@memrov2/pentcloud-recon 0.0.0-stage → 0.1.1-dev.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PentCloud contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,113 @@
-# Temporary Holding Version
+# PentCloud tools
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![Quality](https://github.com/Memrov/PentCloud-tools/actions/workflows/quality.yml/badge.svg)](https://github.com/Memrov/PentCloud-tools/actions/workflows/quality.yml)
+[![codecov](https://codecov.io/gh/Memrov/PentCloud-tools/branch/main/graph/badge.svg)](https://app.codecov.io/gh/Memrov/PentCloud-tools)
+[![npm](https://badgen.net/npm/v/@memrov2/pentcloud-recon)](https://www.npmjs.com/package/@memrov2/pentcloud-recon)
+[![Adapter license: MIT](https://badgen.net/static/adapter%20license/MIT/blue)](LICENSE)
+
+Small, versioned tool runtimes for Cloudflare. The first package, **`@memrov2/pentcloud-recon`**, runs the original httpx, dnsx, Katana and Subfinder binaries together in one lightweight Linux container.
+
+Each tool is callable separately. Cloudflare Workflows can orchestrate the calls, or an agent harness can call the same Durable Object binding. This repository does not deploy or modify the PentCloud application.
+
+| Included tool | Pinned release | First-release behavior |
+| --- | --- | --- |
+| httpx | v1.12.0 | HTTP status, title, server and technology signals |
+| dnsx | v1.3.1 | A and AAAA resolution |
+| Katana | v1.8.0 | Depth-two crawl within the starting URL prefix |
+| Subfinder | v2.17.0 | Passive certificate discovery using `crtname` |
+
+## Call a tool
+
+Install the pinned npm release in your Worker project. Release tarballs and the source checkout support the same imports.
+
+```sh
+npm install @memrov2/pentcloud-recon@0.1.0
+```
+
+```js
+// Export the Durable Object from your Worker's entry point.
+export { ReconRunner } from '@memrov2/pentcloud-recon/worker';
+
+// Use a separate Durable Object identity for each assessment run.
+const runner = env.RECON.getByName(runId);
+try {
+  const result = await runner.run({
+    tool: 'httpx',
+    target: 'https://your-authorized-target.example/'
+  });
+  // Save this result to your existing run/evidence store.
+} finally {
+  await runner.stop();
+}
+```
+
+`httpx` and `katana` accept an absolute HTTP(S) URL. `dnsx` and `subfinder` accept a hostname. The first release accepts exactly `tool` and `target`; additional flags and arbitrary commands are rejected. URLs with embedded login credentials are rejected. JSON stdout, stderr, exit code, timeout/truncation state, execution timing, image identity and tool/pack versions are returned without flattening upstream records.
+
+Calls on one identity are serialized. The default allocation is one vCPU, 512 MiB memory and 2,000 MB disk. An unused runtime shuts down after 120 seconds; explicitly stop it when the run ends. These limits were tested for serial execution, not parallel processes within the same container.
+
+## Build and deploy in your account
+
+Requirements: Node.js 22 or later, npm, Python 3, Go **1.26.5**, Cloudflare Workers Paid with Containers access, and native Cloudflare CLI authentication. The included example uses the same Wrangler **4.157.0** deployment tooling as the tested runtime. Building the Dockerfile also requires a running Docker-compatible engine capable of building Linux/amd64 images.
+
+```sh
+npm ci
+npm test
+npm run test:runner
+npm run test:image
+npm run typecheck
+npm run image:prepare
+npx wrangler login
+npx wrangler deploy --config examples/cloudflare/wrangler.jsonc
+```
+
+The prepare step downloads four upstream release archives, verifies archive and executable SHA-256 values, copies their license files, and builds the small static execution helper. Tool installation and compilation happen at build time, never during an assessment.
+
+The example has no public execution endpoint, workers.dev exposure or preview URL. Start `ReconWorkflow` through Cloudflare's authenticated Workflows API with a payload such as:
+
+```json
+{"tool":"dnsx","target":"your-authorized-target.example"}
+```
+
+For multiple calls within one assessment, reuse that run's Durable Object identity and stop it after the last call. The example Workflow performs one tool call and then stops its runtime. Adapt evidence persistence to your application's existing store; this package does not add a database or exporter.
+
+For a build without Docker, install **regctl v0.9.0** and run `npm run image:build`. This creates the OCI layout in `.cache/image` and records its digest in `.cache/image-release.json`. Copy the image into your Cloudflare-managed registry using your authenticated registry tooling. Configure the resulting account-local digest as the `recon` named image. Cloudflare's native registry and deployment commands are documented below.
+
+## Versions and upgrades
+
+Version `0.1.0` identifies the recon pack and its SDK contract. `tools.lock.json` records each upstream version, archive checksum, binary checksum and the base image digest. Updating one tool preserves the other pins and produces a new pack/image release. This repository does not fork the upstream tools.
+
+Pin the npm package and container image digest together. The runner checks the image's release manifest before executing commands and rejects a mismatched running image. Finish active runs before upgrading their SDK/image pair; retain prior images and matching adapters for retries and rollback. Publishing a package does not deploy it to customer accounts or replace a running container.
+
+To prepare a release: update the package/lock versions together, run the tests and Cloudflare smoke check, build the image, inspect `npm pack --dry-run`, and attach the verified npm tarball, image archive and SHA-256 checksums to the release. Authentication belongs in native CLI login or a secret store, never source files. GitHub Actions runs synthetic quality checks only; publishing uses the maintainer’s local npm authentication. No scanners or assessments run in Actions.
+
+## Limits and safety
+
+Only test targets you are authorized to assess. Argument validation and Katana's URL-prefix filter are **not network-level scope enforcement**. DNS resolution, redirects, tool behavior and future capabilities require their own assessment. This package does not claim to restrict every possible destination.
+
+HTTP/crawl concurrency is one, with a two-request-per-second tool limit; Subfinder uses one request per second. Each command has a 75-second process deadline, with two MiB captured per output stream. Deadline/output cancellation kills the process group. Nonzero command exits remain visible in the returned result and are not automatically retried by the example Workflow.
+
+Do not send model keys or unrelated account credentials to this runtime. The execution helper passes a minimal environment to the tools. Treat stdout/stderr as potentially sensitive assessment evidence; store them privately, keep runs separated, and apply your own deletion policy. Browser login, provider API credentials and additional tool options are outside this first release.
+
+The runtime supports Linux/amd64 on Cloudflare Containers. It does not make these binaries executable inside the Workers JavaScript isolate. Other Kali tools have not been ported or certified by this release.
+
+## References
+
+- [Cloudflare native Container API](https://developers.cloudflare.com/containers/api/durable-object-container/)
+- [Image management and registry](https://developers.cloudflare.com/containers/guides/image-management/)
+- [Workflows](https://developers.cloudflare.com/workflows/)
+- [ProjectDiscovery tools](https://github.com/projectdiscovery)
+- [Third-party notices](THIRD_PARTY_NOTICES.md)
+
+MIT license for the PentCloud adapter. Included executables and base-image packages retain their upstream licenses.
+
+## Tool-pack inventory and quality
+
+See [tool packs and agent capabilities](docs/tool-packs.md) for the current Kali interface inventory, the needs of each agent, and the proposed next bundles. Candidate tools are clearly separated from released support.
+
+Run `npm run coverage` after the development setup in [testing and coverage](docs/testing.md). Reports use standard Node LCOV, Go coverprofile and Python Cobertura formats. The public Quality workflow runs these synthetic tests and uploads explicit coverage reports to Codecov. Cloud account, npm publishing and target credentials are not available to the workflow.
+
+The [release table](docs/releases.md) lists the npm SDKs and their image-distribution requirements. [HTTP, Nuclei and SQLmap](docs/bundles.md) and [the other tool families](docs/remaining-bundles.md) each have their own pinned image and bounded interface. Browser automation stays with managed Browser Run. These profiles do not replace every Kali operation.
+
+## Named instance presets (development)
+
+The next SDK version uses Cloudflare's named Container presets. Most bounded packs start on `lite`; recon, password and Metasploit use `standard-1`. `ready()` verifies and prepares a runtime without executing a scanner. Actual tool execution still waits for readiness and verifies the image manifest. SDK-only lifecycle/sizing updates can retain the same tool lock and image when their executable payload and image manifest are unchanged. Released SDK versions remain immutable.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,14 @@
+# Third-party software
+
+The npm package contains the PentCloud adapter and tool release metadata. The separately built container contains unchanged upstream executables:
+
+| Tool | Release | Source and license |
+| --- | --- | --- |
+| httpx | v1.12.0 | https://github.com/projectdiscovery/httpx/tree/v1.12.0 |
+| dnsx | v1.3.1 | https://github.com/projectdiscovery/dnsx/tree/v1.3.1 |
+| Katana | v1.8.0 | https://github.com/projectdiscovery/katana/tree/v1.8.0 |
+| Subfinder | v2.17.0 | https://github.com/projectdiscovery/subfinder/tree/v2.17.0 |
+
+The build verifies each upstream archive and executable using `tools.lock.json`, and includes the archive's license files under `/usr/share/licenses/pentcloud-recon/<tool>/`. The upstream tools retain their own licenses; the adapter's MIT license does not replace them.
+
+The base is the pinned Alpine Linux 3.22.2 linux/amd64 image. Alpine packages retain their respective licenses. Base source and package metadata are available from https://alpinelinux.org/ and https://pkgs.alpinelinux.org/packages?branch=v3.22. Review the applicable upstream distribution obligations before redistributing a built image.

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@memrov2/pentcloud-recon",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1-dev.0",
+  "description": "A small Cloudflare-native runtime for httpx, dnsx, Katana and Subfinder",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Memrov/PentCloud-tools.git"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.d.mts",
+      "import": "./src/index.mjs"
+    },
+    "./worker": {
+      "types": "./src/worker.d.mts",
+      "import": "./src/worker.mjs"
+    },
+    "./tools.lock.json": "./tools.lock.json"
+  },
+  "files": [
+    "src",
+    "tools.lock.json",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "test:runner": "go test ./runner",
+    "image:prepare": "python3 scripts/prepare-image.py",
+    "image:build": "node scripts/build-image.mjs",
+    "prepublishOnly": "npm test && npm run test:runner && npm run test:image && npm run typecheck",
+    "typecheck": "wrangler types --config examples/cloudflare/wrangler.jsonc .cache/worker-types.d.ts && tsc --noEmit --strict --skipLibCheck --module nodenext --moduleResolution nodenext --target es2022 .cache/worker-types.d.ts test/types.ts",
+    "test:image": "python3 -m unittest discover -s test -p \"*_test.py\"",
+    "coverage": "node scripts/coverage.mjs",
+    "test:bundles": "node --test test/packs.test.mjs test/pack-runtime.test.mjs",
+    "image:pack": "python3 scripts/prepare-pack.py",
+    "image:pack:build": "node scripts/build-pack.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "wrangler": "4.157.0"
+  },
+  "workspaces": [
+    "packages/*"
+  ]
+}

package/src/index.d.mts

@@ -0,0 +1,36 @@
+export type ReconTool = "httpx" | "dnsx" | "katana" | "subfinder";
+export interface ReconRequest {
+  tool: ReconTool;
+  target: string;
+}
+export interface ReconCommand {
+  argv: string[];
+  stdin: string;
+  timeoutMs: number;
+}
+export interface ReconResult {
+  tool: ReconTool;
+  toolVersion: string;
+  packVersion: string;
+  image: string;
+  startedAt: string;
+  finishedAt: string;
+  argv: string[];
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+  truncated: boolean;
+  processMs: number;
+  firstJSONMs: number;
+  cpuUserMs?: number;
+  cpuSystemMs?: number;
+  maxRSSKiB?: number;
+  error?: string;
+}
+export declare const packVersion: string;
+export declare const tools: readonly Readonly<{
+  tool: ReconTool;
+  version: string;
+}>[];
+export declare function buildCommand(request: ReconRequest): ReconCommand;

package/src/index.mjs

@@ -0,0 +1,144 @@
+import lock from "../tools.lock.json" with { type: "json" };
+export const packVersion = lock.packVersion;
+export const tools = Object.freeze(
+  lock.tools.map(({ tool, version }) => Object.freeze({ tool, version })),
+);
+const prefix = "/opt/pentcloud-recon/bin/";
+function hostname(value) {
+  if (
+    value.length > 253 ||
+    !value
+      .split(".")
+      .every(
+        (s) =>
+          s.length > 0 &&
+          s.length <= 63 &&
+          /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(s),
+      )
+  )
+    throw new TypeError(
+      "Use a DNS hostname, without a URL, wildcard or options",
+    );
+  return value.toLowerCase();
+}
+export function buildCommand(input) {
+  if (
+    !input ||
+    typeof input !== "object" ||
+    Array.isArray(input) ||
+    Object.keys(input).some((k) => !["tool", "target"].includes(k))
+  )
+    throw new TypeError("Expected only tool and target");
+  const { tool, target } = input;
+  if (
+    !tools.some((t) => t.tool === tool) ||
+    typeof target !== "string" ||
+    !target ||
+    target.length > 2048 ||
+    /[\s\x00-\x1f\x7f]/.test(target)
+  )
+    throw new TypeError("Unsupported tool or invalid target");
+  let args,
+    stdin = "";
+  if (tool === "httpx" || tool === "katana") {
+    let url;
+    try {
+      url = new URL(target);
+    } catch {
+      throw new TypeError("Use an absolute HTTP or HTTPS URL");
+    }
+    if (
+      !["http:", "https:"].includes(url.protocol) ||
+      !url.hostname ||
+      url.username ||
+      url.password ||
+      url.hash
+    )
+      throw new TypeError(
+        "Use an HTTP(S) URL without credentials or a fragment",
+      );
+    const normalized = url.href;
+    if (tool === "httpx") {
+      args = [
+        "-j",
+        "-silent",
+        "-duc",
+        "-sc",
+        "-title",
+        "-server",
+        "-td",
+        "-nfs",
+        "-rl",
+        "2",
+        "-t",
+        "1",
+        "-timeout",
+        "10",
+      ];
+      stdin = normalized + "\n";
+    } else {
+      if (url.search)
+        throw new TypeError("Start a crawl with a URL without a query string");
+      const scope = normalized.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      args = [
+        "-u",
+        normalized,
+        "-cs",
+        "^" + scope,
+        "-d",
+        "2",
+        "-c",
+        "1",
+        "-p",
+        "1",
+        "-rl",
+        "2",
+        "-ct",
+        "20s",
+        "-timeout",
+        "10",
+        "-jc",
+        "-no-default-ext-filter",
+        "-j",
+        "-silent",
+        "-duc",
+      ];
+    }
+  } else {
+    const host = hostname(target);
+    if (tool === "dnsx") {
+      args = [
+        "-j",
+        "-silent",
+        "-duc",
+        "-a",
+        "-aaaa",
+        "-rl",
+        "2",
+        "-t",
+        "1",
+        "-timeout",
+        "5",
+        "-retry",
+        "1",
+      ];
+      stdin = host + "\n";
+    } else
+      args = [
+        "-d",
+        host,
+        "-sources",
+        "crtname",
+        "-json",
+        "-silent",
+        "-duc",
+        "-rl",
+        "1",
+        "-timeout",
+        "10",
+        "-max-time",
+        "1",
+      ];
+  }
+  return { argv: [prefix + tool, ...args], stdin, timeoutMs: 75000 };
+}

package/src/worker.d.mts

@@ -0,0 +1,8 @@
+import { DurableObject } from "cloudflare:workers";
+import type { ReconRequest, ReconResult } from "./index.mjs";
+export declare class ReconRunner extends DurableObject {
+  ready(): Promise<{ image: string; instance: "standard-1"; readyMs: number }>;
+  run(request: ReconRequest): Promise<ReconResult & { readyMs: number }>;
+  retire(): Promise<{ stopped: boolean; retired: true }>;
+  stop(): Promise<{ stopped: boolean }>;
+}

package/src/worker.mjs

@@ -0,0 +1,149 @@
+import { DurableObject } from "cloudflare:workers";
+import { buildCommand, packVersion, tools } from "./index.mjs";
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const decode = (data) => new TextDecoder().decode(data);
+async function exec(
+  container,
+  argv,
+  body,
+  signal = AbortSignal.timeout(90000),
+) {
+  const process = await container.exec(argv, {
+    signal,
+    ...(body ? { stdin: new Blob([body]).stream() } : {}),
+  });
+  const result = await process.output();
+  return {
+    exitCode: result.exitCode,
+    stdout: decode(result.stdout),
+    stderr: decode(result.stderr),
+  };
+}
+/** One identity per assessment run. Only trusted Worker/Workflow bindings call this object. */
+export class ReconRunner extends DurableObject {
+  #queue = Promise.resolve();
+  #serialize(action) {
+    const result = this.#queue.then(action);
+    this.#queue = result.catch(() => {});
+    return result;
+  }
+  async #ready() {
+      if (await this.ctx.storage.get("retired")) throw new Error("Owned tool runtime is retired");
+    const container = this.ctx.container,
+      image = container.images.recon,
+      start = Date.now();
+    if (!image) throw new Error("Configure the recon named image");
+    if (container.running) {
+      const info = await container.inspect();
+      if (info?.image && info.image !== image)
+        throw new Error(
+          "Recon image changed; finish this run and stop its runtime before upgrading",
+        );
+    } else
+      container.start({
+        image,
+        instance: "standard-1",
+        enableInternet: true,
+        labels: { pack: "recon", version: packVersion },
+      });
+    await container.setInactivityTimeout(120000);
+    const deadline = AbortSignal.timeout(90000);
+    let ready = false;
+    while (Date.now() - start < 90000 && !deadline.aborted) {
+      try {
+        if (
+          (await exec(container, ["/bin/true"], undefined, deadline))
+            .exitCode === 0
+        ) {
+          ready = true;
+          break;
+        }
+      } catch {}
+      if (!deadline.aborted)
+        await wait(Math.min(1000, Math.max(0, 90000 - (Date.now() - start))));
+    }
+    if (!ready)
+      throw new Error("Recon container did not become ready within 90 seconds");
+    const marker = await exec(
+      container,
+      ["/bin/cat", "/opt/pentcloud-recon/pack.json"],
+      undefined,
+      deadline,
+    );
+    if (marker.exitCode !== 0)
+      throw new Error("Recon image is missing its release manifest");
+    let release;
+    try {
+      release = JSON.parse(marker.stdout);
+    } catch {
+      throw new Error("Invalid recon image release manifest");
+    }
+    if (
+      release.packVersion !== packVersion ||
+      tools.some(
+        (t) =>
+          !release.tools?.some(
+            (v) => v.tool === t.tool && v.version === t.version,
+          ),
+      )
+    )
+      throw new Error("Recon image and SDK versions do not match");
+    const info = await container.inspect();
+    if (info?.image !== image)
+      throw new Error("Unable to verify recon image identity");
+    return { image, instance: "standard-1", readyMs: Date.now() - start };
+  }
+  ready() {
+    return this.#serialize(() => this.#ready());
+  }
+  run(input) {
+    const command = buildCommand(input);
+    return this.#serialize(async () => {
+      const startedAt = new Date().toISOString(),
+        ready = await this.#ready();
+      const output = await exec(
+        this.ctx.container,
+        ["/opt/pentcloud-recon/bin/recon-exec"],
+        JSON.stringify(command),
+      );
+      if (output.exitCode !== 0)
+        throw new Error("Recon execution helper failed");
+      let result;
+      try {
+        result = JSON.parse(output.stdout);
+      } catch {
+        throw new Error("Invalid recon execution response");
+      }
+      if (
+        !Number.isInteger(result.exitCode) ||
+        typeof result.stdout !== "string" ||
+        typeof result.stderr !== "string" ||
+        typeof result.timedOut !== "boolean" ||
+        typeof result.truncated !== "boolean"
+      )
+        throw new Error("Incomplete recon execution response");
+      return {
+        ...result,
+        ...ready,
+        tool: input.tool,
+        toolVersion: tools.find((t) => t.tool === input.tool).version,
+        packVersion,
+        startedAt,
+        finishedAt: new Date().toISOString(),
+      };
+    });
+  }
+  retire() {
+    return this.#serialize(async () => {
+      await this.ctx.storage.put("retired", true);
+      if (this.ctx.container.running) await this.ctx.container.destroy();
+      return { stopped: !this.ctx.container.running, retired: true };
+    });
+  }
+  stop() {
+    return this.#serialize(async () => {
+      if (this.ctx.container.running) await this.ctx.container.destroy();
+      return { stopped: !this.ctx.container.running };
+    });
+  }
+}

package/tools.lock.json

@@ -0,0 +1,44 @@
+{
+  "schemaVersion": 1,
+  "packVersion": "0.1.0",
+  "platform": "linux/amd64",
+  "baseImage": "docker.io/library/alpine@sha256:85f2b723e106c34644cd5851d7e81ee87da98ac54672b29947c052a45d31dc2f",
+  "tools": [
+    {
+      "tool": "httpx",
+      "version": "v1.12.0",
+      "assetSha256": "9d8439e8b6c9aa7d1e2314817a392e00d5178da3af5652f7475f88868f418f76",
+      "downloadBytes": 19200026,
+      "binaryBytes": 54444194,
+      "url": "https://github.com/projectdiscovery/httpx/releases/download/v1.12.0/httpx_1.12.0_linux_amd64.zip",
+      "binarySha256": "6d78b83b4da452a7e0bd3613c4fae04cbf523209f083904b563f4d4406a680b0"
+    },
+    {
+      "tool": "dnsx",
+      "version": "v1.3.1",
+      "assetSha256": "438b964653056dd51dcfe614b1a16f8bced3cc48a1d27bc07cc6fdf2ef2a9533",
+      "downloadBytes": 9829391,
+      "binaryBytes": 28569784,
+      "url": "https://github.com/projectdiscovery/dnsx/releases/download/v1.3.1/dnsx_1.3.1_linux_amd64.zip",
+      "binarySha256": "5fca43ddfe95922d8d88a859c1fcc59fee327bf39ae574db66d391c6675b8ba3"
+    },
+    {
+      "tool": "katana",
+      "version": "v1.8.0",
+      "assetSha256": "cb027ae99d0757061b70c07a15c7a80f62c5a535ab52c4a329f80c4b0a7309d2",
+      "downloadBytes": 31910234,
+      "binaryBytes": 68030626,
+      "url": "https://github.com/projectdiscovery/katana/releases/download/v1.8.0/katana_1.8.0_linux_amd64.zip",
+      "binarySha256": "3214c11a0548667b37ec17bbb691706b7e0de1f0f24b3ead2ee12c301ebc1bbc"
+    },
+    {
+      "tool": "subfinder",
+      "version": "v2.17.0",
+      "assetSha256": "a39c3e5c7a26ef3c430915c4d6cbf7716a00f26769a75e9405aba796142eba37",
+      "downloadBytes": 10308162,
+      "binaryBytes": 30474402,
+      "url": "https://github.com/projectdiscovery/subfinder/releases/download/v2.17.0/subfinder_2.17.0_linux_amd64.zip",
+      "binarySha256": "bf4ad8590702b0bb92be9b3be185f96a230b047c9b97f2831cf8914344f0b15a"
+    }
+  ]
+}