netscraper 0.1.0__tar.gz → 0.2.2__tar.gz

{netscraper-0.1.0/src/netscraper.egg-info → netscraper-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: netscraper
-Version: 0.1.0
+Version: 0.2.2
 Summary: Automated network pentest check orchestration -- port-gates a target list, runs the relevant checks (TLS, SSH, SMB, LDAP, RPC, DNS, MSSQL, SNMP, FTP, HTTP, DIRSEARCH, CORS), and produces per-finding POC screenshots plus a styled Excel report.
 Author: Wati Cyber
 License: MIT
@@ -37,15 +37,18 @@ ready to drop straight into a report appendix.
 
 ```bash
 pip install netscraper
-playwright install chromium   # one-time, for POC screenshots
 netscraper --targets targets.txt
 ```
 
-For authorized penetration testing and security research only — see the
-legal banner the tool itself prints on every run. See "Requirements" below
-for the external command-line tools (`sslscan`, `nmap`, etc.) each check
-shells out to; `pip install` alone gets you the `netscraper` command and
-its Python dependencies, not those OS-level tools.
+That's it — no separate `playwright install chromium` step: the first time
+the tool actually needs Chromium for a POC screenshot, it notices it isn't
+downloaded yet and fetches it automatically (a one-time, ~150MB download;
+every run after that is an instant no-op check). For authorized
+penetration testing and security research only — see the legal banner the
+tool itself prints on every run. See "Requirements" below for the external
+command-line tools (`sslscan`, `nmap`, etc.) each check shells out to;
+`pip install` alone gets you the `netscraper` command and its Python
+dependencies, not those OS-level tools.
 
 Runs **vuln-first, not host-first**: every check's required port (TLS's own
 port, SSH/22, SMB/445, LDAP/389, RPC/445, MSSQL/1433, FTP/21, HTTP/80) gets
@@ -358,14 +361,17 @@ signing flagged for manual verification, both real, independent signals).
 
 - Python 3.9+, on macOS or Linux (uses a Unix pty for ANSI-preserving
   terminal capture where relevant; no Windows support).
-- `pip install netscraper && playwright install chromium` (once) — pulls in
-  `ssh-audit`, `impacket` (for `rpcdump.py`), `dirsearch`, `playwright`
-  (renders POC screenshots), `ansi2html` (real captured terminal colors →
-  matching HTML), and `openpyxl` (writes `PT_Scan_Report.xlsx`) as
-  dependencies automatically, and puts the `netscraper` command on your
-  PATH. Running from a source checkout instead of the published package?
-  `pip install -e . && playwright install chromium` from the repo root does
-  the same thing against your local copy.
+- `pip install netscraper` (once) — pulls in `ssh-audit`, `impacket` (for
+  `rpcdump.py`), `dirsearch`, `playwright` (renders POC screenshots),
+  `ansi2html` (real captured terminal colors → matching HTML), and
+  `openpyxl` (writes `PT_Scan_Report.xlsx`) as dependencies automatically,
+  and puts the `netscraper` command on your PATH. No separate `playwright
+  install chromium` step needed — see `ensure_chromium_installed()` in
+  `core/poc_renderer.py`, which the `netscraper` command calls on startup
+  and which downloads Chromium the first time it notices it isn't there
+  yet. Running from a source checkout instead of the published package?
+  `pip install -e .` from the repo root does the same thing against your
+  local copy.
 - Command-line tools this toolkit shells out to (install via your package
   manager — Debian/Ubuntu names shown):
   - `sslscan`, `openssl` — TLS check (`apt install sslscan`; openssl is
@@ -450,8 +456,12 @@ process.
 
 ```bash
 # Scan a list of targets (IPs, hostnames, and/or CIDR subnets, one per line)
-# --output defaults to ./results if omitted. With no --modes flag, you'll be
-# prompted to pick which check(s) to run once the port scan finishes.
+# --output defaults to ~/Netscraper/results if omitted -- the same real
+# folder every time, regardless of which directory you ran this from (you
+# installed this with pip, so there's no "project folder" to default to
+# the way running from a source checkout would have). With no --modes
+# flag, you'll be prompted to pick which check(s) to run once the port
+# scan finishes.
 netscraper --targets targets.txt
 
 # Scan a single target or a whole subnet on the command line
@@ -491,7 +501,7 @@ and — unless you passed `--modes` — asks which check(s) you actually want:
 ============================================================
 [+] Target list loaded: 137 IP/host(es) to scan
 [+] Scan type: LIVE
-[+] Results folder: results/scan_20260907_143022_a1b2c3
+[+] Results folder: /Users/kav1n/Netscraper/results/scan_20260907_143022_a1b2c3
 ============================================================
 
 [+] Scanning required ports across 137 target(s) ...
@@ -537,12 +547,15 @@ the two checks with no fixed port of their own.
 ### Every run gets its own results folder
 
 By default, each run writes into a uniquely-named subfolder under `--output`
-(default root `./results`) instead of a single fixed path — e.g.
-`results/scan_20260907_143022_a1b2c3` (a timestamp plus a short random
-suffix, so two runs started in the same second never collide). This means
-re-scanning the same targets later (a re-test after remediation, a repeat
-engagement, etc.) never silently overwrites a previous run's POCs and raw
-evidence — every run's evidence is kept, side by side, under `./results/`.
+(default root `~/Netscraper/results` — the same real folder on disk every
+time, no matter which directory you happened to run `netscraper` from)
+instead of a single fixed path — e.g.
+`~/Netscraper/results/scan_20260907_143022_a1b2c3` (a timestamp plus a
+short random suffix, so two runs started in the same second never
+collide). This means re-scanning the same targets later (a re-test after
+remediation, a repeat engagement, etc.) never silently overwrites a
+previous run's POCs and raw evidence — every run's evidence is kept, side
+by side, under `~/Netscraper/results/`.
 
 If you're scripting this and want full control over the exact output path
 yourself (e.g. in CI), pass `--no-run-id` to write directly into `--output`
@@ -589,8 +602,8 @@ point of vuln-first scanning).
 ## Output layout
 
 Everything below lives under this run's unique folder (e.g.
-`results/scan_20260907_143022_a1b2c3/`, or directly under `--output` if you
-passed `--no-run-id`):
+`~/Netscraper/results/scan_20260907_143022_a1b2c3/`, or directly under
+`--output` if you passed `--no-run-id`):
 
 ```
 scan_<timestamp>_<id>/

{netscraper-0.1.0 → netscraper-0.2.2}/README.md

@@ -6,15 +6,18 @@ ready to drop straight into a report appendix.
 
 ```bash
 pip install netscraper
-playwright install chromium   # one-time, for POC screenshots
 netscraper --targets targets.txt
 ```
 
-For authorized penetration testing and security research only — see the
-legal banner the tool itself prints on every run. See "Requirements" below
-for the external command-line tools (`sslscan`, `nmap`, etc.) each check
-shells out to; `pip install` alone gets you the `netscraper` command and
-its Python dependencies, not those OS-level tools.
+That's it — no separate `playwright install chromium` step: the first time
+the tool actually needs Chromium for a POC screenshot, it notices it isn't
+downloaded yet and fetches it automatically (a one-time, ~150MB download;
+every run after that is an instant no-op check). For authorized
+penetration testing and security research only — see the legal banner the
+tool itself prints on every run. See "Requirements" below for the external
+command-line tools (`sslscan`, `nmap`, etc.) each check shells out to;
+`pip install` alone gets you the `netscraper` command and its Python
+dependencies, not those OS-level tools.
 
 Runs **vuln-first, not host-first**: every check's required port (TLS's own
 port, SSH/22, SMB/445, LDAP/389, RPC/445, MSSQL/1433, FTP/21, HTTP/80) gets
@@ -327,14 +330,17 @@ signing flagged for manual verification, both real, independent signals).
 
 - Python 3.9+, on macOS or Linux (uses a Unix pty for ANSI-preserving
   terminal capture where relevant; no Windows support).
-- `pip install netscraper && playwright install chromium` (once) — pulls in
-  `ssh-audit`, `impacket` (for `rpcdump.py`), `dirsearch`, `playwright`
-  (renders POC screenshots), `ansi2html` (real captured terminal colors →
-  matching HTML), and `openpyxl` (writes `PT_Scan_Report.xlsx`) as
-  dependencies automatically, and puts the `netscraper` command on your
-  PATH. Running from a source checkout instead of the published package?
-  `pip install -e . && playwright install chromium` from the repo root does
-  the same thing against your local copy.
+- `pip install netscraper` (once) — pulls in `ssh-audit`, `impacket` (for
+  `rpcdump.py`), `dirsearch`, `playwright` (renders POC screenshots),
+  `ansi2html` (real captured terminal colors → matching HTML), and
+  `openpyxl` (writes `PT_Scan_Report.xlsx`) as dependencies automatically,
+  and puts the `netscraper` command on your PATH. No separate `playwright
+  install chromium` step needed — see `ensure_chromium_installed()` in
+  `core/poc_renderer.py`, which the `netscraper` command calls on startup
+  and which downloads Chromium the first time it notices it isn't there
+  yet. Running from a source checkout instead of the published package?
+  `pip install -e .` from the repo root does the same thing against your
+  local copy.
 - Command-line tools this toolkit shells out to (install via your package
   manager — Debian/Ubuntu names shown):
   - `sslscan`, `openssl` — TLS check (`apt install sslscan`; openssl is
@@ -419,8 +425,12 @@ process.
 
 ```bash
 # Scan a list of targets (IPs, hostnames, and/or CIDR subnets, one per line)
-# --output defaults to ./results if omitted. With no --modes flag, you'll be
-# prompted to pick which check(s) to run once the port scan finishes.
+# --output defaults to ~/Netscraper/results if omitted -- the same real
+# folder every time, regardless of which directory you ran this from (you
+# installed this with pip, so there's no "project folder" to default to
+# the way running from a source checkout would have). With no --modes
+# flag, you'll be prompted to pick which check(s) to run once the port
+# scan finishes.
 netscraper --targets targets.txt
 
 # Scan a single target or a whole subnet on the command line
@@ -460,7 +470,7 @@ and — unless you passed `--modes` — asks which check(s) you actually want:
 ============================================================
 [+] Target list loaded: 137 IP/host(es) to scan
 [+] Scan type: LIVE
-[+] Results folder: results/scan_20260907_143022_a1b2c3
+[+] Results folder: /Users/kav1n/Netscraper/results/scan_20260907_143022_a1b2c3
 ============================================================
 
 [+] Scanning required ports across 137 target(s) ...
@@ -506,12 +516,15 @@ the two checks with no fixed port of their own.
 ### Every run gets its own results folder
 
 By default, each run writes into a uniquely-named subfolder under `--output`
-(default root `./results`) instead of a single fixed path — e.g.
-`results/scan_20260907_143022_a1b2c3` (a timestamp plus a short random
-suffix, so two runs started in the same second never collide). This means
-re-scanning the same targets later (a re-test after remediation, a repeat
-engagement, etc.) never silently overwrites a previous run's POCs and raw
-evidence — every run's evidence is kept, side by side, under `./results/`.
+(default root `~/Netscraper/results` — the same real folder on disk every
+time, no matter which directory you happened to run `netscraper` from)
+instead of a single fixed path — e.g.
+`~/Netscraper/results/scan_20260907_143022_a1b2c3` (a timestamp plus a
+short random suffix, so two runs started in the same second never
+collide). This means re-scanning the same targets later (a re-test after
+remediation, a repeat engagement, etc.) never silently overwrites a
+previous run's POCs and raw evidence — every run's evidence is kept, side
+by side, under `~/Netscraper/results/`.
 
 If you're scripting this and want full control over the exact output path
 yourself (e.g. in CI), pass `--no-run-id` to write directly into `--output`
@@ -558,8 +571,8 @@ point of vuln-first scanning).
 ## Output layout
 
 Everything below lives under this run's unique folder (e.g.
-`results/scan_20260907_143022_a1b2c3/`, or directly under `--output` if you
-passed `--no-run-id`):
+`~/Netscraper/results/scan_20260907_143022_a1b2c3/`, or directly under
+`--output` if you passed `--no-run-id`):
 
 ```
 scan_<timestamp>_<id>/

{netscraper-0.1.0 → netscraper-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "netscraper"
-version = "0.1.0"
+version = "0.2.2"
 description = "Automated network pentest check orchestration -- port-gates a target list, runs the relevant checks (TLS, SSH, SMB, LDAP, RPC, DNS, MSSQL, SNMP, FTP, HTTP, DIRSEARCH, CORS), and produces per-finding POC screenshots plus a styled Excel report."
 readme = "README.md"
 requires-python = ">=3.9"

{netscraper-0.1.0 → netscraper-0.2.2}/src/netscraper/__init__.py

@@ -6,4 +6,4 @@ script) and README.md for full usage.
 """
 from __future__ import annotations
 
-__version__ = "0.1.0"
+__version__ = "0.2.2"

{netscraper-0.1.0 → netscraper-0.2.2}/src/netscraper/cli.py

@@ -16,22 +16,23 @@ not lumped in with a "safe" result it didn't earn.
 
 Usage:
   # Live scan (needs the relevant tools installed + real network reach).
-  # --output defaults to ./results if omitted. With no --modes flag, you'll
-  # be prompted to pick which check(s) to run once the port scan is done.
-  # After a scan finishes (or is interrupted with Ctrl-C), you're dropped
-  # back into the same Individual/Bulk/Exit main menu -- the tool only
-  # exits when you actually choose Exit there.
-  python3 cli.py --targets targets.txt
+  # --output defaults to ~/Netscraper/results if omitted -- the same real
+  # folder every time, regardless of which directory you ran this from.
+  # With no --modes flag, you'll be prompted to pick which check(s) to run
+  # once the port scan is done. After a scan finishes (or is interrupted
+  # with Ctrl-C), you're dropped back into the same Individual/Bulk/Exit
+  # main menu -- the tool only exits when you actually choose Exit there.
+  netscraper --targets targets.txt
 
   # Single target on the command line
-  python3 cli.py --target 192.168.1.10 --output ./results
+  netscraper --target 192.168.1.10 --output ./results
 
   # Skip the interactive picker and run specific check(s) non-interactively
-  python3 cli.py --targets targets.txt --modes tls,ssh
+  netscraper --targets targets.txt --modes tls,ssh
 
   # Replay previously-captured output instead of hitting the network
   # (used for testing / reprocessing evidence; see fixtures/)
-  python3 cli.py --targets targets_example.txt --output ./results --xml-dir ./fixtures
+  netscraper --targets targets_example.txt --output ./results --xml-dir ./fixtures
 
 Output layout (per check):
   <output>/SSL_Scan/Expired_Certificate/<host>.png (+ .txt)
@@ -72,20 +73,35 @@ from netscraper.core.port_gate import gate_targets, gate_targets_own_port
 from netscraper.core.families import FAMILIES
 from netscraper.core.concurrency import worker_count
 from netscraper.core.scan_worker import run_one_target_check
+from netscraper.core.poc_renderer import ensure_chromium_installed
 from netscraper.core.excel_report import write_report
 from netscraper.core.banner import clear_screen, print_banner, prompt_mode, prompt_scan_modes, prompt_port_list, ReturnToMainMenu
 from netscraper.core.theme import title, accent, info, ok, bad, warn, err, muted, prompt, host as c_host
 
+# A pip-installed CLI has no natural "project folder" the way a source
+# checkout run with `python3 cli.py` from its own repo does -- `netscraper`
+# can be invoked from literally any directory. Defaulting --output to a
+# relative "./results" would then scatter evidence into whatever random
+# folder happened to be the current directory at the time, which is
+# surprising and easy to lose track of. Anchoring the default on the
+# user's home directory instead means results always land in the same
+# predictable place regardless of where `netscraper` was run from --
+# ~/Netscraper/results on every OS this tool supports (macOS/Linux).
+# --output still overrides this for anyone who wants a different location.
+DEFAULT_OUTPUT_DIR = str(Path.home() / "Netscraper" / "results")
+
 
 def parse_args(argv=None) -> argparse.Namespace:
     p = argparse.ArgumentParser(description="NetScraper")
     src = p.add_mutually_exclusive_group(required=False)
     src.add_argument("--targets", help="Path to a targets file (IPs, hostnames, or CIDR subnets, one per line)")
     src.add_argument("--target", help="A single IP, hostname, or CIDR subnet")
-    p.add_argument("--output", default="./results",
-                   help="Root output directory for POCs, raw evidence, and summary.csv (default: ./results). "
-                        "Each run gets its own uniquely-named subfolder under this root (see --no-run-id) so "
-                        "repeated scans never overwrite each other's evidence.")
+    p.add_argument("--output", default=DEFAULT_OUTPUT_DIR,
+                   help=f"Root output directory for POCs, raw evidence, and summary.csv "
+                        f"(default: {DEFAULT_OUTPUT_DIR}, i.e. ~/Netscraper/results -- the same place "
+                        f"regardless of which directory you ran `netscraper` from). Each run gets its own "
+                        f"uniquely-named subfolder under this root (see --no-run-id) so repeated scans never "
+                        f"overwrite each other's evidence.")
     p.add_argument("--no-run-id", action="store_true",
                    help="Write directly into --output instead of a per-run unique subfolder (will overwrite "
                         "a previous run's evidence at that same path -- use this only for scripted/CI use "
@@ -591,6 +607,16 @@ def main(argv=None) -> int:
     args = parse_args(argv)
     interactive = not args.targets and not args.target
 
+    # Runs exactly once per process, before anything else -- makes `pip
+    # install netscraper` followed immediately by running this command
+    # just work, with no separate manual `playwright install chromium`
+    # step, by downloading it automatically the first time it's actually
+    # missing (a fast no-op every run after that). Deliberately done here,
+    # in the main process, before the interactive/scripted branches below
+    # ever create a worker pool -- see ensure_chromium_installed()'s
+    # docstring for why that ordering matters.
+    ensure_chromium_installed()
+
     if not interactive:
         # Scripted/automated use (--targets or --target given up front):
         # run exactly once and exit, same as before -- no menu loop, since

{netscraper-0.1.0 → netscraper-0.2.2}/src/netscraper/core/poc_renderer.py

@@ -13,6 +13,8 @@ from __future__ import annotations
 import atexit
 import html
 import re
+import subprocess
+import sys
 from contextlib import contextmanager
 from pathlib import Path
 from typing import List, Optional, Pattern
@@ -44,6 +46,19 @@ _SCREENSHOT_TIMEOUT_MS = 15_000
 # blue for exactly this reason.
 _ANSI_CONVERTER = Ansi2HTMLConverter(inline=True, dark_bg=True, scheme="osx")
 
+# Used ONLY to decide which lines count as a highlight match (see
+# _build_body_html below) -- never used to alter what's actually rendered.
+# Some tools (sslscan included) color just PART of a string differently from
+# the rest of it -- e.g. the "-SHA" suffix of a cipher name in a different
+# shade than the rest of the name -- which plants a raw ANSI escape code
+# *inside* what should be one contiguous run of characters. A regex like
+# \bECDHE-ECDSA-AES256-SHA\b can never match that string while the escape
+# code is still sitting in the middle of it, even though the *visible* text
+# is exactly what the pattern is looking for. Stripping codes before
+# matching (and only before matching) fixes that without touching the HTML
+# color rendering itself, which still runs on the original, code-intact text.
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*m")
+
 # How much context to keep around each highlighted (matched) line when a POC
 # gets cropped down to "just the relevant section" for the report. This only
 # ever kicks in when there's at least one real regex hit on a real line --
@@ -189,9 +204,12 @@ def _build_body_html(raw_text: str, highlight_regex: Optional[Pattern]) -> str:
     if len(html_lines) != len(raw_lines):
         html_lines = [html.escape(line) for line in raw_lines]
 
+    # Match against the ANSI-stripped text, not raw_line itself -- see the
+    # _ANSI_RE comment above for why a code embedded mid-string can otherwise
+    # hide an obvious, visible match from the regex entirely.
     hit_indices = [
         i for i, raw_line in enumerate(raw_lines)
-        if highlight_regex and highlight_regex.search(raw_line)
+        if highlight_regex and highlight_regex.search(_ANSI_RE.sub("", raw_line))
     ]
     keep_ranges = _compute_keep_ranges(
         len(raw_lines), hit_indices, _CONTEXT_BEFORE, _CONTEXT_AFTER
@@ -236,6 +254,58 @@ def _launch_browser(p):
         ) from exc
 
 
+def ensure_chromium_installed() -> None:
+    """
+    Makes `pip install netscraper` followed immediately by `netscraper
+    --targets ...` just work, with no separate manual `playwright install
+    chromium` step -- checks whether Playwright's Chromium build is
+    actually on disk yet and, if not, downloads it automatically (once)
+    before any real scanning starts.
+
+    Cheap on every run after the first: `p.chromium.executable_path` is
+    just Playwright telling us where it WOULD look for the browser, not
+    launching anything, so once it's been downloaded this is a fast path
+    check, not a re-download.
+
+    Call this exactly ONCE, in the main process, before any worker pool or
+    scan loop starts -- worker processes forked afterward inherit the
+    already-downloaded browser from disk and never hit this themselves,
+    which matters: without a single up-front check like this, several
+    worker processes could each discover Chromium missing on a brand-new
+    machine's very first run and race to download it into the same cache
+    directory at once.
+    """
+    if Path(_SANDBOX_CHROMIUM_PATH).exists():
+        return  # sandbox's own pre-fetched Chromium -- nothing to install
+
+    try:
+        with sync_playwright() as p:
+            exe_path = p.chromium.executable_path
+    except Exception:
+        # Can't even ask Playwright where it expects the browser (a truly
+        # broken Playwright install) -- don't try to guess further here;
+        # the real render call later will surface a clear, actionable
+        # error instead (see _launch_browser above).
+        return
+
+    if exe_path and Path(exe_path).exists():
+        return  # already installed
+
+    print("[*] Chromium not found -- downloading it now for POC screenshots "
+          "(one-time, ~150MB, needs network access) ...")
+    try:
+        result = subprocess.run([sys.executable, "-m", "playwright", "install", "chromium"])
+    except Exception as exc:
+        print(f"[!] Could not run the automatic Chromium download ({exc}). "
+              f"Run `playwright install chromium` yourself, then try again.")
+        return
+    if result.returncode != 0:
+        print("[!] Automatic Chromium download did not finish successfully. "
+              "Run `playwright install chromium` yourself, then try again.")
+    else:
+        print("[+] Chromium downloaded.")
+
+
 @contextmanager
 def browser_session():
     """

{netscraper-0.1.0 → netscraper-0.2.2/src/netscraper.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: netscraper
-Version: 0.1.0
+Version: 0.2.2
 Summary: Automated network pentest check orchestration -- port-gates a target list, runs the relevant checks (TLS, SSH, SMB, LDAP, RPC, DNS, MSSQL, SNMP, FTP, HTTP, DIRSEARCH, CORS), and produces per-finding POC screenshots plus a styled Excel report.
 Author: Wati Cyber
 License: MIT
@@ -37,15 +37,18 @@ ready to drop straight into a report appendix.
 
 ```bash
 pip install netscraper
-playwright install chromium   # one-time, for POC screenshots
 netscraper --targets targets.txt
 ```
 
-For authorized penetration testing and security research only — see the
-legal banner the tool itself prints on every run. See "Requirements" below
-for the external command-line tools (`sslscan`, `nmap`, etc.) each check
-shells out to; `pip install` alone gets you the `netscraper` command and
-its Python dependencies, not those OS-level tools.
+That's it — no separate `playwright install chromium` step: the first time
+the tool actually needs Chromium for a POC screenshot, it notices it isn't
+downloaded yet and fetches it automatically (a one-time, ~150MB download;
+every run after that is an instant no-op check). For authorized
+penetration testing and security research only — see the legal banner the
+tool itself prints on every run. See "Requirements" below for the external
+command-line tools (`sslscan`, `nmap`, etc.) each check shells out to;
+`pip install` alone gets you the `netscraper` command and its Python
+dependencies, not those OS-level tools.
 
 Runs **vuln-first, not host-first**: every check's required port (TLS's own
 port, SSH/22, SMB/445, LDAP/389, RPC/445, MSSQL/1433, FTP/21, HTTP/80) gets
@@ -358,14 +361,17 @@ signing flagged for manual verification, both real, independent signals).
 
 - Python 3.9+, on macOS or Linux (uses a Unix pty for ANSI-preserving
   terminal capture where relevant; no Windows support).
-- `pip install netscraper && playwright install chromium` (once) — pulls in
-  `ssh-audit`, `impacket` (for `rpcdump.py`), `dirsearch`, `playwright`
-  (renders POC screenshots), `ansi2html` (real captured terminal colors →
-  matching HTML), and `openpyxl` (writes `PT_Scan_Report.xlsx`) as
-  dependencies automatically, and puts the `netscraper` command on your
-  PATH. Running from a source checkout instead of the published package?
-  `pip install -e . && playwright install chromium` from the repo root does
-  the same thing against your local copy.
+- `pip install netscraper` (once) — pulls in `ssh-audit`, `impacket` (for
+  `rpcdump.py`), `dirsearch`, `playwright` (renders POC screenshots),
+  `ansi2html` (real captured terminal colors → matching HTML), and
+  `openpyxl` (writes `PT_Scan_Report.xlsx`) as dependencies automatically,
+  and puts the `netscraper` command on your PATH. No separate `playwright
+  install chromium` step needed — see `ensure_chromium_installed()` in
+  `core/poc_renderer.py`, which the `netscraper` command calls on startup
+  and which downloads Chromium the first time it notices it isn't there
+  yet. Running from a source checkout instead of the published package?
+  `pip install -e .` from the repo root does the same thing against your
+  local copy.
 - Command-line tools this toolkit shells out to (install via your package
   manager — Debian/Ubuntu names shown):
   - `sslscan`, `openssl` — TLS check (`apt install sslscan`; openssl is
@@ -450,8 +456,12 @@ process.
 
 ```bash
 # Scan a list of targets (IPs, hostnames, and/or CIDR subnets, one per line)
-# --output defaults to ./results if omitted. With no --modes flag, you'll be
-# prompted to pick which check(s) to run once the port scan finishes.
+# --output defaults to ~/Netscraper/results if omitted -- the same real
+# folder every time, regardless of which directory you ran this from (you
+# installed this with pip, so there's no "project folder" to default to
+# the way running from a source checkout would have). With no --modes
+# flag, you'll be prompted to pick which check(s) to run once the port
+# scan finishes.
 netscraper --targets targets.txt
 
 # Scan a single target or a whole subnet on the command line
@@ -491,7 +501,7 @@ and — unless you passed `--modes` — asks which check(s) you actually want:
 ============================================================
 [+] Target list loaded: 137 IP/host(es) to scan
 [+] Scan type: LIVE
-[+] Results folder: results/scan_20260907_143022_a1b2c3
+[+] Results folder: /Users/kav1n/Netscraper/results/scan_20260907_143022_a1b2c3
 ============================================================
 
 [+] Scanning required ports across 137 target(s) ...
@@ -537,12 +547,15 @@ the two checks with no fixed port of their own.
 ### Every run gets its own results folder
 
 By default, each run writes into a uniquely-named subfolder under `--output`
-(default root `./results`) instead of a single fixed path — e.g.
-`results/scan_20260907_143022_a1b2c3` (a timestamp plus a short random
-suffix, so two runs started in the same second never collide). This means
-re-scanning the same targets later (a re-test after remediation, a repeat
-engagement, etc.) never silently overwrites a previous run's POCs and raw
-evidence — every run's evidence is kept, side by side, under `./results/`.
+(default root `~/Netscraper/results` — the same real folder on disk every
+time, no matter which directory you happened to run `netscraper` from)
+instead of a single fixed path — e.g.
+`~/Netscraper/results/scan_20260907_143022_a1b2c3` (a timestamp plus a
+short random suffix, so two runs started in the same second never
+collide). This means re-scanning the same targets later (a re-test after
+remediation, a repeat engagement, etc.) never silently overwrites a
+previous run's POCs and raw evidence — every run's evidence is kept, side
+by side, under `~/Netscraper/results/`.
 
 If you're scripting this and want full control over the exact output path
 yourself (e.g. in CI), pass `--no-run-id` to write directly into `--output`
@@ -589,8 +602,8 @@ point of vuln-first scanning).
 ## Output layout
 
 Everything below lives under this run's unique folder (e.g.
-`results/scan_20260907_143022_a1b2c3/`, or directly under `--output` if you
-passed `--no-run-id`):
+`~/Netscraper/results/scan_20260907_143022_a1b2c3/`, or directly under
+`--output` if you passed `--no-run-id`):
 
 ```
 scan_<timestamp>_<id>/