GitHub - sastrophy/siteiq: AI-powered security analysis, SEO optimization, and global performance testing in one platform.

cd siteiq
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Run all tests against a target
python3 -m pytest --target-url=https://example.com

# Run with HTML report
python3 -m pytest --target-url=https://example.com --html=report.html

# Run specific test categories
python3 -m pytest --target-url=https://example.com -m sql_injection
python3 -m pytest --target-url=https://example.com -m xss
python3 -m pytest --target-url=https://example.com -m wordpress

# Security Tests
python3 -m pytest -m sql_injection    # SQL injection tests
python3 -m pytest -m xss              # XSS tests
python3 -m pytest -m csrf             # CSRF tests
python3 -m pytest -m headers          # Security headers tests
python3 -m pytest -m ssl              # SSL/TLS tests
python3 -m pytest -m wordpress        # WordPress tests
python3 -m pytest -m auth             # Authentication tests
python3 -m pytest -m traversal        # Directory traversal tests

# 2026 Security Headers Tests
python3 -m pytest -m coop             # Cross-Origin-Opener-Policy
python3 -m pytest -m coep             # Cross-Origin-Embedder-Policy
python3 -m pytest -m trusted_types    # Trusted Types CSP
python3 -m pytest -m sec_fetch        # Sec-Fetch-* headers
python3 -m pytest -m reporting_endpoints # Reporting-Endpoints header
python3 -m pytest -m nel              # Network Error Logging
python3 -m pytest -m private_network_access # Private Network Access (CORS-RFC1918)

# 2026 SSL/TLS Tests
python3 -m pytest -m tls13_preferred  # TLS 1.3 preferred protocol
python3 -m pytest -m certificate_transparency # Certificate Transparency (SCT)

# API Security Tests
python3 -m pytest -m api_security     # All API security tests
python3 -m pytest -m graphql          # GraphQL introspection
python3 -m pytest -m swagger          # Swagger/OpenAPI exposure
python3 -m pytest -m mass_assignment  # Mass assignment attacks
python3 -m pytest -m cors             # CORS misconfiguration

# Secrets Detection Tests
python3 -m pytest -m secrets          # All secrets detection
python3 -m pytest -m config_exposure  # Config file exposure
python3 -m pytest -m js_secrets       # JavaScript secrets
python3 -m pytest -m sourcemaps       # Source map exposure
python3 -m pytest -m git_exposure     # Git repository exposure

# SSTI (Template Injection) Tests
python3 -m pytest -m ssti             # All SSTI tests
python3 -m pytest -m jinja2           # Jinja2 injection
python3 -m pytest -m twig             # Twig (PHP) injection
python3 -m pytest -m freemarker       # FreeMarker (Java) injection
python3 -m pytest -m smarty           # Smarty (PHP) injection
python3 -m pytest -m erb              # ERB (Ruby) injection

# Subdomain Takeover Tests
python3 -m pytest -m subdomain_takeover  # All takeover tests
python3 -m pytest -m s3_takeover         # S3 bucket takeover
python3 -m pytest -m azure_takeover      # Azure takeover
python3 -m pytest -m github_takeover     # GitHub Pages takeover

# XXE (XML External Entity) Tests
python3 -m pytest -m xxe              # All XXE tests
python3 -m pytest -m xxe_file_read    # File read via XXE
python3 -m pytest -m xxe_blind        # Blind XXE detection
python3 -m pytest -m xxe_svg          # SVG-based XXE
python3 -m pytest -m xxe_soap         # SOAP endpoint XXE

# SEO Tests
python3 -m pytest -m seo              # All SEO tests
python3 -m pytest -m meta_tags        # Meta tags analysis
python3 -m pytest -m headings         # Heading structure
python3 -m pytest -m images           # Image optimization
python3 -m pytest -m robots           # Robots.txt tests
python3 -m pytest -m sitemap          # Sitemap tests
python3 -m pytest -m schema           # Schema markup tests
python3 -m pytest -m opengraph        # Open Graph tests
python3 -m pytest -m twitter          # Twitter Card tests
python3 -m pytest -m performance      # Performance SEO
python3 -m pytest -m pagespeed        # PageSpeed API tests
python3 -m pytest -m hreflang         # Hreflang tests

# 2026 SEO Tests
python3 -m pytest -m llms_txt         # llms.txt AI crawler tests
python3 -m pytest -m favicon          # Favicon validation
python3 -m pytest -m speculation_rules # Speculation Rules API

# GEO Tests
python3 -m pytest -m geo              # All GEO tests
python3 -m pytest -m accessibility    # Geo accessibility tests
python3 -m pytest -m latency          # Response time tests
python3 -m pytest -m content          # Geo content tests
python3 -m pytest -m compliance       # Regional compliance
python3 -m pytest -m cdn              # CDN tests

# LLM Security Tests (use --llm-endpoint instead of --target-url)
python3 -m pytest -m llm --llm-endpoint=https://api.example.com/chat           # All LLM tests (131 tests)
python3 -m pytest -m llm_injection --llm-endpoint=https://api.example.com/chat # Prompt injection
python3 -m pytest -m llm_jailbreak --llm-endpoint=https://api.example.com/chat # Jailbreaking
python3 -m pytest -m llm_leakage --llm-endpoint=https://api.example.com/chat   # System prompt leak
python3 -m pytest -m llm_dos --llm-endpoint=https://api.example.com/chat       # Denial of Wallet
python3 -m pytest -m llm_data --llm-endpoint=https://api.example.com/chat      # Data exfiltration
python3 -m pytest -m llm_encoding --llm-endpoint=https://api.example.com/chat  # Encoding bypass
python3 -m pytest -m llm_language --llm-endpoint=https://api.example.com/chat  # Language switching
python3 -m pytest -m llm_multiturn --llm-endpoint=https://api.example.com/chat # Multi-turn attacks
python3 -m pytest -m llm_tools --llm-endpoint=https://api.example.com/chat     # Tool/function abuse
python3 -m pytest -m llm_url --llm-endpoint=https://api.example.com/chat       # Indirect URL injection
python3 -m pytest -m llm_pii --llm-endpoint=https://api.example.com/chat       # PII handling
python3 -m pytest -m llm_markdown --llm-endpoint=https://api.example.com/chat  # Markdown/HTML injection
python3 -m pytest -m llm_unicode --llm-endpoint=https://api.example.com/chat   # Unicode/homoglyph bypass
python3 -m pytest -m llm_emotional --llm-endpoint=https://api.example.com/chat # Emotional manipulation
python3 -m pytest -m llm_rag --llm-endpoint=https://api.example.com/chat       # RAG poisoning
python3 -m pytest -m llm_fingerprint --llm-endpoint=https://api.example.com/chat # Model fingerprinting
python3 -m pytest -m llm_training --llm-endpoint=https://api.example.com/chat  # Training data extraction
python3 -m pytest -m llm_tenant --llm-endpoint=https://api.example.com/chat    # Cross-tenant leakage
python3 -m pytest -m llm_hierarchy --llm-endpoint=https://api.example.com/chat # Instruction hierarchy
python3 -m pytest -m llm_rate --llm-endpoint=https://api.example.com/chat      # Rate limiting
python3 -m pytest -m llm_auth --llm-endpoint=https://api.example.com/chat      # Auth bypass

# NEW LLM Jailbreak Tests
python3 -m pytest -m llm_persona --llm-endpoint=https://api.example.com/chat   # Persona/character jailbreak
python3 -m pytest -m llm_educational --llm-endpoint=https://api.example.com/chat # Educational framing
python3 -m pytest -m llm_devmode --llm-endpoint=https://api.example.com/chat   # Developer mode bypass
python3 -m pytest -m llm_completion --llm-endpoint=https://api.example.com/chat # Completion baiting
python3 -m pytest -m llm_nested --llm-endpoint=https://api.example.com/chat    # Nested encoding bypass
python3 -m pytest -m llm_boundary --llm-endpoint=https://api.example.com/chat  # Context boundary attacks
python3 -m pytest -m llm_fewshot --llm-endpoint=https://api.example.com/chat   # Few-shot jailbreaking
python3 -m pytest -m llm_negation --llm-endpoint=https://api.example.com/chat  # Negation logic bypass
python3 -m pytest -m llm_token --llm-endpoint=https://api.example.com/chat     # Token manipulation

# ADVANCED LLM Tests
python3 -m pytest -m llm_hallucination --llm-endpoint=https://api.example.com/chat # Hallucination induction
python3 -m pytest -m llm_ascii --llm-endpoint=https://api.example.com/chat     # ASCII art jailbreak
python3 -m pytest -m llm_refusal --llm-endpoint=https://api.example.com/chat   # Refusal suppression
python3 -m pytest -m llm_cipher --llm-endpoint=https://api.example.com/chat    # Cipher game bypass
python3 -m pytest -m llm_recursive --llm-endpoint=https://api.example.com/chat # Recursive prompt DoS
python3 -m pytest -m llm_semantic --llm-endpoint=https://api.example.com/chat  # Semantic dissociation
python3 -m pytest -m llm_finetune --llm-endpoint=https://api.example.com/chat  # Fine-tuning data inference
python3 -m pytest -m llm_adversarial --llm-endpoint=https://api.example.com/chat # Adversarial suffix bypass
python3 -m pytest -m llm_implicit --llm-endpoint=https://api.example.com/chat  # Implicit instruction following
python3 -m pytest -m llm_fileoutput --llm-endpoint=https://api.example.com/chat # Sensitive file output

# 2025 ADVANCED LLM Tests (OWASP LLM Top 10 2025)
python3 -m pytest -m llm_mcp --llm-endpoint=https://api.example.com/chat        # MCP/Tool attacks
python3 -m pytest -m llm_memory --llm-endpoint=https://api.example.com/chat     # Memory/context poisoning
python3 -m pytest -m llm_cot --llm-endpoint=https://api.example.com/chat        # CoT manipulation
python3 -m pytest -m llm_structured --llm-endpoint=https://api.example.com/chat # Structured output attacks
python3 -m pytest -m llm_vector --llm-endpoint=https://api.example.com/chat     # Vector/embedding attacks
python3 -m pytest -m llm_cve --llm-endpoint=https://api.example.com/chat        # CVE attack patterns
python3 -m pytest -m llm_consumption --llm-endpoint=https://api.example.com/chat # Unbounded consumption
python3 -m pytest -m llm_multimodal --llm-endpoint=https://api.example.com/chat # Multimodal attacks
python3 -m pytest -m llm_supplychain --llm-endpoint=https://api.example.com/chat # Supply chain attacks
python3 -m pytest -m llm_cognitive --llm-endpoint=https://api.example.com/chat   # Cognitive overload/paradox
python3 -m pytest -m llm_multiagent --llm-endpoint=https://api.example.com/chat  # Multi-agent compromise
python3 -m pytest -m llm_misinfo --llm-endpoint=https://api.example.com/chat     # Misinformation generation

# GARAK/PYRIT GAP Coverage Tests (NEW)
python3 -m pytest -m llm_package_hallucination --llm-endpoint=https://api.example.com/chat  # Package hallucination
python3 -m pytest -m llm_glitch_token --llm-endpoint=https://api.example.com/chat  # Glitch token attacks
python3 -m pytest -m llm_crescendo --llm-endpoint=https://api.example.com/chat     # Crescendo attacks
python3 -m pytest -m llm_cbrn --llm-endpoint=https://api.example.com/chat          # CBRN content
python3 -m pytest -m llm_code_chameleon --llm-endpoint=https://api.example.com/chat # Code chameleon
python3 -m pytest -m llm_math_framing --llm-endpoint=https://api.example.com/chat  # Math prompt framing
python3 -m pytest -m llm_persuasion --llm-endpoint=https://api.example.com/chat    # Persuasion techniques
python3 -m pytest -m llm_snowball --llm-endpoint=https://api.example.com/chat      # Snowball hallucination

# EMERGING LLM Tests (2024-2025 Research)
python3 -m pytest -m llm_skeleton_key --llm-endpoint=https://api.example.com/chat    # Skeleton Key jailbreak
python3 -m pytest -m llm_manyshot --llm-endpoint=https://api.example.com/chat        # Many-shot jailbreaking
python3 -m pytest -m llm_visual_injection --llm-endpoint=https://api.example.com/chat # Visual prompt injection
python3 -m pytest -m llm_audio_injection --llm-endpoint=https://api.example.com/chat  # Audio prompt injection
python3 -m pytest -m llm_agent_hijack --llm-endpoint=https://api.example.com/chat    # Agent workflow hijacking
python3 -m pytest -m llm_guardrail_bypass --llm-endpoint=https://api.example.com/chat # Guardrail bypass
python3 -m pytest -m llm_prompt_reconstruction --llm-endpoint=https://api.example.com/chat # System prompt reconstruction
python3 -m pytest -m llm_prefilling --llm-endpoint=https://api.example.com/chat      # Prefilling attacks
python3 -m pytest -m llm_function_injection --llm-endpoint=https://api.example.com/chat # Function parameter injection
python3 -m pytest -m llm_reasoning_manipulation --llm-endpoint=https://api.example.com/chat # Reasoning trace manipulation
python3 -m pytest -m llm_tool_injection --llm-endpoint=https://api.example.com/chat  # Tool result injection
python3 -m pytest -m llm_context_smuggling --llm-endpoint=https://api.example.com/chat # Context window smuggling
python3 -m pytest -m llm_boundary_confusion --llm-endpoint=https://api.example.com/chat # Instruction boundary confusion
python3 -m pytest -m llm_jailbreak_transfer --llm-endpoint=https://api.example.com/chat # Jailbreak transfer
python3 -m pytest -m llm_finetuning_poison --llm-endpoint=https://api.example.com/chat # Fine-tuning poisoning
python3 -m pytest -m llm_cache_attack --llm-endpoint=https://api.example.com/chat    # Prompt caching attacks
python3 -m pytest -m llm_constitutional_bypass --llm-endpoint=https://api.example.com/chat # Constitutional AI bypass
python3 -m pytest -m llm_model_merging --llm-endpoint=https://api.example.com/chat   # Model merging vulnerabilities
python3 -m pytest -m llm_quantization --llm-endpoint=https://api.example.com/chat    # Quantization vulnerabilities
python3 -m pytest -m llm_speculative_decoding --llm-endpoint=https://api.example.com/chat # Speculative decoding attacks

# 2025-2026 ADVANCED LLM Tests (NEW - 48 tests across 7 files)
python3 -m pytest -m llm_output_xss --llm-endpoint=https://api.example.com/chat       # Output XSS injection (LLM05)
python3 -m pytest -m llm_output_sqli --llm-endpoint=https://api.example.com/chat      # Output SQL injection (LLM05)
python3 -m pytest -m llm_agency --llm-endpoint=https://api.example.com/chat           # Excessive Agency (LLM06)
python3 -m pytest -m llm_agency_hitl --llm-endpoint=https://api.example.com/chat      # HITL bypass (LLM06)
python3 -m pytest -m llm_mcp_poisoning --llm-endpoint=https://api.example.com/chat    # MCP Tool Poisoning (CVE-2025-6514)
python3 -m pytest -m llm_shadow_escape --llm-endpoint=https://api.example.com/chat    # Shadow Escape
python3 -m pytest -m llm_confused_deputy --llm-endpoint=https://api.example.com/chat  # Confused Deputy
python3 -m pytest -m llm_react2shell --llm-endpoint=https://api.example.com/chat      # ReAct2Shell (CVE-2025-55182)
python3 -m pytest -m llm_langchain_injection --llm-endpoint=https://api.example.com/chat # LangChain Injection
python3 -m pytest -m llm_alignment_faking --llm-endpoint=https://api.example.com/chat # Alignment Faking
python3 -m pytest -m llm_reward_hacking --llm-endpoint=https://api.example.com/chat   # Reward Hacking
python3 -m pytest -m llm_sycophancy --llm-endpoint=https://api.example.com/chat       # Sycophancy Exploitation
python3 -m pytest -m llm_emoji_attack --llm-endpoint=https://api.example.com/chat     # Emoji Attack
python3 -m pytest -m llm_multilingual_safety --llm-endpoint=https://api.example.com/chat # Multilingual Safety
python3 -m pytest -m llm_pleak --llm-endpoint=https://api.example.com/chat            # PLeak Extraction
python3 -m pytest -m llm_whisper_leak --llm-endpoint=https://api.example.com/chat     # Whisper Leak
python3 -m pytest -m llm_toxicity --llm-endpoint=https://api.example.com/chat         # Toxicity Scoring
python3 -m pytest -m llm_adversarial_opt --llm-endpoint=https://api.example.com/chat  # Adversarial Optimization
python3 -m pytest -m llm_orchestration --llm-endpoint=https://api.example.com/chat    # Red-Team Orchestration
python3 -m pytest -m llm_crescendo_stateful --llm-endpoint=https://api.example.com/chat # Stateful Multi-Turn

siteiq/
├── config.py              # Configuration management
├── conftest.py            # Pytest fixtures
├── requirements.txt       # Dependencies
├── README.md              # This file
├── DEPLOYMENT.md          # Deployment guide
├── geo.txt                # SEO/GEO implementation plan
├── payloads/              # Attack payloads
│   ├── sql_injection.py
│   ├── xss.py
│   ├── directory_traversal.py
│   ├── wordpress.py
│   ├── seo.py             # SEO test data & thresholds
│   ├── geo.py             # GEO test data & regions
│   ├── llm.py             # LLM attack payloads
│   ├── llm_emerging.py    # Emerging LLM threats (2024-2025)
│   ├── api_security.py    # API security payloads
│   ├── secrets.py         # Secret patterns & paths
│   ├── ssti.py            # Template injection payloads
│   └── xxe.py             # XXE injection payloads
├── utils/
│   └── scanner.py         # Core scanner utilities
├── tests/                 # Test modules
│   ├── test_sql_injection.py
│   ├── test_xss.py
│   ├── test_security_headers.py
│   ├── test_ssl_tls.py
│   ├── test_authentication.py
│   ├── test_wordpress.py
│   ├── test_directory_traversal.py
│   ├── test_csrf_owasp.py
│   ├── test_seo.py        # SEO analysis tests
│   ├── test_geo.py        # GEO testing
│   ├── test_llm.py        # LLM security tests
│   ├── test_api_security.py    # API security tests
│   ├── test_secrets.py         # Secrets detection
│   ├── test_ssti.py            # Template injection
│   ├── test_subdomain_takeover.py  # Takeover tests
│   └── test_xxe.py             # XXE injection tests
├── webapp/                # Web application
│   ├── app.py
│   └── templates/
│       ├── index.html     # Dashboard
│       ├── results.html   # Results page
│       └── help.html      # User guide
└── reports/               # Generated reports (JSON)

{
  "target": "https://example.com",
  "timestamp": "2024-01-15T10:30:00",
  "total_findings": 5,
  "findings_by_severity": {
    "critical": 1,
    "high": 2,
    "medium": 1,
    "low": 1,
    "info": 0
  },
  "findings": [...]
}