Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
154 lines (117 loc) · 3.48 KB

CONTRIBUTING.md

File metadata and controls

154 lines (117 loc) · 3.48 KB

Contributing to Stiletto

Thank you for your interest in contributing! This document provides guidelines for contributing to the project.

🎯 Areas for Contribution

High Priority

  • Additional DBMS support (Cassandra, Redis, CouchDB)
  • More WAF signatures (Sucuri, Wordfence, etc.)
  • HTML report generation
  • Burp Suite / ZAP integration plugin
  • Mobile app testing support

Medium Priority

  • Additional tamper scripts
  • Rate limiting improvements
  • Proxy chain support
  • Custom payload file loading
  • Session management improvements

Low Priority

  • Documentation translations
  • Video tutorials
  • CI/CD pipeline improvements

🔧 Development Setup

# Clone the repository
git clone https://github.com/fevra-dev/Stiletto.git
cd Stiletto

# Create virtual environment
python3 -m venv venv
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt

# Run tests
pytest tests/ -v

📝 Code Standards

Python Style

  • Follow PEP 8 guidelines
  • Use type hints for function signatures
  • Maximum line length: 100 characters
  • Use descriptive variable names

Documentation

  • All functions must have docstrings (JSDoc3 style)
  • Comments should explain "why" not "what"
  • Update README.md for new features

Example Docstring

def detect_waf(self, headers: Dict[str, str], body: str, status: int) -> WAFDetectionResult:
    """
    Detect WAF from HTTP response characteristics.
    
    Uses three-phase detection methodology:
    1. Header pattern matching
    2. Response body analysis  
    3. Status code correlation
    
    Args:
        headers: HTTP response headers dictionary
        body: Response body content
        status: HTTP status code
        
    Returns:
        WAFDetectionResult with detection details and bypass recommendations
        
    Raises:
        ValueError: If headers is None
    """

🧪 Testing

Running Tests

# All tests
pytest tests/ -v

# Specific test file
pytest tests/test_scanner.py -v

# With coverage
pytest tests/ --cov=src --cov-report=html

Writing Tests

  • Add tests for all new features
  • Test both success and failure cases
  • Use descriptive test names
  • Mock external HTTP requests

📤 Submitting Changes

Pull Request Process

  1. Fork the repository
  2. Create a feature branch: git checkout -b feature/amazing-feature
  3. Commit changes: git commit -m 'Add amazing feature'
  4. Push to branch: git push origin feature/amazing-feature
  5. Open a Pull Request

PR Requirements

  • Code follows style guidelines
  • Tests pass locally
  • New tests added for new features
  • Documentation updated
  • No linting errors

Commit Messages

Use conventional commits:

feat: add MongoDB NoSQL injection support
fix: resolve timeout issue in time-based detection
docs: update README with new examples
test: add WAF detection tests
refactor: improve payload generation logic

🐛 Reporting Issues

Bug Reports

Include:

  • Python version
  • OS and version
  • Steps to reproduce
  • Expected vs actual behavior
  • Error messages/logs

Feature Requests

Include:

  • Use case description
  • Proposed solution
  • Alternative solutions considered

⚠️ Security

For security vulnerabilities, please email directly instead of opening a public issue.

📄 License

By contributing, you agree that your contributions will be licensed under the MIT License.

Thank you for helping make Stiletto better! 🚀