feat: Phase 2 - complete 12 security agents

New agents implemented:
- web.auth: login detection, CSRF analysis, JWT detection, weak cred testing
- web.ssrf: SSRF parameter detection, internal URL probing
- web.lfi: path traversal and file inclusion testing
- web.js: JavaScript analysis for secrets, API routes
- recon.subdomain: crt.sh lookup + DNS brute-force + TLD scanning
- recon.whois: domain registration information gathering
- recon.cert: certificate transparency log analysis
- api.fuzz: HTTP method fuzzing, path discovery, parameter injection
- api.auth: auth bypass testing, token manipulation
- api.rate: rate limiting abuse testing
- infra.port: TCP port scanning (25 common ports)
- infra.service: service fingerprinting from HTTP banners

Enhanced existing agents:
- recon.dns: MX/NS/TXT/CNAME/SOA record support
- verification: finding deduplication, low-quality filter, logging

All 95 tests pass, mypy: 0 errors

Author: bot

bugfinder/agents/api/auth.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import urljoin
+
+from bugfinder.agents.base import AgentResult, BaseAgent
+
+API_AUTH_PATHS = [
+    "/api/users", "/api/admin", "/api/config", "/api/settings",
+    "/api/internal", "/api/debug", "/api/health", "/api/metrics",
+    "/api/backup", "/api/logs", "/api/keys", "/api/secrets",
+    "/api/tokens", "/api/credentials",
+]
+
+
+class APIAuthAgent(BaseAgent):
+    name = "api.auth"
+    description = "API authentication and authorization testing"
+
+    async def execute(self) -> AgentResult:
+        base_url = self.context.target
+        if not base_url.startswith("http"):
+            base_url = f"https://{base_url}"
+        base_url = base_url.rstrip("/")
+
+        findings: list[dict[str, Any]] = []
+        assets: list[dict[str, Any]] = []
+
+        no_auth_req = await self._http_get(base_url)
+        has_auth = "authorization" in no_auth_req.headers.get("www-authenticate", "").lower()
+
+        for path in API_AUTH_PATHS:
+            url = urljoin(base_url, path)
+            try:
+                resp_noauth = await self._http_get(url)
+                status_noauth = resp_noauth.status_code
+                assets.append({
+                    "id": f"api-auth-{path.replace('/', '_')}",
+                    "name": url,
+                    "asset_type": "api_endpoint",
+                    "value": f"HTTP {status_noauth} (no auth)",
+                    "properties": {"path": path, "status_noauth": status_noauth},
+                })
+                if status_noauth == 200:
+                    findings.append({
+                        "title": f"Unauthenticated Access to {path}",
+                        "description": f"Endpoint {url} returns 200 without authentication",
+                        "severity": "high",
+                        "confidence": "verified",
+                        "category": "api_security",
+                        "evidence": {"url": url, "path": path, "status_noauth": status_noauth},
+                        "remediation": "Implement proper authentication and authorization for all API endpoints.",
+                    })
+                elif status_noauth in (401, 403):
+                    findings.append({
+                        "title": f"Protected Endpoint: {path}",
+                        "description": f"Endpoint {url} requires authentication ({status_noauth})",
+                        "severity": "info",
+                        "confidence": "verified",
+                        "category": "api_security",
+                        "evidence": {"url": url, "path": path, "status": status_noauth},
+                    })
+                token_bypass = await self._test_token_bypass(url)
+                if token_bypass:
+                    findings.extend(token_bypass)
+            except Exception:
+                continue
+
+        for i, f in enumerate(findings):
+            f["id"] = f"api-auth-{i}"
+
+        summary = f"Tested {len(API_AUTH_PATHS)} protected endpoints, {len(findings)} findings"
+        return AgentResult(
+            agent_name=self.name,
+            status="completed",
+            findings=findings,
+            assets=assets,
+            summary=summary,
+        )
+
+    async def _test_token_bypass(self, url: str) -> list[dict[str, Any]]:
+        results: list[dict[str, Any]] = []
+        bypass_tokens = [
+            ("Authorization", "Bearer invalid"),
+            ("Authorization", "Bearer eyJhbGciOiJIUzI1NiJ9.dGVzdA.test"),
+            ("X-API-Key", "test"),
+            ("X-Auth-Token", "admin"),
+            ("Cookie", "session=admin"),
+            ("Authorization", "Basic YWRtaW46YWRtaW4="),
+        ]
+        for header, value in bypass_tokens:
+            try:
+                resp = await self._http_get(url, headers={header: value})
+                if resp.status_code == 200:
+                    results.append({
+                        "title": f"Auth Bypass with {header}: {value[:20]}...",
+                        "description": f"Endpoint {url} returns 200 with {header} bypass attempt",
+                        "severity": "critical",
+                        "confidence": "needs_review",
+                        "category": "api_security",
+                        "evidence": {"url": url, "header": header, "value_prefix": value[:20]},
+                        "remediation": "Validate all authentication tokens properly. Do not trust user-supplied headers.",
+                    })
+                    break
+            except Exception:
+                continue
+        return results

bugfinder/agents/api/fuzz.py

@@ -0,0 +1,92 @@
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import urljoin
+
+from bugfinder.agents.base import AgentResult, BaseAgent
+
+FUZZ_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]
+FUZZ_PATHS = [
+    "/admin", "/debug", "/test", "/backup", "/config", "/health",
+    "/status", "/metrics", "/info", "/internal", "/private",
+    "/swagger.json", "/openapi.json", "/api-docs", "/docs",
+    "/graphql", "/api/graphql", "/v1/graphql",
+]
+
+FUZZ_PARAMS = ["debug=true", "test=1", "admin=true", "config=true"]
+
+
+class APIFuzzAgent(BaseAgent):
+    name = "api.fuzz"
+    description = "API endpoint fuzzing and method discovery"
+
+    async def execute(self) -> AgentResult:
+        base_url = self.context.target
+        if not base_url.startswith("http"):
+            base_url = f"https://{base_url}"
+        base_url = base_url.rstrip("/")
+
+        findings: list[dict[str, Any]] = []
+        assets: list[dict[str, Any]] = []
+
+        for path in FUZZ_PATHS:
+            url = urljoin(base_url, path)
+            for method in FUZZ_METHODS:
+                try:
+                    resp = await self._http_request(method, url)
+                    if resp.status_code < 500:
+                        assets.append({
+                            "id": f"fuzz-{method}-{path.replace('/', '_')}",
+                            "name": f"{method} {url}",
+                            "asset_type": "api_route",
+                            "value": f"HTTP {resp.status_code}",
+                            "properties": {"method": method, "path": path, "status": resp.status_code},
+                        })
+                        if resp.status_code == 200 and method in ("PUT", "PATCH", "DELETE"):
+                            findings.append({
+                                "title": f"Unprotected {method} Endpoint: {path}",
+                                "description": f"Endpoint {url} responds with 200 to {method} requests",
+                                "severity": "medium",
+                                "confidence": "needs_review",
+                                "category": "api_security",
+                                "evidence": {"url": url, "method": method, "status": resp.status_code},
+                            })
+                        if resp.status_code in (401, 403) and method in ("PUT", "PATCH", "DELETE"):
+                            findings.append({
+                                "title": f"Authenticated {method} Endpoint: {path}",
+                                "description": f"Endpoint {url} requires auth for {method} ({resp.status_code})",
+                                "severity": "info",
+                                "confidence": "verified",
+                                "category": "api_security",
+                                "evidence": {"url": url, "method": method, "status": resp.status_code},
+                            })
+                except Exception:
+                    continue
+
+        for param in FUZZ_PARAMS:
+            url = f"{base_url}?{param}"
+            try:
+                resp = await self._http_get(url)
+                if resp.status_code == 200 and resp.status_code != 404:
+                    findings.append({
+                        "title": f"Parameter Injection: {param}",
+                        "description": f"Endpoint accepts parameter injection: {param}",
+                        "severity": "low",
+                        "confidence": "needs_review",
+                        "category": "api_security",
+                        "evidence": {"url": url, "param": param, "status": resp.status_code},
+                    })
+            except Exception:
+                continue
+
+        for i, f in enumerate(findings):
+            f["id"] = f"api-fuzz-{i}"
+
+        summary = f"Tested {len(FUZZ_PATHS) * len(FUZZ_METHODS)} endpoints, {len(findings)} findings"
+        return AgentResult(
+            agent_name=self.name,
+            status="completed",
+            findings=findings,
+            assets=assets,
+            summary=summary,
+        )

bugfinder/agents/api/rate.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+
+from bugfinder.agents.base import AgentResult, BaseAgent
+
+
+class APIRateAgent(BaseAgent):
+    name = "api.rate"
+    description = "API rate limiting and abuse control testing"
+
+    async def execute(self) -> AgentResult:
+        base_url = self.context.target
+        if not base_url.startswith("http"):
+            base_url = f"https://{base_url}"
+
+        findings: list[dict[str, Any]] = []
+
+        rate_limited = await self._test_rate_limiting(base_url)
+        if rate_limited is False:
+            findings.append({
+                "title": "No Rate Limiting Detected",
+                "description": f"Endpoint {base_url} does not rate-limit requests (100 rapid requests all returned 200)",
+                "severity": "medium",
+                "confidence": "verified",
+                "category": "api_security",
+                "cwe_id": "CWE-770",
+                "evidence": {"url": base_url, "rapid_requests": 100, "blocked": rate_limited},
+                "remediation": "Implement rate limiting to prevent abuse and DoS attacks.",
+            })
+        elif rate_limited:
+            findings.append({
+                "title": "Rate Limiting Detected",
+                "description": f"Endpoint {base_url} rate-limits requests after rapid calls",
+                "severity": "info",
+                "confidence": "verified",
+                "category": "api_security",
+                "evidence": {"url": base_url, "rate_limited": True},
+            })
+
+        for i, f in enumerate(findings):
+            f["id"] = f"api-rate-{i}"
+
+        has_limit = "rate_limited" if rate_limited else "no_limit"
+        summary = f"Rate limit test: {has_limit.replace('_', ' ')}"
+        return AgentResult(
+            agent_name=self.name,
+            status="completed",
+            findings=findings,
+            summary=summary,
+        )
+
+    async def _test_rate_limiting(self, url: str) -> bool | None:
+        import httpx
+
+        count_429 = 0
+        tasks = []
+        for _ in range(100):
+            tasks.append(self._http_get(url))
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+        for r in results:
+            if isinstance(r, (Exception, BaseException)):
+                continue
+            if isinstance(r, httpx.Response) and r.status_code == 429:
+                count_429 += 1
+        if count_429 > 0:
+            return True
+        return False

bugfinder/agents/infra/port.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+
+from bugfinder.agents.base import AgentResult, BaseAgent
+
+COMMON_PORTS = [
+    (21, "FTP"), (22, "SSH"), (23, "Telnet"), (25, "SMTP"),
+    (53, "DNS"), (80, "HTTP"), (110, "POP3"), (143, "IMAP"),
+    (443, "HTTPS"), (445, "SMB"), (993, "IMAPS"), (995, "POP3S"),
+    (1433, "MSSQL"), (1521, "Oracle"), (2049, "NFS"),
+    (2375, "Docker"), (2376, "Docker TLS"), (3306, "MySQL"),
+    (3389, "RDP"), (5432, "PostgreSQL"), (5900, "VNC"),
+    (6379, "Redis"), (6443, "Kubernetes"), (8080, "HTTP-Alt"),
+    (8443, "HTTPS-Alt"), (27017, "MongoDB"),
+]
+
+
+class PortScanAgent(BaseAgent):
+    name = "infra.port"
+    description = "TCP port scanning"
+
+    async def execute(self) -> AgentResult:
+        import socket
+
+        hostname = self.context.target
+        from urllib.parse import urlparse
+        parsed = urlparse(hostname)
+        hostname = parsed.hostname or hostname
+        hostname = hostname.split("://")[-1].split("/")[0]
+
+        findings: list[dict[str, Any]] = []
+        assets: list[dict[str, Any]] = []
+        open_ports: list[tuple[int, str]] = []
+
+        async def check_port(port: int, service: str) -> tuple[int, str, bool]:
+            try:
+                _, writer = await asyncio.wait_for(
+                    asyncio.open_connection(hostname, port), timeout=3
+                )
+                writer.close()
+                await writer.wait_closed()
+                return (port, service, True)
+            except Exception:
+                return (port, service, False)
+
+        tasks = [check_port(port, svc) for port, svc in COMMON_PORTS]
+        results = await asyncio.gather(*tasks)
+
+        for port, service, is_open in results:
+            if is_open:
+                open_ports.append((port, service))
+                assets.append({
+                    "id": f"port-{port}",
+                    "name": f"{hostname}:{port}",
+                    "asset_type": "open_port",
+                    "value": f"{service} (TCP/{port})",
+                    "properties": {"port": port, "service": service, "protocol": "tcp"},
+                })
+
+        if open_ports:
+            port_list = ", ".join(f"{p}/{s}" for p, s in open_ports[:10])
+            findings.append({
+                "title": f"Open Ports Found: {len(open_ports)}",
+                "description": f"Open ports on {hostname}: {port_list}",
+                "severity": "medium" if any(p in (22, 23, 3389, 3306, 5432, 6379, 27017) for p, _ in open_ports) else "low",
+                "confidence": "verified",
+                "category": "reconnaissance",
+                "evidence": {"hostname": hostname, "open_ports": [{"port": p, "service": s} for p, s in open_ports]},
+                "remediation": "Close unnecessary ports and restrict access with firewalls.",
+            })
+
+        for i, f in enumerate(findings):
+            f["id"] = f"port-{i}"
+
+        summary = f"Scanned {len(COMMON_PORTS)} ports, {len(open_ports)} open"
+        return AgentResult(
+            agent_name=self.name,
+            status="completed",
+            findings=findings,
+            assets=assets,
+            summary=summary,
+        )