py-file-write-call", "conf": 0.78, "crit": 1, "desc": "Python file handle write() call", "from": [ { "file": 9 } ] }, { "id": "well-known/tool/offensive/metasploit::automated-handler-listener", "atk": "T1071", "mbc": "B0030", "conf": 0.95, "crit": 4, "desc": "Metasploit reverse-payload handler being started", "from": [ { "off": 12028, "file": 88, "line": 169 }, { "off": 4873, "file": 1057, "line": 138 } ], "uses": [ 120, 145, 288 ] }, { "id": "micro-behaviors/os/kernel/netlink::ovs-conntrack-expansion", "conf": 0.96, "crit": 4, "desc": "Repeated OVS conntrack action expansion", "from": [ { "off": 5701, "file": 896, "line": 156 } ], "uses": [ 135, 579 ] }, { "id": "micro-behaviors/process/create/workers::parallel-thread-executor", "conf": 0.88, "crit": 3, "desc": "Uses a thread or async task executor", "from": [ { "file": 208 } ] }, { "id": "micro-behaviors/communications/ipc/mcp::mcp-jsonrpc-server-dispatch", "conf": 0.9, "crit": 3, "desc": "MCP JSON-RPC server dispatch", "from": [ { "off": 17245, "file": 290, "line": 440 } ], "uses": [ 189, 331, 764 ] }, { "id": "micro-behaviors/communications/http/endpoints::github-pages", "conf": 0.5, "crit": 3, "desc": "References a GitHub Pages host", "from": [ { "file": 650 } ] }, { "id": "well-known/tool/detection/security-scanner::php-threat-scanner-context", "conf": 0.96, "crit": 3, "desc": "Defensive PHP threat scanner context", "from": [ { "file": 813 } ], "uses": [ 711 ] }, { "id": "micro-behaviors/data/archive/extract/zip::python-zipfile-extractall", "conf": 0.92, "crit": 3, "desc": "Python ZIP archive extraction", "from": [ { "off": 3868, "file": 47, "line": 102 }, { "off": 418, "file": 156, "line": 16 }, { "off": 3019, "file": 453, "line": 98 }, { "off": 229, "file": 584, "line": 12 }, { "file": 765 }, { "file": 767 }, { "file": 1045 }, { "file": 1077 } ], "uses": [ 459, 727 ] }, { "id": "micro-behaviors/fs/write/file/direct::python-pathlib-write-bytes", "mbc": "C0016", "conf": 0.85, "crit": 3, "desc": "Writes bytes with pathlib.Path.write_bytes()", "from": [ { "file": 651 } ] }, { "id": "micro-behaviors/process/create/subprocess::check-output-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "subprocess.check_output call", "from": [ { "file": 32 } ] }, { "id": "objectives/execution/automation/agent::skill-exfil-upload-data", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Skill uploads data", "from": [ { "file": 349 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::python-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python HTTP Content-Length header", "from": [ { "file": 111 } ] }, { "id": "micro-behaviors/communications/http/request/client::response-stream-python", "conf": 0.85, "crit": 3, "desc": "Python HTTP response streaming", "from": [ { "file": 554 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-endpoint-reference", "conf": 0.9, "crit": 3, "desc": "Google Cloud metadata endpoint reference", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/data/decode/command::base64-decode-to-file", "conf": 0.9, "crit": 3, "desc": "Base64 decode redirected into a file", "from": [ { "file": 113 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-from-import", "conf": 0.8, "crit": 3, "desc": "Imports urllib request functions", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/os/env/vars/credentials::python-api-key-env-read", "conf": 0.85, "crit": 3, "desc": "Python reads API key env vars", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/fs/directory/delete::shutil-rmtree", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Calls rmtree() to delete a directory tree", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdin-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdin to custom stream", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/communications/http/token-auth::jwt-unsecured-algorithm", "conf": 0.98, "crit": 3, "desc": "Unsecured alg none setting", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/format/media/raster::declared-image-mime-type", "conf": 0.82, "crit": 3, "desc": "Declares an image MIME type", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::python-permission-error-handler", "atk": "T1027", "mbc": "C0027", "conf": 0.9, "crit": 3, "desc": "Python PermissionError except handler", "from": [ { "file": 289 } ] }, { "id": "micro-behaviors/communications/http/request/client::script-http-client", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Uses a script HTTP client", "from": [ { "file": 32 } ], "uses": [ 649 ] }, { "id": "micro-behaviors/communications/http/download/cli::source-chained-downloader-command", "conf": 0.93, "crit": 3, "desc": "HTTP downloader follows shell operator", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/communications/ipc/mcp::mcp-tools-list-method", "conf": 0.8, "crit": 3, "desc": "MCP tools/list JSON-RPC method", "from": [ { "file": 290 } ] }, { "id": "well-known/tool/offensive/payload-corpus::payloadsallthethings-reference", "conf": 0.9, "crit": 3, "desc": "PayloadsAllTheThings payload-library citation", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/os/network/share::python-smbclient-no-password", "atk": "T1021.002", "conf": 0.94, "crit": 3, "desc": "Python invokes smbclient without password", "from": [ { "file": 54 } ] }, { "id": "metadata/file/catalog/service::service-name-stripe", "conf": 0.82, "crit": 1, "desc": "Stripe service name", "from": [ { "file": 929 } ] }, { "id": "micro-behaviors/fs/proc/container::container-pid1-cgroup", "conf": 0.66, "crit": 3, "desc": "Reads /proc/1/cgroup (PID 1 container check)" }, { "id": "micro-behaviors/communications/http/download/cli::curl-s-flag", "conf": 0.6, "crit": 2, "desc": "curl silent flag (-s)" }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path" }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-embedded-command", "conf": 0.85, "crit": 3, "desc": "String literal sets curl/wget output file", "from": [ { "file": 782 } ] }, { "id": "objectives/credential-access/files/config::login-secret-file-paths--rx-7", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "Shell history file path literal", "from": [ { "file": 123 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "metadata/file/catalog/service::cloud-saas-service-names", "conf": 0.6, "crit": 1, "desc": "Cloud SaaS service names", "from": [ { "file": 76 } ], "uses": [ 282, 299, 499 ] }, { "id": "objectives/execution/exploit/sandbox-escape::python-runtime-subclass-enumeration", "atk": "T1059.006,T1203", "conf": 0.96, "crit": 3, "desc": "Python enumerates runtime subclasses", "from": [ { "file": 1061 } ] }, { "id": "well-known/tool/detection/security-scanner::defensive-dangerous-command-doc", "conf": 0.92, "crit": 1, "desc": "Defensive dangerous command documentation", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-status", "conf": 0.74, "crit": 3, "desc": "References own process status procfs path", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-var-run-sock", "conf": 0.75, "crit": 3, "desc": "Docker socket path" }, { "id": "micro-behaviors/fs/write/file/pathlib::python-path-open-write-binary", "conf": 0.9, "crit": 3, "desc": "Python pathlib opens binary output", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/fs/file/write/direct::py-stream-write-call", "conf": 0.78, "crit": 1, "desc": "Python stream write() call", "from": [ { "file": 290 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::python-crontab-list-query", "conf": 0.9, "crit": 3, "desc": "Python queries crontab", "from": [ { "file": 764 } ] }, { "id": "micro-behaviors/process/create/script/automation::playwright-page-evaluate", "atk": "T1059", "conf": 0.86, "crit": 3, "desc": "Executes code with Playwright page.evaluate()", "from": [ { "file": 690 } ] }, { "id": "micro-behaviors/communications/http/token-auth::access-token-field-source", "conf": 0.92, "crit": 3, "desc": "Access token field in source", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-safe-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP safe request line", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/os/firewall/nftables::nftables", "conf": 0.9, "crit": 3, "desc": "nftables firewall subsystem reference", "from": [ { "file": 232 } ] }, { "id": "micro-behaviors/data/control-flow/loop::python-range-loop-large-bound", "conf": 0.85, "crit": 3, "desc": "Uses a large-bound Python range loop", "from": [ { "file": 823 } ] }, { "id": "micro-behaviors/fs/read/file::python-pathlib-read-bytes", "atk": "T1005", "mbc": "E1005", "conf": 0.8, "crit": 2, "desc": "Read bytes via pathlib", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/communications/http/form::viewstate-field", "conf": 0.85, "crit": 3, "desc": "ASP.NET __VIEWSTATE form field", "from": [ { "file": 1015 } ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "XOR loop uses repeating-key modulo indexing", "from": [ { "file": 339 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus-arg", "conf": 0.75, "crit": 1, "desc": "Python sleep waits at least one second", "from": [ { "file": 84 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 888 } ], "uses": [ 301 ] }, { "id": "objectives/discovery/network/enumeration::certificate-search-query", "conf": 0.88, "crit": 3, "desc": "crt.sh JSON certificate query" }, { "id": "objectives/execution/exploit/http-desync::repeated-content-length-header-lines", "atk": "T1190", "mbc": "E1190", "conf": 0.98, "crit": 1, "desc": "Duplicate Content-Length headers in one template", "from": [ { "file": 111 } ] }, { "id": "micro-behaviors/data/string/concat::dense-string-fragment-concatenation", "conf": 0.9, "crit": 3, "desc": "Dense concatenated string fragments" }, { "id": "micro-behaviors/data/decode/encoded/formats::python-urlsafe-base64-decode", "conf": 0.85, "crit": 3, "desc": "Python URL-safe Base64 decoder call", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-sha1-operation", "conf": 0.93, "crit": 3, "desc": "HMAC-SHA1 operation marker", "from": [ { "file": 635 } ] }, { "id": "micro-behaviors/process/create/system::python-os-system-text", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.85, "crit": 3, "desc": "os.system shell execution in source text", "from": [ { "file": 212 } ] }, { "id": "micro-behaviors/communications/http/server/request::python-http-request-body-read", "conf": 0.9, "crit": 3, "desc": "Reads raw Python HTTP request body", "from": [ { "file": 208 } ] }, { "id": "micro-behaviors/communications/http/response-code::rate-limit-header-handling", "atk": "T1590", "mbc": "C0002", "conf": 0.93, "crit": 3, "desc": "Recognizes HTTP 429 and Retry-After", "from": [ { "off": 31768, "file": 844, "line": 736 }, { "off": 1101, "file": 1064, "line": 39 }, { "off": 3654, "file": 1075, "line": 86 } ], "uses": [ 567, 731 ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "raw.githubusercontent.com JSON URL", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/communications/http/server/request::extract-from-request-form", "conf": 0.8, "crit": 3, "desc": "Extracts a request form field", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-rglob-call", "conf": 0.84, "crit": 3, "desc": "Calls pathlib rglob for recursive enumeration", "from": [ { "file": 218 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-password-file-path-pair", "conf": 0.9, "crit": 3, "desc": "References Unix passwd and shadow paths" }, { "id": "micro-behaviors/communications/http/ssl::requests-verify-false", "conf": 0.85, "crit": 3, "desc": "Requests GET/POST/PUT TLS verification off", "from": [ { "file": 1056 } ] }, { "id": "objectives/discovery/system/fingerprint/os::platform-profiling", "atk": "T1082", "mbc": "B0012", "conf": 0.8, "crit": 3, "desc": "System platform profiling", "from": [ { "off": 22428, "file": 28, "line": 450 }, { "off": 1044, "file": 811, "line": 30 } ], "uses": [ 636, 702 ] }, { "id": "objectives/execution/automation/agent::skill-exfil-destination-url", "atk": "T1059", "conf": 0.9, "crit": 1, "desc": "Skill names a URL destination", "from": [ { "file": 349 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "conf": 0.8, "crit": 3, "desc": "Contains an SQL INSERT statement", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/server/request::python-http-file-response", "conf": 0.86, "crit": 3, "desc": "Writes file response from HTTP handler", "from": [ { "file": 208 } ] }, { "id": "micro-behaviors/os/env/vars/credentials::python-env-keyword-key", "conf": 0.88, "crit": 1, "desc": "Python getenv name contains KEY", "from": [ { "file": 820 } ] }, { "id": "metadata/package/dependencies/declaration::pypi-http-client-dependency", "conf": 0.9, "crit": 3, "desc": "PyPI metadata declares an HTTP client dependency" }, { "id": "micro-behaviors/data/db/sql::sql-drop-object", "conf": 0.8, "crit": 3, "desc": "DROP SQL object syntax reference", "from": [ { "file": 131 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-redirect-state-pair", "conf": 0.9, "crit": 3, "desc": "OAuth redirect and state parameters", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "from": [ { "file": 2 } ], "uses": [ 265 ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::py-importlib-import-module", "conf": 0.6, "crit": 3, "desc": "Dynamically imports a Python module", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/crypto/certificate/transparency::crt-sh-endpoint", "conf": 0.92, "crit": 3, "desc": "crt.sh certificate lookup endpoint" }, { "id": "micro-behaviors/process/create/shell/build::python-pip-install-command", "atk": "T1059", "conf": 0.92, "crit": 3, "desc": "Python subprocess pip install command", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/data/encode/hex::string-encode-hex", "conf": 0.9, "crit": 3, "desc": "String bytes converted to hex", "from": [ { "file": 411 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/ecosystem::pypi-license-metadata", "conf": 0.94, "crit": 2, "desc": "PyPI package declares license information", "from": [ { "file": 1165 } ], "uses": [ 251, 458 ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::platform-system", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Queries the OS with platform.system()", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/communications/http/server/request::extract-from-request-json", "conf": 0.8, "crit": 3, "desc": "Extract data from JSON request body", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/server/listener::caddy-keyword", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Caddy web server", "from": [ { "file": 1015 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client-usage", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses HTTP client APIs", "from": [ { "file": 32 } ], "uses": [ 649 ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Launches a process with subprocess.Popen", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/communications/socket/bind/address::python-framework-server-all-interfaces", "conf": 0.9, "crit": 3, "desc": "Python framework server binds all interfaces", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-output-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Python subprocess captures output streams" }, { "id": "micro-behaviors/os/security/auth/password::python-hardcoded-password-call-argument", "conf": 0.9, "crit": 3, "desc": "Python call with hardcoded password argument" }, { "id": "micro-behaviors/communications/http/cookies::python-response-set-cookie-header-read", "conf": 0.95, "crit": 3, "desc": "Python response object reads Set-Cookie header", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/process/tty/pty::import-pty", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "import pty statement", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/fs/write/credential::python-auth-variable-file-write", "conf": 0.9, "crit": 3, "desc": "Writes auth variable to a file" }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd-cat", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd read via cat command" }, { "id": "micro-behaviors/data/string/measure::alphanumeric-ratio-check", "conf": 0.7, "crit": 3, "desc": "Checks alphanumeric character ratio in string", "from": [ { "file": 844 } ] }, { "id": "metadata/file/catalog/service::service-name-openai", "conf": 0.82, "crit": 1, "desc": "OpenAI service name", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/communications/http/server/request::extract-from-request-query", "conf": 0.8, "crit": 3, "desc": "Extracts a request query field", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/os/container/runtime::api-namespaces-path", "conf": 0.75, "crit": 3, "desc": "Kubernetes namespaced core resource API path" }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "from": [ { "file": 257 } ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd", "conf": 0.8, "crit": 3, "desc": "References a /dev/sd SCSI/SATA device path" }, { "id": "micro-behaviors/communications/http/services/github::gh-issue-mgmt", "conf": 1.0, "crit": 3, "desc": "GitHub CLI repository workflow operations" }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-spec-from-file-location", "conf": 0.9, "crit": 3, "desc": "Loads Python module from source file", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-wildcard-entry", "conf": 0.85, "crit": 3, "desc": "Wildcard crontab entry with command", "from": [ { "file": 123 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "from": [ { "file": 888 } ] }, { "id": "objectives/execution/interpreter/eval/remote::jinja-os-command-sink", "atk": "T1059.006,T1190", "conf": 0.98, "crit": 4, "desc": "Jinja builtins traversal reaches shell", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/ui/graphics/image::python-screenshot-image-method", "conf": 0.75, "crit": 3, "desc": "Calls Python screenshot image method", "from": [ { "file": 690 } ] }, { "id": "micro-behaviors/process/terminate/kill::python-process-kill-call", "conf": 0.9, "crit": 3, "desc": "Python calls a process kill method", "from": [ { "file": 193 } ] }, { "id": "metadata/file/string/application-name::safari-browser-name-literal", "conf": 0.4, "crit": 1, "desc": "String literal names the Safari browser", "from": [ { "file": 1093 } ] }, { "id": "micro-behaviors/communications/http/url/php-endpoint::url-php-query-script", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "URL targets .php with query", "from": [ { "file": 131 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::reverse-shell-python", "atk": "T1059.006", "conf": 0.95, "crit": 4, "desc": "Python reverse shell pattern", "from": [ { "file": 126 } ] }, { "id": "objectives/command-and-control/reverse-shell/dev-tcp::dev-tcp-bash-stdin-redirect", "atk": "T1059.004", "mbc": "B0030", "conf": 0.99, "crit": 5, "desc": "Bash interactive reverse shell with stdin redirection", "from": [ { "off": 796, "file": 98, "line": 32 }, { "off": 1598, "file": 126, "line": 49 }, { "off": 252, "file": 782, "line": 11 } ], "uses": [ 268, 634 ] }, { "id": "micro-behaviors/os/container/runtime::docker-socket-path-scripts-binaries", "conf": 0.9, "crit": 3, "desc": "Docker daemon Unix socket path reference", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/os/privilege/elevation::python-sudo-subprocess-invoke", "conf": 0.7, "crit": 3, "desc": "Invokes sudo/doas via Python subprocess", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/process/create/direct::python-os-execv-call", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Python os.execv process replacement" }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-ex-method-short", "conf": 0.88, "crit": 3, "desc": "Python socket-like connect_ex call", "from": [ { "file": 289 } ] }, { "id": "objectives/command-and-control/backdoor/keywords::reverse-shell-match", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "References reverse-shell terminology", "from": [ { "off": 6356, "file": 70, "line": 139 }, { "file": 126 }, { "file": 782 } ], "uses": [ 542 ] }, { "id": "micro-behaviors/fs/directory/delete::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Contains an executable rm -rf deletion command", "from": [ { "file": 213 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::curl-pipe-shell-text", "atk": "T1059.004", "conf": 0.9, "crit": 3, "desc": "References a curl- or wget-to-shell pipeline", "from": [ { "file": 103 } ] }, { "id": "micro-behaviors/communications/websocket/library::websocket-client-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python websocket-client library import", "from": [ { "file": 1123 } ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/data/db/sql::schema-enumeration-query-suite", "conf": 0.94, "crit": 3, "desc": "SQL schema enumeration query suite", "from": [ { "off": 1136, "file": 78, "line": 46 }, { "off": 3100, "file": 131, "line": 77 } ], "uses": [ 110, 544 ] }, { "id": "micro-behaviors/fs/path/device/storage::unix-block-device-path", "atk": "T1561", "mbc": "E1561", "conf": 0.9, "crit": 3, "desc": "References a Unix block device path" }, { "id": "micro-behaviors/communications/http/websocket::wss-scheme", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "References an encrypted wss:// WebSocket URL", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/data/encode/base32::python-b32decode-call", "mbc": "C0026", "conf": 0.93, "crit": 3, "desc": "Python calls the Base32 decoder", "from": [ { "file": 411 } ] }, { "id": "micro-behaviors/data/db/sql::sql-delete-clause", "conf": 0.5, "crit": 3, "desc": "SQL DELETE statement clause", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/request/params::python-token-request-parameter", "conf": 0.84, "crit": 3, "desc": "Reads Python token request parameter", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda", "atk": "T1561", "mbc": "E1561", "conf": 0.6, "crit": 3, "desc": "References /dev/sda SATA/SCSI disk path" }, { "id": "micro-behaviors/communications/http/lib/requests::requests-head", "conf": 0.85, "crit": 3, "desc": "requests.head call (Python)", "from": [ { "file": 554 } ] }, { "id": "micro-behaviors/communications/http/request/result::http-post-client-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "HTTP POST client call", "from": [ { "file": 494 } ] }, { "id": "micro-behaviors/fs/proc/mounts::proc-mounts-path", "conf": 0.66, "crit": 3, "desc": "References /proc/mounts path", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-file", "atk": "T1105", "conf": 0.7, "crit": 3, "desc": "References curl output-path option" }, { "id": "micro-behaviors/os/container/runtime::secrets-path", "conf": 0.7, "crit": 3, "desc": "Kubernetes secrets path" }, { "id": "micro-behaviors/communications/http/header/custom::application-user-agent", "conf": 0.86, "crit": 3, "desc": "Application-specific User-Agent header", "from": [ { "file": 1053 } ] }, { "id": "micro-behaviors/communications/http/header/custom::non-mozilla-user-agent-header", "conf": 0.9, "crit": 3, "desc": "Sets a non-Mozilla User-Agent header", "from": [ { "file": 652 } ] }, { "id": "micro-behaviors/communications/http/client/library::anthropic-messages-create", "conf": 0.95, "crit": 3, "desc": "Sends an Anthropic Messages API request", "from": [ { "file": 844 } ] }, { "id": "metadata/file/catalog/service::finance-service-names", "conf": 0.82, "crit": 1, "desc": "Finance and payment service names", "from": [ { "off": 324, "file": 929, "line": 10 } ], "uses": [ 334 ] }, { "id": "micro-behaviors/process/interpreter/python::exec-builtin", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Executes dynamic Python code with exec()", "from": [ { "file": 860 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-response-content-access", "conf": 0.82, "crit": 3, "desc": "Reads a requests response body (.content)", "from": [ { "file": 150 } ], "uses": [ 39, 101, 769 ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/communications/http/curl::curl-post-flag", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "curl explicitly sends an HTTP POST request", "from": [ { "file": 118 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-dup2", "conf": 0.85, "crit": 1, "desc": "Python file descriptor duplication (os.dup2)" }, { "id": "micro-behaviors/data/serialize/object::json-dump", "conf": 0.86, "crit": 3, "desc": "Serializes to a stream with json.dump()", "from": [ { "file": 291 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credential-filenames::credentials-json-file", "conf": 0.85, "crit": 3, "desc": "References a credentials.json file", "from": [ { "file": 67 } ] }, { "id": "objectives/lateral-movement/exploit/scanner::exploit-endpoint-url", "atk": "T1210", "conf": 0.7, "crit": 1, "desc": "Exploit-prone admin/CGI endpoint path", "from": [ { "file": 42 }, { "file": 90 }, { "file": 108 }, { "off": 1187, "file": 226, "line": 38 }, { "off": 30772, "file": 1044, "line": 745 } ], "uses": [ 97, 462, 734, 782 ] }, { "id": "micro-behaviors/communications/http/request/client::requests-post-url-literal", "conf": 0.8, "crit": 3, "desc": "requests/httpx post URL literal", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "conf": 0.7, "crit": 3, "desc": "References Mozilla/5.0 User-Agent prefix", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::socket-dns-lookup", "conf": 0.8, "crit": 3, "desc": "Socket-based DNS lookup capability", "from": [ { "off": 584, "file": 393, "line": 21 }, { "file": 766 }, { "file": 1009 } ], "uses": [ 31, 207 ] }, { "id": "micro-behaviors/process/io/stream::process-stderr-result-field", "conf": 0.96, "crit": 3, "desc": "Captures process stderr in result", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::remote-response-body-read", "conf": 0.92, "crit": 3, "desc": "Reads a remote HTTP response body", "from": [ { "file": 28 } ], "uses": [ 5, 187 ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::git-credentials", "atk": "T1552.001", "conf": 0.95, "crit": 3, "desc": "Git credentials file", "from": [ { "file": 471 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 1, "desc": "Declares Python Core Metadata version", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/data/archive/extract/capability::python-extractall-call", "conf": 0.9, "crit": 3, "desc": "Python archive extractall call", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/fs/write/file/direct::python-open-write-binary", "mbc": "C0016", "conf": 0.85, "crit": 3, "desc": "Python opens file for binary write", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/os/privilege/paths::sys-kernel-security", "conf": 0.9, "crit": 3, "desc": "/sys/kernel/security/ LSM access" }, { "id": "objectives/lateral-movement/exploit/scanner::cgi-bin-endpoint-url", "atk": "T1210", "conf": 0.7, "crit": 1, "desc": "CGI endpoint path", "from": [ { "file": 1044 } ] }, { "id": "micro-behaviors/process/create/construction::command-spreading", "conf": 0.85, "crit": 3, "desc": "Command spreading (String construction +)", "from": [ { "file": 39 } ], "uses": [ 509 ] }, { "id": "objectives/command-and-control/reverse-shell/dup::powershell-iex-on-stream-read", "atk": "T1059.001,T1105", "conf": 0.93, "crit": 3, "desc": "PowerShell iex consumes stream-read bytes", "from": [ { "file": 782 } ] }, { "id": "metadata/file/catalog/service::service-name-vault", "conf": 0.82, "crit": 1, "desc": "Vault service name", "from": [ { "file": 289 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::python-credentialed-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python credentialed HTTP URL", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/download/cli::wget-q-flag", "conf": 0.6, "crit": 2, "desc": "wget quiet flag (-q)", "from": [ { "file": 782 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-run-sys-executable", "atk": "T1059.006", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "subprocess.run relaunches Python interpreter", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/post::post-method-detection", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Uses an HTTP POST request method", "from": [ { "file": 32 }, { "file": 111 } ], "uses": [ 737 ] }, { "id": "micro-behaviors/communications/http/headers::x-api-key-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Configures an X-API-Key request header" }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-target", "conf": 0.9, "crit": 3, "desc": "HTTP request targets loopback address", "from": [ { "file": 759 } ], "uses": [ 295, 630 ] }, { "id": "micro-behaviors/communications/url/encoded::percent-encoded-url-value-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "URL percent-encoded as a parameter value", "from": [ { "file": 120 } ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.7, "crit": 3, "desc": "HTTP URL uses alternate port 8080", "from": [ { "file": 269 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-devnull", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "Python subprocess suppresses stdio", "from": [ { "file": 193 } ] }, { "id": "objectives/execution/automation/agent::agent-target-operation-forward", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent names target probing activity", "from": [ { "file": 66 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-keyword-reference", "conf": 0.5, "crit": 3, "desc": "References an OAuth endpoint marker", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-provider-openai-host", "atk": "T1071.001", "conf": 0.82, "crit": 1, "desc": "OpenAI provider host", "from": [ { "file": 845 } ] }, { "id": "objectives/credential-access/cracking/password::kerberos-spn-enumeration", "atk": "T1558.003", "conf": 0.9, "crit": 3, "desc": "Enumerates SPN service accounts", "from": [ { "file": 53 } ] }, { "id": "objectives/credential-access/cloud/container::container-secrets-read-command", "atk": "T1552.005", "conf": 0.88, "crit": 3, "desc": "Container secrets read command" }, { "id": "micro-behaviors/communications/http/upload::curl-at-tmp", "conf": 0.8, "crit": 3, "desc": "curl uploads a file from /tmp", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/ssh/keys::authorized-keys-append-redirect", "conf": 0.9, "crit": 3, "desc": "SSH authorized_keys append redirect", "from": [ { "file": 123 } ] }, { "id": "well-known/app/ai/gateway/ollama::ollama-api-tags-path", "conf": 0.98, "crit": 3, "desc": "Ollama model-list API path", "from": [ { "file": 845 } ] }, { "id": "objectives/collection/file-targeting/filter::credential-file-extension", "atk": "T1005,T1083", "conf": 0.92, "crit": 1, "desc": "Credential-like filename extension", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/communications/http/url/build::python-fstring-url", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "URL constructed with f-string variable", "from": [ { "off": 14045, "file": 29, "line": 332 }, { "off": 573, "file": 399, "line": 26 } ], "uses": [ 85, 281 ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-environ", "conf": 0.92, "crit": 3, "desc": "Read own process environment via procfs", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/data/db/sqlite::python-sqlite3-import", "conf": 0.95, "crit": 3, "desc": "Imports Python SQLite database module", "from": [ { "file": 28 } ] }, { "id": "metadata/file/string/cloud::aws-metadata-endpoint", "conf": 0.85, "crit": 3, "desc": "AWS EC2 metadata endpoint", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/os/security/auth/session::source-session-user-id-assignment", "conf": 0.88, "crit": 3, "desc": "Assigns session user identifier", "from": [ { "file": 32 } ] }, { "id": "metadata/package/testing/scripted::pytest-markers", "conf": 0.8, "crit": 2, "desc": "pytest-specific markers", "from": [ { "file": 168 }, { "file": 221 }, { "file": 289 } ], "uses": [ 273 ] }, { "id": "objectives/command-and-control/reverse-shell/dup::powershell-command-output-loop", "atk": "T1059.001,T1105", "conf": 0.97, "crit": 4, "desc": "PowerShell command output socket loop", "from": [ { "file": 782 } ] }, { "id": "micro-behaviors/process/lifecycle/auto-exec::asyncio-run-call", "conf": 0.85, "crit": 3, "desc": "Python asyncio.run call", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/communications/http/request/client::url-literal", "conf": 0.8, "crit": 3, "desc": "Uses a literal URL in an HTTP request", "from": [ { "file": 29 }, { "file": 387 }, { "file": 848 }, { "file": 1009 }, { "file": 1111 } ], "uses": [ 73, 452 ] }, { "id": "objectives/execution/automation/agent::agent-exploit-workflow-marker", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent workflow names exploit activity", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/os/container/runtime::service-env", "conf": 0.7, "crit": 3, "desc": "Kubernetes service environment variable", "from": [ { "file": 98 } ] }, { "id": "micro-behaviors/communications/http/url/build::python-post-to-derived-url", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "Python POST to computed URL", "from": [ { "file": 838 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/exec::python-asyncio-subprocess-call", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "Python creates a subprocess through asyncio", "from": [ { "file": 293 } ] }, { "id": "metadata/file/catalog/service::service-name-digitalocean", "conf": 0.6, "crit": 1, "desc": "DigitalOcean service name", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/process/create/subprocess::os-exec-family", "atk": "T1059.006", "conf": 0.85, "crit": 3, "desc": "os.exec* family functions", "from": [ { "file": 782 } ], "uses": [ 275 ] }, { "id": "objectives/command-and-control/reverse-shell/dup::socket-shell-exec-malware-term", "atk": "T1059", "mbc": "B0030", "conf": 0.96, "crit": 5, "desc": "Socket dial and executed shell near reverse-shell term", "from": [ { "file": 126 } ], "uses": [ 423, 529, 658, 706 ] }, { "id": "micro-behaviors/communications/http/header/transfer-encoding::chunked-transfer-encoding", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "HTTP chunked transfer encoding", "from": [ { "file": 111 } ] }, { "id": "objectives/command-and-control/dropper/lifecycle::python-comp", "atk": "T1059.006", "mbc": "B0024", "conf": 0.95, "crit": 4, "desc": "Nearby temporary download, executable chmod, and launch", "from": [ { "file": 782 } ], "uses": [ 6, 38, 185, 214, 265, 275, 336, 338, 381, 438, 467, 497, 500, 578, 588, 726 ] }, { "id": "micro-behaviors/os/network/share::net-view-share-enum", "conf": 0.9, "crit": 3, "desc": "Enumerates network shares with net view", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/process/tty/pty::openpty-call", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "openpty() call", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/process/create/shell/command-string::embedded-sh-c-literal", "conf": 0.8, "crit": 3, "desc": "Embedded shell command string uses -c", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/os/service/config::systemd-etc-directory-path", "conf": 0.9, "crit": 3, "desc": "System-wide /etc/systemd directory", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-detached-session", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Python starts a detached subprocess session", "from": [ { "file": 1070 } ] }, { "id": "micro-behaviors/process/create/construction::string-assign", "conf": 0.6, "crit": 2, "desc": "Assigns a command-like string to a variable" }, { "id": "micro-behaviors/fs/disk/partition::fdisk-command", "conf": 0.9, "crit": 3, "desc": "Shell invokes an fdisk partitioning tool" }, { "id": "objectives/execution/automation/agent::agent-exploit-plan-marker", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent plan names exploit activity", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlopen-variable-argument", "conf": 0.9, "crit": 3, "desc": "Passes variable as urlopen argument" }, { "id": "micro-behaviors/fs/path/config/system::config-crontab", "conf": 0.78, "crit": 3, "desc": "Reference to /etc/crontab" }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 28 } ] }, { "id": "metadata/file/catalog/service::service-name-slack", "conf": 0.82, "crit": 1, "desc": "Slack service name", "from": [ { "file": 76 } ] }, { "id": "metadata/file/string/cloud::aws-imds-v2-token-path", "conf": 0.88, "crit": 3, "desc": "AWS IMDSv2 token request path", "from": [ { "file": 269 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 1, "desc": "HTTP POST method string literal", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::chmod-exec-absolute-path", "atk": "T1222", "mbc": "E1222", "conf": 0.92, "crit": 3, "desc": "chmod makes an absolute path executable" }, { "id": "micro-behaviors/data/decode/base64::b64decode-call", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with Python", "from": [ { "file": 411 } ] }, { "id": "micro-behaviors/fs/file/write/direct::python-os-write-fd", "conf": 0.9, "crit": 3, "desc": "Writes bytes through Python file descriptor", "from": [ { "file": 696 } ] }, { "id": "metadata/package/scripts/entrypoint::entry-points-file", "conf": 0.95, "crit": 1, "desc": "Python package contains an entry_points.txt file", "from": [ { "file": 1166 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/fs/path/check::python-path-containment-check", "conf": 0.9, "crit": 3, "desc": "Checks whether path lies beneath directory", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/communications/http/browser-proxy::browser-url-relay-target", "atk": "T1041", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Browser relay target URL parameter", "from": [ { "file": 759 } ] }, { "id": "objectives/discovery/network/enumeration::certificate-transparency-domain-search", "conf": 0.94, "crit": 3, "desc": "Searches certificate records for a domain", "from": [ { "file": 133 }, { "off": 1944, "file": 326, "line": 62 }, { "off": 194, "file": 327, "line": 10 }, { "off": 1951, "file": 332, "line": 62 }, { "off": 600, "file": 333, "line": 25 } ], "uses": [ 359, 383 ] }, { "id": "objectives/evasion/security-bypass/policy/web-admin::encoded-parent-dir-traversal", "atk": "T1190", "mbc": "E1190", "conf": 0.9, "crit": 4, "desc": "URL-encoded parent-directory traversal", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/process/create/script/automation::playwright-python-sync-api-import", "atk": "T1059", "conf": 0.95, "crit": 3, "desc": "Imports the Python Playwright sync API", "from": [ { "file": 690 } ] }, { "id": "micro-behaviors/fs/chmod/modify::python-path-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.85, "crit": 3, "desc": "Python calls chmod to change permissions", "from": [ { "file": 293 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::any-shell-binary-spawn", "atk": "T1059", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Shell binary spawned directly or fed on stdin", "from": [ { "file": 98 }, { "file": 782 } ], "uses": [ 178, 300 ] }, { "id": "micro-behaviors/time/sleep/interval::sleep-interval-before-call", "conf": 0.65, "crit": 3, "desc": "Sleep follows an interval configuration term", "from": [ { "file": 131 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus", "conf": 0.75, "crit": 1, "desc": "Python one-second-plus sleep", "from": [ { "file": 84 } ], "uses": [ 71, 357 ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::authorized-keys-public-key-doc", "atk": "T1552.001", "conf": 0.9, "crit": 2, "desc": "authorized_keys public_key docs", "from": [ { "file": 123 } ], "uses": [ 172 ] }, { "id": "micro-behaviors/os/env/vars/credentials::posix-env-token-name", "conf": 0.7, "crit": 3, "desc": "Reads a TOKEN-named environment variable", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/fs/path/config/git::git-repository-config-path", "conf": 0.9, "crit": 3, "desc": "References a Git repository configuration path", "from": [ { "file": 33 } ] }, { "id": "objectives/evasion/security-bypass/policy/web-admin::semicolon-segment-traversal", "atk": "T1190", "mbc": "E1190", "conf": 0.95, "crit": 4, "desc": "Dot-dot-semicolon path-normalization bypass", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/fs/directory/cwd::python-path-cwd", "conf": 0.9, "crit": 3, "desc": "Gets the current directory with Path.cwd", "from": [ { "file": 11 } ] }, { "id": "objectives/execution/exploit/sql-injection::postgres-delay-payload", "atk": "T1190", "conf": 0.95, "crit": 4, "desc": "PostgreSQL pg_sleep time-delay injection payload", "from": [ { "file": 788 } ] }, { "id": "micro-behaviors/process/tty/pty::python-openpty-call", "atk": "T1059", "conf": 0.92, "crit": 3, "desc": "Python allocates a pseudoterminal pair", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/data/db/config::db-key-host", "conf": 0.85, "crit": 1, "desc": "Connection host key", "from": [ { "file": 96 } ] }, { "id": "well-known/lib/network/urllib3::urllib3-name", "conf": 1.0, "crit": 3, "desc": "Imports the Python urllib3 library", "from": [ { "file": 802 } ] }, { "id": "micro-behaviors/communications/socket/send::socket-send-method", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python socket-like send call", "from": [ { "file": 1050 } ], "uses": [ 556 ] }, { "id": "objectives/command-and-control/backdoor/keywords::generic-term-reverse-shell", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Reverse shell keyword", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/os/env/vars/credentials::python-openai-anthropic-key-env-read", "conf": 0.95, "crit": 3, "desc": "Python reads OpenAI or Anthropic API key", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/data/db/sql::information-schema-ref", "conf": 1.0, "crit": 3, "desc": "SQL information_schema reference", "from": [ { "file": 78 } ] }, { "id": "objectives/execution/automation/agent::agent-target-discovery-b", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent surveys public assets", "from": [ { "file": 173 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-token-usage-json--rx-7", "atk": "T1071.001", "conf": 0.65, "crit": 1, "desc": "LLM output-token count field", "from": [ { "file": 289 } ] }, { "id": "micro-behaviors/process/create/shell/runner::python-run-command-call", "conf": 0.85, "crit": 3, "desc": "Calls run_command helper", "from": [ { "file": 144 } ] }, { "id": "micro-behaviors/process/daemonize/detach::nohup-shell-launch", "atk": "T1059.004", "conf": 0.86, "crit": 3, "desc": "Shell launches a named command with nohup" }, { "id": "micro-behaviors/process/create/subprocess::subprocess-shell-cwd-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Subprocess sets shell or working directory" }, { "id": "metadata/package/scripts/entrypoint::wheel-console-entrypoint", "conf": 0.9, "crit": 3, "desc": "Package declares a console-script entry point", "from": [ { "file": 1166 } ], "uses": [ 521, 686 ] }, { "id": "objectives/command-and-control/reverse-shell/pty::stdio-dup2-socket", "atk": "T1059.006", "conf": 0.9, "crit": 4, "desc": "Python socket descriptor bridged to stdio", "from": [ { "file": 126 }, { "file": 208 }, { "file": 782 }, { "file": 985 } ], "uses": [ 22, 80 ] }, { "id": "objectives/discovery/network/scan/port::target-port", "atk": "T1046", "mbc": "E1046", "conf": 0.4, "crit": 1, "desc": "Target-port identifier fragment", "from": [ { "file": 208 } ] }, { "id": "metadata/file/string/cloud::azure-metadata-endpoint", "conf": 0.85, "crit": 3, "desc": "Azure IMDS endpoint", "from": [ { "file": 132 } ] }, { "id": "objectives/credential-access/files/config::credential-path-table--rx-12", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "Terraform or RSA/DSA SSH-key path literal", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/communications/http/server/framework::server-python", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python HTTP server", "from": [ { "file": 25 } ], "uses": [ 162, 287 ] }, { "id": "micro-behaviors/communications/socket/send::socket-send-method-short", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Short Python socket send call", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::schtasks-action-argument", "atk": "T1053.005", "mbc": "F0012", "conf": 0.9, "crit": 3, "desc": "schtasks command supplies a /TR action", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/ip/parse::ipv4-cidr-slash-24-or-wider", "conf": 0.9, "crit": 3, "desc": "IPv4 CIDR prefix /24 or wider", "from": [ { "file": 291 } ] }, { "id": "micro-behaviors/data/decode/encoded/formats::python-base32-decode", "conf": 0.85, "crit": 3, "desc": "Python base32 decoder call", "from": [ { "file": 411 } ] }, { "id": "micro-behaviors/process/create/agent::ai-agent-tools-key", "atk": "T1059", "mbc": "B0022", "conf": 0.9, "crit": 1, "desc": "Agent tool-list configuration key", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/upload::curl-form-file-attachment", "conf": 0.7, "crit": 3, "desc": "curl -F attaches a local file", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/http/request/client::python-request-data-argument", "conf": 0.84, "crit": 3, "desc": "Python Request call passes a body argument" }, { "id": "micro-behaviors/fs/file/open::write-append-create-mode", "conf": 0.85, "crit": 3, "desc": "Python file opened for write or append" }, { "id": "objectives/command-and-control/reverse-shell/dup::inline-python-socket-dup2", "conf": 0.95, "crit": 4, "desc": "Inline Python socket dup2 redirection" }, { "id": "well-known/tool/detection/pattern-catalog::danger-catalog-constant", "conf": 0.9, "crit": 3, "desc": "Module constant naming dangerous patterns", "from": [ { "file": 213 } ] }, { "id": "micro-behaviors/process/create/exec::python-subprocess-string-command", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "Subprocess API receives literal command string", "from": [ { "file": 684 } ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-429-status", "atk": "T1590", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source checks for HTTP 429 rate-limit response", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/communications/icmp/ping::python-ping-shell-flag", "conf": 0.9, "crit": 3, "desc": "Python shell command includes ping flags", "from": [ { "file": 32 } ] }, { "id": "objectives/execution/automation/agent::agent-exploit-tasking", "atk": "T1059,T1190,T1595", "conf": 0.9, "crit": 3, "desc": "Agent task joins exploit and target operations", "from": [ { "file": 102 } ], "uses": [ 663, 678 ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-string-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Python imports named module dynamically", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/tty/pty::python-pty-master-write", "atk": "T1059", "conf": 0.92, "crit": 3, "desc": "Python writes bytes to PTY master", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/process/create/subprocess-shell::check-output-shell-true", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "check_output invoked with shell=True", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/create/agent::ai-agent-terminal-tool-setting", "atk": "T1059", "mbc": "B0022", "conf": 0.92, "crit": 3, "desc": "Agent terminal tool configuration", "from": [ { "file": 418 } ], "uses": [ 215, 560 ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda-python-call", "atk": "T1561", "mbc": "E1561", "conf": 0.85, "crit": 3, "desc": "Passes /dev/sda to a Python call" }, { "id": "micro-behaviors/process/create/flags::python-create-no-window-getattr", "atk": "T1564.003", "mbc": "F0005", "conf": 0.92, "crit": 3, "desc": "Python gets CREATE_NO_WINDOW for child", "from": [ { "file": 822 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords--containerd", "conf": 0.86, "crit": 1, "desc": "Container engine name literal (containerd)", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd-python-call", "conf": 0.85, "crit": 3, "desc": "Passes /dev/sd path to a Python call" }, { "id": "micro-behaviors/communications/http/download/curl::curl-invoked-with-url-or-option", "conf": 0.3, "crit": 1, "desc": "curl invoked with URL or option", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/os/kernel/netlink::ovs-conntrack-python-loop", "conf": 0.92, "crit": 4, "desc": "Python loop builds OVS conntrack actions", "from": [ { "file": 896 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-requires-dist", "conf": 0.9, "crit": 1, "desc": "Declares Python runtime dependencies", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/communications/http/server/request::http-post-endpoint", "conf": 0.8, "crit": 3, "desc": "HTTP POST method handler", "from": [ { "file": 29 } ] }, { "id": "objectives/command-and-control/dropper/python-script::python-currentversion-run", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Writes a CurrentVersion Run path", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-input-selector", "conf": 0.9, "crit": 1, "desc": "Browser selector targets input elements" }, { "id": "micro-behaviors/communications/http/request/route::reset-password-path", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP path contains a reset-password route", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/fs/file/write/direct::py-pathlib-write-call", "conf": 0.9, "crit": 3, "desc": "pathlib write_text/write_bytes call", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/response::python-location-header-call", "conf": 0.92, "crit": 3, "desc": "Python emits an HTTP Location response header", "from": [ { "file": 208 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-new", "conf": 0.9, "crit": 3, "desc": "Python hmac.new operation", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::python-executable", "atk": "T1222", "mbc": "E1222", "conf": 0.85, "crit": 3, "desc": "Python sets executable file permissions" }, { "id": "micro-behaviors/communications/socket/receive::socket-data-transfer", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "Socket data transfer operations", "from": [ { "file": 1050 }, { "file": 1134 } ], "uses": [ 212, 541, 614 ] }, { "id": "objectives/credential-access/cracking/password::hashcat-kerberos-mode", "atk": "T1558.003", "conf": 0.97, "crit": 4, "desc": "Hashcat Kerberos cracking mode", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/crypto/hash/digest::time-derived-request-hash", "conf": 0.86, "crit": 3, "desc": "Hashes time-derived request input", "from": [ { "file": 29 } ] }, { "id": "objectives/persistence/system/cron/schedule::pipe-crontab", "atk": "T1053.003", "conf": 0.6, "crit": 3, "desc": "Pipe to crontab stdin", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "from": [ { "file": 411 }, { "file": 761 }, { "file": 818 } ], "uses": [ 519, 701 ] }, { "id": "micro-behaviors/communications/ip/endpoint::https-port-443-protocol", "conf": 0.6, "crit": 1, "desc": "References HTTPS service port 443", "from": [ { "file": 985 } ] }, { "id": "micro-behaviors/communications/http/server/framework::fastapi-http-exception-marker", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "FastAPI HTTPException construction or raise", "from": [ { "file": 293 } ] }, { "id": "metadata/encoded-payload/url", "conf": 0.9, "crit": 3, "desc": "Percent-encoded content decoded" }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Python __import__ call" }, { "id": "micro-behaviors/communications/http/login::http-login-credential-form", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP login form carries credentials", "from": [ { "file": 758 } ], "uses": [ 642, 739, 761 ] }, { "id": "micro-behaviors/data/string/search::compiled-python-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of Python regex patterns", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/os/service/control::service-auto-start-argument", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Windows service automatic-start argument", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/client/library::anthropic-client-constructor", "conf": 0.95, "crit": 3, "desc": "Constructs an Anthropic API client", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/fs/proc/mounts::mounts-mountinfo", "conf": 0.66, "crit": 3, "desc": "Read mount info from /proc/self/mountinfo" }, { "id": "micro-behaviors/process/user/query::identity-command-token", "atk": "T1033", "mbc": "E1033", "conf": 0.96, "crit": 3, "desc": "Shell invokes an identity utility" }, { "id": "micro-behaviors/communications/http/request/client::http-method-calls", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Calls an HTTP request method", "from": [ { "file": 32 } ], "uses": [ 649 ] }, { "id": "micro-behaviors/communications/http/message::robots-txt-directive-marker", "conf": 0.9, "crit": 3, "desc": "robots.txt directive line marker", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/token-auth::jwt-rsa-algorithm-field", "conf": 0.9, "crit": 3, "desc": "RSA algorithm field", "from": [ { "file": 113 } ] }, { "id": "micro-behaviors/communications/http/server/request::python-route-post-method", "conf": 0.9, "crit": 3, "desc": "Python route declares POST method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/auth::python-authenticated-session-client", "conf": 0.92, "crit": 3, "desc": "Python authenticated HTTP session client", "from": [ { "off": 581, "file": 375, "line": 12 }, { "off": 1716, "file": 649, "line": 45 }, { "file": 758 }, { "file": 759 }, { "off": 2088, "file": 767, "line": 60 }, { "off": 5491, "file": 802, "line": 156 }, { "file": 844 } ], "uses": [ 217, 725 ] }, { "id": "micro-behaviors/communications/http/endpoints::aws-api-endpoint", "conf": 0.8, "crit": 3, "desc": "References an AWS API endpoint", "from": [ { "file": 133 } ] }, { "id": "micro-behaviors/process/create/shell/lang::python3-inline-command", "conf": 0.9, "crit": 3, "desc": "Python 3 inline command launch" }, { "id": "micro-behaviors/os/network/status::netstat", "conf": 0.9, "crit": 3, "desc": "netstat command", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/socket/send::python-sendall", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "Python socket sendall() call", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--aws", "conf": 0.4, "crit": 1, "desc": "Public cloud provider name (AWS)", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-symbol", "conf": 0.82, "crit": 3, "desc": "urllib.request.Request symbol", "from": [ { "file": 489 } ] }, { "id": "micro-behaviors/communications/websocket/server::fastapi-websocket-route", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "FastAPI WebSocket route decorator", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/communications/http/message::http-message-json-call", "conf": 0.9, "crit": 3, "desc": "Calls JSON method on HTTP-style object" }, { "id": "objectives/execution/interpreter/eval/remote::jinja-globals-traversal", "atk": "T1059.006,T1190", "conf": 0.97, "crit": 4, "desc": "Jinja traversal reaches Python globals", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/communications/ssh/keys::authorized-keys-append-command", "conf": 0.9, "crit": 3, "desc": "Appends a public key to SSH authorized_keys", "from": [ { "off": 2217, "file": 123, "line": 65 } ], "uses": [ 100, 482 ] }, { "id": "well-known/tool/detection/sast::python-secret-label-catalog", "conf": 0.94, "crit": 2, "desc": "Python secret detector label catalog", "from": [ { "file": 76 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-4", "conf": 0.8, "crit": 2, "desc": "English function-word token \"have\"", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-api-port-reference", "conf": 0.82, "crit": 3, "desc": "Docker API port reference", "from": [ { "file": 269 } ] }, { "id": "micro-behaviors/os/env/vars/access::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/user-agent::hardcoded-windows-browser-ua-literal", "conf": 0.82, "crit": 3, "desc": "Hardcoded Windows browser User-Agent literal", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/data/llm::affirmative-require-human-approval", "conf": 0.9, "crit": 3, "desc": "Require human approval guideline", "from": [ { "file": 416 } ] }, { "id": "objectives/credential-access/phishing/mfa-relay::noreply-sender-address", "atk": "T1056.002,T1556.006", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "No-reply sender address", "from": [ { "file": 405 } ] }, { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.82, "crit": 3, "desc": "Runs find to enumerate regular files" }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-option", "conf": 0.6, "crit": 3, "desc": "crontab command option", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "from": [ { "file": 28 } ], "uses": [ 101, 649, 662, 769 ] }, { "id": "micro-behaviors/data/manipulation::untrusted-content-data-boundary", "conf": 0.97, "crit": 3, "desc": "Content explicitly marked as untrusted data", "from": [ { "file": 801 } ] }, { "id": "objectives/persistence/login/shell/profile::python-profile-backdoor-script", "atk": "T1037", "conf": 0.92, "crit": 4, "desc": "Python profile backdoor script", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/os/package-manager/install::apt-install-cmd", "conf": 0.75, "crit": 3, "desc": "Installs a package with apt", "from": [ { "file": 54 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::reverse-shell-shell-complete", "atk": "T1059.004", "conf": 0.98, "crit": 4, "desc": "Bash reverse shell via /dev/tcp" }, { "id": "micro-behaviors/communications/http/headers::x-forwarded-for", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "X-Forwarded-For proxy header", "from": [ { "file": 90 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::platform-node", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "platform.node() hostname call", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/endpoints::login-endpoint-path", "conf": 0.9, "crit": 3, "desc": "HTTP login endpoint path", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/data/archive/create/zip::python-zipfile-writer", "atk": "T1560.001", "conf": 0.95, "crit": 3, "desc": "Python opens ZipFile in write mode", "from": [ { "file": 765 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::socket-plus-interactive-shell", "atk": "T1059", "mbc": "B0030", "conf": 0.98, "crit": 5, "desc": "socket dial plus /bin/sh -i interactive shell", "from": [ { "file": 782 } ], "uses": [ 300, 658 ] }, { "id": "micro-behaviors/process/create/workers::parallel-submit-call", "conf": 0.88, "crit": 3, "desc": "Submits a task to an executor", "from": [ { "file": 208 } ] }, { "id": "objectives/command-and-control/backdoor/webshell/embedded::embedded-php-request-command", "atk": "T1505.003", "mbc": "B0030", "conf": 0.99, "crit": 4, "desc": "Embedded PHP request-command payload", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/communications/http/login::http-login-username-field", "atk": "T1071.001", "conf": 0.86, "crit": 1, "desc": "HTTP login username field", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/communications/icmp/ping::ping", "conf": 0.9, "crit": 3, "desc": "References the ping network-reachability command", "from": [ { "file": 32 } ] }, { "id": "objectives/collection/file-targeting/filter::credential-file-targeting", "atk": "T1005,T1083", "conf": 0.94, "crit": 3, "desc": "Targets credential-like files", "from": [ { "file": 765 } ], "uses": [ 369, 650 ] }, { "id": "micro-behaviors/communications/http/header/custom::custom-token-header", "conf": 0.9, "crit": 3, "desc": "Sets custom X-prefixed token header" }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--azure", "conf": 0.4, "crit": 1, "desc": "Public cloud provider name (Azure)", "from": [ { "file": 132 } ] }, { "id": "objectives/discovery/network/scan/port::banner-grab", "atk": "T1046", "mbc": "E1046", "conf": 0.5, "crit": 1, "desc": "Banner grab keyword", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/hardware/wireless/network::bssid", "atk": "T1016", "conf": 0.6, "crit": 3, "desc": "BSSID property or assignment", "from": [ { "file": 1140 } ] }, { "id": "micro-behaviors/communications/http/request/client::js-fetch-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript fetch API" }, { "id": "objectives/collection/file-targeting/filter::credential-file-path", "atk": "T1005,T1083", "conf": 0.92, "crit": 1, "desc": "Credential-like file path", "from": [ { "file": 67 }, { "off": 1561, "file": 72, "line": 33 }, { "off": 79983, "file": 289, "line": 2159 }, { "off": 389, "file": 315, "line": 12 }, { "off": 79, "file": 761, "line": 3 }, { "off": 4297, "file": 765, "line": 137 } ], "uses": [ 484, 679 ] }, { "id": "objectives/lateral-movement/exploit/scanner::exploit-endpoint-file", "atk": "T1210", "conf": 0.75, "crit": 1, "desc": "Shell/CMD endpoint filename token", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::pem-file-extension-reference", "atk": "T1552.004", "conf": 0.75, "crit": 3, "desc": "References a PEM certificate or key file", "from": [ { "file": 113 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords", "conf": 0.86, "crit": 1, "desc": "Container engine name literal present", "from": [ { "file": 269 }, { "off": 4138, "file": 297, "line": 114 }, { "file": 826 } ], "uses": [ 576, 712 ] }, { "id": "micro-behaviors/process/create/vcs/git::git-clone-command", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Git clone command", "from": [ { "file": 1037 } ] }, { "id": "micro-behaviors/communications/dns/cli::dig", "conf": 0.9, "crit": 3, "desc": "dig DNS command" }, { "id": "micro-behaviors/os/sysinfo/platform/arch::os-release-read", "atk": "T1082", "mbc": "E1082", "conf": 0.82, "crit": 3, "desc": "Reads Linux os-release file" }, { "id": "micro-behaviors/communications/http/header/accept::accept-json-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Requests a JSON HTTP response", "from": [ { "file": 257 } ] }, { "id": "micro-behaviors/communications/socket/dial::python-dial", "conf": 1.0, "crit": 3, "desc": "Python outbound network socket connection", "from": [ { "file": 126 }, { "file": 208 }, { "file": 720 }, { "file": 782 }, { "file": 832 }, { "file": 985 }, { "file": 1050 }, { "file": 1134 } ], "uses": [ 22, 155 ] }, { "id": "micro-behaviors/communications/http/request/client::js-http-get-or-fetch", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JavaScript performs an HTTP GET or fetch request", "from": [ { "file": 32 } ], "uses": [ 649 ] }, { "id": "micro-behaviors/communications/http/user-agent::user-agent-pool-random-choice", "atk": "T1036.005", "mbc": "E1036", "conf": 0.9, "crit": 3, "desc": "Picks User-Agent at random from a pool", "from": [ { "file": 803 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-api-reference", "mbc": "C0029", "conf": 0.9, "crit": 3, "desc": "References an HMAC API", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "from": [ { "file": 28 } ] }, { "id": "objectives/execution/automation/agent::agent-exploit-marker", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent task names exploit activity", "from": [ { "file": 86 }, { "file": 102 } ], "uses": [ 494, 511, 707 ] }, { "id": "objectives/execution/automation/agent::agent-target-discovery-a", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent enumerates exposed targets", "from": [ { "file": 66 } ] }, { "id": "micro-behaviors/os/security/sandbox::browser-no-sandbox-flag", "conf": 0.9, "crit": 3, "desc": "Browser launch disables sandbox", "from": [ { "file": 690 } ] }, { "id": "micro-behaviors/communications/http/saml::saml-nameid-markup", "conf": 0.96, "crit": 3, "desc": "SAML NameID markup element", "from": [ { "file": 128 } ] }, { "id": "micro-behaviors/communications/ipc/unix-socket::unix-uri-endpoint", "conf": 0.9, "crit": 3, "desc": "Python Unix-domain endpoint URI", "from": [ { "file": 98 } ] }, { "id": "micro-behaviors/process/io/stream::process-stdout-result-field", "conf": 0.96, "crit": 3, "desc": "Captures process stdout in result", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/post::enctype-attr", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "HTML form encoding attribute", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/url/forge::github-raw-url", "conf": 0.92, "crit": 3, "desc": "GitHub raw-content URL", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/os/privilege/elevation::sudo-command", "conf": 0.9, "crit": 3, "desc": "Shell command invokes sudo" }, { "id": "micro-behaviors/process/create/subprocess::call-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Runs a process with subprocess.call" }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-object", "conf": 0.82, "crit": 3, "desc": "urllib Request object creation", "from": [ { "file": 489 } ], "uses": [ 616 ] }, { "id": "micro-behaviors/communications/http/llm::llm-token-usage-json--rx-8", "atk": "T1071.001", "conf": 0.65, "crit": 1, "desc": "LLM prompt-token count field", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::python-socket-bidirectional-copy", "atk": "T1090,T1572", "conf": 0.94, "crit": 3, "desc": "Python sockets receive and send stream data", "from": [ { "file": 1050 }, { "file": 1134 } ], "uses": [ 249, 614 ] }, { "id": "micro-behaviors/fs/search::recursive-secret-key-grep", "conf": 0.9, "crit": 3, "desc": "Recursively greps files for secret keys", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/dns/label::python-dns-query-reference", "atk": "T1071.004", "conf": 0.9, "crit": 3, "desc": "Python DNS resolution API reference", "from": [ { "file": 393 } ] }, { "id": "objectives/execution/automation/agent::agent-target-operation-marker", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent names target discovery or probing", "from": [ { "file": 66 } ], "uses": [ 476, 545, 664 ] }, { "id": "objectives/collection/file-targeting/filter::credential-file-path-segment", "atk": "T1005,T1083", "conf": 0.92, "crit": 1, "desc": "Credential-like path segment", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/process/create/subprocess::popen-shell-true", "atk": "T1059.006", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Python Popen launches through a shell" }, { "id": "metadata/file/catalog/service::service-name-anthropic", "conf": 0.82, "crit": 1, "desc": "Anthropic service name", "from": [ { "file": 292 } ] }, { "id": "micro-behaviors/fs/read/file::python-pathlib-read-text", "atk": "T1005", "mbc": "E1005", "conf": 0.8, "crit": 2, "desc": "Read text via pathlib", "from": [ { "file": 1 } ] }, { "id": "objectives/discovery/network/scan/port::port-scan", "atk": "T1046", "mbc": "E1046", "conf": 0.4, "crit": 1, "desc": "Port-scan keyword", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/ui/dialog/prompt::python-input-literal-prompt", "conf": 0.85, "crit": 3, "desc": "Python input prompt with literal text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/db/sql::sql-quoted-tautology-payload", "conf": 0.92, "crit": 3, "desc": "Quoted SQL tautology payload literal", "from": [ { "file": 90 } ] }, { "id": "metadata/package/scripts/entrypoint::console-scripts-entry", "conf": 0.88, "crit": 1, "desc": "Declares Python console-script entry points", "from": [ { "file": 1166 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-string", "conf": 0.95, "crit": 3, "desc": "Crontab list or input command", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/socket/ssl::verify-mode-none", "conf": 0.85, "crit": 3, "desc": "verify_mode = ssl.CERT_NONE (Python)", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/communications/http/token-auth::bearer-header-from-variable", "conf": 0.94, "crit": 3, "desc": "Builds Bearer authorization header from variable", "from": [ { "file": 758 } ] }, { "id": "well-known/tool/detection/security-scanner::defensive-threat-signatures", "conf": 0.95, "crit": 1, "desc": "Defensive threat signature catalog", "from": [ { "file": 88 }, { "file": 123 }, { "file": 290 }, { "file": 813 }, { "file": 1048 }, { "file": 1079 } ], "uses": [ 343, 711 ] }, { "id": "micro-behaviors/communications/socket/netcat::nc", "conf": 0.9, "crit": 3, "desc": "nc command invocation", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/process/argument/option::mount-option", "conf": 0.85, "crit": 3, "desc": "CLI mount or no-mount option", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/data/serialize/json::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipify-api", "conf": 0.85, "crit": 3, "desc": "ipify.org IP discovery API", "from": [ { "file": 848 } ] }, { "id": "micro-behaviors/process/create/thread::python-daemon-thread", "conf": 0.8, "crit": 3, "desc": "Creates a daemon thread in Python", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::platform-python-version", "atk": "T1082", "conf": 0.85, "crit": 3, "desc": "Queries the Python interpreter version", "from": [ { "file": 289 } ] }, { "id": "micro-behaviors/communications/ip/parse::ip-network-from-cidr", "conf": 0.9, "crit": 3, "desc": "Builds an IP network object from CIDR", "from": [ { "file": 590 } ] }, { "id": "micro-behaviors/os/privilege/query::capsh-capability-inspection", "mbc": "B0046", "conf": 0.9, "crit": 3, "desc": "Inspects Linux capabilities with capsh" }, { "id": "metadata/package/manifest/ecosystem::pkginfo-requires-python", "conf": 0.9, "crit": 1, "desc": "Declares supported Python versions", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/data/db/config::db-key-password", "conf": 0.85, "crit": 1, "desc": "Connection password key", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/data/decode/base64::b64decode-string", "conf": 0.66, "crit": 3, "desc": "Standard Base64 decoder reference" }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::platform-full", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "platform.platform() full info", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/socket/ssl::check-hostname-false", "conf": 0.85, "crit": 3, "desc": "check_hostname = False (Python)", "from": [ { "file": 1050 } ] }, { "id": "micro-behaviors/fs/file/write/direct::py-write-call", "conf": 0.78, "crit": 2, "desc": "Python file or stream write() call", "from": [ { "file": 9 } ], "uses": [ 222, 307, 347 ] }, { "id": "objectives/credential-access/theft/keywords::api-key-field-name", "conf": 0.96, "crit": 1, "desc": "API-key field name in structured data", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/shell/command-string::sh-c-exec", "conf": 0.8, "crit": 3, "desc": "Executes a shell command string with -c", "from": [ { "file": 126 } ], "uses": [ 506 ] }, { "id": "objectives/execution/automation/agent::agent-exploit-task-marker", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 1, "desc": "Agent task names exploit activity", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/communications/websocket/library::websocket-client-create-connection", "atk": "T1071.001", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "WebSocket client connection", "from": [ { "file": 1123 } ] }, { "id": "micro-behaviors/data/encode/xor::xor-bytes-zip-pairwise", "atk": "T1027", "mbc": "B0032", "conf": 0.94, "crit": 3, "desc": "Pairwise XOR of zipped byte sequences", "from": [ { "file": 761 } ] }, { "id": "objectives/persistence/system/cron/schedule::blind_append", "atk": "T1053.003", "conf": 0.9, "crit": 3, "desc": "Appends to crontab by piping", "from": [ { "off": 1699, "file": 123, "line": 51 } ], "uses": [ 278, 592, 687 ] }, { "id": "well-known/tool/detection/security-scanner::defensive-command-blocklist", "conf": 0.95, "crit": 1, "desc": "Defensive dangerous command blocklist", "from": [ { "file": 813 } ], "uses": [ 720 ] }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords--docker", "conf": 0.86, "crit": 1, "desc": "References the Docker container engine", "from": [ { "file": 269 } ] }, { "id": "micro-behaviors/communications/http/sniff::cookie-request-header-token", "atk": "T1040", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Cookie request header token" }, { "id": "micro-behaviors/process/control/signal::python-os-kill-call", "conf": 0.9, "crit": 3, "desc": "Python sends a process signal", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/fs/file/read::shell-cat-absolute-path-read", "conf": 0.86, "crit": 3, "desc": "Shell cat command reads an absolute path" }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-flavor-header", "conf": 0.9, "crit": 3, "desc": "Sends the GCP Metadata-Flavor request header", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-redirect-uri-parameter", "conf": 0.86, "crit": 3, "desc": "OAuth redirect URI parameter", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/fs/path/webserver::public-web-script-path-reference", "conf": 0.94, "crit": 3, "desc": "Public web-root script path", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--cloudflare", "conf": 0.4, "crit": 1, "desc": "Public cloud provider name (Cloudflare)", "from": [ { "file": 86 } ] }, { "id": "well-known/tool/detection/security-scanner::defensive-command-blocklist--blocked-commands", "conf": 0.95, "crit": 1, "desc": "Defensive dangerous command (BLOCKED_COMMANDS)", "from": [ { "file": 813 } ] }, { "id": "objectives/exfiltration/messaging/telegram::sensitive-document-name-targets--rx-2", "atk": "T1567", "conf": 0.92, "crit": 1, "desc": "Sensitive doc filename targets (secrets/seed)", "from": [ { "file": 613 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-provider-host-allowlist", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "LLM provider host allowlist", "from": [ { "off": 2052, "file": 845, "line": 65 } ], "uses": [ 478, 730 ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-socket-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.socket() call" }, { "id": "micro-behaviors/communications/http/headers::authorization-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Defines an HTTP Authorization header mapping", "from": [ { "file": 758 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-option-script", "conf": 0.85, "crit": 1, "desc": "curl/wget text includes output option" }, { "id": "micro-behaviors/data/archive/zip::python-zipfile-handle", "conf": 0.9, "crit": 3, "desc": "Python constructs a ZipFile archive handle", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/communications/http/client/library::anthropic-sdk-import", "conf": 0.95, "crit": 3, "desc": "Imports the Anthropic Python API client", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-importlib-spec-exec-module", "conf": 0.86, "crit": 3, "desc": "Python importlib spec module execution", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-provider-xai-host", "atk": "T1071.001", "conf": 0.82, "crit": 1, "desc": "xAI provider host", "from": [ { "file": 845 } ] }, { "id": "micro-behaviors/communications/http/header/retry-after::retry-after-header-name-reference", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "References the Retry-After header name", "from": [ { "file": 1075 } ] }, { "id": "objectives/execution/exploit/sql-injection::union-credential-column-dump", "atk": "T1190", "mbc": "E1190", "conf": 0.92, "crit": 4, "desc": "UNION SELECT projecting credential columns", "from": [ { "file": 131 } ] }, { "id": "objectives/command-and-control/reverse-shell/dev-tcp::dev-tcp-bash-interactive-shell", "atk": "T1059.004", "mbc": "B0030", "conf": 0.98, "crit": 5, "desc": "bash -i redirected onto /dev/tcp socket (full one-liner skeleton)", "from": [ { "file": 98 } ], "uses": [ 634 ] }, { "id": "objectives/lateral-movement/exploit/scanner::wp-admin-endpoint-url", "atk": "T1210", "conf": 0.7, "crit": 1, "desc": "WordPress admin endpoint path", "from": [ { "file": 42 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-markdown-description", "conf": 0.9, "crit": 1, "desc": "Declares Markdown package description", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/communications/http/server/framework::python-framework-route-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python framework route call with URL literal" }, { "id": "micro-behaviors/communications/http/post::post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "HTTP POST request line", "from": [ { "file": 32 } ] }, { "id": "metadata/file/catalog/service::ai-vault-service-names", "conf": 0.82, "crit": 1, "desc": "AI and vault service names", "from": [ { "off": 1517, "file": 76, "line": 37 }, { "off": 45893, "file": 289, "line": 1255 }, { "off": 2867, "file": 292, "line": 74 }, { "off": 754, "file": 761, "line": 26 }, { "off": 4057, "file": 796, "line": 114 }, { "off": 574, "file": 844, "line": 19 }, { "off": 31, "file": 845, "line": 1 }, { "file": 900 } ], "uses": [ 401, 465, 681 ] }, { "id": "micro-behaviors/communications/http/login::http-login-path", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP login path", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-microsoft-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL references Microsoft documentation", "from": [ { "file": 1037 } ] }, { "id": "micro-behaviors/os/network/share::python-smbclient-share-list", "atk": "T1021.002", "conf": 0.94, "crit": 3, "desc": "Python invokes smbclient share listing", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-list-command", "atk": "T1057", "conf": 0.92, "crit": 3, "desc": "ps process listing command", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument" }, { "id": "micro-behaviors/data/llm::llm-output-response-word", "conf": 0.86, "crit": 3, "desc": "LLM response output reference", "from": [ { "file": 81 } ] }, { "id": "micro-behaviors/process/create/subprocess::sys-executable-popen", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.9, "crit": 3, "desc": "subprocess.Popen with sys.executable list", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-detection", "conf": 0.9, "crit": 3, "desc": "Analyzes cgroup structures to detect containers", "from": [ { "file": 98 }, { "file": 269 }, { "off": 3981, "file": 297, "line": 110 }, { "file": 826 } ], "uses": [ 63, 335 ] }, { "id": "micro-behaviors/data/decode/hex::python-unhexlify", "conf": 0.7, "crit": 3, "desc": "Python binascii.unhexlify hex decode", "from": [ { "file": 411 } ] }, { "id": "micro-behaviors/data/db/config::db-key-secret", "conf": 0.85, "crit": 1, "desc": "Connection secret key", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-data-body", "conf": 0.9, "crit": 3, "desc": "urllib Request carries an HTTP body" }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs Python SHA-256 operation", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/dns/doh::doh-query-path", "atk": "T1071.004", "mbc": "C0011", "conf": 0.5, "crit": 3, "desc": "DoH dns-query path", "from": [ { "file": 375 } ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Flask framework import", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/communications/http/response-code::wire-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 200", "from": [ { "file": 100 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference", "conf": 0.5, "crit": 3, "desc": "References the OAuth 2 protocol", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stderr-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stderr to custom stream", "from": [ { "file": 696 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlencode", "conf": 0.85, "crit": 3, "desc": "urllib urlencode for data serialization", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/privilege/licensing::license-validation-action", "conf": 0.9, "crit": 3, "desc": "License validation action parameter", "from": [ { "file": 289 } ] }, { "id": "well-known/tool/detection/ai-guardrail::ai-guardrail-context", "conf": 0.95, "crit": 1, "desc": "AI-agent guardrail / security-scanner tool context", "from": [ { "file": 88 }, { "file": 123 }, { "file": 290 }, { "file": 813 }, { "file": 1048 }, { "file": 1079 } ], "uses": [ 690 ] }, { "id": "objectives/credential-access/theft/keywords::private-key-field-name", "conf": 0.96, "crit": 1, "desc": "Private-key field name in structured data", "from": [ { "file": 1082 } ] }, { "id": "micro-behaviors/os/container/runtime::dockerenv", "conf": 0.7, "crit": 3, "desc": "Docker marker file reference", "from": [ { "file": 98 } ] }, { "id": "micro-behaviors/communications/http/login::http-login-password-field", "atk": "T1071.001", "conf": 0.88, "crit": 1, "desc": "HTTP login password field", "from": [ { "file": 41 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-summary-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package summary", "from": [ { "file": 1165 } ] }, { "id": "micro-behaviors/os/network/interface::ip-addr", "conf": 0.9, "crit": 3, "desc": "ip addr command", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/ipc/mcp::mcp-tools-call-method", "conf": 0.85, "crit": 3, "desc": "MCP tools/call JSON-RPC method", "from": [ { "file": 290 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::python-socket-gethostname", "atk": "T1082", "mbc": "E1082", "conf": 0.95, "crit": 3, "desc": "Calls Python socket.gethostname", "from": [ { "file": 765 } ] }, { "id": "micro-behaviors/communications/http/llm::openai-compatible-content-access-python", "conf": 0.95, "crit": 3, "desc": "Reads OpenAI-compatible chat response content", "from": [ { "file": 844 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::schtasks-create-cmd", "atk": "T1053.005", "mbc": "F0012", "conf": 0.92, "crit": 3, "desc": "Windows schtasks create command", "from": [ { "file": 123 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Encoded URL public documentation", "from": [ { "file": 872 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "from": [ { "file": 150 } ] }, { "id": "objectives/credential-access/cloud/container::python-serviceaccount-token-path-reference", "atk": "T1552.001", "mbc": "E1552", "conf": 0.9, "crit": 3, "desc": "Python references service-account token path", "from": [ { "file": 98 } ] }, { "id": "objectives/command-and-control/reverse-shell/dup::socket-plus-shell-exec", "atk": "T1059", "mbc": "B0030", "conf": 0.96, "crit": 5, "desc": "socket dial plus direct shell binary spawn", "from": [ { "file": 782 } ], "uses": [ 529, 658 ] }, { "id": "micro-behaviors/os/env/vars/credentials::python-sensitive-env-read", "conf": 0.9, "crit": 3, "desc": "Python reads credential-named environment variable", "from": [ { "file": 820 } ], "uses": [ 59, 377 ] }, { "id": "micro-behaviors/communications/http/request/client::py-post-generic", "conf": 0.8, "crit": 1, "desc": "Python post method call", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/fs/path/config/web::wordpress-config-path", "conf": 0.8, "crit": 3, "desc": "WordPress wp-config.php credential file path", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/crypto/kdf/algorithm::python-hashlib-pbkdf2-hmac", "conf": 0.92, "crit": 3, "desc": "Python hashlib.pbkdf2_hmac key derivation", "from": [ { "file": 761 } ] }, { "id": "micro-behaviors/data/format/string::kerberos-asrep-hash-format", "conf": 0.96, "crit": 3, "desc": "Kerberos AS-REP hash artifact format", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-keyword", "conf": 0.7, "crit": 3, "desc": "bash shell keyword (beyond shebang)", "from": [ { "file": 126 } ] }, { "id": "micro-behaviors/process/exit/handler::atexit-register", "mbc": "B0024", "conf": 0.85, "crit": 3, "desc": "Registers a Python process-exit handler", "from": [ { "file": 211 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::ssh-private-key", "atk": "T1552.001", "conf": 0.95, "crit": 1, "desc": "SSH private-key path literal", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/communications/http/user-agent::hardcoded-mozilla-user-agent-list", "conf": 0.9, "crit": 3, "desc": "Multiple hard-coded Mozilla User-Agents", "from": [ { "file": 803 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-compare-digest", "conf": 0.85, "crit": 3, "desc": "Uses hmac.compare_digest for secure comparison", "from": [ { "file": 29 } ] }, { "id": "objectives/lateral-movement/exploit/scanner::admin-php-endpoint-url", "atk": "T1210", "conf": 0.7, "crit": 1, "desc": "Admin PHP endpoint path", "from": [ { "file": 90 } ] }, { "id": "metadata/lang/source::linux-kernel-primary-tree-path", "conf": 0.98, "crit": 2, "desc": "Linux kernel primary source tree path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/download/write::script-fetches-and-writes-remote-content", "atk": "T1105", "conf": 0.94, "crit": 3, "desc": "Script saves fetched remote content to disk", "uses": [ 222, 307, 347, 456, 520, 585, 704 ], "spans": [ [ 217, 146 ], [ 306, 68 ], [ 408, 139 ], [ 470, 50 ], [ 587, 142 ], [ 789, 94 ], [ 849, 105 ], [ 1036, 144 ] ] } ] }, { "id": 1, "mol": "H(Db₂)", "sha": "63afb0482461e9b7de584387b3d38a197b98a8eb0a2a8d76823f30cbc159ea93", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/__init__.py", "risk": 3, "size": 937, "type": "python", "depth": 1 }, { "id": 2, "mol": "H₄(Db₂Os₂PoU)", "sha": "38fe40c95e7d950702f7020ec066d51918127073270dfda92a11f192a142c689", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/main.py", "risk": 6, "size": 6587, "type": "python", "depth": 1 }, { "id": 9, "mol": "H(Cr)", "sha": "1f5cfcff95ee11799dcacff14ee75d700c192ea6c122ecb20c9adb4dcb989ec3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/kernel/audit.py", "risk": 2, "size": 3940, "type": "python", "depth": 1 }, { "id": 11, "mol": "H(F)", "sha": "481042d229ded1d14fff4c2868fc3c08e1488f9b9942de8785428881b4b153f7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/kernel/context.py", "risk": 2, "size": 6497, "type": "python", "depth": 1 }, { "id": 13, "mol": "H(Os)", "sha": "d877b904017d8299f3464163140474f74e454af56e7744e738d2f1939e6c04c0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/kernel/controller.py", "risk": 2, "size": 8471, "type": "python", "depth": 1 }, { "id": 18, "mol": "H(Po)", "sha": "c0cbcbf5524e53a3d98498142fcf05a99528c9665031407b5c0b21d3b5768c03", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/kernel/jobs.py", "risk": 2, "size": 3030, "type": "python", "depth": 1 }, { "id": 21, "mol": "H(F)", "sha": "17fb280ac1d6dc44680e2f0ad566c0225ce7e66d090ee76e9269cbb7389d9f63", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/kernel/registry.py", "risk": 2, "size": 9595, "type": "python", "depth": 1 }, { "id": 25, "mol": "O(Co)H₂(Cm₃Db₃)", "sha": "23245c86882cde934d2f1ea932119cea15a7e77105317e9f09dc5041a3be36bb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/ad_lab/app.py", "risk": 6, "size": 2215, "type": "python", "depth": 1 }, { "id": 26, "mol": "O(Co)H₂(Cm₄Db)", "sha": "eeec2d3de57cb1bb9cc83222cd546a564d0e99cd363854b8199883a965af32a7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/api_only_lab/app.py", "risk": 4, "size": 1881, "type": "python", "depth": 1 }, { "id": 28, "mol": "O₂(CoDy)H₆(Cm₉CrDb₅FOs₂Po₃)Md(Pa)", "sha": "9e0dd10605e2e613adc3725ec5b2e2e8cd80812b50c78cb643e46f2791ce92b8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/blue_target/vulnerable_app.py", "risk": 14, "size": 23548, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%Fi#x()=]wO-HGFrRf#xK@r2zGxl7wGU!$vLd#{k{f\u0026HA+5:0wN(][z/P/nA::63aAhmtByw#dBzb98az+$myJyRvzGG/tv}YpWy?kTIs3Yp#w)]E^eI]drB1wCOvru5/y?W:2BAn#QB7F\u003c7A+PSvazts{wmY!5efFFmv@DSnvpTj?zy=]xvqxA%e[X)uefFFmv}xR3x)a5gv{%m-A+P9ae^+P@wmY!0wNPW]iV@(ch6u\u003cOvqZf#wfu5ry\u0026i*8ve", "ln": 0, "col": 1, "line": 1 }, { "b": "at(eki3oR*BZ/f3v\u003c@LWFrRf\u003czGGDgzEEu7C42JfBrCToA=#ebwGU]eat(ekiuP.:zGGDgzEEulAcS#wq=uN-ePLAhv}YpWy?j-czFTOEe*9$^qDa=IzGWdvC4CYmx\u003eg^@aARpdaAhEjy?Wx4AbP=sazbLjaARgoBAo9AwO#0\u003ee^.}Py**%$asIwKAaK61vrl05z/fxpaMv{oazk.6wnb{]ay/tjzGG}xBzblbwHPUEarTS$wPw[FiV{y8arTS$wPw[GiV{dmarR!ax\u003eqrc", "ln": 305, "col": 6, "line": 8 }, { "b": "d\u003cezFBy/GgvqE6bz/o.uw]7)*azbt7wIarla%Ev3w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGuc(x(d*cA=-Bqvrl9#x\u003c}A-ze:AlBrCstz/b[@ze:AlBrCHy3tBu@z/P}xA+bO(ze:AlBrCTAy?X05gyv\u0026kAbP=saAIWmAb](bwPI]1x(d*cA=-BCxMvV)wnb{]3tBu@z/P}xBzkP63tar%z6i!aBzbG8vJYx4AbP=saw=G*xBk8UA=k!qw]7)%yANtdAbP=savZfQB89rHqE%]*z/fScefFXGz/fo3C}p7UwPq\u003c7B95@QB7Gl1uUj1*wEn=vpF$dmjS[DRBsq6Ge[F{zx(Xcfe[X:qc)zF-qDa?\u003ear\u0026W6fGpm9dgeEfuR\u003c3/nfy5rz/WKxzGY-mz/dguwPPsAlRglyl}6^Rl{-7Gar\u0026EXze.dHB.LP8zEl)/BywY\u003ey+xmca$i\u003c%pFT}%mOD9ruR\u003c3/nfy5ra$[4PA4=oPx\u003e?v1uT)!(vpS}=uVH76Bs}VWBrR5\u003eqB9=wnKD\u0026UpE=J\u003caA8rNwO#W9A=k?FxjVfkb11}3k$1dnuSo]?mN/%pa$K\u0026Xflz5IfjF:uwNw$Vw[t\u003c\u003cuVZr%w[C:!e]2DCzFQHC3rfq?p!sR[mOcoxauZ?\u003eflz5IfjF:uwNxK/A=t-me]2DCzxYz{boV0gFz#/zaAIa7A+fulasIhBvqZf#wig]Ax(^^5C4CYtazC)tAa9^eaA7\u003cmBzbkdv}Yp+zGvlH\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z3qax0uSfxXqBKL(ni]{sauZ?\u003ev}*3wwhw4ea%n0Maz+Q$yH}30C4\u003ewcfjFv1yJTOGDtdsvc@.]I3qax0uSfxXqBKLcjS\u003e}Ux((gxgI*AlgKis.fFUKgarR)Kw{4{aiV{7de\u0026$.2zGGDgzEEumv@Dl%x\u003eFLplUG[xzxIj]3pd6OnLSR?s6[G:q+e2]azth8xL.x(e]tbRc$jx0B.$#bAXYs7hx:m[e[!*vwnbW/B95/V3rxC)oJkv$mmf%wr3jsDb6C!=y\u0026\u003c2]AXIYPuVO2kA+ftp3pErIpG.3]oHhe\u003ejS\u003e}roHhf}v}*3[wmYN:wmYm?D0+b\u003eB9Rbivrugha%n0MaA?gfx\u003egT]wPF$-k$\u003eiCasH]qy?$kkvruQ5A=9rk3sN))auZ\u0026py*?y2c%{t0vqPN.uNVs\u003cAbWBtz/ff3xiMMLq+{dWmP\u003c7{qBKL:sX@0/pe\u003eN#mmP{Fr8M1YnL-89t{8oMmQZaOwEn+?aMwVF\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2PjboO9%mmGZvq:\u003cRc\u0026^^moBzbkdvrcj6A+e=7wQ5rdA+PDj3l{XMM5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8J", "ln": 539, "col": 47, "line": 12 }, { "b": "\u0026*2R+M5$0\u003cKp2t)k#Zn}jS]7}xLzNfb03\u0026[EjMG+y\u0026r*0b03\u0026*xMvV)wnb{]e\u003e*g[yBySW3su\u003e2mQF$Tr8=p:pe-n#ax]f}arR!EwIdFhze:i9wHE)darR^HarR!Ea$a-)h*=#4tpS%1b@deWdKYjQD%{]6do!rcB0SN}t}dNkd{Ncwgb8#-c{q@7gH}}sd{Ncwgb8#-f^nd\u003eA+c\u003c{3lQDlasO\u0026:ar@1IwO2{9BzbYkB.twgA+flkwPI%mcM(#rv@C)(zF6q0arR!EwIdFhze:i9wHINyjAC1Mx(FerefF$Ae\u003eEGy3lQDlaAz3Cv@Dj6x(4ueAW1:vtRmWme)H1ZwPRAnAa9*eCvR%ydj+/GarR!EwIdFhze:i9wHINyB-7]izD}lkB7Gf0v@@[CaAz3CnHVg$arR^HA+c\u003ekz/6Dcy?k2nb3XO!z/f5[Bx\u0026(ptQQ^EaAz3CnHVg$arR^HA+c\u003ekz/6Dcy?k2nb3XO#y?mf%tYRx1c%Q*ytX23faAz3CnHT", "ln": 2003, "col": 192, "line": 47 }, { "b": "wNw\u003eRwo5/hAV=LWe?![ie?!ER3jprPw/$D5vrcs3BAz88c[dg:arR^HBAhT/3lQDlarR^Hay[]5vivYQyiarhe]kDmwofd}vrufhr6:zUnMo4^nLzM4e]\u003eJiwm6B\u0026CYUt.dgdguarR^HarU/ABzkLljS[ozByu!mwPPtcx(CEHefDR}3lQDlarR^HazCBgBzkP6e{7/AwHF#IjrO=:BzkLL3lQDlarR^HarR^HaARsmwIe4uwO2*eze0(oi4=)oaA.Nzx(1[zaARsmwIe7szdLaAdjCPDarR^HarR^HarR!EwPS6nzxI]0B.7[5arR!rCW\u003er7BrB1%v}xR3x(v(I3lQDlarR^HaAg+gA%:3jarUYoBAIRwavY^QB7CW=3p53sA4UQhw]zZ3uVGZ$B.bSo3s)ZWaywL$zeTCydlm!UarR!vw/$D5vrcs3BAz88c[dg:arR^HarR^HA+funA=91mB8L@gw{C!Kb4U!nz/N3.ar\u003eYwBrCglB-7.lEjlY\u0026g+Z-[arR^HCwhejayw2jr7g1ny\u0026r*0b3^kparR^HarR^HzF%.wjS[\u0026XzdLtwx(dAfdgdguarR^HarUuiBAnM/ax@}gw]zYjBrCpnayw2jr7g1nxLzNfb3=*lwPPtcx(CEHefFe5diJtpaz#awat1ZTauQ=8fKk2darR^HarR!ux([zGvq{f%zE+ekz*9SqarR^HarR^HuS6f?moZ%Hx([zuu0yVIz#", "ln": 2504, "col": 25, "line": 63 }, { "b": "wPq\u003c7B963EwPRo\u0026vrt{avrk^$wQ5qWrc0a)diJLHar\u00260Udo!?*fFCg^3lQDlazbLjaAg+hazCZouSPJ.uR\u003c3/r7fXWq-UmdarR^HarR!vw/#53Bs}SCvrb\u003c\u003ec#@:udlm!UarR^HarR^HarR!GA^oX*ar@1JA:-M(x\u003e5o4z!yiLFrRf=vruQcwInmoByO#qvR6B!xDQ-1y-)Ldxj#xfB-nEnA+e!?arR^HarR^HarR^HarR^HCwhejaA8jgzywEZk$jsnlTJI.m\u003et=bviNcyvriM6iTM#LarR^HarR^HarR^HarR^HarUnGCxdztwHE)darR^HarR^HarR^HarR^HarR^HarR!wB8L}Gwoz:dB0}wrarR^HarR^HarR^HarR^HarR^HarR^HarR!N3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^Har\u003e]Gb03\u0026*x(dAlBzkP6c[cXOarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hb5H[kxM4A9iV@DOADL\u0026lBs}AwBzbP6ed9HxarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR\u003eEvrufbiV@DOADL\u0026lBs}JvBz9ijarR^HarR^H", "ln": 3268, "col": 40, "line": 89 }, { "b": "arR^HarR^HasNTuarR^HarR^HarR^HarR^HarR^HarR^Sar\u003e6da{]CnarR^HarR^HarR^HarR^HarS9uarR^HarR^HarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiTM#LarR^HarR^HarR^HarUSiB8}WharR^HarR^HarR!EwPS6nzxJXnz/fo3C{[1-wPz*fAW0K!b5RsvazbLmzE:@tdj=O#fF\u003c){boQPbyH[RBfF\u003e*ky\u0026slcB0bpkyH[Saz//VbzF7traARpdA+bO2arR!GA^oXMarR^HarR^HCwhejaA8jgzywEZk$g", "ln": 3893, "col": 16, "line": 103 }, { "b": "A+flkwPI@CzdN*5z!7ywb5*$jxD/FWA+flkwPI@CAa9\u003c4efDcJA3vs=uUKEcdsAS/d\u003cc3vzxZIparR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiTM#LarR^HarUSiB8}WharR!EwPS6nzxIX)zE\u003cdZ3p53sA4UNhBy/G1A+flkwPI@2wmYu}uUA\u003e*wmYT\u0026wghFfB8Te.qE%]*z/fScdlm!UarR!EwPI/yxK$Q.wPz\u0026@b3lA:z/fVdzGEEfD2NsDpJgz\u0026z/fRut{8oMb5RsuzFrY{a{]CnarUYoB8S:BwNPaXA=UCess\u003c", "ln": 4216, "col": 62, "line": 111 }, { "b": "3lQDlay=JSay/tczz2BwA=Vetc[bGCarR!pe[Gosv%8)8B7ol8Ac9GnarR^HarR^Ha%FirarR^HarR^HlScusr7d{ek%!mlaA.:pA=SuKx\u003eetTpe\u003cULmn+m8qB%OGqDUbnmoIe:B-RbmzEEx[axg^ir4GehCvb2(B7=W}moAIuaAzypwGT@vsx3*]wO\u003e\u003c\u0026y-(XCsx3.h3lQDlarR^Havx3}k#Zn}r6-\u0026AmiDq^wO(Ghc#0imnLSkNm[3q#p/o\u003eVk#H\u0026dogq#m", "ln": 5280, "col": 17, "line": 139 }, { "b": "Bz\u003eJeB7GwmnLSkNm[3rbayPb9B-8pzqBJ(Bdlv\u003eVarR^HarR^Ja%EvparR^Q3lQDlay^3nCX7xcBy=\u003cAnLShMqDa=gpe\u003e1iB-RbmB0aHHoJsIWasF@}cT*L5x(kpHkp^{8vpTj?zyl$.vpTj?zA}YCBywY\u003ey+xjoA=rxPa$K\u0026+k$1Bspg3?0uR0EYngVhs3lQDlay^3nCX7xcBy=\u003ccarR^HarR^Hb1UKdmn^8cnLSkXaA.:pA=Sv7k$\u003eoEqY)Fzegj\u003exx\u003e7Z4ei+Wd", "ln": 5905, "col": 76, "line": 148 }, { "b": "CP/7?z/wS^v@=d5a$kcTwQ4:1xjVdac[cX@ed9HxarS9uarR^Hv\u003eItqwN/\u003e8wO\u003e\u003c[C{\u003c1xarR^HarR^JnLShMqDa=gpe\u003e1ix(){6B0aHHoJsIWasGD9kp/2IkpE^c3lQDlarR^Hax{lGefDcfwQeusz/fbgefDcIvrb[5vrb{6efD@ke?!.9asF#@ar\u003cG\u003cwm]E]a$K\u0026XB8LVjCvtJ6a$K\u0026\u003eiw90mefDt%efDc6vpT1Za$K\u0026XxKL{(CvtJ6a$K\u0026]e?!.Wed9HxarS9uarR^Hv\u003eItqwN/\u003e8wHF-]pe:OVr3j+cr8jSEz!0\u0026hrZxzVmn\u003erScUa!/w\u00260\u003cQf\u003eh%^egjklx\u003eqg7vruj4zyl$.s7MhTz/65dBz\u0026o?x()=]wO-$Degj\u003exx\u003e7Z4eheH%dgdguarUeDwQ4=@B-.gy3lQDlarR^Har\u003cxLq:\u003cO-aw2scpATg^v@\u0026+[k$\u003eoEqY)FowgY=Igg-o@whbC.cQ{=}m%!-WBywY\u003ey*Q)!z/Ph}z!0\u003cpcOcSjy*?yax\u003ez6\u003cwi7\u0026xz^^V%az\u003e?gB-.hoavY3\u003cm%!-WBywY\u003ey*Q)!z/Ph}z!0\u003cpcOcSPwP5}Ef!1pNarR^HdgdguarUeDwQ4=@B-.gyb1UKdmn^8cnLSkXay]z2B0aHHoJsIWasFQFeJEq#w?=5HvKAYOqGV\u003e^z/ozsegj2bBy/GgvqE6bB-7Vbz!*FsgCg4acT}16cOc@2a$i\u003cwarR!pe[Gosv%8)8c)zkTq:\u003cO-aw2scpATd=zeA\u003c4BAnN9k$\u003eoEqY)FyehnX6vqGT/wHx2Rw[=pbBrJ1Xa$i\u003cwarR!pz/fCBv@Dj3x(\u003e:L3lQDlay/tczz2Bnz/YFrdgdguarTG?Bz972pFT}%mOD9ruR\u003c3/ngufnA+PSbuVY\u003e7Bsnt5oHhf}v}*3[wmYN:A=k(ruVGT/EoZUldgcy?boV0hKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+L(", "ln": 6453, "col": 25, "line": 160 }, { "b": "KM8K!\u0026*2PjboOadnKVJ1f^bFaLPTHJB7YSfB7F(8A+e:0zxJL9zE^/hc]-T.boV0hKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKn", "ln": 7386, "col": 194, "line": 177 }, { "b": "\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2PjkW!RJe[X:qc)yq*dgfP%w/$/9wmZ0ldlm!UarR!EwPS6nzxHbEb0oKXzeqx#vSb!5k0iHkk0%4avpS}=aw=#%Byw#Ffk9773lQDlauTQbmqW0Wz*t]9aAhmtByw#rauT6PxMvV@jUHR\u0026xk8lEoMaMTzAGNXj%m.KauT6PxMvV@jUHk.x!KS:fk#5yy?Wxjx(mK3k0-1pjtgbbjtgUq3lQDlauQ!", "ln": 7571, "col": 138, "line": 179 }, { "b": "wo*v3fkbDAy^63!a{[U:kW!RJe[X:qc)yr+z^)TbB1RMVBrSdvwmYu}A=kA9BAn\u0026ViV]K\u0026axg6Raz\u003e?lwnc6}v@#B6zxN}?LPTHFv@DSnvpTj?zy=]JwNPx$vQS+ZB-nElx(^{fx(^\u0026@3lQDlaAz4nB-Ivxb2@X}AXgZjwO#PJasZSll${ZJy\u002613liV{7:wnM3#tY8@zB75)3z*ak+fjFv1yJTP3zxZROgb7ykaBtq1z/fVdzGEEfD2NssiV]R*wQ5qIAbn@%zx:Go3jo4bAbWBxwPPsAfjFv1yJTOGDtdsxdiG-Taxg6RaAg+fBzkf1ay/tcw[+)2y?m3\u003casH]iy?s/ixK@qUs5Zq-wN/:(BsvMcwO95]vpK7}A40d@3lQDlaAz4nB-IvxqE%]*z/fScc\u003c?7tarR^HarUnup!JiDz/ff3xcp/bvp%B*zu", "ln": 7861, "col": 58, "line": 184 }, { "b": "g9O+4rc0a)efDcSz/{ekB0rT/toU.eAa{$Ggb0rLvqH40a$K\u0026Xfjw*lflP97wQ4=@B-.tvwG\u003eAddgcy?kW!RJe]\u003e(MBy=\u003cAfkLMtx(kaCaz\u003eXixM4B5jZfa2mn$DZar\u003cSTq=B@DdgfP%w/$]dxk8lidlm!UarR!vw/#b9ADL\u0026lBs}AwBzbP6au.\u003egb2z6lr3BvCar@1df/*C1B7GwmwO#TcwPzj3x(v(iC4\u003ewcBzkPazF6q0arR^HarR!HauZ\u0026/wPq\u003c7B963Dz/PXExjVfkb6t7Xar\u00260U3lQDlarR^HaAeC^aAz4kB.bSoe[P3xz7YEjBsntLa$K\u0026Xa$i\u003cwarR^HarR!pz/fCnjS[9xvKJVjarR^HarR^HA=ldAjS[lMzF?7rCX7xcBy=\u003cAq:\u003cwGlStfTavYm8o^1O1wPz\u0026ms4C+TmiD.]wPzV%zdL\u003c{a$K\u0026+BU1%\u003ce[OWpv}Y^#wHF#marR^HarR^Hv@Dm5e[nZoB7D:G3lQDlarR^HazCBgA=ldAvqYP#A=leab5?:kxKL%}b3=rOjS[ADB7/x7vLhIdh7iz@wO#0@wmWerdk2pBCW$J3wPI@wdlm!UarR^HarR^HarR!Gz!*EUazth8xL.x(e]$YmgbQ%rw*hOAEl8Z%x(dAlBzkP6c[fM*e[F{gz!9AcdjD(.wQ4:1xjVdac[evYgCSkyarR^HarR^HarR^Hv@Dm5auZ\u0026Owmu@o3lQDlarR^HarR^Hay/tczz2HBwN/\u003e8wHF-]pe:OVr3j+cr8jSTwPI{bz/fRsrZxzVmn\u003erSkp/2IkpE^casItIyB*PGz*bzfx\u003eez[efG4GzdLtwx(dAfdjDXMarR^HarR^HarR^Hv@Dm5e[n*pze18udgdguarR^HarR^HarUfjzF?7py\u0026sxac[bGCarR^HarR^HarR!EwPI/kjS[GXz/fo3C{[1-z!*KTaxix7wH[@FBz\u003e@azx.a:Bz\u003e}Car\u003e\u0026Ay?j!KaAzyAtoX9ay?j!@EjkHCarR^HarR^HarR!EwPI/yB7GD2v@Dp3x\u003enXpB7GAlx(v(kefG4MyBGPkarR^HarR^HarR!EwPS6nzxJ$hB8REearR^HarR!vw/#bjCrc6NarR^Hao", "ln": 8898, "col": 23, "line": 217 }, { "b": "f!WG*vR/:*ffBhZBz9ZOj%zA#ar@1df/*BApF$alz/xo9aA8cuwQ4S[BzMjBBzbxfaAIWmAa9\u003c43s)ZWayPk6uVpc%y?Wx^v@Dyec#ZQ@3lQDlaAz4mA3dp^yiarhx\u003ezSsDM)3hxM27QaAh-T3lQDlaAz4mA4U*nvpS}\u0026B6x?Ov}f7\u003eB1G:$zGG]q", "ln": 10055, "col": 17, "line": 243 }, { "b": "w/#ekB-H#6zddxidlm!UarR!EwPS6nzxJXnz/fo3C{[1-B8Mhwv}xZ9iV}SJB8\u003e+zvq{fryi7NIar\u003e(Ev\u003ePC!fkkrCwPzV%y+Gjox!BvIa$K\u0026Xv@Dl%x\u003eGEWfekdkfFk4iiwkL:B.(dzu41de3jn12\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+L(", "ln": 10412, "col": 3, "line": 252 }, { "b": "\u0026*2R+M5(trvq{frxjVfka$)wzx!KgxwO(GjdgfP%w/$/fwO(GpdlnN]boP@viV})Fx(mD7vScg3wNPE0q=ck5aMv{oaxH\u0026#az1#6B0bNrwGU]2C4\u003e(qB0b7kA=2\u003eVaz2C2z!9A\u0026fjO*bB8#59ayYncy?m3)aA}:AyJx?9arR!pvrrRPaAz4kB.bSoe[5^kB1R9pBsntyvru6[z/QaEefDbXdgdguarUfjzF*NWaywU*c[bGCarR!DauZ\u0026Vb2Z{7mmg2%x\u003ee=jvqPNbAb]V5wGTDupFz%CBy/rgaxI95qBIZrvru6[z/Qa^cWPuiBBtIXarR)KzF%J6iV}uVfGpg6BzbkdC6dRsdgdguarU=DC@=oParR^HarR!Ez*cmBjS[lMzF?7rCX7xcBy=\u003eudk2jzByO#)y?$HG3lQDlaz2!cwPh-lB8=2gBy^lXpJf(=vruj4zEEuIA=M8sayPslwJyevarR^HarQ", "ln": 10970, "col": 195, "line": 258 }, { "b": "arR^HarR^Hv@Dm5e[nZoB7D:G3lQDlaAz4nB-Ivxyiarhx\u003ezSstv.CTBsqeUazbLjaAwPszxJ$rCxm4s3jmb9vq{frxjVfka$[1Gvrb\u003c\u003ea$i\u003efwO96awNPQ?xECq\u003carR)Kr5cGSrzDaYp9rFjoLCTeFrRf]wO2y[azbt7By/FnwP?H6x(v(id06uov}vr6z/2", "ln": 11405, "col": 1, "line": 269 }, { "b": "wfMBJefD=6fBw{BarUfjzF*NWaywU*c[bGCarR!GA^oXMarR^HarR^HA=leyauZ\u0026Sz/fCBwQ4=@B-.gyw*gexoHRrFazCvqzEEx[avYm8o^1d(wO(Ghs4C+TmiDFRzdK?-nLqF{cNBaVEi*l+dk2jzByO#)y?$HGarR)KzF%J6iV}uVfGoyZarR!rCW\u003er7BrCTAy?X05gChExwPzj3x(v($y^\u0026w+z/M$eB0b3P3lQDlarR^Har@1dgccK?A=M8seN\u0026dfwN({7wOb:\u0026v@#B6zxN}?LPU6YwGT]GoDW[!A=k$vwD", "ln": 11743, "col": 41, "line": 277 }, { "b": "arUxgaAz4kB.bSoe[5^kB1R9pBsntBzfc%Jau.\u003egb4#7ny:7[EarR^HarR^HboP@viV@DOw]83*By!#9sw@cv\u0026^^moBzbkdAbP=svqErjaAIa5A:@=mA+frmy\u0026\u003c.vxK$Q.wPw]8v}Y^(B0bNrwGU#nwPA5sA::e0arR^HarR^HzEEx[B09Q*a%FTOz!T8qw*fuNx*c(:tpjq%zdL82Elof0x*9Z-w]zYjAV/7laAzyAB14CsarR^", "ln": 12188, "col": 3, "line": 287 }, { "b": "wG\u003ceTb6myvBt4rHzepzAdgdguarUYoBAIRwazL$ozFrZdc%Hj@v@%btdiJkvAV/xBx(k5lz*cnddgcy?kW!RJe]U-IBsns^vq]{lv@Dj3wO#Qha$i\u003efwO95{z/6u5zGG}FdlnN]boP@viV@G=z/PA1axRMvaMv{oaAz4hwmY^)wft]3CoyQqaARpdasH=iv@DSAw].D]diJ5fze0(gC4\u003eJiatmelze0(vv@Dj3wO#Qh3lQDlayYn1C{2l)A+flkwPI@Cyiarhe[X:qc)Abswo/vIar\u00260U3lQDlayPzmxM4]ljS[=RADL\u0026lBs}rHz/dguwPPsAvrDW9z/N3Mar\u003eliz/c:F3lQDlay/tczxI7+uU0Q]dgdguarUfjzF?7rCX7xcBy=\u003cAnLShMqDa=gpe\u003e1iv@Dj3wO#QhasIhEB97=6wgO\u003ciB-.qnAX5txz!abxaxy^4ryG?ec]0nqei+NcefDuHB-.qnAX5txz!abxdgdguarUfjzF?7pz/6u9BsnNBarR^Hv@Dm5e[nZoB7D:G3lQDlaAz4nB-Ivxyiarhx\u003ezSsDM)xzb03\u0026CA=\u003e@wdgcy?wmU", "ln": 12517, "col": 43, "line": 291 }, { "b": "B1R9pBsntneMlk4B7]Mga$K\u0026Xa$i\u003cwarR!pz/fCnjS[9xvKJVjarR^HA=ldAjS[lMzF?7rCX7xcBy=\u003cAq:\u003cwGlStgJe?d#kqCQ1fB7GAlx(v)gaAFU$pF1q7B-RbmB0bPFpFJ3Pe[[\u0026VB1RPRwPzc(wfs@Amn=L%B1RMMyH}xDko.T3d0fxyegA22w[u6]xM4^1c[bGCarR!pz/fCBv@c78wHF#marR^HA+funA=91uz*8J}3p53sA4U^mBsns^vq]{lwn+$0ffA=-", "ln": 13056, "col": 59, "line": 307 }, { "b": "B-?zeB0bpgvqv0ex\u003c\u0026bOA:-{2qa}rtarR!pz/fCnjS[9xvKJVjarR^HA=ldAjS[lMzF?7rCX7xcBy=\u003cAq:\u003cwGlStfTavYm8o^0$+v@\u0026+]njuABazCvHko.T3c$EmauUK44djD(YwPRA}z/fbmdgdguarUfjzF?7py\u0026sxac[bGCarR!vw/$#fBrCQxCrc6NarR^HarR!EwPS6nzxJXnz/fo3C{[1-wPz*fAW0K!b5RsvazbLmzE:@tdj=O#fF\u003caVarR!vw/}", "ln": 13338, "col": 59, "line": 315 }, { "b": "e[X:qc)zi2B95PSar\u003erfBywY\u003ey+xjoA=riK3lQDlaARKqwO@RNazth8xL.x(e]tbRc$TVzwPIB8i^UBPvqfLaa$^CAv@C)?c[cO$xK#B0x\u003eI0#BsnNBarR^HboR8wwGV28", "ln": 13872, "col": 27, "line": 329 }, { "b": "x(mYeB-RbnaARpdave$ak%[plqy#x%zGG]qy\u00260V[av{A(BrGN[LPT{-x(!igx(mMA3lQDlaz++fyAL+.w*g]gBz%n]fmdwJB98*-vq]{lA+fr6Bt4cxzF0Q6z9JbXyH}xDDVTgwwO#]u3lQDlaAz4nB-Ivxyiarhx\u003ezSsDM)xzb03\u0026CA=\u003e}Aar\u003eucByw)1b03\u0026Ub64mowPP5hx(mYeB7GlhiV@==x(mZmb7g)E3jo4bAbWBGz/Z1Ga$)wzx!KNGvqZc#wPw$z3s)ZWaARTjzGxA3AWSv$arR)Kr5cGSA:-C", "ln": 13981, "col": 18, "line": 331 }, { "b": "efDR}dgdguarU9fBrAZ?w]8x]BsqfvADL\u0026lBs}rHz/dguwPPsAvqP}9zGE6Nattk[3lQDlaz+$ayAL+.xjVf[BAzKKvq{fpar\u003efmA:-\u003cbw[u0\u0026y\u0026r*0a$K\u003ciz/fbn3lQDlazCBgy\u0026r*0azC)tph+2YiTM#LarR^HarUGsv@0hIayPkde)\u0026ZvvqZc#wPzc]z!0M9jS[\u0026WA+eV\u0026x(mMooMaARc[bGCarR!vw/$]dv@0Y9v@VT9A+cUvx(dz", "ln": 14410, "col": 35, "line": 341 }, { "b": "arR^HarR^HBAhT/3lQDlarR^HarR^Hay/tczxI7+uU0Q]dgdguarR^HarR^HarUfjzF?7rCX7xcBy=\u003cAnLShMqDa=gpe\u003e1iBAg/cB7P07B08(yA=k/4B-RbmeoC/qB-RbmemAylB-8pIaxy^4ryG?ec{GmEei+NcefDu-B7Gw@b57Nit}vauz.92tzfdiQ3lQDlarR^HarR^Hay/tczz2BqzeB0ec[bGCarR^HarR^HarR!pz/fCBv@c78wHF#marR^HarR^HarR^", "ln": 14658, "col": 1, "line": 347 }, { "b": "z!0MnA+f5#vrl0ddgdguarUYoBAIRwazL$ozFrZdd0)dHA=M8sb03?\u003cvS=:qb7g)\u003eat\u003e\u0026e3jmb9vq{frAbP/tc)yrMAa{$HwNYs\u003ez!*KC3s)ZWaA}yaxM4*8c[dh1ar@1dgccKRq=l7c\u0026^^mownc6}v@@?+p-%j-z!0M]wig]PvqPNcz/PM8x(k4DA+e=}A+e:5kxR0.jS[iVAa9*ewPFh3arR!HA+(\u003cYaAz4kB.bSoe]2DCzz2NkBsntQA+({Jar\u00260U3lQDlazCBgA+c\u003eAwNPQ?xEE)Bf!$W)e?*J.fKcj+D#9.hvqGQ}B98^-tRmZne?*J.fNNbfiYY02u3[vXtRpyUiwK?(f/z0@e*q??B-IpHaAz3CnHU=\u003czE:\u003elflgSmx(W={BrR\u0026Bz/^aozxK7xy=R[CarR^HarR!EwPS6nzxJXnz/fo3C{[1-wPz*fAW0K!b4twbv@2T^iV@xZx)9{bwGV24zF9K4b7g)\u003eat+=a3lQDlazCXiz/P}xA+flkwPI%mayPsluVDFXarR^HBAhT/3lQDlarR^HaAwO/ayxdwxjVfkB-IpHaARsmwP8ZkjVa=kvqG:#Cvbx4wnc6}v@#=Prc0a)dgdguarR^HarUYoBAIRwazL$ozFrZdd0)dVByxolB0rT/AXqAPvruTkuT[1+wH[@FvSb!5b03\u0026!e{7VHBxZ^-fFD^XdgdguarUluv}xR3avQJ+wPh:9z/cXaB0b3P3lQDlarR^HaAz4nB-Ivxyiarhx\u003ezSsDM)3wA=k$xiV@G=AWUGFEjlY\u0026h83=)3jo4bAbWBxwPPsAflgSmx(W={BrSdvwmYu}A+e=}AWSv$arR)Kr5cGSzV", "ln": 14946, "col": 14, "line": 354 }, { "b": "A+PFzaz#9uv{%m[zFrP?y-)k3wN/G.arR^Hw/%kVA+flkwPI@Cvrc14e[X:qc)Anqy?j!war\u00260U3lQDlaz8-Vaz9lDwPhD]v}v5je?O!3efDbXdiG-Taz$R4C4AYSpFKt3B98CpA3fadB8@F-FrRf7e?O+efe1W}A+c?kwPzHdwPF$we?O!83lQDlayX=2wGTbUp*[DVc)yr^ze.drx()=]wO+Z=x(4v4a$i\u003cwarR!Gvrc0(BrAZ?c$lRawGSSGw*]uMwPI^aC4A6J3lQDlazCBgByxi5wPPLoCXIkvB0@E#3lQDlarR^HaAz4nB-IvxB7Gl1uUj1*wHIUeA+w%9dgdguarUYoBAIRwazL$ozFrZdd0)dHA=M8sb03?\u003czF%Rtw]z*fwfMBJefD=6gZTM%kW!RJe]U-IBsns^vq]{lB-qenvpQMh3s)ZWaA.Ttz^^f8dlnN]boP@viV})Fz!0N0x(!wsvTh{3B8@F-FrRfeAa\u003chkvR/%)yH}3catdRDBzU?pB75^0B0bNrA=l8kxBk\u003e8arUnsjS[=RADL\u0026lBs}fty?mVuxjVfkb4+L9wG\u0026MgarR^Hx\u003ewG9z/^aliTL", "ln": 15990, "col": 63, "line": 381 }, { "b": "wGU]iar(4O3lQDlazCBgzEEx[e[F{hB9ztuxECnMe]UGya$K\u0026Xe[Gosa$K\u0026Xe]$XIefDb?AcSSRdlm!UarR^HarR!EwPS6nzxJXnz/fo3C{[1-wPz*fAW0K!b4twbv@2T^aAR)FwG(KKefD=6fBw{BarUiaB95J/aw=G*xEC5TBzU$Iv}*3[wmYN:w[=6)B1.VPy\u0026r-)B0r4uarR^HwmY?7e]txmx(URvvrb{%BAoPAA=\u003e}Aaz2!iB97=cyDUTqB.90earR^Hw?FdkC4A7jwPI@ofcCdvzdLd6arR^HA+funA=91mB8L@gw{C!Kb5.lviV}yxB.99Db5*$jxD/FWw*e)JAboD3wofzJzEEx[EiK7", "ln": 16534, "col": 21, "line": 396 }, { "b": "y\u0026hoRv@b\u003c\u003czGEEKwPP5nz!@$(arR^Hv@Dm5auZ\u0026Owmu@o3lQDlay/tczz2HBwN/\u003e8wHE)darR^HarR^JnLShMqDa=gpe\u003e1iB-RbmB08(NB7GxfvqPNbAcCV5vrl9kA=k=9em\u0026Wbx(2jvrZxzVmn\u003erSkp/2Ikp/2Fa$K6zarR^HarR^P3lQDlarR^HarR^Hay[]5vj(h7BsntQB7GxfvqPN1efDcVa%nxUB98BJBzkP6e{7/AwHF#Rdj+/GarR^HarR^HarR!uvrl9#x\u003c@YiwhL=Cvrt{gxjVfkb5*$iB9zLywfJMEa%FD*wO#0@wmWerdk2pBCW$J3wPI@wdj+/GarR^HarR^HarR!Ez!@#o3lQDlarR^HarR^Hay[]5vj(h7BsntAzddc{a$K\u0026Xa$k5IarR^HarR^Hdj+/GarR^Q3lQDlay/tczz2BqzeB0ec[bGCarR!pz/fCBv/", "ln": 16994, "col": 46, "line": 408 }, { "b": "sxF0m\u0026^^movR/:@wfsVzllEW/zGGPmx\u003equdA+frgy\u003c6ws3lQDlazCXiz/P}xCX}mHwPR%7wIcz/wO(0@Bx0o(wGUA5avPlp3lQDlaARTHiTM#LarR^HarUYyz/^9+avPlZw].*bB98CpzF7wrwPq\u003c7B963EwPRo\u0026vrt{avrk^$wQ5qWrc0a)djCPDarR^HarR!EwPS6nzxJXnzV", "ln": 17469, "col": 26, "line": 425 }, { "b": "v%8/mjS[//z/Py@arR^HarR^HAa9^eB09Q*yC6WEy?W#ta$+5*3lQDlarR^HazbLjaAeDqzxJ[bA==wbiXr6(iTM#LarR^HarR^HarUfpAV^H/v%8/AB7GD7wObv[y\u0026?7AefGp/dgdguarR^HarUfpA:9G\u003eA==wbeIQKpauZ\u0026\u003c3lQDlayPkde)\u0026WhBAzkmxla", "ln": 18126, "col": 9, "line": 443 }, { "b": "c)AezB98tquU%v}B75Y)a$K\u0026Xa$i\u003cwarR!vw/#hmy=R[CarR^HarR!sA=k!qyh4N2vkn%tze:AlBrBK]ze:r1By=NqboP@viV}v1r7Oj(FrRf%wO#3\u0026A:J{1ze:r1By!*2BAh8kxcp=9B.M2cy?mHa3jm)#arR^HarU=DC@=oParR^HarR^HarR!EwPS6nzxJXnz/fo3C{[1-A+b", "ln": 18308, "col": 20, "line": 449 }, { "b": "KM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5(s$avwW=nLQx]iV})Fx(mD7q=ck5aMwcsayO!$x(k5bvrl98\u0026!AQsv@=0/yARR\u003eK%1\u003c!vrMj5B75(cBz\u0026oPx(n37A=br4fjO{rw[+(+boO9KarR^HarR/^HlrV\u003eB.\u003e\u003epn([$mB7F\u003c4wPP6OHlrV\u003ez/PG4ayO!$x(k6MHlrVTq=Dsh\u0026!AQsqBr\u003e}\u0026!AQsA=k(razbB#xd:JRvq{frxjVfka$)wnze0(vv@Dj3wO#Qha$i\u003efwO95[wnM3#uT[1\u003ezdNQbB0@E#arR)KvpTj?zy]^Ay\u003cvdDx\u003eqGh\u0026^^moA+fc0wPz\u0026mB98tvwN(][z/6u5zGG}xqBawbc@.@Asw@cvB7]H", "ln": 19031, "col": 179, "line": 462 }, { "b": "zGGDgzEEumv@Dl%x\u003eFRJ3lQDlarR^HaAz4nB-Ivxyiarhx\u003ezSsDM)iGByf92v@=d5b03\u0026ss5-K9mmf%wr4GdoC42JfByeZ1B95P!ar\u0026J}h.D^pfFk7vh90uJa$K\u0026XzF%Sdb03?\u003cx(n37A=br4aA.:paA8dlC{mU=3lQDlazCBgB9g@hvruf9jV%]ie[X)ufjO{rw[+)4iTM#LarR^HarR)KwmYm?C@^6TvqYH]C{3QqwN]\u003c8Bzb98ar(2FA+=\u003cwz/cXtxK@q%wN/U7ao", "ln": 19848, "col": 64, "line": 478 }, { "b": "arR^Har\u003e31z/Pz{tY9!*A+fidB7]-mA^qnnA=2lbC4CYnx(v(ijS(B-zxYAgarR^HarR^HarR^Otxjp(z//Lkb5.Hoxk8lcu0InLBAIRuauZ\u0026XBAzFyiXJc%wPhE7C@^@$ggI[CvqYH]C}A/yC%DBXz7YsjBywY\u003ey+xjoA=rWwx()=]wO-#ix()P$cObPEarR^HarR^HarR^ZfFC3+arR^HarR^HdgdguarUxgaAIWmAa9\u003c4au.\u003egb4k20x(kaqz/M$wBZ/q#Bz9pFByxiiB9ztuxEC6kwnM3#fcR\u0026aarR)KwmYm?C{0", "ln": 20105, "col": 8, "line": 483 }, { "b": "x)Ku3b7g)\u003eat+=b3lQDlazCBgB9g@hvruf9jV%]ie{y(yy+oBuz*c7LB7F\u003c7A+PSve{8tWb035NarR^HarR!EwPS6nzxHb\u003cz/fV9v@%:OB7F\u003c7A+PSvkX1IIvpS}=e[n*uA9NoSz!%b$C@^6=zY\u0026FhBz(28By!#9By/Jnx(mM*zxZROgb7ykaBtq1z/fVdzGEEfD2NssiV]R*wQ5qIAbn@%zx:GoarR^HA+funA=91mB8L@gw{C!Kb4U!nz/N3.ar\u003eYwBrCglB-7.lEjlY\u0026g+Z-[3jo4bAbWBGz/Z1Ga$)wnze0(vwQ4=@a$i\u003efwO95[wnM3#uUaE[v\u003c\u0026=!arR)KlR6Hmp9q?BBy/Gfx(n6miV}v1r7ODFaz2!ev\u003c0gjBZYr3wN(])C{3ZqA+w@]eLo8zePkJyC{3QgwN/H83lQDlaARKqauZ\u0026/wPq\u003c7B963FwNPaXA=S\u003cCwPPsAl3mo.z/PMrvruj4zxZROa%FD*A+fiavpJ\u003c%b0]\u003cHA+fnla$K\u0026Xa$i\u003cwarR!vze:AlBrC43B7El^3lQDlazCXiz/P}xxL?f/3jm)#arU=DC@=oParR^HarR!uwNPaXA:Jolg+o+*vr(WcvpS.Ohz=%cB7]nfjS[\u0026+yC6WEy?W#ta$+5*3lQDlarR^Hazts{wmY^7jS[GXz/dgzz^^f$c$lRawI#v$B-Iqtvp\u003c7TvM35NwN/T?wHIk6vpS}\u0026uT+]Ias!MUjV%#rdgdguarR^HarUSiD2dzcwfs2Tyiarhe]kDmwofedvrl0rg+J]\u003ey\u0026:2%wNw[8g?pfcz!9AcAaa3dz^^f-vM34=d\u003cc30jT8s73lQDlarR^HaAImfzFs03uUKy%B-X-?az8*AxK$Q.wPzc!hz/?mDVizsy\u0026r-)uT+]IEiHpPzEWP}wHF#marR^HarR^HwQ5f9v@#o)uUB1}auZ\u0026Xzdc{bzE[2un([#0q:\u003c5Kmn$)JzEWP}wHF#UaAImfzFs03uUKy%B-YeSxKL%}y?WuhB7!#qh8V)oxK#B0x\u003eI0#BsnNBarR^HarR^HwQ5f9v@#o)uT+]IauZ?}3lQDlarR^HarR^HayX=2wI#v$B-Iqtvp\u003c7TvM35OzEWP}wHIkevpH{cwP]K{s5-K9mmf%wr4.:1v@C)?c[cX\u0026B7]o8x(mM\u003cx(m)jBsXLFvrl9#x\u003c@YoxKJUNhyQm?x\u003eI0#BsnN!3lQDlarR^HarR^Hatdhov@C)?c[bGCarR^HarR^HarR^VA=Vtyx(CEAjT8rZarR^HarR^Hdf", "ln": 20414, "col": 43, "line": 488 }, { "b": "A40dxarR^HarR^Hx\u003ewG3wNPaXAXq0oBsntwy?B}vau.\u003egb5RspwG\u0026mnAV/mrBrz$sarR^HarR^HarR^HxL?f/e[n*pAa9=#uU0\u003e-wPI@wwQ5f9v@#o)uUB1}efFOzBswtJAV/4jvpH{1z/6D4A+eP*x\u003eI0#BspZBAaJK3wN]dShz=%cxk.(v3lQDlarR^HasPtUarR^HarR^HarR^HA+funA=91mB8L@gw{C!Kb4U!nz/N3.ar\u003eo6wft#jyH}xcEjlY\u0026g+ZS", "ln": 21442, "col": 23, "line": 511 }, { "b": "BrB1%v}xR3x(v(I3lQDlarR^HaAz4nB-Ivxyiarhx\u003ezSsDM)3wA=k$xiV]RQvpQH5z!\u0026{4b7g)\u003eat+=b3lQDlay/n0auZ\u0026/wPq\u003c7B963HB8L}GxjVfkb4CF2a$K\u0026Xx\u003eezp3lQDlaARTHiTM#LarR^HarUPBBrAZ?B9g@hA=kD0B8@%OB-5QqzdCguB7/c3y=$:rB.99Dv{%s#B-I52z/{evB-Y=CA=\u003e}AaARgtBuJPzB.99DBzkP6z/{d+f!+40ar@1Dz/GhDax7fLg9v#!xK@rfB.\u003e}A3lQDlarR^HaAz4nB-Ivxyiarhx\u003ezSsDM)xJBz#wAb03\u0026+B-YlSByYrjBxZ^:fFD=-ar\u003eAlvp@}Xx(n2piV}r@pGgW\u003coHhfQp^F5KEjkHCarR!rCW\u003er7BrB1%v}xR3x(v(ivriM5iTM#LarR^HarUYoBAIRwazL$ozFrZdd0)dHA=M8sb03\u0026/BAe^vdsAS@at\u003e\u0026b3jma+avwW=nLQx{iV}v1qBR^HwN]H}wN/*lvTh{3B8@F-HlrVuh90uJaz\u003eXivpS!*viBM:K%1\u003cTzeZRcA+e^5aMwcsaA?goy\u0026*/VHlrV*y\u0026r=9\u0026!AQ6boO9KarR^HarR!qwN/+aAcc2say/tbzddr)azC.dwN/*@z/dfInP5SYA=br4aAIamC4\u003eC$az++nwPF#dzxJUhBy/GgvqEMnC}GB?vq{frAbP/tc)yrMAa{$GvrDydfjXT7A^qRCa$i\u003efwO96dvrDyduU0.TA^qRCc[dh1ar@1FA=lhFaz2C3AbPDdBrGN[LPU0TvqE5@xKLQ)aAzQxB0bys", "ln": 21767, "col": 10, "line": 518 }, { "b": "iuP.:zGGDgzEEulAcS(tarR^Hx(d*cA=-BAwPq\u003c7B98ECvriL#ATAc@arR!GA^oXMarR^HarR^HAV^H/uVE=rz/Z1Gb4#7uA5]T9f!$WufFk4if/?fLfGy!fvrDydfjXT7A^qRCa$K\u003cKB8L}VA+flkwPI@CyiarhaA8oyDWNB/BzkP6z/{d+i4kgSarR^HarR!EwPS6nzxI?*B8V5nB7D+ue{7VHBsXLPe]#byBAIUiv@C)?efGo-lVl\u003c:wO#Pwrc-B]b03?\u003cvq{g4x\u003e7N[x(v(xyiarhb7g)EarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxJXnz/fo3C{[1-wPz*fAW0K!B98BJwHS3RefD/7g71u}boPuAk$K/]lPMugvpJ\u003c\u003eBAg/cB7P07aJ6Kvas!Nal@cY6\u0026!AQswo89)zxN}[", "ln": 22420, "col": 67, "line": 531 }, { "b": "A=M8sb03?\u003cwQ4=@B-.tvwGV28ADL#owN)0kdj=O#fF:4UarR!EwPS6nzxJXnz/fo3C{[1-w]7)*b03?\u003cmOD9rDT*=ivpS}=uT)U=uTX4{EiHi+b5RsvwG\u003ceTb4CUiCwXKkxKLQ)avvu3dgcy?kW!RJe[X:qc)yrMAa{$Ggb0rLvqH40a$i\u003efwO96dggaZavqH40c[dg:arR^Hv@Dm5auZ\u0026Owmu@o3lQDlaz$LdA:-\u003cbw[u17auZ\u0026Sz/fCBwQ4=@B-.gyb2Z{7mf", "ln": 22991, "col": 27, "line": 546 }, { "b": "w{C!Kb5.lviV}yxB.99Db6dsoC4\u003eC$b03?\u003cv}*3[wmYN3efDcQz/P}ziV}l{qDe5[3jmb9vq{frxjVfka$)LAvp{=k3s)ZWazbB#xj2gXv@DSvdlm!UarR^KaARpday]4[z*rEqy**%0rZxzJl{T^vqY[K}oJaw5c$)shy-)X9BAz8mzyEQ?Bz(8lB0bHmAbP=sazC{Gazk.6wmY!53lQDlar@0Sv{%B\u0026ePUGvB7]-gC4z!sAbYxev{%A", "ln": 23398, "col": 17, "line": 560 }, { "b": "pe\u003cUWpc?L$dlm!UarR^HarR!EwPS6nzvdHearU=DC@=oParR^HarR!sA=k!qB9hhix(kLtvpy\u003c0x()=]wO-G6ze:AlBrCpnBy/GgvqE5{B0a?7zGE0zboR8NAaI6Mx\u003eIs4A+bN+arR^HarR^HBzbYavpT7\u0026xd^d%A+eV\u0026d0e)rxjVfFuUKz1e](8LefFFiwO(v6jYDDAwHPlMByxiic[bGCarR!rCW\u003er7BrB1%v}xR3x(v(I3lQDlarR^HaARTHiTM#LarR^HarR^HarUxnAbP=sazC.nwPzV%y-)ecayw\u00262BrzXJay]hbwN/*lA=(mxw)]H(vQS+Z3jm)#arR^HarR^HarU=tA+eV\u0026x(mMora{q-vpQ^dvrc0(BuJ#BzGEHKB-5-Mwmo4^z/dZqA=\u003e}xe]#byA=-YU3lQDlarR^Haz2!cwPh-lmr\u0026rNAcb/jzAnaEarR^HarR^HarR!CvrlF%3jpGVaywF[vqPN.uM.G{ar\u003ef1zddc@uTC0r3lQDlaAIa9wge(larR^Hp*[DVc)yr^ze.drx()=]wO+Z=x(4v4flIkIz^^f$a$kcYyH?d1c#-QnwO#QhjYDDAwH[%nCXIkvuVfZyrc0a)dgdguarU32z/o-8x(n37A=br4c[bGCarR!nAbWBIB-5Qvz/Z1-a$$S6e?![ia$K\u003cQz/P}.p!%$*efFFmvS=rDmQZaOwHN@", "ln": 24073, "col": 36, "line": 573 } ], "depth": 1, "facts": { "imp": [ [ "", "int" ], [ "", "os.environ.get" ], [ "", "os.environ.get" ], [ "", "os.environ.get" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "Flask" ], [ "", "threading.Lock" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "json.loads" ], [ "", "Path.read_text" ], [ "", "Path" ], [ "", "data.get" ], [ "", "_ip" ], [ "", "time.time" ], [ "", "time.sleep" ], [ "", "min" ], [ "", "time.time" ], [ "", "_tarpitted" ], [ "", "jsonify" ], [ "", "time.time" ], [ "", "_RATE.hits.get" ], [ "", "_ip" ], [ "", "hits.append" ], [ "", "_ip" ], [ "", "len" ], [ "", "int" ], [ "", "os.environ.get" ], [ "", "jsonify" ], [ "", "request.get_data" ], [ "", "pat.search" ], [ "", "open" ], [ "", "f.write" ], [ "", "json.dumps" ], [ "", "time.time" ], [ "", "_ip" ], [ "", "jsonify" ], [ "", "open" ], [ "", "f.write" ], [ "", "json.dumps" ], [ "", "time.time" ], [ "", "_ip" ], [ "", "resp.headers.pop" ], [ "", "resp.headers.pop" ], [ "", "sqlite3.connect" ], [ "", "Path.unlink" ], [ "", "Path" ], [ "", "_db" ], [ "", "conn.cursor" ], [ "", "c.executescript" ], [ "", "c.execute" ], [ "", "c.execute" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "c.execute" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "c.execute" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "c.executemany" ], [ "", "c.execute" ], [ "", "c.execute" ], [ "", "c.execute" ], [ "", "c.execute" ], [ "", "conn.commit" ], [ "", "conn.close" ], [ "", "Path.write_text" ], [ "", "Path" ], [ "", "app.get" ], [ "", "app.get" ], [ "", "app.get" ], [ "", "Response" ], [ "", "app.get" ], [ "", "jsonify" ], [ "", "app.get" ], [ "", "jsonify" ], [ "", "app.route" ], [ "", "request.form.get" ], [ "", "request.form.get" ], [ "", "_db" ], [ "", "conn.execute.fetchone" ], [ "", "conn.execute" ], [ "", "conn.close" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "p.encode" ], [ "", "hashlib.sha256.hexdigest" ], [ "", "hashlib.sha256" ], [ "", "time.time" ], [ "", "_db" ], [ "", "conn.execute" ], [ "", "time.time" ], [ "", "conn.commit" ], [ "", "conn.close" ], [ "", "jsonify" ], [ "", "resp.set_cookie" ], [ "", "time.sleep" ], [ "", "jsonify" ], [ "", "app.get" ], [ "", "jsonify" ], [ "", "request.headers.get" ], [ "", "app.get" ], [ "", "jsonify" ], [ "", "app.get" ], [ "", "request.args.get" ], [ "", "_db" ], [ "", "conn.execute.fetchall" ], [ "", "conn.execute" ], [ "", "jsonify" ], [ "", "str" ], [ "", "conn.close" ], [ "", "jsonify" ], [ "", "dict" ], [ "", "app.get" ], [ "", "request.args.get" ], [ "", "re.search" ], [ "", "jsonify" ], [ "", "_db" ], [ "", "conn.execute.fetchall" ], [ "", "conn.execute" ], [ "", "Response" ], [ "", "conn.close" ], [ "", "request.args.get" ], [ "", "Response" ], [ "", "jsonify" ], [ "", "dict" ], [ "", "app.post" ], [ "", "request.json.get" ], [ "", "request.json.get" ], [ "", "_db" ], [ "", "conn.execute" ], [ "", "conn.commit" ], [ "", "conn.close" ], [ "", "jsonify" ], [ "", "request.cookies.get" ], [ "", "request.headers.get" ], [ "", "_db" ], [ "", "conn.execute.fetchone" ], [ "", "conn.execute" ], [ "", "conn.close" ], [ "", "app.get" ], [ "", "_db" ], [ "", "conn.execute.fetchone" ], [ "", "conn.execute" ], [ "", "conn.close" ], [ "", "jsonify" ], [ "", "_session_user" ], [ "", "_session_user" ], [ "", "jsonify" ], [ "", "jsonify" ], [ "", "dict" ], [ "", "app.post" ], [ "", "request.json.get" ], [ "", "request.headers.get" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "jsonify" ], [ "", "app.post" ], [ "", "_session_user" ], [ "", "jsonify" ], [ "", "int" ], [ "", "request.json.get" ], [ "", "float" ], [ "", "request.json.get" ], [ "", "getattr" ], [ "", "threading.Lock" ], [ "", "lock.acquire" ], [ "", "_db" ], [ "", "conn.execute" ], [ "", "conn.commit" ], [ "", "conn.close" ], [ "", "jsonify" ], [ "", "lock.release" ], [ "", "jsonify" ], [ "", "app.post" ], [ "", "request.json.get" ], [ "", "re.search" ], [ "", "jsonify" ], [ "", "_r.get" ], [ "", "jsonify" ], [ "", "jsonify" ], [ "", "str" ], [ "", "app.get" ], [ "", "request.args.get" ], [ "", "jsonify" ], [ "", "app.get" ], [ "", "request.args.get" ], [ "", "f.replace" ], [ "", "Path" ], [ "", "target.exists" ], [ "", "send_file" ], [ "", "jsonify" ], [ "", "app.post" ], [ "", "request.files.get" ], [ "", "jsonify" ], [ "", "name.endswith" ], [ "", "jsonify" ], [ "", "Path" ], [ "", "dest.mkdir" ], [ "", "f.save" ], [ "", "jsonify" ], [ "", "app.post" ], [ "", "data.get" ], [ "", "_db" ], [ "", "conn.execute" ], [ "", "data.get" ], [ "", "str" ], [ "", "time.time" ], [ "", "hashlib.md5.hexdigest" ], [ "", "hashlib.md5" ], [ "", "data.get.encode" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "conn.commit" ], [ "", "conn.close" ], [ "", "jsonify" ], [ "", "app.post" ], [ "", "ET.fromstring" ], [ "", "request.get_data" ], [ "", "jsonify" ], [ "", "jsonify" ], [ "", "str" ], [ "", "app.post" ], [ "", "_session_user" ], [ "", "getattr" ], [ "", "data.items" ], [ "", "k.split" ], [ "", "cur.setdefault" ], [ "", "store.get" ], [ "", "Template.render" ], [ "", "Template" ], [ "", "str" ], [ "", "app.get" ], [ "", "_session_user" ], [ "", "_db" ], [ "", "conn.execute.fetchall" ], [ "", "conn.execute" ], [ "", "conn.close" ], [ "", "app.get" ], [ "", "subpath.endswith" ], [ "", "Response" ], [ "", "subpath.startswith" ], [ "", "app.post" ], [ "", "request.headers.get.replace" ], [ "", "request.headers.get" ], [ "", "tok.split" ], [ "", "json.loads" ], [ "", "base64.urlsafe_b64decode" ], [ "", "json.loads" ], [ "", "base64.urlsafe_b64decode" ], [ "", "hmac.new.hexdigest" ], [ "", "hmac.new" ], [ "", "JWT_SECRET.encode" ], [ "", "base64.urlsafe_b64encode.decode.rstrip" ], [ "", "base64.urlsafe_b64encode.decode" ], [ "", "base64.urlsafe_b64encode" ], [ "", "hmac.new.digest" ], [ "", "hmac.new" ], [ "", "JWT_SECRET.encode" ], [ "", "sig.strip" ], [ "", "header.get" ], [ "", "hmac.compare_digest" ], [ "", "hmac.compare_digest" ], [ "", "payload.get" ], [ "", "request.json.get" ], [ "", "subprocess.run" ], [ "", "str" ], [ "", "app.post" ], [ "", "_r.post" ], [ "", "Response" ], [ "", "str" ], [ "", "app.get" ], [ "", "_session_user" ], [ "", "app.get" ], [ "", "_db" ], [ "", "conn.execute.fetchone" ], [ "", "conn.execute" ], [ "", "conn.close" ], [ "", "time.time" ], [ "", "app.get" ], [ "", "app.get" ], [ "", "os.environ.get" ], [ "", "threading.Thread.start" ], [ "", "threading.Thread" ], [ "", "threading.Thread.start" ], [ "", "threading.Thread" ], [ "", "seed" ], [ "", "Path.mkdir" ], [ "", "Path" ], [ "", "_boot_internal" ], [ "", "app.run" ], [ "flask", "Flask" ], [ "pathlib", "Path" ], [ "flask", "Response" ], [ "jinja2", "Template" ], [ "", "base64" ], [ "", "flask" ], [ "", "hashlib" ], [ "", "hmac" ], [ "", "internal" ], [ "suijin.lab.citadel", "internal" ], [ "", "jinja2" ], [ "", "json" ], [ "flask", "jsonify" ], [ "", "os" ], [ "", "pathlib" ], [ "", "re" ], [ "flask", "request" ], [ "", "requests" ], [ "flask", "send_file" ], [ "", "sqlite3" ], [ "", "subprocess" ], [ "", "suijin.lab.citadel" ], [ "", "threading" ], [ "", "time" ], [ "", "xml.etree.ElementTree" ] ], "mbr": [ "ET.fromstring", "JWT_SECRET.encode", "Path.mkdir", "Path.read_text", "Path.unlink", "Path.write_text", "Template.render", "_RATE.hits", "_RATE.hits.get", "_RATE.lock", "_int.run", "_r.get", "_r.post", "_session_user.role", "app._settings", "app._transfer_lock", "app.after_request", "app.before_request", "app.config", "app.config.JSONIFY_PRETTYPRINT_REGISTRATION", "app.get", "app.post", "app.route", "app.run", "base64.urlsafe_b64decode", "base64.urlsafe_b64encode", "base64.urlsafe_b64encode.decode", "base64.urlsafe_b64encode.decode.rstrip", "c.execute", "c.executemany", "c.executescript", "conn.close", "conn.commit", "conn.cursor", "conn.execute", "conn.execute.fetchall", "conn.execute.fetchone", "conn.execute.fetchone.c", "conn.row_factory", "cur.setdefault", "data.get", "data.get.encode", "data.items", "dest.mkdir", "f.filename", "f.replace", "f.save", "f.write", "hashlib.md5", "hashlib.md5.hexdigest", "hashlib.sha256", "hashlib.sha256.hexdigest", "header.get", "hits.append", "hmac.compare_digest", "hmac.new", "hmac.new.digest", "hmac.new.hexdigest", "json.dumps", "json.loads", "k.split", "lock.acquire", "lock.release", "name.endswith", "os.environ", "os.environ.get", "out.stdout", "p.encode", "pat.search", "payload.get", "r.author", "r.body", "r.name", "r.status_code", "r.text", "re.I", "re.compile", "re.search", "request.args", "request.args.get", "request.cookies", "request.cookies.get", "request.files", "request.files.get", "request.form", "request.form.get", "request.full_path", "request.get_data", "request.headers", "request.headers.get", "request.headers.get.replace", "request.json", "request.json.get", "request.method", "request.path", "request.remote_addr", "resp.headers", "resp.headers.pop", "resp.set_cookie", "root.tag", "row.classified", "row.id", "row.pw_hash", "row.role", "sig.strip", "sqlite3.OperationalError", "sqlite3.Row", "sqlite3.connect", "store.get", "subpath.endswith", "subpath.startswith", "subprocess.run", "target.exists", "threading.Lock", "threading.Thread", "threading.Thread.start", "time.sleep", "time.time", "tok.split", "user.id", "user.role" ], "tgt": [ "ET.fromstring", "Flask", "JWT_SECRET.encode", "Path", "Path.mkdir", "Path.read_text", "Path.unlink", "Path.write_text", "Response", "Template", "Template.render", "_RATE.hits.get", "_boot_internal", "_db", "_ip", "_r.get", "_r.post", "_session_user", "_tarpitted", "app.get", "app.post", "app.route", "app.run", "base64.urlsafe_b64decode", "base64.urlsafe_b64encode", "base64.urlsafe_b64encode.decode", "base64.urlsafe_b64encode.decode.rstrip", "c.execute", "c.executemany", "c.executescript", "conn.close", "conn.commit", "conn.cursor", "conn.execute", "conn.execute.fetchall", "conn.execute.fetchone", "cur.setdefault", "data.get", "data.get.encode", "data.items", "dest.mkdir", "dict", "f.replace", "f.save", "f.write", "float", "getattr", "hashlib.md5", "hashlib.md5.hexdigest", "hashlib.sha256", "hashlib.sha256.hexdigest", "header.get", "hits.append", "hmac.compare_digest", "hmac.new", "hmac.new.digest", "hmac.new.hexdigest", "int", "json.dumps", "json.loads", "jsonify", "k.split", "len", "lock.acquire", "lock.release", "min", "name.endswith", "open", "os.environ.get", "p.encode", "pat.search", "payload.get", "re.compile", "re.search", "request.args.get", "request.cookies.get", "request.files.get", "request.form.get", "request.get_data", "request.headers.get", "request.headers.get.replace", "request.json.get", "resp.headers.pop", "resp.set_cookie", "seed", "send_file", "sig.strip", "sqlite3.connect", "store.get", "str", "subpath.endswith", "subpath.startswith", "subprocess.run", "target.exists", "threading.Lock", "threading.Thread", "threading.Thread.start", "time.sleep", "time.time", "tok.split" ], "funcs": [ [ "_ip", 2469 ], [ "_tarpitted", 2526 ], [ "_armor", 2829 ], [ "_hardened", 4348 ], [ "_db", 5110 ], [ "seed", 5210 ], [ "index", 7649 ], [ "robots", 7901 ], [ "backup", 8152 ], [ "api_v1_info", 8473 ], [ "api_v2_index", 8817 ], [ "login", 9008 ], [ "api_public_cors", 10116 ], [ "sourcemap", 10410 ], [ "items", 11000 ], [ "search", 11492 ], [ "comments", 12608 ], [ "_session_user", 12977 ], [ "get_doc", 13280 ], [ "reset", 13743 ], [ "transfer", 14194 ], [ "webhook", 15031 ], [ "redir", 15602 ], [ "download", 15928 ], [ "upload", 16339 ], [ "register", 16856 ], [ "import_xml", 17444 ], [ "settings", 17776 ], [ "admin_comments", 19242 ], [ "catchall", 19762 ], [ "admin_exec", 20665 ], [ "vault_decrypt", 22354 ], [ "executive", 22823 ], [ "v2_health", 23134 ], [ "health", 23368 ], [ "flag_decoy", 23471 ], [ "_boot_internal", 24016 ] ], "metrics": { "ast": { "op.add": 9, "op.div": 2, "op.lor": 16, "op.sub": 4, "op.land": 3, "max_depth": 22, "call_count": 323, "node_count": 6812, "member_count": 121, "max_array_len": 8, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.land": 0, "max_concat_chain": 3, "member_depth_max": 4, "const_return_function_count": 1, "const_return_function_ratio": 0.03, "string_return_function_count": 1, "string_return_function_ratio": 0.03 }, "file": { "size": 24636, "entropy": 5.23 }, "text": { "lines": 592, "top_char": 101, "max_ws_run": 10, "digit_ratio": 0.03, "space_count": 4434, "char_entropy": 5.23, "unique_chars": 104, "top_char_null": 0, "string_density": 0.62, "top_char_ratio": 0.06, "avg_line_length": 40.61, "max_line_length": 200, "non_ascii_ratio": 0.1, "empty_line_ratio": 0.16, "last_line_length": 51, "long_token_count": 11, "whitespace_ratio": 0.2, "identifier_density": 1.65, "line_length_stddev": 37.97, "encoded_string_ratio": 0, "normalized_string_count": 15, "repeated_char_sequences": 76, "suspicious_string_ratio": 0.02, "suspicious_comment_ratio": 0.15, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 26.06 }, "binds": { "count": 96 }, "binary": { "peak_region_bytes": 19456, "peak_region_entropy": 5.21 }, "source": { "function_count": 37 }, "imports": { "count": 25, "aliased": 4, "stdlib_count": 12, "stdlib_ratio": 0.48, "third_party_count": 13, "third_party_ratio": 0.52 }, "strings": { "sql": 7, "bytes": 6140, "count": 365, "ip_count": 2, "url_count": 2, "avg_length": 16.82, "max_length": 613, "path_count": 41, "avg_entropy": 2.56, "email_count": 7, "empty_count": 19, "url_encoded": 1, "entropy_stddev": 1.2, "high_entropy_count": 2, "embedded_code_candidates": 1 }, "comments": { "chars": 5348, "count": 73, "lines": 73, "high_entropy": 11, "to_code_ratio": 0.14 }, "functions": { "count": 37, "density": 6.25, "avg_params": 0.11, "code_ratio": 0.68, "max_params": 1, "length_stddev": 8.9, "avg_name_length": 8.14, "no_params_count": 33, "avg_length_lines": 10.89, "max_length_lines": 38, "min_length_lines": 2, "high_entropy_names": 1, "single_char_params": 1, "avg_param_name_length": 4.5 }, "identifiers": { "count": 974, "unique": 240, "avg_length": 6.55, "max_length": 17, "min_length": 1, "avg_entropy": 2.27, "reuse_ratio": 0.25, "length_stddev": 3.49, "has_digit_ratio": 0.05, "sequential_names": 11, "single_char_count": 11, "single_char_ratio": 0.05, "high_entropy_count": 7, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.85, "all_uppercase_ratio": 0.06, "numeric_suffix_count": 8, "double_underscore_count": 1, "underscore_prefix_count": 14 } } }, "id": 29, "mol": "K(Te)O₇(XeAs₂CCaCoLaS₂)H₆(Cm₂₀Cr₂Db₁₃F₄Os₃Po₆)Md₂(In₁₁Pa)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/citadel/app.py", "pid": 0, "risk": 145, "sha": "3666baac949197cb2c148875da4f2532696820614f4f5a321596a74b6479de32", "size": 24636, "traits": [ { "id": "metadata/import/python/flask/flask::flask", "conf": 0.95, "crit": 2, "desc": "imports Flask from flask", "spans": [ [ 760, 0 ] ] }, { "id": "metadata/import/python/pathlib/path::path", "conf": 0.95, "crit": 3, "desc": "imports Path from pathlib", "spans": [ [ 736, 4 ] ] }, { "id": "metadata/import/python/flask/response::response", "conf": 0.95, "crit": 2, "desc": "imports Response from flask", "spans": [ [ 767, 0 ] ] }, { "id": "metadata/import/python/jinja2/template::template", "conf": 0.95, "crit": 2, "desc": "imports Template from jinja2", "spans": [ [ 18370, 0 ] ] }, { "id": "metadata/import/python/base64::base64", "conf": 0.95, "crit": 3, "desc": "imports base64", "spans": [ [ 20836, 6 ] ] }, { "id": "metadata/import/python/flask::flask", "conf": 0.95, "crit": 2, "desc": "imports flask", "spans": [ [ 747, 0 ] ] }, { "id": "metadata/import/python/hashlib::hashlib", "conf": 0.95, "crit": 3, "desc": "imports hashlib", "spans": [ [ 614, 7 ] ] }, { "id": "metadata/import/python/hmac::hmac", "conf": 0.95, "crit": 3, "desc": "imports hmac", "spans": [ [ 20854, 4 ] ] }, { "id": "metadata/import/python/internal::_int", "conf": 0.95, "crit": 2, "desc": "imports internal as _int", "spans": [ [ 24298, 0 ] ] }, { "id": "metadata/import/python/suijin/lab/citadel/internal::_int", "conf": 0.95, "crit": 2, "desc": "imports internal from suijin.lab.citadel as _int", "spans": [ [ 24147, 0 ] ] }, { "id": "metadata/import/python/jinja2::jinja2", "conf": 0.95, "crit": 2, "desc": "imports jinja2", "spans": [ [ 18356, 0 ] ] }, { "id": "metadata/import/python/json::json", "conf": 0.95, "crit": 2, "desc": "imports json", "spans": [ [ 629, 0 ] ] }, { "id": "metadata/import/python/flask/jsonify::jsonify", "conf": 0.95, "crit": 2, "desc": "imports jsonify from flask", "spans": [ [ 777, 0 ] ] }, { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 641, 2 ] ] }, { "id": "metadata/import/python/pathlib::pathlib", "conf": 0.95, "crit": 3, "desc": "imports pathlib", "spans": [ [ 721, 7 ] ] }, { "id": "metadata/import/python/re::re", "conf": 0.95, "crit": 2, "desc": "imports re", "spans": [ [ 651, 0 ] ] }, { "id": "metadata/import/python/flask/request::request", "conf": 0.95, "crit": 3, "desc": "imports request from flask", "spans": [ [ 786, 7 ] ] }, { "id": "metadata/import/python/requests::_r", "conf": 0.95, "crit": 3, "desc": "imports requests as _r", "spans": [ [ 15350, 8 ] ] }, { "id": "metadata/import/python/flask/send_file::send_file", "conf": 0.95, "crit": 2, "desc": "imports send_file from flask", "spans": [ [ 795, 0 ] ] }, { "id": "metadata/import/python/sqlite3::sqlite3", "conf": 0.95, "crit": 3, "desc": "imports sqlite3", "spans": [ [ 661, 7 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 676, 10 ] ] }, { "id": "metadata/import/python/suijin/lab/citadel::suijin/lab/citadel", "conf": 0.95, "crit": 2, "desc": "imports suijin.lab.citadel", "spans": [ [ 24121, 0 ] ] }, { "id": "metadata/import/python/threading::threading", "conf": 0.95, "crit": 2, "desc": "imports threading", "spans": [ [ 694, 0 ] ] }, { "id": "metadata/import/python/time::time", "conf": 0.95, "crit": 2, "desc": "imports time", "spans": [ [ 711, 0 ] ] }, { "id": "metadata/import/python/xml/etree/elementtree::ET", "conf": 0.95, "crit": 2, "desc": "imports xml.etree.ElementTree as ET", "spans": [ [ 17517, 0 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 890, 0 ] ] }, { "id": "metadata/import/package::python-hashlib-import", "conf": 0.9, "crit": 3, "desc": "Python imports the hashlib library", "spans": [ [ 614, 7 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 15, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2094, 0 ], [ 2124, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 60, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 426, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2920, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 10103, 0 ] ] }, { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "spans": [ [ 19195, 3 ] ] }, { "id": "metadata/package/testing/corpus::sqli-category-label", "conf": 0.9, "crit": 3, "desc": "SQL injection category label", "spans": [ [ 11034, 4 ] ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 369, 4 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 12252, 3 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "spans": [ [ 20782, 35 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::python-response-body-member-reference", "conf": 0.8, "crit": 3, "desc": "Python response body member access", "spans": [ [ 15489, 1 ], [ 15491, 4 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 3, "desc": "Python JSON content type", "spans": [ [ 22632, 16 ] ] }, { "id": "micro-behaviors/communications/http/keywords::webhook-service-word", "conf": 0.9, "crit": 1, "desc": "Mentions 'webhook' (HTTP callback)", "spans": [ [ 15021, 0 ] ] }, { "id": "micro-behaviors/communications/http/login::http-login-path", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP login path", "spans": [ [ 8974, 6 ] ] }, { "id": "micro-behaviors/communications/http/message::robots-txt-directive-marker", "conf": 0.9, "crit": 3, "desc": "robots.txt directive line marker", "spans": [ [ 8000, 9 ] ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "spans": [ [ 8999, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument", "spans": [ [ 22484, 82 ] ] }, { "id": "micro-behaviors/communications/http/request/client::requests-post-url-literal", "conf": 0.8, "crit": 3, "desc": "requests/httpx post URL literal", "spans": [ [ 22485, 15 ] ] }, { "id": "micro-behaviors/communications/http/response::response-success-field", "conf": 0.86, "crit": 3, "desc": "JSON response success field", "spans": [ [ 9645, 10 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::python-framework-route-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python framework route call with URL literal", "spans": [ [ 8963, 44 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::python-http-route-basic-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python basic HTTP route decorator", "spans": [ [ 7635, 9 ], [ 12581, 10 ] ] }, { "id": "micro-behaviors/communications/http/server/request::extract-from-request-form", "conf": 0.8, "crit": 3, "desc": "Extracts a request form field", "spans": [ [ 9101, 16 ] ] }, { "id": "micro-behaviors/communications/http/url/query::interpolated-identifier-query-value", "conf": 0.9, "crit": 3, "desc": "URL query interpolates an identifier value", "spans": [ [ 14078, 14 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-request-target", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP client requests a cleartext URL", "spans": [ [ 22486, 15 ] ] }, { "id": "micro-behaviors/communications/http/url/telemetry::ingest-api-path", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Ingest or upload API endpoint path", "spans": [ [ 16325, 11 ] ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-route-declaration", "conf": 0.86, "crit": 3, "desc": "Webhook route declaration", "spans": [ [ 15010, 18 ] ] }, { "id": "micro-behaviors/communications/socket/bind/address::python-framework-server-all-interfaces", "conf": 0.9, "crit": 3, "desc": "Python framework server binds all interfaces", "spans": [ [ 24588, 22 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs Python SHA-256 operation", "spans": [ [ 9383, 14 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::time-derived-request-hash", "conf": 0.86, "crit": 3, "desc": "Hashes time-derived request input", "spans": [ [ 9391, 25 ] ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-compare-digest", "conf": 0.85, "crit": 3, "desc": "Uses hmac.compare_digest for secure comparison", "spans": [ [ 21506, 19 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::python-early-return-call-gate", "conf": 0.86, "crit": 3, "desc": "Python conditional early return after call", "spans": [ [ 2847, 31 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::broad-exception-bound-catch", "atk": "T1027", "mbc": "C0027", "conf": 0.8, "crit": 1, "desc": "Catches broad Exception into a variable", "spans": [ [ 15508, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::broad-exception-return-suppression", "atk": "T1027", "mbc": "C0027", "conf": 0.86, "crit": 3, "desc": "Broad exception returns failure sentinel", "spans": [ [ 2759, 47 ], [ 4280, 46 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-exception-pass", "atk": "T1027", "mbc": "C0027", "conf": 0.85, "crit": 3, "desc": "exception suppression via try/except pass", "spans": [ [ 2755, 34 ], [ 3957, 50 ], [ 24406, 42 ] ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "spans": [ [ 17156, 10 ] ] }, { "id": "micro-behaviors/data/db/sql::python-sql-f-string", "conf": 0.9, "crit": 3, "desc": "Builds SQL with Python f-string interpolation", "spans": [ [ 11169, 55 ], [ 11807, 49 ] ] }, { "id": "micro-behaviors/data/decode/encoded/formats::python-urlsafe-base64-decode", "conf": 0.85, "crit": 3, "desc": "Python URL-safe Base64 decoder call", "spans": [ [ 20951, 24 ] ] }, { "id": "micro-behaviors/data/encode/base64::urlsafe-b64encode-call", "conf": 0.9, "crit": 3, "desc": "Calls base64.urlsafe_b64encode (Python)", "spans": [ [ 21267, 24 ] ] }, { "id": "micro-behaviors/data/format/json::json-result-field", "conf": 0.8, "crit": 3, "desc": "JSON result or response field key", "spans": [ [ 15456, 9 ], [ 22020, 9 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "spans": [ [ 21836, 0 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "spans": [ [ 3547, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "spans": [ [ 22019, 0 ] ] }, { "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format", "conf": 0.9, "crit": 3, "desc": "Code formats a zero-padded integer", "spans": [ [ 2150, 3 ] ] }, { "id": "micro-behaviors/data/string/search::compiled-python-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of Python regex patterns", "spans": [ [ 2082, 11 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "spans": [ [ 2274, 11 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::flag-file-root-path", "atk": "T1083,T1552.001", "conf": 0.9, "crit": 3, "desc": "Names a root-level flag file path", "spans": [ [ 23462, 7 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 931, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 889, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/full::python-pathlib-read-text", "atk": "T1005", "mbc": "E1005", "conf": 0.8, "crit": 2, "desc": "Read text via pathlib", "spans": [ [ 2579, 0 ] ] }, { "id": "micro-behaviors/fs/write/file/full::py-pathlib-write-call", "conf": 0.9, "crit": 3, "desc": "pathlib write_text/write_bytes call", "spans": [ [ 7131, 15 ] ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-getattr-call", "conf": 0.75, "crit": 3, "desc": "Python getattr dynamic attribute lookup", "spans": [ [ 14474, 7 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "spans": [ [ 17227, 8 ] ] }, { "id": "micro-behaviors/process/create/thread::python-daemon-thread", "conf": 0.8, "crit": 3, "desc": "Creates a daemon thread in Python", "spans": [ [ 24199, 35 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stdout-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stdout stream", "spans": [ [ 22034, 6 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "spans": [ [ 2689, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::py-passphrase-literal-assign", "atk": "T1027.013", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Python secret or cipher key literal", "spans": [ [ 1192, 28 ], [ 1252, 31 ], [ 1380, 35 ] ] }, { "id": "objectives/anti-static/obfuscation/string/concat::python-host-fstring-url", "atk": "T1027", "conf": 0.85, "crit": 3, "desc": "Python host f-string URL", "spans": [ [ 14047, 13 ] ] }, { "id": "objectives/collection/stealer/ctf::ctf-flag-stealer-regex", "conf": 0.95, "crit": 3, "desc": "CTF flag-format pattern in source", "spans": [ [ 1430, 29 ], [ 6834, 23 ], [ 7164, 22 ], [ 23055, 21 ] ] }, { "id": "objectives/command-and-control/remote-command/tasking::json-command-field-read", "atk": "T1059,T1071.001", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Reads command from JSON response", "spans": [ [ 21850, 15 ] ] }, { "id": "objectives/credential-access/cracking/cracker::hash-cracking-vocabulary", "conf": 0.9, "crit": 3, "desc": "Names hash cracking or wordlist attack", "spans": [ [ 19095, 5 ] ] }, { "id": "objectives/lateral-movement/exploit/scanner::file-inclusion-probe-payload", "atk": "T1210", "conf": 0.9, "crit": 3, "desc": "Local-file inclusion probe payload", "spans": [ [ 2274, 11 ] ] }, { "id": "objectives/supply-chain/hidden-payload/staging::build-hook-absolute-temp-marker", "atk": "T1195.002,T1027,T1105", "conf": 0.9, "crit": 3, "desc": "References an absolute temporary path", "spans": [ [ 16146, 26 ], [ 16663, 34 ], [ 24493, 69 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/communications/http/authorization-header::auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Authorization header-name literal", "spans": [ [ 20782, 13 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 22616, 32 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 15339, 20 ] ] }, { "id": "micro-behaviors/communications/http/request/credentials::python-credentialed-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python credentialed HTTP URL", "spans": [ [ 20192, 31 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Flask framework import", "spans": [ [ 742, 23 ] ] }, { "id": "micro-behaviors/communications/http/server/request::extract-from-request-json", "conf": 0.8, "crit": 3, "desc": "Extract data from JSON request body", "spans": [ [ 12717, 12 ] ] }, { "id": "micro-behaviors/communications/http/server/request::extract-from-request-query", "conf": 0.8, "crit": 3, "desc": "Extracts a request query field", "spans": [ [ 11111, 16 ] ] }, { "id": "micro-behaviors/communications/http/server/request::http-post-endpoint", "conf": 0.8, "crit": 3, "desc": "HTTP POST method handler", "spans": [ [ 12581, 10 ] ] }, { "id": "micro-behaviors/communications/http/server/request::python-route-post-method", "conf": 0.9, "crit": 3, "desc": "Python route declares POST method", "spans": [ [ 8962, 42 ] ] }, { "id": "micro-behaviors/communications/http/url/build::python-fstring-url-host", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "URL f-string from host", "spans": [ [ 14045, 16 ] ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "spans": [ [ 22493, 16 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::python-md5-digest", "conf": 0.9, "crit": 3, "desc": "Computes an MD5 digest in Python", "spans": [ [ 1340, 11 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-hexdigest", "conf": 0.9, "crit": 3, "desc": "Computes a SHA-256 hex digest in Python", "spans": [ [ 9383, 56 ] ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-api-reference", "mbc": "C0029", "conf": 0.9, "crit": 3, "desc": "References an HMAC API", "spans": [ [ 21157, 8 ] ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-new", "conf": 0.9, "crit": 3, "desc": "Python hmac.new operation", "spans": [ [ 21157, 8 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-create-table", "conf": 0.5, "crit": 3, "desc": "SQL CREATE TABLE syntax reference", "spans": [ [ 5344, 20 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "conf": 0.8, "crit": 3, "desc": "Contains an SQL INSERT statement", "spans": [ [ 5969, 24 ], [ 6517, 24 ], [ 6684, 23 ], [ 7039, 27 ], [ 9497, 27 ], [ 12829, 22 ], [ 14722, 23 ], [ 17058, 19 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6, "crit": 3, "desc": "SQL SELECT syntax reference", "spans": [ [ 9214, 19 ], [ 11171, 31 ], [ 11809, 25 ], [ 13120, 24 ], [ 13402, 18 ] ] }, { "id": "micro-behaviors/data/db/sqlite::python-sqlite3-import", "conf": 0.95, "crit": 3, "desc": "Imports Python SQLite database module", "spans": [ [ 661, 7 ] ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "spans": [ [ 20836, 6 ] ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "spans": [ [ 7676, 6 ] ] }, { "id": "micro-behaviors/data/manipulation::string-replace-result-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns a string replace result", "spans": [ [ 16054, 15 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "spans": [ [ 2568, 10 ] ] }, { "id": "micro-behaviors/fs/file/open::write-append-create-mode", "conf": 0.85, "crit": 3, "desc": "Python file opened for write or append", "spans": [ [ 3465, 22 ] ] }, { "id": "micro-behaviors/os/env/read::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "spans": [ [ 817, 14 ] ] }, { "id": "micro-behaviors/process/create/shell-subprocess::shell-true", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.7, "crit": 3, "desc": "Subprocess call enables shell parsing", "spans": [ [ 21895, 75 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 676, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 21895, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-shell-cwd-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Subprocess sets shell or working directory", "spans": [ [ 21895, 75 ] ] }, { "id": "micro-behaviors/process/create/thread::python-thread-create", "conf": 0.65, "crit": 3, "desc": "Creates a thread in Python", "spans": [ [ 24198, 8 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 17 ], "spans": [ [ 15350, 8 ] ] }, { "id": "metadata/package/testing/corpus::injection-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple injection attack-category labels", "uses": [ 34, 36 ], "spans": [ [ 11034, 4 ], [ 12252, 3 ] ] }, { "id": "metadata/package/testing/corpus::server-attack-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple server-side attack-category labels", "uses": [ 33, 35 ], "spans": [ [ 369, 4 ], [ 19195, 3 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::requests-response-body-access", "conf": 0.9, "crit": 3, "desc": "Reads a requests response body", "uses": [ 38, 93 ], "spans": [ [ 15339, 20 ], [ 15489, 1 ], [ 15491, 4 ] ] }, { "id": "micro-behaviors/communications/http/request/client::url-literal", "conf": 0.8, "crit": 3, "desc": "Uses a literal URL in an HTTP request", "uses": [ 45 ], "spans": [ [ 22485, 15 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-framework", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 3, "desc": "Flask web framework usage", "uses": [ 47, 95 ], "spans": [ [ 742, 23 ], [ 8963, 44 ] ] }, { "id": "micro-behaviors/communications/http/server/request::http-post-method-handler", "conf": 0.9, "crit": 3, "desc": "HTTP POST method handler variant", "uses": [ 98, 99 ], "spans": [ [ 8962, 42 ], [ 12581, 10 ] ] }, { "id": "micro-behaviors/communications/http/server/request::http-request-input", "conf": 0.9, "crit": 3, "desc": "HTTP handler reads request input", "uses": [ 49, 96, 97 ], "spans": [ [ 9101, 16 ], [ 11111, 16 ], [ 12717, 12 ] ] }, { "id": "micro-behaviors/communications/http/url/build::python-fstring-url", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "URL constructed with f-string variable", "uses": [ 100 ], "spans": [ [ 14045, 16 ] ] }, { "id": "micro-behaviors/fs/read/file/full::file-content-read-operation", "conf": 0.82, "crit": 2, "desc": "File content read operation", "uses": [ 76 ], "spans": [ [ 2579, 0 ] ] }, { "id": "micro-behaviors/process/create/channel-agent::ai-agent-message-receive-operation", "atk": "T1059", "mbc": "B0022", "conf": 0.86, "crit": 1, "desc": "Agent receives chat commands", "uses": [ 53 ], "spans": [ [ 15010, 0 ] ] }, { "id": "objectives/execution/interpreter/cmd/injection::python-web-request-shell-execution", "atk": "T1059.006,T1190", "mbc": "B0024", "conf": 0.99, "crit": 5, "desc": "Web endpoint executes request command via shell", "uses": [ 116, 127, 128 ], "spans": [ [ 20640, 10 ], [ 21842, 12 ], [ 21895, 75 ] ] }, { "id": "objectives/supply-chain/hidden-payload/imports::crypto-network-imports", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "Cryptography with network capability", "uses": [ 6, 7, 121 ], "spans": [ [ 614, 7 ], [ 15350, 8 ], [ 20854, 4 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 125 ], "spans": [ [ 22485, 15 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::server-python", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python HTTP server", "uses": [ 126 ], "spans": [ [ 742, 23 ], [ 8963, 44 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-keywords", "conf": 0.5, "crit": 3, "desc": "Contains several SQL statement types", "uses": [ 106, 107, 108 ], "spans": [ [ 5344, 20 ], [ 5969, 24 ], [ 6517, 24 ], [ 6684, 23 ], [ 7039, 27 ], [ 9214, 19 ], [ 9497, 27 ], [ 11171, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "uses": [ 64 ], "spans": [ [ 20951, 24 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 118 ], "spans": [ [ 21881, 29 ], [ 21895, 14 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 138 ], "spans": [ [ 21881, 29 ], [ 21895, 14 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 138 ], "spans": [ [ 21881, 29 ], [ 21895, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call", "conf": 0.9, "crit": 1, "desc": "Process API invocation", "uses": [ 140 ], "spans": [ [ 21881, 0 ], [ 21895, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 138 ], "spans": [ [ 21881, 29 ], [ 21895, 14 ] ] } ], "type": "python" }, { "id": 30, "mol": "O(Co)H₄(Cm₃Cr₂OsPo)", "sha": "202f5291dee44e0dbc7fc343977455ab0db3e650582516d22c1c58395bbfda94", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/citadel/internal.py", "risk": 5, "size": 3994, "type": "python", "depth": 1 }, { "id": 31, "mol": "O(Co)H₂(Cm₂Db)", "sha": "95ae79a90ed4072d4ef5d919dec5b417dc64265f0a3ff93e007c5d5149438076", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/cloud_iam_lab/app.py", "risk": 5, "size": 1954, "type": "python", "depth": 1 }, { "id": 32, "mol": "H₆(Cm₁₀CrDb₄FOs₂Po₃)", "sha": "d32be81831e10838f36557f11e13218116a071619ff6e3011b64d2b1aec81d6a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/devops_dashboard/app.py", "risk": 11, "size": 15075, "type": "python", "depth": 1 }, { "id": 33, "mol": "H₅(Cm₆DbF₂Os₂Po₂)", "sha": "1929ea5f83b9ddd7f6060a90f8c5053b0cf842dad2b28adeb5c81d5d691552ea", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/app.py", "risk": 8, "size": 8610, "type": "python", "depth": 1 }, { "id": 34, "mol": "H₂(Cr₂Db₃)", "sha": "3cebec7e839e614095c8c6a49f0ebd238f044ae639fb974fb4d4a9ca23a89a69", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/auth.py", "risk": 4, "size": 2434, "type": "python", "depth": 1 }, { "id": 35, "mol": "O(Co)H₃(Cm₂CrF)", "sha": "724a548d92f057d5b2dc0fc8c6a03302681d5724df97d1e68e122500eb94f05e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/data_seed.py", "risk": 4, "size": 4663, "type": "python", "depth": 1 }, { "id": 36, "mol": "H(Db)", "sha": "ff31e99d74b298c6b73d1e34ac58492a35f032d88e769058c18c6a1984163be7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/defenses.py", "risk": 2, "size": 3751, "type": "python", "depth": 1 }, { "id": 37, "mol": "H₂(DbOs)", "sha": "3f86ded7cc6bebf4f4b5d12b42356e5edbd7ee029c0e6569a823bd7a2986b4fe", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/events.py", "risk": 3, "size": 2659, "type": "python", "depth": 1 }, { "id": 38, "mol": "H₂(Cm₂Cr)", "sha": "3eb399b5b29ca1bda8c365bd29821c9dd8137d77ccbbfe87fd6f8416c0c67164", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/internal.py", "risk": 2, "size": 4375, "type": "python", "depth": 1 }, { "ctx": [ { "b": "vruj3xcqqmyH}xmazbU5xkIi$BAn#Qv@Dj3vqYQcx(mV%v@#B6zxJF3v@=\u003clBz(gL3joZNvp%c]g==+3xK@rdz!\u0026{4ayYe9vJYPbaARpdazC.nwPzV%y-)[fB.(dxA=l8xwGUYdaz2C2A^qRCwN)\u003eBBzbj)wmYm\u003eD2N\u003ezAV!}hwn(E3zGE1nzGGDgAbPM3By/IoBzbkdBA.TCyH}=lw].r)zdNQbB0bgmBz?", "ln": 25, "col": 26, "line": 1 }, { "b": "Byxo5azC)tvR*f#cVZzCx(4Pdy?m^3AXmXya%Ev3w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGuc(x(d*cA=-BBwN/:(BAm!6ze:AlBrCTEvSlvav}x.53tBu@z/P}xBzbYavpT7\u0026x9@u\u0026AbP=saARsmwEn=RA=k!qwP?T5BAnNsze:AlBrCdix(\u003cW?qCQmTr7gd=pe\u003cUWrZxz4jS(EpasXG(fD.F.atC.@ze0)gBy/I2uU\u003cT\u003cyAL+.BzbYavpT7\u0026xd=\u003e@v@0Fw3sv\u003c@vru66jS]7}Bz\u003e@azx.a:a%FMXb58atB.b8\u003cvrrXOattA4efDcHwO#71vruj4zx.a:fNTon3s)ZWayw#1zGEoQat2=1ph+2YiTM#LarU3jByxo5toXfcyH}xct{8oMb1tl(m%/t\u003ewNxa+y\u00260D5as!NQwN/:(BAo6Rz!\u0026{4uUB1}c]-T#d\u003cc3:a{]CnarU3jByxo5toW^5B9h58uTX42t{8oMBzkP6e{7/AwHF#marR^HuVQr$By!V2xjU%(A::67z/c+8as/O$f:Xl{wmYu}v%8*jwO#P%Bz\u003e@azyu}ReJ$p#BAfzHarR^HCwhejayw@6v@1ajarR^HarR^Hx\u003ewG9z/^aeB97\u0026jwM{v2z!\u0026{4b3=sfAV/ErzdLtwx(dAfdiHh+uVQr$By!V2x(!urwN]dRBrU0kk0p2^pGfRVmpeRYr7fX=k$\u003crD", "ln": 374, "col": 21, "line": 7 }, { "b": "wO@RNjS[lSAW-BAarR^HA+funA=91Db6Eyhx\u003eezGaARKqwO@RNjS[lSAX5sSxjU%(A::67z/c:Wayxhivru6+b4\u003eF8wPzj3x(v(ku404!3s)ZWaz2C2A^qRCuT^?\u0026vKJVFeJ$p#BAfzHarR^Ha%FjgxK@q}y\u0026r=9B7GxnwN({4zxK4mwGUY8By/GgvqE6fvrDydaAzyyBy=Nyw)]E^ay/b8xK#ibCxdbhAaK5j\u0026^^m2arR^HBzbkdcUmg9A^qRCx(v(pazC)tA+frgy\u003c6x2aAIamC4CXCB7]e@ayYQsBzbkdwmYm\u003eD2N\u003ezAW-Q+a%EvparR!Gz!*EUay/LmA+fcguVZj4wO@[B3lQDlaAz4nB-Ivxw*f=qoIwFMrzlu", "ln": 1466, "col": 44, "line": 48 }, { "b": "uR\u003cS?mOcY8jS\u003e}tnLz/JmoIisk#HVGa{[U:wmYu}wmYm\u003eD2N\u003cNw].r)zdNQbuTU#rB98BNazbU5xkIi$ByeGraAITBdlm!UarR^Ja%GGIl038\u0026w].r)zdNQbB0bgmBy/E", "ln": 1867, "col": 11, "line": 60 }, { "b": "e^.}darR!8wPS6nzGu{Gz!*)Dz/{evB-Y5+aw3D=wN/*@z/cXpvr(WcvpTB4Bzb98ay/tbzddr)ePV5zB98brB-.gqz/MgcarR!pxKLQ)ay/tbzddr)B0b4nv{%s/aARpdaz24@zY\u0026FawftY1vqv0cxK@rdz!\u0026{4e*qF-3lQDlazCBgzF%Rtc\u003c?7tarR^HarU-EAWUKuvp%B*zGGk]aA8oya%FD*B97\u0026hBAqUuBz96(qB9/Emnu/?l0)C^mmG\u003cJdiJ5pwb", "ln": 2091, "col": 72, "line": 65 }, { "b": "az2z7BsntRvrDyduU0.TA^qRCa$K\u003cPyDUTqB.99DwmY\u003c\u003ex(2{RwmYm\u003eD2N\u003ezAV/7lC5IecwfJDfarR^Hv@k:0jS[tXwN/y(asy@oC%cH^A:-P$wO#P%vso.Ow].r)zdNQbuT!Bha{]CnarU=DC@=oParR^HarR!BB-X-?aAIWmAb](bwPI]BA=(mFtoU.fx(kOBxD!#Ia$WpGefFCtwl*-ev{%s#B-I52z/{evB-Y=CA=\u003e}AaARgtBuJPzB.99DBzkP6z/{d+h7n\u003eParR^HarR!oy\u0026r=9jS[rNv@=\u003clByeG[z^\u003eaz3lQDlarR^HaAz4nB-Ivxrc0a)efF\u003eNBs}SRwn=Qje]#bPx(CEHas!MUtYaZ[B.(dKvR/%(iV]Q?d\u003ceqqz^\u003c4@arR!rCW\u003er7BrB1%v}xR3x(v(ivriM5iV]K\u0026az#aqvlbI$oHQS?f^bFaLPT^JvJY-mA+n-\u0026wH[%nA=M8sB0a[iwGUI(BytI0arR^HarR!EwPS6nzxIzSy\u0026:esaz8*dwN/+aAcc2saz2Olz/N(", "ln": 2493, "col": 4, "line": 74 } ], "depth": 1, "facts": { "imp": [ [ "", "threading.Lock" ], [ "", "secrets.token_hex" ], [ "", "time.time" ], [ "", "time.time" ], [ "", "_mint" ], [ "", "emit" ], [ "", "_mint" ], [ "", "emit" ], [ "", "current_token" ], [ "", "emit" ], [ "", "str" ], [ "", "current_token" ], [ "", "len" ], [ "", "str.startswith" ], [ "", "str" ], [ "", "str.startswith" ], [ "", "str" ], [ "", "emit" ], [ "", "emit" ], [ "", "subprocess.run" ], [ "", "encrypt_blob" ], [ "", "out.stdout.strip" ], [ "events", "emit" ], [ "", "events" ], [ "", "secrets" ], [ "", "subprocess" ], [ "", "threading" ], [ "", "time" ] ], "mbr": [ "_state.generation", "_state.issued_at", "_state.token", "out.stdout", "out.stdout.strip", "secrets.token_hex", "str.startswith", "subprocess.run", "threading.Lock", "time.time" ], "tgt": [ "_mint", "current_token", "emit", "encrypt_blob", "len", "out.stdout.strip", "secrets.token_hex", "str", "str.startswith", "subprocess.run", "threading.Lock", "time.time" ], "funcs": [ [ "_mint", 655 ], [ "current_token", 814 ], [ "force_rotate", 1086 ], [ "validate", 1363 ], [ "encrypt_blob", 1551 ], [ "decrypt", 1895 ] ], "metrics": { "ast": { "op.add": 6, "op.lor": 3, "op.mul": 1, "op.sub": 2, "op.land": 1, "max_depth": 13, "call_count": 22, "node_count": 760, "member_count": 10, "max_array_len": 3, "op_density.add": 0.01, "op_density.lor": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.land": 0, "max_concat_chain": 3, "member_depth_max": 3 }, "file": { "size": 2926, "entropy": 4.94 }, "text": { "lines": 81, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.01, "space_count": 484, "char_entropy": 4.94, "unique_chars": 81, "top_char_null": 0, "string_density": 0.54, "top_char_ratio": 0.08, "avg_line_length": 35.12, "max_line_length": 115, "non_ascii_ratio": 0, "empty_line_ratio": 0.25, "last_line_length": 45, "whitespace_ratio": 0.19, "identifier_density": 1.33, "line_length_stddev": 30.3, "normalized_string_count": 4.89, "repeated_char_sequences": 2, "suspicious_string_ratio": 0.05, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 7.26 }, "binds": { "count": 14 }, "binary": { "peak_region_bytes": 2926, "peak_region_entropy": 4.93 }, "source": { "function_count": 6 }, "imports": { "count": 6, "stdlib_count": 3, "stdlib_ratio": 0.5, "third_party_count": 3, "third_party_ratio": 0.5 }, "strings": { "sql": 1, "bytes": 1294, "count": 44, "shell": 1, "avg_length": 29.41, "max_length": 402, "path_count": 1, "avg_entropy": 3.05, "empty_count": 3, "entropy_stddev": 0.88 }, "comments": { "chars": 76, "count": 3, "lines": 3, "to_code_ratio": 0.04 }, "functions": { "count": 6, "density": 7.41, "avg_params": 0.67, "code_ratio": 0.54, "max_params": 2, "length_stddev": 5.28, "avg_name_length": 9.5, "no_params_count": 3, "avg_length_lines": 7.33, "max_length_lines": 19, "min_length_lines": 4, "avg_param_name_length": 7.75 }, "identifiers": { "count": 108, "unique": 46, "avg_length": 7.07, "max_length": 17, "min_length": 1, "avg_entropy": 2.36, "reuse_ratio": 0.43, "length_stddev": 4, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.02, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.89, "all_uppercase_ratio": 0.07, "underscore_prefix_count": 3 } } }, "id": 39, "mol": "K(Te)O(Xe)H(Po₅)Md(In)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/hill_ctf/vault.py", "pid": 0, "risk": 6, "sha": "a8464e05dd8615d05d22266f3180e3fd7e3382d30d77e627b1b7e76479fea2b4", "size": 2926, "traits": [ { "id": "metadata/import/python/events/emit::emit", "conf": 0.95, "crit": 2, "desc": "imports emit from events", "spans": [ [ 524, 0 ] ] }, { "id": "metadata/import/python/events::events", "conf": 0.95, "crit": 2, "desc": "imports events", "spans": [ [ 510, 0 ] ] }, { "id": "metadata/import/python/secrets::secrets", "conf": 0.95, "crit": 2, "desc": "imports secrets", "spans": [ [ 449, 0 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 464, 10 ] ] }, { "id": "metadata/import/python/threading::threading", "conf": 0.95, "crit": 2, "desc": "imports threading", "spans": [ [ 482, 0 ] ] }, { "id": "metadata/import/python/time::time", "conf": 0.95, "crit": 2, "desc": "imports time", "spans": [ [ 499, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 88, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2201, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2139, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 846, 0 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::cipher-keyword", "conf": 0.4, "crit": 2, "desc": "Generic 'cipher' crypto term", "spans": [ [ 1635, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::broad-exception-bound-catch", "atk": "T1027", "mbc": "C0027", "conf": 0.8, "crit": 1, "desc": "Catches broad Exception into a variable", "spans": [ [ 2808, 0 ] ] }, { "id": "micro-behaviors/data/db/config::db-key-secret", "conf": 0.85, "crit": 1, "desc": "Connection secret key", "spans": [ [ 2571, 0 ] ] }, { "id": "micro-behaviors/process/create/construction::string-assign", "conf": 0.6, "crit": 2, "desc": "Assigns a command-like string to a variable", "spans": [ [ 2557, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stdout-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stdout stream", "spans": [ [ 2763, 6 ] ] }, { "id": "objectives/execution/exploit/deserialization::command-payload-option", "atk": "T1190,T1203", "mbc": "E1203", "conf": 0.98, "crit": 3, "desc": "Payload generator command option", "spans": [ [ 2653, 9 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 464, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 2626, 14 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "spans": [ [ 2643, 7 ] ] }, { "id": "micro-behaviors/process/create/construction::command-spreading", "conf": 0.85, "crit": 3, "desc": "Command spreading (String construction +)", "uses": [ 13 ], "spans": [ [ 2557, 3 ], [ 2563, 39 ], [ 2612, 29 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encryption-algorithm-keyword", "conf": 0.5, "crit": 3, "desc": "Encryption algorithm keyword", "uses": [ 10 ], "spans": [ [ 1635, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 18 ], "spans": [ [ 2612, 29 ], [ 2626, 14 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 22 ], "spans": [ [ 2612, 29 ], [ 2626, 14 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 22 ], "spans": [ [ 2612, 29 ], [ 2626, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call", "conf": 0.9, "crit": 1, "desc": "Process API invocation", "uses": [ 24 ], "spans": [ [ 2612, 0 ], [ 2626, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 22 ], "spans": [ [ 2612, 29 ], [ 2626, 14 ] ] } ], "type": "python" }, { "id": 40, "mol": "O(Co)H₄(Cm₂DbFOs)", "sha": "f50225b27fd4dcf929a016053a60c99c623bdf17d2e5d8c94e2ce18d96b652c5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/log4shell_lab/app.py", "risk": 6, "size": 5737, "type": "python", "depth": 1 }, { "id": 41, "mol": "O(Co)H₃(Cm₇Db₂Os)Md(Pa)", "sha": "251068cf46b7f319da183ede53e1269e919cb9ea469cda64bf43ad95a923e001", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/oauth_lab/app.py", "risk": 6, "size": 8959, "type": "python", "depth": 1 }, { "id": 42, "mol": "O(Co)H₄(Cm₅Db₃FOs)", "sha": "484f048c8a75c6fa0e769649e2bfc943c3fe11ad11a1053d2cb6d0bc3e2830e7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/lab/wordpress_lab/app.py", "risk": 6, "size": 9859, "type": "python", "depth": 1 }, { "id": 43, "sha": "dc18c9b90ce6fe65b6bc6598d5e91b173a1468c1ebc5d481b4b760c2564e8197", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/__init__.py", "risk": 1, "size": 1556, "type": "python", "depth": 1 }, { "id": 44, "mol": "H₄(DbFOsPo)", "sha": "59ab55f7d6c0ccc0612d62ebc1e1200c2112ef2279ca4b0ac8c262ea76e2dc37", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/loader.py", "risk": 4, "size": 8201, "type": "python", "depth": 1 }, { "id": 45, "mol": "H₄(DbF₂OsPo₄)", "sha": "43765bb1289cba7cb46153a57396eb0874b4ebaf88c16e039bdbb09fa08472d0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/manager.py", "risk": 6, "size": 7324, "type": "python", "depth": 1 }, { "id": 47, "mol": "H₄(Cm₆Cr₂Db₄F₂)", "sha": "250dfcd9f4e7295532c580cbd9069afbc8c03f602cf191843e7f7ff30ad61d06", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/marketplace.py", "risk": 7, "size": 5690, "type": "python", "depth": 1 }, { "id": 48, "mol": "K(Te)H₃(DbF₂Os)", "sha": "e1d361e88627e810c87c68020f012880d47b023e9a14ca80563f71ea1ee6a06e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/pack_converter.py", "risk": 5, "size": 7575, "type": "python", "depth": 1 }, { "id": 50, "mol": "H(Os)", "sha": "0f34509c7193b6d970527692258fa0bc262307680ce9bf9d4c52a51769e57f22", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/addons/entry.py", "risk": 2, "size": 4535, "type": "python", "depth": 1 }, { "id": 53, "mol": "O(Ca)H₂(DbOs)", "sha": "5cda8a85d74469707e1aa892c1d172d7e7a5cc0c84c157f5501338dc8111dfc0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/adenum/entry.py", "risk": 4, "size": 2286, "type": "python", "depth": 1 }, { "ctx": [ { "b": "ay/tjzGErW3qLI-iV@DOvqE5Lq.p)op-%^%vrlK8zF77um}D^qp/RNFA=SVXawlo^vR6N#vrlK8zF77um}D^xB7Gw\u003cp!(6XedbrIllHt.vrb{4wO#TcwPzj3x(v(uayPd#awtf?p-%[4wPw]mwNPQ?xDVq+LPTKCv}V#[azkn6B.L-8azCXivpK7:Bp98ivSlvav}x.5azC.pz!0i$x(v(iCwhejaAg+fB7F(8z/{evB-YkUpiyw?ePUGAB7]Mgay/7@v@0icwPRu{zE)t=vriMkxK@q@xK$Q\u003eazbtdB95KCBy/zz3l*Vr3jpG:AbP=saAz32x(d*cA=-BBBZ/rgz!0v1A%-mYr7P!MpGpvpjS(Tp3jmbJwO95(A=(mFvrc17efG4GzdNTdBuJ#gnLISHrA7zd3lQDlar\u00260NqGV\u003e1vixSlvSlvav}x.5efF$ABAIRwasIqMwn=QjefG1QwmY!4efF$ABAIRwv@C)?dj#!*a{]CnarU=DC@=oParR^HarR!EauZ\u0026*BZ/rgz!0v1B1RGQzyw}lxlC*Gv{%s#B-I52z/{evB-Y=CA=\u003e}AaARgtBuJPzB.99DBzkP6z/{d+BzkP6z/{dJ3lQDlarR^HaAz4nB-IvxAXqAPwn=QjaA8oya%FMXAXqAPwmY!4aA8oya%FMXAXqxzBAIRwv@C)?3lQDlaz2!cwPh-lmRI", "ln": 127, "col": 59, "line": 3 }, { "b": "wPS6nzxHbEefFKGzF%Rtx(n0lvqG:\u003ewi7\u0026Wvrc17tqfuha$K\u0026*f:Y3CarUluv}xR3aAIWmAb](bwPI]Brb3hXz/{d\u003cCYmwqwN)?earR^HarR^HA+funA=90za$K\u003cGb6mKowN({4B-X-ODVS$swP8ZkErc?YefDJ03jmbJwO95[wm6j%y\u00260E1wPI{bz/c$lv(+-NBAeG!ar\u00260Uat2=1B98B-3lQDlar\u00260NqfuO.yANb2wN/HpazC)tBzbkdl{\u0026tyawq", "ln": 711, "col": 10, "line": 22 }, { "b": "aAz4kB.L(cwfIv6arR!nA+xLrjS)@oarR^HarR^Hb5?*HxM4=Aa$K6zarR^HarR^JeN]$Q3lQDlarR^Haz8*ize:AlBrCTyv@2T$j99Maz!0M]Bs}6zwNPW(uT[1(zE)s1x(v(qc)%vLv\u003eI?AA+PFvdsAM{gDmxzehX\u003erB1Q%sz/YFrdlzG?x(n2vcRM]]p*W0{mntiVa$K6zarR!j3lQDlaA8yAefFIAAX5tNv\u003c0]SuVHpbc$ddeB$s+Tx(dB1B-Y=3fEWtKarR!vw/@o\u003el{TTRpF:FPa%pPqaA8yA", "ln": 975, "col": 26, "line": 30 }, { "b": "B8@DQB-RbmB7Pc5wGT9TB7Gxkj{\u0026zParTM[BAIRwB0bd8B7=Xjx(mH6ay/C2v@2HZy?j-cw[C\u003c[zE\u003c}sxKL%}v{%E4eO#Q+i5ifwdj#!*a{]CnarUxgaz#atay[$y3lQDlarR^HaAz4nB-Ivxb1lJ)z/N(YwmD:5wPq\u003cbA+e=7c$WyrzddJEay]zcvqfQiv@Dibz/M$yB7GwSwn=r[x(kLkz/3{E3lQDlayPq6B%5{\u003ctoVNGBwtUjB7Gxke]V7WefFFke]#bPx(CEHefDb*zF}aCvrlGlefDb*w]zZbvrrXAar\u003eGcB7/5(BrT#$arR^Hx\u003ewGgB7GxkiTM#L", "ln": 1561, "col": 45, "line": 45 }, { "b": "3lQDlarR^HaAz4nB-Ivxb1lJ)z/N(Yx(d/$v@2T$az#atazC.mByx04wN(]iAa%nlx(n0lvqG:5x(d/$v@2T$diY9warR!vw/#b7ar-(\u003cfGGK-arR^HarR!ux(n2njS\u003e}UxK$W?iV{*TaAz44v}YpWy?k*NB-Rbmaz++kBrC:ny?WAAay/C6wmYU2x\u003c\u003e?0aA?e", "ln": 1946, "col": 44, "line": 53 }, { "b": "v)bfVv%{xXDU4kre]#bPx(CEHtrjF@fKo8Hd0]SwzGHpQa{]CnarR)KwQ5rqvpKy4xKL%}az++fwPF$xbX}BfhdpMDwPe[Ee?ONWarR^HxKL%}wPF$Sax@V1azbLjaz+{rx(k5iB-YlSAbolgy?W=#B0@EWx\u003ewFibX}BfhdpMDwPe[sazCZoy\u0026iI=arR^Hx\u003ewG3vrl9[B2\u003cTJarR^HarR!EwPS6nzxHtmarR^HarR^HarR^Hw*fJteMb2laAzyeB97\u00261y?j.$v}fC1zGG}", "ln": 2143, "col": 37, "line": 57 }, { "b": "vrl9[B6yWWfKlamarR^HarR^HarR^Hd\u003cc3vzEWY}v@1aFxKL%}v{%E4eO#Q+i5ifwazth8xK#lqBA?)ICw?Ijy?W%je{8tWa{]CnarR^HarS9uarR^HA+funA=91ib2i50k#PvkmnLaEz^^ZevpB4:ayO+\u0026z/]@tB0b7kB-7.jc#TlIAclm-aBw3HBs}SRA+PFvdo!?/h85r:diY9a3s)ZWayO!/yH}J}wPzY$B95*vv(+-NBAeG!ar\u00260XaA.:pAYLs:BAeG!ar\u00260XaAg+gB9zLywi7\u0026OBAeG!ar\u00260Uat2=1B98B-3lQDlar\u00260Noj-cMwPzY$B98blxf4eQwPq\u003c7B95K6p!\u0026cPx\u003e7{\u0026BAnNmA:-D[vpB4:aA7\u003e7y?W=#e^.}darR^}ADL#svqGH)BugKmwPQ{[wPyZCpie4bC{3Tozddc@flItEAYOeFB8#LzA+3pAwmEi9A3dnNv)h1!A+flkwPI@qa%EvparR!vw/$#fBrCa7aA8oyzF%RtB-RbmiTM#LarQ", "ln": 2408, "col": 26, "line": 63 }, { "b": "arUYoBAIRwaz8/^A=M8siV{}7Bx9x[A-k!fB0bHkj:RiVEl5G$wPz/zB98CpA40etiX-GCu40[7arR^HB8V2rauZ\u0026Ky\u0026gwcz/M$pzxJUhaA8yAe]$#Fx([f9zE)(qdiJtpar\u003c-Xp9H/{zxJ+kaA8oya%Z@AvL@muB0I}Lx(k5fzE0O(arR!uvrl9[B09Q*twOg1w]zYjy\u0026gwfzxJ\u003euBs}SNy?X0cx(mH6c[coMw/@oyyJr(wBz2Uua%pPqaz+}33lQDlazCBgxKL%}wPG)tarR^HarR^HA+funA=90F3lQDlarR^HarR^Haz8/\u003cwPzl\u003eA=g", "ln": 3141, "col": 7, "line": 80 }, { "b": "a$^RGx(ktuAbG-3iYgg(3lQDlarR^HarR^Has!MUtY7.)arR^HarR^HarR^Hd\u003cc3vzxZYFz!T8qxKL%}wPI6phc?TrarR^HarR^HarR^Hd\u003cc3vzEWY}v@1aFxKL%}v{%E4eO#Q+gCHNqaARscyH}Qee{8tWaA}:AwnC$3Bs}VWBrR5marR^HarR^Q3lQDlazCBgB8V2riTM#LarR^HarUYoBAIRwaz8/@p!\u0026cwv}fC1zGG}xw]z*fwfrpEy?mGjB8V2rdsATatY7-dd\u003cc3vzxZYFz!T8qB8V2rtrjF)t}3a6arR!EwPS6nzxJKnph.mNp!\u0026cPx\u003e7{\u0026BAnNBwPR%bwP?S}asIeJBz#wAiV@=/B-YlSBAh8mc[evYf/pT\u003c", "ln": 3457, "col": 18, "line": 86 }, { "b": "ePU=rv@b\u003c\u003czGE0My?W%jatkxYz/Z1yePbFUAa9*easIeGaA}KwxDQ/9wN]\u003ch3lQDlavf*+zY\u003cdxx\u003equdzE)]jC4\u003eJiayPslw)]H(vQS+Ze*qF-3lQDlazCBgzF%RtxM4%liTM#LarR^HarUYoBAIRwar\u003cl{A=k$VaztXmBrCQnADL#owN($(arR^HboR8GC{3*rAa9l(wPP5bx(Xop3lQDlayPq6B%5{\u003ctoW=#Aa9l(wPPIBzdm0\u003ex\u003eqg7", "ln": 3905, "col": 25, "line": 99 }, { "b": "tY7-ryhW*7d066gA+fq@iX-G$dgdguarR)Kw)]H(vQS+ZiV@GXvQ\u003cj*wO#PjeLDG]arR!nA+xLJauZ\u0026Kb6dQgv@b\u003c\u003czGE6Nar\u0026yha$K\u003cGa$\u003eP@xM4%le]#bPx(CEHEiHi+a$VLlt).X%arUPBBttx\u0026wPz/DefF$yg9w.5uVHpbc$ddeB$$GNarR^Hx\u003ewGdv\u003e]e\u0026jS(B3vqYP#z/{dSe]#bPx(CEHiTM#LarR^HarU-svrb}2auZ\u0026Ky\u0026g\u003eDBAh8mc[coJz/M$pzxJUhaA8yAga)S!y?X0cx(mH6c[coMw/@o=x(!5lazCZoy\u0026gwlAV=M5A+PAkwPw$qx(k5fzxJ\u003erar\u003cxNlN0T!zxJ+kt).X%arR^HarUYoBAIRwaz8/@o*P$zxKL{)B0bysaBv^uB98*Md0]=wzyt", "ln": 4371, "col": 62, "line": 108 }, { "b": "lM^^=zF%ArzeTMraA8oyB7]Ggy?j.#x(mDge^.}darR^}ADL#svqGH)BugKXwmoB#wNPQ?xDO)Kat3bby?c%[iXJc%v\u003c0vjay[$Bwn=r[x(kFjv)asuz6g@XB.bPsj%zf{3lQDlazCBgzF%RtwmEUcarR^HarR^HA+funA=90zmriA!AYLsNv\u003c2/6ADL#owN($(arR^HboQJdA+PYdayX=2wGTxoazbUjz6i}lwGUI[aztXmBz+J7wGU]iay]zcvqfP^arR^Hwn=r[x(mo%vrcEhauZ\u0026Tv\u003eI?AA+PFvdk2WXy?W#ta$+5*3lQDlazCBgy?mGjwb", "ln": 5091, "col": 31, "line": 121 }, { "b": "Aa9^eB15j}atC[:arR^HarR^HvQTs?uU13%jS\u003e}1a$^RGx(kthb4LgDDVjxSazbLjaAeDqzxJFdzddc@uVoB]BAn(rarR^HwO=B0iTM#LarR^HarUc4B7FY?zxI7+wmElkBAh8mc[bGCarR!nA+xLrjS)@My?c%[B7F^2v}W5qar\u0026yZa$K\u0026XeL46paz8*lwmk", "ln": 5358, "col": 19, "line": 128 }, { "b": "Byx04wN(#cx(k58A=KhFarR^HarR^HA+funA=90zmriA!AYLsVwmoB#wNPQ?xDRhhBrCpnB97\u0026by?mc1c$d7pazC.mByx04az+N%A4MiOx(4\u0026kfcB.AwP]nhzGx]dy?$kjAaJ{6wmoBaa{]CnarUxgaAy%maW3@4iTM#LarR^HarUYoBAIRwaz8/^A=M8siV@lHvq{p0vrb\u003c\u003eaAy%PDVARAiV@=XA=J^NBAh8mc[evYf!$B*EiG1varR^Kay/tjzGE1jzGG]kwPF%", "ln": 5671, "col": 29, "line": 136 }, { "b": "BrA$DA%:3jarUfjB-8pzjS[V=Bs}6wB-8pHb4LNLa$i\u003cwarR!qzGu{-ax@V1e]\u003eJxy***+c)AhtiV]Q$ar\u00260Ue]#bPx(CEHazbLjaz+{rx(k5iB-YlSAbolgy?W=#B0@EWx\u003ewG7zz30LvrcEhCwhejc)AhtiWc1U3lQDlaAz4nB-Ivxw*f]pk#nXBwNPQ?xA", "ln": 5894, "col": 29, "line": 140 }, { "b": "BAeG!ar\u00260Uat2=1B98B-3lQDlar\u00260NmS\u0026J-aveyrA+e:0zAn[TB.\u003e\u003eCB7GAlx(v(id\u003cdbReMb2las!Nko*P%Mawtf?p+A}oa{]CnarUPBBrAZ?tu}NUarR!BB-YlAz#", "ln": 6155, "col": 54, "line": 146 } ], "depth": 1, "facts": { "imp": [ [ "", "subprocess.run" ], [ "", "dc.strip" ], [ "", "_run" ], [ "", "err.strip" ], [ "", "dc.strip" ], [ "", "users.strip" ], [ "", "_run" ], [ "", "err.strip" ], [ "", "out.splitlines" ], [ "", "len" ], [ "", "out.strip" ], [ "", "user.strip" ], [ "", "_run" ], [ "", "err.strip" ], [ "", "out.splitlines" ], [ "", "out.splitlines" ], [ "", "len" ], [ "", "len" ], [ "", "out.strip" ], [ "", "host.strip" ], [ "", "_run" ], [ "", "out.strip" ], [ "", "ln.strip" ], [ "", "out.splitlines" ], [ "", "ln.strip" ], [ "", "ln.startswith" ], [ "", "len" ], [ "", "host.strip" ], [ "", "_run" ], [ "", "out2.strip" ], [ "", "ln.strip" ], [ "", "out2.splitlines" ], [ "", "len" ], [ "", "err.strip" ], [ "", "err2.strip" ], [ "", "dc.strip.split" ], [ "", "dc.strip" ], [ "", "len" ], [ "", "dc.strip" ], [ "", "dc.strip" ], [ "", "query.strip" ], [ "", "attrs.strip.split" ], [ "", "attrs.strip" ], [ "", "_run" ], [ "", "err.strip" ], [ "", "out.count" ], [ "", "ln.replace.strip" ], [ "", "ln.replace" ], [ "", "out.splitlines" ], [ "", "ln.startswith" ], [ "", "out.append" ], [ "", "out.append" ], [ "", "ad_null_session" ], [ "", "out.append" ], [ "", "out.append" ], [ "", "ad_asrep_roast" ], [ "", "out.append" ], [ "", "out.append" ], [ "", "ad_smb_shares" ], [ "", "dc.split" ], [ "", "out.append" ], [ "", "out.append" ], [ "", "ad_ldap_search" ], [ "", "out.append" ], [ "", "out.append" ], [ "", "ad_kerberoast" ], [ "", "re" ], [ "", "subprocess" ] ], "mbr": [ "attrs.strip", "attrs.strip.split", "dc.split", "dc.strip", "dc.strip.split", "err.strip", "err2.strip", "host.strip", "ln.replace", "ln.replace.strip", "ln.startswith", "ln.strip", "out.append", "out.count", "out.splitlines", "out.strip", "out2.splitlines", "out2.strip", "query.strip", "r.returncode", "r.stderr", "r.stdout", "subprocess.TimeoutExpired", "subprocess.run", "user.strip", "users.strip" ], "tgt": [ "_run", "ad_asrep_roast", "ad_kerberoast", "ad_ldap_search", "ad_null_session", "ad_smb_shares", "attrs.strip", "attrs.strip.split", "dc.split", "dc.strip", "dc.strip.split", "err.strip", "err2.strip", "host.strip", "len", "ln.replace", "ln.replace.strip", "ln.startswith", "ln.strip", "out.append", "out.count", "out.splitlines", "out.strip", "out2.splitlines", "out2.strip", "query.strip", "subprocess.run", "user.strip", "users.strip" ], "funcs": [ [ "_run", 422 ], [ "ad_null_session", 842 ], [ "ad_asrep_roast", 1387 ], [ "ad_kerberoast", 2577 ], [ "ad_smb_shares", 3767 ], [ "ad_ldap_search", 4968 ], [ "ad_full", 6102 ] ], "metrics": { "ast": { "op.add": 12, "op.lor": 8, "op.sub": 6, "op.land": 7, "max_depth": 15, "call_count": 75, "node_count": 2105, "member_count": 26, "max_array_len": 7, "op_density.add": 0.01, "op_density.lor": 0, "op_density.sub": 0, "op_density.land": 0, "max_concat_chain": 5, "member_depth_max": 3 }, "file": { "size": 6724, "entropy": 4.88 }, "text": { "lines": 160, "top_char": 114, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 1371, "char_entropy": 4.88, "unique_chars": 83, "top_char_null": 0, "escape_density": 0.01, "string_density": 0.71, "top_char_ratio": 0.06, "avg_line_length": 41.03, "max_line_length": 107, "non_ascii_ratio": 0, "empty_line_ratio": 0.13, "last_line_length": 25, "whitespace_ratio": 0.23, "identifier_density": 1.93, "line_length_stddev": 29.01, "unicode_escape_count": 1, "normalized_string_count": 9.01, "repeated_char_sequences": 8, "suspicious_string_ratio": 0.01, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 7.38 }, "binds": { "count": 22 }, "binary": { "peak_region_bytes": 6724, "peak_region_entropy": 4.87 }, "source": { "function_count": 7 }, "imports": { "count": 2, "stdlib_count": 2, "stdlib_ratio": 1 }, "strings": { "bytes": 3060, "count": 114, "avg_length": 26.84, "max_length": 373, "avg_entropy": 2.85, "email_count": 1, "empty_count": 17, "entropy_stddev": 1.57, "embedded_code_candidates": 1 }, "comments": { "chars": 152, "count": 5, "lines": 5, "to_code_ratio": 0.03 }, "functions": { "count": 7, "density": 4.38, "avg_params": 2.14, "code_ratio": 0.83, "max_params": 3, "length_stddev": 6.07, "avg_name_length": 11.43, "avg_length_lines": 19, "max_length_lines": 25, "min_length_lines": 9, "avg_param_name_length": 4.27 }, "identifiers": { "count": 309, "unique": 54, "avg_length": 6.41, "max_length": 17, "min_length": 1, "avg_entropy": 2.14, "reuse_ratio": 0.17, "length_stddev": 4.04, "has_digit_ratio": 0.07, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.04, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.87, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 4, "underscore_prefix_count": 2 } } }, "id": 54, "mol": "K(Te)O₂(Ca₂La)H₄(CmDb₂Os₂Po₅)Md(In)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/adenum/main.py", "pid": 0, "risk": 48, "sha": "3b5aad932e8b715f8a8163fbcf9b5ac037ef741ce227ad867e3d4876a277684a", "size": 6724, "traits": [ { "id": "metadata/import/python/re::re", "conf": 0.95, "crit": 2, "desc": "imports re", "spans": [ [ 384, 0 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 394, 10 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 350, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 228, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 2240, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 299, 0 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-create-connection-text", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python socket create_connection in text", "spans": [ [ 1058, 25 ] ] }, { "id": "micro-behaviors/data/db/config::db-key-user", "conf": 0.85, "crit": 1, "desc": "Connection user key", "spans": [ [ 2753, 0 ] ] }, { "id": "micro-behaviors/data/format/string::kerberos-asrep-hash-format", "conf": 0.96, "crit": 3, "desc": "Kerberos AS-REP hash artifact format", "spans": [ [ 2207, 11 ] ] }, { "id": "micro-behaviors/data/format/string::kerberos-tgs-hash-format", "conf": 0.96, "crit": 3, "desc": "Kerberos TGS hash artifact format", "spans": [ [ 3262, 9 ] ] }, { "id": "micro-behaviors/os/network/share::python-smbclient-no-password", "atk": "T1021.002", "conf": 0.94, "crit": 3, "desc": "Python invokes smbclient without password", "spans": [ [ 4435, 44 ] ] }, { "id": "micro-behaviors/os/network/share::python-smbclient-share-list", "atk": "T1021.002", "conf": 0.94, "crit": 3, "desc": "Python invokes smbclient share listing", "spans": [ [ 4435, 17 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::subprocess-timeout-expired-text", "conf": 0.88, "crit": 3, "desc": "Subprocess TimeoutExpired reference", "spans": [ [ 775, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--returncode", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (returncode)", "spans": [ [ 505, 10 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stderr-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stderr stream", "spans": [ [ 497, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stdout-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stdout stream", "spans": [ [ 489, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::stderr-string", "conf": 0.3, "crit": 2, "desc": "References the stderr stream name", "spans": [ [ 463, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name", "spans": [ [ 463, 0 ] ] }, { "id": "objectives/credential-access/cracking/cracker::hash-cracking-vocabulary", "conf": 0.9, "crit": 3, "desc": "Names hash cracking or wordlist attack", "spans": [ [ 1625, 7 ], [ 2472, 8 ] ] }, { "id": "objectives/credential-access/cracking/password::kerberos-spn-enumeration", "atk": "T1558.003", "conf": 0.9, "crit": 3, "desc": "Enumerates SPN service accounts", "spans": [ [ 191, 11 ] ] }, { "id": "objectives/lateral-movement/smb::ntlm-relay-ldap-target", "conf": 0.97, "crit": 3, "desc": "References an LDAP endpoint", "spans": [ [ 5155, 7 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "spans": [ [ 1042, 13 ] ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "spans": [ [ 2625, 13 ] ] }, { "id": "micro-behaviors/os/network/share::net-view-share-enum", "conf": 0.9, "crit": 3, "desc": "Enumerates network shares with net view", "spans": [ [ 3969, 8 ] ] }, { "id": "micro-behaviors/os/package-manager/install::apt-install-cmd", "conf": 0.75, "crit": 3, "desc": "Installs a package with apt", "spans": [ [ 5735, 23 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 394, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 542, 14 ] ] }, { "id": "objectives/credential-access/cracking/password::hashcat-kerberos-mode", "atk": "T1558.003", "conf": 0.97, "crit": 4, "desc": "Hashcat Kerberos cracking mode", "spans": [ [ 3553, 16 ] ] }, { "id": "objectives/credential-access/cracking/password::kerberos-spn-list", "atk": "T1558.003", "conf": 0.88, "crit": 3, "desc": "Maintains a list of Kerberos SPN targets", "spans": [ [ 3205, 8 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 27 ], "spans": [ [ 530, 27 ], [ 542, 14 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 30 ], "spans": [ [ 530, 27 ], [ 542, 14 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 30 ], "spans": [ [ 530, 27 ], [ 542, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call", "conf": 0.9, "crit": 1, "desc": "Process API invocation", "uses": [ 32 ], "spans": [ [ 530, 0 ], [ 542, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 30 ], "spans": [ [ 530, 27 ], [ 542, 14 ] ] } ], "type": "python" }, { "id": 58, "mol": "H(Po)", "sha": "819f97ebd2c6767af65204c21d15d6c322dc8e0a9d3f94f2d12551d20ba5eb6a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/__init__.py", "risk": 2, "size": 1216, "type": "python", "depth": 1 }, { "id": 60, "mol": "H(Po)", "sha": "d58cb4bb80104e2c87ae94932a1bcee624dd16388a7b9f849dcc06c6ebecef52", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/graph/__init__.py", "risk": 1, "size": 556, "type": "python", "depth": 1 }, { "id": 62, "mol": "H₂(Cm₂Db)", "sha": "dbc31fb6c3077fa1424b69c468ae419b3dcd329c9609bf370ef01052b93dd185", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/agent_graph.py", "risk": 3, "size": 28392, "type": "python", "depth": 1 }, { "id": 63, "mol": "H₂(DbF)", "sha": "b80b8b9cd83b0dc8119f8bfa6953794eb047d0512577f1dc3ad0b5ad92fbef65", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/attack_memory.py", "risk": 3, "size": 5525, "type": "python", "depth": 1 }, { "id": 65, "mol": "H₃(DbFPo)", "sha": "a082993488b33d9e5a440033b696fa1fd73b284257dec108d1c6e86250fb41e7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/critique.py", "risk": 4, "size": 8155, "type": "python", "depth": 1 }, { "id": 66, "mol": "H₂(DbPo)", "sha": "b5300b22dff98dcc0ad35de204db54951992f639efe203cd6e28b24bcebea1f6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/decompose.py", "risk": 3, "size": 4067, "type": "python", "depth": 1 }, { "id": 67, "mol": "H₂(DbF)", "sha": "6e8cb40c61e2dc1e29ece585a770d9f72cd90040a6374b874dd4c3444a56bba3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/engagement.py", "risk": 3, "size": 9070, "type": "python", "depth": 1 }, { "id": 69, "mol": "H(Db)", "sha": "6d4445b476e01011ec78137a8b07f1b867ce2a1141107d5784d5b3da497ebde0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/memory.py", "risk": 2, "size": 4142, "type": "python", "depth": 1 }, { "id": 70, "mol": "O(C)H(Db)", "sha": "fba7c59ab52e67ce3d3f1fb385a2b54fc2c47d7175e8f044bb909db04b304783", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/mode_governor.py", "risk": 2, "size": 12593, "type": "python", "depth": 1 }, { "id": 75, "mol": "O(Pr)H(F)", "sha": "bb6ead3ee56cbc7618ded52b615c783c94cd93112b130a8dfd61a8b20eeb145a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/supervisor.py", "risk": 3, "size": 37761, "type": "python", "depth": 1 }, { "id": 76, "mol": "H₂(CmDb)", "sha": "d079d1e54f56f8b58200cdf2e104bd3210c4d9e5a9cad49ae0262ce991aba22a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/target_board.py", "risk": 3, "size": 8398, "type": "python", "depth": 1 }, { "id": 77, "mol": "H₂(DbPo)", "sha": "a01f510cae9b1fce9449bd28f653d6ca35d74d90eb0435d1f2f559c1a175c2ba", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/verify.py", "risk": 2, "size": 8655, "type": "python", "depth": 1 }, { "id": 78, "mol": "H₃(CmDbF)Md", "sha": "5fc4a63f648bd02ae112f2f1541d4483cd891f77dfc367fbee65b7cb9f84590f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/weaponizer.py", "risk": 4, "size": 7264, "type": "python", "depth": 1 }, { "id": 80, "mol": "K(Am)H(Po₂)", "sha": "cf5962a17efaca3993442487693432f2054fc1b578cff41afc95788b1360a942", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/nodes/execute_tool_node.py", "risk": 3, "size": 12616, "type": "python", "depth": 1 }, { "id": 81, "mol": "H(Db)", "sha": "a0b086f4c731e6a9df1303b9e2b4e674ba0d716474e3590ccbf209d563fef4da", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/nodes/generate_response_node.py", "risk": 2, "size": 2969, "type": "python", "depth": 1 }, { "id": 83, "mol": "H(Os)", "sha": "fc709f1729b49191feade94409ea5747978b5b9bc0a567fa16da294d5fa5c823", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/nodes/subagent_node.py", "risk": 2, "size": 22902, "type": "python", "depth": 1 }, { "id": 84, "mol": "H(Db)", "sha": "909ac0f56b3614232e934075702c9b0901e7f09d6f70a4ffdea3f3e234740d0b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/nodes/think_node.py", "risk": 2, "size": 37961, "type": "python", "depth": 1 }, { "id": 86, "mol": "K(Te)H₄(DbFOsPo)", "sha": "cd43c08ff60aec17c82158236b9f421f0dbaf04945c26b63aa07533d2f6b1f25", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/prompts/base.py", "risk": 6, "size": 23915, "type": "python", "depth": 1 }, { "id": 87, "mol": "H₂(Os₂Po)", "sha": "82024ddd5a47458e953b517984317d6d6d519e741793a5a52fc0603b73772f82", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/prompts/blue_system.py", "risk": 4, "size": 9792, "type": "python", "depth": 1 }, { "id": 88, "mol": "K(Te₂)H₂(CmF)", "sha": "a33d0d490442dc2f0dff4d619c7e2b48428b81117d39047555383ec8f0fb16a5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/prompts/tool_registry.py", "risk": 39, "size": 32957, "type": "python", "depth": 1 }, { "id": 90, "mol": "H₂(Cm₂Db)", "sha": "a46d8a3f309ed5b439a4bd6f912e8dd2b596acec908080b3d4c84dce7f8448dd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/access_control.py", "risk": 3, "size": 3454, "type": "python", "depth": 1 }, { "id": 96, "mol": "H(Cm)", "sha": "d44bedf42386f40a1a2eb0445601baa9c32d6046c9355da5f18bdbe7fcc33e82", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/cache_poisoning.py", "risk": 2, "size": 832, "type": "python", "depth": 1 }, { "id": 97, "sha": "b4995ffc9b5accb0d5509d951b1cc37cb73cbeda164d701fc440ee10576806ef", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/clickjacking.py", "risk": 1, "size": 1103, "type": "python", "depth": 1 }, { "ctx": [ { "b": "AaHdTBAy@3yAML\u003ex(4Pdp\u0026ZF\u003eAc9Yta%Fir3pvP:r6:8Jmn^FYq:S\u0026Empe$^nLz/+p/p7-p/FM2ar\u00260N3l{=rk#Z/HlRwL2og./JiV{^=pe\u003cIJpdn56mn(Mtp^\u003eY#bo[AQo*IJxk#ZSTsS*^wqCfFMpGE(gbo[ATax8ldp-}FNavFT$mmg2%lR*DRk$K*uqvl/tu$9L=xBnlTBrAkQA=kCvf!W3HA=l8taBCqAA+fhjwn+%[wPwb]B095JviviQwn+%[wPzv1B%5L7fjXTqfk+]GyZKVXBrAkQA=kCvB7Gf1fkUSIzGGPgw]w/tazk.aA3eXfv@2T@3sEmH3jn15bo[sfr7fRagccKCpEv=zqxO[llRx\u003cEaves]q:?3+w/$FmC42zAA=(mMwn+%[wPxzAz!0M\u003cazC)tzeTMmBy!#z3sEmHvQTs\u003e3s[6+yH}JeeL41bzFstRfe1#4vra2wB-5\u003cyz!0M]AXqAKv@0icB-5rNB%5C0fkUPGat4qHayP89x(mG8v}Y[3z/^9PzeKCrB7+[*u%\u003crGbo[ATax8ldp-}LPaw+%cr.k$Nm[2/*lR*DRk$K*uqvl0caAzQxzFs03aA}KwxDQXmePt-AC4\u003e=7xjUQYiTPn5u$9L=xBnuZx(!5jeO(KLboR5swGUV8B95Knx(!6h3t\u003cZ7zGE0OwmY{qB7wYlatmOHBrz[Say/89z/o.ufkUPG3l{W6xl4{kA3fgjy?m3@wNw\u003eUwO#PjwPIu\u0026AaI6qzeiV@AV^2Sze.drxl4@lcmf\u003cLz/]@tat4WTv}P?2B-nDPzY\u0026[dzeTDuay/58z/{1wflz5IfjOTnA0*C$wnc6bflz5IfjOTnA4=CywN/y(atC05atm?NA4+ZlA=rWRfk+YIx\u003ezS$z/e{5wO+{^B7CX\u0026v}Y^6cNf=/vRGZkB7={zj%hH*zdB+oclM(fxM21vB7=WFx=]O^atmnpB$W@EA4:^VfhLCxr3i\u003eUcnu\u003e\u003ck0y8xv@k--v}YZ$wfryEatmkwwc#)TxM21qD[O#DwfJcWatm!YB1.ruA=bD8flpYmB-IhrC}S#Pz3\u003cVUu\u003cWk=bo[AQq=DgZat=b4lQsKmlp\u003c\u003cxr7PISaves]q:?43u%)CLB7+[\u003cvq{p3at2f:A+PAkarR)Ky?W%jay/LmA+fcgay!\u00260vpA}!x([62A%:cmlQsKQq^04ak$1Bsp9qbLaz(4tzGEALv}P?2B-qyMazULezE)SbzeS%cy?mU{boPutp*Wd7q^Sv2qB9Vsat2=1x(mV%v@@\u0026czGG!txM4%laAhvtv}x.5wPFh6avwB\u003euQNgEuS6rUl%\u0026\u003eYk#H6vat2=1A+eV\u0026ayPekazbt7wEoU8lQsKQpdnb?qBawbeJ$p@vpK7:BrCTxx\u003ey%\u003ezF6q:u%\u003crGbo[ATax8ldp-}RRawkZ3mn=(Hr7f.dmn(Mtp^\u003e.0u%)CLB7+[%B09bVvra2wB-5\u003cNwN/:(BAo9JBZ!{5zE){3B1RfBflpYBC4\u003eC$vpJ!=B-8pO3l{V+w/#eaA=#ebwGUz\u003ev@DHcBrCWzyH}xawQ4{gBAoFIv%8*dat4vKxMOunB2\u003e%cbUIc7mn=(Hr7f.)q:\u003cO+nKC{NnkAe-fjw*lflP66zEEx[B8UL$wPGInwObv[y\u0026?sHz!9]ieL40dl3mo.z/PMrvruj4zAn[bwNPQ\u003cAV=RQv{%E4flQ=AflhhMflpYmA+fulfkCYtwPzW1By/ICx(tUCwPz%dv}x7Uv@DHcBt4-OyH}xja{}Z=u\u003cWk=bo[AQk#7xJeL[-jr7fXWq-V3?z/c}AaAIsjA3eXfv@2T@aAIEhyH}Pgv}YB-yARR!LPTWZcVZzLxK@qhf^6$AzGGr3zE)\u0026hwPIu\u0026AaHenwN/?2AXmXya%Eu", "ln": 18, "col": 15, "line": 2 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4, "call_count": 0, "node_count": 14 }, "file": { "size": 1509, "entropy": 5.36 }, "text": { "lines": 54, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.01, "space_count": 157, "char_entropy": 5.36, "unique_chars": 77, "top_char_null": 0, "string_density": 0.04, "top_char_ratio": 0.05, "avg_line_length": 26.94, "max_line_length": 157, "non_ascii_ratio": 0, "empty_line_ratio": 0.15, "last_line_length": 3, "whitespace_ratio": 0.14, "identifier_density": 0.02, "line_length_stddev": 27.92, "normalized_string_count": 0.27, "suspicious_string_ratio": 0.5, "normalized_unique_identifiers": 0.17 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 1509, "peak_region_entropy": 5.36 }, "strings": { "bytes": 1470, "count": 2, "shell": 1, "very_long": 1, "avg_length": 735, "max_length": 1427, "path_count": 1, "avg_entropy": 4.82, "entropy_stddev": 0.52, "high_entropy_count": 1 }, "identifiers": { "count": 1, "unique": 1, "avg_length": 29, "max_length": 29, "min_length": 29, "avg_entropy": 3.75, "reuse_ratio": 1, "high_entropy_count": 1, "high_entropy_ratio": 1, "all_uppercase_ratio": 1 } } }, "id": 98, "mol": "K₂(Li₂Te₂)O₄(C₃AsCaLa)H₅(Cm₅F₇HfOs₅Po₂)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/container_escape.py", "pid": 0, "risk": 139, "sha": "9bf5b888778b0fe06136e1f1d6e9b3c9776a88ec9212226a89d78eebfb0e98f6", "size": 1509, "traits": [ { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 625, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1473, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 495, 0 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "spans": [ [ 1326, 21 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl or wget references shell variable", "spans": [ [ 1250, 40 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-variable-host-url", "atk": "T1105", "conf": 0.88, "crit": 3, "desc": "Fetch URL host is a variable", "spans": [ [ 1258, 32 ] ] }, { "id": "micro-behaviors/communications/http/tls::curl-insecure", "mbc": "C0005", "conf": 0.95, "crit": 3, "desc": "curl disables TLS certificate verification", "spans": [ [ 1250, 7 ] ] }, { "id": "micro-behaviors/fs/disk/partition::fdisk-command", "conf": 0.9, "crit": 3, "desc": "Shell invokes an fdisk partitioning tool", "spans": [ [ 524, 6 ] ] }, { "id": "micro-behaviors/fs/disk/partition::mount-staged-root", "conf": 0.9, "crit": 3, "desc": "Shell mounts a filesystem under /mnt", "spans": [ [ 551, 35 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::unix-block-device-path", "atk": "T1561", "mbc": "E1561", "conf": 0.9, "crit": 3, "desc": "References a Unix block device path", "spans": [ [ 557, 8 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 685, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 624, 0 ] ] }, { "id": "micro-behaviors/fs/proc/container::container-pid1-cgroup", "conf": 0.66, "crit": 3, "desc": "Reads /proc/1/cgroup (PID 1 container check)", "spans": [ [ 184, 14 ] ] }, { "id": "micro-behaviors/fs/read/file/target::shell-cat-absolute-path-read", "conf": 0.86, "crit": 3, "desc": "Shell cat command reads an absolute path", "spans": [ [ 180, 5 ] ] }, { "id": "micro-behaviors/fs/read/file/target::shell-read-container-secret", "atk": "T1005", "mbc": "E1005", "conf": 0.9, "crit": 3, "desc": "Shell reads a container-mounted secret with cat", "spans": [ [ 1350, 21 ] ] }, { "id": "micro-behaviors/os/container/namespace::host-root-chroot-command", "atk": "T1611", "conf": 0.96, "crit": 3, "desc": "Command enters a mounted host root", "spans": [ [ 430, 11 ] ] }, { "id": "micro-behaviors/os/container/runtime::api-namespaces-path", "conf": 0.75, "crit": 3, "desc": "Kubernetes namespaced core resource API path", "spans": [ [ 1290, 31 ] ] }, { "id": "micro-behaviors/os/container/runtime::api-pods-path", "conf": 0.8, "crit": 3, "desc": "Kubernetes pods API path", "spans": [ [ 1290, 31 ] ] }, { "id": "micro-behaviors/os/container/runtime::container-runtime-secrets-path", "conf": 0.82, "crit": 3, "desc": "Container runtime secrets path", "spans": [ [ 1167, 18 ] ] }, { "id": "micro-behaviors/os/container/runtime::projected-serviceaccount-token", "conf": 0.82, "crit": 3, "desc": "Kubernetes projected service-account path", "spans": [ [ 1354, 51 ] ] }, { "id": "micro-behaviors/os/container/runtime::secrets-path", "conf": 0.7, "crit": 3, "desc": "Kubernetes secrets path", "spans": [ [ 1168, 27 ] ] }, { "id": "micro-behaviors/os/container/runtime::serviceaccount-token", "conf": 0.8, "crit": 3, "desc": "Kubernetes service-account token path", "spans": [ [ 1354, 51 ] ] }, { "id": "micro-behaviors/os/privilege/query::capsh-capability-inspection", "mbc": "B0046", "conf": 0.9, "crit": 3, "desc": "Inspects Linux capabilities with capsh", "spans": [ [ 909, 13 ] ] }, { "id": "micro-behaviors/os/security/capabilities::systemd-ptrace-capability", "conf": 0.95, "crit": 3, "desc": "systemd service requests CAP_SYS_PTRACE", "spans": [ [ 1004, 14 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 232, 11 ] ] }, { "id": "objectives/command-and-control/backdoor/shell/reverse::stdin-redirect-dup", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Stdin redirection (reverse shell indicator)", "spans": [ [ 796, 4 ] ] }, { "id": "well-known/lib/cloud/kubernetes::kubernetes-incluster-client-text", "conf": 0.9, "crit": 2, "desc": "Kubernetes in-cluster client text", "spans": [ [ 1267, 0 ] ] }, { "id": "well-known/tool/sysadmin/kubernetes/bootstrap::kubernetes-tooling-reference", "conf": 0.9, "crit": 3, "desc": "Kubernetes tooling name reference", "spans": [ [ 1139, 10 ], [ 1185, 10 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.7, "crit": 2, "desc": "curl command includes URL or option", "spans": [ [ 1249, 0 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::chmod-exec-absolute-path", "atk": "T1222", "mbc": "E1222", "conf": 0.92, "crit": 3, "desc": "chmod makes an absolute path executable", "spans": [ [ 810, 13 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 618, 16 ], [ 680, 17 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda", "atk": "T1561", "mbc": "E1561", "conf": 0.6, "crit": 3, "desc": "References /dev/sda SATA/SCSI disk path", "spans": [ [ 557, 8 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::mounts-mountinfo", "conf": 0.66, "crit": 3, "desc": "Read mount info from /proc/self/mountinfo", "spans": [ [ 248, 20 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd", "conf": 0.8, "crit": 3, "desc": "References a /dev/sd SCSI/SATA device path", "spans": [ [ 557, 8 ] ] }, { "id": "micro-behaviors/os/container/runtime::docker-var-run-sock", "conf": 0.75, "crit": 3, "desc": "Docker socket path", "spans": [ [ 325, 20 ] ] }, { "id": "micro-behaviors/os/privilege/paths::sys-kernel-security", "conf": 0.9, "crit": 3, "desc": "/sys/kernel/security/ LSM access", "spans": [ [ 839, 21 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl", "atk": "T1105", "conf": 0.66, "crit": 3, "desc": "Download via curl", "uses": [ 28 ], "spans": [ [ 1249, 8 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::container-orchestration-tooling-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "Container or orchestration tooling", "uses": [ 16, 17, 18, 19, 20, 21, 34 ], "spans": [ [ 1167, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/full::file-content-read-operation", "conf": 0.82, "crit": 2, "desc": "File content read operation", "uses": [ 13, 14 ], "spans": [ [ 1350, 0 ] ] }, { "id": "well-known/lib/cloud/kubernetes::legitimate-kubernetes-incluster-client-marker", "conf": 0.93, "crit": 3, "desc": "Kubernetes in-cluster client context", "uses": [ 26 ], "spans": [ [ 1267, 23 ] ] }, { "id": "objectives/command-and-control/reverse-shell/dev-tcp::dev-tcp-bash-stdin-redirect", "atk": "T1059.004", "mbc": "B0030", "conf": 0.99, "crit": 5, "desc": "Bash interactive reverse shell with stdin redirection", "uses": [ 25 ], "spans": [ [ 770, 18 ], [ 796, 4 ] ] }, { "id": "micro-behaviors/communications/ipc/unix-socket::unix-uri-endpoint", "conf": 0.9, "crit": 3, "desc": "Python Unix-domain endpoint URI", "spans": [ [ 376, 8 ] ] }, { "id": "micro-behaviors/os/container/runtime::docker-sock", "conf": 0.7, "crit": 3, "desc": "Docker socket path", "spans": [ [ 82, 128 ] ] }, { "id": "micro-behaviors/os/container/runtime::dockerenv", "conf": 0.7, "crit": 3, "desc": "Docker marker file reference", "spans": [ [ 82, 128 ] ] }, { "id": "micro-behaviors/os/container/runtime::service-env", "conf": 0.7, "crit": 3, "desc": "Kubernetes service environment variable", "spans": [ [ 82, 128 ] ] }, { "id": "micro-behaviors/process/create/shell/interactive::sh-interactive", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Interactive shell invocation (sh -i)", "spans": [ [ 769, 7 ] ] }, { "id": "objectives/command-and-control/backdoor/tasking/command-http::python-http-command-path", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "Python command endpoint path", "spans": [ [ 755, 6 ], [ 804, 6 ], [ 830, 6 ] ] }, { "id": "objectives/credential-access/cloud/container::python-serviceaccount-token-path-reference", "atk": "T1552.001", "mbc": "E1552", "conf": 0.9, "crit": 3, "desc": "Python references service-account token path", "spans": [ [ 1385, 20 ] ] }, { "id": "objectives/lateral-movement/exploit/git-hosting::shell-shebang-stdout-redirect", "atk": "T1190,T1059.004", "mbc": "E1203", "conf": 0.93, "crit": 3, "desc": "Shell shebang with stdout file redirect", "spans": [ [ 743, 61 ] ] }, { "id": "well-known/lib/format/conda-package::jax-k8s-cluster-marker", "conf": 0.98, "crit": 3, "desc": "JAX Kubernetes cluster helper marker", "spans": [ [ 1267, 23 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/fs/path/token::container-run-secrets", "atk": "T1552.001", "conf": 0.9, "crit": 2, "desc": "Container runtime secrets path", "spans": [ [ 1172, 0 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "spans": [ [ 744, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Average identifier length \u003e= 22 chars" }, { "id": "objectives/command-and-control/reverse-shell/socket-exec::any-shell-binary-spawn", "atk": "T1059", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Shell binary spawned directly or fed on stdin", "uses": [ 45 ], "spans": [ [ 769, 0 ] ] } ], "type": "python" }, { "id": 100, "mol": "H(Cm₂)", "sha": "5e4f163c8c80fea245cf8875bbdf91b61f0620520ab149bf765adf73b257e761", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/crlf_injection.py", "risk": 2, "size": 729, "type": "python", "depth": 1 }, { "id": 101, "sha": "ecdf7b6b48555048d3f50af4da7da6600a4fe326460d53fe68bc218cafa7ecaa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/csrf.py", "risk": 2, "size": 3227, "type": "python", "depth": 1 }, { "id": 102, "mol": "O(Xe)Md", "sha": "d89c9733fe0498d297a26906129c3c1a298f9aa72e0ed7363a374874071c8ca8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/cve_exploit.py", "risk": 3, "size": 3376, "type": "python", "depth": 1 }, { "id": 103, "mol": "H₃(CmFPo₄)", "sha": "2c9b887263f190b68ee1c1dd21cb836ebaf1d38378808ff06f001898319f0f43", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/deserialization.py", "risk": 3, "size": 2288, "type": "python", "depth": 1 }, { "id": 105, "mol": "H₂(Cm₂Os)Md", "sha": "fa975453ebf95bd76dd67e29c1f9da196ef9ed7332f1e733af833b914400745a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/dns_rebinding.py", "risk": 4, "size": 1100, "type": "python", "depth": 1 }, { "id": 107, "mol": "H(Cm)", "sha": "63721bd656eec068bebf10053662570d159afd6f467d9964adbca98ff72f8f6d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/email_header.py", "risk": 2, "size": 1069, "type": "python", "depth": 1 }, { "id": 108, "mol": "O₂(CLa)H₃(CmDb₂F)Md", "sha": "913b37a87b91cc99c99e3ecb8c96e4725e45dc53e64aa76a3c30ddb3926f7e78", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/file_upload.py", "risk": 79, "size": 3016, "type": "python", "depth": 1 }, { "id": 109, "mol": "H(Cm)", "sha": "13d7cbb26607d883f5e075041e4cb25499c9de2224ff0a0b3bc290207d370e0a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/graphql_attacks.py", "risk": 2, "size": 1658, "type": "python", "depth": 1 }, { "id": 110, "mol": "H(Cm)Md", "sha": "a7b44fd607c6cadd0c2fa49af04c96688a6eadbbfbbad7574f710d5501b4d57c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/host_header.py", "risk": 2, "size": 709, "type": "python", "depth": 1 }, { "id": 111, "mol": "O(Xe)H(Cm₅)", "sha": "6b245ff0d27c28b4907bd0e02aff91f90e9a269ca9c0b20f4f9180ae35ab2f65", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/http_smuggling.py", "risk": 41, "size": 1172, "type": "python", "depth": 1 }, { "id": 112, "mol": "H(F₃)", "sha": "69a2f30324284cc2161c86e740e9af81dd23217e9c80f45650a0ffd06caf8a31", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/information_disclosure.py", "risk": 2, "size": 1145, "type": "python", "depth": 1 }, { "id": 113, "mol": "H₃(CmDbF₂)", "sha": "ed7962d0e4498421b67044b7f9da6c1939a6ecbd6567b94a52ab56757b4026d0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/jwt_attacks.py", "risk": 4, "size": 3066, "type": "python", "depth": 1 }, { "id": 115, "mol": "O(Pr₂)H₄(CmF₅Os₅Po₂)", "sha": "4338ec2f008ffce4548b19e2a46af5c17d3f0f620a9713f30f3cc2c978196bd0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/linux_privesc.py", "risk": 12, "size": 1391, "type": "python", "depth": 1 }, { "id": 116, "sha": "bfc05ca647c271dd72b7778221b6b20e046dc5772b16db1f14a6d400b53ae601", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/loader.py", "risk": 1, "size": 11782, "type": "python", "depth": 1 }, { "id": 118, "mol": "H(Cm₂)", "sha": "5cf6b525e4f00527b5a2c727c05f1137885af55e37daea70c5cd3531fded5b6f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/nosql_injection.py", "risk": 2, "size": 2377, "type": "python", "depth": 1 }, { "id": 119, "mol": "H(Cm)", "sha": "f2a4a8c0239c4301970f662523daf05596b03f5a04c12bf6342e3766cd1f38db", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/oauth.py", "risk": 2, "size": 1279, "type": "python", "depth": 1 }, { "id": 120, "mol": "Md", "sha": "6b0d03ed8919deaebfae3af1ab90bfa000a26313bb794c8e612c81c2e9f4ae58", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/open_redirect.py", "risk": 2, "size": 928, "type": "python", "depth": 1 }, { "id": 121, "mol": "H(F)", "sha": "f31f500d32799a55b6c4dbadf4a9f56f1b65bd9383b13c79e2f4af2d023e1d0f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/parameter_pollution.py", "risk": 2, "size": 1219, "type": "python", "depth": 1 }, { "id": 122, "mol": "O(Er)H(F₃)", "sha": "a1cb436c9e5322043bc9124c772a2d3cedbf0ff6d3473bcfab36b4032e8e8409", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/path_traversal.py", "risk": 39, "size": 2782, "type": "python", "depth": 1 }, { "id": 123, "mol": "O₂(P₂C)H₄(Cm₃F₆Os₆Po₂)", "sha": "dd4c90719203bbd2329d12487e98a875df5335f60f6493718f8a6e4bc39ca10b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/post_exploit.py", "risk": 50, "size": 3662, "type": "python", "depth": 1 }, { "id": 125, "mol": "H(Cm)", "sha": "5e71504aa0f947be99b0f227a61d9d705fdc161384c32d346167aa71a4d7f963", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/race_condition.py", "risk": 1, "size": 1318, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%FirlVl*UvqYP#nP5oOv@#B6zxHOPqBr\u003e}l3diSv@0h=yIvQ3aw^8%ze:OH3jodszEWY#By=OivqYQ:Bz(hBaA}:AyI4y3CoyHoAV!\u003egzeAZ0wftP7ygQ)%x(v(ivqYP#qBr(93l*Vr3joV#mpe$^nLz/+p/p7-p/FM2ar\u00260N3l{=rk#Z/HlRwL2og./JiV{^=o?^]Gl)b5@n\u003c#9DnL-87fcBdWmg6wKdNN99r7PCyoGBp}vrc0(BrCTrz*cmBB7]o8B0bykay/tbzddr)azC.dwN/*@z/cXoAV!mEmiDU]A+n-\u0026wIbCZ3mWI{z!%ldCoz0vx(+zvz/PS9y\u0026sIIavHb\u003czF%RtB9ztuv}W0bzY?$QoLDdZq=s/YzFS)9B0b:DBS+vaC4z!nA=k(ddK\u003e=PdS/ujBrCWswGUG9A=L-eBrC1lBywV{ay/j@B8@ErB0bWEz/fhudK\u003e=jeIeKY3l{=uavFT$mmg3CpFJ}[nN#yIBzkujay/tbzddr)azC.dwN/*@z/cXsB-I85v}t#Ok{gbPA:-/@By/Fnx(+z9avwB\u0026l}G^jr7d{wz/M$gz/6u1zE:(7zFA-)BzkVhazCBG3n0w(BrC1hAaJD#B0bNyayX[8Aa9*ewN({9zY\u0026EhB9R?GwO\u0026M1z/6u1zE:\u003erAa%i5efF?Ky\u0026slcB-n(OBAg/1wPzZiBy^0CwQ4=@efG1VB97#gdgdTHra]?=A+frhz/fScay/tcByw)3B0byzBz#wAaARp9BrCyrz!\u003czpy?WV@ay/tbzddr)aA8yAAclmBc}NkTvpS[?wPI{7B1wC4pe-oQwPJ0gBAn(reG!2awGU@2A:-/@By/FnzEEx[aAIWrxjVdaB0amSazC.nwPzi?BzkVhiV}*uzdE39ayF=9wN/a0ayGkjzEt1ru$ja(zddr)u[rBdAa%i5u[rBdxM4%lu[rBdx(EDhayF!}y?l#Y3l{=uawCc%l{T^FqDUbfpFBLHpdci@pd^@xr7P\u003eXaxIupogzPJr%/oVbo[AQq=DgZatC]1l}76zlSuSMp6}s$z/M$ivpJ%[v{%m=x\u003egT]wGU@2A:-/@By/FN3nBdQq!o\u0026SayX=2wO=6#wGVe8y\u0026%qi\u0026^^mozF%Sdaz#arzddl6z/{evB-W%Ce*9D0AaJ]$ay/tbzddr)aAIakvrb^#z/P[wCwhejayMyavrcj3wPI]nv@Dj3vqYQp3lQDleG!B.azCv]3lQDleG!CGazCv]3lQDleG!CGD)0clu\u003cX20at1ZzclN2ku)3\u003c$qCnVNzEWP}wGUA5ayDGJhEE%varR^UayDJyazCv]3lQDleG!CeayF[]u)5\u0026+asHYcv@3g2v@0i3zFA-)BzkVhefE}\u003coF6*[v@C)?ayPslu)NY+x\u003eeIFfKMsparR^UayDDyx\u003eeV2asHk/oF6*[v@C)?ayPslu)NM+b@dC]wf\u0026#\u003eu)#B9arSlUpgXS=x(mG8x(mV%v@#B6zAn[Fb}@+wwmb-KgCf!ww/$F}wmcJ#B-.OBBrC1hAaJD#B094#avw}1mOcGLmmnndz/6u1zE:(7zFA-)BzkVhe^:A/avf*+zY\u003cdkB95Kly?W=$iV}/(aAIvgwPe+Hu)aDVLPTWLaAz4mAbPSnwGUI{y*?Qgat\u003eo.wN/T@woe\u003eBj%ii*pdv/Mo*}C)vR/:@wg!h@bo[ATax8ldp-}IOavPyeoIXkVk#ZAKp6}t7zEWl2v@Dl%x(X64wi75Le*8R[qE%uRzyNa%ayEnNx\u003egQ5ayEnNB-7S8wGSNku[rBdj0nG^wmc@hu]]GEB095JvpfA$e*8R[qE%oEazbt7wPGsJiV}/(ay!\u00264atmqFv\u003eR!fB8#Lou[rBdj0n3wBrAkGy**%eBA?[nefFsZay!\u00264atmexA4+ZtzF0P}e]V8z3nTpSdK[tcC4CYnwGV5cwO=fjdJ*cNw/$I#y\u0026sJewgoLDarR!mu%\u003cr:arS-*vQTs\u003eat47CcT{I9xDO)vau?a{fjXTqflyYyfiI7JqEr0(feLHxg:1Focnu\u003eParR!mu%\u003cr:arTE2aw^u9xM4=hA+fA9A=U!mB7/c3y=R[CarU61u\u003cX20auHY+D30.rzzJy!v\u003c0dkze:AlBrCTyv@2T$eot@yAb](bwPI]zz/X0Yj-+KKyH}PuB8LM7wPPsHj992:z/fD7v@%aEb3vYwqEr0(a$LMcg=cTgj8Yf)woz\u0026Dd041Mx(4u#zZW4=fEY84B1R0CA55?.e[O*lwO#Amdj^h5j8Yf)woz\u0026Dd041Mx(4u#zZW4=gatqaBZ/rgz!0v1B1Q%hy?$I7a$)ztzzc6Aa$K]\u0026x^c?icKH$sayFO+3n:vTdK)?{Byuq6CXgVadK)F4u]]GvB-IpvxMOuniXJc?pGpq1nL?Dci5\u0026(JbQ^ehBrAkGy**%eBA?)ID(#)bB7El^dprF\u0026bo[ATax8ldp-}LPax8irnGYAWwPz%9AXgj7wmV(.wO(y5vru66nP5oOv@#B6zyC]1nOf8!xK@r9vrb^[wPRH7aAz49y?m9#B0bQDwPw]czG6-uave:\u003caA.:pB0bNoze:r1By=OoD2v.jCSDf-awcu=yge\u003eUayGLyh.3+mEpafHj%jMKat=83vq{f%vrcAieJ$pApFKwJqCxOFax8irnEv3(n[\u0026fTvkn%6lQ:3Uv0^lgz/ff3xd^K#v@bN{B6\u0026obuTEI+x()Y?e)?%#y\u0026r=\u003ey\u0026-@\u003ctpjugcTwuzz/xo9c)@.tcN*V*wNP9$dsDRL3n0x1CwgXJayGLyuVP^{w?EUjB$N/Dxk8BewPy^*wmYv!zE)uFx(4)5AZKnKy*{*.yByMKD2[7sz6{=XEs3rFB7Gf1e[F{ze[X:qmRMWXwPxgDx\u003eeOuEskGgeG^J6wO2Z!A+/lbiV}/QDP9AkEpafHj%jMKat=83eJ$pApFKwJqCxOFe*a4VmlhM0jr[oQB7]o8az2^Xb4+\u003ebwO\u003e\u003c@yH}JsBy/rdy*?A%e{hnIy?X0pe\u003e71@v%8)8b0P%RCpj[7bZT9Ec)Awoa$m}F3jn15bo[r%pe\u003c!pp^F5Wmn=(ViTNCYl#KhypGeDLwO2*6Ab](ax(mMaBzbkdB75]%aAIakvrb^#z/M$mw/$/fazb4@y?mc1\u0026^^moBAhTHvix8{w[CQ{wO#Pjz/fa[eG^D1awLZiayPtjB.$XjzF{UizFA-)BzkVhayX[(vrDT5ayEnNx\u003egP]wnbN(cV*FPz/PRo\u0026^^moBAhTHv0(ukayGOAu[rBfvpK7{x\u003e7}13n0w^y\u003cfrkB0bNoB95Kly?W=$asIqEwO2*fazCBgz/{evB-YiAvrl0\u003cazC.dwN/*@z/cXdz!j0ccV*FLxM584eG^@5v@Dx#avPs1qDUbYA=kz#aAz4mB.(dxCwhejaA}\u003cuBy!/%z//K$a%Fir", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4, "call_count": 0, "node_count": 14 }, "file": { "size": 2688, "entropy": 5.43 }, "text": { "lines": 70, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 358, "char_entropy": 5.43, "unique_chars": 87, "top_char_null": 0, "string_density": 0.03, "top_char_ratio": 0.06, "avg_line_length": 37.4, "max_line_length": 191, "non_ascii_ratio": 0, "empty_line_ratio": 0.21, "last_line_length": 3, "long_token_count": 1, "whitespace_ratio": 0.16, "identifier_density": 0.01, "line_length_stddev": 36.97, "encoded_string_ratio": 0.5, "normalized_string_count": 0.24, "suspicious_string_ratio": 1.5, "normalized_unique_identifiers": 0.16 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 2688, "peak_region_entropy": 5.41 }, "strings": { "sql": 1, "bytes": 2662, "count": 2, "shell": 1, "very_long": 1, "avg_length": 1331, "max_length": 2552, "path_count": 1, "avg_entropy": 4.95, "url_encoded": 1, "entropy_stddev": 0.47, "high_entropy_count": 1, "embedded_code_candidates": 1 }, "identifiers": { "count": 1, "unique": 1, "avg_length": 16, "max_length": 16, "min_length": 16, "avg_entropy": 3.5, "reuse_ratio": 1, "all_uppercase_ratio": 1 } } }, "id": 126, "mol": "K(Te)O₄(C₃LaSXe)H₄(Cm₇DbFPo₇)Md₂(In₄Pa)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/rce.py", "pid": 0, "risk": 129, "sha": "9f2f57a8d4c9a3ecde67704d470a047f3562a98cd909234ff116a85f2f292b73", "size": 2688, "traits": [ { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 25, 2 ] ] }, { "id": "metadata/import/python/socket::socket", "conf": 0.95, "crit": 3, "desc": "imports socket", "spans": [ [ 7, 6 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 14, 10 ] ] }, { "id": "micro-behaviors/process/fd/dup::python-dup2", "conf": 0.85, "crit": 3, "desc": "Python file descriptor duplication (os.dup2)", "spans": [ [ 74, 7 ] ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdio-dup2", "conf": 0.8, "crit": 3, "desc": "Python duplicates descriptor to stdio", "spans": [ [ 74, 21 ], [ 96, 21 ], [ 118, 21 ] ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-socket-fileno-short", "conf": 0.65, "crit": 3, "desc": "Python short socket fileno", "spans": [ [ 82, 10 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method-short", "conf": 0.85, "crit": 3, "desc": "Short Python socket connect call", "spans": [ [ 46, 10 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "spans": [ [ 0, 13 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-socket-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.socket() call", "spans": [ [ 30, 13 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 46, 27 ], [ 74, 7 ], [ 96, 21 ], [ 118, 21 ], [ 140, 15 ] ] }, { "id": "micro-behaviors/process/create/subprocess::call", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.75, "crit": 3, "desc": "subprocess.call call", "spans": [ [ 140, 16 ] ] }, { "id": "micro-behaviors/process/create/subprocess::call-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Runs a process with subprocess.call", "spans": [ [ 140, 15 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 14, 10 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "spans": [ [ 158, 7 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 1 ], "spans": [ [ 7, 6 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-creation", "atk": "T1071", "mbc": "C0001", "conf": 1.0, "crit": 2, "desc": "Socket creation patterns", "uses": [ 8 ], "spans": [ [ 30, 0 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method", "conf": 0.85, "crit": 3, "desc": "Python socket-like connect call", "uses": [ 6 ], "spans": [ [ 46, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 10, 11 ], "spans": [ [ 140, 16 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-client-operations", "atk": "T1071", "mbc": "C0001", "conf": 1.0, "crit": 2, "desc": "Client socket operations", "uses": [ 16 ], "spans": [ [ 46, 0 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 17 ], "spans": [ [ 140, 16 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 17 ], "spans": [ [ 140, 16 ] ] }, { "id": "objectives/command-and-control/reverse-shell/dup::combo-reverse-shell", "atk": "T1059", "mbc": "B0030.002", "conf": 0.95, "crit": 5, "desc": "Classic reverse shell pattern (socket", "uses": [ 3, 13, 16 ], "spans": [ [ 46, 10 ], [ 74, 7 ], [ 158, 7 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-python", "atk": "T1071", "mbc": "C0001", "conf": 0.75, "crit": 3, "desc": "Initiate socket connection (Python)", "uses": [ 15, 18 ], "spans": [ [ 30, 13 ], [ 46, 10 ] ] }, { "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call", "conf": 0.9, "crit": 1, "desc": "Process API invocation", "uses": [ 20 ], "spans": [ [ 140, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 17 ], "spans": [ [ 140, 16 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 330, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 100, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 325, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 310, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 936, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 258, 0 ] ] }, { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "spans": [ [ 24, 3 ] ] }, { "id": "metadata/package/testing/corpus::sqli-category-label", "conf": 0.9, "crit": 3, "desc": "SQL injection category label", "spans": [ [ 290, 4 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 295, 3 ] ] }, { "id": "micro-behaviors/communications/dns/label::common-source-dns-query-api", "atk": "T1071.004", "conf": 0.88, "crit": 1, "desc": "Source references a common DNS query API", "spans": [ [ 530, 0 ] ] }, { "id": "micro-behaviors/communications/http/curl::curl-command-remote-url", "conf": 0.85, "crit": 3, "desc": "curl command names a remote HTTP(S) URL", "spans": [ [ 1867, 19 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::source-chained-downloader-command", "conf": 0.93, "crit": 3, "desc": "HTTP downloader follows shell operator", "spans": [ [ 1865, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::dev-tcp-path", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Shell /dev/tcp socket path", "spans": [ [ 1576, 21 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "spans": [ [ 952, 0 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "spans": [ [ 1453, 11 ] ] }, { "id": "micro-behaviors/fs/read/file/full::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "spans": [ [ 2162, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/command-string::embedded-sh-c-literal", "conf": 0.8, "crit": 3, "desc": "Embedded shell command string uses -c", "spans": [ [ 1556, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/command-string::unix-shell-command-token-literal", "conf": 0.98, "crit": 1, "desc": "Unix command after shell separator", "spans": [ [ 967, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::parenthesized-command-literal", "conf": 0.98, "crit": 3, "desc": "Parenthesized shell command string", "spans": [ [ 1114, 5 ] ] }, { "id": "objectives/command-and-control/backdoor/shell/reverse::stdin-redirect-dup", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Stdin redirection (reverse shell indicator)", "spans": [ [ 1598, 4 ] ] }, { "id": "objectives/execution/interpreter/cmd/injection::command-injection-comments", "atk": "T1059.006", "conf": 0.75, "crit": 3, "desc": "Command injection vulnerability comments", "spans": [ [ 4, 17 ] ] }, { "id": "objectives/lateral-movement/exploit/scanner::file-inclusion-probe-payload", "atk": "T1210", "conf": 0.9, "crit": 3, "desc": "Local-file inclusion probe payload", "spans": [ [ 1453, 11 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "metadata/file/string/count::few-string-literals", "conf": 0.4, "crit": 3, "desc": "File has very few string literals" }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.7, "crit": 2, "desc": "curl command includes URL or option", "spans": [ [ 1866, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 1872, 11 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd-cat", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd read via cat command", "spans": [ [ 1447, 17 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-keyword", "conf": 0.7, "crit": 3, "desc": "bash shell keyword (beyond shebang)", "spans": [ [ 1554, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::command-substitution", "conf": 1.0, "crit": 2, "desc": "shell script command substitution", "spans": [ [ 1108, 0 ], [ 1114, 0 ] ] }, { "id": "objectives/command-and-control/backdoor/keywords::generic-term-reverse-shell", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Reverse shell keyword", "spans": [ [ 1514, 13 ], [ 1624, 13 ] ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-shadow-path", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "Account database path marker", "spans": [ [ 1452, 12 ] ] }, { "id": "metadata/package/testing/corpus::injection-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple injection attack-category labels", "uses": [ 33, 34 ], "spans": [ [ 290, 4 ], [ 295, 3 ] ] }, { "id": "micro-behaviors/communications/dns/label::source-dns-query-api", "atk": "T1071.004", "conf": 0.9, "crit": 1, "desc": "Source invokes a DNS query API", "uses": [ 35 ], "spans": [ [ 530, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/full::file-content-read-operation", "conf": 0.82, "crit": 2, "desc": "File content read operation", "uses": [ 41 ], "spans": [ [ 2162, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/command-string::sh-c-exec", "conf": 0.8, "crit": 3, "desc": "Executes a shell command string with -c", "uses": [ 42 ], "spans": [ [ 1556, 7 ] ] }, { "id": "micro-behaviors/communications/dns/lookup/query::source-resolver-query", "conf": 0.92, "crit": 3, "desc": "Source or bytecode performs DNS resolution", "uses": [ 58 ], "spans": [ [ 530, 8 ] ] } ], "type": "python" }, { "id": 127, "mol": "H₂(CmDb)", "sha": "cb03125d1c031e31235c19ddc7c05d061e3d55c9ad451716a373de2531b36380", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/redos.py", "risk": 2, "size": 1070, "type": "python", "depth": 1 }, { "id": 128, "mol": "H(Cm)", "sha": "00fc67abcf5492445c51ea5fa0e9fa56d8ef305a9b4c17e8f31fbda23add3896", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/saml.py", "risk": 2, "size": 1407, "type": "python", "depth": 1 }, { "id": 129, "mol": "H(Db)", "sha": "04a7d048e7583f377fee065d4b6bd4e8c61f206c6babfd2eb662566b0889b58e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/soul.py", "risk": 2, "size": 4359, "type": "python", "depth": 1 }, { "id": 130, "mol": "H(Cm)", "sha": "bb1d608a405763671918b78681a3688f6b4148b4b53e15b9090b6f40584f3e1c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/spring_boot.py", "risk": 1, "size": 1189, "type": "python", "depth": 1 }, { "id": 131, "mol": "O(Xe)H₃(Cm₂DbTi)", "sha": "df306b5daa2fb7112ddb1e33d54217b0ed42aed0429bde4b25221f4f15ea5718", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/sql_injection.py", "risk": 40, "size": 4168, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%Firq=uN-avg9\u003evpK6}q!{8-y-(L{z/6Dne^-^Da{[VQq=l7(q+GXQoKyQ]pFBU+auZ?\u003ea%EvsboPoKr6-(Aax7{8oIvF\u0026q:\u003cO+mn+ZonKL#\u0026qBKC.mn)edmO=]Lmn^nhc@T5xmKXVKdK)!-nMnnGk$\u003crZraf/WwPP5dvriL\u003eqCnVOwPRA}x(mMaw{503BzkVhvqGU1C{1IVwNYs\u003ez!\u003czBaz++fyANOpwP?^0Cxkqxx(d*cA=+(kB1wCMA=lhFaz2C3AbPDdBAn#Qw[=6)azbhbv}YB]B15Z:mSi9Vz*9sCxLzJgq=uN-aA}:AyI4y3Cp\u003eu{3jnvpeEz?fbo[s0mn#Yyr7P\u003eXiV}18wO#Q7w{CI0qCnVOwPRA}x(mMawO#3$z!T9hA%-myzE^Z8x(n3laARp9BrCTExj\u003e^%BrBHXqBR^IB-I85v}vXdeG!CzA+))DefFtjwPRA}jZY/-u#Qd8CZhCWefFtAwNYs\u003ez!?HzefFtgvqG:?vpK7ou[rBdA+e=}A+e:5jZY/-u#fK{yDV5jeG^I%y?j-6ze:AlBy/GliV}*Aze:AlByfd", "ln": 0, "col": 1, "line": 1 }, { "b": "B97#hwPw]nzY\u003c7iv}xv$wGUF\u003ey\u00260M?v@3cD3sEmH3l{V)wPzT4zEEu7f/*B#ByxiiayMyex(!xczE)?}zET!vy\u003c6+ui5\u0026(S3l{V?AV/HCwGUz7Cv+k%z/ozlB7Gxnx\u003e7Y%y?WV@aA}yaxM4*8e]$-GwH[%AwPq\u003c7B97(9zy=]AzGGDgvpKz2xBncPu\u003cWluxK#67By/JnazCBgBzbkdByxi5wPP5ivqxB}aA8yAvScybwft]7ADL\u0026lBAoFIf!KORxMOuniXJc?pGpq1nL?Dci5\u0026(JBy/Jnu)aDVLPU3Yze:r5av]Ehp-%mRy\u00260M?v}#Abe*aLnBAzE.fe3E7rz)f}p=ZM}i5\u0026NrDU489AbPDdBBwNBaMv{oay/7@v@0ihxKM09Aa9\u003c4azC)tA+flkwPI%8wc$aBayF(8Bz%n]fi.NPrz)f", "ln": 664, "col": 12, "line": 25 }, { "b": "nLSkNqCGIKax7S[pejwQm*YP0zEWl2v@Dl%x(X64wgO\u003cxA=kz#azC.nwPzV%y-)!gA=#ebwPG)tf!KORxMOuniXJd5z!0i(xM4%lfjk{ZFrRf)z/oP7vpK6}vpJ!UB8}Wze*aLnBAzE.fe24nh.D^pfFk7ku)aDVLPTKZAbok#x(\u003eFlz/oP7vpK6WgCf!TxMOuniXJcue?![ie?!}^aMv{oayP85azC.nwPzx\u003ev}xY*g+G[UxMOuniXJc\u003ciYY03fjk{ZFrRfFp\u003ca-ty\u0026slhvQS+Z3n\u003cBUu$:U7A5]T9y\u0026r/(y?N:dBuhfju)aDVLPTWTBy/GgvqE5+q+dlNe*aLnBAzE.fe4cWv{%g!z/Z1Yh8E9Au)2", "ln": 1123, "col": 14, "line": 39 }, { "b": "ayF(8Bz%n]fkLMpvqGQ}B96D6gb7y\u0026aMv{oazC.nwPzV%y-(e.vrlK8v@(i\u0026A:@+\u0026f!+j5u$:U7A5]T9f/z3AgbQ)vf/z3AgbQ)wy*?A%B966LwPRujwmoN*fjk{ZFrRfxs5QkUwPRu\u003evrt{2c$v7iBZ#{d3mWJ4z/P}xB7nS@aA?Ecax8ipmK/(Gaxh][BrC7izeBieazC.nwPzV%y-)XnA==vBvqYP#zF%SdaAz4mAbPSnwGUI$w[CQ{wO#0?B2\u003cTWaxi5(wP8Zkat2=1AbP=say/kaB7F\u003e?eG^A0zF\u003c2}BzkVhaAz49B-Rb8at2=1AbP=say/kaB7F(8d05%uC4\u003eC$az#ataz++kBy/u7zF7y9eG^O-r8sYTwPI*ezGxwieJ$p@z/P}xz/xo9aA}KwxDRIgvJY-6A=#ebwEp1iph+24nk@L+aAz4mAbPSnwGSM*aAhmtBrCHvwO@Smx([2hz//V7AV/BmA=#ebwEn+?bo[AQq=DgZatV53lRHoQl)bh)r6-]rr6Z\u0026#nD", "ln": 1541, "col": 3, "line": 50 }, { "b": "A5]T9f/z3AgbQ)vf/z3AgbQ)wy*?A%B966LwPRujwmoN*fjkbsavf7caw1\u003c[ay/C6wof^Ou$:U7A5]T9f/z3AgbQ)vf/z3AgbQ)wy*?A%B966LwPRujwmoN*fkj\u003ciflpYmB-IhrC}AJDwN]v\u0026Bzkf1B1Z]deG^LJp=Y.bxMOuniXJd6wPRu\u003evrt{gxk.Z3y?kkkzGGDgzEEumv@Dj6B-.g?wPRu\u003evrt{hB$\u003eTT3n0w^DuBmtiV}*zBAzE.fe24riw96Ag+HHviw96Ag+SYSBywY*Byu?pzGx]dzEWlxvq]{jC4CYnx(v(Lgb7EreIF}ifFM@xeG^C}xk8D@y![LLvqXaGu$:U7A5]T9f/z3AgbQ)vf/z3AgbQ)wzdN/$wmoN*flP65yiarhu\u003cWk\u003cdOiuhpF$dTpe\u0026X)iV{!az/]OkzdN/$wmoN*az2C3AbPDdBAnNBwPq\u003cbA+cwmAaJJ[w[+-$xK$Q.wPz\u0026M3n0w\u003clR]/^u}\u003eiOvpS!*vj:@+vrMNfiV{}hz!A($u\u003cXFdl3^V]wJy@wo\u003ewAPwmoN*iV@J+B.a}/3l{=uboP]:mnL9-iV}l%pGgaSpFq)fo\u0026TXNoI4#H3jovpav]Ehp+uQ6y\u003cvd4q=l7oaARTHaAhvtBz\u003eVcy-)!oB.tu6x(mMaw]zYjqBr(l3n0xdxk.:5wPx*+fkLMpvqGQ}B96D3gDdrEuRa0ZpHCs8FrRfOwN]H@aAhvtBz\u003eVcyZI:pu$Ka?wJzE$fj/lnfk$uvB9ze5aMv{oaz+$avqE5#x(4u6A+eV\u0026asInsA+f6jaA}:AyJy{ieG!Cix\u003e8lCfe4cWv{%g!z/Z1YhzWoLfkkroz^TZEFrRf!x\u003e8lcAb](sz!0Z43jn15bo[sfr7fRah98\u003cHnLA8LqxOqep^F2Umn\u003cK2nOf8Qx(W={BrCP", "ln": 2003, "col": 12, "line": 62 }, { "b": "B7DF5ay]zcvqfQ4Bzb98aAz4mz!%PdB0bNyatCSge?![ie?)X+axqrkaAg+fB7Gwmv@Dl%B-RnnzAn[FxMOuniXJcvgb**te?![jiYF/UwP?^7e[n*pfjkbsavHc\u003cvR/QcwO#0@wnb{]iV}*zBAzE.fe24nh.D^pfFk7vb@mIbgCyE\u00263n0w#wN]H}wN/*8v}Yp+zGv\u0026YxKM6}aBd)FAV/BmA=#2matUYbePLAkx(W={BrCWzazC.nwPzV%y-(qCA%:GwnL\u003cN*fg!#-g:3THCSD%PxMOuniXJc\u003ciYZ\u003e+w[B7Ugb**te?![jt}YN)eG^C)v}/^*y-(qCiV}*zBn", "ln": 2773, "col": 19, "line": 82 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4, "call_count": 0, "node_count": 14 }, "file": { "size": 3472, "entropy": 5.47 }, "text": { "lines": 96, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.09, "space_count": 362, "char_entropy": 5.47, "unique_chars": 85, "top_char_null": 0, "string_density": 0.02, "top_char_ratio": 0.06, "avg_line_length": 35.17, "max_line_length": 84, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.22, "last_line_length": 3, "whitespace_ratio": 0.13, "identifier_density": 0.01, "line_length_stddev": 25.88, "normalized_string_count": 0.2, "suspicious_string_ratio": 1, "normalized_unique_identifiers": 0.15 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 3472, "peak_region_entropy": 5.44 }, "strings": { "sql": 1, "bytes": 3445, "count": 2, "shell": 1, "very_long": 1, "avg_length": 1722.5, "max_length": 3414, "path_count": 1, "avg_entropy": 4.75, "email_count": 1, "entropy_stddev": 0.7, "high_entropy_count": 1 }, "identifiers": { "count": 1, "unique": 1, "avg_length": 17, "max_length": 17, "min_length": 17, "avg_entropy": 3.34, "reuse_ratio": 1, "all_uppercase_ratio": 1 } } }, "id": 132, "mol": "K(Te)O₃(EuLaS)H₂(Cm₇F)Md₃(Pa)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/ssrf.py", "pid": 0, "risk": 11, "sha": "259cfb082e0d0c5f5783fa792809b8f0ec7c69ed3d238cf3acf695040b1c55da", "size": 3472, "traits": [ { "id": "metadata/file/catalog/service::service-name-digitalocean", "conf": 0.6, "crit": 3, "desc": "DigitalOcean service name", "spans": [ [ 2265, 12 ] ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "spans": [ [ 1605, 15 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 828, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 1717, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 325, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 2933, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 2523, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1862, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 239, 0 ] ] }, { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "spans": [ [ 2527, 3 ] ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 4, 4 ] ] }, { "id": "micro-behaviors/communications/http/keywords::webhook-service-word", "conf": 0.9, "crit": 1, "desc": "Mentions 'webhook' (HTTP callback)", "spans": [ [ 383, 0 ] ] }, { "id": "micro-behaviors/communications/http/services/aws::ec2-imds-iam-credentials-endpoint", "conf": 0.9, "crit": 3, "desc": "EC2 instance-metadata IAM credentials endpoint", "spans": [ [ 2067, 57 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-endpoint-reference", "conf": 0.9, "crit": 3, "desc": "Google Cloud metadata host reference", "spans": [ [ 2142, 24 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-flavor-header", "conf": 0.9, "crit": 3, "desc": "Sends the GCP Metadata-Flavor request header", "spans": [ [ 2396, 15 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-gcp-provider-name", "conf": 0.82, "crit": 3, "desc": "Repeated GCP provider name", "spans": [ [ 2129, 3 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--azure", "conf": 0.4, "crit": 3, "desc": "Public cloud provider name (Azure)", "spans": [ [ 2190, 5 ] ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-configuration-key", "conf": 0.86, "crit": 1, "desc": "Webhook configuration key", "spans": [ [ 383, 0 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "spans": [ [ 2595, 11 ] ] }, { "id": "objectives/discovery/network/scan/port::port-scan", "atk": "T1046", "mbc": "E1046", "conf": 0.4, "crit": 1, "desc": "Port-scan keyword", "spans": [ [ 1668, 0 ] ] }, { "id": "objectives/lateral-movement/exploit/scanner::file-inclusion-probe-payload", "atk": "T1210", "conf": 0.9, "crit": 3, "desc": "Local-file inclusion probe payload", "spans": [ [ 2595, 11 ] ] }, { "id": "objectives/lateral-movement/exploit/scanner::internal-cloud-probe-payload", "atk": "T1210", "conf": 0.9, "crit": 3, "desc": "Cloud metadata endpoint probe payload", "spans": [ [ 1605, 15 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "metadata/file/string/cloud::aws-metadata-endpoint", "conf": 0.85, "crit": 3, "desc": "AWS EC2 metadata endpoint", "spans": [ [ 1605, 32 ] ] }, { "id": "metadata/file/string/cloud::azure-metadata-endpoint", "conf": 0.85, "crit": 3, "desc": "Azure IMDS endpoint", "spans": [ [ 2205, 33 ] ] }, { "id": "metadata/file/string/count::few-string-literals", "conf": 0.4, "crit": 3, "desc": "File has very few string literals" }, { "id": "micro-behaviors/communications/http/request/credentials::python-credentialed-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python credentialed HTTP URL", "spans": [ [ 2837, 20 ] ] }, { "id": "micro-behaviors/communications/http/services/aws::iam-credentials-path-reference", "conf": 0.7, "crit": 3, "desc": "AWS IAM credentials metadata path", "spans": [ [ 2100, 24 ] ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "spans": [ [ 1187, 16 ], [ 1230, 16 ], [ 1275, 14 ], [ 2868, 16 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 868, 11 ] ] }, { "id": "micro-behaviors/communications/socket/netcat::nc", "conf": 0.9, "crit": 3, "desc": "nc command invocation", "spans": [ [ 728, 7 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 2868, 41 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-reference", "conf": 0.85, "crit": 3, "desc": "webhook.site service reference", "spans": [ [ 773, 12 ] ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-shadow-path", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "Account database path marker", "spans": [ [ 2594, 12 ] ] }, { "id": "metadata/file/catalog/service::cloud-saas-service-names", "conf": 0.6, "crit": 1, "desc": "Cloud SaaS service names", "uses": [ 0 ], "spans": [ [ 2265, 0 ] ] }, { "id": "metadata/package/testing/corpus::server-attack-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple server-side attack-category labels", "uses": [ 9, 10 ], "spans": [ [ 4, 4 ], [ 2527, 3 ] ] }, { "id": "micro-behaviors/process/create/channel-agent::ai-agent-message-receive-operation", "atk": "T1059", "mbc": "B0022", "conf": 0.86, "crit": 1, "desc": "Agent receives chat commands", "uses": [ 17 ], "spans": [ [ 383, 0 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site", "conf": 0.85, "crit": 3, "desc": "webhook.site OOB service", "uses": [ 32 ], "spans": [ [ 773, 12 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::oob-endpoint-any", "conf": 0.9, "crit": 3, "desc": "References an OOB callback service", "uses": [ 37 ], "spans": [ [ 773, 12 ] ] }, { "id": "objectives/discovery/cloud/metadata::cloud-metadata-access", "conf": 0.85, "crit": 1, "desc": "Cloud metadata endpoint reference", "uses": [ 23, 24 ], "spans": [ [ 2205, 0 ] ] }, { "id": "metadata/encoded-payload/url", "conf": 0.9, "crit": 3, "desc": "Percent-encoded content decoded", "spans": [ [ 2868, 46 ] ] } ], "type": "python" }, { "id": 133, "mol": "O(Dy)H₃(Cm₃CrPo)", "sha": "41aa057ae8932d692df1d51b427dc10b0fc3563ba59c5da3386bab481e85b9bc", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/subdomain_takeover.py", "risk": 5, "size": 1179, "type": "python", "depth": 1 }, { "id": 134, "mol": "H(Cm₂)", "sha": "985cc7303a82164f337f7d938f2e2aa9811b172b0a8954382bd2a0b29d211e99", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/twofa_bypass.py", "risk": 2, "size": 1336, "type": "python", "depth": 1 }, { "id": 135, "sha": "4dbc16464bfc1d6993df4768804e6b8d628585f6e88fbfb8871c4f1ee05c4f93", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/websocket.py", "risk": 1, "size": 1025, "type": "python", "depth": 1 }, { "id": 136, "mol": "H(Cm)", "sha": "566cbcaa5ec7ecdc34ff0508d7a8ea14cadfbeaf95e83e5bc3820f072c57f1b6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/wordpress.py", "risk": 2, "size": 1099, "type": "python", "depth": 1 }, { "id": 137, "mol": "H(Db)", "sha": "56f2ca091946f040c824eae0a43e57f04ffb70c3cc04309c122649b0a4a79720", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/xpath_injection.py", "risk": 2, "size": 911, "type": "python", "depth": 1 }, { "id": 138, "mol": "H(Cm)", "sha": "29a6aec8fbd30df74a633d3bd2c11add6c6d7bbd4e904cf9d922b41e87070bf7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/xss.py", "risk": 2, "size": 2595, "type": "python", "depth": 1 }, { "id": 139, "mol": "H₂(CmF)Md", "sha": "eb39de5f68e622dd34f26e2bdf305047d4c06ac61a33ca280781adcc29754fc0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/lib/skills/xxe.py", "risk": 3, "size": 2708, "type": "python", "depth": 1 }, { "id": 140, "mol": "H(Po)", "sha": "a56a082331abe1387d0f58a160c5a296ae6b6ee9e6f04cd5428ee3aea9d71a21", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/agent/memory/__init__.py", "risk": 1, "size": 740, "type": "python", "depth": 1 }, { "id": 143, "mol": "H₂(DbOs)", "sha": "8f93e3c46dd7bfdc13d566c39cd881ab1aef5358c964adc2fda6cd9dc1d1a77b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/amass/entry.py", "risk": 3, "size": 2166, "type": "python", "depth": 1 }, { "id": 144, "mol": "H(Po)", "sha": "ddabd353db8a0bc8888e9780b5db59dd48d0beb2fad2fdafa944226a709f0e62", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/amass/main.py", "risk": 1, "size": 344, "type": "python", "depth": 1 }, { "id": 149, "mol": "H₂(DbOs)", "sha": "e525ede33cc9fbf5847cdafdea00ffe9f7dc93731ceb9100f6fb84ddbd455354", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/apifuzz/entry.py", "risk": 3, "size": 2180, "type": "python", "depth": 1 }, { "id": 150, "mol": "H(Cm₅)", "sha": "1daecde384595e4a4e16de55101c3d035e30d563bcc2d917878ab5dc245424b2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/apifuzz/main.py", "risk": 2, "size": 2625, "type": "python", "depth": 1 }, { "id": 155, "mol": "H₂(DbOs)", "sha": "f04f56b67159893707a19f784540ad31a7baad9b12a4451e4141abc13d943e1c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/apkstatics/entry.py", "risk": 3, "size": 2201, "type": "python", "depth": 1 }, { "id": 156, "mol": "H(Db₂)", "sha": "a629df34ebb475d515638c1565df0d2e31e1c8c5d6d01206cd26a37b1cf4bcab", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/apkstatics/main.py", "risk": 3, "size": 2341, "type": "python", "depth": 1 }, { "id": 161, "mol": "H₂(DbOs)", "sha": "ff11937952f54e8e365d75e0df56da39298fb38066aaa7011b00b2b41649f818", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/asninfo/entry.py", "risk": 3, "size": 2174, "type": "python", "depth": 1 }, { "id": 162, "mol": "H(Cm₂)", "sha": "9abaafcf1eff08fdd51c514a46b062d0c885b27bd726327af5c079f62229e491", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/asninfo/main.py", "risk": 2, "size": 1095, "type": "python", "depth": 1 }, { "id": 167, "mol": "H₂(DbOs)", "sha": "83d98615fb3dfd54c12fd9b6e8fa5eafe46c8d453403efce65e444a072d36cc0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/auto_fix/entry.py", "risk": 3, "size": 2202, "type": "python", "depth": 1 }, { "id": 168, "mol": "H₃(CmDbPo)", "sha": "aa2f0666745b7b4f7bc5dedd81fa8823399cabc2f733b600e5a55e4794c5c3ef", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/auto_fix/main.py", "risk": 4, "size": 2672, "type": "python", "depth": 1 }, { "id": 173, "mol": "H₂(DbOs)", "sha": "ce9d333abc733e119c4ed72d1ce7d915c24bf948a3daaf2c14636ab9c3255593", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/awsenumer/entry.py", "risk": 3, "size": 2309, "type": "python", "depth": 1 }, { "id": 174, "mol": "H₃(Cm₃DbPo)", "sha": "8b5cda05b0348208d44393655246d0eccbe4567f70ff08432837a17c8fa83dd4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/awsenumer/main.py", "risk": 3, "size": 5574, "type": "python", "depth": 1 }, { "id": 179, "mol": "H₂(DbOs)", "sha": "b22679db59563963f4e3107326baa05d1479e017b239472a82bc774761bf4ae2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/azurenumer/entry.py", "risk": 3, "size": 2205, "type": "python", "depth": 1 }, { "id": 180, "mol": "H(Po)", "sha": "d818bb31747a4bcf4fbd736d76f0f49914989be8f7baca3387fb6f1c3063d472", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/azurenumer/main.py", "risk": 2, "size": 575, "type": "python", "depth": 1 }, { "id": 185, "mol": "H₂(DbOs)", "sha": "f55969c554a54f88e6cd72dd6af8a4ea5074a813f303d43db2921b8c3d4b2048", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/backuphunter/entry.py", "risk": 3, "size": 2113, "type": "python", "depth": 1 }, { "id": 186, "mol": "H(Cm₃)", "sha": "4669afadab0a035366dedc58c57efbb9bf51460bb5ecfd48acbc8b07870cfe5d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/backuphunter/main.py", "risk": 2, "size": 1544, "type": "python", "depth": 1 }, { "id": 190, "mol": "H(Po)", "sha": "5c09592e70ce6c5e43af233126265327b6465b89e431df0c355814e5563a39fe", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/__init__.py", "risk": 2, "size": 1070, "type": "python", "depth": 1 }, { "id": 193, "mol": "H₆(Cm₇DbFOs₅Po₄U)", "sha": "ed8c4bdbf2d57cbcc15a4f0150050977f2118febf53f0211206fabd95b19bb3b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blueteamer.py", "risk": 13, "size": 26683, "type": "python", "depth": 1 }, { "id": 196, "mol": "H₂(Db₂Po₃)", "sha": "8586c8ab36d8412ce4f47bb2381f669eb2c12fc1c3f89d51f789e2641f4b1563", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/ai_engine.py", "risk": 6, "size": 12714, "type": "python", "depth": 1 }, { "id": 197, "mol": "H(Db)", "sha": "eeaff8fe2460578eefcc670c98b0ffbda66cb9ca4a4ad4fd36bdf3bcf8146c23", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/cases.py", "risk": 2, "size": 11671, "type": "python", "depth": 1 }, { "id": 198, "mol": "H(Db)", "sha": "7cef078b012734ce8372433fe2eb082186c8fc0a00726425fc9234ce478489a1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/config.py", "risk": 2, "size": 4719, "type": "python", "depth": 1 }, { "id": 199, "mol": "H(Po)", "sha": "027b1611b3e2864c8eb5284114ec77db32682d745974c690cca700159a41afe4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/console_ui.py", "risk": 2, "size": 13905, "type": "python", "depth": 1 }, { "id": 201, "mol": "H₂(DbOs)", "sha": "663e49a567b4ef930101470b061d6400c84f9659ad762396e9187189b96c9626", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/enforcement.py", "risk": 3, "size": 7574, "type": "python", "depth": 1 }, { "id": 204, "mol": "H₂(CrDb)", "sha": "f81e6d2aa9b84ef3948367bbd5dfec7a3923ccc75b4aea69608825514b2cce09", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/knowledge_graph.py", "risk": 3, "size": 8893, "type": "python", "depth": 1 }, { "id": 205, "mol": "H(Db)", "sha": "e217d97ad0ea5b21d6b28025009bac313255498c38549517a50f0f53e8eec909", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/learning.py", "risk": 2, "size": 6718, "type": "python", "depth": 1 }, { "id": 207, "mol": "H(Db)", "sha": "6d5618617b212010793f008a015d5bd6b82de3039f3c5ff870bc5a460700b982", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/ops.py", "risk": 2, "size": 8757, "type": "python", "depth": 1 }, { "id": 208, "mol": "H₃(Cm₁₂FPo₂)", "sha": "8f19629b4d9bc0411afa1ca15c35c69dabe206b2ae37d831317f82f8734c85bf", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/proxy.py", "risk": 6, "size": 9070, "type": "python", "depth": 1 }, { "id": 209, "mol": "H₂(DbF)", "sha": "144c5db77dcb2589a65b3a2abe481cea03d59e13f5d30b9d02924d5ca06ee432", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/retention.py", "risk": 3, "size": 9709, "type": "python", "depth": 1 }, { "id": 210, "mol": "H₂(CrDb)", "sha": "55e1ead8536bcf43d33a0d4e0880e54b06cb08720618d9eeb146cf72558b3229", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/session_manager.py", "risk": 3, "size": 4875, "type": "python", "depth": 1 }, { "id": 211, "mol": "H₂(OsPo₂)", "sha": "19689920ee398347816216a05f84f605e1c815566b2f98c2d4a8544b3d48739b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/session_runner.py", "risk": 4, "size": 16482, "type": "python", "depth": 1 }, { "id": 212, "mol": "H₄(CmCrDb₂Po₂)", "sha": "80d46cb56b5063baa76c0230847f6bd616b4d4774a54b380e431a798f0067b44", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/subagent_manager.py", "risk": 6, "size": 12307, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%Fi$y\u0026%qiBz(8laAz4ax(!xpC{89%LPU6YwGUA4B7Gk$y-)?kwGUC#B.8X7xjU$5asHVowft@bwO=fiay]IbC4C.E3joJ]o*}#Sk%[7eavoiNl}73Cm[$fPlpJWUiV})FB.8Xqz/oDkaz++nwGUY8aARpdx(UtmCwXKzwOkZ#BAhTHvqYP.vrb{4A+fc0wD", "ln": 0, "col": 1, "line": 1 }, { "b": "wN)ffazk?9A+6i0x(1]lA+eW3zdNQbdj$@Ka%Ev3w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGuc(x(d*cA=-BBBZ/rgz!0v1A%-lYwmYu}uUaa!c[dg:arR^Hw].*baAIWtyh4MrzeS%cy?mVuvR*f#By!($e]klhe[eTtwGUY7AbP=saz2C5z/Pu0zdNQb3jm)#arUYoBAIRwaz2C5z/Pu0zdNQb3jma+aMwSo\u0026/[%oBzbkdA+e($B98CFiV@rGzdK?wj%hm=zy=]sA+uIoAaJJgay]58v@=p5BzkVhdiNSmFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z3jmbJwO95(vR*f#uVYZ%Aa%zxx(D9QB98BNaAIa7z/f9biV@3Jz^^-gjS(ZpfF1tPA+xCOay]g@BrAZ?ph+2YdiHiaaAITBiTM#LarUopz/3RrB.LP8zz2^AwozZ1B1Q{rB.bVavqNSkx\u003c@Y7y\u0026%qwwmYv:zGxwwByxiex(\u003eFize:AlBrCdjxjkB:3jm)#arU8njS[fNxlbhlAV/ZS3lQDlaz2C6vp%d1B98BJx(CHLay]51vr\u003e1Mx(kthy\u0026r:7c$a-vwPPsAB7F\u003c1zE^/jefG1Bv@Dl}B15kIAV/Bmv@Dl}B15T.", "ln": 509, "col": 35, "line": 10 }, { "b": "arUYoBAIRwaywX$w*/8XB7GxnwNxa?zE[9jz/^yDefFBNaAITBc$a-vwPPsAv@DmbwO#P%BA}?pa$K\u0026Xvq{g4x\u003e7N[x(v(xyiarha$j@\u00263jmbJwO95(vR*f#uUi.ZwHIIaBz9YTB98BBjS\u003e{)efFzuwo*iUB98BBjS\u003e{)efG1QvruTkiV@cOBrAZ?gb7ykayPq6B2\u003eBOx\u003e8lcjS)HrzE\u003emteJ$p#BAfzHarR^HvivYQvrc14aA8oyDWMkzarR!CauZ\u0026*", "ln": 2027, "col": 3, "line": 60 }, { "b": "x(W={Bye:3d06GJc$a-vwPPsAx(CmEazC^zaA8oyb0Nn2efG1QAWUuGxjVfkb6v{xa$K\u003cVA+)fEz/M%AxMOunB2\u003e%cwQ4T2Abo8rx(n95y?WAkxM4^1D2NXza$j@F3jprPw/$C\u0026y\u0026%q@v{%m-A^o6Pz!\u0026{4iV@G=AV^H/a%FMXzF%SdiV@G=AV^H/a%FMXvrc14iV}%Ev@@?RawM\u0026)wHO-Nj%j]*AYKKIarR!nauZ\u0026QA+xCoz/M$EEf}8tarUYoBAIRwaywX$w*/8Xvrci(v{%m-A^o6OBAe^re[X:qc)A+KyH}xcefG4MyH}xjaA8oya%FD!aAITBc$a-vwPPsAzF%Sda$K\u003cOz//LtaA8oya%FD+3jmbJwO95(vR*f#uT)H", "ln": 2507, "col": 22, "line": 72 }, { "b": "xJ(\u0026#A3[{Lf/BC5DUuRhAa9\u003c4cTx}qg+-i-asIOItpjrbBy=?9trjO{u41dCazbLjazq)izxJRbBApUrf/q0$t).X%arUYoBAIRwaz8*Ay?mGjxLzNfdsAsGvqYH]C{3^mBsqhVi:uLBar?{Uar\u003e6darR\u003cXyhW*7c#rQnwPGpc3jprPw/$C\u0026y\u0026%q@w]zZ1wNt", "ln": 2962, "col": 27, "line": 84 }, { "b": "wPx*Ox(n95y?WA*By=OsxKM0]C4CXpBzbkdvruQ1v@2T@ayP8bwNPa{aAITyy?kjya%EvparR!sA=k!qAa9\u003c4y?Wu3x(d*cA=-B2vrue\u00263lQDlazbUjz6i[xx\u003e?v1e]tJqB.\u003eSge]USnBy]Diz7YTsvLheezGx]dzGG}xx(d*cA=-B6o\u0026bg+nM2)5arR^HvivYQvrc14aA8oyDWMkzarR!JxN7Z-aAITBc$a-vwPPsAA+eW2z/c:IaAz44B8L}BaA8oyb4twhwGUz]wO#PldgdguarUXEjS)NfBz974o\u0026bg+nM3#WfczDLx(4P)w]zZ1wNxE@Byxo5a{]CnarU=DC@=oParR^HarR!Ee{ztIBy!*3wQ5qBCw8mJ3lQDlarR^HaAz4nB-Ivxc\u003c?7tarR^HarR^HarUnumO=]Hmj?zkr6:FLaAz4kB.bSowN(]iDV%dGEjlq#FrRf#xK@r1x(4Pdy**=}ze0)fB0a)lw].C", "ln": 3192, "col": 25, "line": 89 }, { "b": "arR^HarS9uarR^HwQ4Y@Ac9i#q:\u003e.Ez/M$eB0b3P3lQDlarR^HaAz4nB-Ivxw*fV:A=k$VaBvWFa{[U:uQNgPm[3rKrA0m3k#Z/LqCHdkjS(cWarR^Hb64JyePLCCfcR}OarR^Hb64JyePLCCEJ*rIarR^Hb5IacB1OT/3lQDlar\u003eubazCBJa$K6zarR^JiW=C7auB)hclNZ#iWc9ZarR^Hb0Eb5wmY{qB7uEC3lQDlar\u003e(uB-.ejCwXPQ3lQDlar\u003e\u0026qvScgba$K6zarR^JxKL.0a$K6I3jmbJwO95(vR*f#uVP)(y?$IfzdCWIB98BBjS\u003e{)efFwwxlc9RwnbK}auZ\u0026xz/fbnat2=1B98B-3lQDlar\u00260Nm}3HJwft@bwO=f9\u0026^^moBzbkdvR*f#ayO[]zGEmEay/C6vrujbwGUP9wO2y\u003cz6j4pBz8!qwN)ffazk?9A+6i0x(4\u0026K3lQDlay[[#xjVa4B-OWAvruQ5A=b}vA+e\u003c9B7F(8B-82bB8@E5ry]!Opg3p!r8l\u003c!p/74=rZ/e[A=\u003e}Ca%FirarR^Hx(d*cA=-BxA%-l%arR!nauZ\u0026QA+xCoz/M$EEf}8tarUfjzeAZ0wfs2TB98BJvj(h7BsntyzdB?way/n0diJLHar\u00260U3lQDlazCBgzF%Rtv@Dj3vqYQdB98CpA40d@3lQDlarR^HaAz4nB-Ivxb1lJ)z/N(Yv@k:0A+flkx(W=}a{]CnarUGsCox3\u003ev@Dj3vqYQdy\u0026sJeAWSv?A+fiavpJ\u003c%a%n6Xar\u00260U3lQDlazCBgc\u003c?7tarR^HarU9gC{)R:y\u0026sJeAWSv?A+fiavpJ\u003c%a%n6Xar\u00260UazCZoy\u0026sIuw]zYjA3e\u003ejayvJ5pdE-JpGpt2p^F5Wmn=(VdgdguarR^HarU9gwft/ie[F{zx(Xcfe[X:qc)zO\u0026nLhMHuQmW\u003epHuy:p/p7\u0026miTo9a%FD*y\u0026sJeAWSvVaW3}(BAhIna{]CnarS9]3lQDlarR^HaAz4nB-Ivxc\u003c?7tarR^HarR^HarUnuqBK5Pq:\u003c8nay/tbzddr)az\u003eLev}YB{ayMy6vqYZ?A=l8waAg+hBy/GgasIODz/6u1zE=%jhzwA+\u0026^^)Pe*a87BrBHZnLhMHuQmW\u003epHuy:p/p7\u0026mlL:kB.8XqzY\u0026$wwPz*9wmWwq3lQDlarR^HasNTuarR!GA^oXMarR^HarR^HAb](bauZ\u0026*BZ/rgz!0v1B1RGQzywZkfjFTkflp!JefDb*v\u003ciDDv@Dj3vqYQYefFChAcckywNxv#Bz#wAjYDDAwH[%CwQ5qWrc0a)efG4GzdNTdBuIAldgdguarR^HarUPBBrAZ?c#:iBv\u003eI?Awn=QjaA8oya%FDUd\u003cck*b3Y1\u0026B97@7A=LCda%nxUAb](be]#bBwPz/uazCBgAb](be]#bBwPz/lwO=B0ar\u00260U3lQDlarR^HaAz4nB-Ivxw*gC\u003cCXImxDVj1zv\u003eI!kBAIRwv@C)?Eo^$xz/{eaiY5JAfKo8JazCBgz/{dOB98CpA40dTwO=B0az8*4wQ4{haBw6Fz^$zuwPS6nzEWP}wQN\u0026bc#J@Cz/{evB-Y5R3lQDlaz2!cwPh-lB9g@hA=kD0B8@%kx(dB1B-Z5%Aa%u7wi75uarR^HarR!EwPS6nzxHb(A=M8siV}{JzeAZ0wft#dzdNl2z/{dAc]iL#diY9warR!rCW\u003er7BrB1%v}xR3x(v(ivriM5iV]K\u0026az#aqvlbI$oHQS?f^bFaLPU3XwO=f9wPz*fA=SviA+cw7vrt]+arR^HarR^HA+funA=91ib1lJ)z/N(YDU4QH3jma+az$R8wGSM*asH\u0026tefF)", "ln": 3635, "col": 3, "line": 101 }, { "b": "By=OoBz\u003e#bzxK4tyH}y8azCXfwN]H-By/ola$k5IarR^Hb4twhwNxH(wO=fbiV]?TvR*f#uVP)(y?$TBtoWM]wfLqgar\u003cZazxJvgB7/c3y-)kazeAZ0wfrpkvru6\u003eiV}%wzF9K3z/{azAa9\u003cgwPzWfaz$+4wfs/JnLhMHuQmW\u003epHuy:p/p7\u0026mjxAfedc!j3jprPw/#bjB-.h4vR*f#uVZj8y::gfzdL:JB98BNayPq6B2\u003eBOx\u003e8loay/r", "ln": 6188, "col": 78, "line": 161 }, { "b": "Bsq3nzdLd6arR^Hx\u003ewG0zGG]AazC)tph+2YiTM#LarR^HarUfgz/YFjjS)%DazbLjaz@rozxIntryHm]pFTU.azCBgzEEx[ayPd#az$R8wIe4yy?W#tb3#Jytp?NnazCZozE3EcgHgtgarR^HarR!EwPS6nzxJKnrC(O\u0026z*c7wvR*f#aARKuy-[7xvqPN0A^W", "ln": 6609, "col": 26, "line": 170 } ], "depth": 1, "facts": { "imp": [ [ "", "engage" ], [ "", "str" ], [ "", "min" ], [ "", "float" ], [ "", "a.get" ], [ "", "min" ], [ "", "float" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "_enf.block_ip" ], [ "", "_enf" ], [ "", "str" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "_enf.unblock_ip" ], [ "", "_enf" ], [ "", "_enf.blocked_ips" ], [ "", "_enf" ], [ "", "str" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "_enf.serve_honeypot" ], [ "", "_enf" ], [ "", "str" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "_enf.fake_response" ], [ "", "_enf" ], [ "", "int" ], [ "", "a.get" ], [ "", "_enf.redirect_ip" ], [ "", "_enf" ], [ "", "str" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "_enf.arm_canary" ], [ "", "_enf" ], [ "", "str" ], [ "", "a.get" ], [ "", "str" ], [ "", "a.get" ], [ "", "_enf.canary_hits" ], [ "", "_enf" ], [ "", "len" ], [ "", "str" ], [ "", "a.get" ], [ "", "Path" ], [ "", "r.write_text" ], [ "", "str" ], [ "", "a.get" ], [ "", "command.strip" ], [ "", "command.lower.replace" ], [ "", "command.lower" ], [ "", "any" ], [ "", "p.lower.replace" ], [ "", "p.lower" ], [ "", "os.environ.get.lower" ], [ "", "os.environ.get" ], [ "", "subprocess.run" ], [ "", "out.strip" ], [ "", "BLUE_TOOLS.get" ], [ "", "name.split" ], [ "", "str" ], [ "", "fn" ], [ "", "sorted" ], [ "", "BLUE_TOOLS.items" ], [ "", "lines.append" ], [ "pathlib", "Path" ], [ "suijin.modules.platform.lib.constants", "TMP_DIR" ], [ "suijin.modules.blueteam.lib.blue", "enforcement" ], [ "suijin.modules.blueteam.lib.blue.defense.tarpit", "engage" ], [ "", "os" ], [ "", "pathlib" ], [ "", "subprocess" ], [ "", "suijin.modules.blueteam.lib.blue" ], [ "", "suijin.modules.blueteam.lib.blue.defense.tarpit" ], [ "", "suijin.modules.platform.lib.constants" ] ], "mbr": [ "BLUE_TOOLS.get", "BLUE_TOOLS.items", "_enf.arm_canary", "_enf.block_ip", "_enf.blocked_ips", "_enf.canary_hits", "_enf.fake_response", "_enf.redirect_ip", "_enf.serve_honeypot", "_enf.unblock_ip", "a.get", "command.lower", "command.lower.replace", "command.strip", "h.ip", "h.note", "h.path", "h.ts", "lines.append", "name.split", "os.environ", "os.environ.get", "os.environ.get.lower", "out.strip", "p.lower", "p.lower.replace", "proc.returncode", "proc.stderr", "proc.stdout", "r.write_text", "subprocess.TimeoutExpired", "subprocess.run" ], "tgt": [ "BLUE_TOOLS.get", "BLUE_TOOLS.items", "Path", "_enf", "_enf.arm_canary", "_enf.block_ip", "_enf.blocked_ips", "_enf.canary_hits", "_enf.fake_response", "_enf.redirect_ip", "_enf.serve_honeypot", "_enf.unblock_ip", "a.get", "any", "command.lower", "command.lower.replace", "command.strip", "engage", "float", "fn", "int", "len", "lines.append", "min", "name.split", "os.environ.get", "os.environ.get.lower", "out.strip", "p.lower", "p.lower.replace", "r.write_text", "sorted", "str", "subprocess.run" ], "funcs": [ [ "_enf", 597 ], [ "_blue_tarpit", 812 ], [ "_blue_block", 1182 ], [ "_blue_unblock", 1463 ], [ "_blue_blocks", 1675 ], [ "_blue_honeypot", 1819 ], [ "_blue_fake", 2114 ], [ "_blue_redirect", 2392 ], [ "_blue_canary", 2609 ], [ "_blue_canary_hits", 2802 ], [ "_blue_force_rotate", 3100 ], [ "_blue_shell", 3866 ], [ "route_blue_tool", 6342 ], [ "render_blue_tools", 6987 ] ], "metrics": { "ast": { "op.add": 4, "op.div": 1, "op.lor": 28, "op.sub": 2, "op.land": 2, "max_depth": 16, "call_count": 79, "node_count": 2388, "member_count": 32, "max_array_len": 9, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0.01, "op_density.sub": 0, "op_density.land": 0, "max_concat_chain": 2, "member_depth_max": 4 }, "file": { "size": 7378, "entropy": 4.93 }, "text": { "lines": 187, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.01, "space_count": 1369, "char_entropy": 4.93, "unique_chars": 86, "top_char_null": 0, "string_density": 0.72, "top_char_ratio": 0.07, "avg_line_length": 38.45, "max_line_length": 122, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.23, "last_line_length": 27, "whitespace_ratio": 0.21, "identifier_density": 1.98, "line_length_stddev": 35.4, "normalized_string_count": 9.8, "repeated_char_sequences": 3, "suspicious_string_ratio": 0.04, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 14.58 }, "binds": { "count": 30 }, "binary": { "peak_region_bytes": 7378, "peak_region_entropy": 4.88 }, "source": { "function_count": 14 }, "imports": { "count": 10, "stdlib_count": 3, "stdlib_ratio": 0.3, "third_party_count": 7, "third_party_ratio": 0.7 }, "strings": { "sql": 1, "bytes": 2821, "count": 134, "shell": 4, "url_count": 1, "avg_length": 21.05, "max_length": 537, "path_count": 1, "avg_entropy": 2.77, "empty_count": 25, "entropy_stddev": 1.21, "high_entropy_count": 1 }, "comments": { "chars": 269, "count": 4, "lines": 4, "to_code_ratio": 0.02 }, "functions": { "count": 14, "density": 7.49, "avg_params": 2.14, "code_ratio": 0.58, "max_params": 4, "length_stddev": 5.99, "avg_name_length": 12.86, "no_params_count": 2, "avg_length_lines": 7.71, "max_length_lines": 25, "min_length_lines": 3, "high_entropy_names": 1, "avg_param_name_length": 4.17 }, "identifiers": { "count": 371, "unique": 110, "avg_length": 6.71, "max_length": 19, "min_length": 1, "avg_entropy": 2.22, "reuse_ratio": 0.3, "length_stddev": 4.14, "sequential_names": 8, "single_char_count": 8, "single_char_ratio": 0.07, "high_entropy_count": 3, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.94, "all_uppercase_ratio": 0.03, "underscore_prefix_count": 16 } } }, "id": 213, "mol": "K(Te₄)O₂(CI)H₅(Cm₃Db₂FOsPo₆)Md(In₆)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/tools.py", "pid": 0, "risk": 12, "sha": "3d3fbd5df50ce62c28425b72fd4a26fcfe395b1bed056ee9a80d306c08a7c355", "size": 7378, "traits": [ { "id": "metadata/import/python/pathlib/path::path", "conf": 0.95, "crit": 3, "desc": "imports Path from pathlib", "spans": [ [ 3271, 4 ] ] }, { "id": "metadata/import/python/suijin/modules/platform/lib/constants/tmp_dir::tmp_dir", "conf": 0.95, "crit": 3, "desc": "imports TMP_DIR from suijin.modules.platform.lib.constants", "spans": [ [ 3331, 7 ] ] }, { "id": "metadata/import/python/suijin/modules/blueteam/lib/blue/enforcement::enforcement", "conf": 0.95, "crit": 2, "desc": "imports enforcement from suijin.modules.blueteam.lib.blue", "spans": [ [ 658, 0 ] ] }, { "id": "metadata/import/python/suijin/modules/blueteam/lib/blue/defense/tarpit/engage::engage", "conf": 0.95, "crit": 2, "desc": "imports engage from suijin.modules.blueteam.lib.blue.defense.tarpit", "spans": [ [ 951, 0 ] ] }, { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 4082, 2 ] ] }, { "id": "metadata/import/python/pathlib::pathlib", "conf": 0.95, "crit": 3, "desc": "imports pathlib", "spans": [ [ 3256, 7 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 584, 10 ] ] }, { "id": "metadata/import/python/suijin/modules/blueteam/lib/blue::suijin/modules/blueteam/lib/blue", "conf": 0.95, "crit": 2, "desc": "imports suijin.modules.blueteam.lib.blue", "spans": [ [ 618, 0 ] ] }, { "id": "metadata/import/python/suijin/modules/blueteam/lib/blue/defense/tarpit::suijin/modules/blueteam/lib/blue/defense/tarpit", "conf": 0.95, "crit": 2, "desc": "imports suijin.modules.blueteam.lib.blue.defense.tarpit", "spans": [ [ 896, 0 ] ] }, { "id": "metadata/import/python/suijin/modules/platform/lib/constants::suijin/modules/platform/lib/constants", "conf": 0.95, "crit": 3, "desc": "imports suijin.modules.platform.lib.constants", "spans": [ [ 3286, 37 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 26, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 54, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 3011, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 3981, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 3, "desc": "Python JSON content type", "spans": [ [ 2091, 16 ] ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-command-field-read", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Reads structured task command field", "spans": [ [ 6252, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/tld::reserved-documentation-tld-url", "conf": 0.95, "crit": 3, "desc": "URL uses RFC 2606 reserved documentation TLD", "spans": [ [ 2571, 24 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::broad-exception-bound-catch", "atk": "T1027", "mbc": "C0027", "conf": 0.8, "crit": 1, "desc": "Catches broad Exception into a variable", "spans": [ [ 4978, 0 ] ] }, { "id": "micro-behaviors/data/decode/custom::python-whitespace-only-line-selection", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "Python selects lines containing only whitespace", "spans": [ [ 4155, 19 ] ] }, { "id": "micro-behaviors/data/source/syntax/keyword::function-command-parameter", "conf": 0.8, "crit": 3, "desc": "Python function accepts a command parameter", "spans": [ [ 3864, 51 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::subprocess-timeout-expired-text", "conf": 0.88, "crit": 3, "desc": "Subprocess TimeoutExpired reference", "spans": [ [ 4910, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--returncode", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (returncode)", "spans": [ [ 4801, 10 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stderr-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stderr stream", "spans": [ [ 4723, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stdout-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stdout stream", "spans": [ [ 4701, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::stderr-string", "conf": 0.3, "crit": 2, "desc": "References the stderr stream name", "spans": [ [ 4720, 0 ] ] }, { "id": "objectives/command-and-control/remote-command/tasking::json-command-field-read", "atk": "T1059,T1071.001", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Reads command from JSON response", "spans": [ [ 4123, 12 ] ] }, { "id": "well-known/tool/detection/pattern-catalog::danger-catalog-constant", "conf": 0.9, "crit": 3, "desc": "Module constant naming dangerous patterns", "spans": [ [ 3699, 21 ] ] }, { "id": "well-known/tool/detection/security-scanner::defensive-dangerous-command-doc", "conf": 0.92, "crit": 3, "desc": "Defensive dangerous command documentation", "spans": [ [ 4008, 18 ], [ 4478, 17 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/fs/delete/directory::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Contains an executable rm -rf deletion command", "spans": [ [ 3727, 9 ], [ 3743, 9 ] ] }, { "id": "micro-behaviors/os/env/read::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "spans": [ [ 4353, 14 ] ] }, { "id": "micro-behaviors/process/create/permission-agent::agent-auto-approve-enabled", "atk": "T1562.001", "conf": 0.9, "crit": 3, "desc": "Agent auto-approval boolean is true", "spans": [ [ 4049, 17 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 584, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 4594, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::variable-command-argument", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Subprocess runs a variable-held command", "spans": [ [ 4594, 86 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "spans": [ [ 4611, 7 ] ] }, { "id": "objectives/impact/destroy/keywords::rm-rf-root-command", "conf": 0.8, "crit": 3, "desc": "rm -rf command targeting the filesystem root", "spans": [ [ 3728, 8 ] ] }, { "id": "well-known/tool/detection/security-scanner::defensive-threat-signatures", "conf": 0.95, "crit": 1, "desc": "Defensive threat signature catalog", "uses": [ 27 ], "spans": [ [ 4478, 0 ] ] }, { "id": "well-known/tool/detection/ai-guardrail::ai-guardrail-context", "conf": 0.95, "crit": 3, "desc": "AI-agent guardrail / security-scanner tool context", "uses": [ 37 ], "spans": [ [ 4008, 18 ], [ 4478, 17 ] ] }, { "id": "micro-behaviors/fs/path/public-key::ssh-authorized-keys-benign-context", "atk": "T1552.001", "conf": 0.95, "crit": 2, "desc": "authorized_keys benign context", "uses": [ 38 ], "spans": [ [ 4478, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 33 ], "spans": [ [ 4579, 30 ], [ 4594, 14 ] ] }, { "id": "well-known/tool/detection/security-scanner::defensive-scanner-tool-context", "conf": 0.95, "crit": 1, "desc": "Defensive secret/threat scanner or sandbox context", "uses": [ 37 ], "spans": [ [ 4478, 0 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 40 ], "spans": [ [ 4579, 30 ], [ 4594, 14 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 40 ], "spans": [ [ 4579, 30 ], [ 4594, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call", "conf": 0.9, "crit": 1, "desc": "Process API invocation", "uses": [ 43 ], "spans": [ [ 4579, 0 ], [ 4594, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 40 ], "spans": [ [ 4579, 30 ], [ 4594, 14 ] ] } ], "type": "python" }, { "id": 215, "mol": "H₂(Cm₃F₂)", "sha": "d5bc76a1d4ab4141f331fb1b97e47ac3560744f363c2f497270f079f6461ea6b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/actions/deploy.py", "risk": 3, "size": 8973, "type": "python", "depth": 1 }, { "id": 218, "mol": "H(F)", "sha": "62673c959cfff1a99476f7abd5917d46b8276a031ef28644bc2321aabf39ade9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/codebase/java_analyzer.py", "risk": 2, "size": 1014, "type": "python", "depth": 1 }, { "id": 219, "mol": "H(F)", "sha": "6f7d8ef25d54a53157a2ac31716037090fad2e7a0b9e395ce7e826a8fc9071be", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/codebase/javascript_analyzer.py", "risk": 2, "size": 954, "type": "python", "depth": 1 }, { "id": 220, "mol": "H(F)", "sha": "887bbd3819d0f094cbfab4735cc55b03df4a23bdff529ce2b0317a907d7d202d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/codebase/php_analyzer.py", "risk": 2, "size": 915, "type": "python", "depth": 1 }, { "id": 221, "mol": "H(F)", "sha": "f660a46f864de7b80421a9f23af4b6353c19992520c2d084f193e54e7747d009", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/codebase/python_analyzer.py", "risk": 2, "size": 2264, "type": "python", "depth": 1 }, { "id": 223, "mol": "H(F)", "sha": "e7a62d09bf8e895f94b4e3e9afb140f32fd47b098d4545fe1130596ab496975e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/codebase/sql_extractor.py", "risk": 2, "size": 897, "type": "python", "depth": 1 }, { "id": 225, "mol": "H(Cr)", "sha": "903acba0321338ab1543826beff31bee7a461b25cd70c466b7c505f1147e3afd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/deception/canary_token.py", "risk": 2, "size": 1059, "type": "python", "depth": 1 }, { "id": 226, "mol": "H₂(CmOs)", "sha": "cb645b31a55302b261faaa84258f9f53f4b5fd69d13e8fbb26724bd5a46e8c95", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/deception/honeypot_factory.py", "risk": 2, "size": 1370, "type": "python", "depth": 1 }, { "id": 228, "mol": "H(Cm)", "sha": "52658248f968b812f988a3c1b2d16c1c4c9391550aa601360f9022a44e8e01a7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/deception/time_sink.py", "risk": 2, "size": 1946, "type": "python", "depth": 1 }, { "id": 230, "sha": "e7b1f1fc3b9204033c2358f99bce2c82b1f33c7faa8b5ebaac81baa714ff12f7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/defense/counter_recon.py", "risk": 1, "size": 578, "type": "python", "depth": 1 }, { "id": 232, "mol": "H₂(Os₂Po₂)", "sha": "247650384ee5360013ccd0c210fd8c19f1b51ee552c53979827950febc17db87", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/defense/firewall.py", "risk": 3, "size": 1756, "type": "python", "depth": 1 }, { "id": 233, "mol": "H(Db)", "sha": "b5079e8860635e400793f552598f0279b0c9f10c549bc4b2e1fba9e06fc4cecb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/defense/tarpit.py", "risk": 2, "size": 2278, "type": "python", "depth": 1 }, { "id": 241, "mol": "H₂(DbF)", "sha": "5d0c7e776990dc926f24ca7f3363e67a7f07adc5869f0c4cd6006dd92d614d17", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/traffic/anomaly_detector.py", "risk": 3, "size": 5705, "type": "python", "depth": 1 }, { "id": 242, "mol": "H₂(CrDb)", "sha": "6980f04c1672ed556d593126106e04409739b812a648c22197fb91b559eba767", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/traffic/normalizer.py", "risk": 2, "size": 7593, "type": "python", "depth": 1 }, { "id": 243, "mol": "H₃(CmDb₂F)", "sha": "38305aa6d0ff82cbcc6e8961a8c1e83e7700b971fed57d6b7e40bbc3d662958d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/traffic/replay_harness.py", "risk": 4, "size": 8036, "type": "python", "depth": 1 }, { "id": 246, "mol": "H₅(CmDbFOs₂Po)", "sha": "ee80fbec0b5e8614893c0842f9cfe00f5db4dc3afe298056c40a71c1cdd1c8a7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/tui/feed.py", "risk": 6, "size": 31115, "type": "python", "depth": 1 }, { "id": 248, "mol": "H(F)", "sha": "b652eed4f6d3d041bdacbf1804cba4e3145e883914ab81a3ba24ffc9b9c60281", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/blueteam/lib/blue/watchers/__init__.py", "risk": 2, "size": 8063, "type": "python", "depth": 1 }, { "id": 250, "mol": "H₂(DbOs)", "sha": "3010ab3602687526ad11e3765941b42b58516d4d1d185560eec880d79fa98928", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/bucketprobe/entry.py", "risk": 3, "size": 2206, "type": "python", "depth": 1 }, { "id": 251, "mol": "H(Cm₆)", "sha": "2ee7301aa8f134372eb80b8db53c451b14d6d18b35e90d5271fa77c429a41a41", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/bucketprobe/main.py", "risk": 2, "size": 1864, "type": "python", "depth": 1 }, { "id": 256, "mol": "H₂(DbOs)", "sha": "f6a5d4e08f1a9d7177ed5758d20833a0f58c75f3921a5fcaf34681263d80b15b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/bugscope/entry.py", "risk": 3, "size": 2295, "type": "python", "depth": 1 }, { "id": 257, "mol": "H₃(Cm₅Db₂F)", "sha": "2865550175389a653099855026067971c8666b80a81d3f0715c0b653c91cf4e1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/bugscope/main.py", "risk": 5, "size": 15209, "type": "python", "depth": 1 }, { "id": 262, "mol": "H₂(DbOs)", "sha": "52c1f67af4376894d8b02bb4c94133deea1c59040a5bc3b524163e9ddef012d1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cacheinspect/entry.py", "risk": 3, "size": 2181, "type": "python", "depth": 1 }, { "id": 263, "mol": "H₂(Cm₄Cr₂)", "sha": "7fd2cacd00d0bd0d82dee0492c1d73e36d3efa92fbbedcb61f043bf1ad6eb2a9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cacheinspect/main.py", "risk": 3, "size": 1872, "type": "python", "depth": 1 }, { "id": 268, "mol": "H₂(DbOs)", "sha": "c9929c8e068951d52b3058f546ae752764555ceb42e5ac61244bd520c4490921", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cloudmeta/entry.py", "risk": 3, "size": 2198, "type": "python", "depth": 1 }, { "id": 269, "mol": "H₂(Cm₄Os)Md", "sha": "ae407ad5c42c5435ae3a6bfb58c951e6cd932005e754754f682d94611613d0a9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cloudmeta/main.py", "risk": 4, "size": 2555, "type": "python", "depth": 1 }, { "id": 274, "mol": "H₂(DbOs)", "sha": "009878c9bf2e775707b4e88f7b7f77351c6470e1e214c433ac41f907b5a237dd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cmdsmith/entry.py", "risk": 3, "size": 2230, "type": "python", "depth": 1 }, { "id": 275, "mol": "H₂(Db₂Po)", "sha": "41b3e1f1599eb73d53f9b2de4ba2c2f02ac5e9caf88e977fdd44d427c212d46e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cmdsmith/main.py", "risk": 4, "size": 3054, "type": "python", "depth": 1 }, { "id": 280, "mol": "H₂(DbOs)", "sha": "e3bf59bebe8444097964406fa433e627fcec068fd2041e034a11734aeeaeb9e0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cmepack/entry.py", "risk": 3, "size": 2191, "type": "python", "depth": 1 }, { "id": 281, "mol": "H(Po)", "sha": "8c011b72c4ba518baa48120ffeea75e82cfca4324f5a218ac5d0242e8573c012", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cmepack/main.py", "risk": 2, "size": 656, "type": "python", "depth": 1 }, { "id": 288, "mol": "H₃(Db₂OsPo)", "sha": "b099358261b321cf46f208da8842c0c86e9123b0d7e7d2a2d0e59771a5668f16", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/console/lib/_engage_worker.py", "risk": 4, "size": 1156, "type": "python", "depth": 1 }, { "id": 289, "mol": "H₅(Cm₄Db₃F₃Os₄Po₂)Md(Pa)", "sha": "0bf6f7cfa7322cae2e8ddd27ed820ee694b47c0d6d2f4feadb11da4ebeeeae7b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/console/lib/cli.py", "risk": 16, "size": 95759, "type": "python", "depth": 1 }, { "id": 290, "mol": "K(Te₂)H₃(Cm₂DbOs)", "sha": "b159244cf165e823abf225c70d305ca3f77d2e27453906991efc6bc73bcb27be", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/console/lib/mcp_server.py", "risk": 5, "size": 18472, "type": "python", "depth": 1 }, { "id": 291, "mol": "H₃(CmDb₂F)", "sha": "a4e4fed8fff811ee8354da41db252580d5d95f67d1a63d0e7922a5e84efa4a69", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/console/lib/tui_scope.py", "risk": 4, "size": 7964, "type": "python", "depth": 1 }, { "id": 292, "mol": "H₂(Db₂F)", "sha": "52c554f92211882a846d72cd60935f6b75ccb658b28ceb031fd96ee62a4f2a98", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/console/lib/tui_settings.py", "risk": 3, "size": 10988, "type": "python", "depth": 1 }, { "id": 293, "mol": "H₄(Cm₃DbF₂Po₄)", "sha": "2003536767a32d8e03b40fed11c9d7902c3dd4e56310fce9db6d44f7ea60dbd2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/console/lib/gateway/__init__.py", "risk": 9, "size": 18895, "type": "python", "depth": 1 }, { "id": 296, "mol": "H₂(DbOs)", "sha": "2c352dbbd9a20429c79b3b7bdf0e31a38b78c953069b2e781e32a7558f668ed4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/containerbreak/entry.py", "risk": 3, "size": 2312, "type": "python", "depth": 1 }, { "id": 297, "mol": "H₆(Os₄Cm₃DbF₅HfPo)", "sha": "bed31bfdf436dd2d95df07af7ad2bd240985341ca0510bbebe5e75bbf0be3105", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/containerbreak/main.py", "risk": 46, "size": 6379, "type": "python", "depth": 1 }, { "id": 302, "mol": "H₂(DbOs)", "sha": "309cfcd569f6782ba4db544ddca1444d9a0ff30e413c9c5b4074b870b9d4d032", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cookieaudit/entry.py", "risk": 3, "size": 2108, "type": "python", "depth": 1 }, { "id": 308, "mol": "H₂(DbOs)", "sha": "7c4fd2f389e663668a2646639d0bbab22e999bf69e2ba16f0bbf7ec86038be84", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/core_utils/entry.py", "risk": 3, "size": 2204, "type": "python", "depth": 1 }, { "id": 309, "mol": "H₂(CmOs)", "sha": "ec5712100f724ffc31bd132eab34226e0f611615bed40ca84a535ced04bf6c6b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/core_utils/main.py", "risk": 2, "size": 1531, "type": "python", "depth": 1 }, { "id": 314, "mol": "H₂(DbOs)", "sha": "32f30c003de48ea5746316b945acc2de9e6ff925ea2b74d2c3d482c768bfffef", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/credential_store/entry.py", "risk": 3, "size": 2230, "type": "python", "depth": 1 }, { "id": 315, "mol": "H(Db₂)", "sha": "35e63d42ac14a7ad51bb0de227c23acc6c7b778ce4e8e28c17b12c320924aaf6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/credential_store/main.py", "risk": 2, "size": 2915, "type": "python", "depth": 1 }, { "id": 320, "mol": "H₂(DbOs)", "sha": "ab263032df160d73d210bef7acf0466b56a67446fdab0cf73c75f332791e28c9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cronkit/entry.py", "risk": 3, "size": 2185, "type": "python", "depth": 1 }, { "id": 326, "mol": "H₃(CrDbOs)", "sha": "ebc862843702ba8d7737f398b7cfabc2d7497591a3b06115fd374a16a5640af9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/crtsh/entry.py", "risk": 4, "size": 2170, "type": "python", "depth": 1 }, { "id": 327, "mol": "O(Dy)H₂(Cm₂Cr)", "sha": "3d27a998ccd1d6745ff442751b0352d779e8dd11b71c67fb2e732e9fc64d5a50", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/crtsh/main.py", "risk": 3, "size": 517, "type": "python", "depth": 1 }, { "id": 332, "mol": "H₃(CrDbOs)", "sha": "b2cd281098c6295afe284e185da030f79eb13a88c2121fe10c3986583ba16881", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/crtshq/entry.py", "risk": 4, "size": 2181, "type": "python", "depth": 1 }, { "id": 333, "mol": "O(Dy)H₂(Cm₃Cr)", "sha": "d6e3143b4d0e2f7436650cea61cfe96941f1c7fd4362216258b916455d3b4d69", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/crtshq/main.py", "risk": 3, "size": 1613, "type": "python", "depth": 1 }, { "id": 338, "mol": "H₂(DbOs)", "sha": "ec0f7a4c18f6fb4d7b00b970696d77cb48d58f5423a32159bace3b49479cb6c3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cryptomisc/entry.py", "risk": 3, "size": 2209, "type": "python", "depth": 1 }, { "id": 339, "mol": "H₂(CrDb₂)", "sha": "28130665290282927074b0e09c5d34596da60d61245f0bf38776254926f93531", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cryptomisc/main.py", "risk": 3, "size": 1294, "type": "python", "depth": 1 }, { "id": 344, "mol": "H₂(DbOs)", "sha": "8bcae8295ef15a88d1f052b3d59122307a763e91e7b25d655b08ea53e9950b77", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/curl/entry.py", "risk": 3, "size": 2251, "type": "python", "depth": 1 }, { "id": 345, "mol": "H(Po₂)", "sha": "56c7b2df70acc4d5a271ccaa6d3aed04a7582fbcc15a081958534897a1873dd3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/curl/main.py", "risk": 2, "size": 437, "type": "python", "depth": 1 }, { "id": 346, "mol": "H(Cm)", "sha": "0dc9d28f353b40e9fd6dc32fba0edd4d66e9c86dfdbdf1063db4cfc9d560a693", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/curl/manifest.json", "risk": 2, "size": 508, "type": "json", "depth": 1 }, { "id": 351, "mol": "H₂(DbOs)", "sha": "a0e7eb7b0703ba401127049b45d42ad060500117c2a437c74ed91ad5ae4043c8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cvelookup/entry.py", "risk": 3, "size": 2101, "type": "python", "depth": 1 }, { "id": 352, "mol": "H(Cm₄)", "sha": "c14f69197d9555aa20415d7b3fadc2b160b8f6391e06c46f1e327987310481a2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/cvelookup/main.py", "risk": 2, "size": 1845, "type": "python", "depth": 1 }, { "id": 357, "mol": "H₂(DbOs)", "sha": "a9923863ad584d821691fec6e707dcce5e40d0287f47ffc9e0810911b05afa9c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/devtoolsk/entry.py", "risk": 3, "size": 2218, "type": "python", "depth": 1 }, { "id": 358, "mol": "H(Db)", "sha": "3289ddb7064855bfaf80d988415b10ced544d90caeab556814b195f94817a4de", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/devtoolsk/main.py", "risk": 2, "size": 3478, "type": "python", "depth": 1 }, { "id": 363, "mol": "H₂(DbOs)", "sha": "f4482f22e2dc22fa27392ce1bd580c97afd33bf4c8539fba893f2fd4e791c072", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dirsearchp/entry.py", "risk": 3, "size": 2107, "type": "python", "depth": 1 }, { "id": 364, "mol": "H(Po)", "sha": "e931e30d85d568d44f8aedefb42fa3296fe8d0b5f0dc048aab2de21bac74a62b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dirsearchp/main.py", "risk": 2, "size": 779, "type": "python", "depth": 1 }, { "id": 369, "mol": "H₂(DbOs)", "sha": "eda6ce43fb47c53da7f3c67cb549fe145bca98b22b73f59324e5755fb133fbc9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dns_zone/entry.py", "risk": 3, "size": 2184, "type": "python", "depth": 1 }, { "id": 370, "mol": "H₂(CmPo)", "sha": "e8d7eafddd839571d5ded5bc276d197d510e37dc8d4e27d91fb5875d6b97ec59", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dns_zone/main.py", "risk": 3, "size": 1249, "type": "python", "depth": 1 }, { "id": 374, "mol": "H₂(DbOs)", "sha": "cacd4dbffded32708d6c30b45a6dd2d0428457275770ca65e4f1db56a487d8cf", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnsbrute/entry.py", "risk": 3, "size": 2182, "type": "python", "depth": 1 }, { "id": 375, "mol": "H(Cm₂)", "sha": "9784765b1b3e61740e4242233861a3ca53620453e88751b4836f5321bd332d93", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnsbrute/main.py", "risk": 2, "size": 1263, "type": "python", "depth": 1 }, { "id": 380, "mol": "H₂(DbOs)", "sha": "1d9e755b23a8c5063145898d184249b57bb164fc2ac4ad2fec6abb88a0e456f0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnsreconp/entry.py", "risk": 3, "size": 2202, "type": "python", "depth": 1 }, { "id": 381, "mol": "H(Po)", "sha": "c2a90151ffb26a00108b8647644aacb2f93188970caad38f8ba7bd40ed0bb214", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnsreconp/main.py", "risk": 1, "size": 526, "type": "python", "depth": 1 }, { "id": 386, "mol": "H₂(DbOs)", "sha": "9d84ab1dab258cea137a1c0506a7c94d007fbc6d95d8d69e65d67d5b3dcd602d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnssec/entry.py", "risk": 3, "size": 2183, "type": "python", "depth": 1 }, { "id": 387, "mol": "H(Cm₃)", "sha": "2725934ec8e9ef80239e884790d30246cadeafff7120f3d276438028c0b940f9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnssec/main.py", "risk": 2, "size": 2818, "type": "python", "depth": 1 }, { "id": 392, "mol": "H₂(DbOs)", "sha": "c1a33c53feee8df280e26b1e773d4d75eb08afcb64bff41b4fb860ab316941b4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnssniff/entry.py", "risk": 3, "size": 2197, "type": "python", "depth": 1 }, { "id": 393, "mol": "H(Cm₂)", "sha": "d330f3385134e581d18eb0bdfbba2aa5531c375379a71170fa42c5f9582fd445", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dnssniff/main.py", "risk": 2, "size": 851, "type": "python", "depth": 1 }, { "id": 398, "mol": "H₂(DbOs)", "sha": "5a4db036b9f66597b6ac6d0769d108f67d6d98b54d6830d6139ea30d0247d270", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dohquery/entry.py", "risk": 3, "size": 2207, "type": "python", "depth": 1 }, { "id": 399, "mol": "H(Cm₄)", "sha": "25cd7e929fa29c53396a013615208028ad0268a7eef48149ba4b6563096cbd0a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/dohquery/main.py", "risk": 2, "size": 1753, "type": "python", "depth": 1 }, { "id": 404, "mol": "H₂(DbOs)", "sha": "eae82ec14f1822e0ac5895fc9e8f547b6204c33021bed326a6658113159d9798", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/emailharvest/entry.py", "risk": 3, "size": 2187, "type": "python", "depth": 1 }, { "id": 405, "mol": "O(Ca)H(Cm₃)", "sha": "d3b77acefd89fc43bdec8d5833c3d2efe313ee3a8f23634f6bd32258fcbad9cb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/emailharvest/main.py", "risk": 3, "size": 1298, "type": "python", "depth": 1 }, { "id": 410, "mol": "H₂(DbOs)", "sha": "ae3190a5dc1ad15c195848c7fa768143c12e79f4a85134e3e3237eb5658def59", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/encodesk/entry.py", "risk": 3, "size": 2197, "type": "python", "depth": 1 }, { "id": 411, "mol": "H(Db₆)", "sha": "b4beeacc79f502188c4715a6b404d0e8f1ab5ac689491f9554e91c9370a9c2ef", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/encodesk/main.py", "risk": 2, "size": 1769, "type": "python", "depth": 1 }, { "id": 416, "mol": "H₂(Db₂Os)", "sha": "d9fe9a837f01a33501deb301a71bc8d8dca0af84cf00601facbe7d3cc36a9b37", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/execute_terminal/entry.py", "risk": 4, "size": 2334, "type": "python", "depth": 1 }, { "id": 417, "mol": "H₂(CmOs)", "sha": "2f2b0394396e7e3306ec550c79be45a19c00de73813842e195fc23548f686377", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/execute_terminal/main.py", "risk": 2, "size": 1081, "type": "python", "depth": 1 }, { "id": 418, "mol": "H₂(DbPo)", "sha": "1bbe4d75473f20b79f5b756f73474352776f4418eb14fcdc4270058f63f7afc4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/execute_terminal/manifest.json", "risk": 2, "size": 505, "type": "json", "depth": 1 }, { "id": 419, "mol": "H(Db)", "sha": "1eea417b9e588347d15cd5313ab613142c4104ebbc690736b3070b9e77abc683", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/execute_terminal/plugin.json", "risk": 1, "size": 516, "type": "json", "depth": 1 }, { "id": 420, "mol": "H(Db)", "sha": "42b7c6e5bb42d2cdd492492166d8de904f301e7a472f1c2ecca23900979663ea", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/execute_terminal/skill.md", "risk": 2, "size": 2811, "type": "markdown", "depth": 1 }, { "id": 422, "mol": "H₂(DbOs)", "sha": "f9632267cb57003eaf617131470e9dad179368a779eb3918da08ce40de9b2a8c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/exploitdbp/entry.py", "risk": 3, "size": 2179, "type": "python", "depth": 1 }, { "id": 423, "mol": "H₂(OsPo)", "sha": "7b64258cbe1cafabb258ca49daace1b39816f1057877fd373eee85906b4c0563", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/exploitdbp/main.py", "risk": 2, "size": 579, "type": "python", "depth": 1 }, { "id": 428, "mol": "H₂(DbOs)", "sha": "cf8258ea2809947966818992658622225a9cc6cf9b3b19a912258fe385affbda", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/extractr/entry.py", "risk": 3, "size": 2214, "type": "python", "depth": 1 }, { "id": 429, "mol": "H(Db)", "sha": "c2165de8e9f189875d1dc61d2c43c0480d3cf9cef98a0d25e9abe5276ddeab4b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/extractr/main.py", "risk": 2, "size": 1092, "type": "python", "depth": 1 }, { "id": 434, "mol": "H₂(DbOs)", "sha": "a174ccc20049980ada8191a2501ab214d695ad9d13b3fba889da448a10fc5666", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/feroxbuster/entry.py", "risk": 3, "size": 2211, "type": "python", "depth": 1 }, { "id": 435, "mol": "H(Po)", "sha": "4f5df9a3734b31e5a6b42918e9c76f2ddcffb6a3b9e4cadf601c7c61a9bef77f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/feroxbuster/main.py", "risk": 2, "size": 502, "type": "python", "depth": 1 }, { "id": 440, "mol": "H₂(DbOs)", "sha": "b28f4fdd1d1dbd3485ae6d5a9f4fdd9c30d754c8b4a0693839822e65c6d745fa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ffuf/entry.py", "risk": 3, "size": 2184, "type": "python", "depth": 1 }, { "id": 441, "mol": "H(Po₂)", "sha": "5d33debc2f261b89ae0042a26acd23962241f2f512bcc1734bcab045fb7667f8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ffuf/main.py", "risk": 2, "size": 403, "type": "python", "depth": 1 }, { "id": 446, "mol": "H₂(DbOs)", "sha": "dbb601203e456abf0a7ff5aaaa441e8e0fa055f2934b431923e9978d18092ea7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/fileio/entry.py", "risk": 3, "size": 2217, "type": "python", "depth": 1 }, { "id": 447, "mol": "H(Cm)", "sha": "001300c57a6c273d31e7432a485e2ce2221ee561b88cd1a0b00a16627af65ad5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/fileio/main.py", "risk": 1, "size": 836, "type": "python", "depth": 1 }, { "id": 452, "mol": "H₂(DbOs)", "sha": "fe5f80a66da1f5083b351228d4be6049b7eb19da8eb54d3230be95bc9fc75907", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/filekit/entry.py", "risk": 3, "size": 2183, "type": "python", "depth": 1 }, { "id": 453, "mol": "H₃(CrDbF)", "sha": "46c87266337d42e089335f1e18a3ea565a4bb5fd83e95d795417585eaa2d2799", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/filekit/main.py", "risk": 3, "size": 3877, "type": "python", "depth": 1 }, { "id": 458, "mol": "H₂(DbOs)", "sha": "67c68729dd067be88e779bd6587c9b19a68d75cb9866f86888ebe890c04db578", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/gcpenumer/entry.py", "risk": 3, "size": 2184, "type": "python", "depth": 1 }, { "id": 459, "mol": "H(Po)", "sha": "5fb6d032d0e995c7373e6008808b56436e0662658fe33734aa0c5529720ef530", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/gcpenumer/main.py", "risk": 2, "size": 572, "type": "python", "depth": 1 }, { "id": 464, "mol": "H₂(DbOs)", "sha": "bd0b93788709cbe3a70387961c88236814294f0a3559940134a5af5a919c6767", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/genkit/entry.py", "risk": 3, "size": 2178, "type": "python", "depth": 1 }, { "id": 470, "mol": "H₂(DbOs)", "sha": "8be162cd6deda23be14e93f9caf3b25ee8f8b9cb922dd43cad9775f670310f9b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/githubdork/entry.py", "risk": 3, "size": 2205, "type": "python", "depth": 1 }, { "id": 471, "mol": "H₃(Cm₅F₂Os₂)", "sha": "167a65110472e8d4645259b0b8a385563dca7ddb3415500960b98b532c07fffd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/githubdork/main.py", "risk": 4, "size": 1849, "type": "python", "depth": 1 }, { "id": 476, "mol": "H₂(DbOs)", "sha": "e5167859bbb11f8dfe8b276177c904aa106f46dcf8d518b308020e4597d02a95", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/gobuster/entry.py", "risk": 3, "size": 2182, "type": "python", "depth": 1 }, { "id": 477, "mol": "H(Po)", "sha": "0428f7327a3ee8038ed17086eddbb4257f61b8c9406a446a31dc9ffa675c306e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/gobuster/main.py", "risk": 2, "size": 815, "type": "python", "depth": 1 }, { "id": 482, "mol": "H₂(DbOs)", "sha": "4bb9adffe74fb94009631309c4422134e827d56f2088e1d34097c271bbf21a0e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/google_dork/entry.py", "risk": 3, "size": 2201, "type": "python", "depth": 1 }, { "id": 488, "mol": "H₂(DbOs)", "sha": "8c4a3bac419da3da326780a9fb431ebc4984345f005853569b61a57d1467acf6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/graphql_diff/entry.py", "risk": 3, "size": 2200, "type": "python", "depth": 1 }, { "id": 489, "mol": "H₂(Cm₅Db)", "sha": "3d1beb3caace21d765146bf10d28f64de2c71893ab943f663fd7ad16d4453d43", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/graphql_diff/main.py", "risk": 2, "size": 1004, "type": "python", "depth": 1 }, { "id": 493, "mol": "H₂(DbOs)", "sha": "3e1162d7f36e02a74e23b7758855674c3ac6d721e2de12e246423d5b5872bcb7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/graphqlprobe/entry.py", "risk": 3, "size": 2205, "type": "python", "depth": 1 }, { "id": 494, "mol": "H(Cm₅)", "sha": "b42d096642f8f40d4828b912c3425d821b47cd9a263fbfec55de3fd845fb076a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/graphqlprobe/main.py", "risk": 2, "size": 2682, "type": "python", "depth": 1 }, { "id": 499, "mol": "H₂(DbOs)", "sha": "34ff93a532d79006c691d708c2b011525e5c424d5d965f777418261ff077d919", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/gvm/entry.py", "risk": 3, "size": 2167, "type": "python", "depth": 1 }, { "id": 500, "mol": "H(Po)", "sha": "b461e8559ed8bb390f9d841d9162fce44224920257ef7d6ea2a318b3939ee1b6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/gvm/main.py", "risk": 2, "size": 900, "type": "python", "depth": 1 }, { "id": 505, "mol": "H₂(DbOs)", "sha": "c2c85e0e5126a60bf7ca7e73b4d5dbb71ac1afed81ab76f059c28a2cdff2c6a8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashcatp/entry.py", "risk": 3, "size": 2093, "type": "python", "depth": 1 }, { "id": 506, "mol": "H(Po)", "sha": "e767d4d81a6ebad91b665e62d79381a627105d0250cb542499be0de383a755ba", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashcatp/main.py", "risk": 2, "size": 936, "type": "python", "depth": 1 }, { "id": 511, "mol": "H₂(DbOs)", "sha": "d2e4dcf962689d50c34ccf051ccb749d86a9649f8d69dbe138441499b91f64e4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashcrack/entry.py", "risk": 3, "size": 2217, "type": "python", "depth": 1 }, { "id": 512, "mol": "H(Cr)", "sha": "3d213f126a65e0bb6cfba6560897376dc8d69e2253198e69b866393f680967de", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashcrack/main.py", "risk": 2, "size": 1369, "type": "python", "depth": 1 }, { "id": 517, "mol": "H₂(DbOs)", "sha": "3aa8879310516e834f3395eca9c6e234a526091fb442f0d0296ac7ccc88e2256", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashid/entry.py", "risk": 3, "size": 2193, "type": "python", "depth": 1 }, { "id": 523, "mol": "H₂(DbOs)", "sha": "e51059138857882dd7f596aade552e2f3696e8e0f7598c9238d91b6b7af7d59e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashkit/entry.py", "risk": 3, "size": 2099, "type": "python", "depth": 1 }, { "id": 524, "mol": "H(Cr)", "sha": "efc61a0f7b437821f9b489893cba0a2e1443b51a9a23802e216ad16fdbed16c4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hashkit/main.py", "risk": 2, "size": 1103, "type": "python", "depth": 1 }, { "id": 529, "mol": "H₂(DbOs)", "sha": "0024e98b583c6b0f6e8c5b6ae5e1054f57b80a456d6c4ebc2061275f3f62d6b3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/headeraudit/entry.py", "risk": 3, "size": 2217, "type": "python", "depth": 1 }, { "id": 535, "mol": "H₂(DbOs)", "sha": "4d58f8846d78eca7fade15d618a0fd1649c8f9fcac28c07fec5e3107682dfd3d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hostheaderi/entry.py", "risk": 3, "size": 2205, "type": "python", "depth": 1 }, { "id": 536, "mol": "H(Cm₅)", "sha": "b9cf4cbbc2690fac1c29b361e2c6af7f7d377d8de3d43ecd03962c7a645986bd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hostheaderi/main.py", "risk": 2, "size": 1367, "type": "python", "depth": 1 }, { "id": 541, "mol": "H₂(DbOs)", "sha": "d5c527e2b193cf827dfae6eb3e5c5bfa202dcc15a25e07ea0696d4371817986e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/htmlparse/entry.py", "risk": 3, "size": 2210, "type": "python", "depth": 1 }, { "id": 547, "mol": "H₂(DbOs)", "sha": "dbf770d3e6aec4f96174bb6d6566c9cfa1ffc415663e4fd38434aa63e3a0203a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/http_request/entry.py", "risk": 3, "size": 2301, "type": "python", "depth": 1 }, { "id": 548, "mol": "H₃(CmDbOs)", "sha": "460a10b92cd2bdb49b6de2b37596d50590af711af5defd9559388cac7edb9cf3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/http_request/main.py", "risk": 3, "size": 1111, "type": "python", "depth": 1 }, { "id": 553, "mol": "H₂(DbOs)", "sha": "58124aa2dec306fee4f46e7e0f0f2dfb8b501ae2506bb56dd22a14156cc1eceb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/httplive/entry.py", "risk": 3, "size": 2096, "type": "python", "depth": 1 }, { "id": 554, "mol": "H(Cm₃)", "sha": "e047f5b0202d3f21acac5596b27df024ead47b2f65dcd1d9df3bd6b92afa1ba1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/httplive/main.py", "risk": 2, "size": 1096, "type": "python", "depth": 1 }, { "id": 559, "mol": "H₂(DbOs)", "sha": "1eb609236799d1aa5b9616719fe34dbd423989d79ad9cb85d7fb9c2c3f00208f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/httpmethods/entry.py", "risk": 3, "size": 2104, "type": "python", "depth": 1 }, { "id": 560, "mol": "H(Cm₃)", "sha": "b07a8a3c7e312f020b60d0c9af588067905e645e2cd0aeede52ebbe494819ef9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/httpmethods/main.py", "risk": 2, "size": 1498, "type": "python", "depth": 1 }, { "id": 565, "mol": "H₂(DbOs)", "sha": "bbc5a774161438afafcccb7d74cf6a372d7b97fdb709cdfd481be6230ff42d68", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/httpx/entry.py", "risk": 3, "size": 2096, "type": "python", "depth": 1 }, { "id": 566, "mol": "H(Po₂)", "sha": "ffb385374d6c3b4b113a24e94424d0be87882b9e638d9c3ad86435dd45ca1a06", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/httpx/main.py", "risk": 1, "size": 396, "type": "python", "depth": 1 }, { "id": 571, "mol": "H₂(DbOs)", "sha": "ed7947ce567bef7646c8d0acd4fb11d0ef9ed4ca9a575836f250d59ef033a0dc", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hydra/entry.py", "risk": 3, "size": 2178, "type": "python", "depth": 1 }, { "id": 572, "mol": "H(Po)", "sha": "ff53373f73b2299ce6a8ef8a4673e8aa0a24f62cb81cad20271ceecb6c275661", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/hydra/main.py", "risk": 2, "size": 382, "type": "python", "depth": 1 }, { "id": 577, "mol": "O(Ca)H₂(DbOs)", "sha": "f091d755d617ca1a18a5cb079af6e4853d80a2c72aecb3c357b65d9c33669936", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/imppack/entry.py", "risk": 4, "size": 2187, "type": "python", "depth": 1 }, { "id": 578, "mol": "O(Ca)H(Po)", "sha": "1fcae5b53b52c5ca9a0ee18d269e23bb61fe05701f0ba82a9143121e2f1fccd9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/imppack/main.py", "risk": 40, "size": 1061, "type": "python", "depth": 1 }, { "id": 583, "mol": "H₂(DbOs)", "sha": "6294da2962224c8a7a76c7a8d7736f5c106c9ceed62daaeabf3b0ebd5f1af806", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ipastatics/entry.py", "risk": 3, "size": 2199, "type": "python", "depth": 1 }, { "id": 584, "mol": "H(Db)", "sha": "c22edc9458f28fa29fab92b7f00e3567fe5a1e5dad2154dd78c2904d30398215", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ipastatics/main.py", "risk": 2, "size": 1685, "type": "python", "depth": 1 }, { "id": 589, "mol": "H₂(DbOs)", "sha": "912b49886592769eab5db83dc5ff54039ad656b1744bc745b7629524a619e716", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ipmath/entry.py", "risk": 3, "size": 2195, "type": "python", "depth": 1 }, { "id": 590, "mol": "H(Cm)", "sha": "53a8732269c5d743dc23e96c16a53c1f20f0f5eaafbcfd56220e35fa17dc6383", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ipmath/main.py", "risk": 2, "size": 1210, "type": "python", "depth": 1 }, { "id": 595, "mol": "H₂(DbOs)", "sha": "f50d15714cc0a2f45a36e245aeb0e1bce3589290677fb352b8d09d7c1dc5c562", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/iprepq/entry.py", "risk": 3, "size": 2054, "type": "python", "depth": 1 }, { "id": 596, "mol": "H(Cm₅)", "sha": "4c2bc06b2d7796985bc9ca3b0ee2d8279f7c3ff9b3353eb6df03cc76b4edc71a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/iprepq/main.py", "risk": 2, "size": 1429, "type": "python", "depth": 1 }, { "id": 601, "mol": "H₂(DbOs)", "sha": "47888026100a5a3814629e26058854084c7be23c4c7ef83273aaed078cb59109", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/iptables_control/entry.py", "risk": 3, "size": 2116, "type": "python", "depth": 1 }, { "id": 602, "mol": "H₂(OsPo₂)", "sha": "737b60b17b497e47ad4291c6a26f060d17237ee9c9d539b7243f7aab2eb872ea", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/iptables_control/main.py", "risk": 2, "size": 648, "type": "python", "depth": 1 }, { "id": 606, "mol": "H₂(DbOs)", "sha": "c64ea9412b231eb8231b921adf696c6ce688e58e34d6917e4170b6e69dec115c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/john/entry.py", "risk": 3, "size": 2195, "type": "python", "depth": 1 }, { "id": 607, "mol": "H(Po)", "sha": "4afbe6d7d1b9d9be1725e255fed6d9001d33a65c4c735a637029db6e0b7dc8ed", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/john/main.py", "risk": 2, "size": 674, "type": "python", "depth": 1 }, { "id": 612, "mol": "H₂(DbOs)", "sha": "c439adc5a54713fd9f951d0edf9d4bb3ff8c06b5bba30412cb803c3cdf8e7d93", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/jwt_tool/entry.py", "risk": 3, "size": 2182, "type": "python", "depth": 1 }, { "id": 613, "mol": "H₃(CmCr₂Db₃)", "sha": "145b0de32990210bedb4cd3fde53ae25e72b73cadc80591654dbec0dc5e320f1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/jwt_tool/main.py", "risk": 5, "size": 2534, "type": "python", "depth": 1 }, { "id": 617, "mol": "H₂(DbOs)", "sha": "fa88aab2f6fa2625694fa9a00f319f16370ad6921aa3fa2b9afc3b5ccece10a0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/jwtlab/entry.py", "risk": 3, "size": 2205, "type": "python", "depth": 1 }, { "id": 618, "mol": "H(Db₃)", "sha": "352512ae8f9191b2ec45c35d7e2fbec83720f295c6b429f180fa3820010645b4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/jwtlab/main.py", "risk": 3, "size": 1954, "type": "python", "depth": 1 }, { "id": 623, "mol": "H₂(DbOs)", "sha": "91aedf822eba42e71a954fbf44e9d4bc513b17b2546faaf63c0d39c377b9a800", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/katana/entry.py", "risk": 3, "size": 2180, "type": "python", "depth": 1 }, { "id": 624, "mol": "H(Po₂)", "sha": "dc2ec13b99806e9e468c51a7bf682a608f1a565b77598a1dc70e1ee107a2e910", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/katana/main.py", "risk": 1, "size": 382, "type": "python", "depth": 1 }, { "id": 629, "mol": "H₂(DbOs)", "sha": "6506a40ce45c8323a9143b1fafaf750250e4f99a48c7d212ab0a64e995c380ef", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/kerberos_attacks/entry.py", "risk": 3, "size": 2205, "type": "python", "depth": 1 }, { "id": 630, "mol": "H(Po₂)Th", "sha": "f54755a01fded35e57a60723ae6f5f14b4a9e358eac024a4b09cfe1ef4f6d4cf", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/kerberos_attacks/main.py", "risk": 38, "size": 1868, "type": "python", "depth": 1 }, { "id": 634, "mol": "H₂(DbOs)", "sha": "e0fd5be17812b7d5785013c0d8991e46c6207acf53aa1d8154857013643a00dc", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/kerbtools/entry.py", "risk": 3, "size": 2186, "type": "python", "depth": 1 }, { "id": 635, "mol": "O(Ca)H₂(CrDb)", "sha": "935faebb151fe5c02805461e4a52f47d1ae4c78411f8163fb1f7bfea00224faa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/kerbtools/main.py", "risk": 41, "size": 2125, "type": "python", "depth": 1 }, { "id": 640, "mol": "H₂(DbOs)", "sha": "4cb4450cc434b75c6471b16d91c7373900c47e213dab8cdc330bdf086201e35d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/kg_neo4j/entry.py", "risk": 3, "size": 2208, "type": "python", "depth": 1 }, { "id": 641, "mol": "H₂(DbOs)", "sha": "08c06a32d1b10d710a15cf33a12a2c71bf6ed4e108baabe61662d9b20d166139", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/kg_neo4j/main.py", "risk": 2, "size": 2827, "type": "python", "depth": 1 }, { "id": 649, "mol": "H₂(CmDb)", "sha": "05d9c5240cad078104a6077b685d2088edcbaafa51119ea1e5492d3a22d8d28c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/knowledge/lib/cve_mirror.py", "risk": 3, "size": 4347, "type": "python", "depth": 1 }, { "id": 650, "mol": "K(Te)H₃(CmDb₄F₂)", "sha": "006170d6305c3f470761df89149776ccef8168fbe2dc80cac7d4698d006cf24b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/knowledge/lib/kb.py", "risk": 7, "size": 22025, "type": "python", "depth": 1 }, { "id": 651, "mol": "K(Te)H₂(Db₄F)", "sha": "0c07a7d4e38508ca29600287ecef0bad8d8663fc97c803a9d69513c1b956ff80", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/knowledge/lib/kb_tools.py", "risk": 6, "size": 17495, "type": "python", "depth": 1 }, { "id": 652, "mol": "H₃(Cm₅Cr₂F)", "sha": "829be13ed42527fbaa2f70bf862d553e2a94aea252c1f33477b27d7c1091c3c3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/knowledge/lib/wordlist_hub.py", "risk": 4, "size": 4349, "type": "python", "depth": 1 }, { "id": 654, "mol": "H₂(DbOs)", "sha": "e90b8785e37d07784a8e53ff79c6ab539995539383c1c82a4a3984cb6b5e2b6e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/knowledge_graph/entry.py", "risk": 3, "size": 2254, "type": "python", "depth": 1 }, { "id": 655, "mol": "H(Cm)", "sha": "29176d6e81a8de2fb30c1306614a76c6cd136026172b9ae7f2e7666297f5daf3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/knowledge_graph/main.py", "risk": 1, "size": 964, "type": "python", "depth": 1 }, { "id": 660, "mol": "H₂(DbOs)", "sha": "3ae66a8f8a197613a5a7fa588543f8d941d902c84424b6915490428c240b4d20", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/log_surgeon/entry.py", "risk": 3, "size": 2110, "type": "python", "depth": 1 }, { "id": 661, "mol": "H₂(DbPo)", "sha": "03f95fb18405e2dc871315f6555a5f26f1e89334c832b324523db7a85e833579", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/log_surgeon/main.py", "risk": 3, "size": 900, "type": "python", "depth": 1 }, { "id": 665, "mol": "H₂(DbOs)", "sha": "84002900950bea8de31d269b36ca15373cb6260cdae42e518f92a357c9b5cc4e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/macvendor/entry.py", "risk": 3, "size": 2190, "type": "python", "depth": 1 }, { "id": 671, "mol": "H₂(DbOs)", "sha": "6e15c5090a726a93543a915433e6973c6016caa2999ee8bab772b77ad1c5049b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_metasploit/entry.py", "risk": 3, "size": 2201, "type": "python", "depth": 1 }, { "id": 672, "mol": "K(Te)H(Po)", "sha": "8dc27daa11ddb57080a756d7a1295885207e568866de3dacd50e7025fb03e252", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_metasploit/main.py", "risk": 3, "size": 972, "type": "python", "depth": 1 }, { "id": 677, "mol": "H₂(DbOs)", "sha": "dded49b96cd2b4e1af7b13dc4727617bb02dbd25cd0a8bbacaae5001e0ca9979", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_nmap/entry.py", "risk": 3, "size": 2172, "type": "python", "depth": 1 }, { "id": 678, "mol": "H(Po₂)", "sha": "2823f7ed1d1c26f5d589b5e00384ea37e24b7c5494769ed87f0868bffc6fee82", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_nmap/main.py", "risk": 2, "size": 1658, "type": "python", "depth": 1 }, { "id": 683, "mol": "H₂(DbOs)", "sha": "200e1b8e31c09e73341758e8d137fa71efba383d3d9ce6ef24d3009b96a4c7b4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_nuclei/entry.py", "risk": 3, "size": 2197, "type": "python", "depth": 1 }, { "id": 684, "mol": "H₂(DbPo₃)", "sha": "251b5d1d964a99a9edf47803131c87b21ff8e7d5e56d2c03be6aabfce8e46139", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_nuclei/main.py", "risk": 3, "size": 1481, "type": "python", "depth": 1 }, { "id": 689, "mol": "H₂(DbOs)", "sha": "0849a975b9ffd4b498a9481d0a17e02afbd47f01912d181d8e0de9a58031d34f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_playwright/entry.py", "risk": 3, "size": 2320, "type": "python", "depth": 1 }, { "id": 690, "mol": "H₄(DbOsPo₂U₂)", "sha": "a7b904d13077508a34e0fc2254ec2cd4f43f684ba176a40172cc4698d662b645", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_playwright/main.py", "risk": 5, "size": 12134, "type": "python", "depth": 1 }, { "id": 695, "mol": "H₂(DbOs)", "sha": "22ee8f06e57ffa537d5745f98a355a3ac3b0e9e70719d7bf1675dc5cfb660bd8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_terminal/entry.py", "risk": 3, "size": 2196, "type": "python", "depth": 1 }, { "id": 696, "mol": "H₃(FOsPo₅)", "sha": "89132b0db51e1ee8e45e3fef873fde6dea06afccb2a34e7452b16b076e5aaa6c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mcp_terminal/main.py", "risk": 6, "size": 3289, "type": "python", "depth": 1 }, { "id": 701, "mol": "H₂(DbOs)", "sha": "b6e4f13cb438feacc3f0a2d8dc982fb3f23fc8119f7a5f466f30f9a32c27a0b9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/medusap/entry.py", "risk": 3, "size": 2170, "type": "python", "depth": 1 }, { "id": 702, "mol": "H(Po)", "sha": "b454b9f3293438704d3b257400a3ff042cb09fe9b7f2fc088a15add263cd0628", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/medusap/main.py", "risk": 2, "size": 1017, "type": "python", "depth": 1 }, { "id": 707, "mol": "K(Te)H₂(DbOs)", "sha": "1c1eef3684913d5ab45e5474f05cd69b40afb7499bf8ef1da8863365432fd571", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/metasploit/entry.py", "risk": 4, "size": 2208, "type": "python", "depth": 1 }, { "id": 708, "mol": "H₃(CmDbOs)", "sha": "5b79778df372088ffc6864b40bc1dcbc7e0379f951b2b1f021da797b2e0c60a9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/metasploit/main.py", "risk": 3, "size": 1837, "type": "python", "depth": 1 }, { "id": 713, "mol": "H₂(DbOs)", "sha": "8faebc4bc9b0af5ca74ff5b217f519943d4dd96f8736ac7fe007479b13a595e8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mitmproxy_capture/entry.py", "risk": 3, "size": 2209, "type": "python", "depth": 1 }, { "id": 714, "mol": "H₂(CmPo)", "sha": "ab3cdb7020a9bc9bba5a60740183ec05cca81871c02fd510d193ff261448b7d9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mitmproxy_capture/main.py", "risk": 3, "size": 1147, "type": "python", "depth": 1 }, { "id": 717, "mol": "H(Cm)", "sha": "e93a350266923c835c5120444174cd35f2b2d88aec6fc6b7e474b5de5ada2dce", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/mitmproxy_capture/skill.md", "risk": 2, "size": 322, "type": "markdown", "depth": 1 }, { "id": 719, "mol": "H₂(DbOs)", "sha": "c8f1146a9d6e585696b098e6997890aaf201e969214b18fe6108e648f50964e5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/netutils/entry.py", "risk": 3, "size": 2176, "type": "python", "depth": 1 }, { "id": 720, "mol": "H(Cm₃)", "sha": "be2db6a8d334f4474e260214e0c11aa31f938cec117c475765ca86a2db010350", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/netutils/main.py", "risk": 3, "size": 2346, "type": "python", "depth": 1 }, { "id": 725, "mol": "H₂(DbOs)", "sha": "2ce4f3044578960d6d72b2fa44b900281a38f21ec8411e835b70d8bd0b89339f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/nikto/entry.py", "risk": 3, "size": 2229, "type": "python", "depth": 1 }, { "id": 726, "mol": "H(Po₂)", "sha": "f8ee48dcf9139a1333a4c7c0dce15a1f610f1e7cf9a3dcc51c481c623e3ef907", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/nikto/main.py", "risk": 1, "size": 332, "type": "python", "depth": 1 }, { "id": 731, "mol": "H₂(DbOs)", "sha": "0ca9bc0e7e85f23ded45e4f7ca409d9799889ffb35d860a70d78ad353e6853f0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/nmap/entry.py", "risk": 3, "size": 2092, "type": "python", "depth": 1 }, { "id": 732, "mol": "H(Po)", "sha": "8d19e57c210ab0d710b6f33b4eec33b94c45129211b5ad58a659c1947a692346", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/nmap/main.py", "risk": 1, "size": 340, "type": "python", "depth": 1 }, { "id": 737, "mol": "H₂(DbOs)", "sha": "926a9551a88f45699b34b22d33a880563b43f83d8c2c05de6740b160b313636c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/nuclei/entry.py", "risk": 3, "size": 2191, "type": "python", "depth": 1 }, { "id": 738, "mol": "H(Po)", "sha": "ed6ddaa37ea763c159da4c02e1082d54f4c6f04c50a9ea1b8e6e7fc74ea84bcd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/nuclei/main.py", "risk": 1, "size": 435, "type": "python", "depth": 1 }, { "id": 743, "mol": "H₂(DbOs)", "sha": "a17d8a275d1a760581ca9c10add10e13a8df21dd679a9bb8eb7c168fe828ef07", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/openapi_parser/entry.py", "risk": 3, "size": 2202, "type": "python", "depth": 1 }, { "id": 744, "mol": "H₂(Cm₄Db)", "sha": "dd2348d7873601ec6e92bebb19fb2e3aaa9616e3c07b7b38883e6174996479f9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/openapi_parser/main.py", "risk": 3, "size": 1081, "type": "python", "depth": 1 }, { "id": 748, "mol": "H₂(DbOs)", "sha": "e3bb19ef0dee33b5483135409ed1d0ec2c8041ff4dd28590cd33dd9a366f60b3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/openapik/entry.py", "risk": 3, "size": 2188, "type": "python", "depth": 1 }, { "id": 749, "mol": "H₂(Cm₃Db)", "sha": "8b624f2bfcd6cfffae71ae4979ae12a0fc6f460fd7b46c6fc523c9791e927b4c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/openapik/main.py", "risk": 3, "size": 2581, "type": "python", "depth": 1 }, { "id": 753, "mol": "H(Po)", "sha": "7eba7f9e8557f19a5e4244525fe8af9c93f9aefbd3e94a1290a2a60c6539fc97", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/__init__.py", "risk": 2, "size": 1235, "type": "python", "depth": 1 }, { "id": 756, "mol": "H(Db)", "sha": "20c06288b4c9e0e993161897ccb76458321e4811b8489f893cc39fc302ab1d70", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/approvals.py", "risk": 2, "size": 5662, "type": "python", "depth": 1 }, { "id": 757, "mol": "H₂(Cm₃Db₂)", "sha": "b811f713dd644e4392c19b53e41ee9132436923369334796f49f94a143287d0f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/authorizations.py", "risk": 4, "size": 15278, "type": "python", "depth": 1 }, { "id": 758, "mol": "H₄(Cm₁₁Db₂FPo₄)", "sha": "1e0d7b3691fd9bba939c84b82906e42d579d250ce5d5bfd7275cbdc177148cfa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/battle.py", "risk": 8, "size": 14413, "type": "python", "depth": 1 }, { "ctx": [ { "b": "vS=y3BrCydvJW7nz!y[FxK#0@efGdPA+6cfwPI]zaA7XhBz8/RFrRf/vpJ%[CwhejayLQ)zF%-pazbB#xcp]aC4CMkz/QaLefF$QzGu}xxK@q{xjU$5asI8Bv@0i9AV/gjC4A9NaAI4hA+fqM3ta9.xlbh9vq{shA+e=jaARKuy-)j@y\u00261ezay/thBsXLGBy/G3BzkVhB1OOkwPJ0gBAnNzwPz\u003caB95KDzWHA9Bz#wAB1.0lzEWukxLzKfz/QaQyiarhazbLjaAz4fwNPT\u003eePk/zAXhryy?m3@wGV8nwO#33BAg/1yIvW0e^.}Wz!0M9zeS@@asH=iBy/Gfx(mTaBzkkoavwZHiV@GNA+PGmwN(]SoIDTIwPhD]D2\u003e9GwNPx$Bz(8lay!?@y\u0026Y}(xjkH(B95KDxK@r5x)a5gy**=}\u0026^^moBzbkdwQ4S[BrCKpAaJ\u003c1zE\u003c@hwNPyZvQTw2y?j.veP2AoyAN+vwPGyfwQ5rdzE^r?aA}KwxDQ]6vp{Y]CYW$mv@#B6zxJw9wft\u00265AXh9ovJY-4z/PMfxd+raxK@rcv@=p5BrCEjC4CX3wO\u003e)/woe(9y**%0C42ifwPG)PwP?T9C{3Znvp{Y%zxK4mwGV57z/PziCvtLnxjU$6x(mG#C{4csBn", "ln": 83, "col": 14, "line": 3 }, { "b": "x(n3haAIWmB7GulwO#PjA+flkwPI%mdj$@Ka%Ev3w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGuc(x(d*cA=-BjB9RUkx(st)ze:AlBrCstz/b[@ze:AlBrCQn3tBu@z/P}xBzkP63tar%z6i!aBzbG8vJYx4AbP=saw=G*xBk8ooHhfQqBIY\u003eaAz3Cv@Dj6x(4ueAW0$Dk$tgbtv8.-d{NGDdgf3IogqP.qBIY\u003eaAz3Cv@Dj6x(4ueAW1}4v}x.5uVZj4wO$Z1tQ0DrtYRx0iZ3+NB1gxwtQ0D4tr%\u0026Avj=^VeJEfyeNrYT", "ln": 691, "col": 18, "line": 13 }, { "b": "zGYPeBz(hBaAg[jaz+E}asH\u0026uAV/Bkz/PMfxdjfYk%!{FoHhfEauZ\u0026]3lQDlar\u003eSuxeBWywO=fbiV}SJmOD9rDU^Rkg\u0026)twy\u00260E0v}x1\u003cx\u003c\u003ev-zE^D*h90uDEiI@F3lQDlar(2FA+6cfwPI]piV}SJmOD9rDV%BoB7F\u003c4wPRo#z/Z2ch90uEEiHi+b1tl(m%/D0uVQj6x\u003cUW{xk8l\u003cvTh{3B8$XCiwrprb3=-barR^Hb5Z[jBz8\u003cVax{3VoHhf}z^^^gxKt[6wPzc^y?Wx\u003cuO%?$gjpt$ar\u003coGk$uouvrDW9uV*B3A:Jo]vQy#MfFX52efDcaoHhf}z^^^gxKtgUze0({Ab]Vox(4u[wNvqPfFX52t}us9arR^Kay/bcvpS}=iV@DOvqE5#y**%$aA8dlC{89%LPU6YwGUI{v@DSnC42i3wmoN\u003eB0b76y\u0026:egvqYP#zE[05AV/Bkz/PAg3lQDlar\u003erfBywY\u003ey:7[.tm8F}arR^HarR\u003c$oHhf}v}*3[wmYN:x\u003ehd5uU17+Ba2k-3lQDlarR^Har\u003coGk$uoix()=]wO+Z]z/o-8A:@Wea$K6zarR^HarR^JmOD9rDT*=ivpS}=uV]\u003e2y\u0026\u003c2]A=letEiHiHarR^HarR^Hb1tl(m%!-WBywY\u003ey*QW-z^M{{z*-/X3lQDlaycJ9Ef{rPk%!{PpF$d\u003cauZ\u0026]3lQDlar\u003eSuxeBWywO=fbiV{pufF+l!arR^Hb6N%C", "ln": 969, "col": 15, "line": 27 }, { "b": "w/$D8z/PSmAa9l/uU0\u003e\u003ec[cn\u003cj%iWgBz9YxarR^Hw].*baAIWtyh4MrzeS%cy?mVuAbn%8w]zZbe]klhe{zkOyJBD6v}u=%ze:AlBrBTXqCf}+k%[7Fl}Hn-3lQDlaAz4nB-Ivxs5hZ!q=2+EmpeCOqvi:rwmYu}uT^O:v}YjWx(UQJat2=1p*[DViTM#LarUhqjS[8", "ln": 1614, "col": 3, "line": 49 }, { "b": "B-Ivxc#:iBv}x.5efDbXdj#-szxJL1x(4{jwGSx@z/fbqaz2Olz/NoVa%FirarR^Hx(d*cA=-BxA%:3jarUxnAbP=saAIWmAb](bwPI]1arR^Hx(d*cA=-BBD2\u003cr1arR^HboQ=oy?$k5zH3tqx(mMaB8=thBAzkmxcqbgaARpdaAhmtBrCgfA=VsBc$l+eBrCdbw]zZidgdguarU=DC@=oParR^HarR!Cx\u003eetHaAIWmAb](bwPI]BA=(mFtoW)8z!pgAar\u0026yVx^b8Jw*fo.AbP=sEiI@Fay!\u00260BAIRnuVg7eAclm=rc0a)efG4CCYV8FA=\u003e}AaARsmwP8ZkjU[JtB97@hB-YlSBAh8mc[bGCarR^HarR!vw/#5bwi75uarR^HarR^HarR!FBZ/rgz!0v1B1RGQzywZkyIvQ3a$K\u003cQx\u003ee\u0026qBAh8mc[eBMaARsmwP8ZkjU[I]arR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiV]K\u0026az#aqvlbI$oHQS?f^bFaLPT{-A=-Bly?m3)B-nEqB0a}6B95Kow[C$4Bp6ckarR^HarUSiB8}V}arR^Hvq{f)Aa9\u003c4auZ\u0026zvrufhuTEzVy?l%Xdk2TL", "ln": 1935, "col": 33, "line": 62 }, { "b": "gHhaRar\u003eSgvJ({Faz8*Ay**!3uU\u003cdWa%nJYb4kCfe]V7W3lQDlazCBgzF%Rtvq{f)Aa9\u003c4e[GowB98EKdlnN]boQ(nCp^(TD2d4mwnc6bzEEx[asI5mvLqk9BywY\u003e", "ln": 2431, "col": 49, "line": 75 }, { "b": "ar\u003elkA4V9Pa{]CnarUxgaz#atayPkduVoB}xF9\u003evx(!xqc[dg:arR^HarR^HA+funA=90{z/fbqaz8*lvpyu%z/^alz/]@diV@=TAbYf6vrugha{]CnarR)Kv@bZ+AV^?/vrlibBy/rdaAITkBy=Obz/M$vwPhi?BywS{wGV57z/PMfx9]+7arUomAV/EvA3e\u003ejax{3yBzU$ICw?IjAb]JhB6\u0026-(vLhh2a$K\u0026Xflz5IfjF:uwNw$Vw[t\u003c\u003cuVZr%w[C:!e]2DCzFQHFar\u0026EXze.dHB.LP8zEl)/BywY\u003ey+xmcb3^kparR^HarR^Hp*[DVd0frBdk2:Xy?W^5c#AWtB7]J8uVfZyrc0a)dgdguarUSzz^%[MaAIWmAb](bwPI]Bp\u0026yq:zyt\u0026marR^HarR!hB9R*VwQ4=@B-.53y?kduB98BJvq{f)Aa9\u003c4dp1FiarR^HarR^HB97@hB-Y=/BZ/rgz!0v1B1P\u003cHr.=T*oE{I[arR^HarR!FByX%6AY[F^vSlvav}x.5e\u003c@cepe%$Yed9HxarR^HarUlkC0gg4dSowXwO#W9A=k?Dar\u003cSTqDa\u00263aAITBc#:9BBszR?3lQDlasNTuarR!vze:AlBrCQnADL\u0026lBAm=@arR^Hw]zYjuM:62aAy[dxjSFFfEY3\u0026arR^HarR^HBAhT/3lQDlarR^HarR^HaAz4kB.bSoB1R9pBsp-BxMOuniXJcvgb**te?![ji^U*:A==Z.a$K\u003cUx(dB1B-Y=3dgdguarR^HarR^HarUYoBAIRwaAhvtv\u003en-Da{]CnarR^HarUluv}xR3avQJ+wPh:9z/dPyarR^HarR^HarR^HBzkP6e]$\u0026uwPf4Ke\u00262pk3lQDlaAhvtv\u003eILhy?$HG3lQDlaAz4nB-Ivxph+2YefFKGy**=}DU^b1Eircgx(4u\u003eaARJAvScgbaA8cui^U*:A==ZN3jmbJwO95(zeS{1uVPZ$x(Fexy**^laAITBefF[IA=:t+x(n2wat2=1y?W%jtv.CTBx{{marR^Ha%Fjfv@=p5By!#9oIwe6BAIRwB2\u003eB:wNPx$", "ln": 2625, "col": 71, "line": 77 }, { "b": "wNP7Zaz+E}cVZzCzF%-pazbB#Cxkwz3lQDlayGLyr8ldQpjmK#aAhd9v}xs(y?d9$B0a[iwGUP0y\u00260V[ayPvmA=(nwx(dA7w].*baAhvnz/M$xz/oCmz/{evB-W%kao", "ln": 3490, "col": 54, "line": 102 }, { "b": "ayX=2wGTbUw*g]gBz%n]fekjve?![ie?]zlAbP=sEiG1varR!sz/PXqjS]7}lVl\u003c:wO#Pwrc-B]b03?\u003cvq{g4x\u003e7N[x(v(xCRab-Cp^ABA=0yJA+]r8v@C)?wfMBearR^HB7ol8AccdzjS]7UarR^HarR^Hb5zggg\u0026)twy?$pRax]f}arR^HarR^HarR!N3lQDlarR^HarR^HarR^Har\u003el7BzkVhb03?\u003cB-Rb3Bz(8la$K6zarR^HarR^HarR^HarR^JBz(8luV6p?wG\u003ceTb4#7uA9)S%ADL\u0026lBrSmyarR^HarR^HarR^HarR^Hb6m:wy*QQ\u003exlbmTaBtqHwPRQ7wfK5Sb1C73a$K\u0026XB-IpxiV@2UDTZA8wQMjuv@#\u003c4Bz(gMv@Dl%x\u003eFSred9HxarR^HarR^HarR^HarR\u003eIxM53axMLBVar\u003eSkvqu#%zGWdCx\u003c\u0026b}CYmOxwN(](v@#\u003c4Bz(gzed9HxarR^HarR^HarV7-3lQDlarR^HarR^Hao", "ln": 3736, "col": 4, "line": 108 }, { "b": "arR^HarR^HarR^HarR^HarR^Hb6v{xb03\u0026Ub70^cB7G+Mvq]{lB7F^2v}W5q3lQDlarR^HarR^HarR^HarR^Har\u003eGgvpS}\u0026B0rT/DM(EhwPxv*xjU$5b03?\u003cbZTozwna8vwmoBrfe3)Wx(2zkCWUDdy?kndEiK7\u003c3lQDlarR^HarR^HarR^HaBL^FarR^HarR^HarR^HarR^Hb6mHpB.txfb03?\u003cyhNM@azC.dwN/*@z/cXvx\u003c\u0026b:B7Gwzl1:+DBrSmyarR^HarR^HarR^HEjLZFarR^HarR^HarR!N3lQDlarR^HarR^HarR^Har\u003el7BzkVhb03?\u003cB-Rb3Bz(8la$K6zarR^HarR^HarR^HarR^JBz(8luV6p?wG?", "ln": 4294, "col": 1, "line": 123 }, { "b": "m[3x3efDcVA+({Xaz8*AvQTs?Ej]2Fx!KKsvrb\u003c\u003ekxe?iDWxswB#\u00268^k$uuKb7h0HarR^HarR^HarR^HarR^Hb6mHpB.txfb03?\u003cwO#Vly?m3\u003caA?Ecaz+$eg?[dHz/oAlA3u?uarR^HarR^HarR^HEjLZFarR^HarR^HarR!Nb4j#6x(v(kiV]RRz/6DfwPRGcefDcDz/6DfwPRT8zEmA}vrlv8b03?\u003cw]7)*ay!\u00260BAIRnwfu5fviw#*BAI2lz/M%Jao", "ln": 4655, "col": 42, "line": 131 }, { "b": "ed9HxarR^HarR^HarR^HarR\u003eIz/oD0vrc14b03\u0026[b5H[kxM4A9iV]Rpmn$DZar\u003e@Gy:7[.w*hOhvrl1dfl.v!yiarhfl.v*B$$Z[B7Gxkb7h0HarR^HarR^HarR^HarR^Hb6mHpB.txfb03?\u003cB-7SgBzbl6Bzkk[By!#9B-Rbmaz2CkzdN-@BzkVha$K6zarR^HarR^HarR!Ped9HxarR^HarR^HarV1rarR^HarR^HarR^HarR^Hb4j#6x(v(kiV]R?B7FZ2", "ln": 5028, "col": 44, "line": 139 }, { "b": "b03\u0026[b5H[kxM4A9iV]Rpmn$DZar\u003e@Gy:7[.w*hOhvrl1dfl.v!yiarhfl.v*B$$Z\u0026z/Z2wkxyyAA:@=CcM(h.atD2leIee{ed9HxarR^HarR^HarR^HarR\u003eIxM53axMLBVar\u003e(Dy?U25B.#7uvqG:5AbP/tB0bgmv@9+uAb]Vovru68ed9HxarR^HarR^HarV7-3lQDlarR^HarR^HaBsCrarR^HarR^HarR^HarR^JvpKy[z/c:War\u003e@H", "ln": 5317, "col": 27, "line": 146 }, { "b": "a$K6zarR^HarR^HarR^HarR^JBz(8luTW$/B0rT/DKp(rarR^HarR^HarR^HarR^HarR\u003eBwPRQ7wfK5Sb2z6lr3A\u003e2arR^HarR^HarR^HarR^HarR^Hb6v{xb03\u0026Ub70^cB7G+MCw]cIz!A^4e]UGya$K6zarR^HarR^HarR^HarR^HarR^JvSb!5b03?\u003cy\u0026r@HvpTj?zym1/cuaftj:ne43lQDlarR^HarR^HarR^HarR^Har\u003eGgvpS}\u0026B0rT/w]zZbed9HxarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^Har\u003e]vz/]YaBrS:*b6d:ux=}kgxk8lavTh{3B8@JR3lQDlarR^HarR^Hao", "ln": 5568, "col": 43, "line": 151 }, { "b": "b70^cB7G+MBz\u003e@azxZRsarR^HarR^HarR^HarR^HarR^Hb4tF3C{ko(b4\u003e}8zGGlcD2NsTAa9*eCw?IjcuTxvA=br5wJ:Erx\u003e7Z3Aa9*eCw?Ijj:nq{v@Dr$j-tpJzFrSivpTj?zxZRsarR^HarR^HarR^HarR^HarR^Hb4$K@wmY!5b03\u0026Uz/PXC3lQDlarR^HarR^HarR^HaBL^FarR^HarR^HarR^HarR^Hb6mHpB.txfb03?\u003cAa9*eCw?Ijazk.6zGE0KaAI4hz#", "ln": 6445, "col": 29, "line": 174 }, { "b": "arR^Har\u003e@Gy:7[.w*hOhvrl1dflItEA+PA6zZ3.tarR^HarR^HarR^HarR^HarR^Hb4$K@wmY!5b03\u0026[b0*u[xM4{9Dsp]fz/c:War\u003cc-vrb}1aBwDmpFjbKEsiq/ed9HxarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^Har\u003e]vz/]YaBrS:*b6v%rA+PA6zY\u003cmrBz8!dB7nS{vru6\u003eePUAuAaHelz!\u0026{4a$K6zarR^HarR^HarR!Ped9HxarR^HarR^HarV1rarQ", "ln": 6882, "col": 16, "line": 185 }, { "b": "Bz\u003e@azxZRsarR^HarR^HarR^HarR^HarR^Hb4tF3C{ko(b4\u003e}8zGGlcD2NsTAa9*eCw?IjcuTxvA=br5wJ:HvvKu55B8#LzA+4sTcuAWnAaIgJAaJ{3wgI80ze0(ied9HxarR^HarR^HarR^HarR^HarR\u003ewwNPaXA=SA=azbLjz7D2parR^HarR^HarR^HarR!Ped9HxarR^HarR^HarR^HarR\u003eIxM53axMLBVar\u003e=kB8#LzA+3o", "ln": 7286, "col": 37, "line": 195 }, { "b": "Bz\u003e@azxZRsarR^HarR^HarR^HarR^HarR^Hb4tF3C{ko(b4\u003e}8zGGlcD2NsTAa9*eCw?IjcuTxvA=br5wJ:Ejze0(mAa9*eCw?Ijj:ne43lQDlarR^HarR^HarR^HarR^Har\u003eGgvpS}\u0026B0rT/w]zZbed9HxarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^Har\u003e]vz/]YaBrS:*b5*$iB9zLywftJ9vqZffvriM1wnM3#asHVoC{46mB8#LzA+3qpz/PSmdiZqIarR^HarR^HarR^HEjLZFarR^HarR^HarR!N3lQDlarR^HarR^HarR^Har\u003el7BzkVhb03?\u003cB-Rb3Bz(8la$K6zarR^H", "ln": 8115, "col": 37, "line": 216 }, { "b": "aAI4kx(FfntoWM\u003eBywY\u003ey:9dcjS)@oarR^HarR^HDKp(rarR^HarR^HarR\u003epv@#B6zx.a:b6v%ruVZj8y:7zqarR^HarR^HarR^Hb6m:wy*R6*zdK[Lar\u003eGvBz$PcwPq\u003c7B95PS3lQDlarR^HarR^Har\u003e]Cz!@=?A+xCqiV@+RarR^HarR^HarR^HarR^Hb5H[kxM4A9iV]RypG7jped9HxarR^HarR^HarR^HarR\u003eJA+({Xaz8*AvQTs?Ej]2Fx!KHrxk8BewPw$C3lQDlarR^HarR^HarR^Har\u003eGgvpS}\u0026B0rT/DM\u003e*}zGGDcBs*EqAaHjOar\u003elkAbok#vruj4zzb:Cz/c+Eed9HxarR^HarR^HarR^HarR\u003eqz!abqiV@fUz/dgrB.#8sd0)dXB7GxfvqPN1iV]RQwO#0\u003euUaE[v\u003ciDDb5*$iB9zLywfK5Sb4tb3v}Y?9f^nd\u003eb64QrwG\u003ceTb4V1gv%8)cC4z\u003eCdj+/GarR^HarR^HarR!Ped9HxarR^HarR^HarR\u003eIxM53axMLBVar\u003eVhB8@EjB8#5dzF-%5BugK+x\u003eg=$BzbkdA=k=9a$K6zarR^HarR!Ped9HxarR^HarV1", "ln": 8844, "col": 4, "line": 235 }, { "b": "xlbmTaBsCrarR^HarR^HarR^HarR^JzdN*5z!74Mar\u003cSTq=B}(3lQDlarR^HarR^HarR^Har\u003e@Gy:7[.w*hOhvrl1dfkLMtx(kaC3lQDlarR^HarR^HarR^Har\u003eGgvpS}\u0026B0rT/DM\u003e*}zGGDcBs*EqAaHjOar\u003elkAbok#vruj4zzck^CxXl.w]zZbeP(8IwO#0@wmYo}EjLZFarR^HarR^HarR^HarR^JvSb!5b03?\u003cBV\u003chBzEWu!wQ4=@cu8aSwO}", "ln": 9423, "col": 21, "line": 250 }, { "b": "arR^HarR^HarR^Hb6v{xb03\u0026Ub70^cB7G+Mvq]{lCv+k%z/ozned9HxarR^HarR^HarR^HarR\u003ewwNPaXA=SA=aBtq1z/fVdzGEEfD2NssiV]RPAbYScv{%E[z/djyB8L}uEjLZFarR^HarR^HarR^HarR^JvSb!5b03\u0026YB8L}Gwoz:dB0#wVB-IpxiV@2UDTZA8wQMjLwN]H}wN/*DB-IpYxMOuniXJcvgb**te?![jiYe]KiwkL:B.(dMBz\u003e@azx:GTed9HxarR^HarR^HarV7-3lQDlarR^HarR^Har\u003e]vz/]YaBrS:*b4Cp{x(k4WiV}v1qBR^Lx\u003c\u0026c8wN]H}wN/*8Bz\u0026pzxK@rbz//Afx(mMaC42JfBrCWzyH}xced9HxarR^HarV7-3lQDlarR^HaBtqvv@#B6zx.a:b4CLdAbo9cwG\u0026VFb4CLdAbo9cx(v(@A+eW2z/c:War\u003cP\u003cygQ)%x)a5gv@Dj6y?mZ1a$J", "ln": 10153, "col": 5, "line": 269 }, { "b": "B9RUkay]4}azkn6c#AKpB75Y)B3iopzE\u003evwv@Dl%x\u003eGO7z/fbqasX\u003cRCptMWarR^HarR^Hx(d*cA=-BjB9RUkx(tb5B0a*#B9RUkx(ss=arR^HarR^HvrVc]BrB}0B9RUkx(tRBy?mf%c[)ncgarLMarR^HarR!vw/$@4B8$=5wPF#dB0aj@zE\u003c@eAV/7qx(n0lvqYN^c#AKpB75Y)B1wCPBAe/\u003e3lQDlarR^HarR^HaAz4nB-Ivxa%FcLboR5IAaK6k", "ln": 10964, "col": 6, "line": 286 }, { "b": "ayYe9vJW/Ryiarhe[x9wAc0BHB-IvG3lQDlarR^HaARKqwO@RNayw}[B97=hz!\u0026{4c#AKpB75Y)B0bywax@b23lQDlarR^HazCBgBz\u003e@azAnaEarR^HarR^HarR!oy\u0026r=9jS[iIz^\u003ettwPhD]v}v5jDWwZ/ogqQ7EiHi+Bz\u003e@azyC]narR^HarR!EwPS6nzxJz8z^\u003c4XarR^HA+funA=91jwO}?Z3s)ZWayw}[B97=hz!\u0026{4c#AKpB75Y)B2\u003eBWx(!wBat2=1B98B-3lQDlar\u00260NpgXSXB95Kkv}f7\u003eB6\u003c3cyH}xaB7F[", "ln": 11293, "col": 8, "line": 295 }, { "b": "x(mD}zF78lxK@qZoHIrFr3lp3yH}xje*qF-3lQDlaz+FdwPI@ojS\u003e{)3lQDlazbLjaz\u0026lnzxJ!cB8$=5wPG)tarR^HarR^Hw]zYjxLzMhx(k4)pFjbKuS6rBw[=c[x(){bd06GJc#yOHwPPsAv@DmbwO#PlefDbXdjDYb3lQDlarR^HarR^Haz+FdwPI@ojS[ALBs}iDz/{1Ef!0CLarR!EwPS6nzxJ+7By/H", "ln": 11691, "col": 33, "line": 307 }, { "b": "Buf:KarR^Ja%G{czxJ\u003enwGU!$vJYb\u003ezEWu%vrccoaw#=)B-IwvaARpdaAI4hA+cw7x\u003e8lqa%FirarR^Hx\u003ewG7vpyu%z/^aozxIRslsihQk$s\u003cm3lQDlarR^HaAz4nB-IvxDM)3wA=k$xiV@2UB-7#jz*c7wy**=}DU^b1a-.#Nc#T0maA7\u003cmDVKaCBy!#hoHh0LmOD9rqZ)bza$K\u0026Xy**=%iV@lEvTON\u003carR^HAbP=sauZ\u0026vk%!{PpF$d\u003ctwN.St{7Tuf!+p7ar@1E", "ln": 12015, "col": 55, "line": 319 }, { "b": "AX5sSy**=%iV@lEvTOOaarR!GA^oXMarR^HarR^Hw].*baAIWtyh4MrzeS%cy?mVuAb](ux\u003eg^}B1RoyvJYx4AbP=sazkncuV*A#xjSRpA+fr6Byffivp%cUarR^HarR^Hw].*baAIWtyh4MrzeS%cy?mVuBz(8lB1RoyvLhh9B8UMfv}W00ze:AlBrCQxB-.h4Bz(8l3jm)#arR^HarUYoB7GD2B-Q#7wHF#m3lQDlarR^Hay/tay?m9#wN(]DaBtqAy**%$b03\u0026/wPPsHefDcUz/oD0v{%g\u0026B0rT/fNTonarR^HarR^Hv@bN{B0av(v@Dx#wPx*sarR^HarR^HarR^Ha%FjKz/{ekuVZj8y-)}xvq{f%AYLsMz/]@tB0a$3y\u00261ezazth7C4C-pB0b7hvp%T7w].*baA8yAAclmPa%Fir3lQDlarR^HarR^Hay]4}aywE", "ln": 12368, "col": 33, "line": 327 }, { "b": "arUYov@Dx#wPw[Raw#=Xz/Px1AWSvzarR^HarR^Hw].*baAIWtyh4MrzeS%cy?mVuvp%d?Bs}xzvLh84wO#P%xl4B1xDR2aAbP=sax9z%yh4MKxjU$5m@\u00263SxBk7?arR^HarR!vw/$@ev@1ajarR^HarR^HarR^HxjU%(A::63auZ\u0026OzeS{1uUr}/wPzj3wHH]5z!0M\u0026A@", "ln": 13136, "col": 7, "line": 348 }, { "b": "auZ\u00264g72cDarR^HarUliB7ExtarR^HarR^HarR^Hw].*baAIWtyh4MrzeS%cy?mVuA+e^6wNPBdy?WuhA+e=ly\u00260@}v@b\u003c\u003czGE1nze:AlBrCjczE)\u0026%By!//B9RUkayPslxjU%(A::633jm)#arR^HarR^HarUJfCWCfbwPw[RatLRT3lQDlarR^Hazk.6Aa*vSax9z%yh4MK", "ln": 13335, "col": 21, "line": 353 }, { "b": "B-7L@z/ff3xfyO=zddV@v@DBguV*B2b03\u00267e??XXarR^HarR^HdgdguarR^HarUogzEEu*B97\u0026jwGTbUvrlZiv}/\u003clA=(mF3lQDlarR^HarR^Hazk.6Aa*\u003eAB-5PmarR^HarR^HarR^HarR^Hw*fJ.BywV{aARpdaBv{kvTPwnvpyu/BrCmsBz%n]fekjve?![ie?]zlAbP=sEiq%owftw\u003cAcckywGUMcwPA5smOD9rDWvv$e}5c\u003cD2E*Fv{%mca$K6zarR^HarR^HarR^HarR!GxMvV)wm64Yj.t)EwO#0\u003euWDP$vTRQgx(n2vBzkP6e{7/AwHF#REiHiHarR^HarR^HarR^HdgdguarR^HarS9u3lQDlarR^HazU\u003ekCwXJ^aAIaoc}(][uQ^ZPm]JSdvpAH\u003e3lQDlarR^Hay!\u00260BAIRnwfs2Tv@Dg1wN/*[wb", "ln": 13594, "col": 85, "line": 360 }, { "b": "BsntAB97=0z/Z2cB-R7qefDR}dj=O#dj+/GarR^HarR^HarR^JBz\u003e@azGv0.azC.nd0oPtxjSYdwPPsAx(m)jByfcdyH}y8a$K\u0026\u003cdjDw\u0026azC.nd0oPtxjSYdwPPsAz/{evB-Z#jz!\u0026{4B0rdTfEXC43lQDlarR^HaBKOtarR^HarR!lvq{f%zE^9/x(!xmA^o6Ov@Dy0dgdguarR^HarU31AbYxawm6d:vrcm1zFa2sB7ocewH[%tzF%-pefFChAcckywN)j%arR^HarR^HA+funA=91vv@Dy03lQDlazbt9ve", "ln": 14609, "col": 45, "line": 383 }, { "b": "vSC[0wGV8dwGUz]wO#Pxa%FirarR^HBAhT/3lQDlarR^Haz\u003e?lB7F(8jS)%vazbLjaz8:gzxJ.jz*c7wx\u003ewG1az#atazCZov{%s#B-I57t).X%arR^HarUxgaz#ataz\u003e?lB7F(y3lQDlarR^HarR^HaAz4nB-IvbarR^HarR^HA3dp^uT^O:v}YjWx(UQJatj\u0026Yy?m3}zFs03B1Rrua{]CnarR^HarUGmzE)(ijS[X@A+eV\u0026uVY\u003e7BsnN\u003cB8U@fBzLVewPGmGazCBgA4UZDx(!xqc[coIy\u0026:egtu}NUarR^HarR!yx(mH6e[5ZrwO#3b3lQDlarR^HarR^Haz8/HaBwftz/Pz[cV\u003c6twPI%4zeZ\u003edtrjF)u40\u0026xB7oce", "ln": 15078, "col": 57, "line": 395 }, { "b": "t}7gJaMv{oay]Iby?$koxK#l@ay/j@B8$]la{]CnarR^HarS9uarR^HarR^HA4VuPx()][By/Ysc)z]la$^RGx(ktnx(mH6tp?P:i:BfSd\u003cc3vzxZIparR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiV]K\u0026az#aqvlbI$oHQS?f^bFaLPT^Nvrcm1zFa2kzE[05AV!?iwNPu%", "ln": 15494, "col": 66, "line": 404 }, { "b": "arR!vw/$=3B98tvD0+J0Bz9prCXIkvB0@E#3lQDlarR^HaARTHiTM#LarR^HarR^HarUuiB98tvC{2l)yiarhe]kDmwofejx(!xmA^q2hvrufnA+eV\u0026uVY\u003e7BsnN!3lQDlarR^Haz2!cwPh-lr://!wKQSWz/N(CarR^HarR^HarR^HxLzKfz/QaCjS)%m3lQDlaztFgBz(hBe[5ZrwO#3bB7ocewHN%earR!ux(!xmA^q2hvrufnCxdztwNxK\u003cCYUuGB8L}Gwoz:dB0$ZoB98tvC}p7LzE^r@BuIxddgcy?wmYu}vR6B!xKtB!B98tvC{\u003e9:eJ$p[x(!x2wnbK}t@\u0026rnarR!ux(!xmA^q2hvruf9jS[9vwO#0\u003euT%", "ln": 15784, "col": 2, "line": 414 }, { "b": "az++fwPF$Sax@C4DU^nhc$)soBz(hBdsAsFwO#0\u003eaAzQxd03*#tY7-\u003e3lQDlazbLjaz2CjA^n^wzxJRbB98tvD0q\u003cQfGJG23lQDlarR^Haz++fwPGFjAbYxawgd^carR^HarR^HarR!sa%n1PwO#QgD0qUrx(dB5Byx39cTx}qf!=)YaBvWqBAhUhcV0j2cTw+/gjo", "ln": 16439, "col": 4, "line": 437 }, { "b": "B7ocewPGEFa%EvparR!EwPS6nzxJe7B-7L}wO#0\u003ec#rs3efF!Fv@1kAz!0MiazbLjaz+E}azCZoB8M8vwN)h.k%!{FoHhfEdp0n", "ln": 16911, "col": 34, "line": 448 } ], "depth": 1, "facts": { "imp": [ [ "", "re.compile" ], [ "", "re.compile" ], [ "", "_workspace_dir" ], [ "", "d.mkdir" ], [ "", "subprocess.run.stdout.strip" ], [ "", "subprocess.run" ], [ "", "subprocess.run" ], [ "", "pid.strip" ], [ "", "Path.resolve" ], [ "", "Path" ], [ "", "app_path.exists" ], [ "", "Path.resolve" ], [ "", "Path" ], [ "", "app_path.exists" ], [ "", "Path.unlink" ], [ "", "Path" ], [ "", "subprocess.Popen" ], [ "", "str" ], [ "", "str" ], [ "", "range" ], [ "", "requests.get" ], [ "", "time.sleep" ], [ "", "proc.kill" ], [ "", "json.dumps" ], [ "", "json.dumps" ], [ "", "scripts.get" ], [ "", "_asyncio.sleep" ], [ "", "isinstance" ], [ "", "script.pop" ], [ "", "json.dumps" ], [ "", "_last_token" ], [ "", "blob.replace" ], [ "", "TOKEN_RE.finditer" ], [ "", "str" ], [ "", "m.get" ], [ "", "hit.group" ], [ "", "set" ], [ "", "FLAG_RE.findall" ], [ "", "sorted" ], [ "", "_boot_lab" ], [ "", "reset_usage" ], [ "", "set" ], [ "", "str" ], [ "", "route_tool" ], [ "", "_extract_flags" ], [ "", "Recorder" ], [ "", "_mock_generate" ], [ "", "_mock_script" ], [ "", "SuijinAgentGraph" ], [ "", "asyncio.run" ], [ "", "graph.run" ], [ "", "int" ], [ "", "time.time" ], [ "", "set" ], [ "", "get_usage" ], [ "", "time.strftime" ], [ "", "time.gmtime" ], [ "", "len" ], [ "", "len" ], [ "", "sorted" ], [ "", "round" ], [ "", "len" ], [ "", "len" ], [ "", "final_state.get" ], [ "", "final_state.get" ], [ "", "round" ], [ "", "float" ], [ "", "usage.get" ], [ "", "int" ], [ "", "usage.get" ], [ "", "int" ], [ "", "usage.get" ], [ "", "_append_history" ], [ "", "_append_learnings" ], [ "", "proc.kill" ], [ "", "_bench_dir" ], [ "", "p.read_text.splitlines" ], [ "", "p.read_text" ], [ "", "p.exists" ], [ "", "lines.append" ], [ "", "len" ], [ "", "len" ], [ "", "m.split" ], [ "", "p.write_text" ], [ "", "_bench_dir" ], [ "", "history_path.exists" ], [ "", "json.loads" ], [ "", "history_path.read_text" ], [ "", "history.append" ], [ "", "history_path.write_text" ], [ "", "json.dumps" ], [ "", "_bench_dir" ], [ "", "history_path.exists" ], [ "", "json.loads" ], [ "", "history_path.read_text" ], [ "", "bench_history" ], [ "", "len" ], [ "", "lines.append" ], [ "", "run_bench" ], [ "", "sorted" ], [ "", "Path" ], [ "", "SuijinAgentGraph" ], [ "", "WORKSPACE_DIR" ], [ "", "asyncio" ], [ "", "asyncio" ], [ "", "generate_async" ], [ "", "get_usage" ], [ "", "json" ], [ "", "os" ], [ "", "pathlib" ], [ "", "re" ], [ "", "requests" ], [ "", "reset_usage" ], [ "", "route_tool" ], [ "", "subprocess" ], [ "", "suijin.modules.agent.lib.agent_graph" ], [ "", "suijin.modules.platform.lib.workspace" ], [ "", "suijin.modules.providers.lib" ], [ "", "suijin.modules.redteam.lib.red.llm_client" ], [ "", "suijin.modules.tools.lib.dispatch" ], [ "", "sys" ], [ "", "time" ] ], "mbr": [ "FLAG_RE.findall", "Path.resolve", "Path.resolve.parents", "Path.unlink", "TOKEN_RE.finditer", "_asyncio.sleep", "app_path.exists", "asyncio.run", "blob.replace", "collected.flags", "collected.tool_calls", "d.mkdir", "entry.capture_rate", "entry.cost_usd", "entry.flags_captured", "entry.flags_known", "entry.lab", "entry.mode", "entry.timestamp", "entry.tool_calls", "final_state.get", "graph.run", "history.append", "history_path.exists", "history_path.read_text", "history_path.write_text", "hit.group", "json.dumps", "json.loads", "lines.append", "m.get", "m.split", "os.environ", "p.exists", "p.read_text", "p.read_text.splitlines", "p.write_text", "pid.strip", "proc.kill", "re.compile", "requests.get", "score.lab", "score.timestamp", "script.pop", "scripts.citadel", "scripts.get", "subprocess.DEVNULL", "subprocess.Popen", "subprocess.run", "subprocess.run.stdout", "subprocess.run.stdout.strip", "sys.executable", "time.gmtime", "time.sleep", "time.strftime", "time.time", "usage.get" ], "tgt": [ "FLAG_RE.findall", "Path", "Path.resolve", "Path.unlink", "Recorder", "SuijinAgentGraph", "TOKEN_RE.finditer", "_append_history", "_append_learnings", "_asyncio.sleep", "_bench_dir", "_boot_lab", "_extract_flags", "_last_token", "_mock_generate", "_mock_script", "_workspace_dir", "app_path.exists", "asyncio.run", "bench_history", "blob.replace", "d.mkdir", "final_state.get", "float", "get_usage", "graph.run", "history.append", "history_path.exists", "history_path.read_text", "history_path.write_text", "hit.group", "int", "isinstance", "json.dumps", "json.loads", "len", "lines.append", "m.get", "m.split", "p.exists", "p.read_text", "p.read_text.splitlines", "p.write_text", "pid.strip", "proc.kill", "range", "re.compile", "requests.get", "reset_usage", "round", "route_tool", "run_bench", "script.pop", "scripts.get", "set", "sorted", "str", "subprocess.Popen", "subprocess.run", "subprocess.run.stdout.strip", "time.gmtime", "time.sleep", "time.strftime", "time.time", "usage.get" ], "funcs": [ [ "_workspace_dir", 1612 ], [ "_bench_dir", 1738 ], [ "_boot_lab", 1867 ], [ "_mock_script", 3384 ], [ "_mock_generate", 10614 ], [ "gen", 10963 ], [ "_last_token", 11470 ], [ "_extract_flags", 11878 ], [ "run_bench", 11961 ], [ "__call__", 12725 ], [ "_append_learnings", 14877 ], [ "_append_history", 15675 ], [ "bench_history", 16024 ], [ "render_history", 16264 ], [ "run_all", 16832 ] ], "metrics": { "ast": { "op.add": 4, "op.bor": 1, "op.div": 12, "op.lor": 2, "op.sub": 2, "op.band": 1, "max_depth": 18, "call_count": 103, "node_count": 4476, "member_count": 57, "max_array_len": 8, "op_density.add": 0, "op_density.bor": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.band": 0, "max_concat_chain": 2, "member_depth_max": 4 }, "file": { "size": 16990, "entropy": 4.54 }, "text": { "lines": 449, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.02, "space_count": 4934, "char_entropy": 4.54, "unique_chars": 94, "top_char_null": 0, "string_density": 0.82, "top_char_ratio": 0.06, "avg_line_length": 36.84, "max_line_length": 120, "non_ascii_ratio": 0, "empty_line_ratio": 0.11, "last_line_length": 67, "whitespace_ratio": 0.32, "identifier_density": 1.07, "line_length_stddev": 27.76, "normalized_string_count": 17.46, "repeated_char_sequences": 194, "suspicious_string_ratio": 0.01, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 17.59 }, "binds": { "count": 45 }, "binary": { "peak_region_bytes": 5726, "peak_region_entropy": 5.11 }, "source": { "class_count": 1, "function_count": 15 }, "imports": { "count": 22, "aliased": 2, "stdlib_count": 9, "stdlib_ratio": 0.41, "third_party_count": 13, "third_party_ratio": 0.59 }, "strings": { "sql": 3, "bytes": 6526, "count": 370, "shell": 2, "url_count": 2, "avg_length": 17.64, "max_length": 719, "path_count": 3, "avg_entropy": 2.85, "empty_count": 6, "entropy_stddev": 0.85 }, "comments": { "chars": 498, "count": 10, "lines": 10, "to_code_ratio": 0.02 }, "functions": { "count": 16, "nested": 2, "density": 3.34, "avg_params": 1.4, "code_ratio": 0.89, "max_params": 4, "length_stddev": 43.8, "over_100_lines": 1, "avg_name_length": 11.33, "no_params_count": 4, "avg_length_lines": 26.6, "max_length_lines": 177, "min_length_lines": 2, "avg_nesting_depth": 0.13, "max_nesting_depth": 1, "high_entropy_names": 3, "avg_param_name_length": 5 }, "identifiers": { "count": 480, "unique": 155, "avg_length": 6.85, "max_length": 17, "min_length": 1, "avg_entropy": 2.33, "reuse_ratio": 0.32, "length_stddev": 3.43, "sequential_names": 5, "single_char_count": 6, "single_char_ratio": 0.04, "high_entropy_count": 5, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.92, "all_uppercase_ratio": 0.05, "double_underscore_count": 2, "underscore_prefix_count": 13 } } }, "id": 759, "mol": "K(Te₂)O₇(XeAsC₂CoEuLaS₂)H₄(Cm₁₆Db₈Os₂Po₆)Md(Pa)Th", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/bench.py", "pid": 0, "risk": 66, "sha": "3541d5b6f426a9f409d1c28fefa78c1f8ca2a910eff08293a4f145cdfa3d929d", "size": 16990, "traits": [ { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 2775, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 166, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 501, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 292, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 131, 0 ] ] }, { "id": "metadata/package/testing/corpus::ssrf-category-label", "conf": 0.9, "crit": 3, "desc": "SSRF attack category label", "spans": [ [ 10411, 4 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "spans": [ [ 6947, 23 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 3, "desc": "Python JSON content type", "spans": [ [ 9106, 16 ] ] }, { "id": "micro-behaviors/communications/http/keywords::webhook-service-word", "conf": 0.9, "crit": 1, "desc": "Mentions 'webhook' (HTTP callback)", "spans": [ [ 10185, 0 ] ] }, { "id": "micro-behaviors/communications/http/llm-proxy::llm-token-usage-json--rx-7", "atk": "T1071.001", "conf": 0.65, "crit": 3, "desc": "LLM output-token count field", "spans": [ [ 14709, 13 ] ] }, { "id": "micro-behaviors/communications/http/llm-proxy::llm-token-usage-json--rx-9", "atk": "T1071.001", "conf": 0.65, "crit": 3, "desc": "LLM input-token count field", "spans": [ [ 14673, 12 ] ] }, { "id": "micro-behaviors/communications/http/login::http-login-password-field", "atk": "T1071.001", "conf": 0.88, "crit": 1, "desc": "HTTP login password field", "spans": [ [ 6524, 0 ] ] }, { "id": "micro-behaviors/communications/http/login::http-login-path", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP login path", "spans": [ [ 9487, 14 ], [ 9495, 6 ] ] }, { "id": "micro-behaviors/communications/http/login::http-login-username-field", "atk": "T1071.001", "conf": 0.86, "crit": 1, "desc": "HTTP login username field", "spans": [ [ 9162, 0 ] ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "spans": [ [ 5632, 6 ] ] }, { "id": "micro-behaviors/communications/http/proxy::browser-url-relay-target", "atk": "T1041", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Browser relay target URL parameter", "spans": [ [ 10320, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/result::http-result-payload-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Named payload field", "spans": [ [ 5711, 9 ] ] }, { "id": "micro-behaviors/communications/http/request/wordpress::rest-endpoint-url", "atk": "T1071.001", "mbc": "E1071", "conf": 0.95, "crit": 3, "desc": "References a WordPress REST API endpoint URL", "spans": [ [ 5092, 9 ] ] }, { "id": "micro-behaviors/communications/http/services/entra-directory::user-collection-path-token", "conf": 0.92, "crit": 3, "desc": "Microsoft Graph user collection endpoint", "spans": [ [ 5106, 6 ] ] }, { "id": "micro-behaviors/communications/http/token-auth::bearer-header-from-variable", "conf": 0.94, "crit": 3, "desc": "Builds Bearer authorization header from variable", "spans": [ [ 6947, 25 ] ] }, { "id": "micro-behaviors/communications/http/url/query::ai-prompt-query-remote-url-value", "conf": 0.95, "crit": 3, "desc": "Query value contains a remote URL", "spans": [ [ 10320, 12 ] ] }, { "id": "micro-behaviors/communications/http/url/query::password-query-parameter", "conf": 0.8, "crit": 3, "desc": "URL password query parameter", "spans": [ [ 6524, 10 ] ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-input-field", "conf": 0.9, "crit": 3, "desc": "Reads a hook command field", "spans": [ [ 3943, 11 ] ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-input-read--tool-name", "conf": 0.9, "crit": 3, "desc": "Reads AI agent hook tool input (tool_name)", "spans": [ [ 3944, 9 ] ] }, { "id": "micro-behaviors/communications/mcp::python-mcp-http-tool-name", "conf": 0.99, "crit": 3, "desc": "MCP tool is named http_request", "spans": [ [ 3957, 12 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::broad-exception-return-suppression", "atk": "T1027", "mbc": "C0027", "conf": 0.86, "crit": 3, "desc": "Broad exception returns failure sentinel", "spans": [ [ 3263, 78 ] ] }, { "id": "micro-behaviors/data/control-flow/membership::not-in-membership-check", "conf": 0.3, "crit": 3, "desc": "Python not-in membership check", "spans": [ [ 12079, 24 ] ] }, { "id": "micro-behaviors/data/db/config::db-key-password", "conf": 0.85, "crit": 1, "desc": "Connection password key", "spans": [ [ 6525, 0 ] ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "spans": [ [ 9162, 10 ] ] }, { "id": "micro-behaviors/data/format/json::json-command-field", "conf": 0.8, "crit": 3, "desc": "JSON command or task field key", "spans": [ [ 3905, 9 ] ] }, { "id": "micro-behaviors/data/llm/codegen::llm-generation-source-language-model", "conf": 0.88, "crit": 3, "desc": "Explicit LLM or language-model reference", "spans": [ [ 374, 3 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::agent-tool-call-field", "conf": 0.9, "crit": 3, "desc": "JSON tool-call field", "spans": [ [ 12590, 13 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "spans": [ [ 4790, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "spans": [ [ 2979, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "spans": [ [ 9162, 11 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 2783, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 2784, 0 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "spans": [ [ 9189, 8 ] ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "spans": [ [ 5724, 5 ] ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Launches a process with subprocess.Popen", "spans": [ [ 2922, 16 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-devnull", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "Python subprocess suppresses stdio", "spans": [ [ 2922, 127 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stderr", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stderr)", "spans": [ [ 3024, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stdout)", "spans": [ [ 2207, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::sys-executable-popen", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.9, "crit": 3, "desc": "subprocess.Popen with sys.executable list", "spans": [ [ 2933, 31 ] ] }, { "id": "micro-behaviors/process/fork/clone::python-fork-child-zero-test", "conf": 0.9, "crit": 3, "desc": "Python tests for the fork child branch", "spans": [ [ 2230, 7 ] ] }, { "id": "micro-behaviors/process/info/current::python-sys-executable-text", "conf": 0.75, "crit": 3, "desc": "Python sys.executable reference text", "spans": [ [ 2949, 14 ] ] }, { "id": "micro-behaviors/process/terminate/kill::python-process-kill-call", "conf": 0.9, "crit": 3, "desc": "Python calls a process kill method", "spans": [ [ 3314, 9 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "spans": [ [ 11062, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::python-benchmark-basename-atom", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Python benchmark-style basename" }, { "id": "objectives/collection/stealer/ctf::ctf-flag-stealer-regex", "conf": 0.95, "crit": 3, "desc": "CTF flag-format pattern in source", "spans": [ [ 1033, 33 ], [ 1089, 25 ], [ 1118, 31 ], [ 1168, 27 ], [ 1199, 25 ], [ 1228, 32 ], [ 1368, 23 ], [ 1403, 22 ] ] }, { "id": "objectives/command-and-control/dropper/staged-loader::remote-module-method-field", "atk": "T1105,T1627.001", "mbc": "B0042", "conf": 0.94, "crit": 3, "desc": "Remote module method field", "spans": [ [ 4002, 11 ] ] }, { "id": "objectives/command-and-control/infrastructure/tracking::username-field", "conf": 0.7, "crit": 3, "desc": "Username tracking field", "spans": [ [ 9162, 11 ] ] }, { "id": "objectives/credential-access/theft/keywords::password-field-name", "conf": 0.96, "crit": 1, "desc": "Password field name in structured data", "spans": [ [ 9188, 0 ] ] }, { "id": "objectives/execution/exploit/command-injection::log4shell-jndi-lookup-payload", "atk": "T1190", "mbc": "E1190", "conf": 0.99, "crit": 4, "desc": "Log4Shell JNDI lookup payload", "spans": [ [ 4390, 14 ] ] }, { "id": "objectives/exfiltration/oob/system-profile::python-user-path-profile-fields", "atk": "T1041", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Python user path profile fields", "spans": [ [ 9162, 11 ] ] }, { "id": "objectives/lateral-movement/smb::ntlm-relay-ldap-target", "conf": 0.97, "crit": 3, "desc": "References an LDAP endpoint", "spans": [ [ 4397, 7 ] ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-password-field", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Password field marker for proxy use", "spans": [ [ 9188, 11 ] ] }, { "id": "well-known/lib/stdlib/python-stdlib::asyncio-reference", "conf": 0.5, "crit": 3, "desc": "Python asyncio library reference", "spans": [ [ 766, 7 ] ] }, { "id": "well-known/tool/development/cloud-dev::python-popen-devnull-redirect", "conf": 0.9, "crit": 3, "desc": "Python Popen redirects output to DEVNULL", "spans": [ [ 2922, 127 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/communications/http/authorization-header::auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Authorization header-name literal", "spans": [ [ 6947, 13 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::authorization-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Defines an HTTP Authorization header mapping", "spans": [ [ 6946, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 9090, 32 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 3104, 19 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "spans": [ [ 3174, 12 ] ] }, { "id": "micro-behaviors/communications/http/post::url-encoded-content-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses URL-encoded HTTP form content", "spans": [ [ 3800, 33 ] ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "spans": [ [ 3189, 16 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-quoted-tautology-payload", "conf": 0.92, "crit": 3, "desc": "Quoted SQL tautology payload literal", "spans": [ [ 5381, 8 ] ] }, { "id": "micro-behaviors/data/manipulation::string-replace-result-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns a string replace result", "spans": [ [ 11391, 21 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "spans": [ [ 15848, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 2008, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 2120, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-suppresses-stdio", "atk": "T1059.006", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Python subprocess stdio suppression", "spans": [ [ 2922, 127 ] ] }, { "id": "micro-behaviors/process/lifecycle/auto-exec::asyncio-run-call", "conf": 0.85, "crit": 3, "desc": "Python asyncio.run call", "spans": [ [ 13658, 11 ] ] }, { "id": "objectives/supply-chain/hidden-payload/runtime::python-popen-devnull-inline", "atk": "T1195.002", "mbc": "B0024", "conf": 0.96, "crit": 3, "desc": "Python Popen redirects output to DEVNULL", "spans": [ [ 2922, 127 ] ] }, { "id": "micro-behaviors/communications/http/llm-proxy::llm-token-usage-json", "atk": "T1071.001", "conf": 0.65, "crit": 1, "desc": "LLM token usage JSON fields", "uses": [ 9, 10 ], "spans": [ [ 14673, 0 ] ] }, { "id": "micro-behaviors/communications/http/login::http-login-credential-form", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP login form carries credentials", "uses": [ 11, 12, 13 ], "spans": [ [ 9162, 11 ], [ 9188, 11 ], [ 9487, 14 ] ] }, { "id": "micro-behaviors/communications/http/login::http-login-credential-post", "atk": "T1071.001", "conf": 0.92, "crit": 3, "desc": "HTTP login credentials submitted by POST", "uses": [ 14, 76 ], "spans": [ [ 9006, 6 ], [ 9162, 11 ] ] }, { "id": "micro-behaviors/communications/http/post::post-form", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP form submission encoding", "uses": [ 65 ], "spans": [ [ 3800, 33 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "uses": [ 64 ], "spans": [ [ 3174, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 64 ], "spans": [ [ 3174, 12 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 39, 71 ], "spans": [ [ 2106, 29 ], [ 2120, 14 ], [ 2238, 27 ], [ 2922, 16 ] ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-target", "conf": 0.9, "crit": 3, "desc": "HTTP request targets loopback address", "uses": [ 66, 79 ], "spans": [ [ 3174, 12 ], [ 3189, 16 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 81 ], "spans": [ [ 2106, 29 ], [ 2120, 14 ], [ 2238, 27 ], [ 2922, 16 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 81 ], "spans": [ [ 2106, 29 ], [ 2120, 14 ], [ 2238, 27 ], [ 2922, 16 ] ] }, { "id": "third_party/SigBase/EXPL/Log4J/CVE/2021/44228/Dec21/Soft", "conf": 0.9, "crit": 3, "desc": "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228", "spans": [ [ 4390, 13 ] ] } ], "type": "python" }, { "id": 760, "mol": "H₂(DbF)", "sha": "5f91eaaee2222a6eb7044edd28415d28bc9ed828a3ace780324bd659d7d1820a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/compliance.py", "risk": 3, "size": 6063, "type": "python", "depth": 1 }, { "id": 761, "mol": "H₄(Cr₃Db₆F₂Po)", "sha": "07b6124f88abb054465ba87124ae6d468f2963a99ade0905877adbc065ea25e5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/credential_vault.py", "risk": 10, "size": 6515, "type": "python", "depth": 1 }, { "id": 762, "mol": "H₂(DbF)", "sha": "279f21fdaad24511fd9955bdfbd24dae24271be37d938ed611458d2ffbdcd9a6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/debrief.py", "risk": 3, "size": 6129, "type": "python", "depth": 1 }, { "id": 763, "mol": "H₂(DbF)", "sha": "47dc89c0082243e37930074382181fe51f2d7de27317bb0c5ab10055e9b4b320", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/dossier.py", "risk": 3, "size": 5406, "type": "python", "depth": 1 }, { "id": 764, "mol": "H₄(DbFOsPo₂)", "sha": "90a4462d01830bf35ae552a0065a634e95c47db8437da27e32af09ff0bf10e90", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/engagement_templates.py", "risk": 5, "size": 4687, "type": "python", "depth": 1 }, { "id": 765, "mol": "O(Co)H₅(Cr₂Db₃F₂OsPo)", "sha": "fe9cc7fd595137b2a943104fab153e73ac96456116b7155b4bccff9fb16e9504", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/export_bundle.py", "risk": 9, "size": 7946, "type": "python", "depth": 1 }, { "id": 766, "mol": "H₂(Cm₃Db)", "sha": "3179adcf54753735d13f557596733268ad42dcb944f0ad8e2d4db82c8568848e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/governance.py", "risk": 4, "size": 10675, "type": "python", "depth": 1 }, { "id": 767, "mol": "H₃(Cm₂Db₃F)", "sha": "c05e38d32f90b4999af03e17032b9637e71ecef64676163ae21b76688b8038c5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/housekeeping.py", "risk": 5, "size": 10060, "type": "python", "depth": 1 }, { "id": 768, "mol": "H₂(DbF)", "sha": "c0bc04fb660403e31e5dc594487d52093f92f5e4e9bb386ffd96ffcab59885fc", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/metering.py", "risk": 3, "size": 3744, "type": "python", "depth": 1 }, { "id": 769, "mol": "H₄(Cm₇Db₂FPo)", "sha": "caa48fba8522dd94b836905621642aa10b753527266d08083a94fa07c62fdd7c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/notify.py", "risk": 6, "size": 4152, "type": "python", "depth": 1 }, { "id": 770, "mol": "H₂(FPo)", "sha": "2779c9b45044e66bdeef6cfe1b049095460264dca8435a74b09448f0ee77af4d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/panic.py", "risk": 2, "size": 2058, "type": "python", "depth": 1 }, { "id": 771, "mol": "H₃(Cm₅DbPo₄)", "sha": "625c8257ea44a4c2315cd1f095935764059b134e6390f0ce1cae07f56aa08bcb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/real_battle.py", "risk": 7, "size": 9522, "type": "python", "depth": 1 }, { "id": 772, "mol": "H(Os)", "sha": "08531b56df7903a3bdc73ce270352848d04315fe56783e37dc88df91a1de6c7c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/replay.py", "risk": 2, "size": 7139, "type": "python", "depth": 1 }, { "id": 773, "mol": "H₃(CmDbF)", "sha": "28edb5006b57ac2b53fd8419b3035e506cd78a405d55c97bfe028f776f935681", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ops/lib/sparring.py", "risk": 4, "size": 6173, "type": "python", "depth": 1 }, { "id": 775, "mol": "H₂(DbOs)", "sha": "3c6d9acc8ce31d36ad01f54a345002aeca6821cf5a12e7c15747fbbf20615385", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/payloadescape/entry.py", "risk": 3, "size": 2213, "type": "python", "depth": 1 }, { "id": 781, "mol": "H₂(DbOs)", "sha": "5e3a26f265aab0648782535c2706563a99ca178f63e0fd63222547248c8a4918", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/payloadforge/entry.py", "risk": 3, "size": 2291, "type": "python", "depth": 1 }, { "analysis_gaps": [ "flow-graph-limited", "flow-query-incomplete" ], "ctx": [ { "b": "a%Fjcvr(WcvpS$*A+w@a\u0026^^moA+eV}aAg+my\u0026r-)azkn6wPzj3x(v(iw]zYjvrDW9z/PMrwN({9wPI%czF7Ne3pPbHA^n^tB-7Yhx(v(iA+funA=b}vA=(nqvpB4:ay/t2wIb92zY\u003canzfoV6BzkVhefF?GaAhd9v}xs(y?d9$B1N!za%Ev3x(d*cA=-Bkvrl0rgZW@lAbP=sazl1mA0*q@AbP=saA.Zvy?WuhAa9^dwEn=Kq+ftJoJ95%aBsCrarR^JvQTs\u003eb03?\u003cvQTs\u003eat4pIj%?y9wmY{qByPnyDU^wlB98*-DU^UtA==ZLfG{*ra$K6zarR^JAcVLsz/c:WasENtarR^HarR^JAcVLsz/duNeN][Jx(d*cA=-BBz!0M]Bs.GQvSlvav}x.5en]O\u003ea{]CnarR^HarR\u003eHj-+KKyH}PuB8LM7wPPtwz!0M]Bs]\u003cGuRa0Yr4J9ev@2T$e(LLkoj7Q%qBJ(CdlwZXarR^HarR^HcVZ[Iz/fD7v@%aEb71ctz/Z2Ga$O7SAbP=sEjlQbcKH$sarR^HarR\u003eDB1R0CA55?.e[O*lwO#Amdj^e4j8Yf)woz\u0026Dd041Mx(4u#zZW4=f!2h5B1R0CA55?.e[O*lwO#Amdj^k6j0C1OarR^HarR^OB9g@hA=kD0B8@%zvqG:dtoU.fx(kOBxD!#KeOMzmdo[kF3lQDlasO\u0026GarR^HboQ@sA3eObwft\u0026fCv+/oxK#0@aARgiAbn%8wPF#cvrMi8y?X05A:-=bvSC)!wPF#oxKM09vSD3*yALlwz/PY6BsnNX\u0026^^m2arR^HboR8wwQbUzwGUD8x(4(lvrrS4vqG:5BzkP6aA}KwxDRwgze:r5aAITBx(mMaA+fiavpJ\u003c\u003ex(n0lwNP9RarR^Hb5Q)miV]R:v\u003c0vmatmhrzzc6AaBv{rz/Z2GaBv{zz/P@Fa$K6zarR^JAa\u003chmiV]*#Aa\u003chkePI$scNr:@w]?)2yJ1f6zyuYQy?N:dBBtt:DU^UtA==ZUj7SUFv\u003c\u0026JOvRGZkB7=WFx=]I+gAX\u003edgAXCpcnM?{j6TcXdj+/GarR^JAbP@iA=U]9y?$pRasENtarR^HarR^JbX5#jwP].4vRPE:BrBIcB97#ge(2#1e(MW#yH}Qee(UhmlU{EFzGEoODU^wlB98*TephhLz/P@FdlwZXarR^HarR^Ha%.j)bX5C%wPQ\u003c)A+eV@c[dk43lQDlarR^Har\u003e30D30R4u0OZ+jUOGvhz)uFhgcY%fNV2b3lQDlarR^Har(2yx(4uec)SH\u0026bY+OowNP9$bW@qUef[WSoL59OBz99Lat4Fxattl\u003ej0C1OarR^HarR^JbXf4^pgXS3pHX6Iv@@?Brc-B]pgn0Jax9MbBy/qwraQq@e\u003cSA6nL8u*v@C)(zF7yJm}D^vBAh8kxdb3meheR2x^(a/3lQDlarR^Har\u00267KjT+2QCPXnxatMbcf)(=tBs*BkA+PA7dlwZXarR^HarR^Ha%.g:jTt4#cS0.:cO3P:CvScPp*[DVd\u003c)I6cP-HVarR^HarR^Ha%.ksjT:JRwQ5qHwO#0@wnb{]t@\u003e2jq:TbFdk1b4Bv7m{wPGmBAXY79a{]CnarR^HarR\u003cNB1QKmx()]mbY^ACfF1F\u003cvLgt=zu", "ln": 0, "col": 1, "line": 1 }, { "b": "aAITBauZ?\u003eg=d3Ca$K\u003cDz/fVdCYU$?B98BBjS\u003e}Tvrl9adiHiaaAITBiTM#LarR\u003cLb1DiZwPzj3wGUz7A+fA9A=U!mB7/c3y-)UlwI4.jzE)\u0026hw]zYjBzbkdxk8K2zxJCczGGDmBs[:Ya{]CnarUxgaz#ataz+.fB96CIarR^HarR^HA+funA=90zmriA!AYLsVxM4%laAz4kB.L(cwfrpCz/{7yy?W%jwO#j1xco=xfkboBBz+J7wHO/garR^Hv@#@rjS(d.z/fVdCYU6DAV=Mnvrl9adk2BPCv+!ydk2W-A+PFvdgdguarUxgay/Iraz#atazCZouSfG:oIwwC3lQDlarR^HaAz4nB-Ivxw*fV:A=k$Vay/tcBy/Ysaz(mxBrC47aA8deaA7\u003cmDVKaCBy!#huSfG:oIwwlEiG1varR!Cz/P}xjS[//AWU:yz/P}xz/M%Ag=d3Ca$kc=BAh8mc[bGCarR!GwO(y5vru66jS[9gnjuiC", "ln": 1390, "col": 38, "line": 38 }, { "b": "y?aU$A+eV{azbLjzddJeAbn@)wOu0#wmY!53lQDlaAz4nB-IvxBy/rdy*?A%e]\u003eJxy***+c)B1OxM4%lEiHi+y?N:dBs}SRA+PFvdjD(\u0026wPhD]v}v5jDU^UtA==ZNefF[IA=--q3jprPw/$V5v@C)?uT)+Tx(ktrvr(WcvpRzwB98BBjS\u003e{)efF+qD1z2qiV@G=AV^H/a#gt\u003eat2=1B98B-3lQDlar\u00260NoKSiTAXg\u003cuv@C)?ayMyivr(WcvpRzwvQTs?hz=Kdj%jG:x(CgDj%jryB7El^at2=1xK#Av3jm)#arT9Yv}W03vr(B8aA}\u003cmAc0dzxK@r9A+fAdz/{aLaAIDzy*?Q2A=Tx0azkziwPFh3arR!ovrl0rg:)0.x(CFvvrTdHe*9@jBz#wAazC.6y\u0026%o1B0a)lwmYm?wmV([z/6u1zE+vza%EvparR!vw/$#fBrCKhD2dzcwi75uarR^HarR!EwPS6nzxHb(A=M8siV@xID29", "ln": 1908, "col": 38, "line": 48 }, { "b": "mriA!AYKKIarR^HarR!AauZ\u002653lQDlay[]5vivYQAaa3dz^^fewO#0@wmWer3lQDlaAIToAc0c+ax@aUarR^Hw]zYjx=}bcaAy[dxjSGedlm!UarR^HarR!vw/$!gb{j@=jV%]wiTM#LarR^HarR^HarR)KwP?T5iV})uB7El^3lQDlarR^HarR^Hay[]5vivYQvQTs?hz^3}hz!#.v@C)?c$D+dvjqKaarR^HarR^HarR!FBy/Aje[5ZrwO#3bb4s#4wI#v?dgdguarR^HarUliB7ExtarR^HarR^HarR^HboQ]nwi7\u0026CDtdsvBzbl6ayX=2wI#v/c$^\u003cuA3f7wBz#wAazC)tvRGZ*A^ohUzE)x\u0026B0b4iv@C)(zF7y9arR^HarR^HarR^HwmoN*auZ\u0026Rvrl0rg+Jk}g?yMmz!9Acxl[ohe[n*pAb]JhB0$NcByuQE3lQDlarR^HarR^HaAIToAc0TuAbYxawgeTmDtdsGvM34!dgdguarUYoB9hqvauZ\u0026Tvrt{gwmYm?wmWer3lQDlar@1rB.LV5aARpday]4[z!9A4v}Yp+zxHuFwP?T9B7DFjA+5:4dgdguarUiav@C)?uVoB]BAnM/ax@aUarR^Hw]zYjB97#jazCZoA+fA9A=U/5d06GwAc0D?3lQDlarR^HazCBgB97#jau.\u003egb4s#4wI#v?iTM#LarR^HarR^HarUiav@C)?uVoB]BAo6yAbYxawgeThvrl0rg:1wXa$i\u003cwarR^H", "ln": 2390, "col": 17, "line": 61 }, { "b": "vQTs?hz=Kdwfumxxlw9rx(CmB3lQDlay]4[z!9A^v@k:0jS\u003e{\u003eD(%Q=yhW*7c$D[0z!9A^Aa9^eB14CsarR!EwPS6nzxJKnwO#0@wmYo]d0)r[j%}%$z!T8qB97#jA@", "ln": 3036, "col": 34, "line": 81 }, { "b": "az24@zY\u003cyEwPJ0gBBtoVaBvTgv@C)?uT)}-EiG193s)ZWaAITkxjV9iB-IpVaAITBauZ?\u003ea$K\u003cNwPRQ7wi7\u0026OBAeG!ar\u003errA+({JaA8yAAclm-aAITBauZ?\u003eflz5Iflnr^at2=1B98B-3lQDlar\u00260NluN0Uwftq6wn=Wfy\u0026r-)eN-KceOffrv%8)8aAITkxjV9av@Dj3vqYQda%FirarR^Hx\u003ewG9z/^aAA+)=zarR^HarR^HA+funA=90zmriA!AYLs=A+(\u003eswPq\u003cbA+e=93lQDlaz\u0026k:asI8rBzbP6aA8oyb4C+oy:7qXy\u0026sJeAWSv?B98CpA40dxarR^Hz/{dAjS(d\u003eB-.OBBrCHxar\u0026EXze.dHa$kc=BAh8mc[bGCarR!HauZ\u0026\u0026A+)vHBAh8mc[bGCarR!vw/$}kjV%]iv%8*db035NarR^HarR!EwPS6nzxJKnv%8*dat4UdaBwlVat4HODVa4GEio\u003c-ay/84z!6$vCP.uKB--3Ocmf\u003cZz/{eIa{]CnarUxgaz\u0026k:jS\u003e})xjVfeiTM#LarR^HarUYoBAIRwaz8*wxjVfcePz[WB:Uw:pAU15B--3Ocmf\u003cBxL?V#as?WVDVa4GEio\u003c-aBw3HBBttuarR^Hx\u003ewG8au.\u003egb5?*HxM4=jiTM#LarR^HarUYoBAIRwasENtarR^HarR^HarR!scVBuMxM4=Aat47CtQKl5AbP=saA.Zvy?WuhA+flkwPI@PB-Iqmx\u003c@YnwPq\u003c7B963SA+]=cBAh8bC4A6CDV:-XefYBVB--3Qdlw):arR^HarR^HarR^Hw*.qfAbP=saA8r.z/WKvxL?V#c)B1RB--3Qehh03h8M*Az/WKxCX7xdc)B1RB--3Qel:rBz/{eIb3=T5cNPlzarR^HarR^Q3lQDlaAz4nB-Ivxw*fV:A=k$Vaz\u003eXixM4A7zfo]wayX[8v%8*defGdHwPPECz/M$tD30.rzxYz", "ln": 3162, "col": 64, "line": 83 } ], "depth": 1, "facts": { "imp": [ [ "", "sorted" ], [ "", "str.strip" ], [ "", "str" ], [ "", "template.replace.replace" ], [ "", "template.replace" ], [ "", "lhost.strip" ], [ "", "max" ], [ "", "min" ], [ "", "int" ], [ "", "payload.encode" ], [ "", "range" ], [ "", "base64.b64encode" ], [ "", "steps.append" ], [ "", "base64.b64encode" ], [ "", "gzip.compress" ], [ "", "steps.append" ], [ "", "data.decode" ], [ "", "reversed" ], [ "", "decode_parts.append" ], [ "", "decode_parts.append" ], [ "", "url.strip" ], [ "", "base64" ], [ "", "gzip" ], [ "", "urllib.parse" ] ], "mbr": [ "base64.b64encode", "data.decode", "decode_parts.append", "gzip.compress", "lhost.strip", "payload.encode", "steps.append", "str.strip", "template.replace", "template.replace.replace", "url.strip" ], "tgt": [ "base64.b64encode", "data.decode", "decode_parts.append", "gzip.compress", "int", "lhost.strip", "max", "min", "payload.encode", "range", "reversed", "sorted", "steps.append", "str", "str.strip", "template.replace", "template.replace.replace", "url.strip" ], "funcs": [ [ "rev_shell", 1353 ], [ "encode_chain", 2018 ], [ "stager", 3195 ] ], "metrics": { "ast": { "op.lor": 5, "op.mod": 1, "max_depth": 14, "call_count": 28, "node_count": 910, "member_count": 11, "op_density.lor": 0.01, "op_density.mod": 0, "member_depth_max": 3 }, "file": { "size": 3937, "entropy": 4.93 }, "text": { "lines": 102, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.04, "space_count": 845, "char_entropy": 4.93, "unique_chars": 83, "top_char_null": 0, "string_density": 0.59, "top_char_ratio": 0.06, "avg_line_length": 37.6, "max_line_length": 93, "non_ascii_ratio": 0, "empty_line_ratio": 0.1, "last_line_length": 57, "whitespace_ratio": 0.24, "identifier_density": 1.24, "line_length_stddev": 25.91, "normalized_string_count": 5.94, "repeated_char_sequences": 10, "suspicious_string_ratio": 0.25, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 7.04 }, "binds": { "count": 16 }, "binary": { "peak_region_bytes": 2913, "peak_region_entropy": 5.14 }, "source": { "function_count": 3 }, "imports": { "count": 3, "stdlib_count": 3, "stdlib_ratio": 1 }, "strings": { "bytes": 1784, "count": 60, "shell": 7, "avg_length": 29.73, "max_length": 171, "path_count": 5, "avg_entropy": 3.24, "empty_count": 3, "entropy_stddev": 1.31, "embedded_code_candidates": 8 }, "comments": { "chars": 378, "count": 7, "lines": 7, "to_code_ratio": 0.07 }, "functions": { "count": 3, "density": 2.94, "avg_params": 2.67, "code_ratio": 0.6, "max_params": 3, "length_stddev": 8.5, "avg_name_length": 9, "avg_length_lines": 20.33, "max_length_lines": 32, "min_length_lines": 12, "avg_param_name_length": 5.63 }, "identifiers": { "count": 126, "unique": 47, "avg_length": 5.53, "max_length": 12, "min_length": 1, "avg_entropy": 2.07, "reuse_ratio": 0.37, "length_stddev": 2.6, "has_digit_ratio": 0.04, "sequential_names": 4, "single_char_count": 4, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.91, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 1, "underscore_prefix_count": 1 } } }, "id": 782, "mol": "K(Te)O(C₇)H₄(Cm₈Db₅F₂Po₈)Md₂(In₆)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/payloadforge/main.py", "pid": 0, "risk": 54, "sha": "6ee0e3a54335b049d8d13b06c3aa3a3211553e27e961e2640594c2c5c374f761", "size": 3937, "traits": [ { "id": "micro-behaviors/communications/socket/family::socket-af-inet-name", "atk": "T1071", "mbc": "C0001", "conf": 0.55, "crit": 3, "desc": "AF_INET constant name", "spans": [ [ 358, 7 ] ] }, { "id": "micro-behaviors/communications/socket/family::socket-sock-stream-name", "atk": "T1071", "mbc": "C0001", "conf": 0.55, "crit": 3, "desc": "SOCK_STREAM constant name", "spans": [ [ 373, 11 ] ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdio-dup2", "conf": 0.8, "crit": 3, "desc": "Python duplicates descriptor to stdio", "spans": [ [ 439, 21 ], [ 461, 21 ], [ 483, 21 ] ] }, { "id": "objectives/command-and-control/reverse-shell/dup::python-socket-fileno-short", "conf": 0.65, "crit": 3, "desc": "Python short socket fileno", "spans": [ [ 447, 10 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method-short", "conf": 0.85, "crit": 3, "desc": "Short Python socket connect call", "spans": [ [ 397, 10 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "spans": [ [ 296, 13 ] ] }, { "id": "micro-behaviors/process/create/subprocess::call", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.75, "crit": 3, "desc": "subprocess.call call", "spans": [ [ 516, 16 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-creation", "atk": "T1071", "mbc": "C0001", "conf": 1.0, "crit": 2, "desc": "Socket creation patterns", "uses": [ 0, 1 ], "spans": [ [ 358, 0 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method", "conf": 0.85, "crit": 3, "desc": "Python socket-like connect call", "uses": [ 4 ], "spans": [ [ 397, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 6, 35 ], "spans": [ [ 516, 16 ], [ 3837, 8 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-client-operations", "atk": "T1071", "mbc": "C0001", "conf": 1.0, "crit": 2, "desc": "Client socket operations", "uses": [ 8 ], "spans": [ [ 397, 0 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 9 ], "spans": [ [ 516, 16 ], [ 3837, 8 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 9 ], "spans": [ [ 516, 16 ], [ 3837, 8 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-python", "atk": "T1071", "mbc": "C0001", "conf": 0.75, "crit": 3, "desc": "Initiate socket connection (Python)", "uses": [ 7, 10 ], "spans": [ [ 358, 7 ], [ 373, 11 ], [ 397, 10 ] ] }, { "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call", "conf": 0.9, "crit": 1, "desc": "Process API invocation", "uses": [ 12 ], "spans": [ [ 516, 0 ], [ 3837, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.8, "crit": 3, "desc": "Python process execution capability", "uses": [ 9 ], "spans": [ [ 516, 16 ], [ 3837, 8 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::python-urlretrieve-qualified", "conf": 0.9, "crit": 3, "desc": "urllib.request.urlretrieve download call", "spans": [ [ 3746, 26 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-import-alias-urlretrieve", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "urllib request alias calls urlretrieve", "spans": [ [ 3753, 20 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::python-chmod-call-with-exec-bit", "atk": "T1222", "mbc": "E1222", "conf": 0.95, "crit": 3, "desc": "Python chmod call sets the executable bit", "spans": [ [ 3814, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "spans": [ [ 3746, 15 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::python-executable", "atk": "T1222", "mbc": "E1222", "conf": 0.85, "crit": 3, "desc": "Python sets executable file permissions", "spans": [ [ 3814, 22 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::python-executable-mode-literal", "mbc": "C0016", "conf": 0.9, "crit": 1, "desc": "Python executable mode literal", "uses": [ 20 ], "spans": [ [ 3814, 0 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::python-executable-mode", "mbc": "C0016", "conf": 0.9, "crit": 1, "desc": "Python applies an executable permission mode", "uses": [ 21 ], "spans": [ [ 3814, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "uses": [ 19 ], "spans": [ [ 3746, 15 ] ] }, { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 3810, 2 ] ] }, { "id": "metadata/import/python/urllib/request::urllib/request", "conf": 0.95, "crit": 3, "desc": "imports urllib.request", "spans": [ [ 3730, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlretrieve-call-name", "conf": 0.75, "crit": 1, "desc": "Call target named urlretrieve", "spans": [ [ 3745, 0 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::python-chmod-call", "atk": "T1222", "mbc": "E1222", "conf": 0.88, "crit": 1, "desc": "Python calls a chmod member", "spans": [ [ 3813, 0 ] ] }, { "id": "micro-behaviors/process/create/direct::python-os-execv-call", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Python os.execv process replacement", "spans": [ [ 3837, 8 ] ] }, { "id": "micro-behaviors/process/create/execv::os-execv", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.85, "crit": 3, "desc": "os.execv - execute with argv list", "spans": [ [ 3837, 8 ] ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "spans": [ [ 3730, 14 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 3745, 41 ], [ 3813, 23 ], [ 3837, 27 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::python-path-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.85, "crit": 3, "desc": "Python calls chmod to change permissions", "spans": [ [ 3813, 8 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 25 ], "spans": [ [ 3730, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlretrieve-dup", "atk": "T1105", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls urllib.request.urlretrieve", "uses": [ 19, 26 ], "spans": [ [ 3745, 26 ] ] }, { "id": "micro-behaviors/process/create/execv::os-exec-family", "atk": "T1059.006", "conf": 0.85, "crit": 3, "desc": "os.exec* family functions", "uses": [ 29 ], "spans": [ [ 3837, 8 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 34 ], "spans": [ [ 3745, 26 ] ] }, { "id": "micro-behaviors/communications/http/download/execute::download-chmod-launch", "conf": 0.95, "crit": 3, "desc": "Downloads, chmods, and launches a file", "uses": [ 9, 20, 21, 22, 27, 34 ], "spans": [ [ 3745, 15 ], [ 3813, 22 ], [ 3816, 20 ], [ 3837, 8 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl output file source", "spans": [ [ 3522, 48 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/download::curl-silent-output", "atk": "T1105", "mbc": "E1105", "conf": 0.75, "crit": 3, "desc": "Silent curl with output", "spans": [ [ 3522, 15 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/download::embedded-download-chmod-command", "atk": "T1105", "mbc": "E1105", "conf": 0.96, "crit": 4, "desc": "Embedded command downloads then applies chmod", "spans": [ [ 3522, 33 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-option-script", "conf": 0.85, "crit": 3, "desc": "curl/wget text includes output option", "spans": [ [ 3522, 21 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-file", "atk": "T1105", "conf": 0.7, "crit": 3, "desc": "References curl file-output option", "spans": [ [ 3522, 15 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "curl text contains silent or fail flags", "spans": [ [ 3522, 8 ] ] }, { "id": "metadata/import/python/base64::base64", "conf": 0.95, "crit": 3, "desc": "imports base64", "spans": [ [ 151, 6 ] ] }, { "id": "metadata/import/python/gzip::gzip", "conf": 0.95, "crit": 3, "desc": "imports gzip", "spans": [ [ 165, 4 ] ] }, { "id": "metadata/import/python/urllib/parse::urllib/parse", "conf": 0.95, "crit": 3, "desc": "imports urllib.parse", "spans": [ [ 177, 12 ] ] }, { "id": "metadata/file/encoded::embedded-code-candidates-6", "conf": 0.8, "crit": 3, "desc": "Source has 6+ code-like string candidates" }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 3259, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1482, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 570, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 615, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 595, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 44, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 673, 0 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-embedded-command", "conf": 0.85, "crit": 3, "desc": "String literal sets curl/wget output file", "spans": [ [ 3521, 22 ], [ 3608, 21 ] ] }, { "id": "micro-behaviors/data/compress/gzip::gzip-compress-call", "conf": 0.9, "crit": 3, "desc": "Python gzip.compress call", "spans": [ [ 2730, 13 ] ] }, { "id": "micro-behaviors/data/control-flow/membership::not-in-membership-check", "conf": 0.3, "crit": 3, "desc": "Python not-in membership check", "spans": [ [ 1640, 22 ] ] }, { "id": "micro-behaviors/data/embedded/script::embedded-php-command-exec-call", "conf": 0.96, "crit": 3, "desc": "Embedded PHP command execution call", "spans": [ [ 805, 5 ] ] }, { "id": "micro-behaviors/data/encode/compression::python-base64-gzip-encode", "conf": 0.95, "crit": 3, "desc": "Python encodes gzip data as Base64", "spans": [ [ 2720, 23 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "spans": [ [ 3068, 0 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 2792, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "spans": [ [ 3241, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 3257, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 3258, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/fd::shell-stdin-fd-redirect", "conf": 0.9, "crit": 3, "desc": "Shell stdin FD redirection", "spans": [ [ 764, 74 ] ] }, { "id": "micro-behaviors/process/create/shell/interactive::sh-interactive", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Interactive shell invocation (sh -i)", "spans": [ [ 815, 7 ] ] }, { "id": "objectives/command-and-control/backdoor/shell/reverse::stdin-redirect-dup", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Stdin redirection (reverse shell indicator)", "spans": [ [ 252, 4 ] ] }, { "id": "objectives/command-and-control/reverse-shell/dev-tcp::python-fstring-dev-tcp-template", "atk": "T1059.004", "conf": 0.94, "crit": 3, "desc": "F-string builds a bash TCP shell", "spans": [ [ 216, 21 ] ] }, { "id": "objectives/command-and-control/reverse-shell/socket-exec::powershell-iex-on-stream-read", "atk": "T1059.001,T1105", "conf": 0.93, "crit": 3, "desc": "PowerShell iex consumes stream-read bytes", "spans": [ [ 1149, 24 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/communications/socket/netcat::nc", "conf": 0.9, "crit": 3, "desc": "nc command invocation", "spans": [ [ 718, 6 ] ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "spans": [ [ 2546, 16 ] ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "spans": [ [ 151, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-exec", "conf": 0.7, "crit": 3, "desc": "References the Bash shell", "spans": [ [ 216, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh-interactive", "conf": 0.9, "crit": 3, "desc": "Interactive shell references (/bin/sh -i)", "spans": [ [ 811, 10 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "spans": [ [ 533, 9 ], [ 724, 9 ], [ 810, 9 ] ] }, { "id": "objectives/collection/archive/create::gzip-compress", "atk": "T1560.001", "conf": 0.5, "crit": 1, "desc": "gzip command compression flag", "spans": [ [ 2122, 0 ] ] }, { "id": "objectives/command-and-control/backdoor/keywords::generic-term-reverse-shell", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Reverse shell keyword", "spans": [ [ 1454, 13 ] ] }, { "id": "objectives/collection/archive/create::tar-compress", "atk": "T1560.001", "conf": 0.6, "crit": 3, "desc": "tar archive creation", "uses": [ 77 ], "spans": [ [ 2122, 6 ] ] }, { "id": "objectives/command-and-control/dropper/execution/execute-download::python-temp-download-chmod-launch", "atk": "T1105,T1222.002,T1059.006", "mbc": "B0030", "conf": 0.95, "crit": 4, "desc": "Temporary path, executable chmod, and launch", "uses": [ 6, 9, 15, 20, 34, 64 ], "spans": [ [ 3258, 5 ], [ 3745, 15 ], [ 3814, 22 ], [ 3837, 8 ] ] }, { "id": "objectives/command-and-control/reverse-shell/socket-exec::any-shell-binary-spawn", "atk": "T1059", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Shell binary spawned directly or fed on stdin", "uses": [ 66, 75 ], "spans": [ [ 811, 0 ] ] } ], "type": "python" }, { "id": 787, "mol": "H₂(DbOs)", "sha": "3beea009e10e0980c8fa3ccd15875565d7f196fec2ae8b6a3538a519716bc6f3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/payloadpk/entry.py", "risk": 3, "size": 2192, "type": "python", "depth": 1 }, { "id": 788, "mol": "O(Xe)", "sha": "c4fe1ab68f04e9cb2c99f44d4b867559f42ac277c4bd3bc214c0a034ddb2c0f8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/payloadpk/main.py", "risk": 39, "size": 1962, "type": "python", "depth": 1 }, { "id": 792, "mol": "H(Po)", "sha": "3d2399e6a1ca6c4ab7c50dafafc1cb0a5bcc5465abf575e6a029d5dcf71597f2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/__init__.py", "risk": 2, "size": 2223, "type": "python", "depth": 1 }, { "id": 796, "mol": "H₃(Db₂FU)", "sha": "c4cb1c68bdc3027b410b4bd29f32cb06953af5cbb773ed658059d5c530a67b64", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/config_loader.py", "risk": 4, "size": 6006, "type": "python", "depth": 1 }, { "id": 798, "mol": "H(Os)", "sha": "0444adeb4c4dc7e18ce8ac4e90b76007c87343a0b6cf7a120781293bdf24d5db", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/constants.py", "risk": 2, "size": 3160, "type": "python", "depth": 1 }, { "id": 801, "mol": "H₂(CrDb)", "sha": "4ed744ed52259f339fa23fc477e9e3c41d755cccdcd33dad6d21f76e5ca0b692", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/prompt_safety.py", "risk": 3, "size": 3076, "type": "python", "depth": 1 }, { "id": 802, "mol": "K(Li)H₂(CmPo)", "sha": "4252532fc6b614d39df64d2cf8376fd46cebe9c738bd17125a6d1b5391c674e1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/runtime.py", "risk": 4, "size": 6444, "type": "python", "depth": 1 }, { "id": 803, "mol": "H₂(CmOs)", "sha": "0e7aa36cf09d2249d33d9e0dd714957d49e0a61bf7bc86a377e8f644288ae9fb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/stealth.py", "risk": 3, "size": 8658, "type": "python", "depth": 1 }, { "id": 804, "mol": "H₄(CmDb₂FOs₂)", "sha": "67192a513c2bbd150299863c92b72fe6ca6afbd9ccabb47fe53f6df1d51ff2c9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/templates.py", "risk": 5, "size": 7049, "type": "python", "depth": 1 }, { "id": 805, "mol": "H₂(F₂Os)", "sha": "1f1e6e24b4b24dff4775c2c4ba445d47a2042a2cffc1677872bd547039d21936", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/workspace.py", "risk": 3, "size": 10248, "type": "python", "depth": 1 }, { "id": 807, "mol": "H(Db)", "sha": "6d8be3cb2ca7c863aecf554e63275d4db72604a8e91ee9976f044204a05e0f67", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/helpers/error_class.py", "risk": 2, "size": 4563, "type": "python", "depth": 1 }, { "id": 809, "mol": "H(Db₂)", "sha": "2ee3f5b19ee004b4b5cd28d5fa86e68e8bd8b884b54f769bb3ab5d1431092a5d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/helpers/json_utils.py", "risk": 2, "size": 4211, "type": "python", "depth": 1 }, { "id": 810, "mol": "H(Db₃)", "sha": "9da377fee64dae191fbec5d19804ed19345f4ab4cbf0be8d44f8fa2def3019e4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/helpers/parsing.py", "risk": 3, "size": 4770, "type": "python", "depth": 1 }, { "id": 811, "mol": "H₂(CrOs)", "sha": "7eec072182e88100b3730c91a6d5d93987447ebf544b1a1b87391f9619e3d501", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/helpers/productivity.py", "risk": 2, "size": 13833, "type": "python", "depth": 1 }, { "id": 813, "mol": "K(Te)H₂(CmOs)", "sha": "8c4d6314999d2cc2c9fb86fcdcc79bd25fbc832dbf04d30735323cc8df39b404", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/infra/job_runner.py", "risk": 4, "size": 5303, "type": "python", "depth": 1 }, { "id": 816, "mol": "H(F)", "sha": "7ad623830871961beda1ffabfb1b6fabd91fbe9463bb18901d470f376327eed8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/infra/workspace_fs.py", "risk": 2, "size": 4193, "type": "python", "depth": 1 }, { "id": 818, "mol": "H(Db₂)", "sha": "c1a4dac26cc35171493da11f1ddb8e97d7bdbb524a820ce8fc910b429a8a6f0c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/safety/scan.py", "risk": 3, "size": 10873, "type": "python", "depth": 1 }, { "id": 820, "mol": "H₄(Cm₂CrDbOs)", "sha": "cf4a39847d9a49150b90eba1a6153a3b76000908262bac70adc6e4a6b890c105", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/security/audit.py", "risk": 4, "size": 5938, "type": "python", "depth": 1 }, { "id": 821, "mol": "H(Cm)", "sha": "9ddeac8679a7ff2e67c9d94d0d5ba14fcf628b538ea798fbc1fa88a0f2b75889", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/security/compliance.py", "risk": 2, "size": 15506, "type": "python", "depth": 1 }, { "id": 822, "mol": "H₂(Os₃Po₆)", "sha": "23a4cf94047ca735e9a8cc1440930477deb880f47d48a125112feae1c75b5f2f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/security/osutil.py", "risk": 7, "size": 5349, "type": "python", "depth": 1 }, { "id": 823, "mol": "H₃(Db₃FOs)Md", "sha": "d074890c721e811ef66342d965097d36cd27f347ae4f1e5e0c35b5914606b98f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/platform/lib/security/secret_patterns.py", "risk": 5, "size": 6381, "type": "python", "depth": 1 }, { "id": 825, "mol": "H₂(DbOs)", "sha": "e2c6337dc0b2944bc928c5ce8217956e492d65f8383e02ab0ec1009eadeb3b2a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/portmap/entry.py", "risk": 3, "size": 2192, "type": "python", "depth": 1 }, { "id": 826, "mol": "H(Os)", "sha": "b778c9892f427e9303cc8f2ec5fa6ba7a9db8901f104ca836b13f6e938cb180a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/portmap/main.py", "risk": 2, "size": 3684, "type": "python", "depth": 1 }, { "id": 831, "mol": "H₂(DbOs)", "sha": "1be38e99879b6ac98f242aa56f8e5961f3ae70eae3e02d682f5ef62cd6ae472b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/portscanx/entry.py", "risk": 3, "size": 2180, "type": "python", "depth": 1 }, { "id": 832, "mol": "H₂(Cm₂Os)", "sha": "89784f989e26a6d0425e319d1bfec9767600ac32e88a6f330ebc7abdfa338566", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/portscanx/main.py", "risk": 2, "size": 2360, "type": "python", "depth": 1 }, { "id": 837, "mol": "H₂(DbOs)", "sha": "a77265ee3184df8c3651365238a7f7091ac6ffc8dd48cb2b38ae475fabdd3200", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/protodetect/entry.py", "risk": 3, "size": 2109, "type": "python", "depth": 1 }, { "id": 838, "mol": "H(Cm₅)", "sha": "ff9a7a8087554c46a0e57acedad299757babd5fea76a7ee77a73854d357de147", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/protodetect/main.py", "risk": 2, "size": 1779, "type": "python", "depth": 1 }, { "id": 842, "mol": "H(Db)", "sha": "9e6e779c5f37367267afcdbf37212cf009d88ddc2c06d916926f78af6b5a870f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/providers/__init__.py", "risk": 2, "size": 1163, "type": "python", "depth": 1 }, { "id": 844, "mol": "H₃(Cm₉Db₂Os₂)", "sha": "c569cab87826b7962348240ef21a9d56635f481dac203a80e6a299c4b306d3dd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/providers/lib/__init__.py", "risk": 5, "size": 45391, "type": "python", "depth": 1 }, { "id": 845, "mol": "K(Am)H(Cm₃)", "sha": "465f692563a746c7bfbb0e62fda1c2120e5a75f5f9444c88a53c9f152f2f9606", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/providers/lib/registry.py", "risk": 3, "size": 7666, "type": "python", "depth": 1 }, { "id": 847, "mol": "H₂(DbOs)", "sha": "c7d6a03e0bb23838974bb02d4384d987c98ed03a984570e1617f6b924d1a76e5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/proxycheck/entry.py", "risk": 3, "size": 2101, "type": "python", "depth": 1 }, { "id": 848, "mol": "H(Cm₅)", "sha": "67e4852950b6df4c9b5980a97a23484897fd872aea3c56ae315f7e162a4944cf", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/proxycheck/main.py", "risk": 1, "size": 1332, "type": "python", "depth": 1 }, { "id": 853, "mol": "H₂(DbOs)", "sha": "eca13e261322bd75a47fd961f2b9283447f8f407ee33189214d720519533fca2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/pwdaudit/entry.py", "risk": 3, "size": 2183, "type": "python", "depth": 1 }, { "id": 859, "mol": "H₂(DbOs)", "sha": "108de6ce2b477f5a6077106dc7f42ff5216de901c5d923ca6bf8574e11f4707a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/pyrun/entry.py", "risk": 3, "size": 2200, "type": "python", "depth": 1 }, { "id": 860, "mol": "H₂(DbPo₂)", "sha": "5705af10406696981976906586c7167e443d5d1b9a74b8a69fc7446f37110e92", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/pyrun/main.py", "risk": 4, "size": 1609, "type": "python", "depth": 1 }, { "id": 865, "mol": "H₂(DbOs)", "sha": "2233c847e217939abd3aaffac20682df2b6a168bc5ca7985d9ea65b530326e98", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/querykit/entry.py", "risk": 3, "size": 2189, "type": "python", "depth": 1 }, { "id": 866, "mol": "H(Db)", "sha": "caf7773f6926b8632434be871b07b8759c41de5d849993271e951a043b25c475", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/querykit/main.py", "risk": 2, "size": 3126, "type": "python", "depth": 1 }, { "id": 871, "mol": "H₂(DbOs)", "sha": "586f96307ce87cb62b2e78a7db1ccd6ff3ca4c17d6073b1bc6820f7db94f957b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redirecthunter/entry.py", "risk": 3, "size": 2111, "type": "python", "depth": 1 }, { "id": 872, "mol": "H(Cm₄)", "sha": "e471cfdb944afb6f723d21574b64b0d21fc32fd22f6484e12b748e3e760347e2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redirecthunter/main.py", "risk": 2, "size": 1875, "type": "python", "depth": 1 }, { "id": 877, "mol": "H₂(DbOs)", "sha": "f4481c1edcf492ebee53d4138a72ddf07bea237f14d128093a114a84ed82d43a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redirtrace/entry.py", "risk": 3, "size": 2191, "type": "python", "depth": 1 }, { "id": 878, "mol": "H(Cm₃)", "sha": "f5eb23b4a429bac89b13338e616897823ef2c614a405e569bde860fc77477eb0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redirtrace/main.py", "risk": 2, "size": 1570, "type": "python", "depth": 1 }, { "id": 883, "mol": "H₂(DbOs)", "sha": "2fc1add84e5f13f0320aad184fbd29a4c5fa89bc3618f7955736bc4acc7b5e5a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redisenum/entry.py", "risk": 3, "size": 2185, "type": "python", "depth": 1 }, { "id": 884, "mol": "H(Po)", "sha": "c1c84e8b7cbbdd270a54b5f488669aa2f005b42538343faefbc4be92d2498ccc", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redisenum/main.py", "risk": 2, "size": 828, "type": "python", "depth": 1 }, { "id": 888, "mol": "H(Po)", "sha": "c945291b0f6866769c980b7ae6dceb816d42327280e422fdfd9780dd95cb51a4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/__init__.py", "risk": 2, "size": 1296, "type": "python", "depth": 1 }, { "id": 890, "mol": "H₃(Db₂Po₂U)", "sha": "02f8fb7a765214b8e5be168f379ec8354d8b9403411520e61c98552a18c2cf79", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/redteamer.py", "risk": 6, "size": 62324, "type": "python", "depth": 1 }, { "id": 893, "mol": "H₂(DbOs)", "sha": "20efe1e2f4c6914100345846297b9fc86cbb2d6ea3d22da4ab15db2f553d3085", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/intel/kg_backend.py", "risk": 3, "size": 11437, "type": "python", "depth": 1 }, { "id": 894, "mol": "H(Db₂)", "sha": "757eb7cec624f81187a4695523a90b93861845945131c75556f8251bc83646b1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/intel/knowledge_graph.py", "risk": 3, "size": 6057, "type": "python", "depth": 1 }, { "id": 895, "mol": "H₃(CmDb₃Po)", "sha": "a2c59d892ca19f30aebe0a90e8dd155201084d257f24aac2881560a87a358dcf", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/intel/oracle.py", "risk": 6, "size": 28225, "type": "python", "depth": 1 }, { "id": 896, "mol": "H₃(OsDbPo)", "sha": "8ef7b593d248e01a56130e74435f0527a80f536a0d16b48436fb7896bb9ed17c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/intel/supervisor.py", "risk": 42, "size": 14414, "type": "python", "depth": 1 }, { "id": 899, "mol": "H₃(FOs₂Po₂)", "sha": "663d0382d5d78f6d03928c81d54ef947b0e9d55f80c3c17e061dd3dcd22fd5d6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/red/console_input.py", "risk": 6, "size": 15594, "type": "python", "depth": 1 }, { "id": 900, "mol": "H₂(Db₃Po)", "sha": "29610ce9e31702294f9064b66d52e7781846905d79b00d89bd5739ad3f9fdf4e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/redteam/lib/red/console_ui.py", "risk": 5, "size": 60871, "type": "python", "depth": 1 }, { "id": 904, "mol": "H₂(DbOs)", "sha": "07f91d08e442bb343baac640864f70a6e2d68c5c520068872ce5a95abe3e1d44", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/reqdiff/entry.py", "risk": 3, "size": 2096, "type": "python", "depth": 1 }, { "id": 905, "mol": "H(Cm₄)", "sha": "6ff3e195b5c0b79802462d4b2aa648d75e38af6ad4150fa1c6a7f23713d39ae1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/reqdiff/main.py", "risk": 2, "size": 1969, "type": "python", "depth": 1 }, { "id": 910, "mol": "H₂(DbOs)", "sha": "3c8270def4719ff76b8fbc654497156296a03a452114134d8a675eecefb389de", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/reqtool/entry.py", "risk": 3, "size": 2180, "type": "python", "depth": 1 }, { "id": 911, "mol": "H₃(Cm₃DbF)", "sha": "fd7865bbfd91e69be0d551578e188c272a932988fbfa5aaa0cc82e73da795166", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/reqtool/main.py", "risk": 4, "size": 2578, "type": "python", "depth": 1 }, { "id": 916, "mol": "H₂(DbOs)", "sha": "ee39447f144476053ba1c784216b8df078581151c876045a5b660ca2942ce8b6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/robotsparse/entry.py", "risk": 3, "size": 2214, "type": "python", "depth": 1 }, { "id": 917, "mol": "H(Cm)", "sha": "f5591012d1d137c87ee078a302c880f365e308a200891e284d489d0a797c1061", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/robotsparse/main.py", "risk": 2, "size": 1366, "type": "python", "depth": 1 }, { "id": 922, "mol": "H₂(DbOs)", "sha": "36aebc2758d7d020629a9cf8396938dacc4e3fd9290133d423aee141d1342398", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/search_cve/entry.py", "risk": 3, "size": 2253, "type": "python", "depth": 1 }, { "id": 923, "mol": "H₂(CmDb)", "sha": "2f09bc51b4a2e4c57ed5e21da5293afd683e2c4be81e1b0862d515bf7467046e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/search_cve/main.py", "risk": 3, "size": 900, "type": "python", "depth": 1 }, { "id": 928, "mol": "H₂(DbOs)", "sha": "abb9d0b81a57e8007b49a72702c25c16768f8f16cc3914b9fcd97d21a7f57ec7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/secretscanr/entry.py", "risk": 3, "size": 2201, "type": "python", "depth": 1 }, { "id": 929, "mol": "H(Db)", "sha": "fb5b4aa02f32a5fd9a1a95b304cf7ee3d046f83de01cd377f0a9293d38e9908c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/secretscanr/main.py", "risk": 2, "size": 2237, "type": "python", "depth": 1 }, { "id": 934, "mol": "H₂(DbOs)", "sha": "13e6217acce63265450fe25539068060bf8dd4c8f49cb4fff76d05c1dccea7e3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/securitytxt/entry.py", "risk": 3, "size": 2105, "type": "python", "depth": 1 }, { "id": 935, "mol": "H(Cm₄)", "sha": "18fa7ba60d15ed3b92d80b497d2be0a505fc2773f7e5a1879c79c7c05969fe66", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/securitytxt/main.py", "risk": 2, "size": 1284, "type": "python", "depth": 1 }, { "id": 940, "mol": "H₂(DbOs)", "sha": "018a41a16b903e92879d24b1e9b306e54dde1230fdd616186144f8f0a2d417c0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/shodan/entry.py", "risk": 3, "size": 2196, "type": "python", "depth": 1 }, { "id": 941, "mol": "H₂(Cm₃Os₂)", "sha": "9e50ed0ba903051bec765d7cfd9b0d793257b1339b890ec6176c3cf359fae89b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/shodan/main.py", "risk": 2, "size": 685, "type": "python", "depth": 1 }, { "id": 946, "mol": "H₂(DbOs)", "sha": "5e3802f98427a8bb314796ba9c38506d159cd0725a817114d00963ecfeaae2d8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sitemapper/entry.py", "risk": 3, "size": 2212, "type": "python", "depth": 1 }, { "id": 952, "mol": "H(F)", "sha": "b4ce8061ad8b70736278735dfab962e4af0792dc77cc84b6ed07847a4cf7f40a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/skills/entry.py", "risk": 2, "size": 5642, "type": "python", "depth": 1 }, { "id": 955, "mol": "H₂(DbOs)", "sha": "d59bb170343ca0fc934d66957f5488b6c04e8855f85096876f81d9a8ad8cfba8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/smb_enum/entry.py", "risk": 3, "size": 2174, "type": "python", "depth": 1 }, { "id": 956, "mol": "H₂(OsPo)", "sha": "531a3836c682ead183d73b9607f6c6e28d7e0488bf069a5b372a48718e0178a0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/smb_enum/main.py", "risk": 2, "size": 822, "type": "python", "depth": 1 }, { "id": 960, "mol": "H₂(DbOs)", "sha": "def60da1c6e40f8f0a2fe02745e0b3e3bb6e05ab3083cd1e36572dd9ac121bd4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/snmpenum/entry.py", "risk": 3, "size": 2175, "type": "python", "depth": 1 }, { "id": 961, "mol": "H(Po)", "sha": "c26b0d46880de6981534c13dee53f2de51b74663f3090c9c5a77e8135ad7a037", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/snmpenum/main.py", "risk": 1, "size": 649, "type": "python", "depth": 1 }, { "id": 966, "mol": "H₂(DbOs)", "sha": "7eac55e77729d9fd75dd96b4dae26f45a4e3a12c4da7a4c5f8bc5c9afa3082e7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/socat/entry.py", "risk": 3, "size": 2208, "type": "python", "depth": 1 }, { "id": 967, "mol": "H(Po)", "sha": "c618cea607145820003715afd780577cd7caae43a7ac12c501f0c78322516207", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/socat/main.py", "risk": 1, "size": 273, "type": "python", "depth": 1 }, { "id": 972, "mol": "H₂(DbOs)", "sha": "3c5d17e3f331be8eb186964ed4fcb74d18eb894014e64cedacbd6d9f6db047c1", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sourcemap/entry.py", "risk": 3, "size": 2185, "type": "python", "depth": 1 }, { "id": 973, "mol": "H(Cm₃)", "sha": "048d15f8e508a9dfbabf53047ced5d2ce31aef154776b246e018d858c63a1d48", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sourcemap/main.py", "risk": 2, "size": 1909, "type": "python", "depth": 1 }, { "id": 978, "mol": "H₂(DbOs)", "sha": "1ec9407e74210e6932152fcdc214dbbf6713076d747ed2a223da8681d441d5e6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sqlmap/entry.py", "risk": 3, "size": 2178, "type": "python", "depth": 1 }, { "id": 979, "mol": "H(Po)", "sha": "49568ae9aa1492d2613eb48a70315d400be8e3e9d1d6f3a2ec1cd0e7927d82fd", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sqlmap/main.py", "risk": 1, "size": 434, "type": "python", "depth": 1 }, { "id": 984, "mol": "H₂(DbOs)", "sha": "7d7fe04e1801b532dd67f314d94eb773f145cfb29ea949e0e5af1127b9d0ccbf", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sslprobe/entry.py", "risk": 3, "size": 2194, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BBz!0M]Bp8-0AbP=saAIQu3tar%z6iv$By/MdzdK\u00267ze:AlBrCa5By/MdzdLmvBzkP6Dt^Xj3jmbJwO96aB8kh[wPz)1x(mK3c$)KuBugK=BAeG!ar\u00260XaAhmtBugKUzGE0:at+]hdiHiaaAITBiTM#LarUxgaz#ataztXmBuf:KarR^HarR!EwPS6nzxHb(A=M8siV@9OB95KBwPq\u003cbA+e=93lQDlaARTHiTM#LarR^HarUSwA=-A!azC.nc#:9BBrCHxat+]hdgdguarR^HarUfoCPYc(B8#dIv@=c?By!/\u0026wObv[y\u0026\u003c2]z/fVdCYUt.3lQDlarR^HaA}KwxDRwmv@2T$e[n{kvru6/v@Dm5wN/*@z/c%KxM4%lefF[IA=--YaARsmwP8ZkjVB(K3lQDlarR^HarR^HaA}KwxDQ/bCRjhXvq]N{z!0M]BsqiGv@2T$e]$@vyH}Podj=P.wPz%9A:JG#B98qdzdL\u003ezz/Z1HayPslB2\u003cTJarR^HarR^HarR^HarR!Fe]$PCBzkP6z/{dIi4kgSarR^HarR^HarR^HarR!Fe[n*qzE)s1c[5+EB95@QAbP=sdjCPDarR^HarR^HarR^HarR!pwPz(njS[!#xjVg7wO2)(wPz(vdgdguarR^HarUMuByeG*w]zZ3auZ\u0026Tvru75x(dAlB98CwBzkP6c$u?eBxY@bz/!rSw]zZ3b3=-xa%*Xvc1FbAnie4\u003eiWEYEc0qups%tyFA+fiavpJ\u003c%BB4Usw]x?Ox(dBcz/fbsB-.ax3lQDlarR^Haz#atuTWL*wPw[Ray[]5wPRT6wIe4CA=ubmzdLb9wPz(%b5Rsvl1UjIAW1^uar\u0026avasgLvb$H6yo/:O0asgekc0zGwe]\u003eJxy***+d0f=HzF0/IBzkP6Dt^Xje{hnCdgdguarR^HarUi6D2)tewOc3bjS(d\u003cz//t{w]}Q8at1ZDvru75x(dAlzF%.EBzkP6Dt^Xje{hnCdjD(Wvr(]3arR^HarR^HB75%cauZ\u0026KB%7ynAV/cGaA!(wzxJC2A=-{DwPPsAB9g@bwN/*Fy\u0026\u0026AXzdK[xax@b2t).X%arR^HarUPBBrAZ?tm8F}arR^HarR^HarUnux(!urwPx*ODT{\u00262BsqxrfKk/kz/M$BazCZov}xX5tpjcaB9h5mcTwfHa$K6zarR^HarR^HarR!sb6d)oygQ)%iV@=Wx\u003e8lkCV#\u003ecazbLjaB22yzxJC2A=+IkB9g@bwN/*ft}7gCed9HxarR^HarR^HarUnu", "ln": 0, "col": 1, "line": 1 }, { "b": "az2!px(W^aaA}KwxLzubf/g1-vr(]rdgdguarR^HarU(xy?d3:A+6kljS)%IazbLjaAFVtzxK1ezGu}mw/#dEB97\u0026hBAqUuBz96DdK3rE3lQDlarR^HazCBgCwg(7v{%y*B2\u003cTJarR^HarR^HarR!BB-YlAAbYxawgh4lCwg(7v{%y*ax7N3B2\u003eB\u003cCwg(7v{]", "ln": 1217, "col": 30, "line": 28 }, { "b": "xjSi1w/$+}B76fjAWUGIasztzA+PchuU%v}B75Y)cN*fHy\u0026:egwQL:farR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxJKnmriA!AYLs\u0026wQL:f", "ln": 1561, "col": 88, "line": 34 } ], "depth": 1, "facts": { "imp": [ [ "", "int" ], [ "", "ssl.create_default_context" ], [ "", "socket.create_connection" ], [ "", "ctx.wrap_socket" ], [ "", "socket.socket" ], [ "", "s.settimeout" ], [ "", "s.connect" ], [ "", "s.getpeercert" ], [ "", "datetime.strptime.replace" ], [ "", "datetime.strptime" ], [ "", "datetime.strptime.replace" ], [ "", "datetime.strptime" ], [ "", "datetime.now" ], [ "", "cert.get" ], [ "", "dict" ], [ "", "dict" ], [ "", "len" ], [ "", "out.append" ], [ "", "s.startswith" ], [ "", "out.append" ], [ "", "hasattr" ], [ "", "datetime" ], [ "datetime", "datetime" ], [ "", "socket" ], [ "", "ssl" ], [ "datetime", "timezone" ] ], "mbr": [ "cert.get", "cert.issuer", "cert.notAfter", "cert.notBefore", "cert.subject", "ctx.wrap_socket", "datetime.now", "datetime.strptime", "datetime.strptime.replace", "e.verify_message", "out.append", "s.connect", "s.getpeercert", "s.settimeout", "s.startswith", "socket.create_connection", "socket.socket", "ssl.SSLCertVerificationError", "ssl.create_default_context", "timezone.utc" ], "tgt": [ "cert.get", "ctx.wrap_socket", "datetime.now", "datetime.strptime", "datetime.strptime.replace", "dict", "hasattr", "int", "len", "out.append", "s.connect", "s.getpeercert", "s.settimeout", "s.startswith", "socket.create_connection", "socket.socket", "ssl.create_default_context" ], "funcs": [ [ "ssl_cert_info", 67 ] ], "metrics": { "ast": { "op.add": 1, "op.lor": 1, "op.sub": 1, "max_depth": 15, "call_count": 23, "node_count": 597, "member_count": 20, "max_array_len": 4, "op_density.add": 0, "op_density.lor": 0, "op_density.sub": 0, "max_concat_chain": 2, "member_depth_max": 3 }, "file": { "size": 1661, "entropy": 4.71 }, "text": { "lines": 36, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 401, "char_entropy": 4.71, "unique_chars": 74, "top_char_null": 0, "string_density": 0.5, "top_char_ratio": 0.07, "avg_line_length": 45.14, "max_line_length": 130, "empty_line_ratio": 0.06, "last_line_length": 28, "whitespace_ratio": 0.26, "identifier_density": 3.06, "line_length_stddev": 30.73, "normalized_string_count": 3, "repeated_char_sequences": 10, "suspicious_identifier_ratio": 0.11, "normalized_unique_identifiers": 8.9 }, "binds": { "count": 9 }, "binary": { "peak_region_bytes": 1661, "peak_region_entropy": 4.78 }, "source": { "function_count": 1 }, "imports": { "count": 5, "stdlib_count": 4, "stdlib_ratio": 0.8, "third_party_count": 1, "third_party_ratio": 0.2 }, "strings": { "bytes": 469, "count": 18, "avg_length": 26.06, "max_length": 112, "avg_entropy": 3.06, "empty_count": 1, "entropy_stddev": 1.44 }, "functions": { "count": 1, "density": 2.78, "avg_params": 2, "code_ratio": 0.86, "max_params": 2, "avg_name_length": 13, "avg_length_lines": 31, "max_length_lines": 31, "min_length_lines": 31, "avg_param_name_length": 4 }, "identifiers": { "count": 110, "unique": 46, "avg_length": 7.02, "max_length": 24, "min_length": 1, "avg_entropy": 2.14, "reuse_ratio": 0.42, "length_stddev": 5.17, "sequential_names": 5, "single_char_count": 5, "single_char_ratio": 0.11, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.96 } } }, "id": 985, "mol": "K(Te)H₂(Cm₆Db)Md(In₃)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sslprobe/main.py", "pid": 0, "risk": 7, "sha": "24afb444845799a77c211cba06acb2527fddaaf6648b4c4e87eb3d97e570fd45", "size": 1661, "traits": [ { "id": "metadata/import/python/datetime::datetime", "conf": 0.95, "crit": 2, "desc": "imports datetime", "spans": [ [ 30, 0 ] ] }, { "id": "metadata/import/python/datetime/datetime::datetime", "conf": 0.95, "crit": 2, "desc": "imports datetime from datetime", "spans": [ [ 46, 0 ] ] }, { "id": "metadata/import/python/socket::socket", "conf": 0.95, "crit": 3, "desc": "imports socket", "spans": [ [ 7, 6 ] ] }, { "id": "metadata/import/python/ssl::ssl", "conf": 0.95, "crit": 3, "desc": "imports ssl", "spans": [ [ 21, 3 ] ] }, { "id": "metadata/import/python/datetime/timezone::timezone", "conf": 0.95, "crit": 2, "desc": "imports timezone from datetime", "spans": [ [ 56, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 822, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 273, 0 ] ] }, { "id": "micro-behaviors/communications/proxy/relay::relay-target-connect-method", "atk": "T1090,T1572", "conf": 0.86, "crit": 3, "desc": "Client API create_connection call", "spans": [ [ 278, 24 ] ] }, { "id": "micro-behaviors/communications/proxy/target::target-connect-python", "atk": "T1090,T1572", "conf": 0.94, "crit": 3, "desc": "Python connects to target variable", "spans": [ [ 285, 23 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-create-connection-text", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python socket create_connection in text", "spans": [ [ 278, 25 ] ] }, { "id": "micro-behaviors/communications/socket/disconnect::python-context-managed-tls", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Uses a context-managed Python TLS socket", "spans": [ [ 341, 65 ] ] }, { "id": "micro-behaviors/communications/socket/ssl::python-ssl-default-context", "conf": 0.85, "crit": 3, "desc": "Python creates a default TLS context", "spans": [ [ 236, 26 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::broad-exception-bound-catch", "atk": "T1027", "mbc": "C0027", "conf": 0.8, "crit": 1, "desc": "Catches broad Exception into a variable", "spans": [ [ 1609, 0 ] ] }, { "id": "micro-behaviors/data/source/language::python-timezone-utc", "conf": 0.8, "crit": 3, "desc": "Python timezone.utc reference", "spans": [ [ 615, 12 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "micro-behaviors/communications/ip/endpoint::https-port-443-protocol", "conf": 0.6, "crit": 3, "desc": "References HTTPS service port 443", "spans": [ [ 101, 15 ], [ 198, 22 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method-short", "conf": 0.85, "crit": 3, "desc": "Short Python socket connect call", "spans": [ [ 455, 10 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-create-connection-call", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python socket create_connection call", "spans": [ [ 278, 24 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "spans": [ [ 0, 13 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-socket-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.socket() call", "spans": [ [ 362, 13 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 2 ], "spans": [ [ 7, 6 ] ] }, { "id": "micro-behaviors/communications/ip/endpoint::https-port-443", "conf": 0.6, "crit": 1, "desc": "HTTPS service port number", "uses": [ 15 ], "spans": [ [ 198, 0 ] ] }, { "id": "micro-behaviors/communications/socket/create::socket-creation", "atk": "T1071", "mbc": "C0001", "conf": 1.0, "crit": 2, "desc": "Socket creation patterns", "uses": [ 19 ], "spans": [ [ 362, 0 ] ] }, { "id": "micro-behaviors/communications/ip/endpoint::common-service-port", "conf": 0.6, "crit": 3, "desc": "Common service port number", "uses": [ 21 ], "spans": [ [ 101, 15 ], [ 198, 22 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-method", "conf": 0.85, "crit": 3, "desc": "Python socket-like connect call", "uses": [ 16 ], "spans": [ [ 455, 10 ] ] }, { "id": "micro-behaviors/communications/socket/connect::socket-client-operations", "atk": "T1071", "mbc": "C0001", "conf": 1.0, "crit": 2, "desc": "Client socket operations", "uses": [ 24 ], "spans": [ [ 455, 0 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-python", "atk": "T1071", "mbc": "C0001", "conf": 0.75, "crit": 3, "desc": "Initiate socket connection (Python)", "uses": [ 22, 25 ], "spans": [ [ 362, 13 ], [ 455, 10 ] ] } ], "type": "python" }, { "id": 990, "mol": "H₂(DbOs)", "sha": "064dda391aeec4f871276dd5ab7710ceb700053ad963c8238bd4c49facc98da3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sslscan/entry.py", "risk": 3, "size": 2097, "type": "python", "depth": 1 }, { "id": 991, "mol": "H(Po)", "sha": "9a5eb90517977f05c83f28f452844f294e6a9fccc7b06f375673e69b38cdd969", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/sslscan/main.py", "risk": 1, "size": 327, "type": "python", "depth": 1 }, { "id": 996, "mol": "H₂(DbOs)", "sha": "7a94fbd39d452db5b06d1e40d24a693323ecb74cd7df78a208ade7fbbca2a1ba", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ssrfcanary/entry.py", "risk": 3, "size": 2190, "type": "python", "depth": 1 }, { "id": 997, "mol": "H(Cm₃)", "sha": "66891307661ae3aac140d6e78274454024f10acfae83c95fd4bb184ca4d8f790", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/ssrfcanary/main.py", "risk": 2, "size": 1709, "type": "python", "depth": 1 }, { "id": 1002, "mol": "H₂(DbOs)", "sha": "8a863e1a5e56e2d51b92c3818057ec2c9f425477328bd545a7af08d8afe175a6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/subfinder/entry.py", "risk": 3, "size": 2103, "type": "python", "depth": 1 }, { "id": 1003, "mol": "H(Po)", "sha": "92b3b85b0645a10c387a9e0962057f5b83331c9b7e187a8720a5901e7f04034e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/subfinder/main.py", "risk": 1, "size": 355, "type": "python", "depth": 1 }, { "id": 1008, "mol": "H₂(DbOs)", "sha": "06d39f338c44fd263ddf445d6c582982aa961262f47e61708c300e5ab1d53463", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/takeoverfp/entry.py", "risk": 3, "size": 2208, "type": "python", "depth": 1 }, { "id": 1009, "mol": "H₂(Cm₆Po)", "sha": "096ba77d98b4e00f7c9ddc512af5d8c82b30e0c11b53200befc0e6af4377862b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/takeoverfp/main.py", "risk": 4, "size": 2586, "type": "python", "depth": 1 }, { "id": 1014, "mol": "H₂(DbOs)", "sha": "9be20d2b42b145bf2dba5b9b2c92d03f2ba4c1d38bec1f5c217fc477789e5f29", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/techfp/entry.py", "risk": 3, "size": 2192, "type": "python", "depth": 1 }, { "id": 1015, "mol": "H(Cm)", "sha": "78a7b6d71108d558def90caf5d767f1e640248f2727e89bd6d82fdf166ac162d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/techfp/main.py", "risk": 2, "size": 2613, "type": "python", "depth": 1 }, { "id": 1020, "mol": "H₂(DbOs)", "sha": "c0aeada5f76d3776a07f64feb0d8698a16c3b9518d53dd6bad943be05261b8c5", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/testssl/entry.py", "risk": 3, "size": 2099, "type": "python", "depth": 1 }, { "id": 1021, "mol": "H(Po)", "sha": "7b7a24901d8080814cbc89e77b76c134945a3d4539b2cce91632fb4ddc60a19d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/testssl/main.py", "risk": 2, "size": 633, "type": "python", "depth": 1 }, { "id": 1026, "mol": "H₂(DbOs)", "sha": "12c5445276152e1afa512ae0ce1d9181e8d33ca1ea7bad0567d78cead949a6b0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tfsec/entry.py", "risk": 3, "size": 2184, "type": "python", "depth": 1 }, { "id": 1027, "mol": "H₂(CmOs)", "sha": "e4faf4f2bda7153f021eaf0ccadd1391fd1b79d8e9360f06a5fc66f69a639915", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tfsec/main.py", "risk": 3, "size": 2479, "type": "python", "depth": 1 }, { "id": 1031, "mol": "H₂(DbF)", "sha": "698031abd465baf48cb7ee7223f6406a73319929543f67d3478f3215aa1b1017", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/__init__.py", "risk": 3, "size": 3506, "type": "python", "depth": 1 }, { "id": 1036, "mol": "H₂(OsPo₃)", "sha": "26ac1ee705128e5949016bc754925a2495f6219d85a0bb22dd6b801a5c62fe77", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/aux_tools.py", "risk": 3, "size": 1802, "type": "python", "depth": 1 }, { "id": 1037, "mol": "K(Te₂)O(Dy)H₃(Cm₂Os₂Po)", "sha": "d1a52c099f525ad4750d255480703275ac20e8e3350e7a176827036956dec453", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/availability.py", "risk": 7, "size": 11472, "type": "python", "depth": 1 }, { "id": 1039, "mol": "O(Er)H₂(Cm₂Po)", "sha": "c40b735d25c673f99281ee426c6ef99341a344aed63518bfab99de1e1d6ee86d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/bypass_403.py", "risk": 41, "size": 5219, "type": "python", "depth": 1 }, { "id": 1041, "mol": "H₂(DbPo₂)", "sha": "1a3b318cd41bb6c17b6066f09c5106559ba06bcca9654e6f8e96cc52b0b134d0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/code_harness.py", "risk": 4, "size": 6228, "type": "python", "depth": 1 }, { "id": 1042, "mol": "H₂(Db₂F)", "sha": "602c8863eefffd59b0808b9cbc3f9d5bec1404889ccc7b2da6a50503974964c7", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/coverage.py", "risk": 3, "size": 7621, "type": "python", "depth": 1 }, { "id": 1044, "mol": "K(Te₂)H₄(DbF₂OsPo)", "sha": "d71d3a90f0b5459ffd16bddd5718ac7ffe470b07c3347bb7c4c7058035af86b0", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/dispatch.py", "risk": 7, "size": 49656, "type": "python", "depth": 1 }, { "id": 1045, "mol": "H₃(Cr₂Db₃F₂)", "sha": "45e16907fa80754524682b83e10653a498c100ff928b6071f6011210af268302", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/engagement_bundle.py", "risk": 6, "size": 8596, "type": "python", "depth": 1 }, { "id": 1046, "mol": "H₃(Cr₂DbPo)", "sha": "be9ab894455f50dfafc1acb610b4089c80096a4d9e4e3a69b742114b644a67f2", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/evidence.py", "risk": 4, "size": 4784, "type": "python", "depth": 1 }, { "id": 1047, "mol": "H(Db)", "sha": "f04a21742383f2738d044273134eec5b76a6189cfcf3caf796a07ab405cbdb49", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/exploit_catalog.py", "risk": 2, "size": 16454, "type": "python", "depth": 1 }, { "id": 1048, "mol": "K(Te)H₄(CmF₃OsPo)", "sha": "5e613b71cfbae3b6a99a3fe60c3817af90c4ca059cb98737810714e891f340ef", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/guardrails.py", "risk": 6, "size": 1225, "type": "python", "depth": 1 }, { "id": 1049, "mol": "H(F)", "sha": "85cc72b614b88acb2a67bf15f5e55c2db523e58656f5c5cd2a3fe245d1d13850", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/html_report.py", "risk": 2, "size": 2660, "type": "python", "depth": 1 }, { "id": 1050, "mol": "H₃(Cm₈Db₅F)", "sha": "b811e4559eead5db638c8c829e5b19df0f12345b30c4878e831573e3e9cc1dc3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/http_replay.py", "risk": 8, "size": 23502, "type": "python", "depth": 1 }, { "id": 1051, "mol": "H₄(Cm₃Db₂OsPo₂)", "sha": "b1b64d73aa8c77a9e6508316a03ddc2cea295cb5840597d9914e450677709def", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/http_tools.py", "risk": 7, "size": 9719, "type": "python", "depth": 1 }, { "id": 1052, "mol": "H₃(DbFOs)", "sha": "c7e3581f52ff746445976a3c217cb2f6058a1ad0e09972feece673bb7274492c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/inject_probe.py", "risk": 4, "size": 12218, "type": "python", "depth": 1 }, { "id": 1053, "mol": "K(Te)H₃(Cm₃DbOs₂)", "sha": "774d3c6981b638eae34376dab715462765dc23259609109f1f60d173adb75740", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/intel.py", "risk": 5, "size": 16023, "type": "python", "depth": 1 }, { "id": 1054, "mol": "H(Po₂)", "sha": "f4b4e91b0ba416f9d64106e0dc24c7780851241f0970f46ed876b117b0b58096", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/job_registry.py", "risk": 3, "size": 7479, "type": "python", "depth": 1 }, { "id": 1055, "mol": "H(Po)", "sha": "30fdf6a087fa71908337e29eaf9ac8db6709334b5974344edf7be23b2969913e", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/jobs.py", "risk": 2, "size": 1116, "type": "python", "depth": 1 }, { "id": 1056, "mol": "H₂(Cm₃Db₂)", "sha": "cde2dbaa07e39a45c7e6da9de3efbbfb4876140432c86ce8c24d0b2d1fbb794c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/js_tools.py", "risk": 4, "size": 9023, "type": "python", "depth": 1 }, { "id": 1057, "mol": "K(Te)H₃(FOsPo₂)", "sha": "5b87268a7f583b2f33fe18efe89493bb5b43b19f65f0291dbce8425d87217420", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/metasploit.py", "risk": 42, "size": 7947, "type": "python", "depth": 1 }, { "id": 1058, "mol": "H(F₂)", "sha": "8db9370aecb030bd354a2b3c6f8faa137742697d5cf3f63b43810ea25b7c5eb3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/modes.py", "risk": 3, "size": 6201, "type": "python", "depth": 1 }, { "id": 1059, "mol": "H₃(DbFOs)", "sha": "2babc2a3a8f148ad5ee814afa07d6ddb495cc56da92767b50db13a7d3b53be3d", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/module_sdk.py", "risk": 4, "size": 15950, "type": "python", "depth": 1 }, { "id": 1060, "mol": "H(Db)", "sha": "4373d185808a851e43a33258b96d65959c2f46b77553d7a9abc0f3c616b4b517", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/output_normalizer.py", "risk": 2, "size": 3477, "type": "python", "depth": 1 }, { "ctx": [ { "b": "FrRf^z/fVdCYUJCCvtJ6aAg+my\u0026r-)B0b7nz/3Rcx(^^5C4CY9wft#9v}W0aBywV{e^+9WzE)\u0026%By/Ioq=ck5az\u003eLaB1wCoq=s/GxK$Q]B7/b@BAn#Qq=uT!aAg+my\u0026r-)B0bBkAV!$mvqPO1z/PRC3l*Vr3jpx=z/3R7uUjC5B-I52uM:61AbP=sayPe9z//Afx(v)g3jpG:AbP=sazL$ozvc.El0l(Sk$26FllFAlDKp(rarR\u003eHACPtkiV@+RarR^HarR^Hb5IQDACM*Wax{3qawU(TcOV#icOV!@ar\u003el8ze0(neIed$ar\u0026fQrzDaYp9rF7oHRrFawL{goF4?uefDb:awU(Tf*dloa$K\u0026Xf^!8fpdcj6oHRxDc]AC9eH1EK3lQDlarR^Har\u003e=yB985nwPI\u003ccb03\u0026Ja$1HeqxNtwcP@?ia$K\u0026XvpTj?zym1/a$K\u0026XcM(z:nL-87q:\u003cwGlStg6rzl7reG#.*a#7Dbax5", "ln": 23, "col": 20, "line": 2 }, { "b": "EjLZFarR^JCYN{IiV@+RarR^HarR^Hb4s#4x\u003e5tFax{3LB7ol8AcaoLy?mTec]0ekflpSzx(FeTa$K\u0026XjzwUBaAINkj:n8/zE)\u003cez/O0Hy?mTec]0ema$K\u0026XcOn+ywPz(vf!1X4b3=-barR^HarR^Hb4t?pvrlGliV}SJjACWUfk\u003e-Az^^ftvqGH}Bsn\u003c)j%zK2b0oyEByw)1B0byuwO@SezGG/fxkzcxvqGH}Bsn\u003c)j%zK2b0oNRxcqnov)b5Vz/fcbA=k%", "ln": 614, "col": 5, "line": 16 }, { "b": "uTEI+x()Y?e)?%#y\u0026r=\u003ey\u0026-@\u003cEsip\u003c3lQDlarR^HarR^Har(eVcNQJNuT)[XB8$X}e)?$5A=kq(tqozouTE\u003e%vQ\u003cj.B8$]luTCigEsip\u003c3lQDlarR^HaycJ9arR^HarR^Hb6n3yxcGwVtoXAvh.3+mEiHi+b71VzB7Gf1Esip\u003car(eVvq{frA+flkwPI@CB7GxnwPxziy\u00261JFb3=-barR^HarR^Hb4+\u003ebwO\u003e\u003c@yH}JgiV}SJbZRE1h*((3ar\u00267TAb](c", "ln": 1054, "col": 21, "line": 26 }, { "b": "By=*:zE[2udlX\u003e1DU4BIcUW9sdsAyCed9HxarV7-3lQDlar\u003e(FA+lHRaBsCrarR^HarR^JvrV=piV}SJxMOuniXJcvhArxBh8D{uhArxBh8D$5vru74Bt4GxByu+ivrt{ha$K\u0026XxMOuniXJcvhArxBh8D{uhArxBh8D$5vru74Bt4=TwPxwkvrt{hb3=-barR^HarR^Hb4\u003ez8b03\u0026Jb4#7uA5]T9zdN/$wmoN*e[Y9vxkzcix(n37A=br4fjO{qAclnlo\u003ewAPwmoN*flP66b3=-barR^HarR^Hb4k!uA+cBQax{46BAzE.fe24riw96Ag+HHviw96Ag+SYSBywY*Byu?pzGx]dzEWlxvq]{jC4CYnx(v(Lgb7EreIF}ifFK+Sed9HxarV7-3lQDlar\u003eSlx^bOXDKp(rarR^HarR\u003eAx(n6rb03\u0026Ja$)IHv\u003eR!fB8#Loa$K\u0026Xfj/lnflp/nwn=VoefDb\u0026Ab](bflpYvw?N.kC4\u003e#nzxZROa$[aFAXzlExd)XjvpJ$Zgb06Cv}x.5e]kDsb3=-barR^HarR^Hb6N:swn=Wkb03\u0026Jb11y@tVUSSwn=WktWhF!zz2Tvx^b8Jb11y@tVUSSwn=WktWgiMB97#ggCSiuwo8ycwPz\u0026%tXe1!tWg@XB98EEt}us9arR!Ped9HxarR\u003eyCxt2\u0026aBsCrarR^HarR^JvqGN-zF%A7b03\u0026JcWN4Cy?B}Mb5RspwG\u0026VHBA}*HiWdf$r3D-refDr!b4kq2b03]yz/fbgefYgYA3vs!n([$oEj5qK3lQDlarR^Har(2vvqxj\u003ewN/:(BAnS!ax{4hwN/:(BrSmUb5hszuVP^*A+ftpefDcDxKL^\u003ewO(05efDcQvrlHlz/Pwjt}us9arR!Ped9HxarR\u003erz/6u1zE^9*zFA-)BzkVhb03\u0026[3lQDlarR^Har\u003eSozGQgFiV}SJj0nlFa$K\u0026XD)0cla$K\u0026Xu$\u003cdVa$K\u0026XbQ^wqdiZq=b7a+Xx\u003eezsar\u0026cVazCvgefDcwzFrS9t}us9arR^HarR^JCwg@9z*cmDiV}SJD)0SDz^^G%a$K\u0026XclNICz^^G%a$K\u0026Xcmf\u003cVxM4r@x^c?l3lQDlaBL^FarR^Hb6Xuzb03\u0026[3lQDlarR^Har\u003eo6B7]bdiV}SlarR^HarR^HarR^HcP\u003cRrzepr", "ln": 1316, "col": 95, "line": 30 }, { "b": "arR^HarS3]kx}3YaA?spB7]MgjT8QkfD@.BjrW9*lSvh+miDhXzY\u0026mDaW]d9nMn?nCZ9^xq^03#mnj)GxMOuniXJcNpFsCFlqHGBr8lyBb0Go@jAtvUBuR3@CX5%0flg#HBuR663lQDlarR^HaycJ9arR^HEjL.N3jmbJwO95$wO#71vru6/Aaa3dz^^f$d0x-HzEmHhAaI6MB98BNay/tcBy/YsiV@G=AV^H/a%FMXw].r%wP@6kyDrOVBAeG!ar\u00260Uat2=1B98B-3lQDlar\u00260Nm}DNHA::63aAg+my\u0026r-)B0b7kAV!^kC6dRswPzi*x(4H9C{4iOAaHNyz/x/jz/f01y\u003cvdnx(4)5A+e=7vTf8dA:-/@Cw?Iqe*qF-3lQDlaA?)zzxI7+C6dRsuVZNjwId!qCv+!ydk2TLAbn@)wHF-Ba$K\u0026XuM{{KA+fiavpJ\u003c%a$T#\u0026ar\u003eepdgdguarUi7auZ\u0026zl0l(Sk$26Flm#[ZBsqrPy\u0026g^DDWNsI3lQDlazCBgzF%RtwmvObarR^HarR^HA+funA=91ib2e", "ln": 2343, "col": 7, "line": 52 }, { "b": "arR^HboP%7A4L)qC4CFjy?W%jB0fE)LPU0TBAIRwayP853lQDlarR^HaAz4nB-Ivxyiarhe[x9wAc0BOb6n9HwG\u003ceTC6dRsuVZNjwH[@FAaa3dz^^f$b03\u0026SvTP^Ix(mD)zGF2%dgcz8arR^KawMG?By!#9c$WHdzdN{fA+^mFAaJJ[w[+:7azbLjzddI[arR^Hx\u003ewG1A:-/@Cw?IqayPd#azbU5zdN{fA+^pzz*b=kc[coMzxJF0iTM#", "ln": 2941, "col": 5, "line": 68 }, { "b": "wP@6kyC6BwCv+!ydp4uMazC.7wO#PMgarLqarR^HA+frmy\u0026*^.aBwIzarR^Hw]zYjw{k^GAaa3dz^^f$azCZowmvf9By/rgc[dg:arR^HarR^HA+frmy\u0026\u0026([Cu(sOaAg+m", "ln": 3228, "col": 90, "line": 73 } ], "depth": 1, "facts": { "imp": [ [ "", "vuln_type.lower.replace.replace" ], [ "", "vuln_type.lower.replace" ], [ "", "vuln_type.lower" ], [ "", "PAYLOAD_DB.get" ], [ "", "PAYLOAD_DB.keys" ], [ "", "isinstance" ], [ "", "list" ], [ "", "db.values" ], [ "", "json.dumps" ], [ "", "framework.lower" ], [ "", "json.dumps" ], [ "", "framework.lower" ], [ "", "db.items" ], [ "", "json.dumps" ], [ "", "PAYLOAD_DB.items" ], [ "", "isinstance" ], [ "", "list" ], [ "", "frameworks.values" ], [ "", "frameworks.keys" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "len" ], [ "", "json" ] ], "mbr": [ "PAYLOAD_DB.get", "PAYLOAD_DB.items", "PAYLOAD_DB.keys", "db.items", "db.values", "framework.lower", "frameworks.keys", "frameworks.values", "json.dumps", "lines.append", "vuln_type.lower", "vuln_type.lower.replace", "vuln_type.lower.replace.replace" ], "tgt": [ "PAYLOAD_DB.get", "PAYLOAD_DB.items", "PAYLOAD_DB.keys", "db.items", "db.values", "framework.lower", "frameworks.keys", "frameworks.values", "isinstance", "json.dumps", "len", "lines.append", "list", "vuln_type.lower", "vuln_type.lower.replace", "vuln_type.lower.replace.replace" ], "funcs": [ [ "generate_payloads", 2474 ], [ "list_payload_types", 3415 ] ], "metrics": { "ast": { "op.land": 1, "max_depth": 15, "call_count": 25, "node_count": 1108, "member_count": 13, "max_array_len": 7, "op_density.land": 0, "member_depth_max": 4 }, "file": { "size": 3818, "entropy": 5.22 }, "text": { "lines": 90, "top_char": 34, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 715, "char_entropy": 5.22, "unique_chars": 89, "top_char_null": 0, "string_density": 1.24, "top_char_ratio": 0.07, "avg_line_length": 41.42, "max_line_length": 119, "non_ascii_ratio": 0, "empty_line_ratio": 0.12, "last_line_length": 27, "whitespace_ratio": 0.21, "identifier_density": 0.97, "line_length_stddev": 36.99, "normalized_string_count": 11.81, "repeated_char_sequences": 9, "suspicious_string_ratio": 0.11, "normalized_unique_identifiers": 4.62 }, "binds": { "count": 6 }, "binary": { "peak_region_bytes": 3818, "peak_region_entropy": 5.14 }, "source": { "function_count": 2 }, "imports": { "count": 1, "stdlib_count": 1, "stdlib_ratio": 1 }, "strings": { "sql": 8, "bytes": 1925, "count": 112, "shell": 2, "url_count": 4, "avg_length": 17.19, "max_length": 145, "path_count": 7, "avg_entropy": 2.78, "empty_count": 2, "entropy_stddev": 1.12, "high_entropy_count": 2, "embedded_code_candidates": 2 }, "comments": { "chars": 97, "count": 3, "lines": 3, "to_code_ratio": 0.03 }, "functions": { "count": 2, "density": 2.22, "avg_params": 1.5, "code_ratio": 0.34, "max_params": 3, "length_stddev": 5.5, "avg_name_length": 17.5, "no_params_count": 1, "avg_length_lines": 15.5, "max_length_lines": 21, "min_length_lines": 10, "high_entropy_names": 1, "avg_param_name_length": 8.33 }, "identifiers": { "count": 87, "unique": 30, "avg_length": 6.67, "max_length": 18, "min_length": 2, "avg_entropy": 2.35, "reuse_ratio": 0.34, "length_stddev": 3.8, "high_entropy_count": 1, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.97, "all_uppercase_ratio": 0.03 } } }, "id": 1061, "mol": "K(Te₂)O₆(AsCaLaPrSXe₂)H₅(Cm₃DbF₂OsPo₂)Md₂(Pa)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/payload_generator.py", "pid": 0, "risk": 15, "sha": "62936e143f2d1d3d99906326dc23f86c7d680cef30316f0af1c28cd24c3d92cf", "size": 3818, "traits": [ { "id": "metadata/import/python/json::json", "conf": 0.95, "crit": 2, "desc": "imports json", "spans": [ [ 192, 0 ] ] }, { "id": "metadata/file/string/cloud::aws-user-data-endpoint", "conf": 0.9, "crit": 3, "desc": "AWS EC2 user-data endpoint", "spans": [ [ 1424, 39 ] ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "spans": [ [ 1387, 15 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 314, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 2585, 0 ] ] }, { "id": "metadata/package/testing/corpus::sqli-category-label", "conf": 0.9, "crit": 3, "desc": "SQL injection category label", "spans": [ [ 87, 4 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 98, 3 ] ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-endpoint-reference", "conf": 0.9, "crit": 3, "desc": "Google Cloud metadata host reference", "spans": [ [ 1492, 24 ] ] }, { "id": "micro-behaviors/communications/http/token-auth::jwt-unsecured-algorithm", "conf": 0.98, "crit": 3, "desc": "Unsecured alg none setting", "spans": [ [ 1882, 12 ], [ 1912, 12 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "spans": [ [ 3005, 7 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 3260, 0 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "spans": [ [ 2993, 0 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-account-database-path-reference", "conf": 0.95, "crit": 3, "desc": "Unix account database path reference", "spans": [ [ 1665, 11 ], [ 1680, 11 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-environ", "conf": 0.92, "crit": 3, "desc": "References own process environment procfs path", "spans": [ [ 1695, 18 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "spans": [ [ 2003, 8 ] ] }, { "id": "micro-behaviors/process/create/shell/command-string::shell-control-string-literal", "conf": 0.9, "crit": 3, "desc": "Shell separator plus command token", "spans": [ [ 2068, 4 ], [ 2076, 4 ], [ 2110, 5 ] ] }, { "id": "micro-behaviors/process/create/shell/command-string::unix-shell-command-token-literal", "conf": 0.98, "crit": 1, "desc": "Unix command after shell separator", "spans": [ [ 2110, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::parenthesized-command-literal", "conf": 0.98, "crit": 3, "desc": "Parenthesized shell command string", "spans": [ [ 2092, 5 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--rx-20", "atk": "T1027", "mbc": "B0032", "conf": 0.94, "crit": 3, "desc": "linux platform config key marker", "spans": [ [ 1654, 8 ] ] }, { "id": "objectives/execution/exploit/http-command-injection::shell-backtick-command-string-literal", "atk": "T1059,T1190", "mbc": "B0024", "conf": 0.98, "crit": 3, "desc": "Backtick shell command string", "spans": [ [ 2083, 6 ] ] }, { "id": "objectives/execution/exploit/sandbox-escape::python-runtime-subclass-enumeration", "atk": "T1059.006,T1203", "conf": 0.96, "crit": 3, "desc": "Python enumerates runtime subclasses", "spans": [ [ 1118, 16 ] ] }, { "id": "objectives/lateral-movement/exploit/scanner::file-inclusion-probe-payload", "atk": "T1210", "conf": 0.9, "crit": 3, "desc": "Local-file inclusion probe payload", "spans": [ [ 1665, 11 ] ] }, { "id": "objectives/lateral-movement/exploit/scanner::internal-cloud-probe-payload", "atk": "T1210", "conf": 0.9, "crit": 3, "desc": "Cloud metadata endpoint probe payload", "spans": [ [ 1387, 15 ], [ 1492, 24 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member" }, { "id": "well-known/tool/offensive/xxgaruda::payload-generator-function", "conf": 0.98, "crit": 3, "desc": "XXGARUDA payload generator function", "spans": [ [ 2474, 17 ] ] }, { "id": "metadata/file/string/cloud::aws-metadata-endpoint", "conf": 0.85, "crit": 3, "desc": "AWS EC2 metadata endpoint", "spans": [ [ 1387, 32 ] ] }, { "id": "metadata/file/string/cloud::azure-metadata-endpoint", "conf": 0.85, "crit": 3, "desc": "Azure IMDS endpoint", "spans": [ [ 1566, 33 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 1380, 40 ], [ 1424, 40 ], [ 1485, 51 ], [ 1559, 40 ], [ 2407, 20 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::unix-password-file-path-pair", "conf": 0.9, "crit": 3, "desc": "References Unix passwd and shadow paths", "spans": [ [ 1665, 26 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "conf": 0.4, "crit": 2, "desc": "Windows platform string", "spans": [ [ 1793, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::command-substitution", "conf": 1.0, "crit": 2, "desc": "shell script command substitution", "spans": [ [ 2092, 0 ] ] }, { "id": "objectives/credential-access/files/config::login-secret-file-paths--rx-6", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 3, "desc": "Authorized-keys or shadow-file path literal", "spans": [ [ 1680, 11 ] ] }, { "id": "objectives/privilege-escalation/exploit/keywords::img-onerror-handler", "atk": "T1059.007", "mbc": "E1090", "conf": 0.9, "crit": 3, "desc": "Image onerror event handler", "spans": [ [ 678, 19 ] ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-shadow-path", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "Account database path marker", "spans": [ [ 1664, 12 ] ] }, { "id": "metadata/package/testing/corpus::injection-category-labels", "conf": 0.9, "crit": 3, "desc": "Multiple injection attack-category labels", "uses": [ 5, 6 ], "spans": [ [ 87, 4 ], [ 98, 3 ] ] }, { "id": "objectives/discovery/cloud/metadata::cloud-metadata-access", "conf": 0.85, "crit": 1, "desc": "Cloud metadata endpoint reference", "uses": [ 25, 26 ], "spans": [ [ 1566, 0 ] ] } ], "type": "python" }, { "id": 1063, "sha": "8e8a98ca95aa9e03d109d63708ee3d8f5bea7a08f20fffa45c8a624a626aa296", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/portal.py", "risk": 2, "size": 2432, "type": "python", "depth": 1 }, { "id": 1064, "mol": "H(Cm)", "sha": "35139321cca2ef7ad478f23f086afe2ad5cff0b7a31444e4a06662fcdf56ce67", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/rate_limit_detector.py", "risk": 2, "size": 3089, "type": "python", "depth": 1 }, { "id": 1065, "mol": "H₂(DbF)", "sha": "21e94c481b2a0cda8abf77a60f07e19b699d110f5e53223835ac061616afe443", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/recipes.py", "risk": 3, "size": 6317, "type": "python", "depth": 1 }, { "id": 1069, "mol": "H(Db)", "sha": "49659979a14760ebf3c396bc1b2b0e1d79b02e25b183ff0483e646e7dca33804", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/reporting.py", "risk": 2, "size": 1708, "type": "python", "depth": 1 }, { "id": 1070, "mol": "H(Po₅)", "sha": "0d4aca6c570705de3fa3b18e0c4302c594807a6fefac31e83899201538def6df", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/result.py", "risk": 4, "size": 5544, "type": "python", "depth": 1 }, { "id": 1071, "mol": "H(Po)", "sha": "d68d7724f42e8cfffe28cdac16476422d762dd5b829705eed3245275cefc984f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/run_commands.py", "risk": 2, "size": 10410, "type": "python", "depth": 1 }, { "id": 1072, "mol": "H(Db)", "sha": "2a810f156563392b246b8093731900677a77cfb218cf7abaa6d170fc9009f2fa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/self_config.py", "risk": 2, "size": 7219, "type": "python", "depth": 1 }, { "id": 1073, "mol": "H(F₂)", "sha": "7638aede6cc99afda100b19b3db7545bfb9d91754ab246cf2f0e1d8baaad722c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/self_improve.py", "risk": 3, "size": 8022, "type": "python", "depth": 1 }, { "id": 1075, "mol": "H₂(Cm₃Os)", "sha": "f8c2d04e4bb933082b1f939c4892c3320c0fa933a3802230e6961408c44216b4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/session_aware.py", "risk": 3, "size": 6497, "type": "python", "depth": 1 }, { "id": 1076, "mol": "H₂(Db₂F)", "sha": "6ba32682068f7ab85b39ac800ad40efe91b306f4ed571867bc8bf3396bd33368", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/session_replay.py", "risk": 4, "size": 4133, "type": "python", "depth": 1 }, { "id": 1077, "mol": "H₃(Cr₂Db₅F₂)", "sha": "026cec19af2c390f7281e67e9f074a41607737fea218ad9f85454fec36dda5fb", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/sjpack.py", "risk": 6, "size": 17966, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%FjfxK#0@az2!ev%8)cz/cXgvru78vr\u0026#cz/M$0B.LP8zxK4tz!%FE3joZwz/xn#aARJABzbkdvp%d?BrC^CA+/-nvpJ\u003c\u003eCwhejay]58BAhIlBzk]feN@Zozddr)azk?9A+6i0x(4\u0026y3l*Vr3jpx=z/3R7uUjC5B-I52uM:61AbP=sayPe9z//Afx(v)g3jpG:AbP=saA8rdx(d*cA=-BBxL.m83tBu@z/P}xB9R*l3jprPw/$D8B0@E#3lQDlar\u00260Np\u00266MZw]zZb", "ln": 0, "col": 1, "line": 1 }, { "b": "A+/-nvpJ\u003cQ3lQDlaAz4nB-IvxCw?IqB8UL$wEn+Kw].*batdXCB9hqvazCXiz/P}xA=(nbv@Dj3vqYP.3jprPw/$VfwN/\u003e8wNxK\u003cA=2JdvqEu4zdCguBzkP6z/{d+gCyms3lQDlar\u00260Nq!P-Uy-)qlwN/\u003e8x(v(ixjk)[Cvt+t\u0026^^moB7occwN({9zY\u003cazx\u003e?v1uTWOUzGEJOCw?IqB8UL$wIaq%arR^HlVl*UvqYQ%aARp9BrCBswnbU3aARpdazkIevQT6}B9R?GwO\u0026LrAa%nlx(n0lvqG:hayYw5CpT\u003eBAc9SNB9h2iefFICv\u003eGhqarR^Hvrb{4x(n37A:@W1By!#9vqYP#A+flkx(W=cwQ5fgx\u003e7\u003e0aA.:pAV!!fAb](uvqE5}wOb\u003e3wGUMewN/\u003e8x(v(w3lQDlar\u00260N3lQDlaARTHiTM#LarR^HarUxgaz#atay/n0iTM#LarR^HarR^HarUYoBAIRwar\u003cl{A=k$VawM?$v@Dj3vqYP#Ab](ux\u003eg^=e*pSfarR^HarR^HboP{cx-", "ln": 327, "col": 47, "line": 15 }, { "b": "Cxj)HB7Gxk3lQDlarR^Har@1HB-5szxK@q@z/fV9x(mH5aA?EcazC.mByx04e]U\u003e^atj\u003cFz!0M]AV!\u003egze:AmwIarjarR^HarR!vw/#euB1RAFvrua1A+#{ZjS\u003e})x(kZZb035NarR^HarR^HarR!EwPS6nzxHtmarR^HarR^HarR^HarR^Hb1lJ)z/N(YzEET3C4z^$x(mE1Cxj)vB0bvsBrCTEAbY-oBy!#nax9z%yh4MdA=(nvaA8cuzdc{Iq.f4n3lQDlarR^HarR^HarR^Har\u003cG[zGQgPaA8oyC4\u003ewcl#MNJwPw]izxJ1{zE^WfB0fE)LPU9\u0026wGUY8B97\u0026by+xWFf^7NRaAIaoaA.SCBzbkda{]CnarR^HarR^HarR^HarR\u003erz/fV9x(mH5efG4FwO@ShB-5siz/6u1zE^/hx(n0awmV($Bs[:AarR^HarR^HarR^Hdgcz8arR^HarR^Kax8\u0026/w?uU\u0026y?$j\u003c", "ln": 876, "col": 63, "line": 34 }, { "b": "D0+J8wfs2TB98BJz/WKzwPR)9wge(Q3lQDlarR^Hay/n0uVZj4wO#MijS[lKwg?[lAbn@)wHF-:a$K\u0026Xar\u0026l!A+fiavpJ\u003c%a%[SXefDbVa$kc+wPhD]v}v5jD)g9:a%n6Ue]$#Fx(\u003e:L3lQDlarR^HazCBgb5p[ey:70ozxJCawm6B%yH}y8ayPd#az(yhAa]", "ln": 1283, "col": 10, "line": 44 }, { "b": "CX7xcBy=O8z/6u1zE+vxDU[4nAa@\u003chazC)tBzbkdk$Jg+xjU$5cVZzGCwXK1A=kD0B8@D}l[PP+z/)gtB-RTEw[=c[aARpdaAR4jxjVfcvq{g4x\u003e7N[x(v(pB0apJl[PU\u003c3lQDlarR^Har@10y\u0026r=\u003ey+o79BzkVhazkb8wJy@FzGGDgv}xR3ay[[#xjVa4B-OWnz/6u1zE^!}arR^HarR^Hw].*baAIWtyh4MrzeS%cy?mVuBz(8lB1RoyvLhqovrb[0vqfL0azCXiz/P}xx(^S(vqYZ?A=l8w3jm)#arR^HarUi6zF9K3z/{aLaAg+hBy+", "ln": 1505, "col": 52, "line": 47 }, { "b": "zF-%5BrC^wBz8!gz/65{A+fCqAa9\u003c4B08(FvpJ8idgdguarR^HarUlkB%5{\u003cz/WKxzGY-mz/dgqz/x$IdgdguarR^HarUclwP}H2vrug7auZ\u0026Ka$)\u003eNBt4rCzdNf%wP]!px(kaCar\u0026EYB8\u0026{Iz!0i(fjFTka$K\u0026Xfk\u003e/KfkbovwNYW\u003eCq12Dx(kb23lQDlarR^Hay/LmA+fcguVoB}xDPCXwO#VzxjVfkb2yN8nfPPca%FDyarR^HarR^Hw]zYjvSiD7zxJzewP}H2vrug7iTM#LarR^HarR^HarUxgayYpjzF%Rtx(k56B-IIlzGGl8vrufz3lQDlarR^HarR^HarR^Hay/LmA+fcguVoB}xDPCXw*hOhAd6=]v%8*jwO}", "ln": 2112, "col": 23, "line": 59 }, { "b": "CvtL1arR^HarR^HboQMxwN^8#ayPslvixx2By/G3y-\u003c]-a%prmxlw65zGEGNra]#!ayYwfyH[S1C4CYtaAh4lwO=6#wEoL5arR^HarR)KvqYP#v}Yp+zE)u3v@Dj3vqYP#x(k5nxMvV}ay]z2B.$YcBy!#9w[+*)wftD3xjkB:zdNQbB1N!xarR^H", "ln": 2670, "col": 66, "line": 70 }, { "b": "bW-2Ht{p*xv@k:9dgdguarR^HarUxgaz$+4woha0xK#0@iTM#LarR^HarR^HarUfhwm6p:A==vBjS)@MfjFTkflp!JefDb*v\u003ciDDv@k:Z3lQDlarR^Haz2wgwJyevarR^HarR^HarR^Kaxin{wO#jdwJI2DvqG:5vQS+ZaARJAvixS8wO=f9z/fbry?W=#AV!$jAV/vAz//M3fjO{qAbP(pwftx2zeAZ0woe82arR^HarR^HarR!GA^oXMarR^HarR^HarR^HarR^Hv@k:-Aa9^eB09Q*B7/x3CRj5Ry?W#tv@k:93lQDlarR^HarR^Haz2!cwPh-lr://!wKQSWz/N(CarR^HarR^HarR^HarR^Hv@k:-Aa9^eB09Q*toU.fx(kOBxD!#Ia$WpGefFCtwl/JHarR^HarR^HboP{bwNPy%xDOZDh7*QjiV@lSBZ#Rpz/oDkazkl", "ln": 2885, "col": 47, "line": 75 }, { "b": "v@k:-Aa9^eB09Q*B75%2Bzl5juT[1\u003ezddr)c$va8uVoB]BAn(rarR^HarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiV]K\u0026az#aqvlbI$oHQS?f^bFaLPT\u003cPC4CXpvR/%)yANhkwN/\u003e8x(v\u003e@arR^HarR^HarR^HAa9*e3lQDlarR^HaAz4mB.(dxjS[=/zEl)(zeAZ0wgd^carR^HarR^HarR!pzdE0)vrcEhazCBgy?mGjv@k:-Aa9^eB15j}atC0Iy\u0026:egtoU.fx(kOBxD!#Ia$WpGefFCtwl*.[arR^HarR^HarR^HBzkP6z/{d+BzkP6z/{dM3lQDlarR^HarR^Hay/Raj-+Z=c%}gtc\u0026", "ln": 3602, "col": 17, "line": 92 } ], "depth": 1, "facts": { "imp": [ [ "", "str" ], [ "", "os.getpid" ], [ "", "cmd.replace(\";\", \" \").replace(\"\u0026\u0026\", \" \").replace(\"|\", \" \").split" ], [ "", "cmd.replace(\";\", \" \").replace(\"\u0026\u0026\", \" \").replace" ], [ "", "cmd.replace(\";\", \" \").replace" ], [ "", "cmd.replace" ], [ "", "is_dangerous" ], [ "", "confirm_global_action" ], [ "", "os.environ.copy" ], [ "", "env.get" ], [ "", "bool" ], [ "", "re.search" ], [ "", "shlex.split" ], [ "", "len" ], [ "", "sanitize_command" ], [ "", "run_command" ], [ "", "len" ], [ "", "str" ], [ "", "ws" ], [ "", "truncate" ], [ "", "result.format" ], [ "", "str" ], [ "", ".result" ], [ "", ".result.run_command" ], [ "", "confirm_global_action" ], [ "", "is_dangerous" ], [ "", "os" ], [ "", "re" ], [ "", "sanitize_command" ], [ "", "shlex" ], [ "", "suijin.modules.platform.lib" ], [ "", "suijin.modules.platform.lib.runtime" ], [ "", "suijin.modules.platform.lib.stealth" ], [ "", "suijin.modules.tools.lib.guardrails" ], [ "", "sys" ], [ "", "truncate" ], [ "", "workspace" ] ], "mbr": [ "_re.search", "_ws().WORKSPACE_DIR", "cmd.replace", "cmd.replace().replace", "cmd.replace().replace().replace", "cmd.replace().replace().replace().split", "env.PATH", "env.get", "os.environ", "os.environ.copy", "os.getpid", "result.format", "shlex.split", "sys.platform" ], "tgt": [ "_re.search", "_ws", "bool", "cmd.replace", "cmd.replace().replace", "cmd.replace().replace().replace", "cmd.replace().replace().replace().split", "confirm_global_action", "env.get", "is_dangerous", "len", "os.environ.copy", "os.getpid", "result.format", "run_command", "sanitize_command", "shlex.split", "str", "truncate" ], "funcs": [ [ "_ws", 190 ], [ "execute_terminal", 393 ] ], "metrics": { "ast": { "op.land": 3, "max_depth": 16, "call_count": 22, "node_count": 718, "member_count": 14, "max_array_len": 3, "op_density.land": 0, "member_depth_max": 5 }, "file": { "size": 4140, "entropy": 4.62 }, "text": { "lines": 106, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.01, "space_count": 1052, "char_entropy": 4.62, "unique_chars": 83, "top_char_null": 0, "string_density": 0.31, "top_char_ratio": 0.06, "avg_line_length": 38.06, "max_line_length": 154, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.21, "last_line_length": 43, "whitespace_ratio": 0.28, "identifier_density": 1.24, "line_length_stddev": 30.65, "normalized_string_count": 3.21, "repeated_char_sequences": 25, "suspicious_string_ratio": 0.15, "suspicious_comment_ratio": 0.18, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 7.73 }, "binds": { "count": 13 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 4.62 }, "source": { "function_count": 2 }, "imports": { "count": 15, "aliased": 1, "relative": 2, "stdlib_count": 4, "stdlib_ratio": 0.27, "relative_ratio": 0.13, "third_party_count": 11, "third_party_ratio": 0.73 }, "strings": { "bytes": 969, "count": 33, "shell": 5, "avg_length": 29.36, "max_length": 225, "path_count": 7, "avg_entropy": 2.54, "empty_count": 1, "entropy_stddev": 1.62 }, "comments": { "chars": 941, "count": 17, "lines": 17, "high_entropy": 3, "to_code_ratio": 0.19 }, "functions": { "count": 2, "density": 1.89, "avg_params": 1, "code_ratio": 0.84, "max_params": 2, "length_stddev": 39.5, "avg_name_length": 9.5, "no_params_count": 1, "avg_length_lines": 44.5, "max_length_lines": 84, "min_length_lines": 5, "avg_param_name_length": 5 }, "identifiers": { "count": 131, "unique": 52, "avg_length": 7.15, "max_length": 21, "min_length": 1, "avg_entropy": 2.4, "reuse_ratio": 0.4, "length_stddev": 4.11, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.02, "high_entropy_count": 2, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.94, "all_uppercase_ratio": 0.02, "underscore_prefix_count": 2 } } }, "id": 1079, "mol": "K(Te)H₂(DbPo)", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/terminal.py", "pid": 0, "risk": 5, "sha": "6933b225f3bcc8cd3d359f5cc0016ea06877c1c4b46e192eef53e4feebfa7b30", "size": 4140, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "spans": [ [ 56, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "spans": [ [ 603, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-3", "conf": 0.8, "crit": 2, "desc": "English function-word token \"that\"", "spans": [ [ 516, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "spans": [ [ 27, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-6", "conf": 0.8, "crit": 2, "desc": "English function-word token \"with\"", "spans": [ [ 76, 0 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "spans": [ [ 688, 0 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 3735, 0 ] ] }, { "id": "micro-behaviors/os/syscall/invoke::linux-kernel-extra-tree-directory", "atk": "T1106", "conf": 0.98, "crit": 2, "desc": "Linux-kernel extra-tree directory component", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/runner::python-run-command-call", "conf": 0.85, "crit": 3, "desc": "Calls run_command helper", "spans": [ [ 3744, 11 ] ] }, { "id": "well-known/tool/detection/security-scanner::defensive-dangerous-command-doc", "conf": 0.92, "crit": 1, "desc": "Defensive dangerous command documentation", "spans": [ [ 1650, 0 ] ] }, { "id": "well-known/tool/offensive/suijin::package-tree-member", "conf": 0.99, "crit": 3, "desc": "Suijin package tree member", "spans": [ [ 0, 36 ] ] }, { "id": "micro-behaviors/data/parse/command::python-shlex-command-split", "conf": 0.9, "crit": 3, "desc": "Python parses shell-like command words", "spans": [ [ 3113, 11 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "spans": [ [ 1102, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "conf": 0.4, "crit": 2, "desc": "Windows platform string", "spans": [ [ 1102, 0 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "spans": [ [ 2949, 7 ] ] }, { "id": "objectives/execution/condition/platform::has-os-check", "conf": 0.6, "crit": 1, "desc": "Checks for OS platform", "uses": [ 12, 13 ], "spans": [ [ 1102, 0 ] ] }, { "id": "well-known/tool/detection/security-scanner::defensive-threat-signatures", "conf": 0.95, "crit": 1, "desc": "Defensive threat signature catalog", "uses": [ 9 ], "spans": [ [ 1650, 0 ] ] }, { "id": "well-known/tool/detection/ai-guardrail::ai-guardrail-context", "conf": 0.95, "crit": 1, "desc": "AI-agent guardrail / security-scanner tool context", "uses": [ 16 ], "spans": [ [ 1650, 0 ] ] }, { "id": "well-known/tool/detection/security-scanner::defensive-scanner-tool-context", "conf": 0.95, "crit": 1, "desc": "Defensive secret/threat scanner or sandbox context", "uses": [ 16 ], "spans": [ [ 1650, 0 ] ] } ], "type": "python" }, { "id": 1081, "mol": "H(Cm₅)", "sha": "1237e0582e3043b6a3f8e6a40926a63f8a052a7b081bebcc5b09ad722ed8d867", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/web_search.py", "risk": 2, "size": 2616, "type": "python", "depth": 1 }, { "id": 1082, "mol": "H₂(DbF)", "sha": "06ce6729c956b6c57ca3dbfc2fa12d991893ed7f4dc313cad65c931258ba5ef3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/web_session.py", "risk": 3, "size": 9759, "type": "python", "depth": 1 }, { "id": 1083, "mol": "H₂(Db₃F)", "sha": "00977853822c91a46452586d0fcf880ae48b23733c154a40e8b6a71427c03ef4", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/tools/lib/wordlist_mutator.py", "risk": 4, "size": 4729, "type": "python", "depth": 1 }, { "id": 1086, "mol": "H₂(DbOs)", "sha": "78d4e77e0170f189c4390163450bcc2412d4aaf3cf5f754be3f7b1241030bb6a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/trufflehog/entry.py", "risk": 3, "size": 2183, "type": "python", "depth": 1 }, { "id": 1087, "mol": "H(Po₂)", "sha": "d46d9a4eabd52a25c907eabe798b89517a7aa16dc32f969571123d8764175b17", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/trufflehog/main.py", "risk": 1, "size": 412, "type": "python", "depth": 1 }, { "id": 1092, "mol": "H₂(DbOs)", "sha": "756c69e22e548d77e583c621e366b4f7ce617c09021837c581d6c4240e6943c9", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/uacheck/entry.py", "risk": 3, "size": 2202, "type": "python", "depth": 1 }, { "id": 1098, "mol": "H₂(DbOs)", "sha": "27773e5b600240d45c437e520ca9e9bdca9ddbefd873159adaa421f457aaa763", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/urltoolz/entry.py", "risk": 3, "size": 2060, "type": "python", "depth": 1 }, { "id": 1104, "mol": "H₂(DbOs)", "sha": "270421ab06a843520f180f288c337f48c4411b2aac6fc70dd636c6bf8cc85018", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/wafw00f/entry.py", "risk": 3, "size": 2096, "type": "python", "depth": 1 }, { "id": 1105, "mol": "H(Po)", "sha": "78536205a363033bad47776336a311bfc8d84d91ad84b41e969aa929d8e77619", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/wafw00f/main.py", "risk": 2, "size": 597, "type": "python", "depth": 1 }, { "id": 1110, "mol": "H₂(DbOs)", "sha": "ea17784d7390b947319c9d54817a8c9a6264ca29f3d0fdca63b67611d10c8814", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/waybacker/entry.py", "risk": 3, "size": 2187, "type": "python", "depth": 1 }, { "id": 1111, "mol": "H(Cm₃)", "sha": "70624c7dd2e679e0e9011a221f512d792bc8ad0de181589dedf19357ee0df9ff", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/waybacker/main.py", "risk": 2, "size": 1594, "type": "python", "depth": 1 }, { "id": 1116, "mol": "H₂(DbOs)", "sha": "5eea7315a1c602a5dbe4cae62b4460a305136af9eafe9138ac5ed43e2776685a", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/webprobe/entry.py", "risk": 3, "size": 2215, "type": "python", "depth": 1 }, { "id": 1117, "mol": "H(Cm₃)", "sha": "0876109ddd9fa4324bcb611f7911c5ffdfa6f74de6becbfd4c858cd2642e00df", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/webprobe/main.py", "risk": 2, "size": 3313, "type": "python", "depth": 1 }, { "id": 1122, "mol": "H₂(DbOs)", "sha": "a63c21de47c0545ea89c202e4fada7dbd5ed259bdffc8106e4b93c8d4a077efa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/websocket_client/entry.py", "risk": 3, "size": 2210, "type": "python", "depth": 1 }, { "id": 1123, "mol": "H(Cm₃)", "sha": "47d0002535422f9364bc5885cc097a9f0d4759247221783bd51c13233f9ea6fa", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/websocket_client/main.py", "risk": 2, "size": 1373, "type": "python", "depth": 1 }, { "id": 1127, "mol": "H₂(DbOs)", "sha": "b655701e1ccf55fe296413a35ce41588e3f86de150db8eb98b895f82da6a0eec", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/whatweb/entry.py", "risk": 3, "size": 2100, "type": "python", "depth": 1 }, { "id": 1128, "mol": "H(Po₂)", "sha": "b7dfbb9f0709935df3a97c0de1d5622649b29087b08d134a0960072a919c586c", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/whatweb/main.py", "risk": 1, "size": 376, "type": "python", "depth": 1 }, { "id": 1133, "mol": "H₂(DbOs)", "sha": "49e6b0f22f76f268da9aa35ebc37ed75720929992c1e4ebdede4e3498c54f6b3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/whoisraw/entry.py", "risk": 3, "size": 2177, "type": "python", "depth": 1 }, { "id": 1134, "mol": "H(Cm₄)", "sha": "f6baaebfb4baa23e0abd8b1608467df2efe712d97960bbadd85ca0b5fe538711", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/whoisraw/main.py", "risk": 2, "size": 1269, "type": "python", "depth": 1 }, { "id": 1139, "mol": "H₂(DbOs)", "sha": "f1637c2094888b32ec2b22816e6338c5e3a4c549dcddd355ed5a03ee2e28dca3", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/wifi/entry.py", "risk": 3, "size": 2191, "type": "python", "depth": 1 }, { "id": 1140, "mol": "H₃(FOs₂Po₃)", "sha": "d8d83319ca1dcffb216abe17f25f1f462cc82f489f2cced260e16d5d5930fbd6", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/wifi/main.py", "risk": 5, "size": 8814, "type": "python", "depth": 1 }, { "id": 1145, "mol": "H₂(DbOs)", "sha": "5c2e37905424131739705ebb806c04779c17b3b747faf051569e66cb42e17f4f", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/wordlisthub/entry.py", "risk": 3, "size": 2239, "type": "python", "depth": 1 }, { "id": 1151, "mol": "H₂(DbOs)", "sha": "77e830f6c19f4838f8a9c6f2db8a26b8688f8fd26f551cfc5471481b86bf9b36", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/wordlistio/entry.py", "risk": 3, "size": 2195, "type": "python", "depth": 1 }, { "id": 1157, "mol": "H₂(DbOs)", "sha": "cf52fa0f91d52a547645053d60d40d9e69f1cff6ebb4e30fde93799bac5bd4e8", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/write_note/entry.py", "risk": 3, "size": 2254, "type": "python", "depth": 1 }, { "id": 1158, "mol": "H₂(CmOs)", "sha": "14a6f7bcdb66a2e5824aeab95a8b4683230b2903657d4f82f84ad49d5d237102", "path": "suijin-6.6.0-py3-none-any.whl!!suijin/modules/write_note/main.py", "risk": 2, "size": 1031, "type": "python", "depth": 1 }, { "id": 1165, "mol": "K(Te)Md(Pa)", "sha": "309b6b3e9d80724f69a7a9b78c844a6440edf7632a42d8bd368d9af58d73d12b", "path": "suijin-6.6.0-py3-none-any.whl!!suijin-6.6.0.dist-info/METADATA", "risk": 3, "size": 55577, "type": "pkg_info", "depth": 1 }, { "id": 1166, "mol": "Md(Pa)", "sha": "e3eb306af05d42389efa796a61d348dcd3246a30be97f0df7d6811d84a4b6d70", "path": "suijin-6.6.0-py3-none-any.whl!!suijin-6.6.0.dist-info/entry_points.txt", "risk": 1, "size": 63, "type": "text", "depth": 1 }, { "id": 1168, "mol": "Md(Re)", "sha": "4b6c794d3fca253e1c55c95cab76af367002106636aca8d0e68a87fb96804604", "path": "suijin@6.6.0.registry.json", "risk": 1, "size": 823, "type": "registry", "depth": 1 } ], "omitted_files": 479, "rev": "479f3", "v": "8" } }