{ "checker": { "claims": [ { "claim": "Every finding carries raw_request and raw_response as HTTP/1.1 text (machine-readable JSONL)", "command": " scan -u 'http://127.0.0.1:5001/sqli?q=test' -p q --jsonl", "evidence": "raw_request\":\"GET /sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\\r\\nAccept-Encoding: identity\\r\\nAccept: text/html,application/json,*/*;q=0.8\\r\\nConnection: close\\r\\nHost: 127.0.0.1:5001\\r\\n\\r\\n\",\"raw_response\":\"HTTP/1.0 200 OK\\r\\nServer: BaseHTTP/0.6 Python/3.12.3\\r\\nDate: Tue, 27 Oct 2026 13:56:07 GMT\\r\\nContent-Type: text/html\\r\\nContent-Length: 63\\r\\n\\r\\nResults for \",\"signals\":[],\"timestamp\":\"2026-10-27T", "expected": "JSONL output containing raw_request; exit code 1 because findings exist", "input": "scan of local target http://127.0.0.1:5001/sqli?q=test with --jsonl", "kind": "claim", "outcome": "Real input produced the expected result: raw_request", "returncode": 1, "source": "Every finding carries `raw_request` and `raw_response` as HTTP/1.1 text", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "creds discovers credentials in a directory tree", "command": " creds ", "evidence": "[*] 0 finding(s)\n", "expected": "0 findings", "input": "clean directory ", "kind": "claim", "outcome": "Real input produced the expected result: [*] 0 finding(s)", "returncode": 0, "source": "Credential discovery in tree or Git history", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "terms accept records Terms of Use acceptance", "command": " terms accept", "evidence": "Terms version 1 accepted.\nRecorded at \n", "expected": "Terms version 1 accepted.", "input": "janissary terms accept", "kind": "claim", "outcome": "Real input produced the expected result: Terms version 1 accepted.", "returncode": 0, "source": "Accept the Terms of Use (required once before any network command):", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "scan reports findings grouped by severity", "command": " scan -u 'http://127.0.0.1:5001/sqli?q=test' -p q", "evidence": "Findings by severity:\n HIGH 2\n[*] Probing for WAF...\n No WAF signatures observed\n [q] baseline is static - timing gates disabled\n [q] xss_script -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n [q] xss_img -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n", "expected": "severity summary; exit code 1 because findings exist", "input": "scan of local target http://127.0.0.1:5001/sqli?q=test", "kind": "claim", "outcome": "Real input produced the expected result: Findings by severity:", "returncode": 1, "source": "Findings by severity:", "source_checked": true, "source_file": "README.md", "verdict": "yes" } ], "cycle_checks": [ { "claim": "Scheduled or looping main behavior", "command": "", "evidence": "Inspected README.md and src/janissary (grep for cron, schedule, --once, --now, webhook, while True found no matches). janissary is a one-shot CLI (scan, creds, fingerprint, graphql, ws, admin, terms, agent, attack); no product scheduler or loop exists.", "expected": "identify the product trigger", "input": "source inspection", "kind": "cycle", "outcome": "Inspected README.md and src/janissary (grep for cron, schedule, --once, --now, webhook, while True found no matches). janissary is a one-shot CLI (scan, creds, fingerprint, graphql, ws, admin, terms, agent, attack); no product scheduler or loop exists.", "source": "repository entry points", "verdict": "yes" } ], "details": { "argv": [ "", "scan", "-u", "http://127.0.0.1:5001/sqli?q=test", "-p", "q", "--jsonl" ], "kind": "cli", "needs_browser": false, "needs_credentials": false, "returncode": 1, "scope": "product operation", "stderr": "JANISSARY \u2014 differential DAST\n============================================================\n[*] Scanning http://127.0.0.1:5001/sqli?q=test\n[*] Parameters: q\n[*] Method: GET\n[*] Baseline samples: 10\n\n[*] Probing for WAF...\n No WAF signatures observed\n [q] baseline is static - timing gates disabled\n [q] xss_script -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n [q] xss_img -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML\n[excerpt truncated]", "stdout": "{\"id\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"class\":\"xss\",\"fingerprint\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"title\":null,\"severity\":\"high\",\"url\":\"http://127.0.0.1:5001/sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E\",\"method\":\"GET\",\"parameter\":\"q\",\"payload\":\"\",\"raw_request\":\"GET /sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\\r\\nAccept-Encoding: identity\\r\\nAccept: text/html,application/json,*/*;q=0.8\\r\\nConnection: close\\r\\nHost: 127.0.0.1:5001\\r\\n\\r\\n\",\"raw_response\":\"HTTP/1.0 200 OK\\r\\nServer: BaseHTTP/0.6 Python/3.12.3\\r\\nDate: Tue, 27 Oct 2026 13:56:06 GMT\\r\\nContent-Type: text/html\\r\\nContent-Length: 63\\r\\n\\r\\nResults for \",\"signals\":[],\"timestamp\":\"2026-10-27T13:56:06Z\"}\n{\"id\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"class\":\"xss\",\"fingerprint\":\"jfv1:44538268085d38d45327bc8f51a1da6e\",\"title\":null,\"severity\":\"high\",\"url\":\"http://127.0.0.1:5001/sqli?q=%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E\",\"method\":\"GET\",\"parameter\":\"q\",\"payload\":\"

\",\"\n[excerpt truncated]", "working": true }, "evidence_strength": "readme_checked", "example_checks": [ { "claim": "Scan a directory for credentials (offline, clean fixture; README example uses a git repo)", "command": " creds ", "deferred": false, "evidence": "[*] 0 finding(s)", "expected": "0 findings, exit code 0", "input": "janissary creds ", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart: Scan a Git repository for leaked credentials", "verdict": "yes" }, { "claim": "Show the Terms of Use required before network commands", "command": " terms show", "deferred": false, "evidence": "information it produces primarily to improve the security\nof the affected systems.\n\n6. NO WARRANTY\nJANISSARY is provided \"as is\", without warranty of any kind, as set\nout in the Apache License 2.0. These Terms supplement, and do not\nreplace, the Apache License 2.0.\n\n7. GOVERNING LAW\nThese Terms are governed by the laws of Victoria, Australia. The\nparties submit to the exclusive jurisdiction of the courts of\nVictoria, Australia.\n\nBy typing I AGREE, you confirm that you have read these Terms, that\nyou accept them, and that you will comply with clause 1 (Authorised\nUse) in every use of JANISSARY.", "expected": "Terms of Use text, exit code 0", "input": "janissary terms show", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart: Review with janissary terms show", "verdict": "yes" } ], "status": "PASS" }, "deviations": [ "Workspace is not a git repository and I did not run the git fetch/reset pin step; the pinned commit was not verified. Source already present in was used as-is.", "/inputs/coldpass-preflight.py does not exist in this guest; ran as instructed.", "README examples use https://target.example; substituted a local fixture HTTP server on 127.0.0.1:5001 (it reflects q unescaped and returns 500 on a single quote) because the scanner needs a reachable target.", "README 'Scan a Git repository' example (creds ./my-repo --scan-git) replaced by directory scan of an offline fixture; no git repo was created.", "The README scan example's exit code 1 (findings found) is documented in source code, not README text, so the scan example was recorded as a claim (exit 1 with 'Findings by severity:') rather than a checked example.", "Scope enforcement (--scope-include/--scope-exclude, exit 64) was not exercised.", "pip install -e . may have created egg-info metadata inside the workspace." ], "fault_owner": null, "main_blocker": null, "operation": "Install JANISSARY from source, accept the Terms of Use, and run a DAST scan (janissary scan) and offline credential discovery (janissary creds) against a local HTTP target", "operation_scope": "Local target only: http://127.0.0.1:5001/sqli?q=test served by a fixture server at (left running). Requires Python >=3.10 (guest has 3.12.3) and a venv. No network, browser, or credentials were needed.", "outcome": "working", "plain_failure": null, "steps": [ "python3 -m venv && install -e . (README 'From source (development)')", " terms accept (README Quickstart)", " terms show", " scan -u \"http://127.0.0.1:5001/sqli?q=test\" -p q (README 'Scan a single endpoint'; returns exit 1 when findings exist)", " scan -u \"http://127.0.0.1:5001/sqli?q=test\" -p q --jsonl (README 'Machine-readable output')", " creds (finds AWS keys, exit 1)", " creds (exit 0, 0 findings)" ], "stuck_step": null, "suggested_fix": "None required. Optional: the scan example in README uses target.example, which cannot be run as-is; a documented local test target would make the quickstart easier to replay." }