nsauditor-ai 0.2.56 → 0.2.57

package/plugins/ftp_banner_check.mjs

@@ -24,7 +24,9 @@ export default {
       let banner = '';
       let up = false;
       let anonState = 'banner'; // banner | send-user | send-pass | done
-      let anonymousLogin = false;
+      // 1.3.0 (s3): null unless MEASURED; anonTested is true when it was, else the reason it was not.
+      let anonymousLogin = null;
+      let anonTested = anonEnabled ? 'no-answer' : 'opt-in-off';
       let bannerCollected = false;
       let resolved = false;
       const safeResolve = (value) => { if (resolved) return; resolved = true; resolve(value); };
@@ -77,7 +79,7 @@ export default {
           response_banner: parsed.bannerTrimmed || null
         }];
 
-        if (anonEnabled && anonymousLogin) {
+        if (anonEnabled && anonymousLogin === true) {
           evidenceRows.push({
             probe_protocol: 'tcp',
             probe_port: port,
@@ -94,9 +96,8 @@ export default {
           data: evidenceRows
         };
 
-        if (anonEnabled) {
-          result.anonymousLogin = anonymousLogin;
-        }
+        result.anonymousLogin = anonymousLogin;
+        result.anonymousLoginTested = anonTested;
 
         dlog(`FTP Banner Check result: up=${up}, program=${parsed.program}, version=${parsed.version}, os=${parsed.os}, anonymousLogin=${anonymousLogin}, banner=${parsed.bannerTrimmed || 'none'}`);
         return result;
@@ -138,20 +139,22 @@ export default {
           } else if (response.startsWith('230')) {
             // Logged in without password
             anonymousLogin = true;
+            anonTested = true;
             anonState = 'done';
             socket.end();
           } else {
-            // Unexpected response, treat as denied
+            // The server answered USER with something else — a refusal it made, so a measurement
+            anonymousLogin = false;
+            anonTested = true;
             anonState = 'done';
             socket.end();
           }
         } else if (anonState === 'send-pass') {
           const response = chunk.trim();
           dlog(`Anon PASS response: ${response}`);
-          if (response.startsWith('230')) {
-            anonymousLogin = true;
-          }
-          // 530/421 or anything else = denied
+          // 230 = accepted; 530/421 or anything else the server answered = refused. Either is a measurement.
+          anonymousLogin = response.startsWith('230');
+          anonTested = true;
           anonState = 'done';
           socket.end();
         }
@@ -170,6 +173,8 @@ export default {
           program: 'Unknown',
           version: 'Unknown',
           os: null,
+          anonymousLogin: null,
+          anonymousLoginTested: anonTested,
           data: [{
             probe_protocol: 'tcp',
             probe_port: port,
@@ -194,6 +199,8 @@ export default {
           program: 'Unknown',
           version: 'Unknown',
           os: null,
+          anonymousLogin: null,
+          anonymousLoginTested: anonTested,
           data: [{
             probe_protocol: 'tcp',
             probe_port: port,
@@ -237,9 +244,10 @@ export async function conclude({ host, result }) {
     authoritative: true
   };
 
-  if (result?.anonymousLogin != null) {
-    record.anonymousLogin = result.anonymousLogin;
-  }
+  // 1.3.0 (s3): the result and its tested state, on every FTP record — null with no state is a result an earlier release
+  // wrote, which did not record whether the check ran.
+  record.anonymousLogin = result?.anonymousLogin ?? null;
+  record.anonymousLoginTested = result?.anonymousLoginTested ?? null;
 
   return [record];
 }

package/plugins/host_up_check.mjs

@@ -1,5 +1,6 @@
 // plugins/host_up_check.mjs
-// Real plugin to check if a host is up or down using ICMP (ping), TCP (common ports), and UDP (high closed port) probes.
+// Real plugin that looks for evidence a host is up — ICMP (ping), TCP (common ports) and UDP (a high, likely-closed
+// port). No answer is recorded as no evidence, never as down.
 // Updated to prioritize ICMP TTL-based OS detection, with TCP probes refining ambiguous TTLs (e.g., TTL 64) using banners and port heuristics.
 // Extracts router name and version from port 443 banner (e.g., Netgear R8000) and includes in result.
 // Returns { up: boolean, os: string|null, router_info: { name: string|null, version: string|null }|null, data: [{ probe_protocol, probe_port, probe_info, response_banner }] }.
@@ -76,7 +77,7 @@ const OS_SPECIFICITY = {
 export default {
   id: '005',
   name: 'Host Up Check',
-  description: 'Checks if the host is up or down using ICMP, TCP (common ports), and UDP (high closed port) probes with enhanced OS detection.',
+  description: 'Looks for evidence that the host is up using ICMP, TCP (common ports) and UDP (a high, likely-closed port) probes, with enhanced OS detection; no answer is no evidence, not down.',
   priority: 20,
   requirements: { host: "down" }, // run when ping hasn't marked it UP (ping blocked/filtered)
   protocols: ['tcp', 'udp', 'icmp'],
@@ -245,88 +246,46 @@ export default {
       });
     }
 
-    // UDP Probe (send to likely closed high port)
+    // UDP Probe (send to a likely-closed high port).
+    // 1.3.0 lane 1 F: a successful send is NOT evidence that the host is up — it says only that the
+    // local stack accepted the datagram. The leg used to set `up` in the send callback, clear the wait
+    // and close the socket, so a host that never answered read UP and the ICMP port-unreachable that
+    // follows a send (the real order on loopback) was discarded with the socket. Evidence of UP is that
+    // port-unreachable or a reply. Silence until the timeout is recorded as NO EVIDENCE, never as down,
+    // and costs up to UDP_REPLY_WAIT_MS on every run of this plugin where nothing answers on UDP.
+    // Settles once: the first of reply / port-unreachable / error / timeout writes the one UDP row.
     const udpPort = 54321;
+    const UDP_REPLY_WAIT_MS = 3000;
     await new Promise((resolve) => {
       dlog(`Attempting UDP probe on ${host}:${udpPort}`);
       const socket = dgram.createSocket('udp4');
-      const timeoutId = setTimeout(() => {
-        data.push({
-          probe_protocol: 'udp',
-          probe_port: udpPort,
-          probe_info: 'Timeout - host possibly down',
-          response_banner: null
-        });
+      let settled = false;
+      const settle = (probe_info, answered) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeoutId);
+        if (answered) up = true;
+        data.push({ probe_protocol: 'udp', probe_port: udpPort, probe_info, response_banner: null });
         socket.close();
         resolve();
-      }, 3000);
+      };
+      const timeoutId = setTimeout(
+        () => settle(`No reply within ${UDP_REPLY_WAIT_MS / 1000} s - no evidence either way`, false),
+        UDP_REPLY_WAIT_MS
+      );
 
+      socket.on('message', () => settle('UDP reply - host up', true));
       socket.on('error', (err) => {
-        clearTimeout(timeoutId);
-        if (err.code === 'ECONNREFUSED') {
-          up = true;
-          data.push({
-            probe_protocol: 'udp',
-            probe_port: udpPort,
-            probe_info: 'ICMP Port Unreachable - host up',
-            response_banner: null
-          });
-        } else {
-          data.push({
-            probe_protocol: 'udp',
-            probe_port: udpPort,
-            probe_info: `Error: ${err.code} - ${err.message}`,
-            response_banner: null
-          });
-        }
-        socket.close();
-        resolve();
+        if (err.code === 'ECONNREFUSED') settle('ICMP Port Unreachable - host up', true);
+        else settle(`Error: ${err.code} - ${err.message}`, false);
       });
 
       socket.connect(udpPort, host, (err) => {
-        if (err) {
-          clearTimeout(timeoutId);
-          data.push({
-            probe_protocol: 'udp',
-            probe_port: udpPort,
-            probe_info: `Connect error: ${err.message}`,
-            response_banner: null
-          });
-          socket.close();
-          resolve();
-          return;
-        }
-
+        if (err) return settle(`Connect error: ${err.message}`, false);
         socket.send(Buffer.alloc(0), (err) => {
-          clearTimeout(timeoutId);
-          if (err) {
-            if (err.code === 'ECONNREFUSED') {
-              up = true;
-              data.push({
-                probe_protocol: 'udp',
-                probe_port: udpPort,
-                probe_info: 'ICMP Port Unreachable - host up',
-                response_banner: null
-              });
-            } else {
-              data.push({
-                probe_protocol: 'udp',
-                probe_port: udpPort,
-                probe_info: `Send error: ${err.message}`,
-                response_banner: null
-              });
-            }
-          } else {
-            up = true;
-            data.push({
-              probe_protocol: 'udp',
-              probe_port: udpPort,
-              probe_info: 'Send successful, no error - host up (port may be open)',
-              response_banner: null
-            });
-          }
-          socket.close();
-          resolve();
+          if (!err) return; // sent — now wait for a reply, a port-unreachable or the timeout
+          if (err.code === 'ECONNREFUSED') settle('ICMP Port Unreachable - host up', true);
+          else settle(`Send error: ${err.message}`, false);
         });
       });
     });

package/plugins/http_probe.mjs

@@ -6,16 +6,31 @@ import http from 'node:http';
 import https from 'node:https';
 import { promisify } from 'node:util';
 import { execFile } from 'node:child_process';
+import { redactSetCookie, redactLocation } from '../utils/cookie_redaction.mjs';
 
 const execFileP = promisify(execFile);
 
 const DEBUG = /^(1|true|yes|on)$/i.test(String(process.env.DEBUG_MODE || process.env.HTTP_DEBUG || ""));
 function dlog(...a) { if (DEBUG) console.log("[http-probe]", ...a); }
 
+/**
+ * The response headers 006 keeps on its record — ONE (1.3.0 item 1, ruled): Strict-Transport-Security, for Enterprise's
+ * Missing-HSTS check. A header map is a channel into every consumer of the record (artifacts, AI payloads, the webhook,
+ * GRC), so the set is held by a census over the real concluder's output (tests/service_flag_table.test.mjs), never
+ * widened silently.
+ */
+export const RECORD_HEADERS = Object.freeze(['strict-transport-security']);
+const recordHeaders = (h) => Object.fromEntries(RECORD_HEADERS.filter((k) => h?.[k] != null).map((k) => [k, String(h[k])]));
+
 function buildBanner(status, headers) {
   const lines = [];
   lines.push(`${status.code} ${status.message}`);
-  // Capture the most useful fingerprinting headers
+  // Capture the most useful fingerprinting headers. Each VALUE kept here reaches the record, the artifacts and the AI
+  // prompt, so none may be a secret (1.3.0, the audit seat's ruling): a Set-Cookie value is the target's session token —
+  // its NAME is kept, its value redacted; a Location query can carry an SSO ticket or an OAuth code — the URL is kept
+  // without it. The rest describe the product or its configuration: an auth scheme and realm, a server string, a framing
+  // policy, a media type.
+  const redact = { 'set-cookie': redactSetCookie, location: redactLocation };
   const pick = [
     'www-authenticate',
     'server',
@@ -27,10 +42,11 @@ function buildBanner(status, headers) {
   for (const k of pick) {
     const v = headers[k];
     if (!v) continue;
+    const shown = redact[k] ?? String;
     if (Array.isArray(v)) {
-      for (const vv of v) lines.push(`${k}: ${vv}`);
+      for (const vv of v) lines.push(`${k}: ${shown(vv)}`);
     } else {
-      lines.push(`${k}: ${v}`);
+      lines.push(`${k}: ${shown(v)}`);
     }
   }
   return lines.join('\r\n').slice(0, 512); // Limit banner size
@@ -152,6 +168,10 @@ export default {
       const req = mod.request(reqOpts, async (res) => {
         const headers = res.headers;
         const status = { code: res.statusCode, message: res.statusMessage };
+        // 1.3.0 item 1: the allowlisted headers, on an HTTPS response only — a user agent ignores Strict-Transport-Security
+        // over plain HTTP (RFC 6797 §8.1). Set here, where a response ARRIVED: no response, no `headers` key at all, since an
+        // empty map would read as "the header is missing".
+        if (isHttps) result.headers = recordHeaders(headers);
 
         // Initial "up" via response
         result.up = true;
@@ -260,31 +280,79 @@ export default {
 
     // Keep OS null unless we have a trustworthy hint; HTTP headers rarely reveal OS reliably.
 
-    // HTTP method testing via OPTIONS
+    // HTTP method testing via OPTIONS. `methodsTested` means AN ALLOW HEADER WAS READ — the probe has no other way to see
+    // the method list, so an OPTIONS answer without Allow (a 405, a 200) and no answer at all are both NOT TESTED:
+    // methodsTested false and null arrays, never [] (1.3.0, the audit seat's ruling; all three read [] before, so "not
+    // tested" read as "none dangerous"). Do not widen "tested" to "answered": a per-method probe is a different capability.
+    let optResult = null;
     try {
-      const optResult = await probeOptions(host, port, isHttps, allowInsecure, timeoutMs);
-      if (optResult?.allow) {
-        const methods = optResult.allow.split(',').map(m => m.trim().toUpperCase()).filter(Boolean);
-        const dangerous = methods.filter(m => ['PUT', 'DELETE', 'TRACE', 'CONNECT'].includes(m));
-        result.allowedMethods = methods;
-        result.dangerousMethods = dangerous;
-        if (dangerous.length > 0) {
-          result.data.push({
-            probe_protocol: isHttps ? 'https' : 'http',
-            probe_port: port,
-            probe_info: `WARNING: Dangerous HTTP methods enabled: ${dangerous.join(', ')}`,
-            response_banner: `Allow: ${optResult.allow}`
-          });
-        }
-      } else {
-        result.allowedMethods = [];
-        result.dangerousMethods = [];
-      }
+      optResult = await probeOptions(host, port, isHttps, allowInsecure, timeoutMs);
     } catch {
-      result.allowedMethods = [];
-      result.dangerousMethods = [];
+      optResult = null;
+    }
+    if (!optResult || !String(optResult.allow || '').trim()) {
+      result.methodsTested = false;
+      result.allowedMethods = null;
+      result.dangerousMethods = null;
+      result.data.push({
+        probe_protocol: isHttps ? 'https' : 'http',
+        probe_port: port,
+        probe_info: optResult
+          ? `OPTIONS answered ${optResult.status} with no Allow header — HTTP methods not tested`
+          : 'OPTIONS was not answered — HTTP methods not tested',
+        response_banner: null
+      });
+    } else {
+      const methods = String(optResult.allow || '').split(',').map(m => m.trim().toUpperCase()).filter(Boolean);
+      const dangerous = methods.filter(m => ['PUT', 'DELETE', 'TRACE', 'CONNECT'].includes(m));
+      result.methodsTested = true;
+      result.allowedMethods = methods;
+      result.dangerousMethods = dangerous;
+      if (dangerous.length > 0) {
+        result.data.push({
+          probe_protocol: isHttps ? 'https' : 'http',
+          probe_port: port,
+          probe_info: `WARNING: Dangerous HTTP methods enabled: ${dangerous.join(', ')}`,
+          response_banner: `Allow: ${optResult.allow}`
+        });
+      }
     }
 
     return result;
   },
-};
+};
+/**
+ * Concluder adapter (1.3.0 lane 3 (a4), the audit seat's Option A). The HTTP probe had no adapter, so its methods result
+ * never reached a service record. Its record lands EXACTLY where the concluder's fallback put it — the http / https key,
+ * the same program, version, status and source — so no service identity, CPE or Services-detected count moves across
+ * 1.2.0 -> 1.3.0; it adds only the methods result. `methodsTested` is true only when an Allow header was READ; otherwise
+ * both arrays are null (NOT TESTED, never "none"). Merging into the tcp key is a separate, boarded decision.
+ */
+export function conclude({ result }) {
+  const rows = Array.isArray(result?.data) ? result.data : [];
+  const row = rows.find(Boolean) || {};
+  let status = result?.up ? 'open' : 'unknown';
+  if (row?.probe_info && /refused|ECONNREFUSED/i.test(String(row.probe_info))) status = 'closed';
+  return [{
+    port: Number(row?.probe_port ?? result?.port ?? 0),
+    protocol: row?.probe_protocol || result?.protocol || 'tcp',
+    service: 'http',
+    program: result?.program || 'Unknown',
+    version: result?.version || 'Unknown',
+    status,
+    info: row?.probe_info || null,
+    banner: row?.response_banner || null,
+    source: 'http',
+    evidence: rows,
+    // 1.3.0 item 1: the allowlisted response headers, on the HTTPS record only and only when a response arrived (run()
+    // sets `headers` there and nowhere else) — filtered again here, so the record can never carry a header outside
+    // RECORD_HEADERS whatever the result holds.
+    ...(row?.probe_protocol === 'https' && result?.headers && typeof result.headers === 'object'
+      ? { headers: recordHeaders(result.headers) } : {}),
+    ...('methodsTested' in (result || {}) ? {
+      methodsTested: result.methodsTested === true,
+      allowedMethods: result.methodsTested === true ? result.allowedMethods : null,
+      dangerousMethods: result.methodsTested === true ? result.dangerousMethods : null,
+    } : {}),
+  }];
+}

package/plugins/mcp_scanner.mjs

@@ -42,6 +42,17 @@ export const MCP_CANDIDATE_PORTS = [1967, 3000, 3005, 5173, 6274, 6277, 8000, 80
 // network-reachable. Detection on a non-loopback target = MEDIUM finding.
 export const MCP_INSPECTOR_PORTS = new Set([5173, 6274, 6277]);
 
+// The grade of each security flag buildFindings() sets, declared beside the code that sets it (the research grades in
+// its comments). The shared service-flag table (utils/service_flags.mjs) reads this, so every reader grades a flag the
+// moment it is added here — and tests/service_flag_table.test.mjs fails if buildFindings sets a flag this does not grade.
+export const MCP_FLAG_SEVERITY = Object.freeze({
+  mcpAnonymousAccess: 'Critical',
+  mcpAnonymousToolList: 'Critical',
+  mcpCleartextTransport: 'High',
+  mcpDeprecatedProtocol: 'High',
+  mcpInspectorExposed: 'Medium',
+});
+
 // MCP RPC method paths (in priority order — try canonical mountpoints first)
 export const MCP_PROBE_PATHS = ['/', '/mcp', '/jsonrpc', '/sse', '/messages'];
 
@@ -454,8 +465,10 @@ export function conclude({ result }) {
       detection.tools.length ? `tools=${detection.tools.length}` : null,
     ].filter(Boolean).join(' '),
     authoritative: true,
-    // Security flags. scan_host returns them on this record; the Markdown report, SARIF, CSV and --fail-on do NOT read
-    // them yet (1.2.0 build 3 states it; boarded for 1.2.1).
+    // The producer's own name for its records — the shared service-flag table keys the MCP rows on it (1.3.0 (s1) B).
+    source: 'mcp',
+    // Security flags, graded by MCP_FLAG_SEVERITY through the shared service-flag table — the Markdown report, SARIF,
+    // the CSV and --fail-on all read them there (1.3.0 (s1)).
     ...flags,
     // Evidence fields per N.5 FindingSchema
     evidence: { cwe, owasp, mitre },

package/plugins/netbios_scanner.mjs

@@ -452,19 +452,23 @@ async function probeMdnsSmb(){
 }
 
 // SMB2 null session probe — attempts anonymous auth, IPC$ tree connect, and share/user enum
-async function probeNullSession(host){
-  const result = { nullSessionAllowed: false, shares: [], users: [] };
-  if (!ENABLE_NULL_SESSION) return result;
+// `port`, `enabled` and `timeoutMs` default to production's 445, SMB_NULL_SESSION and SMB_NULL_SESSION_TIMEOUT; they are
+// parameters so the outcomes can be driven against a loopback listener.
+export async function probeNullSession(host, { port = 445, enabled = ENABLE_NULL_SESSION, timeoutMs = NULL_SESSION_TIMEOUT } = {}){
+  // 1.3.0 (s3): null unless MEASURED; nullSessionTested is true when it was, else the reason it was not.
+  const result = { nullSessionAllowed: null, nullSessionTested: enabled ? 'no-answer' : 'opt-in-off', shares: [], users: [] };
+  if (!enabled) return result;
+  const measured = (allowed) => { result.nullSessionAllowed = allowed; result.nullSessionTested = true; };
 
   return new Promise(resolve => {
     let resolved = false;
     const safeResolve = (v) => { if (resolved) return; resolved = true; resolve(v); };
 
-    const sock = net.createConnection({ host, port: 445 });
+    const sock = net.createConnection({ host, port });
     const to = setTimeout(() => {
       try { sock.destroy(); } catch {}
       safeResolve(result);
-    }, NULL_SESSION_TIMEOUT);
+    }, timeoutMs);
 
     let phase = 'negotiate'; // negotiate | session-setup-1 | session-setup-2 | tree-connect | done
     let sessionIdLo = 0;
@@ -517,23 +521,25 @@ async function probeNullSession(host){
             // Some servers accept directly (guest/anonymous)
             sessionIdLo = hdr.sessionIdLo;
             sessionIdHi = hdr.sessionIdHi;
-            result.nullSessionAllowed = true;
+            measured(true);
             phase = 'tree-connect';
             try { sock.write(wrapNbss(buildSmb2TreeConnect(host, sessionIdLo, sessionIdHi))); } catch { finish(); }
           } else {
-            // ACCESS_DENIED or other — null session not allowed
+            // ACCESS_DENIED or other — null session not allowed (the server answered: a measurement)
             dlog('null-session: session setup denied, status=0x' + hdr.status.toString(16));
+            measured(false);
             finish();
           }
         } else if (phase === 'session-setup-2') {
           if (hdr.status === STATUS_SUCCESS) {
-            result.nullSessionAllowed = true;
+            measured(true);
             sessionIdLo = hdr.sessionIdLo; // H2 fix: unconditional assign, not ||
             sessionIdHi = hdr.sessionIdHi;
             phase = 'tree-connect';
             try { sock.write(wrapNbss(buildSmb2TreeConnect(host, sessionIdLo, sessionIdHi))); } catch { finish(); }
           } else {
             dlog('null-session: session auth denied, status=0x' + hdr.status.toString(16));
+            measured(false);
             finish();
           }
         } else if (phase === 'tree-connect') {
@@ -638,30 +644,39 @@ export default {
       }
     }catch{ /* best-effort only */ }
 
-    // SMB2 null session enumeration (opt-in via SMB_NULL_SESSION env)
-    let nullSessionAllowed = false;
+    // SMB2 null session enumeration (opt-in via SMB_NULL_SESSION env). 1.3.0 (s3): null unless measured, with its state.
+    let nullSessionAllowed = null;
+    let nullSessionTested = ENABLE_NULL_SESSION ? 'no-answer' : 'opt-in-off';
     let shares = [];
     let users = [];
 
     try {
       const ns = await probeNullSession(host);
       nullSessionAllowed = ns.nullSessionAllowed;
+      nullSessionTested = ns.nullSessionTested;
       shares = ns.shares;
       users = ns.users;
-      if (nullSessionAllowed) {
+      if (nullSessionAllowed === true) {
         data.push({
           probe_protocol: 'tcp',
           probe_port: 445,
           probe_info: 'WARNING: SMB null session authentication succeeded',
           response_banner: `Null session allowed. Shares: ${shares.length}, Users: ${users.length}`
         });
-      } else if (ENABLE_NULL_SESSION) {
+      } else if (nullSessionAllowed === false) {
         data.push({
           probe_protocol: 'tcp',
           probe_port: 445,
           probe_info: 'SMB null session denied (good)',
           response_banner: null
         });
+      } else if (ENABLE_NULL_SESSION) {
+        data.push({
+          probe_protocol: 'tcp',
+          probe_port: 445,
+          probe_info: 'SMB null session not measured — the exchange did not complete',
+          response_banner: null
+        });
       }
     } catch {
       if (ENABLE_NULL_SESSION) {
@@ -680,6 +695,7 @@ export default {
       version,
       type: 'netbios/smb',
       nullSessionAllowed,
+      nullSessionTested,
       shares,
       users,
       data
@@ -706,7 +722,9 @@ export async function conclude({ host, result }){
     program: result?.program || 'Unknown',
     version: result?.version || 'Unknown',
     status, info, banner,
-    nullSessionAllowed: result?.nullSessionAllowed ?? false,
+    // 1.3.0 (s3): null unless measured — the old default `false` read "refused" for a check that never ran.
+    nullSessionAllowed: result?.nullSessionAllowed ?? null,
+    nullSessionTested: result?.nullSessionTested ?? null,
     shares: result?.shares ?? [],
     users: result?.users ?? [],
     source: 'netbios',
@@ -725,6 +743,7 @@ export async function conclude({ host, result }){
       status: 'open', info: 'WARNING: SMB null session allowed — anonymous enumeration possible',
       banner: `Shares: ${(result.shares||[]).join(', ') || 'none'}, Users: ${(result.users||[]).join(', ') || 'none'}`,
       nullSessionAllowed: true,
+      nullSessionTested: true,
       shares: result?.shares ?? [],
       users: result?.users ?? [],
       source: 'netbios',

package/plugins/opensearch_scanner.mjs

@@ -128,8 +128,12 @@ export default {
           const agent = await buildAgentIfNeeded(scheme, insecure);
           const ctrl = new AbortController();
           const to = setTimeout(() => ctrl.abort(), timeoutMs);
+          // 1.3.0 lane 2 (R2): never follow a redirect. The banner and version are read at `/`; a 3xx is
+          // the target's answer. Followed, a target could send the scanner to any host — loopback and
+          // cloud metadata included — with no SSRF check at the hop.
           const res = await doFetch(url, {
             method: 'GET',
+            redirect: 'manual',
             headers: {
               'User-Agent': 'opensearch-js/3.4.0 (opensearch-scanner)'
             },