parlov 0.3.0

HTTP oracle detection tool — systematic probing for RFC-compliant information leakage.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

//! CLI argument definitions for parlov.
//!
//! Structured via `clap` derive macros. Each oracle class maps to a subcommand.

use clap::{Parser, Subcommand};

/// HTTP oracle detection tool.
///
/// Probes web applications and APIs to identify information leakage through RFC-compliant server
/// behavior.
#[derive(Debug, Parser)]
#[command(name = "parlov", version, about, long_about = None)]
pub struct Cli {
    /// Subcommand selecting which oracle class to probe.
    #[command(subcommand)]
    pub command: Command,
}

/// Top-level subcommands, one per oracle class.
#[derive(Debug, Subcommand)]
pub enum Command {
    /// Probe for existence oracles via status-code differential (403 vs 404, etc.).
    Existence(ExistenceArgs),
    /// Automated elicitation scan: run all applicable strategies against a target endpoint.
    Scan(ScanArgs),
}

/// Arguments for the existence oracle subcommand.
#[derive(Debug, clap::Args)]
pub struct ExistenceArgs {
    /// Target URL template. Use `{id}` as the placeholder, e.g. `https://api.example.com/users/{id}`.
    #[arg(long)]
    pub target: String,

    /// Resource ID to use as the baseline (known-existing resource).
    #[arg(long)]
    pub baseline_id: String,

    /// Resource ID to probe. Defaults to a randomly generated `UUIDv4` (nonexistent by design).
    #[arg(long)]
    pub probe_id: Option<String>,

    /// Additional request headers in `Name: Value` format. Repeatable.
    #[arg(long = "header", value_name = "HEADER")]
    pub headers: Vec<String>,

    /// HTTP method to use.
    #[arg(long, default_value = "GET")]
    pub method: String,

    /// Optional request body template. Use `{id}` as the placeholder.
    /// Required for POST when the identifier is in the body.
    /// Also used for PATCH and PUT to supply the patch payload.
    #[arg(long)]
    pub body: Option<String>,
}

/// Arguments for the automated elicitation scan subcommand.
#[derive(Debug, clap::Args)]
pub struct ScanArgs {
    /// Target URL template with `{id}` placeholder.
    #[arg(long)]
    pub target: String,

    /// Known-existing resource ID (baseline).
    #[arg(long)]
    pub baseline_id: String,

    /// Known-nonexistent resource ID (probe). Defaults to a random `UUIDv4`.
    #[arg(long)]
    pub probe_id: Option<String>,

    /// Maximum risk level of strategies to run: safe | method-destructive | operation-destructive
    #[arg(long, default_value = "safe")]
    pub risk: String,

    /// Additional request headers in `Name: Value` format. Repeatable.
    #[arg(long = "header", value_name = "HEADER")]
    pub headers: Vec<String>,

    /// Under-scoped credential header for scope-manipulation strategy, e.g. `Authorization: Bearer ...`
    #[arg(long = "alt-credential", value_name = "HEADER")]
    pub alt_credential: Option<String>,

    /// Known-duplicate field=value for uniqueness strategy, e.g. `email=alice@example.com`
    #[arg(long)]
    pub known_duplicate: Option<String>,

    /// State field=value for state-transition strategy, e.g. `status=invalid`
    #[arg(long)]
    pub state_field: Option<String>,
}