pentool 0.2.2__tar.gz → 0.2.4__tar.gz

{pentool-0.2.2 → pentool-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pentool
-Version: 0.2.2
+Version: 0.2.4
 Summary: Modern Web Pentesting TUI - Professional security testing tool
 Author-email: Pentool Team <dev@pentool.pro>
 License: AGPL-3.0
@@ -130,6 +130,11 @@ Fast, transparent, and built for real-world testing.
 # Install
 pip install pentool
 
+# Start a 14-day PRO trial (unlocks Scanner + other PRO features)
+# Run this BEFORE first launching the TUI — if the TUI is already open,
+# restart it afterwards so it picks up the new license.
+pentool license trial
+
 # Launch TUI
 pentool
 

{pentool-0.2.2 → pentool-0.2.4}/README.md

@@ -84,6 +84,11 @@ Fast, transparent, and built for real-world testing.
 # Install
 pip install pentool
 
+# Start a 14-day PRO trial (unlocks Scanner + other PRO features)
+# Run this BEFORE first launching the TUI — if the TUI is already open,
+# restart it afterwards so it picks up the new license.
+pentool license trial
+
 # Launch TUI
 pentool
 

{pentool-0.2.2 → pentool-0.2.4}/pentool/__init__.py

@@ -1,6 +1,6 @@
 """Pentool — professional web security testing toolkit with Textual TUI."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"
 __author__ = "pentool"
 
 

{pentool-0.2.2 → pentool-0.2.4}/pentool/api/target_api.py

@@ -83,6 +83,8 @@ class TargetAPI(ExportableAPI):
                 try:
                     node = SiteNode.from_dict(node_dict)
                     self._sitemap._nodes.setdefault(host, {})[node.path] = node
+                    if node.in_scope:
+                        self._sitemap._scope_hosts.add(self._sitemap._norm_host(host))
                     loaded += 1
                 except Exception as exc:
                     logger.warning("TargetAPI.import_project_data: skip node: %s", exc)

{pentool-0.2.2 → pentool-0.2.4}/pentool/core/database.py

@@ -95,6 +95,14 @@ CREATE TABLE IF NOT EXISTS site_map (
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_site_map_host_path ON site_map (host, path);
+
+-- Generic per-project key/value settings (e.g. "proxy.enforce_scope").
+-- Lives in the project .db file itself so it travels with the project,
+-- unlike pentool's global ~/.config/pentool/config.yaml.
+CREATE TABLE IF NOT EXISTS project_settings (
+    key     TEXT PRIMARY KEY,
+    value   TEXT NOT NULL DEFAULT ''
+);
 """
 
 
@@ -170,3 +178,31 @@ def init_db_sync(db_path: str) -> None:
         db_path: Path to the SQLite file.
     """
     asyncio.run(init_db(db_path))
+
+
+async def get_project_setting(db_path: str, key: str, default: str | None = None) -> str | None:
+    """Read a single per-project key/value setting from `project_settings`.
+
+    Returns `default` if the key is missing or the table/column doesn't
+    exist yet (e.g. a brand-new .db before init_db() has run).
+    """
+    try:
+        async with aiosqlite.connect(db_path) as db:
+            async with db.execute(
+                "SELECT value FROM project_settings WHERE key = ?", (key,)
+            ) as cur:
+                row = await cur.fetchone()
+                return row[0] if row else default
+    except Exception:
+        return default
+
+
+async def set_project_setting(db_path: str, key: str, value: str) -> None:
+    """Upsert a single per-project key/value setting into `project_settings`."""
+    async with aiosqlite.connect(db_path) as db:
+        await db.execute(
+            "INSERT INTO project_settings (key, value) VALUES (?, ?) "
+            "ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+            (key, value),
+        )
+        await db.commit()

{pentool-0.2.2 → pentool-0.2.4}/pentool/modules/proxy.py

@@ -150,6 +150,14 @@ class ProxyServer:
 
         self.intercept_enabled: bool = False
         self.scope: list[str] = []  # Empty = intercept everything
+        # When False (default), scope is informational only — ALL traffic is
+        # captured/shown regardless of self.scope. Scope filtering (dropping
+        # out-of-scope requests from capture) only takes effect when this is
+        # explicitly turned on via the "Skip out-of-scope" toggle button.
+        # Without this flag, a leftover/stale `scope` list (e.g. saved from a
+        # previous project) would silently blackhole all non-matching traffic
+        # the moment the proxy starts, with no visible indication why.
+        self.enforce_scope: bool = False
 
         # Match/Replace via dedicated engine
         self._match_replace_engine = MatchReplaceEngine()
@@ -205,7 +213,10 @@ class ProxyServer:
         self._running = False
         if self._server:
             self._server.close()
-            await self._server.wait_closed()
+            try:
+                await asyncio.wait_for(self._server.wait_closed(), timeout=2.0)
+            except asyncio.TimeoutError:
+                logger.debug("ProxyServer.stop: wait_closed timeout, continuing")
             self._server = None
         # Close singleton HTTP client
         if self._http_client:
@@ -214,6 +225,25 @@ class ProxyServer:
             except Exception as e:
                 logger.warning("ProxyServer.stop: http_client.close() error: %s", e)
             self._http_client = None
+        # Cancel all remaining active tasks (open TLS tunnels, keep-alive
+        # connections, intercept waits) so the event loop can exit promptly.
+        # Without this, _handle_connect loops on _READ_TIMEOUT=30s and
+        # _INTERCEPT_TIMEOUT=300s — the proxy thread would not exit for up to
+        # 5 minutes after stop(), blocking project switches and restarts.
+        loop = asyncio.get_running_loop()
+        current = asyncio.current_task()
+        pending = [t for t in asyncio.all_tasks(loop) if t is not current and not t.done()]
+        if pending:
+            logger.debug("ProxyServer.stop: cancelling %d active task(s)", len(pending))
+            for task in pending:
+                task.cancel()
+            try:
+                await asyncio.wait_for(
+                    asyncio.gather(*pending, return_exceptions=True),
+                    timeout=2.0,
+                )
+            except asyncio.TimeoutError:
+                logger.debug("ProxyServer.stop: task cancellation timed out")
         logger.info("Proxy stopped")
 
     async def serve_forever(self) -> None:
@@ -296,6 +326,19 @@ class ProxyServer:
         else:
             self.intercept_enabled = enabled
 
+    def set_enforce_scope(self, enabled: bool) -> None:
+        """Thread-safe setting of enforce_scope flag from any thread.
+
+        Same rationale as set_intercept — the proxy loop reads this flag
+        in _handle_http/_handle_connect, so writes from the TUI thread must
+        go through call_soon_threadsafe to avoid a torn read.
+        """
+        loop = self._loop
+        if loop is not None and loop.is_running():
+            loop.call_soon_threadsafe(setattr, self, "enforce_scope", enabled)
+        else:
+            self.enforce_scope = enabled
+
     def _find_request(self, req_id: str) -> InterceptedRequest | None:
         with self._requests_lock:
             for r in reversed(self.requests):
@@ -367,7 +410,8 @@ class ProxyServer:
         await writer.drain()
 
         # If host is out of scope — just tunnel without interception
-        if not self.is_in_scope(domain):
+        # (only enforced when the user turned on "Skip out-of-scope")
+        if self.enforce_scope and not self.is_in_scope(domain):
             await self._tunnel_raw(domain, host_port, reader, writer)
             return
 
@@ -491,7 +535,8 @@ class ProxyServer:
                     req.method, req.url, is_https, self.intercept_enabled, self.is_in_scope(host))
 
         # Check scope (for HTTP; HTTPS already checked in _handle_connect)
-        if not is_https and not self.is_in_scope(host):
+        # (only enforced when the user turned on "Skip out-of-scope")
+        if self.enforce_scope and not is_https and not self.is_in_scope(host):
             logger.debug("PROXY: _handle_http: host %s out of scope, forwarding direct", host)
             return await self._forward_direct(req, writer)
 

{pentool-0.2.2 → pentool-0.2.4}/pentool/modules/target.py

@@ -66,6 +66,20 @@ class SiteMap:
         self._db_path = db_path
     # host -> path -> SiteNode
         self._nodes: dict[str, dict[str, SiteNode]] = {}
+        # Scope is tracked independently of _nodes (normalized, port-stripped
+        # host names) so that adding a host to scope from Proxy works even
+        # if Target hasn't seen any traffic for it yet (or saw it under a
+        # host:port key that doesn't match the port-less host the user/Proxy
+        # refers to). Previously set_in_scope() was a no-op unless the exact
+        # host string already existed as a node — a host added to scope
+        # before any matching traffic arrived (or under a different
+        # host:port key) silently never got flagged, with no error raised.
+        self._scope_hosts: set[str] = set()
+
+    @staticmethod
+    def _norm_host(host: str) -> str:
+        """Normalize a host for scope comparisons: lowercase, no port."""
+        return host.split(":")[0].strip().lower()
 
     def add_request(self, req: "ParsedRequest") -> None:
         try:
@@ -79,6 +93,7 @@ class SiteMap:
 
         now = datetime.now(timezone.utc)
         host_map = self._nodes.setdefault(host, {})
+        in_scope = self._norm_host(host) in self._scope_hosts
 
         if path in host_map:
             node = host_map[path]
@@ -92,6 +107,7 @@ class SiteMap:
                 methods={req.method},
                 request_count=1,
                 last_seen=now,
+                in_scope=in_scope,
             )
 
     def get_tree(self) -> dict[str, list[SiteNode]]:
@@ -107,18 +123,38 @@ class SiteMap:
         return sorted(self._nodes.get(host, {}).values(), key=lambda n: n.path)
 
     def get_scope(self) -> list[str]:
-        return [h for h, paths in self._nodes.items() if any(n.in_scope for n in paths.values())]
+        # Union of hosts flagged via nodes (legacy/DB-loaded state) and hosts
+        # registered in _scope_hosts before any matching node existed.
+        node_hosts = {h for h, paths in self._nodes.items() if any(n.in_scope for n in paths.values())}
+        explicit_hosts = {h for h in self._nodes if self._norm_host(h) in self._scope_hosts}
+        return sorted(node_hosts | explicit_hosts)
 
     def get_request_count(self, host: str) -> int:
         return sum(n.request_count for n in self._nodes.get(host, {}).values())
 
     def set_in_scope(self, host: str, in_scope: bool) -> None:
-        """Include/exclude a host from Scope."""
-        if host in self._nodes:
-            for node in self._nodes[host].values():
-                node.in_scope = in_scope
+        """Include/exclude a host from Scope.
+
+        Tracks the (normalized, port-stripped) host in `_scope_hosts`
+        independently of whether a matching node already exists in
+        `_nodes` — a host added to scope before any traffic for it has
+        been seen (or seen under a different host:port key) is still
+        remembered and will be applied to any node for that host,
+        present now or added later via add_request().
+        """
+        norm = self._norm_host(host)
+        if in_scope:
+            self._scope_hosts.add(norm)
+        else:
+            self._scope_hosts.discard(norm)
+        for h, paths in self._nodes.items():
+            if self._norm_host(h) == norm:
+                for node in paths.values():
+                    node.in_scope = in_scope
 
     def is_in_scope(self, host: str) -> bool:
+        if self._norm_host(host) in self._scope_hosts:
+            return True
         paths = self._nodes.get(host, {})
         return any(n.in_scope for n in paths.values())
 
@@ -172,11 +208,14 @@ class SiteMap:
                     in_scope=bool(row["in_scope"]),
                 )
                 self._nodes.setdefault(node.host, {})[node.path] = node
+                if node.in_scope:
+                    self._scope_hosts.add(self._norm_host(node.host))
         except Exception as exc:
             logger.error("SiteMap.load error: %s", exc)
 
     def clear(self) -> None:
         self._nodes.clear()
+        self._scope_hosts.clear()
 
     def export_json(self) -> dict:
         return {

{pentool-0.2.2 → pentool-0.2.4}/pentool/tui/app.py

@@ -701,6 +701,14 @@ class PentoolApp(App):
                 pass
         self.query_one(ContentSwitcher).current = f"screen-{module_id}"
         self._active_module = module_id
+        # _update_proxy_screen_labels() only refreshes the ProxyScreen label
+        # when it IS the active module — so if the proxy was stopped/started
+        # while the user was on a different tab (e.g. right after creating a
+        # new project, which force-stops the proxy while Dashboard is shown),
+        # the label update was skipped and stayed stale until the next actual
+        # start/stop toggle. Refresh it explicitly on every switch into Proxy.
+        if module_id == "proxy":
+            self._update_proxy_screen_labels()
 
     def get_proxy(self) -> ProxyServer | None:
         return self._proxy
@@ -758,6 +766,21 @@ class PentoolApp(App):
         if self._proxy.is_running:
             self._stop_proxy()
         else:
+            if not self._project_loaded:
+                # Project DB switch/open (auto-open at startup, New/Open
+                # Project) is still finishing in the background — starting
+                # the proxy now would race HttpStorage.switch_db() (its
+                # connection may be mid-close/reopen) and silently lose or
+                # fail to persist the first captured requests. _project_loaded
+                # is set as soon as the DB switch itself completes (see
+                # ProjectManager._do_switch) — the other screens may still be
+                # reloading, but that's independent of Proxy.
+                self.notify(
+                    "Проект ещё открывается — подождите пару секунд перед запуском Proxy",
+                    severity="warning",
+                    timeout=4,
+                )
+                return
             self._start_proxy()
 
     def action_toggle_intercept(self) -> None:
@@ -877,13 +900,25 @@ class PentoolApp(App):
                 self._proxy.stop(), self._proxy_loop
             )
             try:
-                future.result(timeout=5)
+                # stop() now cancels all active tasks and waits up to ~4s
+                # internally, so 6s here is generous headroom
+                future.result(timeout=6)
             except Exception as e:
                 logger.warning("APP: proxy.stop() error or timeout: %s", e)
+                # Force-cancel anything still running in the proxy loop so
+                # the thread can exit even if stop() itself timed out
+                if self._proxy_loop and not self._proxy_loop.is_closed():
+                    try:
+                        def _cancel_all():
+                            for t in asyncio.all_tasks(self._proxy_loop):
+                                t.cancel()
+                        self._proxy_loop.call_soon_threadsafe(_cancel_all)
+                    except Exception:
+                        pass
         if self._proxy_thread and self._proxy_thread.is_alive():
-            self._proxy_thread.join(timeout=3)
+            self._proxy_thread.join(timeout=5)
             if self._proxy_thread.is_alive():
-                logger.warning("APP: proxy thread did not stop in 3s")
+                logger.warning("APP: proxy thread did not stop in 5s — port 8080 may still be in use")
         self.call_after_refresh(self._update_status)
         self.call_after_refresh(self._update_proxy_screen_labels)
 
@@ -974,7 +1009,20 @@ class PentoolApp(App):
             target = self.query_one(SCREEN_TARGET, TargetScreen)
             api = target._get_api()
             api.sitemap.set_in_scope(msg.host, msg.in_scope)
-            target._load_sitemap()
+            # Rebuild the tree from the in-memory sitemap only — NOT
+            # target._load_sitemap(), which does a full api.load() from
+            # the DB. The sitemap is persisted in batches of 20 rows
+            # (see target/screen.py _do_save_sitemap), so any host/path
+            # added in-memory since the last batch save would be wiped
+            # out by that reload, making a simple "Add to Scope" click
+            # from Proxy appear to clear the whole Target tree.
+            target._refresh_tree()
+            # Persist the scope change right away — without this, the
+            # in-memory-only mutation above can be silently discarded by a
+            # later full api.load() from the DB (e.g. on project import),
+            # making the scope change from Proxy appear to have never
+            # happened once the project is reloaded.
+            self.run_worker(api.save(), exclusive=False)
         except Exception as e:
             logger.debug("on_sync_scope_to_target: %s", e)
 

pentool-0.2.4/pentool/tui/dialogs/comment_dialog.py

@@ -0,0 +1,61 @@
+"""CommentDialog — view/edit the comment for a proxy history request.
+
+Standardized on the same compact layout as the other dialogs (ToolbarButton
+flat buttons, compact Input, CSS in a sibling .tcss file) instead of the
+default textual.widgets.Button/Input, which render with full-size borders
+and looked oversized compared to the rest of the app.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from textual import on
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import ModalScreen
+from textual.widgets import Input, Label
+
+from pentool.tui.widgets.toolbar_button import ToolbarButton
+
+_CSS = (Path(__file__).parent / "comment_dialog.tcss").read_text(encoding="utf-8")
+
+
+class CommentDialog(ModalScreen[str | None]):
+    """Dialog: view/edit the comment for the currently-selected request."""
+
+    DEFAULT_CSS = _CSS
+
+    BINDINGS = [Binding("escape", "dismiss(None)", "Cancel")]
+
+    def __init__(self, initial_comment: str = "") -> None:
+        super().__init__()
+        self._initial_comment = initial_comment
+
+    def compose(self) -> ComposeResult:
+        with Vertical(id="dialog"):
+            yield Label("Comment:", id="comment-label")
+            yield Input(
+                value=self._initial_comment,
+                placeholder="Add comment...",
+                id="comment-dialog-input",
+                compact=True,
+            )
+            with Horizontal(id="buttons"):
+                yield ToolbarButton("Save", "btn-save")
+                yield ToolbarButton("Cancel", "btn-cancel")
+
+    def on_mount(self) -> None:
+        self.query_one("#comment-dialog-input", Input).focus()
+
+    @on(ToolbarButton.Pressed, "#btn-save")
+    def on_btn_save(self, _: ToolbarButton.Pressed) -> None:
+        self.dismiss(self.query_one("#comment-dialog-input", Input).value)
+
+    @on(ToolbarButton.Pressed, "#btn-cancel")
+    def on_btn_cancel(self, _: ToolbarButton.Pressed) -> None:
+        self.dismiss(None)
+
+    def on_input_submitted(self, event: Input.Submitted) -> None:
+        self.dismiss(event.value)

pentool-0.2.4/pentool/tui/dialogs/comment_dialog.tcss

@@ -0,0 +1,25 @@
+CommentDialog {
+    align: center middle;
+}
+CommentDialog #dialog {
+    width: 60;
+    height: auto;
+    border: round $primary;
+    background: $surface;
+    padding: 1 2;
+}
+CommentDialog #comment-label {
+    margin-bottom: 1;
+}
+CommentDialog #comment-dialog-input {
+    margin-bottom: 1;
+}
+CommentDialog #buttons {
+    layout: horizontal;
+    height: 1;
+    align: right middle;
+    margin-top: 1;
+}
+CommentDialog #buttons ToolbarButton {
+    margin-left: 1;
+}

{pentool-0.2.2 → pentool-0.2.4}/pentool/tui/dialogs/match_replace_dialog.py

@@ -13,7 +13,6 @@ from textual.screen import ModalScreen
 _CSS = (Path(__file__).parent / "match_replace_dialog.tcss").read_text(encoding="utf-8")
 from textual.widgets import (
     Button,
-    Checkbox,
     DataTable,
     Input,
     Label,
@@ -21,6 +20,7 @@ from textual.widgets import (
 )
 
 from pentool.api.proxy_api import MatchReplaceRule
+from pentool.tui.widgets.nice_checkbox import NiceCheckbox as Checkbox
 from pentool.tui.widgets.toolbar_button import ToolbarButton
 
 _TARGET_OPTIONS = [("request", "Request"), ("response", "Response"), ("both", "Both")]