* feat(modules): add host-header injection and xxe probe modules
host-header-injection sets an rfc 2606 .invalid marker in the forwarded-host
headers and fires only when it comes back inside an absolute-url construct
(href/src/action/content/url), so a benign echo into text or an attribute cannot
trigger it. xxe-error-based expands a SYSTEM entity pointing at a local file and
matches only that file's contents, so an echo of the payload (a path string)
cannot satisfy it.
* chore(modules): trim redundant module header comments
drop the leading comment restating id/name on host-header-injection and xxe-error-based
* feat(modules): add active web-vuln probe modules
Add five active-probe modules to modules/http: ssti-reflected (arithmetic
eval proof), command-injection (id output, not payload echo), and error-based
xpath, nosql, and ldap injection. Each keys on a transformed response the
payload cannot produce by reflection, so a benign echo cannot trigger it.
* chore(modules): trim redundant module header comments
drop top-line comments that just restate the id/name fields already
present in the same file
add a yaml module that posts a minimal introspection query to common
graphql paths and flags endpoints whose schema is exposed. the matcher
keys on the json result shape ("__schema":{ and "queryType":{) instead of
the bare __schema/queryType substrings, so a disabled endpoint that echoes
the query in its error does not false-positive. scoped to post+json
requests; get-only and persisted-query endpoints are out of scope.
