[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_278":279,"_280":281},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_209":-5,"_20":210,"_22":211,"_212":213,"_214":215,"_26":216,"_24":217,"_218":-5,"_219":-5,"_220":55,"_221":222,"_223":46,"_224":-5,"_225":-5,"_226":227},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","johnreaver","name","Pentester","branchName","main","version","path","frontend/components","project",{"_34":151,"_13":14,"_47":152,"_153":-5,"_154":55,"_155":156,"_157":156,"_158":159,"_160":-5,"_161":162,"_163":70,"_164":46,"_165":-5,"_166":-5,"_167":49,"_168":169,"_170":171,"_172":173,"_174":175,"_176":-5,"_177":178,"_179":178,"_180":181,"_182":181,"_183":181,"_184":178,"_185":178,"_186":187,"_188":189,"_190":191,"_192":55},"tree",[65,66,67],"file",{"_34":60,"_13":59,"_37":40,"_39":61,"_41":42,"_43":44,"_45":46,"_47":62,"_17":49,"_50":63,"_52":-5,"_54":55,"_56":-5,"_18":64},"contents",[33],"upstream","pull","ahead","behind","envVars",{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":57},"id","df1d314f-595e-4018-bd4b-710e34939bd4","App.tsx","fileId","9c062ec0-8d93-11f1-b900-1607ee4eb77e","parentId","cdb40789-02a5-4c52-86e6-628f3f2a4126","branchId","f2cc7821-6613-4833-a0ba-f0db8282379f","branchVersion",8,"latest",true,"createdAt",["D",1785580054240],0,"fileType","script","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState, useEffect, useCallback } from \"https://esm.sh/react@18.2.0\";\n\n// ============ Types ============\ninterface ScanModuleInfo { id: string; name: string; description: string; icon: string; }\ninterface ScanSummary { total: number; critical: number; high: number; medium: number; low: number; info: number; }\ninterface ScanInfo {\n id: number; target: string; status: string; startedAt: string; completedAt: string | null;\n modulesRun: string[]; summary: ScanSummary | null; aiAnalysis: string | null; error: string | null;\n}\ninterface VulnInfo {\n id: number; scanId: number; module: string; title: string; severity: string;\n description: string; evidence: string; recommendation: string; cwe: string | null; url: string | null;\n}\n\ntype View = \"dashboard\" | \"newScan\" | \"results\" | \"report\";\n\nconst SEV_COLORS: Record = {\n critical: \"bg-red-500/20 text-red-400 border-red-500/30\",\n high: \"bg-orange-500/20 text-orange-400 border-orange-500/30\",\n medium: \"bg-yellow-500/20 text-yellow-400 border-yellow-500/30\",\n low: \"bg-blue-500/20 text-blue-400 border-blue-500/30\",\n info: \"bg-gray-500/20 text-gray-400 border-gray-500/30\",\n};\nconst SEV_EMOJI: Record = { critical: \"🔴\", high: \"🟠\", medium: \"🟡\", low: \"🔵\", info: \"⚪\" };\n\n// ============ Main App ============\nexport function App() {\n const [view, setView] = useState(\"dashboard\");\n const [scans, setScans] = useState([]);\n const [currentScan, setCurrentScan] = useState(null);\n const [vulns, setVulns] = useState([]);\n const [modules, setModules] = useState([]);\n const [loading, setLoading] = useState(false);\n const [error, setError] = useState(null);\n const [report, setReport] = useState(\"\");\n\n const fetchScans = useCallback(async () => {\n try {\n const res = await fetch(\"/api/scans\");\n const data = await res.json();\n setScans(data.scans ?? []);\n } catch (e) { setError(\"Failed to load scans\"); }\n }, []);\n\n const fetchModules = useCallback(async () => {\n try {\n const res = await fetch(\"/api/modules\");\n const data = await res.json();\n setModules(data.modules ?? []);\n } catch (e) { setError(\"Failed to load modules\"); }\n }, []);\n\n useEffect(() => { fetchScans(); fetchModules(); }, []);\n\n const startScan = async (target: string, selectedModules: string[]) => {\n setLoading(true);\n setError(null);\n try {\n const res = await fetch(\"/api/scan\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ target, modules: selectedModules }),\n });\n const data = await res.json();\n if (data.error) { setError(data.error); setLoading(false); return; }\n // Poll for completion\n const scanId = data.scanId;\n const poll = async () => {\n const r = await fetch(`/api/scan/${scanId}`);\n const d = await r.json();\n if (d.scan) {\n setCurrentScan(d.scan);\n if (d.scan.status === \"completed\" || d.scan.status === \"failed\") {\n setLoading(false);\n if (d.scan.status === \"completed\") {\n const vr = await fetch(`/api/scan/${scanId}/vulnerabilities`);\n const vd = await vr.json();\n setVulns(vd.vulnerabilities ?? []);\n setView(\"results\");\n }\n fetchScans();\n return;\n }\n }\n setTimeout(poll, 2000);\n };\n setTimeout(poll, 2000);\n } catch (e) { setError(\"Failed to start scan\"); setLoading(false); }\n };\n\n const viewScanResults = async (scan: ScanInfo) => {\n setCurrentScan(scan);\n try {\n const res = await fetch(`/api/scan/${scan.id}/vulnerabilities`);\n const data = await res.json();\n setVulns(data.vulnerabilities ?? []);\n setView(\"results\");\n } catch { setError(\"Failed to load results\"); }\n };\n\n const viewReport = async () => {\n if (!currentScan) return;\n try {\n const res = await fetch(`/api/scan/${currentScan.id}/report`);\n const data = await res.json();\n setReport(data.report ?? \"\");\n setView(\"report\");\n } catch { setError(\"Failed to load report\"); }\n };\n\n const deleteScan = async (id: number) => {\n if (!confirm(\"Delete this scan?\")) return;\n await fetch(`/api/scan/${id}`, { method: \"DELETE\" });\n fetchScans();\n if (currentScan?.id === id) { setView(\"dashboard\"); setCurrentScan(null); }\n };\n\n // ============ Render ============\n return (\n

\n {/* Header */}\n

{ setView(\"dashboard\"); fetchScans(); }}>\n 🛡️\n

Autonomous Pentest Platform

AI-powered vulnerability scanning

\n \n

\n\n {error && (\n

\n ⚠️ {error}\n \n

\n )}\n\n

\n {view === \"dashboard\" && setView(\"newScan\")} />}\n {view === \"newScan\" && setView(\"dashboard\")} />}\n {view === \"results\" && currentScan && { setView(\"dashboard\"); fetchScans(); }} />}\n {view === \"report\" && currentScan && setView(\"results\")} />}\n

\n );\n}\n\n// ============ Dashboard ============\nfunction Dashboard({ scans, onView, onDelete, onNew }: {\n scans: ScanInfo[]; onView: (s: ScanInfo) => void; onDelete: (id: number) => void; onNew: () => void;\n}) {\n const totalVulns = scans.reduce((acc, s) => acc + (s.summary?.total ?? 0), 0);\n const totalCritical = scans.reduce((acc, s) => acc + (s.summary?.critical ?? 0), 0);\n const totalHigh = scans.reduce((acc, s) => acc + (s.summary?.high ?? 0), 0);\n\n return (\n

\n {/* Stats */}\n

\n \n \n \n \n

\n\n {/* New Scan button */}\n \n\n {/* Scans list */}\n

Recent Scans

\n {scans.length === 0 ? (\n

🔍

No scans yet. Start your first scan!

\n ) : (\n

\n {scans.map(scan => (\n

scan.status === \"completed\" ? onView(scan) : null}>\n

\n {scan.status}\n {scan.target}\n

\n {scan.summary && (\n

\n 🔴 {scan.summary.critical}\n 🟠 {scan.summary.high}\n 🟡 {scan.summary.medium}\n 🔵 {scan.summary.low}\n ⚪ {scan.summary.info}\n

\n )}\n {scan.error &&

{scan.error}

}\n

{new Date(scan.startedAt).toLocaleString()}

\n {scan.status === \"completed\" && (\n \n )}\n \n

\n ))}\n

\n )}\n

\n );\n}\n\n// ============ Scan Form ============\nfunction ScanForm({ modules, onStart, loading, onBack }: {\n modules: ScanModuleInfo[]; onStart: (target: string, modules: string[]) => void; loading: boolean; onBack: () => void;\n}) {\n const [target, setTarget] = useState(\"\");\n const [selected, setSelected] = useState(modules.map(m => m.id));\n\n useEffect(() => {\n if (modules.length > 0 && selected.length === 0) setSelected(modules.map(m => m.id));\n }, [modules]);\n\n const toggle = (id: string) => {\n setSelected(prev => prev.includes(id) ? prev.filter(x => x !== id) : [...prev, id]);\n };\n\n return (\n

\n \n

New Scan

Enter a target URL and select scanning modules.

\n\n

\n Target URL\n setTarget(e.target.value)}\n onKeyDown={(e) => { if (e.key === \"Enter\" && target && selected.length > 0 && !loading) onStart(target, selected); }}\n placeholder=\"example.com or https://example.com\"\n className=\"w-full bg-gray-800 border border-gray-700 rounded-lg px-4 py-3 text-white placeholder-gray-600 focus:border-blue-500 focus:outline-none\"\n />\n

⚠️ Only scan targets you own or have permission to test.

\n\n

Scanning Modules

\n {modules.map(m => (\n \n toggle(m.id)} className=\"mt-1 accent-blue-500\" />\n

\n {m.icon}\n {m.name}\n

{m.description}

\n \n ))}\n

\n\n target && selected.length > 0 && onStart(target, selected)}\n disabled={!target || selected.length === 0 || loading}\n className=\"w-full bg-blue-600 hover:bg-blue-700 disabled:bg-gray-700 disabled:cursor-not-allowed text-white font-medium py-3 rounded-xl transition flex items-center justify-center gap-2\"\n >\n {loading ? (\n <>⏳ Scanning... This may take 30-60 seconds\n ) : (\n <>🚀 Start Scan ({selected.length} modules)\n )}\n \n

\n );\n}\n\n// ============ Results ============\nfunction Results({ scan, vulns, onReport, onBack }: {\n scan: ScanInfo; vulns: VulnInfo[]; onReport: () => void; onBack: () => void;\n}) {\n const [filter, setFilter] = useState(\"all\");\n const [expanded, setExpanded] = useState(null);\n\n const filtered = filter === \"all\" ? vulns : vulns.filter(v => v.severity === filter);\n const s = scan.summary;\n\n return (\n

\n \n\n {/* Scan header */}\n

{scan.target}

Scan #{scan.id} · {new Date(scan.startedAt).toLocaleString()}

\n {s && (\n

\n \n \n \n \n \n

\n )}\n

\n \n

\n\n {/* Filter buttons */}\n

\n setFilter(\"all\")} label={`All (${vulns.length})`} />\n {[\"critical\", \"high\", \"medium\", \"low\", \"info\"].map(sev => {\n const count = vulns.filter(v => v.severity === sev).length;\n if (count === 0) return null;\n return setFilter(sev)} label={`${SEV_EMOJI[sev]} ${sev} (${count})`} />;\n })}\n

\n\n {/* Vulnerabilities */}\n {filtered.length === 0 ? (\n

✅

No vulnerabilities found with this filter.

\n ) : (\n

\n {filtered.map(v => (\n

\n setExpanded(expanded === v.id ? null : v.id)}\n >\n

\n {v.severity.toUpperCase()}\n {v.module}\n {v.title}\n {expanded === v.id ? \"▲\" : \"▼\"}\n

\n {expanded === v.id && (\n

\n \n \n \n {v.url && }\n \n

\n )}\n

\n ))}\n

\n )}\n \n );\n}\n\n// ============ Report View ============\nfunction ReportView({ scan, report, onBack }: { scan: ScanInfo; report: string; onBack: () => void }) {\n return (\n

\n \n

📄 Security Report — {scan.target}

\n \n

{report}

\n\n {/* AI Analysis */}\n {scan.aiAnalysis && (\n

🤖 AI Analysis

{scan.aiAnalysis}

\n )}\n

\n );\n}\n\n// ============ Small Components ============\nfunction StatCard({ label, value, icon, color }: { label: string; value: number; icon: string; color: string }) {\n return (\n

\n {icon}\n {value}\n

{label}

\n );\n}\n\nfunction SevBadge({ label, count, severity }: { label: string; count: number; severity: string }) {\n return (\n

{count}

{label}

\n );\n}\n\nfunction FilterBtn({ active, onClick, label }: { active: boolean; onClick: () => void; label: string }) {\n return (\n \n );\n}\n\nfunction Field({ label, value, mono, link }: { label: string; value: string; mono?: boolean; link?: boolean }) {\n return (\n

{label}

\n {link ? (\n {value}\n ) : (\n

{value}

\n )}\n

\n );\n}\n","deleted",false,"label",[58,59,36],"frontend","components","391d34bb-33cb-4e83-8bb1-9e37a379881e","812edd43-9ed5-49c0-8e1a-3b6acf548d9f",["D",1785580054240],"directory",[58,59],{"_34":121,"_13":58,"_37":61,"_39":-5,"_41":42,"_43":122,"_45":46,"_47":123,"_17":49,"_50":63,"_52":-5,"_54":55,"_56":-5,"_76":124,"_18":125},{"_34":79,"_13":80,"_37":81,"_39":-5,"_41":42,"_43":73,"_45":46,"_47":82,"_17":49,"_50":63,"_52":-5,"_54":55,"_56":-5,"_76":83,"_18":84},{"_34":68,"_13":69,"_37":70,"_39":-5,"_41":42,"_43":71,"_45":46,"_47":72,"_17":73,"_50":74,"_52":75,"_54":55,"_56":-5,"_76":77,"_18":78},"4cde5600-78d3-4013-93c5-9374042eb2df","main.ts","794ec406-8d92-11f1-a6c0-1607ee4eb77e",10,["D",1785580074081],2,"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\nimport {\n initDB, createScan, updateScanStatus, completeScan, addVulnerability,\n getScan, listScans, getVulnerabilities, deleteScan, computeSummary,\n} from \"./lib/db.ts\";\nimport { runScan, AVAILABLE_MODULES } from \"./lib/scanner.ts\";\nimport { analyzeFindings } from \"./lib/ai.ts\";\nimport { buildReport, formatMarkdownReport } from \"./lib/report.ts\";\n\n// Initialize database on first request\nlet dbInitialized = false;\nasync function ensureDB() {\n if (!dbInitialized) {\n await initDB();\n dbInitialized = true;\n }\n}\n\nconst app = new Hono();\n\n// ============ Frontend ============\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ============ API: Modules ============\napp.get(\"/api/modules\", (c) => {\n return c.json({ modules: AVAILABLE_MODULES });\n});\n\n// ============ API: List scans ============\napp.get(\"/api/scans\", async (c) => {\n await ensureDB();\n const scans = await listScans();\n return c.json({ scans });\n});\n\n// ============ API: Get scan ============\napp.get(\"/api/scan/:id\", async (c) => {\n await ensureDB();\n const id = parseInt(c.req.param(\"id\"));\n const scan = await getScan(id);\n if (!scan) return c.json({ error: \"Scan not found\" }, 404);\n return c.json({ scan });\n});\n\n// ============ API: Start scan ============\napp.post(\"/api/scan\", async (c) => {\n await ensureDB();\n const body = await c.req.json();\n const target = body?.target?.trim();\n const modules = body?.modules ?? [];\n\n if (!target) return c.json({ error: \"Target URL is required\" }, 400);\n if (!modules || modules.length === 0) return c.json({ error: \"Select at least one module\" }, 400);\n\n // Create scan record\n const scanId = await createScan(target, modules);\n await updateScanStatus(scanId, \"running\");\n\n try {\n // Run the scan\n const findings = await runScan(target, modules);\n\n // Store vulnerabilities\n for (const f of findings) {\n await addVulnerability({\n scanId,\n module: f.module,\n title: f.title,\n severity: f.severity,\n description: f.description,\n evidence: f.evidence,\n recommendation: f.recommendation,\n cwe: f.cwe,\n url: f.url,\n });\n }\n\n // Compute summary\n const vulns = await getVulnerabilities(scanId);\n const summary = computeSummary(vulns);\n\n // AI analysis\n const aiAnalysis = await analyzeFindings(target, vulns, summary);\n\n // Complete the scan\n await completeScan(scanId, summary, aiAnalysis);\n\n return c.json({ scanId, status: \"completed\", summary });\n } catch (err) {\n console.error(\"Scan failed:\", err);\n await updateScanStatus(scanId, \"failed\", String(err));\n return c.json({ scanId, status: \"failed\", error: String(err) }, 500);\n }\n});\n\n// ============ API: Get vulnerabilities ============\napp.get(\"/api/scan/:id/vulnerabilities\", async (c) => {\n await ensureDB();\n const id = parseInt(c.req.param(\"id\"));\n const vulnerabilities = await getVulnerabilities(id);\n return c.json({ vulnerabilities });\n});\n\n// ============ API: Get report ============\napp.get(\"/api/scan/:id/report\", async (c) => {\n await ensureDB();\n const id = parseInt(c.req.param(\"id\"));\n const scan = await getScan(id);\n if (!scan) return c.json({ error: \"Scan not found\" }, 404);\n const vulns = await getVulnerabilities(id);\n const report = buildReport(scan, vulns);\n const markdown = formatMarkdownReport(report);\n return c.json({ report: markdown });\n});\n\n// ============ API: Delete scan ============\napp.delete(\"/api/scan/:id\", async (c) => {\n await ensureDB();\n const id = parseInt(c.req.param(\"id\"));\n await deleteScan(id);\n return c.json({ success: true });\n});\n\n// Unwrap and rethrow errors\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","children",[],[69],"a178eb84-3957-4afe-8695-0a74be8bfccb","lib","f6775acb-8e59-4b4e-aa6c-997c86ecd260",["D",1785579805630],[85,86,87,88],[80],{"_34":114,"_13":115,"_37":116,"_39":81,"_41":42,"_43":73,"_45":46,"_47":117,"_17":49,"_50":51,"_52":118,"_54":55,"_56":-5,"_76":119,"_18":120},{"_34":106,"_13":107,"_37":108,"_39":81,"_41":42,"_43":109,"_45":46,"_47":110,"_17":49,"_50":51,"_52":111,"_54":55,"_56":-5,"_76":112,"_18":113},{"_34":98,"_13":99,"_37":100,"_39":81,"_41":42,"_43":101,"_45":46,"_47":102,"_17":49,"_50":51,"_52":103,"_54":55,"_56":-5,"_76":104,"_18":105},{"_34":89,"_13":90,"_37":91,"_39":81,"_41":42,"_43":92,"_45":46,"_47":93,"_17":94,"_50":51,"_52":95,"_54":55,"_56":-5,"_76":96,"_18":97},"5a79c023-725f-4566-9048-b303e9eb0262","scanner.ts","712b6594-8d93-11f1-ae1f-1607ee4eb77e",11,["D",1785580092727],1,"import type { Severity } from \"./db.ts\";\n\n// ============ Types ============\nexport interface VulnFinding {\n module: string;\n title: string;\n severity: Severity;\n description: string;\n evidence: string;\n recommendation: string;\n cwe: string | null;\n url: string | null;\n}\n\nexport interface ScanModule {\n id: string;\n name: string;\n description: string;\n icon: string;\n}\n\nexport const AVAILABLE_MODULES: ScanModule[] = [\n { id: \"headers\", name: \"Security Headers\", description: \"HTTP security headers analysis\", icon: \"📋\" },\n { id: \"ssl\", name: \"SSL/TLS\", description: \"SSL/TLS and HTTPS enforcement\", icon: \"🔒\" },\n { id: \"disclosure\", name: \"Info Disclosure\", description: \"Exposed files and sensitive paths\", icon: \"📂\" },\n { id: \"owasp\", name: \"OWASP Top 10\", description: \"SQLi, XSS, CORS, path traversal\", icon: \"🎯\" },\n { id: \"fingerprint\", name: \"Tech Fingerprint\", description: \"Server, framework & CMS detection\", icon: \"🔍\" },\n { id: \"ports\", name: \"Port Scanner\", description: \"Common web ports enumeration\", icon: \"🔌\" },\n { id: \"dns\", name: \"DNS Analysis\", description: \"DNS records & subdomain discovery\", icon: \"🌐\" },\n { id: \"cookies\", name: \"Cookie Security\", description: \"Cookie flags & security analysis\", icon: \"🍪\" },\n];\n\nconst TIMEOUT_MS = 8000;\nconst USER_AGENT = \"AutonomousPentest/1.0 (+https://val.town)\";\n\nfunction normalizeUrl(target: string): string {\n let url = target.trim();\n if (!url.startsWith(\"http://\") && !url.startsWith(\"https://\")) {\n url = \"https://\" + url;\n }\n return url;\n}\n\nfunction getOrigin(url: string): string {\n try {\n const u = new URL(url);\n return `${u.protocol}//${u.host}`;\n } catch {\n return url;\n }\n}\n\nfunction getHostname(url: string): string {\n try {\n return new URL(url).hostname;\n } catch {\n return url;\n }\n}\n\nasync function safeFetch(url: string, opts: RequestInit = {}): Promise {\n try {\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), TIMEOUT_MS);\n const response = await fetch(url, {\n ...opts,\n signal: controller.signal,\n headers: { \"User-Agent\": USER_AGENT, ...(opts.headers ?? {}) },\n redirect: \"follow\",\n });\n clearTimeout(timeoutId);\n return response;\n } catch {\n return null;\n }\n}\n\n// ============ Module: Security Headers ============\nasync function scanHeaders(url: string): Promise {\n const findings: VulnFinding[] = [];\n const response = await safeFetch(url);\n if (!response) return findings;\n\n const headers: Record = {};\n response.headers.forEach((value, key) => { headers[key.toLowerCase()] = value; });\n\n const checks = [\n { h: \"content-security-policy\", sev: \"high\" as Severity, title: \"Missing Content-Security-Policy\", cwe: \"CWE-1021\", desc: \"No Content-Security-Policy header detected. Without CSP, the application is vulnerable to XSS and data injection attacks.\", rec: \"Implement a strict Content-Security-Policy header to restrict resource sources and prevent XSS.\" },\n { h: \"x-frame-options\", sev: \"medium\" as Severity, title: \"Missing X-Frame-Options\", cwe: \"CWE-1021\", desc: \"No X-Frame-Options header. The site can be embedded in iframes, enabling clickjacking attacks.\", rec: \"Set X-Frame-Options: DENY or SAMEORIGIN, or use CSP frame-ancestors directive.\" },\n { h: \"x-content-type-options\", sev: \"medium\" as Severity, title: \"Missing X-Content-Type-Options\", cwe: \"CWE-79\", desc: \"No X-Content-Type-Options header. Browsers may MIME-sniff content, leading to XSS via type confusion.\", rec: \"Set X-Content-Type-Options: nosniff on all responses.\" },\n { h: \"strict-transport-security\", sev: \"high\" as Severity, title: \"Missing Strict-Transport-Security\", cwe: \"CWE-319\", desc: \"No HSTS header. Browsers may connect via HTTP, exposing traffic to MITM attacks.\", rec: \"Set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.\" },\n { h: \"referrer-policy\", sev: \"low\" as Severity, title: \"Missing Referrer-Policy\", cwe: \"CWE-200\", desc: \"No Referrer-Policy header. Sensitive URL information may leak via the Referer header.\", rec: \"Set Referrer-Policy: strict-origin-when-cross-origin.\" },\n { h: \"permissions-policy\", sev: \"low\" as Severity, title: \"Missing Permissions-Policy\", cwe: \"CWE-200\", desc: \"No Permissions-Policy header. Browser features (camera, microphone, geolocation) are not restricted.\", rec: \"Set Permissions-Policy to restrict unnecessary browser features.\" },\n ];\n\n for (const c of checks) {\n if (!headers[c.h]) {\n findings.push({ module: \"headers\", title: c.title, severity: c.sev, description: c.desc, evidence: `Header \"${c.h}\" not present in response`, recommendation: c.rec, cwe: c.cwe, url });\n }\n }\n\n // Check for version disclosure\n if (headers[\"server\"]) {\n findings.push({ module: \"headers\", title: \"Server Version Disclosure\", severity: \"info\", description: \"The Server header reveals software version information that could help attackers identify known vulnerabilities.\", evidence: `Server: ${headers[\"server\"]}`, recommendation: \"Configure the web server to suppress version information in the Server header.\", cwe: \"CWE-200\", url });\n }\n if (headers[\"x-powered-by\"]) {\n findings.push({ module: \"headers\", title: \"X-Powered-By Disclosure\", severity: \"info\", description: \"The X-Powered-By header reveals the technology stack, aiding attackers in targeted exploits.\", evidence: `X-Powered-By: ${headers[\"x-powered-by\"]}`, recommendation: \"Remove the X-Powered-By header from all responses.\", cwe: \"CWE-200\", url });\n }\n\n return findings;\n}\n\n// ============ Module: SSL/TLS ============\nasync function scanSSL(url: string): Promise {\n const findings: VulnFinding[] = [];\n const origin = getOrigin(url);\n\n // Check if HTTPS\n if (url.startsWith(\"https://\")) {\n // Check HSTS\n const response = await safeFetch(url);\n if (response) {\n const hsts = response.headers.get(\"strict-transport-security\");\n if (!hsts) {\n findings.push({ module: \"ssl\", title: \"No HSTS on HTTPS\", severity: \"medium\", description: \"HTTPS is enabled but HSTS is not enforced, allowing downgrade attacks.\", evidence: \"No Strict-Transport-Security header over HTTPS\", recommendation: \"Set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.\", cwe: \"CWE-319\", url });\n } else {\n const maxAge = hsts.match(/max-age=(\\d+)/);\n if (maxAge && parseInt(maxAge[1]) < 31536000) {\n findings.push({ module: \"ssl\", title: \"Weak HSTS max-age\", severity: \"low\", description: `HSTS max-age is ${maxAge[1]} seconds, which is less than the recommended 1 year.`, evidence: hsts, recommendation: \"Set max-age to at least 31536000 (1 year).\", cwe: \"CWE-319\", url });\n }\n }\n }\n } else {\n // Check HTTP → HTTPS redirect\n const httpUrl = url.replace(\"https://\", \"http://\");\n const response = await safeFetch(httpUrl, { redirect: \"manual\" });\n if (response) {\n const location = response.headers.get(\"location\") ?? \"\";\n if (response.status === 301 || response.status === 302) {\n if (location.startsWith(\"https://\")) {\n findings.push({ module: \"ssl\", title: \"HTTP to HTTPS redirect\", severity: \"info\", description: \"The server redirects HTTP to HTTPS, which is good practice.\", evidence: `${response.status} → ${location}`, recommendation: \"No action needed — HTTPS redirect is in place.\", cwe: null, url });\n } else {\n findings.push({ module: \"ssl\", title: \"HTTP redirects to HTTP\", severity: \"high\", description: \"The server redirects from HTTP to another HTTP URL instead of HTTPS.\", evidence: `${response.status} → ${location}`, recommendation: \"Configure the server to redirect all HTTP traffic to HTTPS.\", cwe: \"CWE-319\", url });\n }\n } else {\n findings.push({ module: \"ssl\", title: \"No HTTPS redirect\", severity: \"high\", description: \"The server serves content over HTTP without redirecting to HTTPS.\", evidence: `HTTP status: ${response.status}`, recommendation: \"Enable HTTPS and redirect all HTTP traffic to HTTPS.\", cwe: \"CWE-319\", url });\n }\n }\n }\n\n // Check HTTPS availability\n const httpsUrl = origin.replace(\"http://\", \"https://\");\n const httpsResponse = await safeFetch(httpsUrl);\n if (!httpsResponse) {\n findings.push({ module: \"ssl\", title: \"HTTPS not available\", severity: \"critical\", description: \"The server does not respond over HTTPS. All traffic is unencrypted.\", evidence: \"Connection to HTTPS endpoint failed\", recommendation: \"Obtain an SSL/TLS certificate and enable HTTPS immediately.\", cwe: \"CWE-319\", url: httpsUrl });\n }\n\n return findings;\n}\n\n// ============ Module: Information Disclosure ============\nasync function scanDisclosure(url: string): Promise {\n const findings: VulnFinding[] = [];\n const origin = getOrigin(url);\n\n const sensitivePaths = [\n { path: \"/.git/config\", sev: \"critical\" as Severity, title: \"Exposed .git directory\", desc: \"The .git directory is accessible, exposing source code and potentially credentials.\", cwe: \"CWE-540\" },\n { path: \"/.env\", sev: \"critical\" as Severity, title: \"Exposed .env file\", desc: \"The .env file is accessible, potentially exposing API keys, database credentials, and secrets.\", cwe: \"CWE-540\" },\n { path: \"/.htaccess\", sev: \"high\" as Severity, title: \"Exposed .htaccess\", desc: \"The .htaccess file is accessible, revealing server configuration and access rules.\", cwe: \"CWE-540\" },\n { path: \"/backup\", sev: \"high\" as Severity, title: \"Exposed backup directory\", desc: \"A backup directory is accessible, potentially containing sensitive data or database dumps.\", cwe: \"CWE-538\" },\n { path: \"/admin\", sev: \"medium\" as Severity, title: \"Admin panel exposed\", desc: \"An admin panel is accessible at /admin. This should be restricted to authorized users only.\", cwe: \"CWE-538\" },\n { path: \"/phpinfo.php\", sev: \"high\" as Severity, title: \"Exposed phpinfo()\", desc: \"The phpinfo.php file is accessible, revealing detailed PHP configuration and server information.\", cwe: \"CWE-200\" },\n { path: \"/server-status\", sev: \"high\" as Severity, title: \"Apache server-status exposed\", desc: \"Apache's server-status page is accessible, revealing detailed server information and request history.\", cwe: \"CWE-200\" },\n { path: \"/wp-config.php\", sev: \"critical\" as Severity, title: \"Exposed wp-config.php\", desc: \"The WordPress configuration file is accessible, potentially exposing database credentials.\", cwe: \"CWE-540\" },\n { path: \"/.svn/entries\", sev: \"high\" as Severity, title: \"Exposed .svn directory\", desc: \"The Subversion metadata directory is accessible, exposing source code repository information.\", cwe: \"CWE-540\" },\n { path: \"/composer.json\", sev: \"medium\" as Severity, title: \"Exposed composer.json\", desc: \"The Composer configuration file is accessible, revealing PHP dependencies and project structure.\", cwe: \"CWE-200\" },\n { path: \"/package.json\", sev: \"low\" as Severity, title: \"Exposed package.json\", desc: \"The package.json file is accessible, revealing Node.js dependencies and project scripts.\", cwe: \"CWE-200\" },\n { path: \"/.DS_Store\", sev: \"low\" as Severity, title: \"Exposed .DS_Store\", desc: \"A macOS .DS_Store file is accessible, potentially revealing directory structure.\", cwe: \"CWE-200\" },\n ];\n\n const results = await Promise.allSettled(\n sensitivePaths.map(async (p) => {\n const fullUrl = origin + p.path;\n const res = await safeFetch(fullUrl);\n if (res && res.status === 200) {\n const text = await res.text().catch(() => \"\");\n const hasContent = text.length > 0;\n return { ...p, fullUrl, hasContent };\n }\n return null;\n })\n );\n\n for (const r of results) {\n if (r.status === \"fulfilled\" && r.value) {\n findings.push({\n module: \"disclosure\",\n title: r.value.title,\n severity: r.value.sev,\n description: r.value.desc,\n evidence: `200 OK at ${r.value.path}`,\n recommendation: `Restrict access to ${r.value.path}. Configure the web server to deny requests to sensitive files and directories.`,\n cwe: r.value.cwe,\n url: r.value.fullUrl,\n });\n }\n }\n\n // Check robots.txt\n const robotsRes = await safeFetch(origin + \"/robots.txt\");\n if (robotsRes && robotsRes.status === 200) {\n const robotsText = await robotsRes.text();\n const disallowed = robotsText.match(/Disallow:\\s*(.+)/g);\n if (disallowed && disallowed.length > 0) {\n findings.push({\n module: \"disclosure\",\n title: \"robots.txt reveals paths\",\n severity: \"info\",\n description: \"The robots.txt file discloses paths that the site owner doesn't want indexed. These paths may contain sensitive areas worth investigating.\",\n evidence: disallowed.slice(0, 5).join(\", \"),\n recommendation: \"Review robots.txt to ensure no sensitive paths are disclosed. Consider using meta tags or authentication instead of robots.txt for sensitive areas.\",\n cwe: \"CWE-200\",\n url: origin + \"/robots.txt\",\n });\n }\n }\n\n return findings;\n}\n\n// ============ Module: OWASP Top 10 ============\nasync function scanOWASP(url: string): Promise {\n const findings: VulnFinding[] = [];\n const origin = getOrigin(url);\n\n // 1. CORS misconfiguration\n const corsRes = await safeFetch(origin, {\n headers: { \"Origin\": \"https://evil.com\" },\n });\n if (corsRes) {\n const acao = corsRes.headers.get(\"access-control-allow-origin\");\n const acac = corsRes.headers.get(\"access-control-allow-credentials\");\n if (acao === \"*\" && acac === \"true\") {\n findings.push({ module: \"owasp\", title: \"CORS: Wildcard with credentials\", severity: \"critical\", description: \"The server returns Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true, allowing any site to make authenticated cross-origin requests.\", evidence: \"ACAO: *, ACAC: true\", recommendation: \"Restrict CORS to trusted origins and never combine wildcard origin with credentials.\", cwe: \"CWE-942\", url: origin });\n } else if (acao === \"https://evil.com\") {\n findings.push({ module: \"owasp\", title: \"CORS: Origin reflection\", severity: \"high\", description: \"The server reflects the Origin header back in Access-Control-Allow-Origin, allowing any site to make cross-origin requests.\", evidence: `ACAO reflected: ${acao}`, recommendation: \"Use a whitelist of allowed origins instead of reflecting the Origin header.\", cwe: \"CWE-942\", url: origin });\n }\n }\n\n // 2. SQL Injection (error-based detection via common payloads)\n const testParams = [\"id=1\", \"page=1\", \"q=test\"];\n const sqliPayloads = [\"'\", \"1' OR '1'='1\", \"1; SELECT 1--\", \"' OR 1=1--\"];\n for (const param of testParams) {\n for (const payload of sqliPayloads) {\n const testUrl = `${origin}/?${param.split(\"=\")[0]}=${encodeURIComponent(payload)}`;\n const res = await safeFetch(testUrl);\n if (res) {\n const text = await res.text().catch(() => \"\");\n const sqliErrors = [\n \"SQL syntax\", \"mysql_fetch\", \"ORA-01756\", \"SQLSTATE[\",\n \"Microsoft OLE DB Provider for SQL Server\", \"PostgreSQL ERROR\",\n \"Warning: mysql_\", \"mysqli_query\", \"SQLite3::query\",\n \"unterminated quoted string\", \"PG::SyntaxError\",\n ];\n const found = sqliErrors.find(e => text.includes(e));\n if (found) {\n findings.push({ module: \"owasp\", title: `SQL Injection via ${param.split(\"=\")[0]} parameter`, severity: \"critical\", description: \"SQL error messages are returned when injecting special characters, indicating the application is vulnerable to SQL injection.\", evidence: `Error: ${found}`, recommendation: \"Use parameterized queries / prepared statements. Validate and sanitize all user input. Use an ORM with safe defaults.\", cwe: \"CWE-89\", url: testUrl });\n break; // one finding per param\n }\n }\n }\n }\n\n // 3. XSS detection (reflected parameter)\n const xssMarker = \"xssprobe9x7k\";\n const xssRes = await safeFetch(`${origin}/?q=${encodeURIComponent(xssMarker)}`);\n if (xssRes) {\n const text = await xssRes.text().catch(() => \"\");\n if (text.includes(xssMarker)) {\n const idx = text.indexOf(xssMarker);\n const context = text.substring(Math.max(0, idx - 50), idx + xssMarker.length + 50);\n // Check if it's reflected without encoding\n if (!context.includes(\"<\") && !context.includes(\"&#x\")) {\n findings.push({ module: \"owasp\", title: \"Reflected XSS via 'q' parameter\", severity: \"high\", description: \"User input is reflected in the HTML response without proper encoding, enabling cross-site scripting attacks.\", evidence: `Reflected: ...${context}...`, recommendation: \"Implement output encoding (HTML entity encoding) for all user input reflected in pages. Use a Content Security Policy as defense-in-depth.\", cwe: \"CWE-79\", url: `${origin}/?q=test` });\n }\n }\n }\n\n // 4. Path traversal\n const traversalPayloads = [\"../../../etc/passwd\", \"..%2F..%2F..%2Fetc%2Fpasswd\", \"....//....//....//etc/passwd\"];\n for (const payload of traversalPayloads) {\n const testUrl = `${origin}/?file=${encodeURIComponent(payload)}`;\n const res = await safeFetch(testUrl);\n if (res) {\n const text = await res.text().catch(() => \"\");\n if (text.includes(\"root:\") && text.includes(\"/bin/\")) {\n findings.push({ module: \"owasp\", title: \"Path Traversal via 'file' parameter\", severity: \"critical\", description: \"The application allows reading arbitrary files through path traversal, exposing sensitive system files like /etc/passwd.\", evidence: \"Content of /etc/passwd detected in response\", recommendation: \"Validate file paths against a whitelist. Use chroot or restricted directories. Never allow user input to specify file system paths directly.\", cwe: \"CWE-22\", url: testUrl });\n break;\n }\n }\n }\n\n // 5. HTTP methods\n const optionsRes = await safeFetch(origin, { method: \"OPTIONS\" });\n if (optionsRes) {\n const allow = optionsRes.headers.get(\"allow\") ?? \"\";\n const dangerous = [\"TRACE\", \"PUT\", \"DELETE\", \"CONNECT\"].filter(m => allow.toUpperCase().includes(m));\n if (dangerous.length > 0) {\n findings.push({ module: \"owasp\", title: \"Dangerous HTTP methods enabled\", severity: \"medium\", description: `The server allows dangerous HTTP methods: ${dangerous.join(\", \")}. These can be used for attacks.`, evidence: `Allow: ${allow}`, recommendation: `Disable unnecessary HTTP methods (${dangerous.join(\", \")}). Only allow GET, POST, HEAD unless specific methods are required.`, cwe: \"CWE-650\", url: origin });\n }\n }\n\n // 6. Clickjacking (if no X-Frame-Options, add as OWASP finding too)\n if (corsRes && !corsRes.headers.get(\"x-frame-options\")) {\n const csp = corsRes.headers.get(\"content-security-policy\") ?? \"\";\n if (!csp.includes(\"frame-ancestors\")) {\n findings.push({ module: \"owasp\", title: \"Clickjacking vulnerability\", severity: \"medium\", description: \"The page can be embedded in an iframe (no X-Frame-Options or CSP frame-ancestors), enabling clickjacking attacks.\", evidence: \"No X-Frame-Options or CSP frame-ancestors\", recommendation: \"Set X-Frame-Options: DENY or CSP: frame-ancestors 'none'.\", cwe: \"CWE-1021\", url: origin });\n }\n }\n\n return findings;\n}\n\n// ============ Module: Tech Fingerprinting ============\nasync function scanFingerprint(url: string): Promise {\n const findings: VulnFinding[] = [];\n const response = await safeFetch(url);\n if (!response) return findings;\n\n const headers: Record = {};\n response.headers.forEach((value, key) => { headers[key.toLowerCase()] = value; });\n const html = await response.text().catch(() => \"\");\n\n const techs: { name: string; check: () => boolean; version?: string }[] = [\n { name: \"Apache\", check: () => (headers[\"server\"]?.toLowerCase().includes(\"apache\")) ?? false, version: headers[\"server\"]?.match(/Apache\\/([\\d.]+)/)?.[1] },\n { name: \"Nginx\", check: () => (headers[\"server\"]?.toLowerCase().includes(\"nginx\")) ?? false, version: headers[\"server\"]?.match(/nginx\\/([\\d.]+)/)?.[1] },\n { name: \"IIS\", check: () => (headers[\"server\"]?.toLowerCase().includes(\"microsoft-iis\")) ?? false, version: headers[\"server\"]?.match(/IIS\\/([\\d.]+)/)?.[1] },\n { name: \"WordPress\", check: () => (html.includes(\"wp-content\") || html.includes(\"wp-includes\") || html.includes('name=\"generator\" content=\"WordPress')), version: html.match(/WordPress\\s+([\\d.]+)/)?.[1] },\n { name: \"React\", check: () => (html.includes(\"__REACT_DEVTOOLS_GLOBAL_HOOK__\") || html.includes(\"react-root\") || html.includes(\"data-reactroot\")) },\n { name: \"Vue.js\", check: () => (html.includes(\"__VUE__\") || html.includes(\"data-v-\") || html.includes(\"vue-app\")) },\n { name: \"Angular\", check: () => (html.includes(\"ng-app\") || html.includes(\"ng-version\") || html.includes(\"__ngDevmode\")) },\n { name: \"Next.js\", check: () => (html.includes(\"__NEXT_DATA__\") || html.includes(\"_next/\")) },\n { name: \"Django\", check: () => (headers[\"x-frame-options\"] === \"DENY\" && html.includes(\"csrfmiddlewaretoken\")) },\n { name: \"Express.js\", check: () => (headers[\"x-powered-by\"]?.toLowerCase().includes(\"express\")) ?? false },\n { name: \"PHP\", check: () => (headers[\"x-powered-by\"]?.toLowerCase().includes(\"php\")) ?? false, version: headers[\"x-powered-by\"]?.match(/PHP\\/([\\d.]+)/)?.[1] },\n { name: \"Cloudflare\", check: () => (headers[\"server\"]?.toLowerCase().includes(\"cloudflare\")) ?? false },\n { name: \"jQuery\", check: () => html.includes(\"jquery\") },\n { name: \"Bootstrap\", check: () => html.includes(\"bootstrap\") },\n ];\n\n const detected = techs.filter(t => t.check());\n if (detected.length > 0) {\n const techList = detected.map(t => t.version ? `${t.name} ${t.version}` : t.name).join(\", \");\n findings.push({\n module: \"fingerprint\",\n title: \"Technology stack identified\",\n severity: \"info\",\n description: `Detected technologies: ${techList}. This information helps attackers identify known vulnerabilities in specific versions.`,\n evidence: techList,\n recommendation: \"Minimize version information exposure. Keep all software updated to the latest secure versions.\",\n cwe: \"CWE-200\",\n url,\n });\n }\n\n // Check for default/management pages\n const adminPaths = [\"/admin\", \"/wp-admin\", \"/manager\", \"/console\", \"/dashboard\"];\n for (const p of adminPaths) {\n const res = await safeFetch(url + p);\n if (res && (res.status === 200 || res.status === 401 || res.status === 403)) {\n findings.push({\n module: \"fingerprint\",\n title: `Management interface at ${p}`,\n severity: res.status === 200 ? \"medium\" : \"info\",\n description: `A management interface is accessible at ${p} (HTTP ${res.status}). ${res.status === 200 ? \"This page is publicly accessible.\" : \"This page exists but requires authentication.\"}`,\n evidence: `GET ${p} → ${res.status}`,\n recommendation: \"Restrict access to management interfaces using IP allowlisting, VPN, or additional authentication layers.\",\n cwe: \"CWE-538\",\n url: url + p,\n });\n }\n }\n\n return findings;\n}\n\n// ============ Module: Port Scanner ============\nasync function scanPorts(url: string): Promise {\n const findings: VulnFinding[] = [];\n const hostname = getHostname(url);\n const commonPorts = [80, 443, 3000, 5000, 8000, 8080, 8443, 8888, 9000];\n\n const results = await Promise.allSettled(\n commonPorts.map(async (port) => {\n const protocol = port === 443 || port === 8443 ? \"https\" : \"http\";\n const portUrl = `${protocol}://${hostname}:${port}`;\n const res = await safeFetch(portUrl);\n return { port, protocol, portUrl, status: res?.status ?? null };\n })\n );\n\n const openPorts = results\n .filter((r): r is PromiseFulfilledResult<{ port: number; protocol: string; portUrl: string; status: number | null }> => r.status === \"fulfilled\" && r.value.status !== null)\n .map(r => r.value);\n\n for (const p of openPorts) {\n const isStandard = (p.port === 80 && p.protocol === \"http\") || (p.port === 443 && p.protocol === \"https\");\n if (!isStandard) {\n findings.push({\n module: \"ports\",\n title: `Port ${p.port} is open`,\n severity: p.port === 8080 || p.port === 8443 ? \"low\" : \"medium\",\n description: `Port ${p.port} (${p.protocol}) is responding with HTTP status ${p.status}. Non-standard ports may expose additional services or applications.`,\n evidence: `${p.portUrl} → ${p.status}`,\n recommendation: `Review whether port ${p.port} needs to be publicly accessible. Close unused ports and restrict access to management interfaces.`,\n cwe: \"CWE-200\",\n url: p.portUrl,\n });\n }\n }\n\n if (openPorts.length > 0) {\n const portList = openPorts.map(p => `${p.port}/${p.protocol}`).join(\", \");\n findings.push({\n module: \"ports\",\n title: \"Open ports summary\",\n severity: \"info\",\n description: `Detected ${openPorts.length} open port(s): ${portList}. Each open port is a potential attack surface.`,\n evidence: portList,\n recommendation: \"Minimize exposed services. Use a firewall to restrict access to only necessary ports.\",\n cwe: \"CWE-200\",\n url: null,\n });\n }\n\n return findings;\n}\n\n// ============ Module: DNS Analysis ============\nasync function scanDNS(url: string): Promise {\n const findings: VulnFinding[] = [];\n const hostname = getHostname(url);\n\n const recordTypes = [\"A\", \"AAAA\", \"MX\", \"NS\", \"TXT\", \"CNAME\", \"SOA\"];\n const records: Record = {};\n\n for (const type of recordTypes) {\n try {\n const res = await fetch(\n `https://dns.google/resolve?name=${encodeURIComponent(hostname)}&type=${type}`,\n { headers: { \"Accept\": \"application/dns-json\" } }\n );\n if (res.ok) {\n const data = await res.json();\n if (data.Answer) {\n records[type] = data.Answer.map((a: { data: string }) => a.data);\n }\n }\n } catch { /* skip */ }\n }\n\n // Report DNS records\n const allRecords = Object.entries(records).filter(([, v]) => v.length > 0);\n if (allRecords.length > 0) {\n const recordStr = allRecords.map(([t, v]) => `${t}: ${v.join(\", \")}`).join(\"; \");\n findings.push({\n module: \"dns\",\n title: \"DNS records enumeration\",\n severity: \"info\",\n description: `DNS records for ${hostname}: ${allRecords.map(([t, v]) => `${t} (${v.length})`).join(\", \")}. DNS enumeration reveals infrastructure details.`,\n evidence: recordStr.substring(0, 200),\n recommendation: \"Ensure DNS records don't expose internal infrastructure details. Use DNSSEC for additional security.\",\n cwe: \"CWE-200\",\n url: null,\n });\n }\n\n // Check for SPF/DMARC\n const txtRecords = records[\"TXT\"] ?? [];\n const hasSPF = txtRecords.some(t => t.includes(\"v=spf1\"));\n if (!hasSPF) {\n findings.push({\n module: \"dns\",\n title: \"Missing SPF record\",\n severity: \"medium\",\n description: \"No SPF (Sender Policy Framework) record found. Without SPF, the domain is vulnerable to email spoofing.\",\n evidence: \"No TXT record with v=spf1 found\",\n recommendation: \"Add an SPF record to the DNS TXT records to specify authorized mail servers.\",\n cwe: \"CWE-200\",\n url: null,\n });\n }\n\n // Check DMARC\n try {\n const dmarcRes = await fetch(\n `https://dns.google/resolve?name=_dmarc.${encodeURIComponent(hostname)}&type=TXT`,\n { headers: { \"Accept\": \"application/dns-json\" } }\n );\n if (dmarcRes.ok) {\n const dmarcData = await dmarcRes.json();\n if (!dmarcData.Answer || !dmarcData.Answer.some((a: { data: string }) => a.data.includes(\"v=DMARC1\"))) {\n findings.push({\n module: \"dns\",\n title: \"Missing DMARC record\",\n severity: \"medium\",\n description: \"No DMARC record found. Without DMARC, email authentication is incomplete, allowing phishing via the domain.\",\n evidence: \"No DMARC record at _dmarc.\" + hostname,\n recommendation: \"Add a DMARC record to specify email authentication policy (e.g., v=DMARC1; p=reject;).\",\n cwe: \"CWE-200\",\n url: null,\n });\n }\n }\n } catch { /* skip */ }\n\n // Subdomain discovery via crt.sh\n try {\n const crtRes = await fetch(`https://crt.sh/?q=${encodeURIComponent(hostname)}&output=json`, {\n signal: AbortSignal.timeout(TIMEOUT_MS),\n });\n if (crtRes.ok) {\n const crtData = await crtRes.json();\n const subdomains = new Set();\n for (const entry of crtData.slice(0, 50)) {\n const names = (entry.name_value ?? \"\").split(\"\\n\");\n for (const n of names) {\n if (n.includes(hostname) && !n.startsWith(\"*\")) {\n subdomains.add(n.trim());\n }\n }\n }\n if (subdomains.size > 0) {\n findings.push({\n module: \"dns\",\n title: `Subdomain discovery (${subdomains.size} found)`,\n severity: subdomains.size > 10 ? \"medium\" : \"info\",\n description: `Discovered ${subdomains.size} subdomain(s) via Certificate Transparency logs: ${Array.from(subdomains).slice(0, 10).join(\", \")}${subdomains.size > 10 ? \"...\" : \"\"}. Each subdomain is additional attack surface.`,\n evidence: Array.from(subdomains).slice(0, 15).join(\"\\n\"),\n recommendation: \"Monitor subdomain inventory. Ensure all subdomains are properly secured and decommission unused ones.\",\n cwe: \"CWE-200\",\n url: null,\n });\n }\n }\n } catch { /* skip */ }\n\n return findings;\n}\n\n// ============ Module: Cookie Security ============\nasync function scanCookies(url: string): Promise {\n const findings: VulnFinding[] = [];\n const response = await safeFetch(url);\n if (!response) return findings;\n\n const setCookies = response.headers.getSetCookie?.() ?? [];\n if (setCookies.length === 0) {\n // Try manual parsing\n const raw = response.headers.get(\"set-cookie\");\n if (raw) {\n // Some platforms combine cookies into one header\n }\n }\n\n for (const cookie of setCookies) {\n const name = cookie.split(\"=\")[0]?.trim() ?? \"unknown\";\n const lower = cookie.toLowerCase();\n\n if (!lower.includes(\"secure\")) {\n findings.push({\n module: \"cookies\",\n title: `Cookie \"${name}\" missing Secure flag`,\n severity: \"medium\",\n description: `The cookie \"${name}\" is set without the Secure flag, allowing it to be transmitted over unencrypted HTTP.`,\n evidence: cookie.substring(0, 100),\n recommendation: \"Add the Secure flag to all cookies to ensure they're only sent over HTTPS.\",\n cwe: \"CWE-614\",\n url,\n });\n }\n if (!lower.includes(\"httponly\")) {\n findings.push({\n module: \"cookies\",\n title: `Cookie \"${name}\" missing HttpOnly flag`,\n severity: \"medium\",\n description: `The cookie \"${name}\" is set without the HttpOnly flag, allowing JavaScript to access it and enabling XSS-based cookie theft.`,\n evidence: cookie.substring(0, 100),\n recommendation: \"Add the HttpOnly flag to prevent JavaScript access to cookies.\",\n cwe: \"CWE-1004\",\n url,\n });\n }\n if (!lower.includes(\"samesite\")) {\n findings.push({\n module: \"cookies\",\n title: `Cookie \"${name}\" missing SameSite flag`,\n severity: \"low\",\n description: `The cookie \"${name}\" is set without the SameSite attribute, making it vulnerable to CSRF attacks.`,\n evidence: cookie.substring(0, 100),\n recommendation: \"Set SameSite=Strict or SameSite=Lax to prevent cross-site request forgery.\",\n cwe: \"CWE-1275\",\n url,\n });\n }\n }\n\n if (setCookies.length === 0) {\n findings.push({\n module: \"cookies\",\n title: \"No cookies detected\",\n severity: \"info\",\n description: \"No cookies were set in the response. This may be normal for static pages, or cookies may be set after authentication.\",\n evidence: \"No Set-Cookie headers in response\",\n recommendation: \"If the application uses cookies, ensure they have Secure, HttpOnly, and SameSite flags.\",\n cwe: null,\n url,\n });\n }\n\n return findings;\n}\n\n// ============ Main Orchestrator ============\nexport async function runScan(target: string, moduleIds: string[]): Promise {\n const url = normalizeUrl(target);\n const allFindings: VulnFinding[] = [];\n\n const moduleMap: Record Promise> = {\n headers: scanHeaders,\n ssl: scanSSL,\n disclosure: scanDisclosure,\n owasp: scanOWASP,\n fingerprint: scanFingerprint,\n ports: scanPorts,\n dns: scanDNS,\n cookies: scanCookies,\n };\n\n // Run modules in parallel with Promise.allSettled for resilience\n const tasks = moduleIds\n .filter(id => moduleMap[id])\n .map(id => moduleMap[id](url));\n\n const results = await Promise.allSettled(tasks);\n for (const r of results) {\n if (r.status === \"fulfilled\") {\n allFindings.push(...r.value);\n } else {\n console.error(\"Module failed:\", r.reason);\n }\n }\n\n return allFindings;\n}\n",[],[80,90],"f130dc93-ab3e-4653-ab63-26565c491070","report.ts","24f8be24-8d93-11f1-b56a-1607ee4eb77e",4,["D",1785579854426],"import type { Scan, Vulnerability, ScanSummary, Severity } from \"./db.ts\";\n\nconst SEVERITY_EMOJI: Record = {\n critical: \"🔴\",\n high: \"🟠\",\n medium: \"🟡\",\n low: \"🔵\",\n info: \"⚪\",\n};\n\nexport interface FullReport {\n scan: Scan;\n vulnerabilities: Vulnerability[];\n summary: ScanSummary;\n aiAnalysis: string | null;\n modulesBreakdown: Record;\n generatedAt: string;\n}\n\nexport function buildReport(scan: Scan, vulns: Vulnerability[]): FullReport {\n const modulesBreakdown: Record = {};\n for (const v of vulns) {\n modulesBreakdown[v.module] = (modulesBreakdown[v.module] ?? 0) + 1;\n }\n return {\n scan,\n vulnerabilities: vulns,\n summary: scan.summary ?? { total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n aiAnalysis: scan.aiAnalysis,\n modulesBreakdown,\n generatedAt: new Date().toISOString(),\n };\n}\n\nexport function formatMarkdownReport(report: FullReport): string {\n const { scan, vulnerabilities, summary, aiAnalysis, modulesBreakdown } = report;\n const lines: string[] = [];\n\n lines.push(`# 🛡️ Pentest Report — ${scan.target}`);\n lines.push(\"\");\n lines.push(`**Scan ID:** #${scan.id} `);\n lines.push(`**Started:** ${scan.startedAt} `);\n lines.push(`**Completed:** ${scan.completedAt ?? \"N/A\"} `);\n lines.push(`**Status:** ${scan.status}`);\n lines.push(\"\");\n lines.push(\"## 📊 Summary\");\n lines.push(\"\");\n lines.push(\"| Severity | Count |\");\n lines.push(\"|----------|-------|\");\n lines.push(`| ${SEVERITY_EMOJI.critical} Critical | ${summary.critical} |`);\n lines.push(`| ${SEVERITY_EMOJI.high} High | ${summary.high} |`);\n lines.push(`| ${SEVERITY_EMOJI.medium} Medium | ${summary.medium} |`);\n lines.push(`| ${SEVERITY_EMOJI.low} Low | ${summary.low} |`);\n lines.push(`| ${SEVERITY_EMOJI.info} Info | ${summary.info} |`);\n lines.push(`| **Total** | **${summary.total}** |`);\n lines.push(\"\");\n lines.push(\"## 🔍 Modules Breakdown\");\n lines.push(\"\");\n for (const [mod, count] of Object.entries(modulesBreakdown)) {\n lines.push(`- **${mod}**: ${count} finding(s)`);\n }\n lines.push(\"\");\n\n if (vulnerabilities.length > 0) {\n lines.push(\"## 🐛 Vulnerabilities\");\n lines.push(\"\");\n for (const v of vulnerabilities) {\n lines.push(`### ${SEVERITY_EMOJI[v.severity]} [${v.severity.toUpperCase()}] ${v.title}`);\n lines.push(\"\");\n lines.push(`- **Module:** ${v.module}`);\n lines.push(`- **CWE:** ${v.cwe ?? \"N/A\"}`);\n if (v.url) lines.push(`- **URL:** ${v.url}`);\n lines.push(`- **Description:** ${v.description}`);\n lines.push(`- **Evidence:** \\`${v.evidence}\\``);\n lines.push(`- **Recommendation:** ${v.recommendation}`);\n lines.push(\"\");\n }\n }\n\n if (aiAnalysis) {\n lines.push(\"## 🤖 AI Security Analysis\");\n lines.push(\"\");\n lines.push(\"```json\");\n lines.push(aiAnalysis);\n lines.push(\"```\");\n lines.push(\"\");\n }\n\n lines.push(\"---\");\n lines.push(`*Generated by Autonomous Pentest Platform at ${report.generatedAt}*`);\n return lines.join(\"\\n\");\n}\n",[],[80,99],"96f10f59-210e-43fc-9441-30544006203b","db.ts","24ec7448-8d93-11f1-ba2f-1607ee4eb77e",3,["D",1785579854425],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type Severity = \"critical\" | \"high\" | \"medium\" | \"low\" | \"info\";\nexport type ScanStatus = \"pending\" | \"running\" | \"completed\" | \"failed\";\n\nexport interface ScanSummary {\n total: number;\n critical: number;\n high: number;\n medium: number;\n low: number;\n info: number;\n}\n\nexport interface Scan {\n id: number;\n target: string;\n status: ScanStatus;\n startedAt: string;\n completedAt: string | null;\n modulesRun: string[];\n summary: ScanSummary | null;\n aiAnalysis: string | null;\n error: string | null;\n}\n\nexport interface Vulnerability {\n id: number;\n scanId: number;\n module: string;\n title: string;\n severity: Severity;\n description: string;\n evidence: string;\n recommendation: string;\n cwe: string | null;\n url: string | null;\n createdAt: string;\n}\n\nexport async function initDB() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS scans (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n target TEXT NOT NULL,\n status TEXT DEFAULT 'pending',\n startedAt TEXT NOT NULL,\n completedAt TEXT,\n modulesRun TEXT DEFAULT '[]',\n summary TEXT,\n aiAnalysis TEXT,\n error TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS vulnerabilities (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n scanId INTEGER NOT NULL,\n module TEXT NOT NULL,\n title TEXT NOT NULL,\n severity TEXT NOT NULL,\n description TEXT,\n evidence TEXT,\n recommendation TEXT,\n cwe TEXT,\n url TEXT,\n createdAt TEXT NOT NULL,\n FOREIGN KEY (scanId) REFERENCES scans(id) ON DELETE CASCADE\n )`,\n },\n ]);\n}\n\nexport async function createScan(target: string, modules: string[]): Promise {\n const result = await sqlite.execute({\n sql: \"INSERT INTO scans (target, status, startedAt, modulesRun) VALUES (?, 'pending', ?, ?)\",\n args: [target, new Date().toISOString(), JSON.stringify(modules)],\n });\n return Number(result.lastInsertRowid);\n}\n\nexport async function updateScanStatus(id: number, status: ScanStatus, error?: string) {\n if (error) {\n await sqlite.execute({\n sql: \"UPDATE scans SET status = ?, error = ? WHERE id = ?\",\n args: [status, error, id],\n });\n } else {\n await sqlite.execute({\n sql: \"UPDATE scans SET status = ? WHERE id = ?\",\n args: [status, id],\n });\n }\n}\n\nexport async function completeScan(id: number, summary: ScanSummary, aiAnalysis?: string) {\n await sqlite.execute({\n sql: \"UPDATE scans SET status = 'completed', completedAt = ?, summary = ?, aiAnalysis = ? WHERE id = ?\",\n args: [new Date().toISOString(), JSON.stringify(summary), aiAnalysis ?? null, id],\n });\n}\n\nexport async function addVulnerability(v: Omit) {\n await sqlite.execute({\n sql: `INSERT INTO vulnerabilities (scanId, module, title, severity, description, evidence, recommendation, cwe, url, createdAt)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [v.scanId, v.module, v.title, v.severity, v.description, v.evidence, v.recommendation, v.cwe, v.url, new Date().toISOString()],\n });\n}\n\nexport async function getScan(id: number): Promise {\n const result = await sqlite.execute({ sql: \"SELECT * FROM scans WHERE id = ?\", args: [id] });\n if (result.rows.length === 0) return null;\n return parseScan(result.rows[0]);\n}\n\nexport async function listScans(): Promise {\n const result = await sqlite.execute({ sql: \"SELECT * FROM scans ORDER BY id DESC LIMIT 50\" });\n return result.rows.map(parseScan);\n}\n\nexport async function getVulnerabilities(scanId: number): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM vulnerabilities WHERE scanId = ? ORDER BY CASE severity WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 WHEN 'info' THEN 4 END, id ASC\",\n args: [scanId],\n });\n return result.rows.map(parseVuln);\n}\n\nexport async function deleteScan(id: number) {\n await sqlite.batch([\n { sql: \"DELETE FROM vulnerabilities WHERE scanId = ?\", args: [id] },\n { sql: \"DELETE FROM scans WHERE id = ?\", args: [id] },\n ]);\n}\n\nexport function computeSummary(vulns: Vulnerability[]): ScanSummary {\n const s: ScanSummary = { total: vulns.length, critical: 0, high: 0, medium: 0, low: 0, info: 0 };\n for (const v of vulns) s[v.severity]++;\n return s;\n}\n\nfunction parseScan(row: Record): Scan {\n return {\n id: Number(row.id),\n target: String(row.target),\n status: String(row.status) as ScanStatus,\n startedAt: String(row.startedAt),\n completedAt: (row.completedAt as string | null) ?? null,\n modulesRun: JSON.parse(String(row.modulesRun)),\n summary: row.summary ? JSON.parse(String(row.summary)) : null,\n aiAnalysis: (row.aiAnalysis as string | null) ?? null,\n error: (row.error as string | null) ?? null,\n };\n}\n\nfunction parseVuln(row: Record): Vulnerability {\n return {\n id: Number(row.id),\n scanId: Number(row.scanId),\n module: String(row.module),\n title: String(row.title),\n severity: String(row.severity) as Severity,\n description: String(row.description ?? \"\"),\n evidence: String(row.evidence ?? \"\"),\n recommendation: String(row.recommendation ?? \"\"),\n cwe: (row.cwe as string | null) ?? null,\n url: (row.url as string | null) ?? null,\n createdAt: String(row.createdAt),\n };\n}\n",[],[80,107],"a97270f3-a12e-47fa-ae87-deb357ba37c4","ai.ts","07dc7984-8d93-11f1-bfc1-1607ee4eb77e",["D",1785579805630],"import type { Vulnerability, ScanSummary } from \"./db.ts\";\n\nexport interface AIAnalysis {\n riskScore: number;\n riskLevel: string;\n executiveSummary: string;\n keyFindings: string[];\n attackVectors: string[];\n prioritizedRecommendations: { priority: string; action: string; impact: string }[];\n complianceNotes: string[];\n}\n\n/**\n * Analyze scan results with AI (OpenAI) if API key is available,\n * otherwise fall back to rule-based analysis.\n */\nexport async function analyzeFindings(\n target: string,\n vulns: Vulnerability[],\n summary: ScanSummary,\n): Promise {\n const apiKey = Deno.env.get(\"OPENAI_API_KEY\");\n\n if (apiKey) {\n try {\n return await analyzeWithOpenAI(target, vulns, summary, apiKey);\n } catch (err) {\n console.error(\"AI analysis failed, falling back to rule-based:\", err);\n }\n }\n return JSON.stringify(ruleBasedAnalysis(target, vulns, summary), null, 2);\n}\n\nasync function analyzeWithOpenAI(\n target: string,\n vulns: Vulnerability[],\n summary: ScanSummary,\n apiKey: string,\n): Promise {\n const findingsText = vulns.map((v) =>\n `[${v.severity.toUpperCase()}] ${v.module}: ${v.title}\\n Description: ${v.description}\\n Evidence: ${v.evidence}\\n CWE: ${v.cwe ?? \"N/A\"}`\n ).join(\"\\n\\n\");\n\n const systemPrompt = `You are an expert penetration tester and security analyst. Analyze the following vulnerability scan results and provide a comprehensive security assessment in JSON format.\n\nReturn JSON with this structure:\n{\n \"riskScore\": <0-100>,\n \"riskLevel\": \"\",\n \"executiveSummary\": \"<2-3 paragraph summary for management>\",\n \"keyFindings\": [\"\", \"\", ...],\n \"attackVectors\": [\"\", \"\", ...],\n \"prioritizedRecommendations\": [\n { \"priority\": \"P0|P1|P2|P3\", \"action\": \"\", \"impact\": \"\" }\n ],\n \"complianceNotes\": [\"\", ...]\n}`;\n\n const userPrompt = `Target: ${target}\nTotal vulnerabilities: ${summary.total}\nCritical: ${summary.critical}, High: ${summary.high}, Medium: ${summary.medium}, Low: ${summary.low}, Info: ${summary.info}\n\nFindings:\n${findingsText}\n\nProvide a thorough security analysis as JSON.`;\n\n const response = await fetch(\"https://api.openai.com/v1/chat/completions\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${apiKey}`,\n },\n body: JSON.stringify({\n model: \"gpt-4o-mini\",\n messages: [\n { role: \"system\", content: systemPrompt },\n { role: \"user\", content: userPrompt },\n ],\n temperature: 0.3,\n max_tokens: 2000,\n }),\n });\n\n if (!response.ok) {\n throw new Error(`OpenAI API error: ${response.status}`);\n }\n\n const data = await response.json();\n return data.choices[0].message.content;\n}\n\nfunction ruleBasedAnalysis(\n target: string,\n vulns: Vulnerability[],\n summary: ScanSummary,\n): AIAnalysis {\n const riskScore = computeRiskScore(summary);\n const riskLevel = riskScore >= 75 ? \"Critical\"\n : riskScore >= 50 ? \"High\"\n : riskScore >= 25 ? \"Medium\" : \"Low\";\n\n const keyFindings = vulns\n .filter((v) => v.severity === \"critical\" || v.severity === \"high\")\n .slice(0, 10)\n .map((v) => `${v.severity.toUpperCase()}: ${v.title} (${v.module})`);\n\n const attackVectors = vulns\n .filter((v) => v.severity === \"critical\" || v.severity === \"high\")\n .slice(0, 5)\n .map((v) => `${v.title} could allow attackers to ${v.description.toLowerCase()}`);\n\n const prioritizedRecommendations = vulns\n .sort((a, b) => severityWeight(a.severity) - severityWeight(b.severity))\n .slice(0, 10)\n .map((v) => ({\n priority: v.severity === \"critical\" ? \"P0\" : v.severity === \"high\" ? \"P1\" : v.severity === \"medium\" ? \"P2\" : \"P3\",\n action: v.recommendation,\n impact: `Fixes ${v.title} (${v.cwe ?? \"no CWE\"})`,\n }));\n\n const complianceNotes: string[] = [];\n if (summary.critical > 0) complianceNotes.push(\"Critical vulnerabilities detected — immediate remediation required for SOC2/ISO27001 compliance.\");\n if (vulns.some((v) => v.module === \"ssl\")) complianceNotes.push(\"SSL/TLS issues may affect PCI-DSS compliance.\");\n if (vulns.some((v) => v.module === \"headers\" && v.title.includes(\"Content-Security-Policy\"))) complianceNotes.push(\"Missing CSP headers may violate OWASP ASCP requirements.\");\n if (vulns.some((v) => v.module === \"disclosure\")) complianceNotes.push(\"Information disclosure issues may affect GDPR data protection requirements.\");\n\n return {\n riskScore,\n riskLevel,\n executiveSummary: `Security scan of ${target} identified ${summary.total} vulnerabilities (${summary.critical} critical, ${summary.high} high, ${summary.medium} medium, ${summary.low} low, ${summary.info} informational). The overall risk score is ${riskScore}/100 (${riskLevel}). ${summary.critical > 0 ? \"Critical vulnerabilities require immediate attention.\" : summary.high > 0 ? \"High-severity issues should be addressed urgently.\" : \"No critical or high-severity issues detected.\"} Recommendations are prioritized by severity and potential impact.`,\n keyFindings: keyFindings.length > 0 ? keyFindings : [\"No critical or high-severity findings detected.\"],\n attackVectors: attackVectors.length > 0 ? attackVectors : [\"No immediate attack vectors identified from scan results.\"],\n prioritizedRecommendations,\n complianceNotes: complianceNotes.length > 0 ? complianceNotes : [\"No specific compliance concerns identified from this scan.\"],\n };\n}\n\nfunction computeRiskScore(summary: ScanSummary): number {\n if (summary.total === 0) return 0;\n return Math.min(100,\n summary.critical * 25 +\n summary.high * 15 +\n summary.medium * 8 +\n summary.low * 3 +\n summary.info * 1\n );\n}\n\nfunction severityWeight(s: string): number {\n const weights: Record = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };\n return weights[s] ?? 5;\n}\n",[],[80,115],"37658dde-ca18-4115-8237-4096f04aef9b",6,["D",1785579990230],[126,127,128],[58],{"_34":60,"_13":59,"_37":40,"_39":61,"_41":42,"_43":44,"_45":46,"_47":144,"_17":49,"_50":63,"_52":-5,"_54":55,"_56":-5,"_76":145,"_18":146},{"_34":136,"_13":137,"_37":138,"_39":61,"_41":42,"_43":139,"_45":46,"_47":140,"_17":49,"_50":51,"_52":141,"_54":55,"_56":-5,"_76":142,"_18":143},{"_34":129,"_13":130,"_37":131,"_39":61,"_41":42,"_43":122,"_45":46,"_47":132,"_17":49,"_50":51,"_52":133,"_54":55,"_56":-5,"_76":134,"_18":135},"12482b6f-fb2c-44ca-b5b3-8b8d46c536d9","root.tsx","75df0186-8d93-11f1-a8ed-1607ee4eb77e",["D",1785579990230],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport function Root() {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n 🛡️ Autonomous Pentest Platform\n