F --> G1[Passive scanners]
F --> G2[Active scanners]

I[template-tool] --> H[CVE templates]
H --> G2

G1 --> J[Findings]
G2 --> J
J --> K[Reporter]
K --> L[Auto Reports]
K --> M[CI/CD Controls]

## Why ApiHunter?

### Core Advantages

- **API-First Architecture**: Purpose-built for REST/GraphQL APIs, not adapted from web app scanners
- **Intelligent False Positive Reduction**: 
  - SPA catch-all detection with canary probing
  - Context-aware secret validation (frontend vs backend)
  - Body content validation and referer checking
  - Response fingerprinting to skip duplicate findings
- **Production-Safe by Design**:
  - Adaptive concurrency (AIMD) that backs off on errors
  - Per-host rate limiting with configurable delays
  - Politeness controls (retries, timeouts, WAF evasion)
  - Dry-run mode for active checks
- **Stealth & Evasion**:
  - Runtime User-Agent rotation from curated pool (assets/user_agents.txt)
  - Randomized request delays with jitter
  - Per-host delay enforcement (avoids burst patterns)
  - Retry logic with exponential backoff
  - Custom header injection for blending with legitimate traffic
  - Adaptive timing based on server responses
  - No hardcoded scanner fingerprints in default mode

### Stealth Techniques Deep Dive

ApiHunter uses several stealth techniques to avoid detection by WAF (Web Application Firewall) and bot protection systems:

#### 1. User-Agent Rotation
**What it does:** Randomly cycles through 100+ real browser User-Agent strings from a file (`assets/user_agents.txt`)

**Why it works:** Bots typically use the same User-Agent (like `curl/7.68.0`). By pretending to be Chrome, Firefox, Safari, etc., you blend in with legitimate traffic

**Simple analogy:** Like wearing different disguises instead of always wearing the same uniform

#### 2. Random Timing & Jitter
**What it does:** Adds random delays between requests (controlled by `--delay-ms`) with jitter (small random variations)

**Why it works:** Bots send requests at perfect intervals (exactly 100ms apart). Humans are unpredictable. Random timing makes traffic look organic

**Simple analogy:** Walking with irregular steps instead of marching like a robot

#### 3. Per-Host Delay Enforcement
**What it does:** Tracks delay separately for each domain, not globally

**Why it works:** Prevents burst patterns where you hit one host 50 times instantly. Each host sees polite, spaced-out requests

**Simple analogy:** Taking turns in different conversations instead of shouting at one person repeatedly

#### 4. Adaptive Concurrency (AIMD)
**What it does:** Automatically slows down when getting 429 (rate limit) or 503 (server busy) errors, speeds up when successful

**Why it works:** Backs off when caught, mimics how browsers retry. WAFs see "this client respects our limits"

**Simple analogy:** Slowing down when traffic is congested, speeding up on open roads

#### 5. Retry with Exponential Backoff
**What it does:** When a request fails, waits 1s, then 2s, then 4s before retrying

**Why it works:** Legitimate clients retry gracefully. Bots often hammer immediately or give up

**Simple analogy:** Knocking on a door, waiting longer each time instead of banging continuously

#### 6. No Scanner Fingerprints
**What it does:** Doesn't send headers like `X-Scanner: ApiHunter` or predictable patterns

**Why it works:** Many tools leave signatures (Nuclei templates, sqlmap patterns). ApiHunter avoids obvious markers

**Simple analogy:** Not wearing a name tag that says "Security Tester"

#### 7. Connection Reuse & Pooling
**What it does:** Uses per-host HTTP client pools, keeps connections alive

**Why it works:** Browsers reuse connections. Opening/closing for every request looks suspicious

**Simple analogy:** Keeping the door open instead of slamming it shut and ringing the bell again

#### 8. Custom Header Injection
**What it does:** Can add headers like `Referer`, `X-Forwarded-For`, custom cookies

**Why it works:** Makes requests look like they came from a legitimate application flow (clicked a link, have session cookies)

**Simple analogy:** Showing a ticket stub when entering a venue instead of jumping the fence

#### Detection Comparison

| Technique | Without Evasion | With Evasion |
|-----------|----------------|-------------|
| **User-Agent** | `python-requests/2.28.0` (obvious bot) | `Mozilla/5.0 (Windows NT 10.0; Win64; x64)...` (looks like Chrome) |
| **Timing** | Perfect 100ms intervals → WAF blocks | 120ms, 95ms, 180ms → looks human |
| **Retries** | Instant retry → ban | Wait 1s→2s→4s → "patient client" |
| **Concurrency** | 100 parallel hits → alarm | Adaptive 5→10→3 based on response → "polite browser" |

#### When to use `--waf-evasion`

- Testing production APIs with Cloudflare/Akamai/AWS WAF
- Avoiding IP bans during large scans
- Penetration tests where you need to stay under the radar

- **CI/CD Native**:
  - Baseline diffing (only report new findings)
  - Streaming NDJSON output for real-time monitoring
  - SARIF 2.1.0 for GitHub/GitLab Code Scanning
  - Exit code bitmask for pipeline control
  - Severity-based filtering and failure thresholds
- **Performance at Scale**:
  - Rust async runtime (tokio) with zero-cost abstractions
  - Concurrent scanning with semaphore-bounded parallelism
  - Per-host HTTP client pools to avoid connection bottlenecks
  - Efficient memory usage (no GC pauses)
- **Comprehensive Auth Support**:
  - JSON-based auth flows with cookie/header extraction
  - Dual-identity IDOR/BOLA testing
  - Session file import (Excalibur integration)
  - Bearer, Basic, and custom header auth
  - Automatic unauth client for privilege escalation checks

## Scanner Modules

ApiHunter includes 13 built-in scanner modules. See [docs/scanners.md](https://github.com/teycir/apihunter/blob/HEAD/docs/scanners.md) for detailed detection logic.

| Scanner | Type | What It Detects |
|---------|------|----------------|
| **CORS** | Passive | Wildcard origins, reflected origins with credentials, null origin acceptance, regex bypass vulnerabilities (suffix/prefix attacks), missing Vary: Origin, unsafe preflight methods |
| **CSP** | Passive | Missing Content-Security-Policy, unsafe-inline/unsafe-eval directives, wildcard sources, bypassable CDN hosts (JSONP gadgets), missing frame-ancestors |
| **GraphQL** | Passive | Introspection enabled, sensitive schema fields (user/password/token types), field suggestions (schema leakage), query batching, alias amplification (DoS), GraphiQL/Playground exposure |
| **JWT** | Passive | alg=none tokens, weak HS256 secrets (wordlist-based), missing/excessive expiry, sensitive claims in payload, algorithm confusion vulnerabilities |
| **OpenAPI** | Passive | Missing security schemes, operations without auth requirements, file upload endpoints, deprecated operations still present, unsecured sensitive endpoints |
| **API Versioning** | Passive | Version header disclosure, concurrent legacy/new API versions, deprecation headers, and response drift across benign query/version variants (plus deep mode via `--response-diff-deep`) |
| **gRPC/Protobuf** | Passive + Active | gRPC transport/content-type signals, protobuf surface hints, and optional reflection/health probe signals |
| **API Security** | Passive + Active | Missing security headers (X-Content-Type-Options, X-Frame-Options), server version disclosure, unauthenticated access to sensitive paths, HTTP method enumeration, debug endpoints, secret exposure patterns, active IDOR/BOLA checks (body + selected header comparison), blind SSRF callback probes, and gateway/bypass probe signals |
| **Mass Assignment** | Active | Reflected sensitive fields (is_admin, role, permissions), persisted state changes, privilege escalation via field injection |
| **OAuth/OIDC** | Active | Redirect URI validation bypass, missing state parameter, PKCE support issues (missing S256, plain allowed), implicit flow enabled, password grant enabled |
| **Rate Limit** | Active | Missing rate limiting (burst probes), missing Retry-After headers, IP header spoofing bypass (X-Forwarded-For) |
| **WebSocket** | Active | WebSocket upgrade acceptance on common paths, missing origin validation, unauthenticated WebSocket connections |
| **CVE Templates** | Active | Template-driven CVE detection from `assets/cve_templates/*.toml` (168 templates currently), baseline vs bypass differential matching |

**Passive scanners** run by default and analyze responses without sending crafted requests.  
**Active scanners/checks** require `--active-checks` and send potentially invasive probes (IDOR/BOLA, mutation, bypass tests).  
IDOR/BOLA lives under the `API Security` scanner (there is no dedicated `--no-idor` flag; use `--no-api-security` to disable it).

### Module Output & Signal Notes

These notes summarize how findings are emitted and what typically causes noise:

| Module | Finding Prefix / Shape | Common False Positives | Common False Negatives |
|---------|-------------------------|-------------------------|-------------------------|
| CORS | `cors/*` with origin/evidence fields | Reflection on non-sensitive routes | Origin checks applied only on authenticated routes |
| CSP | `csp/*` with directive evidence | Legacy CSP applied intentionally during migration | CSP delivered only on production CDN edge path |
| GraphQL | `graphql/*` with endpoint + capability signal | Public playground intended for internal/testing tenants | Schema controls enabled only after auth |
| JWT | `jwt/*` with token claim/header evidence | Test/demo tokens in synthetic responses | Token never appears in scanned responses |
| OpenAPI | `openapi/*` with operation/security context | Spec intentionally includes deprecated but blocked endpoints | Spec unavailable or split across private docs |
| API Versioning | `api_versioning/*` + `response_diff/*` | Multiple supported versions during controlled migrations | Versioned paths not discoverable from current seed set |
| gRPC/Protobuf | `grpc_protobuf/*` with transport/reflection evidence | gRPC-like metadata on edge proxies without exposed RPC surface | gRPC endpoints behind separate host/path not reached from seed set |
| API Security | `api_security/*` with header/path/method evidence | Debug/test endpoints intentionally exposed in non-prod | Controls enforced behind auth/session context |
| Mass Assignment | `mass_assignment/*` with reflected/persisted deltas | Echo behavior that does not persist backend state | Mutations rejected by hidden validation rules |
| OAuth/OIDC | `oauth/*` with redirect/metadata evidence | Non-production IdP config with relaxed policies | Dynamic policy enforcement not visible in metadata |
| Rate Limit | `rate_limit/*` with burst/429 behavior | Global traffic shaping masks app-level limiter behavior | Long-window limiters not triggered by short probe window |
| WebSocket | `websocket/*` with upgrade/origin checks | Public WS endpoints intentionally anonymous | Auth required via handshake headers not provided in probe |
| CVE Templates | `cve/<id>/<check>` with template evidence | Fingerprint collision on generic endpoints | Vulnerable path/context not reached from seed URLs |

For check-by-check detail and remediation guidance, see [docs/scanners.md](https://github.com/teycir/apihunter/blob/HEAD/docs/scanners.md) and [docs/findings.md](https://github.com/teycir/apihunter/blob/HEAD/docs/findings.md).
The scanner docs now include a source-aligned [Module Check Catalog](https://github.com/teycir/apihunter/blob/HEAD/docs/scanners.md#module-check-catalog) and [False-Positive Expectation Model](https://github.com/teycir/apihunter/blob/HEAD/docs/scanners.md#false-positive-expectation-model).

## Features

### Passive Security Analysis
- **CORS Misconfiguration Detection**:
  - Dynamic origin generation based on target domain
  - Regex bypass testing (suffix/prefix attacks)
  - Credential-aware severity scoring
  - Wildcard and null origin detection
- **CSP Policy Analysis**:
  - Missing/weak Content Security Policy detection
  - Unsafe inline/eval directives
  - Wildcard source detection
  - Policy bypass patterns
- **GraphQL Security**:
  - Introspection query detection
  - Sensitive type/field name analysis
  - Query batching support detection
  - Alias amplification (DoS) probing
  - Active mutation fuzzing (`--active-checks`, supports `--dry-run`)
  - GraphiQL/Playground exposure
- **JWT Token Analysis**:
  - Algorithm confusion (alg=none, HS256→RS256)
  - Weak secret detection (curated wordlist)
  - Long-lived token detection (missing/excessive exp)
  - Sensitive claim exposure
  - Token extraction from headers and cookies
- **OpenAPI/Swagger Analysis**:
  - Security scheme validation
  - File upload endpoint detection
  - Deprecated operation flagging
  - Missing security definitions
  - Spec caching for performance
- **gRPC/Protobuf Coverage**:
  - gRPC response metadata/content-type detection
  - Protobuf surface hint detection from endpoint metadata/path shape
  - Optional reflection/health active probe signals on known gRPC paths
- **Secret Exposure Detection**:
  - AWS keys (AKIA*, secret keys)
  - Google API keys (AIza*)
  - GitHub tokens (ghp_*, github_pat_*)
  - Slack tokens (xox*)
  - Stripe keys (sk_live_*, pk_live_*)
  - Database URLs, private keys, bearer tokens
  - Context-aware validation (reduces false positives)
- **API Security Checks**:
  - HTTP method enumeration
  - Debug endpoint detection
  - Directory listing exposure
  - Security.txt presence
  - Response header analysis (HSTS, X-Frame-Options, etc.)
  - Error message disclosure

### Active Security Testing (--active-checks)
- **API Security IDOR/BOLA Checks** (3-tier approach):
  - Unauthenticated access testing
  - Response comparison via body fingerprints plus stable header snapshots
  - ID enumeration (±2 range walk)
  - Cross-user authorization bypass (dual-identity)
  - Blind SSRF callback probing via callback-style query params (`APIHUNTER_OAST_BASE`, supports `--dry-run`)
  - Gateway fingerprint and bypass probing (`api_security/gateway-*`)
- **Mass Assignment Vulnerabilities**:
  - Reflected sensitive field injection
  - Persisted state change detection
  - Baseline→Mutate→Confirm verification
  - Privilege escalation via field injection
- **OAuth/OIDC Security**:
  - Redirect URI validation bypass
  - State parameter handling
  - PKCE support detection
  - Metadata configuration hardening
  - Implicit flow and password grant detection
- **Rate Limiting**:
  - Burst request probing
  - Missing rate limit detection
  - Retry-After header validation
  - IP header spoofing bypass tests
- **WebSocket Security**:
  - Upgrade acceptance on common paths
  - Origin validation testing
  - Missing authentication checks
- **CVE Template Engine**:
  - TOML-based template catalog
  - Nuclei YAML import support
  - Baseline vs bypass differential matching
  - Host+template deduplication
  - Loader quality gates skip invalid/unsafe request templates (for example unresolved request placeholders)
  - Segment-aware context matching reduces broad path-substring over-triggering
  - Current local catalog: 168 templates (includes curated hardened checks such as CVE-2022-22947, CVE-2021-29442, CVE-2021-29441, CVE-2020-13945, CVE-2021-45232, CVE-2022-24288)

### Discovery & Enumeration
- **Endpoint Discovery**:
  - robots.txt parsing
  - sitemap.xml parsing
  - OpenAPI/Swagger spec import
  - HAR file import (Excalibur integration)
  - Postman/Insomnia collection import (`--collection`)
  - JavaScript endpoint extraction
  - Same-host filtering
- **URL Accessibility Pre-filtering**:
  - Fast pre-check to skip dead endpoints
  - Configurable timeout
  - Optional bypass with --no-filter

### Performance & Reliability
- **Adaptive Concurrency (AIMD)**:
  - Automatic rate adjustment based on errors
  - Additive increase (every 5s)
  - Multiplicative decrease on 429/503/timeouts
- **Stealth & WAF Evasion**:
  - User-Agent rotation from runtime pool (assets/user_agents.txt with 100+ real UAs)
  - Embedded fallback UAs if file unavailable
  - Random delay jitter to avoid detection patterns
  - Per-host timing enforcement (not global)
  - Retry logic with exponential backoff
  - Custom header injection (X-Forwarded-For, Referer, etc.)
  - Adaptive timing based on 429/503 responses
  - Politeness mode for cooperative testing
  - No scanner fingerprints in User-Agent or headers by default
- **Resource Management**:
  - Semaphore-bounded parallelism
  - Per-host HTTP client pools
  - Connection reuse and pooling
  - Configurable timeouts and retries
- **Error Handling**:
  - Panic recovery via JoinSet
  - Captured errors reported separately
  - Graceful degradation on scanner failures

### Output & Reporting
- **Multiple Output Formats**:
  - Pretty JSON (human-readable)
  - NDJSON (streaming, parseable)
  - SARIF 2.1.0 (GitHub/GitLab Code Scanning)
- **Baseline Diffing**:
  - Generate baseline snapshots
  - Compare scans to report only new findings
  - Perfect for regression testing
- **Auto-Save Reports** (enabled by default, disable with `--no-auto-report`):
  - Saved to ~/Documents/ApiHunterReports/<timestamp>/
  - findings.json (structured findings)
  - summary.md (markdown report)
  - scan.log (execution log)
- **Real-Time Streaming**:
  - Stream findings as they're discovered
  - NDJSON format for live parsing
  - Progress tracking
- **Severity Filtering**:
  - Filter by minimum severity (info/low/medium/high/critical)
  - Fail-on threshold for CI/CD
  - Exit code bitmask (0x01 findings, 0x02 errors)

### Integration & Extensibility
- **Pluggable Scanner Architecture**:
  - Implement Scanner trait to add modules
  - Async-first design
  - Independent scanner execution
  - Panic isolation per scanner
- **TOML-Based Extensibility**:
  - CVE template catalog in assets/cve_templates/*.toml
  - No code changes needed to add new checks
  - Template-driven vulnerability detection
  - Community-shareable template format
- **Nuclei Template Import**:
  - template-tool binary for YAML → TOML conversion
  - Automatic matcher translation (status, word, regex, dsl)
  - Safe preflight request-chain extraction
  - Preserves detection logic from upstream templates
- **Dual Extension Model**:
  - **Code-based**: Write Rust scanners implementing Scanner trait for complex logic
  - **Template-based**: Write TOML templates for signature-based checks (CVEs, misconfigs)
  - Best of both worlds: performance + flexibility
- **Complementary Tools**:
  - Excalibur browser extension (HAR capture)
  - BurpAPIsecuritysuite (manual testing)
  - Workflow: Capture → Automate → Deep test

### Configuration & Control
- **Flexible Input**:
  - File-based URL lists
  - stdin (pipe from other tools)
  - HAR file import
  - Postman/Insomnia collection import
  - OpenAPI spec import
- **Granular Scanner Control**:
  - Enable/disable individual scanners
  - Active vs passive mode
  - Dry-run for active checks
  - Per-scanner configuration
- **Network Configuration**:
  - HTTP/HTTPS proxy support
  - TLS certificate validation control
  - Custom headers and cookies
  - Configurable timeouts and retries
- **Scan Profiles**:
  - quickscan.sh (fast, low-impact)
  - deepscan.sh (comprehensive, active checks)
  - inaccessiblescan.sh (re-check previously inaccessible targets with slower settings)
  - baselinescan.sh (generate baseline)
  - diffscan.sh (compare against baseline)
  - authscan.sh (authenticated scanning)
  - sarifscan.sh (CI/CD integration)
  - scan-and-report.sh (run scan + print latest report path)
  - split-by-host.sh (split targets by host and optionally fan out scans)

## Comparison with Other Tools| 機能 | ApiHunter | Nuclei | ZAP | Burp Suite | ffuf |
|---------|-----------|--------|-----|------------|------|
| **言語** | Rust | Go | Java | Java | Go |
| **パフォーマンス** | ⚡⚡⚡ 非同期、適応型並行処理 | ⚡⚡ 高速並列処理 | ⚡ 中程度 | ⚡ 中程度 | ⚡⚡⚡ 非常に高速 |
| **APIファースト設計** | ✅ API向けに設計 | ❌ 一般的なWeb | ⚠️ ハイブリッド | ⚠️ ハイブリッド | ❌ ファジングに特化 |
| **誤検知フィルタリング** | ✅ SPA検出、ボディ検証、リファラーチェック | ⚠️ テンプレート依存 | ⚠️ FPが多い | ✅ 良好 | 該当なし |
| **CORS/CSP分析** | ✅ 高度なポリシー解析 | ⚠️ 基本的なテンプレート | ✅ 良好 | ✅ 良好 | ❌ |
| **GraphQLイントロスペクション** | ✅ スキーマ露出と機密フィールドの検査 | ⚠️ 基本的な検出 | ⚠️ 限定 | ✅ 拡張機能経由 | ❌ |
| **OpenAPI/Swagger** | ✅ セキュリティスキーム分析 | ❌ | ✅ インポートのみ | ✅ インポート＋スキャン | ❌ |
| **JWT分析** | ✅ alg=none、脆弱なシークレット、有効期限 | ⚠️ テンプレート経由 | ⚠️ 限定 | ✅ 拡張機能経由 | ❌ |
| **IDOR/BOLA検出** | ✅ 3段階 (未認証/範囲/クロスユーザー) | ⚠️ 手動テンプレート | ⚠️ 限定 | ✅ 手動テスト | ❌ |
| **シークレット検出** | ✅ コンテキスト認識 (フロントエンド vs バックエンド) | ⚠️ 正規表現ベース | ⚠️ 基本 | ⚠️ 基本 | ❌ |
| **アクティブチェック** | ✅ オプトイン (IDOR, mass-assignment, OAuth/OIDC, websocket, レート制限, CVEテンプレート) | ✅ テンプレートベース | ✅ アクティブスキャン | ✅ アクティブスキャン | ✅ ファジング |
| **WAF回避** | ✅ UAローテーション、遅延、リトライ、適応型タイミング | ⚠️ 基本 | ⚠️ 限定 | ✅ 良好 | ⚠️ 基本 |
| **CI/CD統合** | ✅ NDJSON、SARIF、終了コード | ✅ JSON、SARIF | ⚠️ XMLレポート | ⚠️ XML/JSON | ✅ JSON |
| **ベースライン差分比較** | ✅ 組み込み | ❌ 外部ツール | ❌ | ❌ | ❌ |
| **認証フロー** | ✅ JSONベースの事前スキャンログイン | ⚠️ ヘッダーインジェクション | ✅ セッション管理 | ✅ セッション管理 | ⚠️ ヘッダーインジェクション |
| **ストリーミング出力** | ✅ リアルタイムNDJSON | ❌ バッチのみ | ❌ | ❌ | ✅ |
| **リソース使用量** | 🟢 低 (Rust) | 🟢 低 (Go) | 🟡 高 (Java) | 🟡 高 (Java) | 🟢 低 (Go) |
| **学習曲線** | 🟢 シンプルなCLI | 🟢 テンプレート構文 | 🟡 GUIの複雑さ | 🔴 急峻 | 🟢 シンプル |
| **拡張性** | ✅ Rustのトレイトシステム | ✅ YAMLテンプレート | ✅ アドオン | ✅ 拡張機能 | ⚠️ 限定 |
| **ライセンス** | MIT (無料) | MIT (無料) | Apache 2.0 (無料) | 商用 | MIT (無料) |
| **最適な用途** | CI/CDでのAPIセキュリティ、リグレッションテスト、CORS/GraphQL/JWT分析 | 一般的な脆弱性スキャン、CVE検出 | 本格的なWebアプリケーションペネトレーションテスト | 手動ペネトレーションテスト、複雑なワークフロー | ディレクトリ/パラメータファジング |

### 主な差別化要因

**ApiHunter:** APIファースト設計、SPA検出、ベースライン差分、3段階IDOR/BOLA、コンテキスト認識のシークレット検出、AIMD並行処理、**ステルス/WAF回避 (UAローテーション、ジッター、適応型タイミング)**、**二重拡張性 (TOMLテンプレート + Rustモジュール)**  
**Nuclei:** より広範なCVEカバレッジ、YAMLテンプレートのみ、基本的な回避  
**ZAP/Burp:** 手動テスト、プロキシワークフロー、GUIベースの拡張機能、限定的なステルス  
**ffuf:** 純粋なファジング、コンテンツディスカバリー、限定的な拡張性、基本的な回避

## クイックスタート```bash
cargo build --release

# Scan URLs from a file (newline-delimited)
./target/release/apihunter --urls ./targets/cve-regression-real-public.txt --format ndjson --output ./results.ndjson

# Or scan URLs from stdin
cat ./targets/cve-regression-real-public.txt | ./target/release/apihunter --stdin --min-severity medium

デスクトップスキャン入力では以下をサポートしています：
- 手動のマルチターゲット入力（1行に1URL、またはカンマ区切り）
- `Load CSV` によるCSVインポート（最大307,200バイト / 300 KiB）
- ガイド付きスキャンプリセット：`Quick Passive` と `Deep Active`
- ハードリミット：1回の実行につき最大3,000ターゲット（重複排除済み、絶対 `http/https` URLとして検証済み）
- スコープ制御：ディスカバリのオン/オフ、到達可能性フィルタリング＋タイムアウト、サイトごとの最大エンドポイント数
- APIバージョニング制御：詳細なレスポンス差分プロービングのオプショントグル
- 詳細制御：プロキシ、ヘッダー、クッキー、Bearer/Basic認証、TLS無効証明書トグル
- アクティブチェック用のBlind SSRFコールバック相関入力（`OAST callback base`）
- パフォーマンス制御：ホストごとのクライアント、適応型同時実行数、カスタムユーザーエージェントプールによるWAF回避
- `API Versioning` と `gRPC/Protobuf` を含むスキャナートグルの完全カバレッジ
- 右揃えキャレット付きの折りたたみ可能なスキャンセクション。`Safety and Scan Behavior`、`Runtime Limits`、`Scanner toggles` はデフォルトで折りたたまれています
- ターゲットごとの完了状況・検出結果スナップショットを表示する並列実行プログレスカード
- 結果分析ダッシュボード：深刻度ヒートマップ、最悪ターゲットカード、スキャン効率、スキャナーカバレッジ、上位の脆弱性パス、チェック深刻度の内訳
- セッション永続化：次回起動時に最後のスキャン結果を自動復元
- Enrich Modeパネル：検出結果NDJSONの読み込み、脅威インテリジェンスエンリッチメントの実行、高スコアホストをDeep Activeプリセット付きFull Scanに直接プロモート
- エクスポートUX：サイズラベル＋`Save All Reports`＋実行ごとのタイムスタンプ付きファイル名。エクスポートには、ターゲットごとのJSONバンドル、NDJSON、SARIF、Insomniaコレクション、Insomnia Runnerデータが含まれます

詳細な使用方法は[HOWTO.md](https://github.com/teycir/apihunter/blob/HEAD/HOWTO.md)、VulhubベースのCVE検証ラボは[docs/lab-setup.md](https://github.com/teycir/apihunter/blob/HEAD/docs/lab-setup.md)、内部構造は[docs/](https://github.com/teycir/apihunter/blob/HEAD/docs/)を参照してください。

リリース版デスクトップバイナリが必要な場合：```bash
cd apps/desktop
npm run tauri build
./src-tauri/target/release/apihunter-desktop

注: デスクトップ開発の起動はビルド済みフロントエンドアセットを直接使用するようになり、別途 `localhost:1420` サーバーは不要です。

詳細な使用方法は [HOWTO.md](https://github.com/teycir/apihunter/blob/HEAD/HOWTO.md) を、VulhubベースのCVE検証ラボは [docs/lab-setup.md](https://github.com/teycir/apihunter/blob/HEAD/docs/lab-setup.md) を、内部構造は [docs/](https://github.com/teycir/apihunter/blob/HEAD/docs/) を参照してください。

### NDJSON 検出結果の例```json
{
  "url": "https://api.example.com/graphql",
  "check": "graphql/introspection-enabled",
  "title": "GraphQL introspection is enabled",
  "severity": "MEDIUM",
  "detail": "Introspection query returned schema metadata from a public endpoint.",
  "evidence": "POST /graphql -> HTTP 200 with __schema fields in response body",
  "scanner": "graphql",
  "timestamp": "2026-03-19T14:02:11.824Z"
}

**フロー:** CLI 引数 → Config → Runner が Discovery + Scanners を調整 → HTTP クライアント (Auth/WAF 付き) → レポート

## テンプレートツール

ApiHunter は **二重の拡張性** をサポートします: **TOML テンプレート** (コード不要) または **Rust モジュール** (完全制御) でチェックを追加できます。

### TOML テンプレート形式
`assets/cve_templates/*.toml` にカスタムチェックを作成します:```toml
id = "custom-api-check"
name = "Custom API Vulnerability"
severity = "high"

[[requests]]
method = "GET"
path = "/api/vulnerable"

[[requests.matchers]]
type = "status"
values = [200]

[[requests.matchers]]
type = "word"
part = "body"
words = ["sensitive_data", "exposed"]

### カスタムRustスキャナーの追加
複雑なロジック用に `Scanner` トレイトを実装します:```rust
#[async_trait]
impl Scanner for MyCustomScanner {
    async fn scan(
        &self,
        url: &str,
        client: &HttpClient,
        config: &Config,
    ) -> (Vec<Finding>, Vec<CapturedError>) {
        // Your custom scanning logic
    }
}

`split-by-host.sh` 以外のすべてのラッパースクリプトは、`--stdin` と末尾の ApiHunter フラグをサポートしています。

## テスト戦略

- **単体テスト** (`tests/*_scanner.rs`、パーサー/設定テスト): スキャナーのロジックとエッジケース。
- **統合テスト** (`tests/integration_runner.rs`、起動/CLI 動作): オーケストレーションとランタイム配線。
- **フィクスチャ回帰テスト** (`tests/cve_templates_real_data.rs`、`tests/cve_templates_upstream_parity.rs`): 実際のペイロードを再生し、固定されたアップストリームテンプレートと比較します。
- **モックサーバーテスト** (複数のスキャナースイート): インターネット上のターゲットに依存しない決定的な動作チェック。
- **ライブターゲットチェック**: オプション/手動のみ (デフォルトの `cargo test` には含まれません)。

完全なテストマトリックスとカバレッジマップについては、専用の [テストガイド](https://github.com/teycir/apihunter/blob/HEAD/docs/testing.md) を参照してください。

フォーカスしたスイートを実行:```bash
cargo test --test cors_scanner
cargo test --test graphql_scanner
cargo test --test cve_templates_runtime_ext
cargo test --test integration_runner

実データ統合ゲートを実行する (フィクスチャ + ライブ無視スイート):```bash
# Fixture-backed real payload regression suites
cargo test --test cve_templates_real_data --test cve_templates_upstream_parity --test cve_templates_runtime_ext

# Manual live internet integration suites (ignored by default)
cargo test --test live_vulnerable_apis --test live_real_world_targets -- --ignored

### ビルド済みリリース成果物

タグ付きリリース（`v*`）では、以下のプラットフォーム向けにビルド済みの `apihunter` バイナリを公開しています：

- Linux（`x86_64-unknown-linux-gnu`、`aarch64-unknown-linux-gnu`）
- macOS（`x86_64-apple-darwin`）
- Windows（`x86_64-pc-windows-msvc`）

各リリースでは、サプライチェーン成果物も公開しています：

- SHA256チェックサムファイル（`*.sha256`）
- Sigstore キーレス署名素材（`*.sig`、`*.pem`、`*.sigstore.json`）
- SPDX JSON SBOM（`apihunter-release-assets-sbom.spdx.json`）
- GitHub アーティファクト証明（来歴および SBOM 証明メタデータ）

ダウンロードは [GitHub Releases](https://github.com/Teycir/ApiHunter/releases) から。

### デスクトップ版のインストール（Tauri + React）

デスクトップアプリのソースは `apps/desktop` にあります。

本番用デスクトップバイナリをビルドして実行する：```bash
cd apps/desktop
npm install
npm run tauri build
./src-tauri/target/release/apihunter-desktop

クリック可能なLinuxランチャーアイコンをインストール:```bash
cd apps/desktop
npm run desktop:install-icon

現在のディレクトリ内のファイルからスキャンを実行します:```bash
docker run --rm -v "$PWD:/work" apihunter:local \
  --urls /work/targets/cve-regression-real-public.txt \
  --format ndjson \
  --output /work/results.ndjson

**Q: ベースライン差分?**```bash
./target/release/apihunter --urls targets/cve-regression-real-public.txt --format ndjson --output baseline.ndjson
./target/release/apihunter --urls targets/cve-regression-real-public.txt --baseline baseline.ndjson --format ndjson