Web Exploit Test v2

Local fixture verification only. CLI rejects non-loopback target/allow-host/state URL. TLS strict unless --insecure; redirects never followed; request, timeout, worker, race, response bounds enforced. Atomic redacted evidence: schema 2.0, mode 0600, states tested|skipped|error|candidate|verified. No severity before verified impact.

python3 scripts/verifier.py scan http://127.0.0.1:8080 --allow-host 127.0.0.1:8080 --modules headers,cors,methods,admin,exposed,xss,sqli,ssrf,ssti,traversal,redirect,https,info --budget 50 --test-budget 4 --output scan.json
python3 scripts/verifier.py jwt http://127.0.0.1:8080/me --allow-host 127.0.0.1 --valid-token "$TOKEN" --budget 8 --output jwt.json
python3 scripts/verifier.py race http://127.0.0.1:8080/action --allow-host 127.0.0.1:8080 --n 8 --workers 4 --serial 2 --state-url http://127.0.0.1:8080/state --state-pointer /counter --expected-delta 8 --max-delta 8 --budget 20 --output race.json
python3 -m unittest discover -s tests -v

Scan berjalan sekuensial dengan ModuleBudget atomik per modul. exposed memakai baseline impossible-path plus signature Git/ZIP/SQLite/env. Kontrol kelas-spesifik tetap maksimal candidate; hanya artifact signature kuat dapat verified. Methods hanya observasi. JWT alg:none mempertahankan payload token valid; token malformed tidak diprobe. Race menghormati --serial; verified hanya bila --state-pointer plus --expected-delta/--max-delta terpenuhi. Failures are atomic structured evidence without traceback-only output.

Limits: no DNS-name localhost aliases, DNS pinning, redirect following, browser XSS execution, SSRF callback, timing SQLi, destructive payloads, auth workflow, production targets. Offline references/ remain research material only. Provenance: PROVENANCE.md, NOTICE, MANIFEST.sha256.