janus-security 0.1.0

Enterprise-grade BOLA and API Vulnerability Scanner

Janus Security Scanner 🛡️

Janus is an enterprise-grade API security scanner designed for Red Teams and advanced security testing. Unlike traditional scanners, Janus uses a distinct approach for detecting BOLA (Broken Object Level Authorization), BFLA, and Race Conditions without relying on external AI APIs.

Features 🚀

• BOLA/IDOR Detection: Automatic analysis of resource access patterns.
• Broken Function Level Authorization (BFLA): Vertical privilege escalation testing.
• PII & Secrets Scanning: Detect sensitive data leaks in API responses.
• Race Condition Testing: Multi-threaded exploitation of concurrency bugs.
• Stealth Mode: WAF evasion with header rotation, jitter, and proxies.
• Team Collaboration: Real-time finding synchronization via Redis/Hive-Mind.
• CI/CD Integration: Export findings to SARIF for GitHub Security tab.
• Web Dashboard: Modern UI for managing scans and viewing reports.

Installation 📦

From Source

git clone https://github.com/ksanjeev284/janus.git
cd janus
pip install .

Quick Start 🏃‍♂️

1. Web Dashboard (Recommended)

Option A: Using Docker (Fastest)

# Pull and run the latest image
docker run -p 8000:8000 ghcr.io/ksanjeev284/janus:latest

Option B: From Source Start the web server and dashboard:

python -m janus.interface.web.server
# Access at http://localhost:8000

2. CLI Usage

Janus provides a powerful CLI for automation testing.

Basic BOLA Scan:

janus scan --victim <token> --attacker <token> --host <url>

Stealth Test:

janus stealth-test

Vertical Escalation (BFLA):

janus bfla --host https://api.example.com --low <user_token>

Architecture 🏗️

Janus operates by "learning" from legitimate traffic (via its proxy or provided tokens) to understand the structure of API resources. It then attempts to access those same resources using a different user's context (the attacker), analyzing the structural similarity of the responses to determine vulnerability.

Contributing 🤝

We welcome contributions! Please see CONTRIBUTING.md for details.

License 📄

MIT License - see LICENSE for details.