gyntoolkit 2.1.1__tar.gz → 2.3.0__tar.gz

{gyntoolkit-2.1.1 → gyntoolkit-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gyntoolkit
-Version: 2.1.1
+Version: 2.3.0
 Summary: Canivete suíço de pentest — recon, port scan, CVE lookup e brute force.
 Author: PH, Fl4vs
 License-Expression: MIT
@@ -49,7 +49,7 @@ Dynamic: license-file
  ██████╗██╗   ██╗███╗   ██╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
 ██╔════╝╚██╗ ██╔╝████╗  ██║    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
 ██║  ███╗╚████╔╝ ██╔██╗ ██║       ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║
-██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.1
+██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.3
 ╚██████╔╝  ██║   ██║ ╚████║       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   by: PH,Fl4vs
  ╚═════╝   ╚═╝   ╚═╝  ╚═══╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝
 ```
@@ -124,23 +124,34 @@ Dynamic: license-file
 | 9 | **HIBP Breach Check** | Domain → known breaches via Have I Been Pwned |
 | 10 | **MAC Vendor Lookup** | `api.macvendors.com` — OUI → vendor |
 | 11 | **Traceroute (TCP)** | `scapy` — hops + RTT (needs privilege) |
+| 12 | **DNS Zone Transfer (AXFR)** | `dnspython` — tries AXFR against each authoritative NS |
+| 13 | **Web Content Discovery** | `aiohttp` — robots.txt / sitemap / security.txt + built-in path wordlist |
+| 14 | **Shodan Host** | Full `api.shodan.io` host lookup (ports, CPEs, CVEs, tags) — needs `api_keys.shodan`; falls back to InternetDB hint without a key |
+| 15 | **Email Security** | `dnspython` — SPF, DKIM, DMARC, DNSSEC and CAA analyzer with per-item verdict (`ok`/`weak`/`missing`) |
 
 ### `[2]` Brute Force
 
 | # | Module | Details |
 |---|--------|---------|
-| 1 | **CUPP wordlist** | Wrapper for `cupp.py -i` — custom wordlist generator |
-| 2 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
-| 3 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
+| 1 | **Native wordlist** | Built-in CUPP-style generator (offline, no external clone) — case/leet variants, years, suffixes, term combos |
+| 2 | **CUPP wordlist** | Optional wrapper for `cupp.py -i` |
+| 3 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
+| 4 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
 
-> Every attack requires typing `AUTORIZO` to confirm — no silent bypass.
+> Every attack requires typing the authorization word (`AUTHORIZE` / `AUTORIZO`)
+> to confirm — no silent bypass.
 
 ### `[3]` Advanced Scanning
 
 - **Port scan** — fast (Top 21 common ports) or full (1–65535)
 - **SYN scan** (stealth) when privileged, automatic fallback to **TCP connect**
 - **Banner grabbing** — async, parallel
-- **CVE analysis** per service via **NVD API v2.0**
+- **CVE analysis** per service via **NVD API v2.0** — parses product + version
+  from the banner and matches by **CPE** (`virtualMatchString`), falling back to
+  keyword search; rate-limited and deduplicated per banner
+- **Risk scoring** — each CVE is enriched with **CVSS** base score/severity,
+  **EPSS** exploitation probability and a **CISA KEV** flag; host risk is the
+  highest severity found (KEV forces critical). Filter with `--min-cvss` / `--kev-only`
 - **Host discovery** (ARP scan) by CIDR — e.g. `192.168.0.0/24`
 - Automatic risk classification based on CVEs found
 
@@ -154,6 +165,12 @@ Dynamic: license-file
 | 4 | **Base64 decode** | base64 → UTF-8 with auto-padding |
 | 5 | **JWT decode** | Header + payload without signature verification |
 
+### `[5]` Audit — one target, consolidated profile
+
+Orchestrates the recon modules (and, with `--active --authorize`, the port scan)
+into a **single report** with an executive summary. Passive by default; stage
+selection via `--only` / `--skip`. See the [CLI examples](#non-interactive-cli-scriptable).
+
 ---
 
 ## Installation
@@ -203,6 +220,55 @@ An interactive dark CLI opens with a numbered menu. Commands are entered at the
 
 ---
 
+## Non-interactive CLI (scriptable)
+
+Pass a subcommand to run a single action and print the result as JSON on stdout
+(pipe-friendly) — no menu. Omit the subcommand to open the interactive menu.
+
+```bash
+gyntoolkit recon dns example.com --type MX        # DNS lookup
+gyntoolkit recon axfr example.com                 # zone transfer attempt
+gyntoolkit recon webscan http://example.com       # web content discovery
+gyntoolkit recon shodan 1.1.1.1                   # Shodan host (needs api_keys.shodan)
+gyntoolkit recon ssl example.com --port 443       # TLS cert
+gyntoolkit scan 127.0.0.1 --type fast             # port scan + CVEs (CVSS/EPSS/KEV)
+gyntoolkit scan 10.0.0.5 --min-cvss 7.0 --kev-only # only high-risk / actively exploited
+gyntoolkit scan 192.168.0.0/24                    # host discovery (CIDR)
+gyntoolkit audit example.com                      # full passive profile → one report
+gyntoolkit audit 10.0.0.5 --active --authorize    # + active port scan (authorized)
+gyntoolkit utils hash "text" --algo sha1
+gyntoolkit utils jwt <token>
+gyntoolkit wordlist --terms alice,fluffy,acme --years 1990,2020 --leet --save wl.txt
+```
+
+`audit` runs a pipeline over one target and consolidates everything into a single
+report with an executive summary. It is **passive by default** (WHOIS, DNS, geo,
+subdomains, TLS, HTTP fingerprint, InternetDB, HIBP, email security); the active
+port scan only runs with `--active --authorize`. Narrow it with `--only a,b` or
+`--skip a,b`.
+
+Global flags (place after the subcommand): `-o/--output DIR` saves a report,
+`-f/--format {json,html,csv,md}` picks its format, `-q/--quiet` silences stdout,
+`--lang {en,pt}` overrides the language.
+
+```bash
+gyntoolkit scan scanme.example.com -o reports -f md     # also save a Markdown report
+gyntoolkit recon geo 1.1.1.1 -o reports -f csv -q       # CSV only, no stdout
+```
+
+Active attacks are available but require explicit authorization:
+
+```bash
+gyntoolkit brute ssh HOST --users users.txt --passwords pass.txt --authorize
+gyntoolkit brute http URL  --users admin --passwords pass.txt --mode form \
+  --user-field user --pass-field pass --fail-signature "Invalid" --authorize
+```
+
+Without `--authorize`, brute subcommands abort — you confirm you have **written
+authorization** for the target.
+
+---
+
 ## Example
 
 Target: the **local security lab** (never a third-party system).
@@ -256,8 +322,8 @@ Full walkthrough: [`docs/security-lab.md`](docs/security-lab.md) and
 
 ## Reports
 
-After scans and recon lookups, the CLI offers to export results as **JSON** or a
-dark-themed **HTML report**. Files are written to
+After scans and recon lookups, the CLI offers to export results as **JSON**, a
+dark-themed **HTML report**, **CSV** or **Markdown**. Files are written to
 `reports/<module>-<timestamp>.<fmt>` (configurable via `export.dir`; set
 `export.auto: true` to export without prompting). Details in
 [`docs/reports.md`](docs/reports.md).

{gyntoolkit-2.1.1 → gyntoolkit-2.3.0}/README.md

@@ -6,7 +6,7 @@
  ██████╗██╗   ██╗███╗   ██╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
 ██╔════╝╚██╗ ██╔╝████╗  ██║    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
 ██║  ███╗╚████╔╝ ██╔██╗ ██║       ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║
-██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.1
+██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.3
 ╚██████╔╝  ██║   ██║ ╚████║       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   by: PH,Fl4vs
  ╚═════╝   ╚═╝   ╚═╝  ╚═══╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝
 ```
@@ -81,23 +81,34 @@
 | 9 | **HIBP Breach Check** | Domain → known breaches via Have I Been Pwned |
 | 10 | **MAC Vendor Lookup** | `api.macvendors.com` — OUI → vendor |
 | 11 | **Traceroute (TCP)** | `scapy` — hops + RTT (needs privilege) |
+| 12 | **DNS Zone Transfer (AXFR)** | `dnspython` — tries AXFR against each authoritative NS |
+| 13 | **Web Content Discovery** | `aiohttp` — robots.txt / sitemap / security.txt + built-in path wordlist |
+| 14 | **Shodan Host** | Full `api.shodan.io` host lookup (ports, CPEs, CVEs, tags) — needs `api_keys.shodan`; falls back to InternetDB hint without a key |
+| 15 | **Email Security** | `dnspython` — SPF, DKIM, DMARC, DNSSEC and CAA analyzer with per-item verdict (`ok`/`weak`/`missing`) |
 
 ### `[2]` Brute Force
 
 | # | Module | Details |
 |---|--------|---------|
-| 1 | **CUPP wordlist** | Wrapper for `cupp.py -i` — custom wordlist generator |
-| 2 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
-| 3 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
+| 1 | **Native wordlist** | Built-in CUPP-style generator (offline, no external clone) — case/leet variants, years, suffixes, term combos |
+| 2 | **CUPP wordlist** | Optional wrapper for `cupp.py -i` |
+| 3 | **SSH brute** | `paramiko`, async via `asyncio.to_thread`, concurrency `Semaphore`, delay |
+| 4 | **HTTP brute** | `aiohttp` — Basic Auth or form POST with configurable `fail_signature` |
 
-> Every attack requires typing `AUTORIZO` to confirm — no silent bypass.
+> Every attack requires typing the authorization word (`AUTHORIZE` / `AUTORIZO`)
+> to confirm — no silent bypass.
 
 ### `[3]` Advanced Scanning
 
 - **Port scan** — fast (Top 21 common ports) or full (1–65535)
 - **SYN scan** (stealth) when privileged, automatic fallback to **TCP connect**
 - **Banner grabbing** — async, parallel
-- **CVE analysis** per service via **NVD API v2.0**
+- **CVE analysis** per service via **NVD API v2.0** — parses product + version
+  from the banner and matches by **CPE** (`virtualMatchString`), falling back to
+  keyword search; rate-limited and deduplicated per banner
+- **Risk scoring** — each CVE is enriched with **CVSS** base score/severity,
+  **EPSS** exploitation probability and a **CISA KEV** flag; host risk is the
+  highest severity found (KEV forces critical). Filter with `--min-cvss` / `--kev-only`
 - **Host discovery** (ARP scan) by CIDR — e.g. `192.168.0.0/24`
 - Automatic risk classification based on CVEs found
 
@@ -111,6 +122,12 @@
 | 4 | **Base64 decode** | base64 → UTF-8 with auto-padding |
 | 5 | **JWT decode** | Header + payload without signature verification |
 
+### `[5]` Audit — one target, consolidated profile
+
+Orchestrates the recon modules (and, with `--active --authorize`, the port scan)
+into a **single report** with an executive summary. Passive by default; stage
+selection via `--only` / `--skip`. See the [CLI examples](#non-interactive-cli-scriptable).
+
 ---
 
 ## Installation
@@ -160,6 +177,55 @@ An interactive dark CLI opens with a numbered menu. Commands are entered at the
 
 ---
 
+## Non-interactive CLI (scriptable)
+
+Pass a subcommand to run a single action and print the result as JSON on stdout
+(pipe-friendly) — no menu. Omit the subcommand to open the interactive menu.
+
+```bash
+gyntoolkit recon dns example.com --type MX        # DNS lookup
+gyntoolkit recon axfr example.com                 # zone transfer attempt
+gyntoolkit recon webscan http://example.com       # web content discovery
+gyntoolkit recon shodan 1.1.1.1                   # Shodan host (needs api_keys.shodan)
+gyntoolkit recon ssl example.com --port 443       # TLS cert
+gyntoolkit scan 127.0.0.1 --type fast             # port scan + CVEs (CVSS/EPSS/KEV)
+gyntoolkit scan 10.0.0.5 --min-cvss 7.0 --kev-only # only high-risk / actively exploited
+gyntoolkit scan 192.168.0.0/24                    # host discovery (CIDR)
+gyntoolkit audit example.com                      # full passive profile → one report
+gyntoolkit audit 10.0.0.5 --active --authorize    # + active port scan (authorized)
+gyntoolkit utils hash "text" --algo sha1
+gyntoolkit utils jwt <token>
+gyntoolkit wordlist --terms alice,fluffy,acme --years 1990,2020 --leet --save wl.txt
+```
+
+`audit` runs a pipeline over one target and consolidates everything into a single
+report with an executive summary. It is **passive by default** (WHOIS, DNS, geo,
+subdomains, TLS, HTTP fingerprint, InternetDB, HIBP, email security); the active
+port scan only runs with `--active --authorize`. Narrow it with `--only a,b` or
+`--skip a,b`.
+
+Global flags (place after the subcommand): `-o/--output DIR` saves a report,
+`-f/--format {json,html,csv,md}` picks its format, `-q/--quiet` silences stdout,
+`--lang {en,pt}` overrides the language.
+
+```bash
+gyntoolkit scan scanme.example.com -o reports -f md     # also save a Markdown report
+gyntoolkit recon geo 1.1.1.1 -o reports -f csv -q       # CSV only, no stdout
+```
+
+Active attacks are available but require explicit authorization:
+
+```bash
+gyntoolkit brute ssh HOST --users users.txt --passwords pass.txt --authorize
+gyntoolkit brute http URL  --users admin --passwords pass.txt --mode form \
+  --user-field user --pass-field pass --fail-signature "Invalid" --authorize
+```
+
+Without `--authorize`, brute subcommands abort — you confirm you have **written
+authorization** for the target.
+
+---
+
 ## Example
 
 Target: the **local security lab** (never a third-party system).
@@ -213,8 +279,8 @@ Full walkthrough: [`docs/security-lab.md`](docs/security-lab.md) and
 
 ## Reports
 
-After scans and recon lookups, the CLI offers to export results as **JSON** or a
-dark-themed **HTML report**. Files are written to
+After scans and recon lookups, the CLI offers to export results as **JSON**, a
+dark-themed **HTML report**, **CSV** or **Markdown**. Files are written to
 `reports/<module>-<timestamp>.<fmt>` (configurable via `export.dir`; set
 `export.auto: true` to export without prompting). Details in
 [`docs/reports.md`](docs/reports.md).

{gyntoolkit-2.1.1 → gyntoolkit-2.3.0}/gyntoolkit/__init__.py

@@ -5,9 +5,10 @@ Este ``__init__`` re-exporta a API pública para manter compatibilidade com
 ``import gyntoolkit as g`` (usado pelo lab E2E) e pelo entry point do pyproject.
 """
 
-__version__ = "2.1.1"
+__version__ = "2.3.0"
 
 from . import i18n, ui
+from .audit import run_audit
 from .brute import (
     cupp_generate,
     http_bruteforce,
@@ -29,7 +30,8 @@ from .core import (
     sanitize_input,
     show_menu,
 )
-from .export import export_html, export_json, save_report
+from .export import export_csv, export_html, export_json, export_md, save_report
+from .mailsec import DEFAULT_DKIM_SELECTORS, mailsec_report
 from .recon import (
     DNS_TYPES,
     TECH_SIGNATURES,
@@ -41,20 +43,25 @@ from .recon import (
     internetdb_lookup,
     mac_vendor,
     reverse_dns,
+    shodan_host,
     ssl_inspect,
     subdomain_enum,
     traceroute,
     whois_lookup,
+    zone_transfer,
 )
 from .scan import (
     check_vulnerabilities,
     connect_scan,
     get_banner,
     network_discovery,
+    parse_service,
     perform_scan,
     syn_scan,
 )
 from .utils import b64_decode, b64_encode, hash_file, hash_text, jwt_decode
+from .web import COMMON_PATHS, web_discovery
+from .wordlist import generate_wordlist
 
 __all__ = [
     "__version__",
@@ -63,18 +70,28 @@ __all__ = [
     "clear_screen", "is_admin_windows", "sanitize_input", "show_menu",
     # scan
     "syn_scan", "connect_scan", "get_banner", "check_vulnerabilities",
-    "network_discovery", "perform_scan",
+    "parse_service", "network_discovery", "perform_scan",
     # recon
     "whois_lookup", "dns_lookup", "geo_ip", "reverse_dns", "subdomain_enum",
     "ssl_inspect", "http_fingerprint", "internetdb_lookup", "hibp_breaches",
-    "mac_vendor", "traceroute", "escolher_tipo_dns", "DNS_TYPES", "TECH_SIGNATURES",
+    "mac_vendor", "traceroute", "zone_transfer", "shodan_host",
+    "escolher_tipo_dns", "DNS_TYPES", "TECH_SIGNATURES",
+    # web discovery
+    "web_discovery", "COMMON_PATHS",
+    # mail security
+    "mailsec_report", "DEFAULT_DKIM_SELECTORS",
+    # audit
+    "run_audit",
+    # wordlist
+    "generate_wordlist",
     # brute
     "print_ethical_warning", "load_wordlist", "cupp_generate",
     "ssh_bruteforce", "http_bruteforce",
     # utils
     "hash_text", "hash_file", "b64_encode", "b64_decode", "jwt_decode",
     # config / export / ui
-    "CONFIG", "DEFAULTS", "load_config", "save_report", "export_json", "export_html", "ui", "i18n",
+    "CONFIG", "DEFAULTS", "load_config", "save_report",
+    "export_json", "export_html", "export_csv", "export_md", "ui", "i18n",
     # cli
     "main_flow", "main_entry",
 ]

gyntoolkit-2.3.0/gyntoolkit/audit.py

@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""Audit: orquestrador de engajamento — 1 alvo, perfil consolidado.
+
+Roda um pipeline de etapas (recon passivo por padrão; scan ativo só com
+``active=True`` + ``authorized=True``) e agrega tudo num único relatório com
+resumo executivo. Reaproveita os módulos existentes (recon/scan/mailsec).
+
+Etapas são resilientes: a falha de uma registra ``{"error": ...}`` na sua seção
+sem derrubar o resto.
+"""
+
+import asyncio
+import ipaddress
+import socket
+from datetime import datetime, timezone
+from typing import Any
+
+from .core import log, sanitize_input
+
+# Etapas passivas (seguras) e ativas (intrusivas). Ordem define a saída.
+PASSIVE_STAGES = ("whois", "dns", "geo", "subdomains", "ssl", "httpfp",
+                  "internetdb", "hibp", "mailsec")
+ACTIVE_STAGES = ("scan",)
+ALL_STAGES = PASSIVE_STAGES + ACTIVE_STAGES
+
+# Etapas que só fazem sentido p/ domínio (não p/ IP literal).
+_DOMAIN_ONLY = {"whois", "subdomains", "hibp", "mailsec"}
+
+
+def _is_ip(target: str) -> bool:
+    try:
+        ipaddress.ip_address(target)
+        return True
+    except ValueError:
+        return False
+
+
+def _resolve(target: str) -> str | None:
+    try:
+        return socket.gethostbyname(target)
+    except socket.gaierror:
+        return None
+
+
+# --------------------------------------------------------------------------
+# Runners por etapa.
+# --------------------------------------------------------------------------
+def _passive_stage(name: str, target: str, ctx: dict) -> Any:
+    """Executa uma etapa passiva (síncrona: requests/dns). Roda em thread."""
+    from . import recon
+    from .mailsec import mailsec_report
+
+    is_ip = ctx["is_ip"]
+    if name == "whois":
+        return {"whois": str(recon.whois_lookup(target))}
+    if name == "dns":
+        return {t: recon.dns_lookup(target, t) for t in ("A", "MX", "NS", "TXT")}
+    if name == "geo":
+        return recon.geo_ip(target)
+    if name == "subdomains":
+        subs = recon.subdomain_enum(target)
+        return {"total": len(subs), "subdomains": subs}
+    if name == "ssl":
+        return recon.ssl_inspect(target, 443)
+    if name == "httpfp":
+        scheme = "http" if is_ip else "https"
+        return recon.http_fingerprint(f"{scheme}://{target}")
+    if name == "internetdb":
+        return recon.internetdb_lookup(target)
+    if name == "hibp":
+        return {"breaches": recon.hibp_breaches(target)}
+    if name == "mailsec":
+        return mailsec_report(target)
+    raise ValueError(f"unknown passive stage: {name}")
+
+
+async def _run_one(name: str, target: str, ctx: dict) -> tuple[str, Any]:
+    """Executa uma etapa com captura de erro. Passivas rodam em thread."""
+    try:
+        if name == "scan":
+            from .scan import perform_scan
+
+            ip = target if ctx["is_ip"] else (_resolve(target) or target)
+            results = await perform_scan(
+                ip, ctx["scan_type"], concurrency=ctx["concurrency"], nvd_api_key=ctx["nvd_key"],
+            )
+            return (name, {str(port): data for port, data in results.items()})
+        return (name, await asyncio.to_thread(_passive_stage, name, target, ctx))
+    except Exception as e:  # noqa: BLE001 - etapa resiliente
+        log.warning("audit stage '%s' falhou: %s", name, e)
+        return (name, {"error": str(e)})
+
+
+def _select_stages(is_ip: bool, active: bool, only: list[str] | None,
+                   skip: list[str] | None) -> list[str]:
+    """Resolve a lista final de etapas conforme tipo de alvo e flags."""
+    stages = list(PASSIVE_STAGES) + (list(ACTIVE_STAGES) if active else [])
+    if only:
+        wanted = set(only)
+        stages = [s for s in ALL_STAGES if s in wanted and (active or s not in ACTIVE_STAGES)]
+    if skip:
+        stages = [s for s in stages if s not in set(skip)]
+    if is_ip:
+        stages = [s for s in stages if s not in _DOMAIN_ONLY]
+    return stages
+
+
+def _summarize(stages_out: dict) -> dict:
+    """Resumo executivo: contagens e destaques das seções coletadas."""
+    summary: dict[str, Any] = {}
+    scan = stages_out.get("scan")
+    if isinstance(scan, dict) and "error" not in scan:
+        open_ports = list(scan.keys())
+        cves = [c for port in scan.values() for c in port.get("vulnerabilidades", [])]
+        kev = [c for c in cves if c.get("kev")]
+        summary["open_ports"] = len(open_ports)
+        summary["cves"] = len(cves)
+        summary["kev_cves"] = len(kev)
+    subs = stages_out.get("subdomains")
+    if isinstance(subs, dict) and "total" in subs:
+        summary["subdomains"] = subs["total"]
+    mail = stages_out.get("mailsec")
+    if isinstance(mail, dict) and "summary" in mail:
+        summary["mailsec_weak"] = mail["summary"].get("weak", 0) + mail["summary"].get("missing", 0)
+    return summary
+
+
+async def run_audit(
+    target: str,
+    active: bool = False,
+    authorized: bool = False,
+    only: list[str] | None = None,
+    skip: list[str] | None = None,
+    concurrency: int = 100,
+    nvd_key: str = "",
+    scan_type: str = "fast",
+) -> dict:
+    """Roda o audit e devolve o relatório consolidado.
+
+    Etapas ativas (scan) só rodam com ``active=True`` **e** ``authorized=True`` —
+    autorização é exigida p/ qualquer ação intrusiva.
+    """
+    target = sanitize_input(target, r"[A-Za-z0-9.:/-]")
+    is_ip = _is_ip(target)
+    run_active = active and authorized
+    ctx = {"is_ip": is_ip, "concurrency": concurrency, "nvd_key": nvd_key, "scan_type": scan_type}
+
+    stages = _select_stages(is_ip, run_active, only, skip)
+    results = await asyncio.gather(*[_run_one(s, target, ctx) for s in stages])
+    stages_out = dict(results)
+    # reordena conforme ALL_STAGES p/ saída estável
+    ordered = {s: stages_out[s] for s in ALL_STAGES if s in stages_out}
+
+    return {
+        "target": target,
+        "is_ip": is_ip,
+        "active": run_active,
+        "active_requested_without_auth": active and not authorized,
+        "generated": datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC"),
+        "summary": _summarize(ordered),
+        "stages": ordered,
+    }

{gyntoolkit-2.1.1 → gyntoolkit-2.3.0}/gyntoolkit/brute.py

@@ -21,7 +21,9 @@ def print_ethical_warning(action: str) -> bool:
     print(f"{Fore.RED}{i18n.t('brute.warn_crime')}{Style.RESET_ALL}")
     print(f"{Fore.RED}{'=' * 60}{Style.RESET_ALL}")
     confirm = input(f"{Fore.YELLOW}{i18n.t('brute.confirm')}{Style.RESET_ALL}").strip()
-    return confirm == "AUTORIZO"
+    # Aceita a palavra localizada (en/pt) e o legado "AUTORIZO" como alias.
+    accepted = {i18n.t("brute.confirm_word").strip().upper(), "AUTORIZO"}
+    return confirm.upper() in accepted
 
 
 def load_wordlist(path: str) -> list[str]:
@@ -158,7 +160,9 @@ async def http_bruteforce(
                     if mode == "basic":
                         auth = aiohttp.BasicAuth(u, p)
                         async with session.get(url, auth=auth) as r:
-                            ok = r.status not in (401, 403)
+                            # Basic Auth: sucesso = 2xx. 401/403 = falha; 404/5xx
+                            # NÃO são credencial válida (evita falso-positivo).
+                            ok = 200 <= r.status < 300
                     else:
                         payload = {user_field: u, pass_field: p}
                         async with session.post(url, data=payload, allow_redirects=False) as r: