Metadata-Version: 2.4
Name: vulnlogic
Version: 2.0.1
Summary: Free API penetration testing from your terminal — zero config, zero cost
Author-email: VulnLogic <hello@vulnlogic.my>
License: MIT
Project-URL: Homepage, https://www.vulnlogic.my
Project-URL: Repository, https://github.com/loremipsum90/vulnlogic-cli
Keywords: security,pentest,api,vulnerability,scanning,idor,owasp
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.11
Description-Content-Type: text/markdown
Requires-Dist: click>=8.1.0
Requires-Dist: rich>=13.0.0
Requires-Dist: requests>=2.31.0
Requires-Dist: aiohttp>=3.9.0
Requires-Dist: pydantic>=2.0.0
Requires-Dist: pyyaml>=6.0

# VulnLogic CLI

Free, zero-config API penetration testing from your terminal.

The free tier runs 6 deterministic logic-flaw modules — IDOR, Mass Assignment,
Function-Level Auth Bypass, Horizontal Privilege Escalation, Race Condition,
and Workflow Bypass — with no signup, no API key, and no manual setup. The CLI
automatically creates its own test accounts against your target when you
don't supply a token.

A full 63-module platform (SQLi, SSRF, JWT attacks, PDF reports, dashboards)
is in development — [get notified when it ships](https://www.vulnlogic.my/coming-soon).

## Never used a terminal before?

No problem — here is everything you need, step by step.

**1. Open a terminal.**
- Mac: press `Cmd + Space`, type `Terminal`, hit Enter.
- Windows: press the Windows key, type `PowerShell`, hit Enter.
- Linux: press `Ctrl + Alt + T`.

**2. Check if Python is installed.** Type this and press Enter:
```bash
python3 --version
```
If you see something like `Python 3.11.5`, skip to step 4. If you see
"command not found," install Python first (step 3).

**3. Install Python** (only if step 2 failed).
- Mac: install [Homebrew](https://brew.sh), then run `brew install python@3.11`.
- Windows: download Python from [python.org/downloads](https://python.org/downloads)
  and run the installer — check "Add Python to PATH" during setup.
- Linux: `sudo apt install python3` (Ubuntu/Debian) or `sudo dnf install python3` (Fedora).

**4. Install VulnLogic:**
```bash
pip install vulnlogic
```

**5. Run your first scan.** Replace the URL with the API you want to test:
```bash
vulnlogic scan --free --target "My API" --base-url https://api.yourapp.com --spec openapi.json
```
Don't have an OpenAPI spec file? Most APIs built with FastAPI, Django REST
Framework, or similar frameworks expose one automatically — check
`/openapi.json` or `/swagger.json` on your API's base URL.

**What happens next:** VulnLogic automatically creates a couple of throwaway
test accounts on your API, then runs 6 security checks. If it finds
something, you will see a table listing what it found and how to fix it.
If not, you will get a clean "All clear" message.

## Install

```bash
pip install vulnlogic
```

## Quick Start

```bash
# Free scan — zero config, no token needed
vulnlogic scan --free --target myapi --base-url https://api.acme.com --spec openapi.json
```

That's it. VulnLogic will register its own throwaway test accounts against
your target, run all 6 free modules, and report any findings.

## Usage

```bash
# Free scan — no token, no signup
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json

# Free scan with your own token instead of auto-provisioning
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json --token eyJ...

# IDOR testing with two known accounts (skips auto-provisioning)
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json \
  --token eyJ... --victim-token eyJ...

# JSON output
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json --output json

# CI/CD — SARIF output + exit code 1 on high+ findings
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json \
  --output sarif --output-file results.sarif --fail-on high

# List available modules
vulnlogic modules
```

## GitHub Actions Example

```yaml
- name: API Security Scan (free tier)
  run: |
    pip install vulnlogic
    vulnlogic scan --free \
      --target ${{ github.repository }} \
      --base-url ${{ secrets.API_URL }} \
      --spec openapi.json \
      --output sarif \
      --output-file vulnlogic.sarif \
      --fail-on high

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: vulnlogic.sarif
```

## Free Tier Modules

| Module | What it catches |
|--------|------------------|
| IDOR | Accessing another user's data by changing an identifier |
| Mass Assignment | Injecting protected fields (e.g. `admin: true`) into a request body |
| Function-Level Auth Bypass | Regular users reaching admin-only endpoints |
| Horizontal Privilege Escalation | Acting on another user's resource via a tampered identity field |
| Race Condition | Concurrent requests bypassing balance/quota checks |
| Workflow Bypass | Skipping required steps in a multi-step process (e.g. refund before payment) |

63 modules total are planned for the full platform, covering injection
(SQLi, NoSQLi, SSRF, XXE), authentication (JWT attacks), infrastructure
(CORS, GraphQL, HTTP smuggling), file upload, cryptography, WebSocket, and
multi-tenant isolation — [join the waitlist](https://www.vulnlogic.my/coming-soon)
to get notified when they ship.
