ALISX Real Target Organism

ALISX is a comprehensive, three-stage authorized security pipeline designed for testing real web applications. The system operates as an "organism," moving from automated mapping of application states to complex multi-actor permission matrices, and finally to verified proof-of-concept (PoC) generation.

How It Works

The pipeline executes a continuous flow:

1. Stage 1 (Mapper): Connects to Chrome via the Chrome DevTools Protocol (CDP), captures real user sessions (Account A and Account B), and builds a normalized endpoint graph.
2. Stage 2 (Core/Matrix): Constructs an object corpus, selects the attack surface, and runs the Professional Real Matrix v9. This stage uses multi-actor testing to verify cross-user permissions and detect business logic vulnerabilities.
3. Stage 3 (Verifier): Performs isolated replays, differential proofs, impact assessments, and automatically generates PoC scripts (cURL, Python, Bash).

Features

• CDP Handshake: Supports manual login in Chrome, followed by automated session capture and state machine normalization.
• Multi-Actor Testing: Simulates real-world authorization flaws (IDOR, BOLA) by comparing responses between two authenticated users.
• Advanced Attack Plugins: Includes specialized modules for authentication, business logic, GraphQL, and web vulnerabilities.
• Automated PoC Generation: Instantly creates executable scripts to demonstrate discovered vulnerabilities.
• Blind Injection & XSS: Built-in detectors for blind injection payloads and cross-site scripting (XSS) validation.

Prerequisites & Setup

Requirements

• Python 3.11+
• Chrome/Chromium Browser (running with remote debugging enabled)
• Two authenticated accounts on the target application

Installation

1. Clone the repository:

   git clone https://github.com/edik40288-stack/Alisx.git
   cd Alisx

2. Create a virtual environment and install dependencies:

   python -m venv .venv
   source .venv/bin/activate
   pip install -e .

3. Configure the environment:

   cp .env.example .env
   # Edit .env to set target URLs, ports, and scope boundaries

Running the Organism

1. Start two Chrome instances with CDP enabled:
   • Account A: chrome --remote-debugging-port=9222
   • Account B: chrome --remote-debugging-port=9333
2. Log in manually in both browsers.
3. Run the unified pipeline:

   .\RUN_ORGANISM_WINDOWS.ps1
   # or via CLI:
   alisx-pipeline organism

Tech Stack

• Language: Python 3.11+
• Browser Automation: Playwright (CDP)
• Networking: httpx, requests
• Build System: Setuptools

License

This project is licensed under the MIT License.