make tool more stable and powerful

[Chintanpatel24]

Description

This update improves tool stability, expands scanning capabilities, and refreshes data dictionaries with more realistic login/auth fields (including admin and role/state-related keys).

Main Changes

1. Core Runtime and CLI Reliability

• Improved URL handling by normalizing targets that do not include a scheme.
• Added safer request behavior with timeout support.
• Added better mode handling: if no scan mode is selected, help output is shown.
• Selenium now starts only when required by selected modes.
• Added safer driver lifecycle with guaranteed cleanup.

2. New Feature Options

• Added passive SQL detection mode with --sql-detect.
• Added JSON report export with --report <path>.
• Added structured result aggregation for scan outputs.

3. SQL Injection Engine Improvements

• Fixed selector lookup behavior to search by multiple strategies (XPath, name, id, placeholder).
• Added robust element deduplication for form inputs.
• Added support for custom SQL payload wordlists.
• Added payload queue/tested tracking in results.
• Added SQL error pattern detection during injection attempts.

4. XSS and Subdomain Scan Improvements

• XSS modes now return structured stats (tested, reflected, alerts).
• Improved handling of missing payload files.
• Subdomain scan now returns discovered endpoints for reporting.

5. CSRF Request Replay Hardening

• Improved HTTP request-line parsing safety.
• Added better relative URL resolution.
• Improved JSON body parsing for content-types with charset.

6. Data Dictionary Refresh (Realistic States)

Updated scanner data files with broader real-world field names and state keys, including:

• Admin/privileged variants: admin, administrator, owner, operator, superuser, root
• Role/state variants: role, userRole, accountType, accountStatus, state, status, isAdmin, is_admin, permissions, scope

Updated files:

• data/EmailSelectors.txt
• data/PassSelectors.txt
• data/InputSelectors.txt
• data/values.txt

7. Documentation and Project Metadata

• Updated feature status in README upcoming features:
  • SQL Detections: done
  • Reports: done
  • Custom Wordlists: done
• Added CLI usage examples for new and existing modes.
• Removed invalid stdlib dependency entry (datetime) from requirements.

Files Updated

• main.py
• modules/scans.py
• modules/bireq.py
• README.md
• requirements.txt
• data/EmailSelectors.txt
• data/PassSelectors.txt
• data/InputSelectors.txt
• data/values.txt

Outcome

The tool is more stable under different targets, supports richer detection/report flows, and uses more realistic/auth-centric test keys for better practical coverage.

[Copilot]

Pull request overview

This PR improves the scanner’s runtime stability and output structure by adding safer URL/request handling, introducing passive SQL error detection and JSON reporting, and refreshing selector/value dictionaries for more realistic auth/login fields.

Changes:

• Add --sql-detect passive SQL error probing and structured result aggregation across modes.
• Add --report <path> to export a JSON scan summary and improve driver lifecycle (start only when needed, guaranteed cleanup).
• Refresh selector/value dictionaries (email/password/input keys) and update README CLI usage/examples.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
README.md	Updates formatting and adds CLI mode examples (including --sql-detect and --report).
main.py	Adds URL normalization, report writing, mode gating, and safer Selenium driver lifecycle.
modules/scans.py	Refactors SQLi/XSS/subdomain scanning for structured results; adds passive SQL error detection.
modules/bireq.py	Hardens CSRF request replay parsing (safer request-line parsing, urljoin, JSON content-type handling).
data/values.txt	Expands keys searched/edited during CSRF replay to more realistic auth/state fields.
data/PassSelectors.txt	Refreshes/expands password selectors (including common variants and XPath attribute matches).
data/InputSelectors.txt	Expands generic input selectors beyond input to include auth/session/role keys.
data/EmailSelectors.txt	Refreshes/expands login/email/identifier selectors, including admin/role-related variants.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.