feat: Obfuscated exfiltration detection, WebSocket C2, FP reduction, GitLab CI (closes #1, #2, #3, #5)

[ezzy1630]

Bounty Issues Addressed

This PR addresses 4 bounty issues in a single submission:

#1 - Detect Obfuscated Credential Exfiltration (1,000 $ISNAD, tier:critical)

New obfuscated-exfil.ts detection module:

• Base64-encoded exfiltration URLs — atob()/Buffer.from() decoding with network calls
• Hex-constructed API endpoints — \\x68\\x74\\x74\\x70 style obfuscated URLs
• CharCode URL construction — String.fromCharCode(104,116,116,112...) patterns
• String reversal obfuscation — .split("").reverse().join("") to hide URLs
• Concatenated URL construction — "https:" + "//evil.com" evade detection
• Template literal URL assembly — `https://${subdomain}.evil.com/${path}`
• Environment variable harvesting — process.env → obfuscated transmission
• Decode-then-send — Decoding before fetch/axios/request
• Decoded sample extraction — Actively decodes base64, hex, charcode, reversed strings to reveal hidden URLs

All 8 detection patterns + decoder with 11 test cases.

#3 - Scanner Rule for Malicious WebSocket Handlers (200 $ISNAD, tier:rule)

New websocket-c2.ts detection module:

• WebSocket C2 connections — Hardcoded and dynamic URL detection
• Message handler exfiltration — onmessage handlers accessing process.env/fs
• Reverse shell patterns — WebSocket + child_process/execSync combos
• Data exfiltration channels — .send() with sensitive data
• Binary payload transfers — ArrayBuffer/Uint8Array handling
• Suspicious URL indicators — ngrok, Tor, raw IPs, Discord/Slack webhooks, high ports
• Suspicious connection analysis with risk assessment
• 10 test cases

#2 - Reduce False Positives on Legitimate HTTP Clients (500 $ISNAD, tier:improvement)

Context-aware detection patterns:

• HTTP_CLIENT_PATTERNS — Allowlist for axios, node-fetch, got, superagent, needle, urllib3
• LEGITIMATE_HTTP_CONTEXT — Test file detection (jest, mocha, vitest, cypress)
• KNOWN_SAFE_ENDPOINTS — Allowlist for GitHub API, npm registry, PyPI, OpenAI, Anthropic APIs
• Integrated into analyzer for smarter pattern matching

#5 - GitLab CI Integration Template (750 $ISNAD, tier:improvement)

.gitlab-ci/isnad-gitlab-ci.yml:

• Full scan job — Scans entire project on default branch and MRs
• Quick scan job — Scans only changed files in MRs for fast feedback
• Flag submission job — Manual job to submit findings to ISNAD Oracle
• SARIF output — Compatible with GitLab Security Dashboard
• Configurable thresholds — ISNAD_FAIL_ON_CRITICAL, ISNAD_FAIL_ON_HIGH, ISNAD_FAIL_ON_MEDIUM
• Setup documentation — Complete README with configuration, variables, examples

Testing

All 21 tests passing:

• 11 obfuscated exfiltration tests
• 10 WebSocket C2 detection tests

Closes #1, closes #2, closes #3, closes #5

[vercel]

@ezzy1630 is attempting to deploy a commit to the Rapi's projects Team on Vercel.

A member of the Team first needs to authorize it.