Removed duplicate base path from output, minor changes to value type handling

Fix EnforceSingleContentType function to not remove all custom headers

.github/ISSUE_TEMPLATE/bug_report.md

@@ -8,31 +8,35 @@ assignees: ''
 ---
 
 **Describe the bug**
+
 A clear and concise description of what the bug is.
 
 **To Reproduce**
-Steps to reproduce the behavior:
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
+
+A code block containing the command executed with output:
+
+```bash
+$ sj automate -u https://petstore.swagger.io/v2/swagger.json
+[SOME OUTPUT AND/OR ERROR HERE]
+
+#Note: To maintain privacy, please omit any IP address, URL, organizational information contained within the definition file, etc.
+```
 
 **Expected behavior**
+
 A clear and concise description of what you expected to happen.
 
 **Screenshots**
+
 If applicable, add screenshots to help explain your problem.
 
+*Note: To maintain privacy, please omit any IP address, URL, organizational information contained within the definition file, etc.*
+
 **Desktop (please complete the following information):**
  - OS: [e.g. iOS]
  - Browser [e.g. chrome, safari]
  - Version [e.g. 22]
 
-**Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Browser [e.g. stock browser, safari]
- - Version [e.g. 22]
-
 **Additional context**
+
 Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -8,13 +8,17 @@ assignees: ''
 ---
 
 **Is your feature request related to a problem? Please describe.**
+
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
 
 **Describe the solution you'd like**
+
 A clear and concise description of what you want to happen.
 
 **Describe alternatives you've considered**
+
 A clear and concise description of any alternative solutions or features you've considered.
 
 **Additional context**
+
 Add any other context or screenshots about the feature request here.

README.md

@@ -4,15 +4,16 @@
 
 sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing.
 
-It does this by parsing the definition file for paths, parameters, and accepted methods before using the results with one of four commands:
+It does this by parsing the definition file for paths, parameters, and accepted methods before using the results with one of five sub-commands:
 - `automate` - Crafts a series of requests and analyzes the status code of the response.
 - `prepare` - Generates a list of commands to use for manual testing.
 - `endpoints` - Generates a list of raw API routes. *Path values will not be replaced with test data*.
 - `brute` - Sends a series of requests to a target to find operation definitions based on commonly used file paths.
+- `convert` - Converts a definition file from v2 to v3.
 
 ## Build
 
-To compile from source, ensure you have Go version `>= 1.20` installed and run `go build` from within the repository:
+To compile from source, ensure you have Go version `>= 1.22.5` installed and run `go build` from within the repository:
 
 ```bash
 $ git clone https://github.com/BishopFox/sj.git
@@ -36,100 +37,101 @@ $ export PATH=$PATH:~/go/bin
 > Use the `automate` command to send a series of requests to each defined endpoint and analyze the status code of each response.
 
 ```bash
-$ sj automate -u https://petstore.swagger.io/v2/swagger.json -q
-
-INFO[0000] Gathering API details.
+$ sj automate -u https://petstore.swagger.io/v2/swagger.json -qi -p http://127.0.0.1:8080
 
+INFO[0000] Gathering API details.                       
 Title: Swagger Petstore
 Description: This is a sample server Petstore server.  You can find out more about Swagger at [http://swagger.io](http://swagger.io) or on [irc.freenode.net, #swagger](http://swagger.io/irc/).  For this sample, you can use the api key `special-key` to test the authorization filters.
-
-INFO[0000] Available authentication mechanisms:
-    - api_key
-    - petstore_auth
-
-INFO[0000] Endpoint accessible!                          Method=GET Status=200 Target="https://petstore.swagger.io/v2/pet/findByTags?tags=1"
-INFO[0000] Endpoint accessible!                          Method=POST Status=200 Target="https://petstore.swagger.io/v2/store/order"
-WARN[0000] Manual testing may be required.               Method=POST Status=500 Target="https://petstore.swagger.io/v2/user/createWithList"
-INFO[0000] Endpoint accessible!                          Method=POST Status=200 Target="https://petstore.swagger.io/v2/user"
-ERRO[0000] User not found                                Method=GET Status=404 Target="https://petstore.swagger.io/v2/user/test"
-WARN[0000] Manual testing may be required.               Method=PUT Status=415 Target="https://petstore.swagger.io/v2/user/test"
-INFO[0000] Endpoint accessible!                          Method=GET Status=200 Target="https://petstore.swagger.io/v2/user/login?password=test&username=test"
-WARN[0000] Manual testing may be required.               Method=POST Status=500 Target="https://petstore.swagger.io/v2/user/createWithArray"
-INFO[0000] Endpoint accessible!                          Method=GET Status=200 Target="https://petstore.swagger.io/v2/user/logout"
-WARN[0000] Manual testing may be required.               Method=POST Status=415 Target="https://petstore.swagger.io/v2/pet/test"
-ERRO[0000] Pet not found                                 Method=GET Status=404 Target="https://petstore.swagger.io/v2/pet/test"
-WARN[0000] Manual testing may be required.               Method=POST Status=415 Target="https://petstore.swagger.io/v2/pet/test/uploadImage"
-ERRO[0000] Order not found                               Method=GET Status=404 Target="https://petstore.swagger.io/v2/store/order/test"
-INFO[0000] Endpoint accessible!                          Method=GET Status=200 Target="https://petstore.swagger.io/v2/store/inventory"
-INFO[0000] Endpoint accessible!                          Method=POST Status=200 Target="https://petstore.swagger.io/v2/pet"
-WARN[0000] Manual testing may be required.               Method=PUT Status=415 Target="https://petstore.swagger.io/v2/pet"
-INFO[0001] Endpoint accessible!                          Method=GET Status=200 Target="https://petstore.swagger.io/v2/pet/findByStatus?status=1"
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/pet/findByTags
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/pet/1
+WARN Manual testing may be required.               Method=POST Status=415 Target=/v2/v2/pet/1
+WARN Manual testing may be required.               Method=POST Status=400 Target=/v2/v2/store/order
+WARN Manual testing may be required.               Method=POST Status=400 Target=/v2/v2/user/createWithList
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/user/login
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/user/logout
+WARN Manual testing may be required.               Method=POST Status=415 Target=/v2/v2/pet/1/uploadImage
+WARN Manual testing may be required.               Method=POST Status=400 Target=/v2/v2/pet
+WARN Manual testing may be required.               Method=PUT Status=415 Target=/v2/v2/pet
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/pet/findByStatus
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/store/inventory
+INFO Endpoint accessible!                          Method=GET Status=200 Target=/v2/v2/store/order/1
+ERRO Endpoint not found.                           Method=GET Status=404 Target=/v2/v2/user/bishopfox
+WARN Manual testing may be required.               Method=PUT Status=415 Target=/v2/v2/user/bishopfox
+WARN Manual testing may be required.               Method=POST Status=400 Target=/v2/v2/user/createWithArray
+WARN Manual testing may be required.               Method=POST Status=400 Target=/v2/v2/user
 ```
 
 > Use the `prepare` command to prepare a list of commands for manual testing. Currently supports both `curl` and `sqlmap`. You will likely have to modify these slightly.
 
 ```bash
-$ sj prepare -u https://petstore.swagger.io/v2/swagger.json -q
+$ sj prepare -u https://petstore.swagger.io/v2/swagger.json -qi -p http://127.0.0.1:8080      
 
 INFO[0000] Gathering API details.
-
+                      
 Title: Swagger Petstore
 Description: This is a sample server Petstore server.  You can find out more about Swagger at [http://swagger.io](http://swagger.io) or on [irc.freenode.net, #swagger](http://swagger.io/irc/).  For this sample, you can use the api key `special-key` to test the authorization filters.
-
-INFO[0000] Available authentication mechanisms:
-    - api_key
-    - petstore_auth
-
-curl -sk -X PUT 'https://petstore.swagger.io/v2/user/test' -d '{"test":"test"}'
-curl -sk -X GET 'https://petstore.swagger.io/v2/user/test'
-curl -sk -X GET 'https://petstore.swagger.io/v2/pet/test'
-curl -sk -X POST 'https://petstore.swagger.io/v2/pet/test' -d '{"test":"test"}'
-curl -sk -X POST 'https://petstore.swagger.io/v2/store/order' -d '{"test":"test"}'
-curl -sk -X POST 'https://petstore.swagger.io/v2/pet' -d '{"test":"test"}'
-curl -sk -X PUT 'https://petstore.swagger.io/v2/pet' -d '{"test":"test"}'
-curl -sk -X GET 'https://petstore.swagger.io/v2/store/order/test'
-curl -sk -X GET 'https://petstore.swagger.io/v2/pet/findByTags?tags=1'
-curl -sk -X POST 'https://petstore.swagger.io/v2/user/createWithList' -d '{"test":"test"}'
-curl -sk -X POST 'https://petstore.swagger.io/v2/user' -d '{"test":"test"}'
-curl -sk -X GET 'https://petstore.swagger.io/v2/user/logout'
-curl -sk -X GET 'https://petstore.swagger.io/v2/user/login?password=test&username=test'
-curl -sk -X POST 'https://petstore.swagger.io/v2/pet/test/uploadImage' -d '{"test":"test"}'
-curl -sk -X GET 'https://petstore.swagger.io/v2/pet/findByStatus?status=1'
-curl -sk -X GET 'https://petstore.swagger.io/v2/store/inventory'
-curl -sk -X POST 'https://petstore.swagger.io/v2/user/createWithArray' -d '{"test":"test"}'
+$ curl -X POST "https://petstore.swagger.io/v2/pet/{petId}"
+$ curl -X GET "https://petstore.swagger.io/v2/pet/{petId}"
+$ curl -X GET "https://petstore.swagger.io/v2/store/inventory"
+$ curl -X POST "https://petstore.swagger.io/v2/user/createWithList" -d 'body=1'
+$ curl -X GET "https://petstore.swagger.io/v2/user/logout"
+$ curl -X POST "https://petstore.swagger.io/v2/user/createWithArray" -d 'body=1'
+$ curl -X GET "https://petstore.swagger.io/v2/pet/findByStatus"
+$ curl -X GET "https://petstore.swagger.io/v2/pet/findByTags"
+$ curl -X POST "https://petstore.swagger.io/v2/store/order" -d 'petId=1&quantity=1&shipDate=bishopfox&status=bishopfox&complete=1&id=1&body='
+$ curl -X POST "https://petstore.swagger.io/v2/pet/{petId}/uploadImage"
+$ curl -X POST "https://petstore.swagger.io/v2/pet" -d 'photoUrls=1&tags=1&status=bishopfox&id=1&category=&name=doggie&body='
+$ curl -X PUT "https://petstore.swagger.io/v2/pet" -d 'id=1&category=&name=doggie&photoUrls=1&tags=1&status=bishopfox&body='
+$ curl -X GET "https://petstore.swagger.io/v2/user/{username}"
+$ curl -X PUT "https://petstore.swagger.io/v2/user/{username}" -d 'email=bishopfox&password=bishopfox&phone=bishopfox&userStatus=1&id=1&username=bishopfox&firstName=bishopfox&lastName=bishopfox&body='
+$ curl -X GET "https://petstore.swagger.io/v2/user/login"
+$ curl -X POST "https://petstore.swagger.io/v2/user" -d 'phone=bishopfox&userStatus=1&id=1&username=bishopfox&firstName=bishopfox&lastName=bishopfox&email=bishopfox&password=bishopfox&body='
+$ curl -X GET "https://petstore.swagger.io/v2/store/order/{orderId}"
 ```
 
 > Use the `endpoints` command to generate a list of raw endpoints from the provided definition file.
 
 ```bash
-$ sj endpoints -u https://petstore.swagger.io/v2/swagger.json
+$ sj endpoints -u https://petstore.swagger.io/v2/swagger.json -qi -p http://127.0.0.1:8080
 
 INFO[0000] Gathering endpoints.
-
+                        
+/v2/store/inventory
+/v2/store/order/{orderId}
 /v2/pet
-/v2/pet/findByStatus
+/v2/pet
+/v2/store/order
+/v2/user/createWithList
+/v2/pet/{petId}/uploadImage
 /v2/pet/findByTags
 /v2/pet/{petId}
-/v2/pet/{petId}/uploadImage
-/v2/store/inventory
-/v2/store/order
-/v2/store/order/{orderId}
-/v2/user
+/v2/pet/{petId}
+/v2/user/{username}
+/v2/user/{username}
 /v2/user/createWithArray
-/v2/user/createWithList
+/v2/pet/findByStatus
 /v2/user/login
 /v2/user/logout
-/v2/user/{username}
+/v2/user
 ```
 
 > Use the `brute` command to send a series of requests in an attempt to find a definition file on the target.
 
 ```bash
-$ sj brute -u https://petstore.swagger.io/v2/swagger.json
-INFO[0000] Sending 2045 requests. This could take a while...
+$ sj brute -u https://petstore.swagger.io -qi -p http://127.0.0.1:8080 -e
+INFO[0000] Sending 2173 requests. This could take a while... 
 Request: 343
-INFO[0015] Definition file found: https://petstore.swagger.io/v2/swagger
-{"...SNIP..."}
+INFO[0033] Definition file found: https://petstore.swagger.io/v2/swagger 
+```
+
+> Use the `convert` command to convert a definition file from version 2 to version 3.
+
+```bash
+$ sj convert -u https://petstore.swagger.io/v2/swagger.json -qi -p http://127.0.0.1:8080 -o openapi.json
+
+INFO[0000] Gathering API details.
+                      
+INFO[0000] Wrote file to /current/directory/openapi.json 
 ```
 
 ## Help
@@ -157,6 +159,9 @@ $ sj endpoints -u https://petstore.swagger.io/v2/swagger.json
 Perform a brute-force attack against the target to identify hidden definition files:
 $ sj brute -u https://petstore.swagger.io
 
+Convert a Swagger (v2) definition file to an OpenAPI (v3) definition file:
+$ sj convert -u https://petstore.swagger.io/v2/swagger.json -o openapi.json
+
 Usage:
   sj [flags]
   sj [command]
@@ -164,12 +169,13 @@ Usage:
 Available Commands:
   automate    Sends a series of automated requests to the discovered endpoints.
   brute       Sends a series of automated requests to discover hidden API operation definitions.
+  convert     Converts a Swagger definition file to an OpenAPI v3 definition file.
   endpoints   Prints a list of endpoints from the target.
   help        Help about any command
   prepare     Prepares a set of commands for manual testing of each endpoint.
 
 Flags:
-  -a, --agent string            Set the User-Agent string. (default "Swagger Jacker (github.com/BishopFox/sj)")
+  -A, --agent string            Set the User-Agent string. (default "Swagger Jacker (github.com/BishopFox/sj)")
   -b, --base-path string        Set the API base path if not defined in the definition file (i.e. /V2/).
   -f, --format string           Declare the format of the definition file (json/yaml/yml/js). (default "json")
   -H, --headers stringArray     Add custom headers, separated by a colon ("Name: Value"). Multiple flags are accepted.
@@ -179,7 +185,7 @@ Flags:
   -o, --outfile string          Output the results to a file. Only supported for the 'automate' and 'brute' commands at this time.
   -p, --proxy string            Proxy host and port. Example: http://127.0.0.1:8080 (default "NOPROXY")
   -q, --quiet                   Do not prompt for user input - uses default values for all requests.
-  -r, --randomize-user-agent    Randomizes the user agent string. Default is 'false'.
+      --randomize-user-agent    Randomizes the user agent string. Default is 'false'.
   -s, --safe-word stringArray   Avoids 'dangerous word' check for the specified word(s). Multiple flags are accepted.
   -T, --target string           Manually set a target for the requests to be made if separate from the host the documentation resides on.
   -t, --timeout int             Set the request timeout period. (default 30)

cmd/auth.go

@@ -5,8 +5,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/getkin/kin-openapi/openapi3"
-
 	log "github.com/sirupsen/logrus"
 )
 
@@ -21,89 +19,113 @@ var (
 	bearerToken        string
 )
 
-func CheckSecDefs(doc3 openapi3.T) (apiInQuery bool, apiKey string, apiKeyName string) {
-
-	if outputFormat == "json" && !quiet {
-		if len(doc3.Components.SecuritySchemes) != 0 {
-			log.Warnf("The following authentication mechanisms are supported. If necessary, supply these manually when using the JSON output format:\n")
-		}
-		for mechanism := range doc3.Components.SecuritySchemes {
-			log.Infof(`Type: %s, Scheme: %s`, doc3.Components.SecuritySchemes[mechanism].Value.Type, doc3.Components.SecuritySchemes[mechanism].Value.Scheme)
-		}
-		log.Warnln("Note: To avoid these messages, pass the quiet (-q) flag.")
-	} else if !quiet {
-		if len(doc3.Components.SecuritySchemes) > 0 {
-			log.Info("Available authentication mechanisms: ")
-		}
-
-		for mechanism := range doc3.Components.SecuritySchemes {
-			if doc3.Components.SecuritySchemes[mechanism].Value == nil {
-				log.Error("Authorization schema structure unsupported. Manual testing is required.")
-				return false, "", ""
-			}
-			if doc3.Components.SecuritySchemes[mechanism].Value.Scheme != "" {
-				fmt.Printf("    - %s (%s)\n", mechanism, doc3.Components.SecuritySchemes[mechanism].Value.Scheme)
-			} else if outputFormat != "json" {
-				fmt.Printf("    - %s\n", mechanism)
+func CheckSecuritySchemes(spec map[string]interface{}) {
+	components, ok := spec["components"].(map[string]interface{})
+	if ok && components != nil {
+		securitySchemes, ok := components["securitySchemes"].(map[string]interface{})
+		if !ok || len(securitySchemes) == 0 {
+			fmt.Println("No security schemes defined.")
+		} else {
+			if outputFormat != "json" {
+				fmt.Println("Found security schemes:")
 			}
+			var apiKey string
+			var apiKeyName string
 
-			if doc3.Components.SecuritySchemes[mechanism].Value.Type == "http" {
-				if doc3.Components.SecuritySchemes[mechanism].Value.Scheme == "basic" {
-					log.Infof("Basic Authentication is accepted. Supply a username and password? (y/N)")
-					fmt.Scanln(&autoApplyBasicAuth)
-					autoApplyBasicAuth = strings.ToLower(autoApplyBasicAuth)
-					if autoApplyBasicAuth == "y" {
-						fmt.Printf("Enter a username.")
-						fmt.Scanln(&basicAuthUser)
-						fmt.Printf("Enter a password.")
-						fmt.Scanln(&basicAuthPass)
-						basicAuth = []byte(basicAuthUser + ":" + basicAuthPass)
-						basicAuthString = base64.StdEncoding.EncodeToString(basicAuth)
-						log.Infof("Using %s as the Basic Auth value.", basicAuthString)
-						Headers = append(Headers, "Authorization: Basic "+basicAuthString)
-					} else {
-						log.Warn("A basic authentication header is accepted. Review the spec and craft a header manually using the -H flag.")
-					}
-				} else if strings.ToLower(doc3.Components.SecuritySchemes[mechanism].Value.Scheme) == "bearer" {
-					log.Warn("A bearer token is accepted. Review the spec and craft a token manually using the -H flag.")
+			for mechanism, value := range securitySchemes {
+				fmt.Printf("  - %s\n", mechanism)
+				scheme, ok := value.(map[string]interface{})
+				if !ok {
+					continue
 				}
-			} else if doc3.Components.SecuritySchemes[mechanism].Value.Type == "apiKey" && doc3.Components.SecuritySchemes[mechanism].Value.In == "query" {
-				apiInQuery = true
-				log.Infof("An API key can be provided via a parameter string. Would you like to apply one? (y/N)")
-				fmt.Scanln(&autoApplyAPIKey)
-				autoApplyAPIKey = strings.ToLower(autoApplyAPIKey)
-				if autoApplyAPIKey == "y" {
-					apiKeyName = doc3.Components.SecuritySchemes[mechanism].Value.Name
-					fmt.Printf("What value would you like to use for the API key (%s)?", apiKeyName)
-					fmt.Scanln(&apiKey)
-					log.Infof("Using %s=%s as the API key in all requests.", apiKeyName, apiKey)
+
+				if typ, ok := scheme["type"].(string); ok {
+					switch typ {
+					case "http":
+						if schemeType := scheme["scheme"]; schemeType != nil {
+							switch schemeType {
+							case "basic":
+								fmt.Println("Basic Authentication is accepted. Supply a username and password? (y/N)")
+								fmt.Scanln(&autoApplyBasicAuth)
+								autoApplyBasicAuth = strings.ToLower(autoApplyBasicAuth)
+								if autoApplyBasicAuth == "y" {
+									fmt.Printf("Enter a username.")
+									fmt.Scanln(&basicAuthUser)
+									fmt.Printf("Enter a password.")
+									fmt.Scanln(&basicAuthPass)
+									basicAuth = []byte(basicAuthUser + ":" + basicAuthPass)
+									basicAuthString = base64.StdEncoding.EncodeToString(basicAuth)
+									log.Infof("Using %s as the Basic Auth value.", basicAuthString)
+									Headers = append(Headers, "Authorization: Basic "+basicAuthString)
+								} else {
+									log.Warn("A basic authentication header is accepted. Review the spec and craft a header manually using the -H flag.")
+								}
+							case "bearer":
+								log.Warn("A bearer token is accepted. Review the spec and craft a token manually using the -H flag.")
+							}
+						}
+					case "apiKey":
+						if inVal, ok := scheme["in"].(string); ok {
+							switch inVal {
+							case "query":
+								log.Infof("An API key can be provided via a parameter string. Would you like to apply one? (y/N)")
+								if quiet {
+									autoApplyAPIKey = "n"
+								} else {
+									fmt.Scanln(&autoApplyAPIKey)
+									autoApplyAPIKey = strings.ToLower(autoApplyAPIKey)
+								}
+
+								if autoApplyAPIKey == "y" {
+									if nameVal, ok := scheme["name"].(string); ok {
+										apiKeyName = nameVal
+									}
+									fmt.Printf("What value would you like to use for the API key (%s)?", apiKeyName)
+									fmt.Scanln(&apiKey)
+									log.Infof("Using %s=%s as the API key in all requests.", apiKeyName, apiKey)
+								}
+							case "header":
+								if mechanism == "bearer" {
+									log.Infof("A bearer token is accepted. Would you like to provide one? (y/N)")
+									if quiet {
+										autoApplyBearer = "n"
+									} else {
+										fmt.Scanln(&autoApplyBearer)
+										autoApplyBearer = strings.ToLower(autoApplyBearer)
+									}
+									if autoApplyBearer == "y" {
+										fmt.Printf("What value would you like to use for the Bearer Token? ")
+										fmt.Scanln(&bearerToken)
+										Headers = append(Headers, "Authorization: Bearer "+bearerToken)
+									} else {
+										log.Warn("A bearer token is accepted. Review the spec and craft a header manually using the -H flag.")
+									}
+								} else {
+									if nameVal, ok := scheme["name"].(string); ok {
+										log.Infof("An API key can be provided via the header %s. Would you like to apply one? (y/N)", nameVal)
+										if quiet {
+											autoApplyAPIKey = "n"
+										} else {
+											fmt.Scanln(&autoApplyAPIKey)
+											autoApplyAPIKey = strings.ToLower(autoApplyAPIKey)
+										}
+										if autoApplyAPIKey == "y" {
+											apiKeyName = nameVal
+											fmt.Printf("What value would you like to use for the API key (%s)?", apiKeyName)
+											fmt.Scanln(&apiKey)
+											Headers = append(Headers, nameVal+": "+apiKey)
+										}
+									}
+								}
+							}
+						}
+					}
 				}
-			} else if doc3.Components.SecuritySchemes[mechanism].Value.Type == "apiKey" && doc3.Components.SecuritySchemes[mechanism].Value.In == "header" {
-				if mechanism == "bearer" {
-					log.Infof("A bearer token is accepted. Would you like to provide one? (y/N)")
-					fmt.Scanln(&autoApplyBearer)
-					autoApplyBearer = strings.ToLower(autoApplyBearer)
-					if autoApplyBearer == "y" {
-						fmt.Printf("What value would you like to use for the Bearer Token? ")
-						fmt.Scanln(&bearerToken)
-						Headers = append(Headers, "Authorization: Bearer "+bearerToken)
-					} else {
-						log.Warn("A bearer token is accepted. Review the spec and craft a header manually using the -H flag.")
-					}
-				} else {
-					log.Infof("An API key can be provided via the header %s. Would you like to apply one? (y/N)", doc3.Components.SecuritySchemes[mechanism].Value.Name)
-					fmt.Scanln(&autoApplyAPIKey)
-					autoApplyAPIKey = strings.ToLower(autoApplyAPIKey)
-					if autoApplyAPIKey == "y" {
-						apiKeyName = doc3.Components.SecuritySchemes[mechanism].Value.Name
-						fmt.Printf("What value would you like to use for the API key (%s)?", apiKeyName)
-						fmt.Scanln(&apiKey)
-						Headers = append(Headers, doc3.Components.SecuritySchemes[mechanism].Value.Name+": "+apiKey)
-					}
+
+				if bearerFormat, ok := scheme["bearerFormat"].(string); ok {
+					fmt.Println("  - bearerFormat:", bearerFormat)
 				}
 			}
 		}
 	}
-	fmt.Printf("\n")
-	return apiInQuery, apiKey, apiKeyName
 }

cmd/automate.go

@@ -23,7 +23,6 @@ var automateCmd = &cobra.Command{
 This enables the user to get a quick look at which endpoints require authentication and which ones do not. If a request
 responds in an abnormal way, manual testing should be conducted (prepare manual tests using the "prepare" command).`,
 	Run: func(cmd *cobra.Command, args []string) {
-
 		if outfile != "" && strings.ToLower(outputFormat) != "" {
 			if !strings.HasSuffix(strings.ToLower(outfile), "json") && strings.ToLower(outputFormat) != "json" {
 				log.Fatal("Only the JSON output format is supported at the moment.")
@@ -32,13 +31,25 @@ responds in an abnormal way, manual testing should be conducted (prepare manual
 			}
 		}
 
+		/* // NEED TO RE-IMPLEMENT RATE LIMIT
+		if rateLimit <= 0 {
+			log.Fatal("Invalid rate supplied. Must be a positive number")
+		}
+		*/
+
+		if randomUserAgent {
+			if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+				log.Warnf("A supplied User Agent was detected (%s) while supplying the 'random-user-agent' flag.", UserAgent)
+			}
+		}
+
 		var bodyBytes []byte
 
 		client := CheckAndConfigureProxy()
 
 		if strings.ToLower(outputFormat) != "json" {
 			fmt.Printf("\n")
-			log.Infof("Gathering API details.\n\n")
+			log.Infof("Gathering API details.\n")
 		}
 
 		if swaggerURL != "" {
@@ -51,6 +62,11 @@ responds in an abnormal way, manual testing should be conducted (prepare manual
 
 			bodyBytes, _ = io.ReadAll(specFile)
 		}
+		/* // NEED TO RE-IMPLEMENT RATE LIMIT
+		if rateLimit > 0 && strings.ToLower(outputFormat) != "json" {
+			log.Info("Sending requests at a rate of ", rateLimit, " requests per second.")
+		}
+		*/
 		GenerateRequests(bodyBytes, client)
 	},
 }

cmd/brute.go

@@ -11,12 +11,16 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/getkin/kin-openapi/openapi2"
+	"github.com/getkin/kin-openapi/openapi2conv"
 	"github.com/getkin/kin-openapi/openapi3"
 	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v3"
 
 	log "github.com/sirupsen/logrus"
 )
 
+var endpointOnly bool
 var endpointWordlist string
 
 var prefixDirs []string = []string{"", "/swagger", "/swagger/docs", "/swagger/latest", "/swagger/v1", "/swagger/v2", "/swagger/v3", "/swagger/static", "/swagger/ui", "/swagger-ui", "/api-docs", "/api-docs/v1", "/api-docs/v2", "/apidocs", "/api", "/api/v1", "/api/v2", "/api/v3", "/v1", "/v2", "/v3", "/doc", "/docs", "/docs/swagger", "/docs/swagger/v1", "/docs/swagger/v2", "/docs/swagger-ui", "/docs/swagger-ui/v1", "/docs/swagger-ui/v2", "/docs/v1", "/docs/v2", "/docs/v3", "/public", "/redoc"}
@@ -29,6 +33,18 @@ var bruteCmd = &cobra.Command{
 	Long:  `The brute command sends requests to the target to find operation definitions based on commonly used file locations.`,
 	Run: func(cmd *cobra.Command, args []string) {
 
+		/* // NEED TO RE-IMPLEMENT RATE LIMIT
+		if rateLimit <= 0 {
+			log.Fatal("Invalid rate supplied. Must be a positive number")
+		}
+		*/
+
+		if randomUserAgent {
+			if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+				log.Warnf("A supplied User Agent was detected (%s) while supplying the 'random-user-agent' flag.", UserAgent)
+			}
+		}
+
 		client := CheckAndConfigureProxy()
 
 		var allURLs []string
@@ -60,7 +76,11 @@ var bruteCmd = &cobra.Command{
 				log.Fatalf("failed to read words from file: %s", err)
 			}
 		}
-		log.Infof("Sending %d requests. This could take a while...\n", len(allURLs))
+		if rateLimit > 0 && strings.ToLower(outputFormat) != "json" {
+			log.Infof("Sending %d requests at a rate of %d requests per second. This could take a while...\n", len(allURLs), rateLimit)
+		} else {
+			log.Infof("Sending %d requests. This could take a while...\n", len(allURLs))
+		}
 
 		specFound, definitionFile := findDefinitionFile(allURLs, client)
 		if specFound {
@@ -86,7 +106,11 @@ var bruteCmd = &cobra.Command{
 					log.Infof("Wrote file to %s\n", f)
 				}
 			} else {
-				fmt.Println(string(definedOperations))
+				if endpointOnly {
+					return
+				} else {
+					fmt.Println(string(definedOperations))
+				}
 			}
 			// TODO: Check if (future implementation) automate flag is true and if so than call the 'sj automate' command with the discovered definition file.
 		} else {
@@ -111,6 +135,7 @@ func makeURLs(target string, endpoints []string, fileExtension string) []string
 }
 
 func findDefinitionFile(urls []string, client http.Client) (bool, *openapi3.T) {
+
 	for i, url := range urls {
 		ct := CheckContentType(client, url)
 		if strings.Contains(ct, "application/json") {
@@ -143,7 +168,6 @@ func findDefinitionFile(urls []string, client http.Client) (bool, *openapi3.T) {
 		} else {
 			fmt.Printf("\033[2K\r%s%d", "Request: ", i+1)
 		}
-
 	}
 	return false, nil
 }
@@ -151,4 +175,86 @@ func findDefinitionFile(urls []string, client http.Client) (bool, *openapi3.T) {
 func init() {
 	// TODO: Add a flag here (boolean) that defaults to false that will cause the program to execute 'sj automate' on the discovered definition file automatically.
 	bruteCmd.PersistentFlags().StringVarP(&endpointWordlist, "wordlist", "w", "", "The file containing a list of paths to brute force for discovery.")
+	bruteCmd.Flags().BoolVarP(&endpointOnly, "endpoint-only", "e", false, "Only return the identified endpoint")
+}
+
+func ExtractSpecFromJS(bodyBytes []byte) []byte {
+	var openApiIndex int
+	var specClose int
+	var bodyString, spec string
+
+	bodyString = string(bodyBytes)
+	spec = strings.ReplaceAll(bodyString, "\n", "")
+	spec = strings.ReplaceAll(spec, "\t", "")
+	spec = strings.ReplaceAll(spec, " ", "")
+
+	if strings.Contains(strings.ReplaceAll(bodyString, " ", ""), `"swagger":"2.0"`) {
+		openApiIndex = strings.Index(spec, `"swagger":`) - 1
+		specClose = strings.LastIndex(spec, "]}") + 2
+
+		var doc2 openapi2.T
+		bodyBytes = []byte(spec[openApiIndex:specClose])
+		_ = json.Unmarshal(bodyBytes, &doc2)
+		if !strings.Contains(doc2.Swagger, "2") {
+			specClose = strings.LastIndex(spec, "}") + 1
+			bodyBytes = []byte(spec[openApiIndex:specClose])
+			_ = json.Unmarshal(bodyBytes, &doc2)
+			if !strings.Contains(doc2.Swagger, "2") {
+				log.Error("Error parsing JavaScript file for spec. Try saving the object as a JSON file and reference it locally.")
+			}
+		}
+	} else if strings.Contains(strings.ReplaceAll(bodyString, " ", ""), `"openapi":"3`) {
+		openApiIndex = strings.Index(spec, `"openapi":`) - 1
+
+		specClose = strings.LastIndex(spec, "]}") + 2
+
+		var doc3 openapi3.T
+		bodyBytes = []byte(spec[openApiIndex:specClose])
+		_ = json.Unmarshal(bodyBytes, &doc3)
+		if !strings.Contains(doc3.OpenAPI, "3") {
+			specClose = strings.LastIndex(spec, "}") + 1
+			bodyBytes = []byte(spec[openApiIndex:specClose])
+			_ = json.Unmarshal(bodyBytes, &doc3)
+			if !strings.Contains(doc3.OpenAPI, "3") {
+				log.Error("Error parsing JavaScript file for spec. Try saving the object as a JSON file and reference it locally.")
+			}
+		}
+	} else {
+		log.Error("Error parsing JavaScript file for spec. Try saving the object as a JSON file and reference it locally.")
+	}
+
+	return bodyBytes
+}
+
+func UnmarshalSpec(bodyBytes []byte) (newDoc *openapi3.T) {
+	var doc openapi2.T
+	var doc3 openapi3.T
+
+	format = strings.ToLower(format)
+	if format == "js" || strings.HasSuffix(swaggerURL, ".js") {
+		bodyBytes = ExtractSpecFromJS(bodyBytes)
+	} else if format == "yaml" || format == "yml" || strings.HasSuffix(swaggerURL, ".yaml") || strings.HasSuffix(swaggerURL, ".yml") {
+		_ = yaml.Unmarshal(bodyBytes, &doc)
+		_ = yaml.Unmarshal(bodyBytes, &doc3)
+	}
+
+	_ = json.Unmarshal(bodyBytes, &doc)
+	_ = json.Unmarshal(bodyBytes, &doc3)
+
+	if strings.HasPrefix(doc3.OpenAPI, "3") {
+		newDoc := &doc3
+		return newDoc
+	} else if strings.HasPrefix(doc.Swagger, "2") {
+		newDoc, err := openapi2conv.ToV3(&doc)
+		if err != nil {
+			fmt.Printf("Error converting v2 document to v3: %s\n", err)
+		}
+		return newDoc
+	} else if os.Args[1] == "brute" {
+		var noDoc openapi3.T
+		return &noDoc
+	} else {
+		log.Fatal("Error parsing definition file.")
+		return nil
+	}
 }

cmd/convert.go

@@ -0,0 +1,128 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/getkin/kin-openapi/openapi2"
+	"github.com/getkin/kin-openapi/openapi2conv"
+	"github.com/getkin/kin-openapi/openapi3"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v3"
+)
+
+var convertCmd = &cobra.Command{
+	Use:   "convert",
+	Short: "Converts a Swagger definition file to an OpenAPI v3 definition file.",
+	Long:  `The convert command converts a provided definition file from the Swagger specification (v2) to the OpenAPI specification (v3) and stores it into an output file.`,
+	Run: func(cmd *cobra.Command, args []string) {
+
+		var bodyBytes []byte
+
+		if randomUserAgent {
+			if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+				log.Warnf("A supplied User Agent was detected (%s) while supplying the 'random-user-agent' flag.", UserAgent)
+			}
+		}
+
+		client := CheckAndConfigureProxy()
+
+		if strings.ToLower(outputFormat) != "json" {
+			fmt.Printf("\n")
+			log.Infof("Gathering API details.\n\n")
+		}
+
+		if swaggerURL != "" {
+			bodyBytes, _, _ = MakeRequest(client, "GET", swaggerURL, timeout, nil)
+		} else {
+			specFile, err := os.Open(localFile)
+			if err != nil {
+				log.Fatal("Error opening definition file:", err)
+			}
+
+			bodyBytes, _ = io.ReadAll(specFile)
+		}
+
+		var doc openapi2.T
+		var doc3 openapi3.T
+
+		format = strings.ToLower(format)
+		if format == "yaml" || format == "yml" || strings.HasSuffix(swaggerURL, ".yaml") || strings.HasSuffix(swaggerURL, ".yml") {
+			_ = yaml.Unmarshal(bodyBytes, &doc)
+			_ = yaml.Unmarshal(bodyBytes, &doc3)
+		} else {
+			_ = json.Unmarshal(bodyBytes, &doc)
+			_ = json.Unmarshal(bodyBytes, &doc3)
+		}
+
+		if strings.HasPrefix(doc3.OpenAPI, "3") {
+			log.Warnln("Definition file is already version 3.")
+			WriteConvertedDefinitionFile(bodyBytes)
+		} else if strings.HasPrefix(doc.Swagger, "2") {
+			newDoc, err := openapi2conv.ToV3(&doc)
+			if err != nil {
+				fmt.Printf("Error converting v2 document to v3: %s\n", err)
+			}
+
+			switch format {
+			case "json":
+				if strings.HasSuffix(outfile, "yaml") || strings.HasSuffix(outfile, "yml") {
+					log.Warn("It looks like you're trying to save the file in YAML format. Supply the '-f yaml' option to do so (default: json).")
+				}
+				converted, err := json.Marshal(newDoc)
+				if err != nil {
+					log.Fatal("Error converting definition file to v3:", err)
+				}
+				if !strings.HasSuffix(string(converted), "}") {
+					if outfile == "" {
+						fmt.Println(string(converted))
+					} else {
+						WriteConvertedDefinitionFile(converted)
+					}
+				} else {
+					endOfJSON := strings.LastIndex(string(converted), "}") + 1
+					if outfile == "" {
+						fmt.Println(string(converted)[:endOfJSON])
+					} else {
+						WriteConvertedDefinitionFile(converted)
+					}
+				}
+			case "yaml", "yml":
+				converted, err := yaml.Marshal(newDoc)
+				if err != nil {
+					log.Fatal("Error converting definition file to v3:", err)
+				}
+				if outfile == "" {
+					fmt.Println(string(converted))
+				} else {
+					WriteConvertedDefinitionFile(converted)
+				}
+			}
+
+		} else {
+			log.Fatal("Error parsing definition file.")
+		}
+	},
+}
+
+func WriteConvertedDefinitionFile(data []byte) {
+	file, err := os.OpenFile(outfile, os.O_CREATE|os.O_WRONLY, 0644)
+	if err != nil {
+		log.Errorf("Error opening file: %s\n", err)
+	}
+
+	defer file.Close()
+
+	_, err = file.Write(data)
+	if err != nil {
+		log.Errorf("Error writing file: %s\n", err)
+	} else {
+		f, _ := filepath.Abs(outfile)
+		log.Infof("Wrote file to %s\n", f)
+	}
+}

cmd/endpoints.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 
-	"github.com/mpvl/unique"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -16,28 +15,29 @@ var endpointsCmd = &cobra.Command{
 	Long: `The endpoints command allows you to pull a list of endpoints out of a Swagger definition file.
 This list contains the raw endpoints (parameter values will not be appended or modified).`,
 	Run: func(cmd *cobra.Command, args []string) {
+		if randomUserAgent {
+			if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+				log.Warnf("A supplied User Agent was detected (%s) while supplying the 'random-user-agent' flag.", UserAgent)
+			}
+		}
+
 		client := CheckAndConfigureProxy()
 
 		var bodyBytes []byte
-		var paths []string
 
 		fmt.Printf("\n")
 		log.Infof("Gathering endpoints.\n\n")
 
 		if swaggerURL != "" {
 			bodyBytes, _, _ := MakeRequest(client, "GET", swaggerURL, timeout, nil)
-			paths = GenerateRequests(bodyBytes, client)
+			GenerateRequests(bodyBytes, client)
 		} else {
 			specFile, err := os.Open(localFile)
 			if err != nil {
 				log.Fatal("Error opening file:", err)
 			}
 			bodyBytes, _ = io.ReadAll(specFile)
-			paths = GenerateRequests(bodyBytes, client)
-		}
-		unique.Sort(unique.StringSlice{&paths})
-		for _, v := range paths {
-			fmt.Println(v)
+			GenerateRequests(bodyBytes, client)
 		}
 	},
 }

cmd/log.go

@@ -8,8 +8,25 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-func writeLog(sc int, target, method, errorMsg, response string) {
+type Result struct {
+	Method string `json:"method"`
+	Status int    `json:"status"`
+	Target string `json:"target"`
+}
 
+type VerboseResult struct {
+	Method  string `json:"method"`
+	Preview string `json:"preview"`
+	Status  int    `json:"status"`
+	Target  string `json:"target"`
+	Curl    string `json:"curl"`
+}
+
+var tempLogger *log.Logger
+
+func writeLog(sc int, target, method, errorMsg, response string) {
+	var file *os.File
+	tempLogger = log.New()
 	tempResponsePreviewLength := responsePreviewLength
 
 	if len(response) < responsePreviewLength {
@@ -23,71 +40,78 @@ func writeLog(sc int, target, method, errorMsg, response string) {
 			os.Exit(1)
 		}
 
-		defer file.Close()
-
-		log.SetOutput(file)
+		tempLogger.SetOutput(file)
 	}
 
 	if outputFormat == "console" {
 		if strings.Contains(response, "\"") {
-			log.SetFormatter(&log.TextFormatter{DisableQuote: true, DisableTimestamp: true})
+			tempLogger.SetFormatter(&log.TextFormatter{DisableQuote: true, DisableTimestamp: true})
 		} else {
-			log.SetFormatter(&log.TextFormatter{DisableTimestamp: true})
+			tempLogger.SetFormatter(&log.TextFormatter{DisableTimestamp: true})
 		}
 	} else {
-		log.SetFormatter(&log.JSONFormatter{DisableHTMLEscape: true, DisableTimestamp: true})
+		tempLogger.SetFormatter(&log.JSONFormatter{DisableHTMLEscape: true, DisableTimestamp: true, PrettyPrint: true})
 	}
 
 	if verbose {
 		if sc != 200 {
 			if sc == 401 || sc == 403 {
-				logVerboseUnauth(sc, target, method, errorMsg, response)
+				logVerboseUnauth(sc, target, method, errorMsg, response, tempLogger)
 			} else if sc == 301 || sc == 302 {
-				logVerboseRedirect(sc, target, method, response)
+				logVerboseRedirect(sc, target, method, response, tempLogger)
 			} else if sc == 0 {
-				logVerboseBad(sc, target, method, response)
+				logVerboseBad(sc, target, method, response, tempLogger)
 			} else if sc == 404 {
-				logNotFound(sc, target, method, errorMsg)
+				logNotFound(sc, target, method, errorMsg, tempLogger)
 			} else if sc == 1 {
-				logDangerous(target, method)
+				logDangerous(target, method, tempLogger)
+			} else if sc == 8899 {
+				logVerboseJSON(specTitle, specDescription)
 			} else {
-				logVerboseManual(sc, target, method, errorMsg, response)
+				logVerboseManual(sc, target, method, errorMsg, response, tempLogger)
 			}
 		} else {
-			logVerboseAccessible(sc, target, method, response)
+			logVerboseAccessible(sc, target, method, response, tempLogger)
 		}
 	} else {
 		if sc != 200 {
 			if sc == 401 || sc == 403 {
-				logUnauth(sc, target, method, errorMsg)
+				logUnauth(sc, target, method, errorMsg, tempLogger)
 			} else if sc == 301 || sc == 302 {
-				logRedirect(sc, target, method)
+				logRedirect(sc, target, method, tempLogger)
 			} else if sc == 0 {
-				logBad(sc, target, method)
+				logBad(sc, target, method, tempLogger)
 			} else if sc == 404 {
-				logNotFound(sc, target, method, errorMsg)
+				logNotFound(sc, target, method, errorMsg, tempLogger)
 			} else if sc == 1 {
-				logDangerous(target, method)
+				logDangerous(target, method, tempLogger)
+			} else if sc == 8899 {
+				logJSON(specTitle, specDescription)
 			} else {
-				logManual(sc, target, method, errorMsg)
+				logManual(sc, target, method, errorMsg, tempLogger)
 			}
 		} else {
-			logAccessible(sc, target, method)
+			if sc == 8899 {
+				logJSON(specTitle, specDescription)
+			} else {
+				logAccessible(sc, target, method, tempLogger)
+			}
 		}
 	}
 	responsePreviewLength = tempResponsePreviewLength
+	file.Close()
 }
 
-func logAccessible(status int, target, method string) {
-	log.WithFields(log.Fields{
+func logAccessible(status int, target, method string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status": status,
 		"Target": target,
 		"Method": method,
 	}).Print("Endpoint accessible!")
 }
 
-func logVerboseAccessible(status int, target, method, response string) {
-	log.WithFields(log.Fields{
+func logVerboseAccessible(status int, target, method, response string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status":  status,
 		"Target":  target,
 		"Method":  method,
@@ -95,30 +119,30 @@ func logVerboseAccessible(status int, target, method, response string) {
 	}).Print("Endpoint accessible!")
 }
 
-func logDangerous(target, method string) {
-	log.WithFields(log.Fields{
+func logDangerous(target, method string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status": "skipped",
 		"Target": target,
 		"Method": method,
-	}).Warn("Endpoint skipped due to dangerous keyword.")
+	}).Warn("Endpoint skipped due to dangerous keyword (or request cancelled due to timeout).")
 }
 
-func logManual(status int, target, method, errorMsg string) {
+func logManual(status int, target, method, errorMsg string, logger *log.Logger) {
 	if errorMsg == "" {
 		errorMsg = "Manual testing may be required."
 	}
-	log.WithFields(log.Fields{
+	logger.WithFields(log.Fields{
 		"Status": status,
 		"Target": target,
 		"Method": method,
 	}).Warn(errorMsg)
 }
 
-func logVerboseManual(status int, target, method, errorMsg, response string) {
+func logVerboseManual(status int, target, method, errorMsg, response string, logger *log.Logger) {
 	if errorMsg == "" {
 		errorMsg = "Manual testing may be required."
 	}
-	log.WithFields(log.Fields{
+	logger.WithFields(log.Fields{
 		"Status":  status,
 		"Target":  target,
 		"Method":  method,
@@ -126,27 +150,27 @@ func logVerboseManual(status int, target, method, errorMsg, response string) {
 	}).Warn(errorMsg)
 }
 
-func logNotFound(status int, target, method, errorMsg string) {
+func logNotFound(status int, target, method, errorMsg string, logger *log.Logger) {
 	if errorMsg == "" {
 		errorMsg = "Endpoint not found."
 	}
-	log.WithFields(log.Fields{
+	logger.WithFields(log.Fields{
 		"Status": status,
 		"Target": target,
 		"Method": method,
 	}).Error(errorMsg)
 }
 
-func logRedirect(status int, target, method string) {
-	log.WithFields(log.Fields{
+func logRedirect(status int, target, method string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status": status,
 		"Target": target,
 		"Method": method,
 	}).Error("Redirect detected. This likely requires authentication.")
 }
 
-func logVerboseRedirect(status int, target, method, response string) {
-	log.WithFields(log.Fields{
+func logVerboseRedirect(status int, target, method, response string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status":  status,
 		"Target":  target,
 		"Method":  method,
@@ -154,16 +178,16 @@ func logVerboseRedirect(status int, target, method, response string) {
 	}).Error("Redirect detected. This likely requires authentication.")
 }
 
-func logBad(status int, target, method string) {
-	log.WithFields(log.Fields{
+func logBad(status int, target, method string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status": "N/A",
 		"Target": target,
 		"Method": method,
 	}).Warn("Bad request (could not reach the target).")
 }
 
-func logVerboseBad(status int, target, method, response string) {
-	log.WithFields(log.Fields{
+func logVerboseBad(status int, target, method, response string, logger *log.Logger) {
+	logger.WithFields(log.Fields{
 		"Status":  "N/A",
 		"Target":  target,
 		"Method":  method,
@@ -171,25 +195,41 @@ func logVerboseBad(status int, target, method, response string) {
 	}).Warn("Bad request (could not reach the target).")
 }
 
-func logUnauth(status int, target, method, errorMsg string) {
+func logUnauth(status int, target, method, errorMsg string, logger *log.Logger) {
 	if errorMsg == "" {
 		errorMsg = "Unauthorized."
 	}
-	log.WithFields(log.Fields{
+	logger.WithFields(log.Fields{
 		"Status": status,
 		"Target": target,
 		"Method": method,
 	}).Error(errorMsg)
 }
 
-func logVerboseUnauth(status int, target, method, errorMsg, response string) {
+func logVerboseUnauth(status int, target, method, errorMsg, response string, logger *log.Logger) {
 	if errorMsg == "" {
 		errorMsg = "Unauthorized."
 	}
-	log.WithFields(log.Fields{
+	logger.WithFields(log.Fields{
 		"Status":  status,
 		"Target":  target,
 		"Method":  method,
 		"Preview": response[:responsePreviewLength],
 	}).Error(errorMsg)
 }
+
+func logJSON(title, description string) {
+	tempLogger.WithFields(log.Fields{
+		"apiTitle":    title,
+		"description": description,
+		"results":     jsonResultArray,
+	}).Println("Done")
+}
+
+func logVerboseJSON(title, description string) {
+	tempLogger.WithFields(log.Fields{
+		"apiTitle":    title,
+		"description": description,
+		"results":     jsonVerboseResultArray,
+	}).Println("Done")
+}

cmd/prepare.go

@@ -15,6 +15,13 @@ var prepareCmd = &cobra.Command{
 	Long: `The prepare command prepares a set of commands for manual testing of each endpoint.
 This enables you to test specific API functions for common vulnerabilities or misconfigurations.`,
 	Run: func(cmd *cobra.Command, args []string) {
+
+		if randomUserAgent {
+			if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+				log.Warnf("A supplied User Agent was detected (%s) while supplying the 'random-user-agent' flag.", UserAgent)
+			}
+		}
+
 		client := CheckAndConfigureProxy()
 
 		fmt.Printf("\n")

cmd/requests.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"io"
 	"math/rand"
@@ -91,33 +92,36 @@ func MakeRequest(client http.Client, method, target string, timeout int64, reqDa
 	}
 
 	for i := range Headers {
-		h := strings.Split(Headers[i], ":")
-		if len(h) == 2 {
-			if h[0] == "User-Agent" {
-				UserAgent = h[1]
-			}
-			if h[0] == "Content-Type" {
-				contentType = h[1]
-			}
-			if h[0] == "Accept" {
-				accept = h[1]
-			}
-			req.Header.Set(h[0], h[1])
-		} else {
+		delimIndex := strings.Index(Headers[i], ":")
+		if delimIndex == -1 {
 			log.Warnf("Header provided (%s) cannot be used. Headers must be in 'Key: Value' format (this may be caused by a header declared within the definition file).\n", Headers[i])
+			continue
+		}
+
+		key := Headers[i][:delimIndex]
+		value := Headers[i][delimIndex+1:]
+
+		if len(Headers) == 2 {
+			if key == "User-Agent" {
+				UserAgent = value
+			}
+			if key == "Content-Type" {
+				contentType = value
+			}
+			if key == "Accept" {
+				accept = value
+			}
+		} else {
+			req.Header.Set(key, value)
 		}
 	}
 
 	// User-Agent handling
 	if randomUserAgent {
-		if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
-			log.Fatalf("Cannot set a User Agent while supplying the 'random-user-agent' flag.")
-		} else {
-			rand.New(rand.NewSource(time.Now().UnixNano()))
-			UserAgent = userAgents[rand.Intn(len(userAgents))]
-			req.Header.Set("User-Agent", UserAgent)
-		}
-	} else if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+		rand.New(rand.NewSource(time.Now().UnixNano()))
+		UserAgent = userAgents[rand.Intn(len(userAgents))]
+		req.Header.Set("User-Agent", UserAgent)
+	} else {
 		req.Header.Set("User-Agent", UserAgent)
 	}
 
@@ -177,6 +181,15 @@ func CheckContentType(client http.Client, target string) string {
 		log.Fatal("Error: could not create HTTP request - ", err)
 	}
 
+	// User-Agent handling
+	if randomUserAgent {
+		rand.New(rand.NewSource(time.Now().UnixNano()))
+		UserAgent = userAgents[rand.Intn(len(userAgents))]
+		req.Header.Set("User-Agent", UserAgent)
+	} else if UserAgent != "Swagger Jacker (github.com/BishopFox/sj)" {
+		req.Header.Set("User-Agent", UserAgent)
+	}
+
 	resp, err := client.Do(req.WithContext(ctx))
 	if err == context.DeadlineExceeded {
 		log.Printf("Error: %s - skipping request.", err)
@@ -193,3 +206,26 @@ func CheckContentType(client http.Client, target string) string {
 	}
 	return resp.Header.Get("Content-Type")
 }
+
+func CheckAndConfigureProxy() (client http.Client) {
+	var proxyUrl *url.URL
+
+	transport := &http.Transport{}
+
+	if insecure {
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+
+	if proxy != "NOPROXY" {
+		proxyUrl, _ = url.Parse(proxy)
+		transport.Proxy = http.ProxyURL(proxyUrl)
+	}
+
+	client = http.Client{
+		Transport: transport,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	return client
+}

cmd/root.go

@@ -5,7 +5,6 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var accessibleEndpointFound bool
 var apiTarget string
 var basePath string
 var format string
@@ -15,6 +14,7 @@ var outfile string
 var proxy string
 var quiet bool
 var randomUserAgent bool
+var rateLimit int
 var safeWords []string
 var swaggerURL string
 var timeout int64
@@ -39,14 +39,17 @@ Generate a list of raw API routes for use with custom scripts:
 $ sj endpoints -u https://petstore.swagger.io/v2/swagger.json
 
 Perform a brute-force attack against the target to identify hidden definition files:
-$ sj brute -u https://petstore.swagger.io`,
+$ sj brute -u https://petstore.swagger.io
+
+Convert a Swagger (v2) definition file to an OpenAPI (v3) definition file:
+$ sj convert -u https://petstore.swagger.io/v2/swagger.json -o openapi.json`,
 
 	Run: func(cmd *cobra.Command, args []string) {
 		if len(args) < 1 {
 			log.Error("Command not specified. See the --help flag for usage.")
 		}
 	},
-	Version: "1.7.2",
+	Version: "2.0.2",
 }
 
 func Execute() {
@@ -58,7 +61,8 @@ func init() {
 	rootCmd.AddCommand(endpointsCmd)
 	rootCmd.AddCommand(prepareCmd)
 	rootCmd.AddCommand(bruteCmd)
-	rootCmd.PersistentFlags().StringVarP(&UserAgent, "agent", "a", "Swagger Jacker (github.com/BishopFox/sj)", "Set the User-Agent string.")
+	rootCmd.AddCommand(convertCmd)
+	rootCmd.PersistentFlags().StringVarP(&UserAgent, "agent", "A", "Swagger Jacker (github.com/BishopFox/sj)", "Set the User-Agent string.")
 	rootCmd.PersistentFlags().StringVarP(&basePath, "base-path", "b", "", "Set the API base path if not defined in the definition file (i.e. /V2/).")
 	rootCmd.PersistentFlags().StringVarP(&format, "format", "f", "json", "Declare the format of the definition file (json/yaml/yml/js).")
 	rootCmd.PersistentFlags().StringArrayVarP(&Headers, "headers", "H", nil, "Add custom headers, separated by a colon (\"Name: Value\"). Multiple flags are accepted.")
@@ -67,7 +71,8 @@ func init() {
 	rootCmd.PersistentFlags().StringVarP(&outfile, "outfile", "o", "", "Output the results to a file. Only supported for the 'automate' and 'brute' commands at this time.")
 	rootCmd.PersistentFlags().StringVarP(&proxy, "proxy", "p", "NOPROXY", "Proxy host and port. Example: http://127.0.0.1:8080")
 	rootCmd.PersistentFlags().BoolVarP(&quiet, "quiet", "q", false, "Do not prompt for user input - uses default values for all requests.")
-	rootCmd.PersistentFlags().BoolVarP(&randomUserAgent, "randomize-user-agent", "r", false, "Randomizes the user agent string. Default is 'false'.")
+	rootCmd.PersistentFlags().BoolVar(&randomUserAgent, "randomize-user-agent", false, "Randomizes the user agent string. Default is 'false'.")
+	// rootCmd.PersistentFlags().IntVarP(&rateLimit, "rate", "r", 15, "Limit the number of requests per second.") // NEED TO RE-IMPLEMENT RATE LIMIT
 	rootCmd.PersistentFlags().StringArrayVarP(&safeWords, "safe-word", "s", nil, "Avoids 'dangerous word' check for the specified word(s). Multiple flags are accepted.")
 	rootCmd.PersistentFlags().StringVarP(&apiTarget, "target", "T", "", "Manually set a target for the requests to be made if separate from the host the documentation resides on.")
 	rootCmd.PersistentFlags().Int64VarP(&timeout, "timeout", "t", 30, "Set the request timeout period.")

cmd/schemas.go

@@ -1,119 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"math/rand"
-	"strings"
-
-	"github.com/getkin/kin-openapi/openapi3"
-	log "github.com/sirupsen/logrus"
-)
-
-type SchemaReference struct {
-	Required   []string
-	Type       string
-	Properties struct {
-		Property struct {
-			Type      string
-			Format    string
-			Example   string
-			Reference string
-			XML       struct {
-				Name      string
-				Namespace string
-				Prefix    string
-				Attribute bool
-				Wrapped   bool
-			}
-		}
-	}
-}
-
-func HandleSchemaReference(schema *openapi3.SchemaRef) {
-
-}
-
-func (s SwaggerRequest) SetParametersFromSchema(param *openapi3.ParameterRef, location, schemaRef string, req *openapi3.RequestBodyRef, counter int) SwaggerRequest {
-	if param != nil {
-		name := strings.TrimPrefix(schemaRef, "#/components/schemas/")
-		if s.Def.Components.Schemas[name] != nil {
-			schema := s.Def.Components.Schemas[name]
-			if schema.Value.Properties != nil {
-				for property := range schema.Value.Properties {
-					if schema.Value.Properties[property].Ref != "" {
-						if counter < 3 {
-							s = s.SetParametersFromSchema(param, location, schema.Value.Properties[property].Ref, req, counter+1)
-						} else {
-							log.Warnf("Nested reference encountered for %s (Property: %s). Test this endpoint manually.\n", s.URL.Scheme+"://"+s.URL.Host+s.URL.Path, property)
-							break
-						}
-					} else if location == "path" {
-						if schema.Value.Properties[property].Value.Type == "string" {
-							if strings.Contains(s.URL.Path, param.Value.Name) {
-								s.URL.Path = strings.ReplaceAll(s.URL.Path, "{"+param.Value.Name+"}", "test")
-							} else {
-								s.URL.Path = strings.ReplaceAll(s.URL.Path, "{"+strings.ToLower(param.Value.Name)+"}", "test")
-							}
-						} else {
-							if strings.Contains(s.URL.Path, param.Value.Name) {
-								s.URL.Path = strings.ReplaceAll(s.URL.Path, "{"+param.Value.Name+"}", "1")
-							} else {
-								s.URL.Path = strings.ReplaceAll(s.URL.Path, "{"+strings.ToLower(param.Value.Name)+"}", "1")
-							}
-						}
-					} else if location == "query" {
-						if schema.Value.Properties[property].Value.Type == "string" {
-							s.Query.Add(param.Value.Name, "test")
-						} else {
-							s.Query.Add(param.Value.Name, "1")
-						}
-					} else if location == "body" {
-						if schema.Value.Properties[property].Value.Type == "string" {
-							s.Body[param.Value.Name] = "test"
-						} else {
-							s.Body[param.Value.Name] = 1
-						}
-					}
-				}
-			} else if schema.Value.Enum != nil {
-				if location == "path" {
-					value := schema.Value.Enum[rand.Intn(len(schema.Value.Enum))]
-					s.URL.Path = strings.ReplaceAll(s.URL.Path, "{"+param.Value.Name+"}", fmt.Sprint(value))
-				} else if location == "query" {
-					value := schema.Value.Enum[rand.Intn(len(schema.Value.Enum))]
-					s.Query.Add(param.Value.Name, fmt.Sprint(value))
-				} else if location == "body" {
-					value := schema.Value.Enum[rand.Intn(len(schema.Value.Enum))]
-					s.Body[param.Value.Name] = value
-				}
-			}
-		}
-	} else {
-		name := strings.TrimPrefix(schemaRef, "#/components/schemas/")
-		if s.Def.Components.Schemas[name] != nil {
-			schema := s.Def.Components.Schemas[name]
-			if schema.Value.Properties != nil {
-				for property := range schema.Value.Properties {
-					if schema.Value.Properties[property].Ref != "" {
-						if counter < 3 {
-							s = s.SetParametersFromSchema(param, location, schema.Value.Properties[property].Ref, req, counter+1)
-						} else {
-							log.Warnf("Nested reference encountered for %s (Property: %s). Test this endpoint manually.\n", s.URL.Scheme+"://"+s.URL.Host+s.URL.Path, property)
-							break
-						}
-					} else {
-						if schema.Value.Properties[property].Value.Type == "string" {
-							s.Body[property] = "test"
-						} else {
-							s.Body[property] = 1
-						}
-					}
-				}
-			} else if schema.Value.Enum != nil {
-				value := schema.Value.Enum[rand.Intn(len(schema.Value.Enum))]
-				s.Body[name] = value
-			}
-		}
-	}
-	return s
-}

go.mod

@@ -1,25 +1,26 @@
 module github.com/BishopFox/sj
 
-go 1.20
+go 1.22.5
+
+toolchain go1.23.4
 
 require (
-	github.com/getkin/kin-openapi v0.115.0
-	github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de
+	github.com/getkin/kin-openapi v0.132.0
 	github.com/sirupsen/logrus v1.9.0
 	github.com/spf13/cobra v1.6.1
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/swag v0.19.5 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.1 // indirect
-	github.com/invopop/yaml v0.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
-	github.com/perimeterx/marshmallow v1.1.4 // indirect
+	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
+	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
+	github.com/perimeterx/marshmallow v1.1.5 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

go.sum

@@ -2,38 +2,36 @@ github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/getkin/kin-openapi v0.115.0 h1:c8WHRLVY3G8m9jQTy0/DnIuljgRwTCB5twZytQS4JyU=
-github.com/getkin/kin-openapi v0.115.0/go.mod h1:l5e9PaFUo9fyLJCPGQeXI2ML8c3P8BHOEV2VaAVf/pc=
-github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/getkin/kin-openapi v0.132.0 h1:3ISeLMsQzcb5v26yeJrBcdTCEQTag36ZjaGk7MIRUwk=
+github.com/getkin/kin-openapi v0.132.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/invopop/yaml v0.1.0 h1:YW3WGUoJEXYfzWBjn00zIlrw7brGVD0fUKRYDPAPhrc=
-github.com/invopop/yaml v0.1.0/go.mod h1:2XuRLgs/ouIrW3XNzuNj7J3Nvu/Dig5MXvbCEdiBN3Q=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de h1:D5x39vF5KCwKQaw+OC9ZPiLVHXz3UFw2+psEX+gYcto=
-github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de/go.mod h1:kJun4WP5gFuHZgRjZUWWuH1DTxCtxbHDOIJsudS8jzY=
-github.com/perimeterx/marshmallow v1.1.4 h1:pZLDH9RjlLGGorbXhcaQLhfuV0pFMNfPO55FuFkxqLw=
-github.com/perimeterx/marshmallow v1.1.4/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
+github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
+github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
+github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
+github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
+github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -42,27 +40,16 @@ github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUq
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/ugorji/go v1.2.7 h1:qYhyWUUd6WbiM+C6JZAUkIJt/1WrjzNHY9+KCIjVqTo=
-github.com/ugorji/go v1.2.7/go.mod h1:nF9osbDWLy6bDVv/Rtoh6QgnvNDpmCalQV5urGCCS6M=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
 github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8 h1:0A+M6Uqn+Eje4kHMK80dtF3JCXC4ykBgQG4Fe06QRhQ=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=