parlov-elicit 0.1.0

Elicitation engine: strategy selection and probe plan generation for parlov.
Documentation

parlov-elicit

Elicitation engine for parlov. Given a target endpoint and operator context, generates a plan of ProbeSpecs designed to trigger specific server-side differentials that reveal resource existence.

Overview

The engine codifies the elicitation playbook as 17 composable strategies. Each strategy targets a different layer of the HTTP pipeline — content negotiation, conditional headers, auth, payload validation, rate limiting — and produces probe definitions that the binary feeds into its execution loops.

Usage

use parlov_elicit::{generate_plan, RiskLevel, ScanContext};
use http::HeaderMap;

let ctx = ScanContext {
    target: "https://api.example.com/users/{id}".to_string(),
    baseline_id: "1001".to_string(),
    probe_id: "9999".to_string(),
    headers: HeaderMap::new(),
    max_risk: RiskLevel::Safe,
    known_duplicate: None,
    state_field: None,
    alt_credential: None,
};

let plan = generate_plan(&ctx);
// plan contains ProbeSpec::Pair, ::Burst, and ::HeaderDiff items
// ready for dispatch by the binary's scan pipeline

Strategies

# ID Risk Methods Prereq
1 accept-elicit Safe GET, HEAD —
2 if-none-match-elicit Safe GET, HEAD —
3 trailing-slash-elicit Safe GET, HEAD —
4 case-normalize-elicit Safe GET, HEAD —
5 long-uri-elicit Safe GET, HEAD —
6 auth-strip-elicit Safe GET, HEAD Authorization header
7 low-privilege-elicit Safe GET, HEAD Authorization header
8 scope-manipulation-elicit Safe GET, HEAD alt_credential
9 rate-limit-headers-elicit Safe GET, HEAD —
10 content-type-elicit MethodDestructive POST, PUT, PATCH —
11 if-match-elicit MethodDestructive PUT, PATCH, DELETE —
12 empty-body-elicit MethodDestructive POST, PUT, PATCH —
13 oversized-body-elicit MethodDestructive POST, PUT, PATCH —
14 state-transition-elicit MethodDestructive PATCH, PUT state_field
15 uniqueness-elicit OperationDestructive POST, PUT known_duplicate
16 dependency-delete-elicit OperationDestructive DELETE —
17 rate-limit-burst-elicit OperationDestructive GET, HEAD —

Design

  • Pure computation — no I/O, no async. The binary owns the async boundary.
  • Strategy as trait — adding a strategy is one file + one registry line.
  • ProbeSpec variants drive dispatch in the binary: Pair → adaptive loop, Burst → volume loop, HeaderDiff → single-request header comparison.
  • RiskLevel uses Ord — generate_plan filters with risk() <= ctx.max_risk.