# @hover-dev/pentest

The **discovery** half of Hover security — the red "pentest mode". Where
[`@hover-dev/security`](../security) crystallizes confirmed access-control
findings into a CI `.security.spec.ts` (the orange "security mode", business /
authorization), pentest hunts **vulnerabilities + attack classes** (SQLi, XSS,
SSTI, SSRF, path-traversal, XXE, deserialization, RCE, open-redirect, CORS,
JWT, …) and turns a session's recorded checks into a **findings report**.

- **Authorized, own-app only.** Scoped to the dev origin you're building — no
  third-party targets, no DoS, no detection-evasion. Entering red mode is the
  authorization.
- **In-band confirmation.** Findings are confirmed by timing, body-diff, or
  reflected internal content — not external out-of-band callbacks.
- **No secrets in the report.** Cookies / tokens / PII are stripped; request
  bodies/headers are referenced, never dumped; URLs are sanitized.
- **Says what it didn't test.** Every report carries a "Not tested" section so
  it's never mistaken for full coverage.

## Coverage

Probes come from the shared `@hover-dev/probe-engine` seed set (built-ins +
your `.hover/rules/`). Built-in **offensive** seeds today:

| Class | Built-in seed | How it's confirmed (in-band) |
|---|---|---|
| SQL injection | `sqli-error-boolean` | error fragment / boolean body-diff / SLEEP delay |
| Reflected XSS | `xss-reflected` | canary reflects unencoded in an executable context |
| SSTI | `ssti-template-injection` | `{{7*7}}` → 49 in the response |
| SSRF | `ssrf-url-param` | internal/metadata content or a timing delta |
| Open redirect | `open-redirect` | 3xx `Location` to an external origin |
| Path traversal | `path-traversal` | file contents (e.g. `/etc/passwd`) in the response |
| GraphQL | `graphql-introspection` | `__schema` returned (introspection left on) |

Plus the authz seeds shared with security mode (IDOR, BFLA, mass-assignment,
auth-bypass — the latter also covers JWT tampering / `alg:none`).

**Deliberately out of scope** (so the report's honesty holds): recon / OSINT /
subdomain enumeration (we test the app you're building, not its attack surface),
cloud-misconfig, and anything that can only be confirmed **out-of-band**
(Collaborator-style callbacks) — those are reported as *suspected*, never
confirmed. CORS and JWT live as cross-flow / header checks rather than per-flow
seeds for now. Growing the seed set is the main expansion path — add to
`.hover/rules/` or the engine built-ins.

## Standing on the shoulders of giants

Pentest mode's offensive web-vulnerability methodology — the per-class
detection signals, exploitation techniques, the validation gate, the report
shape — is adapted (with thanks) from **Claude-BugHunter** by Sachin Sharma
(MIT):

**https://github.com/elementalsouls/Claude-BugHunter**

We rewrote the material into Hover's probe-seed + report format and scoped it to
authorized own-app testing (dropping the bug-bounty / external-target / OOB and
enterprise-appliance parts). Credit and gratitude to that project.

## License

[Apache-2.0](../../LICENSE) © Hyperyond Studio
