icarus-cmd 0.3.1

package/src/tools/whatweb.js

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export default {
+  id: 'whatweb',
+  name: 'WhatWeb',
+  category: 'recon',
+  description: 'Empreinte technologique (CMS, frameworks)',
+  needs: 'url',
+  needsWorkdir: true,
+  bins: ['whatweb'],
+  winPaths: [],
+  install: 'gem install whatweb  (ou https://github.com/urbanadventurer/WhatWeb)',
+
+  command(target, opts = {}) {
+    const out = join(opts.workdir, 'whatweb.json');
+    return { args: [`--log-json=${out}`, '--no-errors', target] };
+  },
+
+  parse({ workdir, target }) {
+    const out = join(workdir || '', 'whatweb.json');
+    if (!workdir || !existsSync(out)) return [];
+    let arr;
+    try { arr = JSON.parse(readFileSync(out, 'utf8')); } catch { return []; }
+    const findings = [];
+    for (const entry of [].concat(arr)) {
+      const plugins = entry.plugins || {};
+      const techs = Object.keys(plugins);
+      if (!techs.length) continue;
+      findings.push({
+        type: 'fingerprint',
+        severity: 'info',
+        title: `Technos: ${techs.slice(0, 12).join(', ')}`,
+        detail: entry.target || target,
+        ref: 'whatweb',
+      });
+    }
+    return findings;
+  },
+};

package/src/tools/wpscan.js

@@ -0,0 +1,58 @@
+import { normalize } from '../core/severity.js';
+
+export default {
+  id: 'wpscan',
+  name: 'WPScan',
+  category: 'web',
+  description: 'Scanner de sécurité WordPress',
+  needs: 'url',
+  bins: ['wpscan'],
+  winPaths: [],
+  install: 'gem install wpscan  (https://wpscan.com)',
+
+  options: [
+    { key: 'enumerate', label: 'Énumérer', type: 'select', default: '', choices: [
+      { value: '', label: 'Défaut' }, { value: 'vp', label: 'Plugins vulnérables' },
+      { value: 'ap', label: 'Tous les plugins' }, { value: 'u', label: 'Utilisateurs' },
+    ] },
+    { key: 'apiToken', label: 'API token (WPScan)', type: 'text', placeholder: 'optionnel — enrichit les vulns' },
+  ],
+
+  command(target, opts = {}) {
+    const args = ['--url', target, '--format', 'json', '--no-banner'];
+    if (opts.apiToken) args.push('--api-token', opts.apiToken);
+    if (opts.enumerate) args.push('--enumerate', opts.enumerate);
+    return { args };
+  },
+
+  parse({ stdout, target }) {
+    const start = stdout.indexOf('{');
+    if (start < 0) return [];
+    let data;
+    try { data = JSON.parse(stdout.slice(start)); } catch { return []; }
+
+    const findings = [];
+    const pushVulns = (vulns, label) => {
+      for (const v of vulns || []) {
+        findings.push({
+          type: 'cms',
+          severity: normalize(v.severity) === 'unknown' ? 'high' : normalize(v.severity),
+          title: `${label}: ${v.title}`,
+          detail: (v.references?.cve || []).map((c) => `CVE-${c}`).join(', ') || target,
+          ref: 'wpscan',
+        });
+      }
+    };
+
+    if (data.version) {
+      pushVulns(data.version.vulnerabilities, `WordPress ${data.version.number || ''}`.trim());
+    }
+    for (const [name, p] of Object.entries(data.plugins || {})) pushVulns(p.vulnerabilities, `plugin ${name}`);
+    for (const [name, t] of Object.entries(data.themes || {})) pushVulns(t.vulnerabilities, `thème ${name}`);
+
+    if (data.version?.number && !findings.length) {
+      findings.push({ type: 'cms', severity: 'info', title: `WordPress ${data.version.number} détecté`, detail: target, ref: 'wpscan' });
+    }
+    return findings;
+  },
+};

package/src/tools/zap.js

@@ -0,0 +1,73 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { normalize } from '../core/severity.js';
+
+const RISK = { 3: 'high', 2: 'medium', 1: 'low', 0: 'info' };
+
+// java.exe en chemin absolu : spawn(shell:false) avec un cwd custom ne résout
+// pas un nom court ("java") -> ENOENT. On le localise via JAVA_HOME puis PATH.
+function findJava() {
+  const exe = process.platform === 'win32' ? 'java.exe' : 'java';
+  const cands = [];
+  if (process.env.JAVA_HOME) cands.push(join(process.env.JAVA_HOME, 'bin', exe));
+  cands.push('C:/Program Files/Common Files/Oracle/Java/javapath/' + exe);
+  for (const p of (process.env.PATH || '').split(process.platform === 'win32' ? ';' : ':')) {
+    if (p) cands.push(join(p, exe));
+  }
+  for (const c of cands) { if (existsSync(c)) return c; }
+  return 'java';
+}
+
+export default {
+  id: 'zap',
+  name: 'OWASP ZAP',
+  category: 'web',
+  description: "Scanner d'applications web (OWASP)",
+  needs: 'url',
+  needsWorkdir: true,
+  bins: ['zap.bat', 'zap.sh', 'zap'],
+  winPaths: [
+    'C:/Program Files/ZAP/Zed Attack Proxy/zap.bat',
+    'C:/Program Files (x86)/ZAP/Zed Attack Proxy/zap.bat',
+  ],
+  install: 'https://www.zaproxy.org/download/   (ou: docker run zaproxy/zap-stable)',
+
+  command(target, opts = {}) {
+    const report = join(opts.workdir, 'zap.json');
+    // zap.bat lance `java -jar zap-x.y.z.jar` en chemin RELATIF : lancé depuis
+    // un dossier temp, il ne trouve pas son .jar (échec instantané). On appelle
+    // donc java directement avec le .jar en chemin absolu, en exécutant depuis
+    // le dossier d'installation de ZAP (pour ses ressources).
+    const dir = opts.bin ? dirname(opts.bin) : '';
+    let jar = '';
+    try { jar = readdirSync(dir).find((f) => /^zap.*\.jar$/i.test(f)) || ''; } catch { /* ignore */ }
+    const jarPath = jar ? join(dir, jar) : join(dir, 'zap.jar');
+    return {
+      cmd: findJava(),
+      cwd: dir || undefined,
+      args: ['-Xmx512m', '-jar', jarPath, '-cmd', '-quickurl', target, '-quickout', report, '-quickprogress'],
+    };
+  },
+
+  parse({ workdir, target }) {
+    const report = join(workdir || '', 'zap.json');
+    if (!workdir || !existsSync(report)) return [];
+    let data;
+    try { data = JSON.parse(readFileSync(report, 'utf8')); } catch { return []; }
+
+    const findings = [];
+    for (const site of data.site || []) {
+      for (const alert of site.alerts || []) {
+        const uri = alert.instances?.[0]?.uri || site['@name'] || target;
+        findings.push({
+          type: 'web',
+          severity: normalize(RISK[Number(alert.riskcode)] ?? alert.riskdesc),
+          title: alert.name || alert.alert || 'alerte ZAP',
+          detail: uri,
+          ref: alert.cweid ? `CWE-${alert.cweid}` : 'zap',
+        });
+      }
+    }
+    return findings;
+  },
+};

package/src/ui/anim.js

@@ -0,0 +1,59 @@
+// Petites animations terminal : spinner live + helpers. Tout se désactive
+// proprement hors TTY (sortie pipée / CI) pour ne pas polluer les logs.
+import chalk from 'chalk';
+
+const ESC = '\x1b';
+const FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+// Jeu d'icônes — style "épuré" : chevron doré en préfixe de menu, points
+// colorés pour les sévérités. Cohérent, rend partout (pas d'emoji).
+export const GOLD = '#d4a843';
+export const chevron = chalk.hex(GOLD)('❯');
+export const ICON = {
+  chevron: '❯', dot: '●',
+  ok: '✓', miss: '✗', warn: '!', star: '✦', report: '❯',
+  // toutes les sévérités = même point, la couleur porte le sens
+  critical: '●', high: '●', medium: '●', low: '●', info: '●',
+};
+export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export const isTTY = () => Boolean(process.stdout.isTTY) && !process.env.NO_COLOR && !process.env.CI;
+
+const HIDE = `${ESC}[?25l`;
+const SHOW = `${ESC}[?25h`;
+const CLEARLINE = `\r${ESC}[2K`;
+
+// Spinner avec lignes de résultat qui défilent au-dessus (spin.log).
+export function startSpinner(text) {
+  if (!isTTY()) {
+    return { update() {}, log: (l) => console.log(l), stop: (l) => l && console.log(l) };
+  }
+  let i = 0;
+  let cur = text;
+  process.stdout.write(HIDE);
+  const render = () => {
+    i = (i + 1) % FRAMES.length;
+    process.stdout.write(CLEARLINE + chalk.hex('#f59e0b')(FRAMES[i]) + '  ' + cur);
+  };
+  const timer = setInterval(render, 80);
+  render();
+  return {
+    update(t) { cur = t; },
+    log(line) { process.stdout.write(CLEARLINE + line + '\n'); render(); },
+    stop(line) {
+      clearInterval(timer);
+      process.stdout.write(CLEARLINE + (line ? line + '\n' : '') + SHOW);
+    },
+  };
+}
+
+// Affiche des lignes une par une avec un léger délai (effet "déploiement").
+export async function revealLines(lines, { delay = 26, indent = '' } = {}) {
+  if (!isTTY()) { console.log(lines.map((l) => indent + l).join('\n')); return; }
+  for (const l of lines) {
+    process.stdout.write(indent + l + '\n');
+    await sleep(delay);
+  }
+}
+
+// Efface la ligne courante (utilisé pour nettoyer après un spinner inline).
+export const clearLine = () => { if (isTTY()) process.stdout.write(CLEARLINE); };

package/src/ui/banner.js

@@ -0,0 +1,49 @@
+import chalk from 'chalk';
+import { LOGO } from './logo.js';
+import { isTTY, sleep, revealLines } from './anim.js';
+
+const GOLD = '#d4a843';
+const GOLD_HI = '#fff3cf';
+const INDENT = '  ';
+const CLR = '\r\x1b[2K'; // retour début de ligne + efface la ligne
+// Aligne le texte sous le centre du logo.
+const PAD = ' '.repeat(Math.max(0, Math.round((LOGO.length ? 44 : 20) / 2) - 6));
+
+function wordmark(highlight = -1) {
+  const letters = 'ICARUS'.split('');
+  return letters
+    .map((c, i) => (i === highlight ? chalk.hex(GOLD_HI).bold(c) : chalk.hex(GOLD).bold(c)))
+    .join(' ');
+}
+
+// Bannière statique (utilisée partout, y compris sortie pipée).
+export function banner() {
+  return (
+    '\n' +
+    LOGO.map((l) => INDENT + l).join('\n') +
+    '\n\n' +
+    PAD + wordmark() +
+    '\n'
+  );
+}
+
+// Bannière animée : déploiement du logo + balayage lumineux sur ICARUS.
+export async function intro() {
+  if (!isTTY()) { console.log(banner()); return; }
+  process.stdout.write('\n');
+  await revealLines(LOGO, { delay: 22, indent: INDENT });
+  process.stdout.write('\n');
+
+  // balayage lumineux lettre par lettre
+  for (let h = 0; h <= 6; h++) {
+    process.stdout.write(CLR + PAD + wordmark(h));
+    await sleep(55);
+  }
+  process.stdout.write(CLR + PAD + wordmark() + '\n');
+  console.log('');
+}
+
+export function rule(label = '') {
+  const line = '─'.repeat(Math.max(0, 60 - label.length));
+  return chalk.gray(`── ${chalk.white.bold(label)} ${line}`);
+}

package/src/ui/logo.js

@@ -0,0 +1,20 @@
+// Généré par scripts/gen-logo.mjs depuis logo.png — ne pas éditer à la main.
+export const LOGO = [
+  "  \u001b[38;2;229;206;164m\u001b[48;2;238;209;162m▀\u001b[0m\u001b[38;2;222;196;153m▄\u001b[0m                                    \u001b[38;2;210;181;134m▄\u001b[0m\u001b[38;2;204;176;130m\u001b[48;2;222;187;138m▀\u001b[0m  ",
+  "  \u001b[38;2;220;189;140m\u001b[48;2;213;181;135m▀\u001b[0m\u001b[38;2;235;202;153m\u001b[48;2;229;195;144m▀\u001b[0m\u001b[38;2;222;194;150m\u001b[48;2;231;197;147m▀\u001b[0m\u001b[38;2;222;191;145m▄\u001b[0m                                \u001b[38;2;208;177;130m▄\u001b[0m\u001b[38;2;210;179;132m\u001b[48;2;216;179;128m▀\u001b[0m\u001b[38;2;218;182;131m\u001b[48;2;213;177;126m▀\u001b[0m\u001b[38;2;205;171;124m\u001b[48;2;196;163;116m▀\u001b[0m  ",
+  "   \u001b[38;2;223;188;137m\u001b[48;2;204;171;123m▀\u001b[0m\u001b[38;2;225;190;140m\u001b[48;2;218;182;131m▀\u001b[0m\u001b[38;2;227;192;141m\u001b[48;2;221;186;134m▀\u001b[0m\u001b[38;2;221;190;142m\u001b[48;2;223;186;135m▀\u001b[0m\u001b[38;2;222;190;143m▄\u001b[0m                            \u001b[38;2;208;176;126m▄\u001b[0m\u001b[38;2;202;171;124m\u001b[48;2;209;173;121m▀\u001b[0m\u001b[38;2;213;177;125m\u001b[48;2;208;171;120m▀\u001b[0m\u001b[38;2;211;174;123m\u001b[48;2;205;169;118m▀\u001b[0m\u001b[38;2;208;171;121m\u001b[48;2;191;156;110m▀\u001b[0m   ",
+  "    \u001b[38;2;209;174;124m▀\u001b[0m\u001b[38;2;214;177;126m\u001b[48;2;208;171;121m▀\u001b[0m\u001b[38;2;216;180;129m\u001b[48;2;209;172;121m▀\u001b[0m\u001b[38;2;216;180;128m\u001b[48;2;211;174;123m▀\u001b[0m\u001b[38;2;219;185;135m\u001b[48;2;211;174;122m▀\u001b[0m\u001b[38;2;212;177;126m▄\u001b[0m                        \u001b[38;2;202;167;117m▄\u001b[0m\u001b[38;2;206;172;122m\u001b[48;2;200;162;109m▀\u001b[0m\u001b[38;2;204;167;115m\u001b[48;2;199;162;111m▀\u001b[0m\u001b[38;2;204;167;116m\u001b[48;2;197;160;109m▀\u001b[0m\u001b[38;2;202;165;114m\u001b[48;2;194;157;107m▀\u001b[0m\u001b[38;2;196;160;110m\u001b[48;2;172;139;98m▀\u001b[0m    ",
+  "     \u001b[38;2;183;149;104m▀\u001b[0m\u001b[38;2;203;167;116m▀\u001b[0m\u001b[38;2;205;167;116m\u001b[48;2;194;157;106m▀\u001b[0m\u001b[38;2;206;168;117m\u001b[48;2;201;163;111m▀\u001b[0m\u001b[38;2;207;170;118m\u001b[48;2;201;162;110m▀\u001b[0m\u001b[38;2;206;169;118m\u001b[48;2;202;164;112m▀\u001b[0m\u001b[38;2;202;166;115m▄\u001b[0m                    \u001b[38;2;191;156;106m▄\u001b[0m\u001b[38;2;197;161;111m\u001b[48;2;193;154;103m▀\u001b[0m\u001b[38;2;197;158;106m\u001b[48;2;191;153;102m▀\u001b[0m\u001b[38;2;196;159;107m\u001b[48;2;191;153;102m▀\u001b[0m\u001b[38;2;194;156;105m\u001b[48;2;185;148;100m▀\u001b[0m\u001b[38;2;190;153;104m▀\u001b[0m\u001b[38;2;170;137;94m▀\u001b[0m     ",
+  "        \u001b[38;2;187;150;102m▀\u001b[0m\u001b[38;2;196;157;105m\u001b[48;2;180;144;97m▀\u001b[0m\u001b[38;2;197;158;105m\u001b[48;2;192;153;100m▀\u001b[0m\u001b[38;2;198;158;106m\u001b[48;2;192;152;99m▀\u001b[0m\u001b[38;2;197;160;108m\u001b[48;2;192;153;100m▀\u001b[0m\u001b[38;2;193;154;102m▄\u001b[0m                \u001b[38;2;186;148;99m▄\u001b[0m\u001b[38;2;187;150;101m\u001b[48;2;187;147;96m▀\u001b[0m\u001b[38;2;188;150;99m\u001b[48;2;186;147;96m▀\u001b[0m\u001b[38;2;188;149;99m\u001b[48;2;184;145;96m▀\u001b[0m\u001b[38;2;187;149;99m\u001b[48;2;170;135;91m▀\u001b[0m\u001b[38;2;177;141;93m▀\u001b[0m        ",
+  "       \u001b[38;2;179;144;97m▀\u001b[0m\u001b[38;2;185;147;96m▄\u001b[0m\u001b[38;2;179;145;98m▄\u001b[0m \u001b[38;2;184;145;93m▀\u001b[0m\u001b[38;2;187;147;96m\u001b[48;2;178;139;88m▀\u001b[0m\u001b[38;2;186;147;95m\u001b[48;2;183;143;92m▀\u001b[0m\u001b[38;2;188;148;97m\u001b[48;2;182;142;90m▀\u001b[0m\u001b[38;2;182;149;104m\u001b[48;2;185;146;95m▀\u001b[0m\u001b[38;2;182;147;101m▄\u001b[0m           \u001b[38;2;183;144;93m▄\u001b[0m\u001b[38;2;184;146;95m\u001b[48;2;180;140;89m▀\u001b[0m\u001b[38;2;184;143;92m\u001b[48;2;181;141;90m▀\u001b[0m\u001b[38;2;184;144;93m\u001b[48;2;176;138;89m▀\u001b[0m\u001b[38;2;181;142;93m▀\u001b[0m\u001b[38;2;162;127;83m▀\u001b[0m\u001b[38;2;176;144;98m▄\u001b[0m\u001b[38;2;178;140;91m▄\u001b[0m\u001b[38;2;170;137;91m▀\u001b[0m       ",
+  "        \u001b[38;2;167;130;81m▀\u001b[0m\u001b[38;2;179;139;87m\u001b[48;2;176;137;86m▀\u001b[0m\u001b[38;2;182;146;96m\u001b[48;2;175;136;85m▀\u001b[0m\u001b[38;2;175;137;87m▄\u001b[0m \u001b[38;2;171;133;84m▀\u001b[0m\u001b[38;2;180;141;89m\u001b[48;2;168;131;83m▀\u001b[0m\u001b[38;2;178;138;87m\u001b[48;2;177;137;85m▀\u001b[0m\u001b[38;2;181;142;90m\u001b[48;2;177;138;87m▀\u001b[0m\u001b[38;2;183;147;101m\u001b[48;2;174;136;87m▀\u001b[0m   \u001b[38;2;224;193;145m▄\u001b[0m\u001b[38;2;228;196;147m▄\u001b[0m   \u001b[38;2;176;140;93m\u001b[48;2;176;137;87m▀\u001b[0m\u001b[38;2;179;140;89m\u001b[48;2;176;136;85m▀\u001b[0m\u001b[38;2;177;137;86m\u001b[48;2;176;136;85m▀\u001b[0m\u001b[38;2;178;139;88m\u001b[48;2;167;130;83m▀\u001b[0m\u001b[38;2;170;133;84m▀\u001b[0m \u001b[38;2;175;138;89m▄\u001b[0m\u001b[38;2;177;142;94m\u001b[48;2;172;133;83m▀\u001b[0m\u001b[38;2;174;135;85m\u001b[48;2;169;131;83m▀\u001b[0m\u001b[38;2;167;129;82m▀\u001b[0m        ",
+  "          \u001b[38;2;172;133;83m▀\u001b[0m\u001b[38;2;173;133;83m\u001b[48;2;169;130;81m▀\u001b[0m\u001b[38;2;173;134;83m\u001b[48;2;170;131;82m▀\u001b[0m\u001b[38;2;177;142;97m\u001b[48;2;170;132;82m▀\u001b[0m\u001b[38;2;174;135;86m▄\u001b[0m\u001b[38;2;176;136;84m\u001b[48;2;172;132;81m▀\u001b[0m\u001b[38;2;174;134;83m\u001b[48;2;171;131;81m▀\u001b[0m\u001b[38;2;175;136;85m\u001b[48;2;173;134;83m▀\u001b[0m  \u001b[38;2;205;175;129m\u001b[48;2;208;174;126m▀\u001b[0m\u001b[38;2;228;193;142m\u001b[48;2;222;186;135m▀\u001b[0m\u001b[38;2;228;194;143m\u001b[48;2;222;187;136m▀\u001b[0m\u001b[38;2;209;180;137m\u001b[48;2;205;172;125m▀\u001b[0m  \u001b[38;2;175;135;85m\u001b[48;2;171;133;83m▀\u001b[0m\u001b[38;2;174;135;84m\u001b[48;2;170;132;82m▀\u001b[0m\u001b[38;2;173;134;84m\u001b[48;2;169;130;81m▀\u001b[0m\u001b[38;2;156;122;79m\u001b[48;2;171;133;84m▀\u001b[0m\u001b[38;2;174;140;94m\u001b[48;2;168;129;80m▀\u001b[0m\u001b[38;2;170;132;83m\u001b[48;2;167;129;80m▀\u001b[0m\u001b[38;2;170;132;82m\u001b[48;2;165;128;81m▀\u001b[0m\u001b[38;2;167;130;82m\u001b[48;2;151;117;76m▀\u001b[0m\u001b[38;2;149;116;74m▀\u001b[0m         ",
+  "            \u001b[38;2;165;127;79m▀\u001b[0m\u001b[38;2;167;129;80m\u001b[48;2;161;125;77m▀\u001b[0m\u001b[38;2;169;130;80m\u001b[48;2;165;127;78m▀\u001b[0m\u001b[38;2;169;129;80m\u001b[48;2;165;127;77m▀\u001b[0m\u001b[38;2;169;129;79m\u001b[48;2;165;126;77m▀\u001b[0m\u001b[38;2;168;129;80m\u001b[48;2;164;126;78m▀\u001b[0m\u001b[38;2;155;121;76m▄\u001b[0m  \u001b[38;2;218;183;131m\u001b[48;2;212;175;123m▀\u001b[0m\u001b[38;2;216;181;129m\u001b[48;2;211;176;124m▀\u001b[0m   \u001b[38;2;166;128;79m\u001b[48;2;160;122;74m▀\u001b[0m\u001b[38;2;166;127;79m\u001b[48;2;161;123;75m▀\u001b[0m\u001b[38;2;165;127;79m\u001b[48;2;161;123;76m▀\u001b[0m\u001b[38;2;164;126;78m\u001b[48;2;160;123;76m▀\u001b[0m\u001b[38;2;163;126;79m\u001b[48;2;153;118;75m▀\u001b[0m\u001b[38;2;159;123;77m▀\u001b[0m            ",
+  "              \u001b[38;2;153;118;73m▀\u001b[0m\u001b[38;2;163;125;77m\u001b[48;2;147;112;70m▀\u001b[0m\u001b[38;2;162;123;75m\u001b[48;2;157;120;73m▀\u001b[0m\u001b[38;2;163;125;77m\u001b[48;2;160;123;75m▀\u001b[0m\u001b[38;2;161;125;78m\u001b[48;2;150;115;72m▀\u001b[0m  \u001b[38;2;206;169;118m\u001b[48;2;197;160;110m▀\u001b[0m\u001b[38;2;203;167;117m\u001b[48;2;195;159;110m▀\u001b[0m  \u001b[38;2;150;115;71m\u001b[48;2;146;112;69m▀\u001b[0m\u001b[38;2;158;120;73m\u001b[48;2;152;116;70m▀\u001b[0m\u001b[38;2;155;118;71m\u001b[48;2;149;114;69m▀\u001b[0m\u001b[38;2;155;119;73m\u001b[48;2;137;105;65m▀\u001b[0m\u001b[38;2;148;113;71m▀\u001b[0m              ",
+  "                \u001b[38;2;145;112;69m▀\u001b[0m\u001b[38;2;154;119;73m\u001b[48;2;143;109;67m▀\u001b[0m\u001b[38;2;148;113;70m\u001b[48;2;149;114;68m▀\u001b[0m  \u001b[38;2;189;152;103m\u001b[48;2;174;139;92m▀\u001b[0m\u001b[38;2;185;148;99m\u001b[48;2;173;137;90m▀\u001b[0m  \u001b[38;2;144;110;67m\u001b[48;2;140;107;64m▀\u001b[0m\u001b[38;2;146;110;67m\u001b[48;2;138;105;64m▀\u001b[0m\u001b[38;2;133;101;63m▀\u001b[0m                ",
+  "                  \u001b[38;2;136;103;63m\u001b[48;2;130;99;61m▀\u001b[0m  \u001b[38;2;167;131;84m\u001b[48;2;161;125;79m▀\u001b[0m\u001b[38;2;163;129;84m\u001b[48;2;158;123;78m▀\u001b[0m  \u001b[38;2;136;103;62m\u001b[48;2;127;96;59m▀\u001b[0m                  ",
+  "                     \u001b[38;2;152;117;72m\u001b[48;2;145;110;67m▀\u001b[0m\u001b[38;2;152;117;73m\u001b[48;2;146;111;68m▀\u001b[0m                     ",
+  "                     \u001b[38;2;141;107;65m\u001b[48;2;135;102;60m▀\u001b[0m\u001b[38;2;142;107;64m\u001b[48;2;136;102;61m▀\u001b[0m                     ",
+  "                      \u001b[38;2;130;99;59m▀\u001b[0m                     "
+];
+export const LOGO_WIDTH = 44;

package/src/ui/results.js

@@ -0,0 +1,45 @@
+// Affichage des résultats en table dans le terminal.
+
+import chalk from 'chalk';
+import Table from 'cli-table3';
+import { rank, paint, SEVERITIES } from '../core/severity.js';
+
+export function renderFindings(findings, { title = 'Résultats' } = {}) {
+  if (!findings.length) return chalk.gray('Aucun résultat enregistré.');
+
+  const sorted = [...findings].sort((a, b) => rank(a.severity) - rank(b.severity));
+  const table = new Table({
+    head: ['Sév.', 'Outil', 'Cible', 'Finding', 'Détail'].map((h) => chalk.bold(h)),
+    colWidths: [12, 10, 22, 38, 34],
+    wordWrap: true,
+    style: { head: [], border: ['grey'] },
+  });
+
+  for (const f of sorted) {
+    table.push([
+      paint(chalk, f.severity, f.severity),
+      f.tool,
+      truncate(f.target, 20),
+      truncate(f.title, 36),
+      truncate(f.detail || f.ref || '', 32),
+    ]);
+  }
+
+  return `\n${chalk.bold(title)}  ${chalk.gray(`(${findings.length})`)}\n${table.toString()}\n${summary(findings)}`;
+}
+
+function summary(findings) {
+  const counts = {};
+  for (const f of findings) {
+    const s = (f.severity || 'unknown').toLowerCase();
+    counts[s] = (counts[s] || 0) + 1;
+  }
+  return SEVERITIES.filter((s) => counts[s])
+    .map((s) => paint(chalk, s, `${s}: ${counts[s]}`))
+    .join('   ');
+}
+
+function truncate(str, n) {
+  const s = String(str ?? '');
+  return s.length > n ? `${s.slice(0, n - 1)}…` : s;
+}

package/src/web/public/index.html

@@ -0,0 +1,253 @@
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Icarus — pentest</title>
+<style>
+  :root{
+    --bg:#07070a; --panel:#0e0e12; --panel2:#121218; --border:#1e1e26;
+    --gold:#d4a843; --gold-hi:#f0c66b; --txt:#e9e7e1; --dim:#8b8b95;
+    --crit:#dc2626; --high:#f97316; --med:#eab308; --low:#3b82f6; --info:#7a7a86;
+    --ok:#3fb950; --bad:#f85149;
+  }
+  *{box-sizing:border-box}
+  html,body{margin:0;height:100%}
+  body{
+    background:radial-gradient(1200px 600px at 50% -10%, #14110a 0%, var(--bg) 55%);
+    color:var(--txt); font:14px/1.5 ui-monospace,"SF Mono","JetBrains Mono",Menlo,Consolas,monospace;
+    -webkit-font-smoothing:antialiased;
+  }
+  a{color:var(--gold)}
+  .wrap{max-width:1180px;margin:0 auto;padding:26px 20px 60px}
+
+  header{text-align:center;padding:14px 0 22px}
+  header img{width:108px;height:108px;object-fit:contain;filter:drop-shadow(0 0 26px rgba(212,168,67,.35));animation:float 5s ease-in-out infinite}
+  @keyframes float{0%,100%{transform:translateY(0)}50%{transform:translateY(-7px)}}
+  .word{font-size:30px;font-weight:800;letter-spacing:.5em;margin:10px 0 4px;
+        background:linear-gradient(180deg,var(--gold-hi),var(--gold));-webkit-background-clip:text;background-clip:text;-webkit-text-fill-color:transparent}
+  .sub{color:var(--dim);font-size:12px}
+  .warn{margin-top:10px;color:var(--gold);font-size:12px;opacity:.85}
+
+  .stats{display:flex;gap:10px;justify-content:center;margin:18px 0 6px;flex-wrap:wrap}
+  .stat{background:var(--panel);border:1px solid var(--border);border-radius:10px;padding:8px 16px;min-width:120px;text-align:center}
+  .stat b{display:block;font-size:20px;color:var(--gold-hi)}
+  .stat span{font-size:11px;color:var(--dim);text-transform:uppercase;letter-spacing:.08em}
+
+  .grid{display:grid;grid-template-columns:380px 1fr;gap:18px;margin-top:18px}
+  @media(max-width:880px){.grid{grid-template-columns:1fr}}
+  .card{background:var(--panel);border:1px solid var(--border);border-radius:14px;padding:16px}
+  .card h2{margin:0 0 12px;font-size:12px;text-transform:uppercase;letter-spacing:.12em;color:var(--dim);font-weight:700}
+
+  label.f{display:block;font-size:11px;color:var(--dim);margin:0 0 5px;text-transform:uppercase;letter-spacing:.08em}
+  input[type=text],input[type=number]{width:100%;background:var(--panel2);border:1px solid var(--border);border-radius:9px;
+    color:var(--txt);padding:11px 12px;font:inherit;outline:none}
+  input:focus{border-color:var(--gold)}
+  .row{display:flex;gap:10px}.row>div{flex:1}
+
+  .chips{display:flex;flex-wrap:wrap;gap:7px;margin:4px 0 2px}
+  .chip{background:var(--panel2);border:1px solid var(--border);color:var(--txt);border-radius:999px;
+    padding:6px 13px;font-size:12px;cursor:pointer;transition:.15s}
+  .chip:hover{border-color:var(--gold)}
+  .chip.on{background:linear-gradient(180deg,var(--gold-hi),var(--gold));color:#1a1407;border-color:var(--gold);font-weight:700}
+
+  .cat{font-size:10px;color:var(--dim);text-transform:uppercase;letter-spacing:.12em;margin:14px 0 6px}
+  .tools{display:flex;flex-direction:column;gap:3px}
+  .tool{display:flex;align-items:center;gap:9px;padding:7px 9px;border-radius:8px;cursor:pointer;transition:.12s}
+  .tool:hover{background:var(--panel2)}
+  .tool.off{opacity:.4;cursor:not-allowed}
+  .tool .dot{width:8px;height:8px;border-radius:50%;flex:none}
+  .tool input{accent-color:var(--gold);width:15px;height:15px}
+  .tool .nm{font-weight:600}
+  .tool .ds{color:var(--dim);font-size:11px;margin-left:auto;text-align:right;max-width:140px;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}
+
+  .btns{display:flex;gap:10px;margin-top:16px}
+  button{font:inherit;border-radius:10px;padding:12px 16px;cursor:pointer;border:1px solid var(--border);
+    background:var(--panel2);color:var(--txt);transition:.15s;font-weight:600}
+  button:hover{border-color:var(--gold)}
+  button.primary{flex:1;background:linear-gradient(180deg,var(--gold-hi),var(--gold));color:#1a1407;border-color:var(--gold)}
+  button.primary:hover{filter:brightness(1.08)}
+  button:disabled{opacity:.5;cursor:not-allowed}
+
+  .term{background:#050507;border:1px solid var(--border);border-radius:12px;padding:14px;height:300px;overflow:auto;
+    font-size:12.5px;white-space:pre-wrap;word-break:break-word;color:#cfcfd6}
+  .term::-webkit-scrollbar{width:9px}.term::-webkit-scrollbar-thumb{background:#2a2a33;border-radius:9px}
+  .term .t-start{color:var(--gold-hi);font-weight:700;margin-top:8px}
+  .term .t-ok{color:var(--ok)}.term .t-err{color:var(--bad)}.term .t-info{color:var(--dim)}
+  .term .out{color:#7d7d88}
+
+  .findings{display:flex;flex-direction:column;gap:6px;margin-top:14px;max-height:420px;overflow:auto}
+  .find{display:grid;grid-template-columns:auto auto 1fr;gap:10px;align-items:start;background:var(--panel2);
+    border:1px solid var(--border);border-left-width:3px;border-radius:9px;padding:9px 12px}
+  .find .sev{font-size:11px;font-weight:800;text-transform:uppercase;letter-spacing:.05em;display:flex;align-items:center;gap:6px;white-space:nowrap}
+  .find .sev .d{width:9px;height:9px;border-radius:50%}
+  .find .tl{font-weight:600}
+  .find .dt{color:var(--dim);font-size:11.5px;margin-top:2px;word-break:break-all}
+  .find .tool{justify-self:end;color:var(--gold);font-size:10px;opacity:.8}
+  .empty{color:var(--dim);text-align:center;padding:30px;font-size:13px}
+  .tabbar{display:flex;gap:6px;margin-bottom:8px}
+  .tab{font-size:12px;color:var(--dim);padding:6px 12px;border-radius:8px;cursor:pointer}
+  .tab.on{color:var(--gold);background:var(--panel2)}
+  footer{text-align:center;color:var(--dim);font-size:11px;margin-top:30px}
+</style>
+</head>
+<body>
+<div class="wrap">
+  <header>
+    <img src="/logo.png" alt="Icarus">
+    <div class="word">ICARUS</div>
+    <div class="sub">plateforme de pentest tout-en-un</div>
+    <div class="warn">⚠ Usage strictement autorisé — tes systèmes ou mandat écrit signé.</div>
+  </header>
+
+  <div class="stats">
+    <div class="stat"><b id="s-find">0</b><span>findings</span></div>
+    <div class="stat"><b id="s-scan">0</b><span>scans</span></div>
+    <div class="stat"><b id="s-tools">0</b><span>outils prêts</span></div>
+  </div>
+
+  <div class="grid">
+    <div class="card">
+      <h2>Configuration</h2>
+      <label class="f">Cible</label>
+      <input id="target" type="text" placeholder="example.com  ·  http://site/p?id=1" autocomplete="off">
+
+      <div style="margin-top:14px">
+        <label class="f">Profil</label>
+        <div class="chips" id="profiles"></div>
+      </div>
+
+      <div class="row" style="margin-top:14px">
+        <div><label class="f">Timeout / outil (s)</label><input id="timeout" type="number" value="120" min="0"></div>
+      </div>
+
+      <label class="f" style="margin-top:16px">Outils</label>
+      <div id="toolwrap"></div>
+
+      <div class="btns">
+        <button class="primary" id="run">▸ Lancer le scan</button>
+        <button id="report" title="Rapport HTML">▤</button>
+        <button id="clear" title="Effacer les résultats">✕</button>
+      </div>
+    </div>
+
+    <div class="card">
+      <h2>Exécution &amp; résultats</h2>
+      <div class="tabbar">
+        <div class="tab on" data-tab="out">Sortie live</div>
+        <div class="tab" data-tab="find">Findings (<span id="fcount">0</span>)</div>
+      </div>
+      <div id="pane-out" class="term">En attente — configure une cible et lance un scan.</div>
+      <div id="pane-find" class="findings" style="display:none"></div>
+    </div>
+  </div>
+
+  <footer>Icarus · interface web locale · <span id="host"></span></footer>
+</div>
+
+<script>
+const SEV={critical:'var(--crit)',high:'var(--high)',medium:'var(--med)',low:'var(--low)',info:'var(--info)',unknown:'var(--info)'};
+const ORDER=['critical','high','medium','low','info','unknown'];
+const $=(s)=>document.querySelector(s);
+const el=(t,c,h)=>{const e=document.createElement(t);if(c)e.className=c;if(h!=null)e.textContent=h;return e;};
+let STATE={tools:[],profiles:{}}, selected=new Set();
+$('#host').textContent=location.host;
+
+async function loadState(){
+  const s=await (await fetch('/api/state')).json();
+  STATE=s;
+  $('#s-find').textContent=s.findingsCount;
+  $('#s-scan').textContent=s.scansCount;
+  $('#s-tools').textContent=s.tools.filter(t=>t.available).length;
+  renderProfiles(); renderTools(); loadFindings();
+}
+
+function renderProfiles(){
+  const box=$('#profiles'); box.innerHTML='';
+  for(const [id,p] of Object.entries(STATE.profiles)){
+    const c=el('div','chip',p.label); c.dataset.p=id;
+    c.onclick=()=>{ selected=new Set(p.tools.filter(x=>STATE.tools.find(t=>t.id===x&&t.available))); renderTools(); mark(id); };
+    box.appendChild(c);
+  }
+}
+function mark(id){ document.querySelectorAll('.chip').forEach(c=>c.classList.toggle('on',c.dataset.p===id)); }
+
+function renderTools(){
+  const w=$('#toolwrap'); w.innerHTML='';
+  for(const cat of [...new Set(STATE.tools.map(t=>t.category))]){
+    w.appendChild(el('div','cat',cat));
+    const list=el('div','tools');
+    for(const t of STATE.tools.filter(t=>t.category===cat)){
+      const row=el('div','tool'+(t.available?'':' off'));
+      const dot=el('span','dot'); dot.style.background=t.available?'var(--ok)':'var(--bad)';
+      const cb=el('input'); cb.type='checkbox'; cb.disabled=!t.available; cb.checked=selected.has(t.id);
+      cb.onchange=()=>{ cb.checked?selected.add(t.id):selected.delete(t.id); mark(''); };
+      row.append(cb,dot,el('span','nm',t.name),el('span','ds',t.available?(t.description||''):'non installé'));
+      row.onclick=(e)=>{ if(e.target!==cb&&t.available){cb.checked=!cb.checked;cb.onchange();} };
+      list.appendChild(row);
+    }
+    w.appendChild(list);
+  }
+}
+
+const term=$('#pane-out');
+function log(cls,txt){ const d=el('div',cls,txt); term.appendChild(d); term.scrollTop=term.scrollHeight; }
+
+$('#run').onclick=async()=>{
+  const target=$('#target').value.trim();
+  if(!target){ $('#target').focus(); return; }
+  if(!selected.size){ alert('Choisis au moins un outil ou un profil.'); return; }
+  switchTab('out'); term.innerHTML='';
+  $('#run').disabled=true; $('#run').textContent='◌ scan…';
+  log('t-info',`▸ cible : ${target} · ${selected.size} outil(s)`);
+  try{
+    const res=await fetch('/api/scan',{method:'POST',headers:{'Content-Type':'application/json'},
+      body:JSON.stringify({target,tools:[...selected],timeout:Number($('#timeout').value)||0})});
+    const rd=res.body.getReader(), dec=new TextDecoder(); let buf='';
+    for(;;){ const {value,done}=await rd.read(); if(done)break; buf+=dec.decode(value,{stream:true});
+      let nl; while((nl=buf.indexOf('\n'))>=0){ const ln=buf.slice(0,nl); buf=buf.slice(nl+1); if(ln.trim())handleEv(JSON.parse(ln)); } }
+  }catch(e){ log('t-err','Erreur : '+e.message); }
+  $('#run').disabled=false; $('#run').textContent='▸ Lancer le scan'; loadState();
+};
+
+function handleEv(ev){
+  if(ev.type==='info') log('t-info','  '+ev.message);
+  else if(ev.type==='tool-start') log('t-start',`\n❯ ${ev.name} → ${ev.target}`);
+  else if(ev.type==='out') log('out', ev.chunk.replace(/\x1b\[[0-9;]*m/g,''));
+  else if(ev.type==='log') log('out','  '+ev.line);
+  else if(ev.type==='tool-done'){ ev.error?log('t-err',`  ✗ ${ev.error}`):log('t-ok',`  ✓ terminé — ${ev.findings.length} finding(s)`); }
+  else if(ev.type==='done') log('t-start',`\n■ Scan terminé — ${ev.totalFindings} finding(s) sur ${ev.tools} outil(s).`);
+}
+
+async function loadFindings(){
+  const f=await (await fetch('/api/findings')).json();
+  $('#fcount').textContent=f.length;
+  const box=$('#pane-find'); box.innerHTML='';
+  if(!f.length){ box.appendChild(el('div','empty','Aucun finding pour l’instant.')); return; }
+  f.sort((a,b)=>ORDER.indexOf(a.severity)-ORDER.indexOf(b.severity));
+  for(const x of f){
+    const col=SEV[x.severity]||SEV.info;
+    const r=el('div','find'); r.style.borderLeftColor=col;
+    const sev=el('div','sev'); sev.style.color=col;
+    const d=el('span','d'); d.style.background=col; sev.append(d,document.createTextNode(x.severity||'?'));
+    const mid=el('div'); mid.append(el('div','tl',x.title||''),el('div','dt',x.detail||''));
+    r.append(sev,el('div','tool',x.tool||''),mid);
+    box.appendChild(r);
+  }
+}
+
+function switchTab(t){
+  document.querySelectorAll('.tab').forEach(x=>x.classList.toggle('on',x.dataset.tab===t));
+  $('#pane-out').style.display=t==='out'?'block':'none';
+  $('#pane-find').style.display=t==='find'?'flex':'none';
+  if(t==='find') loadFindings();
+}
+document.querySelectorAll('.tab').forEach(x=>x.onclick=()=>switchTab(x.dataset.tab));
+
+$('#report').onclick=async()=>{ const r=await (await fetch('/api/report',{method:'POST'})).json(); if(r.htmlUrl) window.open(r.htmlUrl,'_blank'); };
+$('#clear').onclick=async()=>{ if(!confirm('Effacer tous les résultats ?'))return; await fetch('/api/clear',{method:'POST'}); term.innerHTML='Résultats effacés.'; loadState(); };
+
+loadState();
+</script>
+</body>
+</html>