feat: expand bug bounty template coverage

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

backend/scripts/seed-templates/exposure-to-cve-brief.json

@@ -0,0 +1,184 @@
+{
+  "_metadata": {
+    "name": "WAF Edge Recon Triage",
+    "description": "Authorized bug bounty workflow that probes live URLs with HTTPx, detects Web Application Firewalls with wafw00f, and writes a prioritized edge-defense recon report.",
+    "category": "bug-bounty",
+    "tags": ["bug-bounty", "recon", "httpx", "wafw00f", "waf", "edge-defense", "triage"],
+    "author": "sentris-team",
+    "version": "1.0.0"
+  },
+  "manifest": {
+    "name": "WAF Edge Recon Triage",
+    "description": "Fingerprint live web assets and detect WAF presence for authorized bug bounty targets.",
+    "version": "1.0.0",
+    "author": "sentris-team",
+    "category": "bug-bounty",
+    "tags": ["bug-bounty", "recon", "httpx", "wafw00f", "waf", "edge-defense", "triage"],
+    "entryPoint": "trigger_1",
+    "nodeCount": 5,
+    "edgeCount": 8
+  },
+  "graph": {
+    "name": "WAF Edge Recon Triage",
+    "description": "HTTP probing plus WAF detection for authorized live URLs.",
+    "nodes": [
+      {
+        "id": "trigger_1",
+        "type": "core.workflow.entrypoint",
+        "position": { "x": 100, "y": 260 },
+        "data": {
+          "label": "Authorized Live URL Input",
+          "config": {
+            "params": {
+              "runtimeInputs": [
+                {
+                  "id": "liveUrls",
+                  "label": "Live URLs",
+                  "type": "array",
+                  "required": true,
+                  "description": "Authorized HTTP or HTTPS URLs to probe for WAF and service fingerprinting."
+                },
+                {
+                  "id": "authorizationNotes",
+                  "label": "Authorization notes",
+                  "type": "text",
+                  "required": false,
+                  "defaultValue": "",
+                  "description": "Program scope, exclusions, and rate-limit notes."
+                }
+              ]
+            },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "httpx_probe",
+        "type": "sentris.httpx.scan",
+        "position": { "x": 420, "y": 260 },
+        "data": {
+          "label": "Probe Live HTTP Services",
+          "config": {
+            "params": {
+              "threads": 50,
+              "followRedirects": true,
+              "tlsProbe": true,
+              "preferHttps": true
+            },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "wafw00f_scan",
+        "type": "sentris.wafw00f.run",
+        "position": { "x": 740, "y": 260 },
+        "data": {
+          "label": "Detect Web Application Firewalls",
+          "config": {
+            "params": { "findAll": false, "verbose": false },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "rank_waf_recon",
+        "type": "core.logic.script",
+        "position": { "x": 1060, "y": 260 },
+        "data": {
+          "label": "Rank WAF and HTTP Signals",
+          "config": {
+            "params": {
+              "variables": [
+                { "name": "liveUrls", "type": "list-text" },
+                { "name": "authorizationNotes", "type": "string" },
+                { "name": "httpResponses", "type": "list-json" },
+                { "name": "wafDetections", "type": "list-json" },
+                { "name": "detectionCount", "type": "number" }
+              ],
+              "returns": [{ "name": "report", "type": "json" }],
+              "code": "export function script(input) {\n  const liveUrls = Array.isArray(input.liveUrls) ? input.liveUrls : [];\n  const httpResponses = Array.isArray(input.httpResponses) ? input.httpResponses : [];\n  const wafDetections = Array.isArray(input.wafDetections) ? input.wafDetections : [];\n  const authorizationNotes = typeof input.authorizationNotes === 'string' && input.authorizationNotes.trim().length > 0 ? input.authorizationNotes.trim() : null;\n  const wafByUrl = new Map();\n  for (const item of wafDetections) {\n    const url = typeof item?.url === 'string' ? item.url : '';\n    if (url) wafByUrl.set(url, item);\n  }\n  const assets = httpResponses.map((resp) => {\n    const url = resp?.url || resp?.finalUrl || resp?.input || '';\n    const waf = wafByUrl.get(url) || null;\n    return {\n      url,\n      statusCode: resp?.statusCode ?? null,\n      title: resp?.title ?? null,\n      technologies: Array.isArray(resp?.technologies) ? resp.technologies : [],\n      wafDetected: waf?.detected === true,\n      firewall: waf?.firewall || null,\n      manufacturer: waf?.manufacturer || null\n    };\n  }).sort((a, b) => Number(b.wafDetected) - Number(a.wafDetected) || Number(b.technologies?.length || 0) - Number(a.technologies?.length || 0));\n  const wafBrands = Array.from(new Set(assets.filter((item) => item.wafDetected).map((item) => item.firewall).filter(Boolean)));\n  return {\n    report: {\n      summary: {\n        liveUrls: liveUrls.length,\n        probedEndpoints: httpResponses.length,\n        wafDetections: Number(input.detectionCount || assets.filter((item) => item.wafDetected).length),\n        wafBrands,\n        interestingWithoutWaf: assets.filter((item) => !item.wafDetected && [200, 401, 403, 500].includes(Number(item.statusCode))).length\n      },\n      authorizationNotes,\n      assets: assets.slice(0, 100),\n      nextSteps: [\n        'Treat WAF-detected endpoints as edge-protected before active testing',\n        'Review 401/403 endpoints without WAF signals for auth bypass opportunities',\n        'Stay within authorized scope and rate limits for follow-up testing'\n      ]\n    }\n  };\n}"
+            },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "artifact_report",
+        "type": "core.artifact.writer",
+        "position": { "x": 1380, "y": 260 },
+        "data": {
+          "label": "Save WAF Recon Report",
+          "config": {
+            "params": {
+              "fileExtension": ".json",
+              "mimeType": "application/json",
+              "saveToRunArtifacts": true,
+              "publishToArtifactLibrary": false
+            },
+            "inputOverrides": { "artifactName": "waf-edge-recon-triage-{{date}}" }
+          }
+        }
+      }
+    ],
+    "edges": [
+      {
+        "id": "trigger_1-httpx_probe-targets",
+        "source": "trigger_1",
+        "target": "httpx_probe",
+        "sourceHandle": "liveUrls",
+        "targetHandle": "targets"
+      },
+      {
+        "id": "trigger_1-wafw00f_scan-targets",
+        "source": "trigger_1",
+        "target": "wafw00f_scan",
+        "sourceHandle": "liveUrls",
+        "targetHandle": "targets"
+      },
+      {
+        "id": "trigger_1-rank_waf_recon-liveUrls",
+        "source": "trigger_1",
+        "target": "rank_waf_recon",
+        "sourceHandle": "liveUrls",
+        "targetHandle": "liveUrls"
+      },
+      {
+        "id": "trigger_1-rank_waf_recon-authorizationNotes",
+        "source": "trigger_1",
+        "target": "rank_waf_recon",
+        "sourceHandle": "authorizationNotes",
+        "targetHandle": "authorizationNotes"
+      },
+      {
+        "id": "httpx_probe-rank_waf_recon-responses",
+        "source": "httpx_probe",
+        "target": "rank_waf_recon",
+        "sourceHandle": "responses",
+        "targetHandle": "httpResponses"
+      },
+      {
+        "id": "wafw00f_scan-rank_waf_recon-detections",
+        "source": "wafw00f_scan",
+        "target": "rank_waf_recon",
+        "sourceHandle": "wafDetections",
+        "targetHandle": "wafDetections"
+      },
+      {
+        "id": "wafw00f_scan-rank_waf_recon-detectionCount",
+        "source": "wafw00f_scan",
+        "target": "rank_waf_recon",
+        "sourceHandle": "detectionCount",
+        "targetHandle": "detectionCount"
+      },
+      {
+        "id": "rank_waf_recon-artifact_report-report",
+        "source": "rank_waf_recon",
+        "target": "artifact_report",
+        "sourceHandle": "report",
+        "targetHandle": "content"
+      }
+    ]
+  },
+  "requiredSecrets": []
+}

backend/scripts/seed-templates/public-repo-full-code-security-discord-report.json

@@ -13,18 +13,21 @@ const newTemplateFiles = [
   'container-image-cve-triage.json',
   'cve-impact-research-brief.json',
   'exposed-service-cve-mapper.json',
+  'exposure-to-cve-brief.json',
   'github-dependency-cve-hunt-discord-report.json',
   'github-repo-dependency-cve-triage.json',
   'kev-fresh-cve-watch-brief.json',
   'npm-dependency-cve-hunt.json',
   'passive-osint-subdomain-expansion.json',
   'public-repo-code-iac-risk-triage.json',
+  'public-repo-full-code-security-discord-report.json',
   'public-repo-full-code-security.json',
   'public-repo-secret-exposure-triage.json',
   'security-scan-discord-report.json',
   'subdomain-takeover-triage.json',
   'tech-stack-cve-hunter.json',
   'web-api-fuzz-triage.json',
+  'wafw00f-edge-recon-triage.json',
   'web-attack-surface-quick-win-hunt.json',
 ];
 
@@ -2037,4 +2040,145 @@ describe('new seed templates', () => {
     expect(result.report.assets[0].url).toBe('https://www.example.com');
     expect(result.report.assets[0].statusCode).toBe(200);
   });
+
+  it('public-repo-full-code-security-discord-report wires Run Report Discord after artifact save', () => {
+    const filePath = join(seedTemplatesDir, 'public-repo-full-code-security-discord-report.json');
+    const template = JSON.parse(readFileSync(filePath, 'utf8'));
+
+    expect(template.manifest.nodeCount).toBe(14);
+    expect(template.requiredSecrets).toEqual([
+      expect.objectContaining({ name: 'DISCORD_WEBHOOK_URL', type: 'string' }),
+    ]);
+    expect(
+      template.graph.edges.find(
+        (edge: { id: string }) => edge.id === 'artifact_report-run_report_discord-after',
+      ),
+    ).toEqual(
+      expect.objectContaining({
+        source: 'artifact_report',
+        target: 'run_report_discord',
+        sourceHandle: 'saved',
+        targetHandle: 'after',
+      }),
+    );
+  });
+
+  it('exposure-to-cve-brief chains exposure mapping into CVE impact brief assembly', () => {
+    const filePath = join(seedTemplatesDir, 'exposure-to-cve-brief.json');
+    const template = JSON.parse(readFileSync(filePath, 'utf8'));
+    const nodeTypes = template.graph.nodes.map((node: { type: string }) => node.type);
+
+    expect(nodeTypes).toEqual(
+      expect.arrayContaining([
+        'sentris.naabu.scan',
+        'sentris.httpx.scan',
+        'sentris.nvd.cve.query',
+        'core.http.request',
+        'core.logic.script',
+        'core.artifact.writer',
+      ]),
+    );
+    expect(
+      template.graph.edges.find(
+        (edge: { id: string }) => edge.id === 'rank_cve_candidates-pick_top_cve-report',
+      ),
+    ).toBeTruthy();
+    expect(
+      template.graph.edges.find(
+        (edge: { id: string }) => edge.id === 'pick_top_cve-query_nvd_detail-cveId',
+      ),
+    ).toBeTruthy();
+    expect(
+      template.graph.edges.find(
+        (edge: { id: string }) => edge.id === 'pick_top_cve-query_nvd_detail-lookupKeyword',
+      ),
+    ).toBeTruthy();
+  });
+
+  it('exposure-to-cve-brief pick script selects the top ranked CVE candidate', () => {
+    const filePath = join(seedTemplatesDir, 'exposure-to-cve-brief.json');
+    const template = JSON.parse(readFileSync(filePath, 'utf8'));
+    const pickNode = template.graph.nodes.find(
+      (node: { id: string }) => node.id === 'pick_top_cve',
+    );
+    const result = runTemplateScript<{ cveId: string; product: string; cveLookupKeyword: string }>(
+      pickNode.data.config.params.code,
+      {
+        report: {
+          summary: { topCandidate: 'CVE-2024-0001', fingerprintKeyword: 'nginx' },
+          candidates: [{ id: 'CVE-2024-0001' }, { id: 'CVE-2023-9999' }],
+        },
+      },
+    );
+
+    expect(result.cveId).toBe('CVE-2024-0001');
+    expect(result.product).toBe('nginx');
+    expect(result.cveLookupKeyword).toBe('CVE-2024-0001');
+  });
+
+  it('exposure-to-cve-brief pick script falls back to product keyword when no CVE is ranked', () => {
+    const filePath = join(seedTemplatesDir, 'exposure-to-cve-brief.json');
+    const template = JSON.parse(readFileSync(filePath, 'utf8'));
+    const pickNode = template.graph.nodes.find(
+      (node: { id: string }) => node.id === 'pick_top_cve',
+    );
+    const result = runTemplateScript<{ cveId: string; product: string; cveLookupKeyword: string }>(
+      pickNode.data.config.params.code,
+      {
+        report: {
+          summary: { topCandidate: null, fingerprintKeyword: 'nginx' },
+          candidates: [],
+        },
+      },
+    );
+
+    expect(result.cveId).toBe('');
+    expect(result.product).toBe('nginx');
+    expect(result.cveLookupKeyword).toBe('nginx');
+  });
+
+  it('wafw00f-edge-recon-triage wires httpx and wafw00f into a ranked report', () => {
+    const filePath = join(seedTemplatesDir, 'wafw00f-edge-recon-triage.json');
+    const template = JSON.parse(readFileSync(filePath, 'utf8'));
+
+    expect(template.graph.nodes.map((node: { type: string }) => node.type)).toEqual([
+      'core.workflow.entrypoint',
+      'sentris.httpx.scan',
+      'sentris.wafw00f.run',
+      'core.logic.script',
+      'core.artifact.writer',
+    ]);
+  });
+
+  it('wafw00f-edge-recon-triage rank script merges HTTP and WAF detections by URL', () => {
+    const filePath = join(seedTemplatesDir, 'wafw00f-edge-recon-triage.json');
+    const template = JSON.parse(readFileSync(filePath, 'utf8'));
+    const rankNode = template.graph.nodes.find(
+      (node: { id: string }) => node.id === 'rank_waf_recon',
+    );
+    const result = runTemplateScript<{
+      report: {
+        summary: Record<string, unknown>;
+        assets: { url: string; wafDetected: boolean; firewall?: string }[];
+      };
+    }>(rankNode.data.config.params.code, {
+      liveUrls: ['https://app.example.com'],
+      httpResponses: [
+        { url: 'https://app.example.com', statusCode: 200, title: 'App', technologies: ['nginx'] },
+      ],
+      wafDetections: [
+        {
+          url: 'https://app.example.com',
+          detected: true,
+          firewall: 'Cloudflare',
+          manufacturer: 'Cloudflare',
+        },
+      ],
+      detectionCount: 1,
+    });
+
+    expect(result.report.summary.wafDetections).toBe(1);
+    expect(result.report.assets[0].wafDetected).toBe(true);
+    expect(result.report.assets[0].firewall).toBe('Cloudflare');
+  });
 });

backend/scripts/seed-templates/wafw00f-edge-recon-triage.json

@@ -58,15 +58,18 @@ const securityTemplateFiles = [
   'bug-bounty-recon-triage.json',
   'cve-impact-research-brief.json',
   'exposed-service-cve-mapper.json',
+  'exposure-to-cve-brief.json',
   'github-dependency-cve-hunt-discord-report.json',
   'github-repo-dependency-cve-triage.json',
   'kev-fresh-cve-watch-brief.json',
   'npm-dependency-cve-hunt.json',
+  'public-repo-full-code-security-discord-report.json',
   'public-repo-full-code-security.json',
   'public-repo-secret-exposure-triage.json',
   'security-scan-discord-report.json',
   'subdomain-takeover-triage.json',
   'tech-stack-cve-hunter.json',
+  'wafw00f-edge-recon-triage.json',
   'web-attack-surface-quick-win-hunt.json',
 ] as const;