danishrecon 0.7.0__tar.gz

danishrecon-0.7.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The DanishRecon contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

danishrecon-0.7.0/PKG-INFO

@@ -0,0 +1,190 @@
+Metadata-Version: 2.4
+Name: danishrecon
+Version: 0.7.0
+Summary: Security toolkit: recon + web vulnerability scanning, static malware analysis and network-traffic analysis. For authorized testing only.
+Author: Danish Dhanjal
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/DanishDhanjal15/DanishRecon-Main
+Project-URL: Issues, https://github.com/DanishDhanjal15/DanishRecon-Main/issues
+Project-URL: Changelog, https://github.com/DanishDhanjal15/DanishRecon-Main/blob/main/docs/CHANGES_AND_ROADMAP.md
+Keywords: security,vulnerability-scanner,reconnaissance,pentest,dast,nuclei,nmap,malware-analysis,pcap
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.31
+Requires-Dist: networkx>=3.0
+Requires-Dist: matplotlib>=3.7
+Requires-Dist: cryptography>=42
+Requires-Dist: python-dotenv>=1.0
+Requires-Dist: reportlab>=4.0
+Provides-Extra: gui
+Requires-Dist: PyQt5>=5.15; extra == "gui"
+Provides-Extra: web
+Requires-Dist: fastapi>=0.110; extra == "web"
+Requires-Dist: uvicorn>=0.29; extra == "web"
+Provides-Extra: malware
+Requires-Dist: pefile>=2023.2.7; extra == "malware"
+Requires-Dist: yara-python>=4.3; extra == "malware"
+Requires-Dist: oletools>=0.60; extra == "malware"
+Provides-Extra: ai
+Requires-Dist: google-genai>=1.0; extra == "ai"
+Provides-Extra: openvas
+Requires-Dist: python-gvm<22; extra == "openvas"
+Provides-Extra: scout
+Requires-Dist: fastapi>=0.110; extra == "scout"
+Requires-Dist: uvicorn>=0.29; extra == "scout"
+Requires-Dist: pydantic; extra == "scout"
+Requires-Dist: httpx; extra == "scout"
+Requires-Dist: google-generativeai; extra == "scout"
+Provides-Extra: all
+Requires-Dist: danishrecon[ai,gui,malware,web]; extra == "all"
+Provides-Extra: dev
+Requires-Dist: danishrecon[malware,web]; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Requires-Dist: httpx; extra == "dev"
+Dynamic: license-file
+
+# DanishRecon
+
+![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)
+![Python 3.10+](https://img.shields.io/badge/Python-3.10+-blue.svg)
+
+An open-source **security toolkit** with three modes that share one engine, one database
+and one report format:
+
+| Mode | Input | Command |
+|---|---|---|
+| Recon + web vulnerability scan | a host or URL | `danishrecon scan <target> --i-am-authorized` |
+| Static malware analysis | file(s) or a folder | `danishrecon malware <path>` |
+| Network traffic analysis | a .pcap, or a live interface | `danishrecon sniff <pcap>` |
+
+It does not reinvent detection engines. It orchestrates proven open-source tools (nmap,
+nuclei, katana, httpx, tshark, YARA), keeps every result in one evidence-backed finding
+model, and reports only what was actually observed.
+
+> **Authorized use only.** Scan systems you own or have explicit written permission to
+> test. The CLI refuses to scan without `--i-am-authorized`, and the GUI and dashboard ask
+> for the same confirmation.
+
+## Install
+
+```bash
+pip install danishrecon                 # scan engine + CLI
+pip install "danishrecon[gui]"          # + desktop GUI (PyQt5)
+pip install "danishrecon[web]"          # + web dashboard
+pip install "danishrecon[malware]"      # + YARA, PE and Office-macro analysis
+pip install "danishrecon[all]"          # everything above
+```
+
+pip installs the Python code only. The scanners it drives are separate programs:
+
+| Tool | Needed for | Install |
+|---|---|---|
+| **nmap** (required) | ports, services, TLS cipher audit | https://nmap.org/download |
+| nuclei, katana, httpx, subfinder (recommended) | crawl, injection tests, exposure templates | `go install github.com/projectdiscovery/<tool>/...@latest` |
+| tshark / Wireshark | traffic analysis | https://www.wireshark.org/download.html |
+| rustscan (optional) | fast all-ports discovery on the `Full` profile | `cargo install rustscan` |
+| Nikto, an exploit-database checkout, OpenVAS (optional) | extra checks, exploit references | see `docs/FEATURES.md` |
+
+Run `danishrecon-preflight` to see what is installed. A missing optional tool is reported
+in the scan log as "not tested"; it never produces simulated results.
+
+## Use
+
+```bash
+# recon + vulnerability scan
+danishrecon scan example.com --i-am-authorized
+danishrecon scan https://app.example.com --i-am-authorized --profile Full --nuclei
+danishrecon scan https://app.example.com --i-am-authorized --cookie "session=abc123"
+danishrecon scan example.com --i-am-authorized --fail-on high      # exit code 1 for CI
+
+# static malware analysis (files are never executed)
+danishrecon malware suspicious.exe
+danishrecon malware ./samples --reputation        # + MalwareBazaar lookup (sends the hash only)
+
+# traffic analysis
+danishrecon sniff capture.pcap --ioc-file bad_domains.txt
+danishrecon sniff "Wi-Fi" --live --i-am-authorized --duration 60
+
+# front-ends
+danishrecon-gui                # desktop GUI
+danishrecon-web                # dashboard on http://127.0.0.1:8787
+```
+
+Every command writes to `./results/` (or `--output-dir`): an HTML report, `scan_<id>.json`,
+`findings_<id>.json` and `scan_<id>.sarif`.
+
+## What a scan does
+
+DNS and subdomains, ports and versions (a fast path on CDN hosts), TLS certificate /
+protocol / cipher checks, known CVEs for the detected versions (NVD, CISA KEV, EPSS), a
+crawl followed by injection tests on every parameter and submitted form (nuclei DAST),
+exposure and misconfiguration templates, leaked secrets, DDoS amplification exposure, and
+Exploit-DB references. Details: [docs/FEATURES.md](docs/FEATURES.md).
+
+Every finding carries a **source** (which tool) and a **confidence**:
+
+- `confirmed` - a tool observed the vulnerable behaviour
+- `version-match` - the detected version is listed as affected (not verified)
+- `exposure` - a service is reachable; not a vulnerability by itself
+- `heuristic` - weak signal, needs manual review
+
+## Accuracy
+
+The repository ships a benchmark with known ground truth (`benchmark/`):
+
+- Local ground-truth app: **5/5 expected issues detected, 0 false positives**
+  (GET parameter, POST body, behind a login, exposed secret).
+- OWASP Juice Shop: **2/10 detected, 0 false positives**. Partial on purpose to show: it is
+  a single-page app whose API calls come from JavaScript, which the crawler only partly
+  discovers.
+
+```bash
+python benchmark/run_benchmark.py --min-recall 1.0 --max-false-positives 0
+```
+
+## Privacy
+
+Scan data stays on your machine. Four things can leave it, all optional:
+
+- **NVD / EPSS lookup** sends product identifiers and CVE ids only (`--no-nvd` to disable)
+- **MalwareBazaar lookup** sends a file hash, only with `--reputation`
+- **Gemini analysis** sends finding summaries to Google, only with `--ai`
+- **Login alert (GUI)** sends a WhatsApp message through Twilio, only if you configure it in `.env`
+
+nuclei runs with interactsh disabled, so no out-of-band callbacks go to third parties.
+
+## Limitations
+
+- Form login is a plain POST; logins that need a CSRF token, JavaScript or MFA need `--cookie`.
+- No access-control (IDOR) testing and no business-logic testing.
+- `version-match` CVEs are not verified; distributions back-port fixes.
+- Malware analysis is static only. There is no sandbox, by design.
+- The Nikto stage is unreliable on Windows.
+- The GUI launches recon scans only; malware and traffic analysis run from the CLI.
+
+## Development
+
+```bash
+git clone https://github.com/DanishDhanjal15/DanishRecon-Main
+cd DanishRecon-Main
+pip install -e ".[dev]"
+python -m unittest discover -s tests -v
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md) and
+[docs/CHANGES_AND_ROADMAP.md](docs/CHANGES_AND_ROADMAP.md).
+
+## License
+
+MIT - see [LICENSE](LICENSE). DanishRecon started as the CyberRecon-Pro hackathon project.

danishrecon-0.7.0/README.md

@@ -0,0 +1,134 @@
+# DanishRecon
+
+![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)
+![Python 3.10+](https://img.shields.io/badge/Python-3.10+-blue.svg)
+
+An open-source **security toolkit** with three modes that share one engine, one database
+and one report format:
+
+| Mode | Input | Command |
+|---|---|---|
+| Recon + web vulnerability scan | a host or URL | `danishrecon scan <target> --i-am-authorized` |
+| Static malware analysis | file(s) or a folder | `danishrecon malware <path>` |
+| Network traffic analysis | a .pcap, or a live interface | `danishrecon sniff <pcap>` |
+
+It does not reinvent detection engines. It orchestrates proven open-source tools (nmap,
+nuclei, katana, httpx, tshark, YARA), keeps every result in one evidence-backed finding
+model, and reports only what was actually observed.
+
+> **Authorized use only.** Scan systems you own or have explicit written permission to
+> test. The CLI refuses to scan without `--i-am-authorized`, and the GUI and dashboard ask
+> for the same confirmation.
+
+## Install
+
+```bash
+pip install danishrecon                 # scan engine + CLI
+pip install "danishrecon[gui]"          # + desktop GUI (PyQt5)
+pip install "danishrecon[web]"          # + web dashboard
+pip install "danishrecon[malware]"      # + YARA, PE and Office-macro analysis
+pip install "danishrecon[all]"          # everything above
+```
+
+pip installs the Python code only. The scanners it drives are separate programs:
+
+| Tool | Needed for | Install |
+|---|---|---|
+| **nmap** (required) | ports, services, TLS cipher audit | https://nmap.org/download |
+| nuclei, katana, httpx, subfinder (recommended) | crawl, injection tests, exposure templates | `go install github.com/projectdiscovery/<tool>/...@latest` |
+| tshark / Wireshark | traffic analysis | https://www.wireshark.org/download.html |
+| rustscan (optional) | fast all-ports discovery on the `Full` profile | `cargo install rustscan` |
+| Nikto, an exploit-database checkout, OpenVAS (optional) | extra checks, exploit references | see `docs/FEATURES.md` |
+
+Run `danishrecon-preflight` to see what is installed. A missing optional tool is reported
+in the scan log as "not tested"; it never produces simulated results.
+
+## Use
+
+```bash
+# recon + vulnerability scan
+danishrecon scan example.com --i-am-authorized
+danishrecon scan https://app.example.com --i-am-authorized --profile Full --nuclei
+danishrecon scan https://app.example.com --i-am-authorized --cookie "session=abc123"
+danishrecon scan example.com --i-am-authorized --fail-on high      # exit code 1 for CI
+
+# static malware analysis (files are never executed)
+danishrecon malware suspicious.exe
+danishrecon malware ./samples --reputation        # + MalwareBazaar lookup (sends the hash only)
+
+# traffic analysis
+danishrecon sniff capture.pcap --ioc-file bad_domains.txt
+danishrecon sniff "Wi-Fi" --live --i-am-authorized --duration 60
+
+# front-ends
+danishrecon-gui                # desktop GUI
+danishrecon-web                # dashboard on http://127.0.0.1:8787
+```
+
+Every command writes to `./results/` (or `--output-dir`): an HTML report, `scan_<id>.json`,
+`findings_<id>.json` and `scan_<id>.sarif`.
+
+## What a scan does
+
+DNS and subdomains, ports and versions (a fast path on CDN hosts), TLS certificate /
+protocol / cipher checks, known CVEs for the detected versions (NVD, CISA KEV, EPSS), a
+crawl followed by injection tests on every parameter and submitted form (nuclei DAST),
+exposure and misconfiguration templates, leaked secrets, DDoS amplification exposure, and
+Exploit-DB references. Details: [docs/FEATURES.md](docs/FEATURES.md).
+
+Every finding carries a **source** (which tool) and a **confidence**:
+
+- `confirmed` - a tool observed the vulnerable behaviour
+- `version-match` - the detected version is listed as affected (not verified)
+- `exposure` - a service is reachable; not a vulnerability by itself
+- `heuristic` - weak signal, needs manual review
+
+## Accuracy
+
+The repository ships a benchmark with known ground truth (`benchmark/`):
+
+- Local ground-truth app: **5/5 expected issues detected, 0 false positives**
+  (GET parameter, POST body, behind a login, exposed secret).
+- OWASP Juice Shop: **2/10 detected, 0 false positives**. Partial on purpose to show: it is
+  a single-page app whose API calls come from JavaScript, which the crawler only partly
+  discovers.
+
+```bash
+python benchmark/run_benchmark.py --min-recall 1.0 --max-false-positives 0
+```
+
+## Privacy
+
+Scan data stays on your machine. Four things can leave it, all optional:
+
+- **NVD / EPSS lookup** sends product identifiers and CVE ids only (`--no-nvd` to disable)
+- **MalwareBazaar lookup** sends a file hash, only with `--reputation`
+- **Gemini analysis** sends finding summaries to Google, only with `--ai`
+- **Login alert (GUI)** sends a WhatsApp message through Twilio, only if you configure it in `.env`
+
+nuclei runs with interactsh disabled, so no out-of-band callbacks go to third parties.
+
+## Limitations
+
+- Form login is a plain POST; logins that need a CSRF token, JavaScript or MFA need `--cookie`.
+- No access-control (IDOR) testing and no business-logic testing.
+- `version-match` CVEs are not verified; distributions back-port fixes.
+- Malware analysis is static only. There is no sandbox, by design.
+- The Nikto stage is unreliable on Windows.
+- The GUI launches recon scans only; malware and traffic analysis run from the CLI.
+
+## Development
+
+```bash
+git clone https://github.com/DanishDhanjal15/DanishRecon-Main
+cd DanishRecon-Main
+pip install -e ".[dev]"
+python -m unittest discover -s tests -v
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md) and
+[docs/CHANGES_AND_ROADMAP.md](docs/CHANGES_AND_ROADMAP.md).
+
+## License
+
+MIT - see [LICENSE](LICENSE). DanishRecon started as the CyberRecon-Pro hackathon project.

danishrecon-0.7.0/pyproject.toml

@@ -0,0 +1,64 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "danishrecon"
+version = "0.7.0"
+description = "Security toolkit: recon + web vulnerability scanning, static malware analysis and network-traffic analysis. For authorized testing only."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Danish Dhanjal" }]
+keywords = ["security", "vulnerability-scanner", "reconnaissance", "pentest", "dast", "nuclei", "nmap", "malware-analysis", "pcap"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Information Technology",
+    "Intended Audience :: System Administrators",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+]
+# Core = scan engine + CLI. External tools (nmap, nuclei, katana, httpx, tshark, ...) are
+# separate programs and are NOT installed by pip - see the README.
+dependencies = [
+    "requests>=2.31",
+    "networkx>=3.0",
+    "matplotlib>=3.7",
+    "cryptography>=42",
+    "python-dotenv>=1.0",
+    "reportlab>=4.0",
+]
+
+[project.optional-dependencies]
+gui     = ["PyQt5>=5.15"]
+web     = ["fastapi>=0.110", "uvicorn>=0.29"]
+malware = ["pefile>=2023.2.7", "yara-python>=4.3", "oletools>=0.60"]
+ai      = ["google-genai>=1.0"]
+openvas = ["python-gvm<22"]
+scout   = ["fastapi>=0.110", "uvicorn>=0.29", "pydantic", "httpx", "google-generativeai"]
+all     = ["danishrecon[gui,web,malware,ai]"]
+dev     = ["danishrecon[web,malware]", "build", "twine", "httpx"]
+
+[project.scripts]
+danishrecon           = "danishrecon.cli:main"
+danishrecon-web       = "danishrecon.webapp.server:main"
+danishrecon-preflight = "danishrecon.preflight:main"
+
+[project.gui-scripts]
+danishrecon-gui = "danishrecon.gui:main"
+
+[project.urls]
+Homepage = "https://github.com/DanishDhanjal15/DanishRecon-Main"
+Issues = "https://github.com/DanishDhanjal15/DanishRecon-Main/issues"
+Changelog = "https://github.com/DanishDhanjal15/DanishRecon-Main/blob/main/docs/CHANGES_AND_ROADMAP.md"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+danishrecon = ["yara_rules/*.yar", "webapp/*.html", "scout_chatbot/*.html", "scout_chatbot/*.txt"]

danishrecon-0.7.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

danishrecon-0.7.0/src/danishrecon/__init__.py

@@ -0,0 +1,4 @@
+"""DanishRecon - recon + web vulnerability scanning, static malware analysis and
+network-traffic analysis in one toolkit. For authorized security testing only."""
+
+__version__ = "0.7.0"

danishrecon-0.7.0/src/danishrecon/__main__.py

@@ -0,0 +1,5 @@
+from danishrecon.cli import main
+import sys
+
+if __name__ == "__main__":
+    sys.exit(main())

danishrecon-0.7.0/src/danishrecon/amplification.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""
+DDoS amplification / reflection exposure checks (defensive).
+
+For each UDP service that attackers abuse as a reflector, send ONE small, well-formed probe
+to the target and see whether it answers - and how much bigger the answer is than the probe
+(the amplification factor). A service that answers an unauthenticated UDP probe with a larger
+reply can be abused to reflect/amplify traffic at a third party, so it is a real exposure on
+the owner's own host.
+
+This is a single probe packet per vector (standard scanning), never a flood. Run it only
+against hosts you are authorized to scan - the engine already gates that.
+"""
+from __future__ import annotations
+
+import socket
+import struct
+from typing import Dict, List, Optional
+
+
+# ── probe payload builders ──────────────────────────────────────────────────────
+def dns_query(name: str = "peacecorps.gov", qtype: int = 255) -> bytes:
+    """Recursive DNS query (RD=1) for an external name. A host that is not authoritative
+    for it yet returns answers is an OPEN RESOLVER (type 255 = ANY maximises the reply)."""
+    header = b"\x13\x37" + b"\x01\x00" + struct.pack(">HHHH", 1, 0, 0, 0)  # RD=1, 1 question
+    q = b"".join(bytes([len(lbl)]) + lbl.encode() for lbl in name.split(".")) + b"\x00"
+    q += struct.pack(">HH", qtype, 1)  # qtype, class IN
+    return header + q
+
+
+def ntp_monlist() -> bytes:
+    """NTP mode 7 MON_GETLIST_1 (monlist). A reply means the classic ~556x amplifier."""
+    return b"\x17\x00\x03\x2a" + b"\x00" * 4
+
+
+def memcached_stats() -> bytes:
+    """UDP memcached 'stats' (8-byte UDP header + command). A reply = exposed (huge amp)."""
+    return b"\x00\x01\x00\x00\x00\x01\x00\x00" + b"stats\r\n"
+
+
+def ssdp_msearch() -> bytes:
+    return ("M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\n"
+            'MAN: "ssdp:discover"\r\nMX: 2\r\nST: ssdp:all\r\n\r\n').encode()
+
+
+def chargen_probe() -> bytes:
+    return b"\x01"
+
+
+def _ber(tag: int, value: bytes) -> bytes:
+    """Minimal definite-length BER TLV (lengths < 128 only, enough for this probe)."""
+    return bytes([tag]) + bytes([len(value)]) + value
+
+
+def _ber_oid(oid: str) -> bytes:
+    parts = [int(x) for x in oid.split(".")]
+    body = bytes([parts[0] * 40 + parts[1]])
+    for n in parts[2:]:
+        if n < 128:
+            body += bytes([n])
+        else:
+            chunk = []
+            while n:
+                chunk.insert(0, n & 0x7F)
+                n >>= 7
+            for i in range(len(chunk) - 1):
+                chunk[i] |= 0x80
+            body += bytes(chunk)
+    return _ber(0x06, body)
+
+
+def snmp_get(community: str = "public", oid: str = "1.3.6.1.2.1.1.1.0") -> bytes:
+    """SNMPv1 GetRequest for sysDescr.0 with the given community. A reply from 'public'
+    means SNMP is open (info leak + reflection/amplification vector)."""
+    varbind = _ber(0x30, _ber_oid(oid) + _ber(0x05, b""))        # OID + NULL
+    varbinds = _ber(0x30, varbind)
+    pdu = _ber(0xA0,                                             # GetRequest PDU
+               _ber(0x02, b"\x13\x37") +                        # request-id
+               _ber(0x02, b"\x00") +                            # error-status
+               _ber(0x02, b"\x00") +                            # error-index
+               varbinds)
+    msg = _ber(0x30,
+               _ber(0x02, b"\x00") +                            # version 0 (v1)
+               _ber(0x04, community.encode()) +                 # community
+               pdu)
+    return msg
+
+
+# ── vector catalogue ────────────────────────────────────────────────────────────
+# severity reflects the amplification potential of the vector when it responds.
+VECTORS = {
+    "memcached": {"port": 11211, "name": "memcached exposed on UDP", "payload": memcached_stats,
+                  "severity": "HIGH", "note": "memcached over UDP can amplify traffic by ~10,000-50,000x"},
+    "ntp":       {"port": 123,   "name": "NTP monlist enabled", "payload": ntp_monlist,
+                  "severity": "HIGH", "note": "ntp monlist amplifies by ~556x (CVE-2013-5211)"},
+    "dns":       {"port": 53,    "name": "Open DNS resolver (recursion)", "payload": dns_query,
+                  "severity": "HIGH", "note": "open resolvers are abused for DNS amplification (~28-54x)"},
+    "ssdp":      {"port": 1900,  "name": "SSDP/UPnP responder exposed", "payload": ssdp_msearch,
+                  "severity": "MEDIUM", "note": "SSDP amplifies by ~30x and leaks device info"},
+    "snmp":      {"port": 161,   "name": "SNMP open with 'public' community", "payload": snmp_get,
+                  "severity": "MEDIUM", "note": "SNMP GetBulk amplifies by ~6x and leaks system info"},
+    "chargen":   {"port": 19,    "name": "chargen (UDP) enabled", "payload": chargen_probe,
+                  "severity": "MEDIUM", "note": "chargen amplifies by ~358x and should be disabled"},
+}
+
+
+def probe_vector(host: str, vector: str, timeout: float = 3.0) -> Optional[Dict]:
+    """Send one probe for ``vector`` to ``host``. Returns a result dict when the service
+    answers (so it is a confirmed reflector), else None. Never raises."""
+    spec = VECTORS.get(vector)
+    if not spec:
+        return None
+    payload = spec["payload"]()
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.settimeout(timeout)
+    try:
+        sock.sendto(payload, (host, spec["port"]))
+        total = 0
+        first = None
+        # UDP amplifiers often answer with several datagrams; read what arrives in the window.
+        while True:
+            try:
+                data, _ = sock.recvfrom(65535)
+            except socket.timeout:
+                break
+            if first is None:
+                first = data
+            total += len(data)
+            if total > 200000:
+                break
+        if not total:
+            return None
+        factor = round(total / max(len(payload), 1), 1)
+        return {"vector": vector, "port": spec["port"], "name": spec["name"],
+                "severity": spec["severity"], "note": spec["note"],
+                "request_bytes": len(payload), "response_bytes": total,
+                "amplification_factor": factor}
+    except (socket.gaierror, OSError):
+        return None
+    finally:
+        sock.close()
+
+
+def check_host(host: str, vectors: Optional[List[str]] = None, timeout: float = 3.0,
+               stop_check=None) -> List[Dict]:
+    """Probe all (or the given) amplification vectors on one host; return confirmed hits."""
+    results = []
+    for v in (vectors or list(VECTORS)):
+        if stop_check and stop_check():
+            break
+        hit = probe_vector(host, v, timeout)
+        if hit:
+            results.append(hit)
+    return results