clawscan 1.0.0

OpenClaw/Moltbot/Clawdbot vulnerability scanner for prompt injection, supply chain, and RAG poisoning attacks
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

//! ClawScan CLI - High-Performance OpenClaw Vulnerability Scanner

use clap::Parser;
use clawscan::parse_target;
use colored::Colorize;

#[derive(Parser)]
#[command(name = "clawscan")]
#[command(about = "OpenClaw/Moltbot/Clawdbot Vulnerability Scanner", long_about = None)]
struct Cli {
    /// Target(s) to scan (domain, IP, or ws:// URL)
    targets: Vec<String>,

    /// Number of concurrent scans
    #[arg(short, long, default_value = "50")]
    concurrency: usize,

    /// Output JSON report to file
    #[arg(short, long)]
    json: Option<String>,

    /// Quiet mode - only show exploited vulnerabilities
    #[arg(short, long)]
    quiet: bool,
}

#[tokio::main]
async fn main() {
    let cli = Cli::parse();

    println!("{}", "🔍 ClawScan v1.0.0".bright_cyan().bold());
    println!();

    if cli.targets.is_empty() {
        eprintln!("{}", "Error: No targets specified".red());
        std::process::exit(1);
    }

    // Parse targets
    println!("📋 Parsing {} target(s)...", cli.targets.len());
    let mut parsed_targets = Vec::new();

    for target_input in &cli.targets {
        match parse_target(target_input) {
            Ok(target) => {
                println!("  {} {}", "✓".green(), target.url);
                parsed_targets.push(target);
            }
            Err(e) => {
                eprintln!("  {} {}: {}", "✗".red(), target_input, e);
            }
        }
    }

    if parsed_targets.is_empty() {
        eprintln!("{}", "Error: No valid targets to scan".red());
        std::process::exit(1);
    }

    println!();
    println!("🎯 Scanning {} target(s) with concurrency: {}",
        parsed_targets.len(), cli.concurrency);
    println!();

    // Show attack modules
    println!("{}", "Attack Modules (9/9 Complete):".bright_yellow());
    println!("  {} CVE-2026-25253: WebSocket CSWSH {}",
        "●".bright_red(), "[CRITICAL]".red());
    println!("  {} CVE-2026-22708: Indirect Injection {}",
        "●".bright_magenta(), "[HIGH]".yellow());
    println!("  {} CVE-2026-25157: Command Injection {}",
        "●".bright_red(), "[CRITICAL]".red());
    println!("  {} Prompt Injection (24 techniques) {}",
        "●".bright_magenta(), "[HIGH]".yellow());
    println!("  {} RAG/Memory Poisoning {}",
        "●".bright_magenta(), "[HIGH]".yellow());
    println!("  {} Supply Chain (ClawHavoc) {}",
        "●".bright_red(), "[CRITICAL]".red());
    println!("  {} MCP Tool Poisoning {}",
        "●".bright_magenta(), "[HIGH]".yellow());
    println!("  {} Elevated Mode Bypass {}",
        "●".bright_magenta(), "[HIGH]".yellow());
    println!("  {} Zero-Click RCE Chain {}",
        "●".bright_red(), "[CRITICAL]".red());
    println!();

    // Execute scan
    use clawscan::{scan_targets, ScanConfig, generate_report, format_terminal_report, save_json_report};

    let config = ScanConfig {
        concurrency: cli.concurrency,
    };

    println!("{}", "⏳ Running vulnerability scan...".bright_cyan());

    match scan_targets(parsed_targets, config).await {
        Ok(results) => {
            // Generate report
            let report = generate_report(results);

            // Save JSON if requested
            if let Some(json_path) = &cli.json {
                match save_json_report(&report, json_path) {
                    Ok(_) => println!("{} Report saved to: {}", "✓".green(), json_path),
                    Err(e) => eprintln!("{} Failed to save JSON report: {}", "✗".red(), e),
                }
            }

            // Display report (unless quiet mode and no exploits)
            if !cli.quiet || report.summary.exploited > 0 {
                println!("{}", format_terminal_report(&report));
            }
        }
        Err(e) => {
            eprintln!("{} Scan failed: {}", "✗".red(), e);
            std::process::exit(1);
        }
    }
}