feat(stuff): more tests

Author: Mte90

README.md

@@ -35,6 +35,6 @@ baco scan --config myproject.toml
 
 - [Architecture](docs/architecture.md) - PhaseGraph pipeline
 - [Configuration](docs/configuration.md) - Settings, LLM config, prompts
-- [Research Integration](docs/research-integration.md) - Design decisions
+- [Research Integration](docs/research-integration.md) - Design decisions based on 30 academic papers plus triage patterns inspired by [Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter)
 
 Codecov: [![Codecov](https://codecov.io/gh/CodeAtCode/baco-scanner/branch/master/graph/badge.svg)](https://app.codecov.io/gh/CodeAtCode/baco-scanner/tree/master)

docs/research-integration.md

@@ -0,0 +1,72 @@
+# Authentication/Authorization Vulnerability Hunt Guide
+
+## Dangerous API Patterns by Language
+
+### C/C++
+- **Password Storage**: `MD5(password)`, `SHA1(password)` without salt
+- **Session Management**: Hardcoded session keys, predictable session IDs
+- **Access Control**: Missing permission checks before file operations
+- **Buffer Overflows in Auth**: `strcpy` in password comparison buffers
+
+### Python
+- **Password Hashing**: `hashlib.md5(password)`, `hashlib.sha1(password)`
+- **Session Tokens**: `secrets.token_hex()` without proper entropy, hardcoded secrets
+- **Auth Bypass**: `if user == 'admin':` without proper validation
+- **JWT**: `jwt.decode(token, verify=False)`, weak JWT algorithms (none, HS256 with weak secret)
+
+### Java
+- **Password Hashing**: `MessageDigest.getInstance("MD5")`, `SHA-1`
+- **Session**: `session.setAttribute()` without timeout, predictable session IDs
+- **Authorization**: `request.isUserInRole()` not called, missing `@PreAuthorize`
+- **Hardcoded Secrets**: `String apiKey = "abc123";`, `private static final String SECRET = "..."`
+
+### Go
+- **Password Hashing**: `sha256.Sum256(password)` without bcrypt/argon2
+- **JWT**: `Parse(token, func(...) { return nil })` skipping signature verification
+- **Session**: Hardcoded session secrets, missing CSRF tokens
+- **Auth Middleware**: Empty middleware functions, missing permission checks
+
+### JavaScript/Node.js
+- **Password Hashing**: `crypto.createHash('md5').update(password)`
+- **JWT**: `jwt.verify(token, secret, { algorithms: ['none'] })`
+- **Session**: `express-session` without `secure: true`, `httpOnly: true`
+- **Auth Logic**: `if (req.query.admin === 'true')`, missing role checks
+
+## Known False-Positive Signatures
+
+### Safe Patterns (DO NOT REPORT)
+- **Proper Password Hashing**: `bcrypt.hash(password, saltRounds)`, `argon2.hash(password)`
+- **JWT Verification**: `jwt.verify(token, secret, { algorithms: ['RS256'] })` with proper validation
+- **Session Security**: `secure: true, httpOnly: true, sameSite: 'strict'`
+- **Role-Based Access**: `@RequiresRoles("ADMIN")`, `if (user.role === 'admin' && user.verified)`
+- **OAuth/OIDC**: Proper implementation using established libraries (passport.js, oauth2-server)
+
+## Bypass Detection Patterns
+
+### Authentication Bypass
+- **Parameter Pollution**: `?admin=true&admin=false`
+- **Type Juggling**: `if (userId == "1")` in PHP/JS
+- **HTTP Parameter Pollution**: Duplicate parameters to confuse logic
+- **Null Byte Injection**: `admin.txt%00.jpg` to bypass extensions
+- **Race Conditions**: Concurrent requests to bypass rate limiting
+
+### Authorization Bypass
+- **IDOR**: `GET /api/users/1` → `GET /api/users/2` without ownership check
+- **Privilege Escalation**: Modifying role claims in JWT, URL parameter tampering
+- **Missing Middleware**: Protected routes without auth middleware
+- **CORS Misconfiguration**: `Access-Control-Allow-Origin: *` on auth endpoints
+
+## Chain Opportunities
+
+### Auth Vulnerabilities Enable
+- **Data Breach**: Unauthorized access to sensitive data
+- **Privilege Escalation**: Admin access leads to RCE or full system compromise
+- **Account Takeover**: Session fixation, weak password policies
+- **Business Logic Abuse**: Bypass payment, free access to premium features
+- **Lateral Movement**: Compromised credentials used for internal network access
+
+### Priority Indicators
+- **Critical**: Admin authentication bypass, password reset flaws, MFA bypass
+- **High**: IDOR on sensitive data, JWT validation flaws, session fixation
+- **Medium**: Weak password policies, missing rate limiting, verbose error messages
+- **Low**: Missing security headers, informational disclosure in error pages

prompts/hunt/auth.md

@@ -0,0 +1,77 @@
+# Cryptographic Weakness Vulnerability Hunt Guide
+
+## Dangerous API Patterns by Language
+
+### C/C++
+- **Random Number Generation**: `rand()`, `srand(time(NULL))` for security purposes
+- **Hash Functions**: `MD5()`, `SHA1()` for password hashing, integrity verification
+- **Encryption**: `EVP_CIPHER_CTX_init()` with DES, RC4, CBC mode without HMAC
+- **Key Management**: Hardcoded encryption keys, keys in source code
+- **Memory**: Storing plaintext keys in memory, insufficient key clearing
+
+### Python
+- **Random**: `random.random()`, `random.randint()` for tokens/secrets
+- **Hash**: `hashlib.md5()`, `hashlib.sha1()` for passwords
+- **Encryption**: `Crypto.Cipher.DES`, `Crypto.Cipher.ARC4`
+- **Key Derivation**: `hashlib.md5(password)` instead of `bcrypt`/`argon2`
+- **Hardcoded Keys**: `SECRET_KEY = "abc123"`, `API_KEY = "..."`
+
+### Java
+- **Random**: `java.util.Random` for security tokens
+- **Hash**: `MessageDigest.getInstance("MD5")`, `SHA-1`
+- **Encryption**: `Cipher.getInstance("DES/ECB/PKCS5Padding")`, `RC4`
+- **KeyStore**: Hardcoded keystore passwords, weak key storage
+- **SSL**: `TrustAllManager`, `hostnameVerifier = (a, b) -> true`
+
+### Go
+- **Random**: `math/rand` instead of `crypto/rand`
+- **Hash**: `crypto/md5`, `crypto/sha1` for security purposes
+- **Encryption**: `cipher.NewRC4()`, ECB mode usage
+- **Key Derivation**: `md5.Sum(password)` instead of `bcrypt`
+- **TLS**: `tls.Config{InsecureSkipVerify: true}`
+
+### JavaScript/Node.js
+- **Random**: `Math.random()` for tokens/secrets
+- **Hash**: `crypto.createHash('md5')`, `createHash('sha1')`
+- **Encryption**: `crypto.createCipher('des-ecb', key)`
+- **JWT**: Weak algorithms, missing signature verification
+- **Hardcoded Secrets**: `process.env.SECRET = "abc123"` in code
+
+## Known False-Positive Signatures
+
+### Safe Patterns (DO NOT REPORT)
+- **Cryptographically Secure RNG**: `secrets.token_hex()`, `crypto.getRandomValues()`, `crypto/rand`
+- **Modern Hashing**: `bcrypt`, `argon2`, `scrypt`, `PBKDF2` for passwords
+- **Strong Encryption**: `AES-GCM`, `AES-256-CBC` with HMAC, `ChaCha20-Poly1305`
+- **Key Derivation**: `bcrypt.gensalt()`, `argon2.hash()`, `pbkdf2_derive()`
+- **Proper TLS**: Valid certificate verification, strong cipher suites
+
+## Bypass Detection Patterns
+
+### Weak Crypto Exploitation
+- **Hash Collisions**: MD5 collision attacks for certificate forgery
+- **Rainbow Tables**: Unsalted hashes vulnerable to precomputation
+- **Timing Attacks**: Non-constant-time string comparison for tokens
+- **Padding Oracle**: CBC padding oracle attacks
+- **Key Recovery**: Brute-force weak keys, default credentials
+
+### Implementation Flaws
+- **ECB Mode**: Patterns visible in encrypted data
+- **IV Reuse**: Same IV used multiple times with same key
+- **Short Keys**: Keys shorter than 128 bits
+- **Predictable Nonces**: Nonce reuse in stream ciphers
+
+## Chain Opportunities
+
+### Crypto Vulnerabilities Enable
+- **Credential Theft**: Cracking weak password hashes
+- **Session Hijacking**: Predicting session tokens from weak RNG
+- **Data Decryption**: Breaking weak encryption schemes
+- **Certificate Forgery**: MD5 collision for fake certificates
+- **Authentication Bypass**: Timing attacks on token comparison
+
+### Priority Indicators
+- **Critical**: Hardcoded encryption keys, weak RNG for tokens/passwords
+- **High**: MD5/SHA1 for passwords, ECB mode encryption, InsecureSkipVerify
+- **Medium**: Missing rate limiting on auth, weak password policies
+- **Low**: Outdated TLS versions (1.0/1.1), missing HSTS headers

prompts/hunt/crypto.md

@@ -0,0 +1,82 @@
+# Insecure Deserialization/Configuration Vulnerability Hunt Guide
+
+## Dangerous API Patterns by Language
+
+### C/C++
+- **Serialization**: `memcpy()` from network/buffer without validation
+- **Struct Parsing**: `read(fd, &struct, sizeof(struct))` from untrusted source
+- **Pickles**: Custom binary format parsing without schema validation
+- **Memory**: Deserializing into fixed-size buffers
+
+### Python
+- **Pickle**: `pickle.loads(user_input)`, `pickle.load(file)`
+- **YAML**: `yaml.load(user_input)` without `SafeLoader`
+- **Marshal**: `marshal.loads(user_input)`
+- **Shelve**: `shelve.open()` with untrusted data
+- **JSON**: `json.loads()` with custom `object_hook` executing code
+
+### Java
+- **Serialization**: `ObjectInputStream.readObject()` from untrusted source
+- **XStream**: `xstream.fromXML(user_input)` without type allowlist
+- **Jackson**: `ObjectMapper.readValue()` with polymorphic types enabled
+- **YAML**: `new Yaml().load(user_input)` without safe constructor
+- **JSON**: `JSONObject.parse(user_input)` with gadget classes
+
+### Go
+- **Gob**: `gob.NewDecoder(reader).Decode(&struct)` with untrusted data
+- **JSON**: `json.Unmarshal()` with `interface{}` leading to type confusion
+- **Marshal**: Custom marshaling without validation
+- **Protobuf**: `proto.Unmarshal()` with unexpected fields
+
+### JavaScript/Node.js
+- **JSON**: `JSON.parse(user_input)` with `__proto__` pollution
+- **Serialize-JS**: `serialize-javascript` without strict mode
+- **YAML**: `yaml.parse(user_input)` without safe options
+- **MessagePack**: `msgpack.decode(user_input)` without schema validation
+
+## Known False-Positive Signatures
+
+### Safe Patterns (DO NOT REPORT)
+- **Safe Loaders**: `yaml.safe_load()`, `yaml.load(..., SafeLoader)`
+- **Type Allowlists**: `XStream.allowTypesByWildcard(["com.example.safe.*"])`
+- **Schema Validation**: JSON Schema validation before parsing
+- **Immutable Types**: Deserializing only to immutable data structures
+- **JSON Only**: Using JSON instead of binary serialization formats
+
+## Bypass Detection Patterns
+
+### Deserialization Attacks
+- **Gadget Chains**: Known exploit chains (Apache Commons, Java Serialization)
+- **Type Confusion**: Casting to unexpected types after deserialization
+- **Prototype Pollution**: `{"__proto__": {"admin": true}}`
+- **Polymorphic Abuse**: Deserializing to unexpected subclasses
+- **Metadata Manipulation**: Modifying version/length fields
+
+### Configuration Issues
+- **Hardcoded Secrets**: `SECRET_KEY = "abc123"` in config files
+- **Debug Mode**: `DEBUG = True` in production
+- **Weak CORS**: `Access-Control-Allow-Origin: *` on sensitive endpoints
+- **Excessive Permissions**: `chmod 777`, running as root
+- **Insecure Defaults**: SSL verification disabled, weak ciphers
+
+## Chain Opportunities
+
+### Deserialization Enables
+- **Remote Code Execution**: Gadget chains leading to `Runtime.exec()`
+- **Authentication Bypass**: Deserializing admin session objects
+- **Privilege Escalation**: Modifying serialized permission objects
+- **Data Tampering**: Altering serialized business logic state
+- **Information Disclosure**: Deserializing sensitive configuration
+
+### Config Vulnerabilities Enable
+- **Credential Theft**: Hardcoded API keys, database passwords
+- **Reconnaissance**: Debug endpoints exposing internal state
+- **Bypass**: CORS allowing cross-origin attacks
+- **DoS**: Unbounded resource allocation from config
+- **Lateral Movement**: Internal network settings exposed
+
+### Priority Indicators
+- **Critical**: `pickle.loads()`, `readObject()` from HTTP input, RCE gadget chains
+- **High**: YAML unsafe load, hardcoded secrets in repo, debug mode in production
+- **Medium**: Prototype pollution potential, weak configuration defaults
+- **Low**: Info disclosure in config, missing security headers

prompts/hunt/deserialization.md

@@ -0,0 +1,73 @@
+# Injection Vulnerability Hunt Guide
+
+## Dangerous API Patterns by Language
+
+### C/C++
+- **Command Injection**: `system()`, `popen()`, `exec*()`, `spawn*()` with user input
+- **SQL**: Direct string concatenation into SQL queries (rare in C, more common in embedded)
+- **Format String**: `printf(user_input)`, `sprintf(buf, user_controlled_format)`
+- **LDAP**: Custom implementations using string building for LDAP filters
+
+### Python
+- **SQL**: `"SELECT * FROM users WHERE id=" + user_id`, `cursor.execute(f"SELECT * FROM {table}")`
+- **Command**: `os.system("ping " + ip)`, `subprocess.call("ls " + path, shell=True)`
+- **SSTI**: `render_template_string(user_input)`, `format(user_input)`
+- **Code Execution**: `eval(user_input)`, `exec(user_input)`, `compile()`
+
+### Java
+- **SQL**: `Statement.executeQuery("SELECT * FROM users WHERE id=" + id)`
+- **Command**: `Runtime.getRuntime().exec("ping " + host)`, `ProcessBuilder` with user input
+- **LDAP**: `context.search(filter)` with unsanitized filter strings
+- **XXE**: `DocumentBuilder.parse()` with external entity resolution enabled
+
+### Go
+- **SQL**: `db.Query("SELECT * FROM users WHERE id=" + id)`, `fmt.Sprintf(query, user_input)`
+- **Command**: `exec.Command("sh", "-c", "ping "+host)`
+- **Template Injection**: `template.HTML(user_input)`, `tmpl.ExecuteTemplate()` with user templates
+
+### JavaScript/Node.js
+- **SQL**: `query("SELECT * FROM users WHERE id=" + id)`
+- **NoSQL**: `find({$where: "this.name == " + user_input})`
+- **Command**: `exec("ping " + host)`, `spawn("sh", ["-c", cmd])`
+- **Prototype Pollution**: `Object.assign(target, user_input)`
+
+## Known False-Positive Signatures
+
+### Safe Patterns (DO NOT REPORT)
+- **Parameterized Queries**: `cursor.execute("SELECT * FROM users WHERE id=?", (user_id,))`
+- **Prepared Statements**: `PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id=?")`
+- **ORM Methods**: `User.objects.get(id=user_id)`, `db.users.find({id: userId})`
+- **Escaping Functions**: `mysql_real_escape_string()`, `pg_escape_literal()`
+- **Whitelist Validation**: Input validated against known-good patterns before use
+
+## Bypass Detection Patterns
+
+### Encoding Tricks
+- URL encoding: `%27` for `'`, `%22` for `"`
+- Double encoding: `%2527` → `%27` → `'`
+- Unicode encoding: `\u0027` for `'`
+- Hex encoding: `0x27` for `'`
+
+### Comment Injection
+- SQL comments: `--`, `#`, `/* */`
+- Null bytes: `%00`, `\0` in path traversal
+- Line breaks: `%0a`, `%0d` to bypass filters
+
+### Concatenation Attacks
+- String concatenation to evade filters: `' OR '1'='1`
+- Type confusion: `1 OR 1=1` in numeric context
+
+## Chain Opportunities
+
+### Injection Enables
+- **Authentication Bypass**: SQLi can bypass login forms
+- **Command Execution**: SQLi with `xp_cmdshell` (SQL Server) or `INTO OUTFILE` (MySQL)
+- **XSS**: Stored XSS via database injection
+- **Path Traversal**: Command injection can read arbitrary files
+- **SSRF**: Command injection can make internal network requests
+
+### Priority Indicators
+- **Critical**: Database credentials in connection strings, admin panel access
+- **High**: User input directly in system commands, authentication queries
+- **Medium**: Read-only database queries, non-critical command output
+- **Low**: Logged-only user input, debug endpoints