argus

# ARGUS — THE ALL-SEEING SCANNER SUITE > Named for Argus Panoptes, the hundred-eyed giant. Six "eyes" that surface what > ordinary scans miss: two of the most common web2 classes (CORS, CRLF), the > NoSQL "db" surface, JWT forging, **blind-bug confirmation via OOB** (the eye > that sees the invisible — unblocks an entire severity band), and automated LLM > red-teaming. All pure-Python, no new deps. Core logic is offline-testable. --- ## 0. ROUTING — which tool for what | Signal on the target | Tool / command | |---|---| | API reflects `Origin`, or `ACAO`/`ACAC` headers seen | `/cors` | | Param reaches a redirect / `Location` / log / response header | `/crlf` | | JSON login or `{user,pass}` body, Mongo/Mongoose stack | `/nosqli` | | `Authorization: Bearer ey...` / JWT in cookie or storage | `/jwt-scan` | | Suspected **blind** SSRF/XXE/SQLi/RCE (no in-band signal) | `/oob` | | Chatbot / agent / LLM feature | `/llm-redteam` | --- ## 1. CORS — `/cors` ```bash tools/cors_scanner.py https://api.target.com/me --cookie "session=..." tools/cors_scanner.py -l recon/target.com/urls/api.txt --json ``` Sends crafted `Origin` headers, classifies `Access-Control-Allow-Origin` / `Access-Control-Allow-Credentials`: - **CRITICAL** — reflects attacker origin **with** `ACAC: true` → cookie-auth'd cross-origin read (account-data exfil). - **HIGH** — `null` origin trusted with credentials. - **MEDIUM** — reflects without creds (exploitable when auth = non-cookie token), or trusts http dow...