aegis/config.py at main · moon0deva/aegis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# config.py
"""
Aegis 2025 — Global configuration, severity map, and shared constants.
"""

import os

# ─────────────────────────────────────────────
# HTTP
# ─────────────────────────────────────────────
DEFAULT_TIMEOUT  = 7
DEFAULT_THREADS  = 10
DEFAULT_DELAY    = 0.15   # seconds between requests per thread
REQUEST_RETRIES  = 3
HEADERS = {
    "User-Agent": "Aegis/2025.1 (Security Research)",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
}

# ─────────────────────────────────────────────
# OWASP Severity / CVSS scoring
# ─────────────────────────────────────────────
SEVERITY = {
    # Critical (CVSS 9.0–10.0)
    "SQL Injection":          ("Critical", 9.8),
    "LFI":                    ("Critical", 9.0),
    "RFI":                    ("Critical", 9.8),
    "SSRF":                   ("Critical", 9.1),
    "XXE":                    ("Critical", 9.1),
    "RCE":                    ("Critical", 10.0),
    # High (CVSS 7.0–8.9)
    "XSS":                    ("High",     7.5),
    "SSTI":                   ("High",     8.1),
    "CSRF":                   ("High",     8.0),
    "Insecure Deserialization":("High",    8.1),
    # Medium (CVSS 4.0–6.9)
    "Open Redirect":          ("Medium",   6.1),
    "Broken Authentication":  ("Medium",   6.5),
    "Security Misconfiguration":("Medium", 6.5),
    "PHP Info Exposed":       ("Medium",   5.3),
    "Server Version Exposed": ("Medium",   5.3),
    "Missing Security Header":("Medium",   5.0),
    "Cookie Without Flags":   ("Medium",   5.4),
    # Low (CVSS 0.1–3.9)
    "Directory/File Found":   ("Low",      3.1),
    "Directory Listing":      ("Low",      3.5),
    "Sensitive File Exposed":  ("Low",     3.8),
    # Info
    "WAF Detected":           ("Info",     0.0),
    "Technology Fingerprint": ("Info",     0.0),
}

# ─────────────────────────────────────────────
# AI
# ─────────────────────────────────────────────
ANTHROPIC_API_KEY = os.environ.get("ANTHROPIC_API_KEY", "")
AI_MODEL          = "claude-opus-4-6"

# ─────────────────────────────────────────────
# Report
# ─────────────────────────────────────────────
DEFAULT_OUTPUT_DIR = "aegis_reports"