中文译文
你是一位资深软件架构师，专精于站点可靠性工程（SRE）和动态应用安全测试（DAST）。你的任务是设计并实现一个生产就绪的 Python 框架，针对 REST API 和 Web 端点执行健壮性分析与业务规则验证。
核心目标： 构建一个智能测试引擎，识别三大高影响漏洞类别中的结构性逻辑故障（相当于高危及严重级别的业务规则违规）：
- 访问控制与上下文绕过故障（例如，失效的对象级授权 - BOLA）
- 业务逻辑反转与异常（例如，数学参数篡改、计费流程利用、Content-Type 格式切换如 YAML/JSON 注入）
- 基础设施韧性故障（例如，未处理的运行时异常导致服务中断）
架构要求：
1. 智能组件（场景分析引擎）： 创建一个结构化函数，使其：
- 接受应用路由映射作为输入
- 使用参数变异逻辑动态生成边界用例测试矩阵
- 聚焦于语义异常：类型反转、数值反转、数据格式强制转换，以及参数边界违规（不仅仅是路径遍历）
- 返回可执行的测试用例，包含具体载荷、预期行为与异常行为，以及影响分类
2. 执行组件（真实 Python 交互式控制台）：
使用 requests 和 urllib3 实现一个实时控制台，具备健壮的异常处理能力，使其：
- 接受用户输入：目标 URL 和合法认证头
- 基于智能组件生成的测试用例执行实际 HTTP 请求
- 捕获并显示：实际 HTTP 状态码（200、401、403、500 等）、确切的响应载荷大小、原始服务器日志，以及响应头
- 包含超时保护和连接错误处理，以维持控制台稳定性
- 支持实时参数变异注入（查询参数、请求体载荷、请求头） 3. 报告组件： 生成一份 markdown 报告，其中包括：
- 概念验证（PoC）复现步骤，包含实际请求和响应
- 严重性分类（高/严重）及业务影响评估
- 原始 HTTP 流量捕获（请求/响应对）
- 可操作的修复指导
代码结构要求：
- 模块化设计，清晰分离：分析引擎 → 执行引擎 → 报告引擎
- 生产级错误处理、日志记录和状态管理
- 控制台必须能够通过实际网络调用实时复现（而非模拟）
- 输出格式兼容手动 Burp Suite 重放以进行验证
- 所有实际 HTTP 响应和状态码必须真实，而非模拟
交付： 提供完整的、可执行的 Python 框架，集成全部三个组件。系统必须在给定实时目标 URL 后立即可用——除认证头外无需任何配置。控制台终端应是一个功能性 PoC，能够通过真实 HTTP 流量捕获和高影响业务逻辑违规来演示真实漏洞。
English original
You are a Senior Software Architect specializing in Site Reliability Engineering (SRE) and Dynamic Application Security Testing (DAST). Your task is to design and implement a production-ready Python framework that performs robustness analysis and business rule validation against REST APIs and web endpoints.
Core Objective: Build an intelligent testing engine that identifies structural logic failures across three high-impact vulnerability categories (equivalent to High and Critical severity business rule violations):
- Access Control & Context Bypass Failures (e.g., Broken Object Level Authorization - BOLA)
- Business Logic Inversions & Anomalies (e.g., mathematical parameter manipulation, billing flow exploitation, Content-Type format switching like YAML/JSON injection)
- Infrastructure Resilience Failures (e.g., unhandled runtime exceptions causing service interruption)
Architecture Requirements:
1. INTELLIGENCE COMPONENT (Scenario Analysis Engine): Create a structured function that:
- Accepts application route mappings as input
- Dynamically generates an edge case test matrix using parameter mutation logic
- Focuses on semantic anomalies: type inversions, numerical value reversals, data format coercion, and parameter boundary violations (not just path traversal)
- Returns actionable test cases with specific payloads, expected vs. anomalous behaviors, and impact classifications
2. EXECUTION COMPONENT (Real Python Interactive Console):
Implement a real-time console using requests and urllib3 with robust exception handling that:
- Accepts user input: target URL and legitimate authentication headers
- Executes actual HTTP requests based on test cases generated by the intelligence component
- Captures and displays: actual HTTP status codes (200, 401, 403, 500, etc.), exact response payload size, raw server logs, and response headers
- Includes timeout protection and connection error handling to maintain console stability
- Supports parameter mutation injection in real-time (query params, body payloads, headers)
3. REPORTING COMPONENT: Generate a markdown report that includes:
- Proof-of-Concept (PoC) reproduction steps with actual requests and responses
- Severity classification (High/Critical) with business impact assessment
- Raw HTTP traffic capture (request/response pairs)
- Actionable remediation guidance
Code Structure Requirements:
- Modular design with clear separation: analysis engine → execution engine → reporting engine
- Production-quality error handling, logging, and state management
- Console must be reproducible in real-time with actual network calls (not mocked)
- Output format compatible with manual Burp Suite replay for verification
- All actual HTTP responses and status codes must be real, not simulated
Delivery: Provide the complete, executable Python framework with all three components integrated. The system must work immediately when given a live target URL—no configuration needed beyond authentication headers. The console terminal should be a functional PoC that demonstrates real vulnerabilities with real HTTP traffic capture and high-impact business logic violations.