pentool 0.2.8__tar.gz → 0.2.9__tar.gz

{pentool-0.2.8 → pentool-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pentool
-Version: 0.2.8
+Version: 0.2.9
 Summary: Modern Web Pentesting TUI - Professional security testing tool
 Author-email: Pentool Team <dev@pentool.pro>
 License: AGPL-3.0
@@ -58,6 +58,25 @@ Dynamic: license-file
 
 ---
 
+## 💸 Support & Pricing
+
+> Pentool is open-source and free to use. If it saves you time on a pentest — consider supporting development.  
+> Full pricing details and sponsorship options: **[pentool.pro](https://pentool.pro)**
+
+| | | |
+|---|---|---|
+| ⭐ **Sponsor (individual)** | **$5** one-time or /month | [Sponsor on GitHub](https://github.com/sponsors/DrXOps) |
+| 🏢 **Sponsor (company)** | **$50** one-time or /month | Logo in README + website · [pentool.pro/sponsor](https://pentool.pro/sponsor) |
+| 🔑 **PRO License — Early Access** | **$29** *(beta price, until Dec 31 2026)* | After release: $99/year |
+
+> **🎁 Beta loyalty discount:** Everyone who buys PRO for $29 gets a **lifetime 50% discount on annual renewal** (i.e. $49.50/year instead of $99).  
+> This discount applies **only to first buyers during the beta — until December 31, 2026**.
+
+**PRO license is issued manually during beta.**  
+To purchase, contact: **[@sudores](https://t.me/sudores)** (Telegram) · **dev@pentool.pro**
+
+---
+
 **Pentool** is a terminal-based (TUI) security toolkit for penetration testers and security researchers.  
 It combines HTTP interception, vulnerability scanning, automated attacks, and data analysis — all inside your terminal.  
 Fast, transparent, and built for real-world testing.
@@ -186,7 +205,8 @@ Pentool is built and maintained by a solo developer in spare time.
 If it saves you hours on a pentest — consider giving back. Every contribution directly funds new features, fixes, and faster releases.
 
 - ⭐ **[Star on GitHub](https://github.com/DrXOps/pentool)** — free, takes 2 seconds, helps visibility enormously
-- 🔑 **PRO license** — get early access and support development → **[@sudores](https://t.me/sudores)**
+- 💸 **[Sponsor the project](https://pentool.pro/sponsor)** — $5 (individual) or $50 (company, includes logo placement)
+- 🔑 **[PRO license — $29 beta price](https://pentool.pro)** — early access + lifetime loyalty discount
 - 💬 **Share** — tell a colleague, post a review, or mention Pentool in your writeups
 
 > Building tools is lonely work. A star or a kind word genuinely matters. Thank you. 🙏

{pentool-0.2.8 → pentool-0.2.9}/README.md

@@ -12,6 +12,25 @@
 
 ---
 
+## 💸 Support & Pricing
+
+> Pentool is open-source and free to use. If it saves you time on a pentest — consider supporting development.  
+> Full pricing details and sponsorship options: **[pentool.pro](https://pentool.pro)**
+
+| | | |
+|---|---|---|
+| ⭐ **Sponsor (individual)** | **$5** one-time or /month | [Sponsor on GitHub](https://github.com/sponsors/DrXOps) |
+| 🏢 **Sponsor (company)** | **$50** one-time or /month | Logo in README + website · [pentool.pro/sponsor](https://pentool.pro/sponsor) |
+| 🔑 **PRO License — Early Access** | **$29** *(beta price, until Dec 31 2026)* | After release: $99/year |
+
+> **🎁 Beta loyalty discount:** Everyone who buys PRO for $29 gets a **lifetime 50% discount on annual renewal** (i.e. $49.50/year instead of $99).  
+> This discount applies **only to first buyers during the beta — until December 31, 2026**.
+
+**PRO license is issued manually during beta.**  
+To purchase, contact: **[@sudores](https://t.me/sudores)** (Telegram) · **dev@pentool.pro**
+
+---
+
 **Pentool** is a terminal-based (TUI) security toolkit for penetration testers and security researchers.  
 It combines HTTP interception, vulnerability scanning, automated attacks, and data analysis — all inside your terminal.  
 Fast, transparent, and built for real-world testing.
@@ -140,7 +159,8 @@ Pentool is built and maintained by a solo developer in spare time.
 If it saves you hours on a pentest — consider giving back. Every contribution directly funds new features, fixes, and faster releases.
 
 - ⭐ **[Star on GitHub](https://github.com/DrXOps/pentool)** — free, takes 2 seconds, helps visibility enormously
-- 🔑 **PRO license** — get early access and support development → **[@sudores](https://t.me/sudores)**
+- 💸 **[Sponsor the project](https://pentool.pro/sponsor)** — $5 (individual) or $50 (company, includes logo placement)
+- 🔑 **[PRO license — $29 beta price](https://pentool.pro)** — early access + lifetime loyalty discount
 - 💬 **Share** — tell a colleague, post a review, or mention Pentool in your writeups
 
 > Building tools is lonely work. A star or a kind word genuinely matters. Thank you. 🙏

{pentool-0.2.8 → pentool-0.2.9}/pentool/__init__.py

@@ -1,6 +1,17 @@
 """Pentool — professional web security testing toolkit with Textual TUI."""
 
-__version__ = "0.2.8"
+from importlib.metadata import PackageNotFoundError, version as _pkg_version
+
+try:
+    # Single source of truth: the version pip actually installed (matches
+    # `pentool --version` / `pip show pentool`), including dev-build suffixes
+    # like "0.2.8.dev5" that CI stamps only into the package metadata, not
+    # into this file. Falls back to the literal below for editable/dev
+    # checkouts where the package isn't registered in the environment.
+    __version__ = _pkg_version("pentool")
+except PackageNotFoundError:
+    __version__ = "0.2.9"
+
 __author__ = "pentool"
 
 

{pentool-0.2.8 → pentool-0.2.9}/pentool/api/intruder_api.py

@@ -5,11 +5,18 @@ from __future__ import annotations
 import asyncio
 
 from pentool.api.base_api import ExportableAPI
+from pentool.api.intruder_repository import IntruderRepository
 from pentool.modules.intruder import (
     AttackType,
+    ChainedPayloadSource,
+    CharPayloadSource,
+    FilePayloadSource,
     IntruderAttack,
     IntruderConfig,
     IntruderResult,
+    NumericPayloadSource,
+    ProcessedPayloads,
+    count_lines_with_progress,
     count_markers,
     extract_marker_defaults,
     generate_char_payloads,
@@ -24,6 +31,12 @@ __all__ = [
     "IntruderAttack",
     "IntruderConfig",
     "IntruderResult",
+    "ChainedPayloadSource",
+    "CharPayloadSource",
+    "FilePayloadSource",
+    "NumericPayloadSource",
+    "ProcessedPayloads",
+    "count_lines_with_progress",
     "count_markers",
     "extract_marker_defaults",
     "generate_char_payloads",
@@ -33,13 +46,33 @@ __all__ = [
 ]
 
 
+
 class IntruderAPI(ExportableAPI):
 
-    def __init__(self, db_path: str | None = None) -> None:
+    def __init__(self, db_path: str | None = None, http_client=None) -> None:
         self._db_path = db_path
+        # Optional injected HTTPClient (DIP — see
+        # MYPLANS/ARCHITECTURE_REFACTOR_PLAN_2026-08-09.md section 2.2).
+        # IntruderAttack already accepted this as an optional constructor
+        # param (reusing one HTTPClient/connection pool across the whole
+        # attack — see the БАГ-D fix in modules/intruder.py) but IntruderAPI
+        # had no way to pass one in — it always let IntruderAttack create
+        # its own from scratch. Threading it through here just extends the
+        # existing `http_client=None` pattern one layer up, matching how
+        # ScannerAPI(db_path, http_client) already works. Does not apply to
+        # Turbo mode — TurboIntruderAttack manages its own aiohttp session
+        # pool internally by design (Keep-Alive tuning specific to Turbo),
+        # unrelated to this DI change.
+        self._http_client = http_client
         self._attack: IntruderAttack | None = None
         self._task: asyncio.Task | None = None
         self._restored_results: list = []
+        # SQL for tab state / attack results lives in IntruderRepository
+        # (see MYPLANS/ARCHITECTURE_REFACTOR_PLAN_2026-08-09.md section 2.6)
+        # — mirrors ScannerTabRepository, the same extraction already done
+        # for Scanner. IntruderAPI keeps its existing public method names
+        # as a thin facade so no caller needs to change.
+        self._repo = IntruderRepository(db_path=db_path)
 
     async def start_attack(
         self,
@@ -48,27 +81,56 @@ class IntruderAPI(ExportableAPI):
         on_progress=None,
         turbo_mode: bool = False,
     ) -> str:
+        """Run the attack to completion and return its attack_id.
+
+        NOTE: this method awaits the whole attack — it does NOT return as
+        soon as the attack starts. Before this fix it fired the attack via
+        `asyncio.create_task(...)` and returned immediately without
+        awaiting it, so a caller doing `await api.start_attack(...)` got
+        control back right after the attack merely started, not when it
+        finished — `get_results()` called right after would see a near-
+        empty/partial result set (see IntruderService.start_attack, which
+        relies on start_attack() having completed the attack before it
+        reads get_results() and emits IntruderFinished). The task handle is
+        still kept on self._task so stop()/pause()/resume() and callers
+        that want to cancel mid-attack (via self._task) keep working the
+        same way as before.
+        """
         if turbo_mode:
             # Turbo Mode: connection pooling + Keep-Alive
             from pentool.modules.intruder_turbo import TurboIntruderAttack
             self._attack = TurboIntruderAttack(config)
         else:
             # Standard mode
-            self._attack = IntruderAttack(config, db_path=self._db_path)
+            self._attack = IntruderAttack(config, db_path=self._db_path, http_client=self._http_client)
 
         _on_result = on_result if on_result else lambda r: None
         _on_progress = on_progress if on_progress else lambda d, t: None
 
         self._task = asyncio.create_task(self._attack.run(_on_result, _on_progress))
+        try:
+            await self._task
+        except asyncio.CancelledError:
+            pass
         return self._attack.attack_id if hasattr(self._attack, 'attack_id') else "turbo"
 
     async def pause(self) -> None:
-        if self._attack:
+        """Pause the running attack, if supported.
+
+        TurboIntruderAttack has no pause/resume — Turbo mode intentionally
+        runs to completion or stop() only (see modules/intruder_turbo.py).
+        Before this API method was actually reachable from IntruderScreen,
+        turbo_mode was silently never honored there (a pre-existing bug —
+        see MYPLANS/ARCHITECTURE_REFACTOR_PLAN_2026-08-09.md section 2.7),
+        so Pause/Resume during a real Turbo run was never exercised. Guard
+        with hasattr so enabling real Turbo mode doesn't crash Pause.
+        """
+        if self._attack and hasattr(self._attack, "pause"):
             await self._attack.pause()
 
     async def resume(self) -> None:
-        """Resume the attack after a pause."""
-        if self._attack:
+        """Resume the attack after a pause, if supported (see pause() note)."""
+        if self._attack and hasattr(self._attack, "resume"):
             await self._attack.resume()
 
     async def stop(self) -> None:
@@ -97,11 +159,24 @@ class IntruderAPI(ExportableAPI):
         return load_payloads_from_file(path)
 
     async def generate_numeric(self, start: int, end: int, step: int = 1) -> list[str]:
+        """Eager numeric generation — kept for backward compatibility.
+
+        Prefer constructing `NumericPayloadSource(start, end, step)` directly
+        for anything the UI will hold onto (see IntruderScreen._GenerateDialog),
+        since this materializes the whole range into a list immediately.
+        """
         return generate_numeric_payloads(start, end, step)
 
     async def generate_chars(
         self, charset: str, min_len: int, max_len: int
     ) -> list[str]:
+        """Eager charset brute-force generation — kept for backward
+        compatibility. Prefer constructing
+        `CharPayloadSource(charset, min_len, max_len)` directly — this
+        materializes every combination into a list immediately, which for
+        even a modest charset/length is a combinatorial explosion (see
+        CharPayloadSource's docstring).
+        """
         return generate_char_payloads(charset, min_len, max_len)
 
     def export_csv(self, path: str) -> None:
@@ -116,132 +191,52 @@ class IntruderAPI(ExportableAPI):
         template: str,
         attack_type: str,
         payloads: list[list[str]],
+        tab_uid: str = "",
     ) -> None:
         """Save Intruder tab state (template, attack type, payloads) to DB."""
-        if not self._db_path:
-            return
-        import json
-
-        from pentool.core.database import get_db
-
-        async with get_db(self._db_path) as db:
-            # Delete old state for this tab
-            await db.execute("DELETE FROM intruder_state WHERE tab_name = ?", (tab_name,))
-            # Insert new state
-            await db.execute(
-                """INSERT INTO intruder_state (tab_name, template, attack_type, payloads_json, updated_at)
-                   VALUES (?, ?, ?, ?, datetime('now'))""",
-                (tab_name, template, attack_type, json.dumps(payloads)),
-            )
-            await db.commit()
-
-    async def load_state(self, tab_name: str) -> dict | None:
+        await self._repo.save_state(tab_name, template, attack_type, payloads, tab_uid=tab_uid)
+
+    async def load_state(self, tab_name: str, tab_uid: str = "") -> dict | None:
         """Load Intruder tab state from DB."""
-        if not self._db_path:
-            return None
-        import json
-
-        from pentool.core.database import get_db
-
-        async with get_db(self._db_path) as db:
-            cursor = await db.execute(
-                "SELECT template, attack_type, payloads_json FROM intruder_state WHERE tab_name = ?",
-                (tab_name,),
-            )
-            row = await cursor.fetchone()
-            if not row:
-                return None
-            return {
-                "template": row[0],
-                "attack_type": row[1],
-                "payloads": json.loads(row[2]),
-            }
-
-    async def save_result(self, result: IntruderResult, project_id: int | None = None) -> None:
+        return await self._repo.load_state(tab_name, tab_uid=tab_uid)
+
+    async def get_tabs(self) -> list[dict]:
+        """List all Intruder tabs with saved state, most recently updated first."""
+        return await self._repo.get_tabs()
+
+    async def delete_tab(self, tab_uid: str) -> None:
+        """Delete a tab's saved state and results by its stable tab_uid."""
+        await self._repo.delete_tab(tab_uid)
+
+    async def switch_db(self, db_path: str) -> None:
+        """Point this API's repository at a different project DB file.
+
+        Lets IntruderScreen keep ONE persistent IntruderAPI/IntruderRepository
+        instance for the app's lifetime (mirrors ProxyService/HttpStorage)
+        instead of constructing a new one — and therefore a new SQLite
+        connection — on every single call. See BaseSqliteStorage.switch_db.
+        """
+        self._db_path = db_path
+        await self._repo.switch_db(db_path)
+
+    async def close(self) -> None:
+        """Close the underlying persistent SQLite connection, if open."""
+        await self._repo.close()
+
+    async def save_result(
+        self, result: IntruderResult, project_id: int | None = None, tab_uid: str = ""
+    ) -> None:
         """Save a single intruder result to DB."""
-        if not self._db_path:
-            return
-        import json
-
-        from pentool.core.database import get_db
-
-        async with get_db(self._db_path) as db:
-            await db.execute(
-                """INSERT INTO intruder_results
-                   (project_id, attack_id, request_number, payload_values, request_raw,
-                    response_raw, response_status, response_length, response_time_ms, error, timestamp)
-                   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
-                (
-                    project_id,
-                    result.attack_id,
-                    result.request_number,
-                    json.dumps(result.payload_values),
-                    result.request_raw,
-                    result.response_raw,
-                    result.response_status,
-                    result.response_length,
-                    result.response_time_ms,
-                    result.error,
-                    result.timestamp.isoformat(),
-                ),
-            )
-            await db.commit()
+        await self._repo.save_result(result, project_id, tab_uid=tab_uid)
 
     async def get_results_from_db(
         self,
         attack_id: str | None = None,
         limit: int = 1000,
+        tab_uid: str = "",
     ) -> list[IntruderResult]:
         """Load intruder results from DB."""
-        if not self._db_path:
-            return []
-        import json
-        from datetime import datetime, timezone
-
-        from pentool.core.database import get_db
-
-        async with get_db(self._db_path) as db:
-            if attack_id:
-                cursor = await db.execute(
-                    """SELECT id, attack_id, request_number, payload_values, request_raw,
-                              response_raw, response_status, response_length, response_time_ms, error, timestamp
-                       FROM intruder_results WHERE attack_id = ?
-                       ORDER BY request_number LIMIT ?""",
-                    (attack_id, limit),
-                )
-            else:
-                cursor = await db.execute(
-                    """SELECT id, attack_id, request_number, payload_values, request_raw,
-                              response_raw, response_status, response_length, response_time_ms, error, timestamp
-                       FROM intruder_results
-                       ORDER BY timestamp DESC LIMIT ?""",
-                    (limit,),
-                )
-            rows = await cursor.fetchall()
-            results = []
-            for row in rows:
-                try:
-                    ts = datetime.fromisoformat(row[10])
-                    if ts.tzinfo is None:
-                        ts = ts.replace(tzinfo=timezone.utc)
-                except Exception:
-                    ts = datetime.now(timezone.utc)
-                results.append(
-                    IntruderResult(
-                        id=str(row[0]),
-                        attack_id=row[1],
-                        request_number=row[2],
-                        payload_values=json.loads(row[3]) if row[3] else [],
-                        request_raw=row[4],
-                        response_raw=row[5],
-                        response_status=row[6],
-                        response_length=row[7],
-                        response_time_ms=row[8],
-                        error=row[9],
-                        timestamp=ts,
-                    )
-                )
-            return results
+        return await self._repo.get_results(attack_id, limit, tab_uid=tab_uid)
 
     # ── Project persistence ────────────────────────────────────────────────────
 

pentool-0.2.9/pentool/api/intruder_repository.py

@@ -0,0 +1,250 @@
+"""IntruderRepository — SQL for Intruder tab state and attack result persistence.
+
+Extracted from `IntruderAPI` (see
+MYPLANS/ARCHITECTURE_REFACTOR_PLAN_2026-08-09.md, section 2.6). Pure
+data-access: no attack orchestration knowledge, only the `intruder_state`/
+`intruder_results` table CRUD that used to live directly on `IntruderAPI`.
+Behavior (upsert-by-delete-then-insert for state, column selection/ordering
+for results) is unchanged from the original
+`IntruderAPI.save_state`/`load_state`/`save_result`/`get_results_from_db`.
+
+Mirrors the pattern already used for Scanner
+(`pentool.api.scanner_tab_repository.ScannerTabRepository`, pro/) — same
+extraction, applied to the one remaining API class that still wrote raw
+SQL directly (`ProxyAPI`/`RepeaterAPI` already delegate all SQL to
+`HttpStorage`/`Repeater` in modules/).
+
+Intruder became multi-tab (see IntruderScreen._TabState) — `tab_uid` is the
+new stable per-tab identity (mirrors Scanner's tab_uid), persisted/restored
+independently of the cosmetic, user-renameable `tab_name`. All `tab_uid`
+parameters below default to "" and fall back to the original tab_name-keyed
+behavior when omitted, so existing single-tab callers/tests are unaffected.
+
+Connection lifecycle: inherits `BaseSqliteStorage` (see
+pentool/storage/base_sqlite_storage.py) instead of opening/closing a fresh
+`aiosqlite` connection via `core.database.get_db()` on every call. That old
+per-call open/close pattern was the direct cause of a real crash — a fast
+Intruder attack calls `save_result()` per HTTP response (thousands/sec),
+each one opening+closing its own connection to the same file HttpStorage
+already holds open. Every public method here now calls
+`await self.ensure_open()` first, which connects once (lazily, on first
+use) and reuses that connection for the object's lifetime — the "safe
+no-op when db_path is falsy" contract (see TestNoDbPath in
+tests/unit/api/test_intruder_repository.py) is preserved because
+`ensure_open()` returns False when `self._db_path` is empty.
+"""
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+
+from pentool.modules.intruder import IntruderResult
+from pentool.storage.base_sqlite_storage import BaseSqliteStorage
+
+
+class IntruderRepository(BaseSqliteStorage):
+    """CRUD for `intruder_state` and `intruder_results`, scoped to one project DB."""
+
+    def __init__(self, db_path: str | None = None) -> None:
+        super().__init__(db_path=db_path)
+
+    async def save_state(
+        self,
+        tab_name: str,
+        template: str,
+        attack_type: str,
+        payloads: list[list[str]],
+        tab_uid: str = "",
+    ) -> None:
+        """Save Intruder tab state (template, attack type, payloads) to DB.
+
+        When `tab_uid` is given, upserts by that stable identity (matches
+        ScannerTabRepository.save_tab's rationale — tab_name alone can't
+        distinguish two same-named tabs across restarts). When omitted,
+        falls back to the original delete-by-tab_name-then-insert behavior
+        for backward compatibility with single-tab callers.
+        """
+        if not await self.ensure_open():
+            return
+
+        db = self._db
+        if tab_uid:
+            cursor = await db.execute(
+                "SELECT id FROM intruder_state WHERE tab_uid = ?", (tab_uid,)
+            )
+            row = await cursor.fetchone()
+            if row:
+                await db.execute(
+                    """UPDATE intruder_state SET tab_name = ?, template = ?,
+                       attack_type = ?, payloads_json = ?, updated_at = datetime('now')
+                       WHERE tab_uid = ?""",
+                    (tab_name, template, attack_type, json.dumps(payloads), tab_uid),
+                )
+            else:
+                await db.execute(
+                    """INSERT INTO intruder_state
+                       (tab_uid, tab_name, template, attack_type, payloads_json, updated_at)
+                       VALUES (?, ?, ?, ?, ?, datetime('now'))""",
+                    (tab_uid, tab_name, template, attack_type, json.dumps(payloads)),
+                )
+        else:
+            # Legacy path — delete-then-insert by tab_name. Restricted to
+            # rows with no tab_uid so it never clobbers a multi-tab
+            # caller's uid-keyed row that happens to share the same name.
+            await db.execute(
+                "DELETE FROM intruder_state WHERE tab_name = ? AND (tab_uid IS NULL OR tab_uid = '')",
+                (tab_name,),
+            )
+            await db.execute(
+                """INSERT INTO intruder_state (tab_name, template, attack_type, payloads_json, updated_at)
+                   VALUES (?, ?, ?, ?, datetime('now'))""",
+                (tab_name, template, attack_type, json.dumps(payloads)),
+            )
+        await db.commit()
+
+    async def load_state(self, tab_name: str, tab_uid: str = "") -> dict | None:
+        """Load Intruder tab state from DB — by tab_uid if given, else tab_name."""
+        if not await self.ensure_open():
+            return None
+
+        db = self._db
+        if tab_uid:
+            cursor = await db.execute(
+                "SELECT template, attack_type, payloads_json FROM intruder_state WHERE tab_uid = ?",
+                (tab_uid,),
+            )
+        else:
+            cursor = await db.execute(
+                "SELECT template, attack_type, payloads_json FROM intruder_state WHERE tab_name = ?",
+                (tab_name,),
+            )
+        row = await cursor.fetchone()
+        if not row:
+            return None
+        return {
+            "template": row[0],
+            "attack_type": row[1],
+            "payloads": json.loads(row[2]),
+        }
+
+    async def get_tabs(self) -> list[dict]:
+        """List all Intruder tabs that have saved state (tab_uid set), most
+        recently updated first — used to restore tabs on project load."""
+        if not await self.ensure_open():
+            return []
+
+        cursor = await self._db.execute(
+            "SELECT tab_uid, tab_name FROM intruder_state "
+            "WHERE tab_uid IS NOT NULL AND tab_uid != '' "
+            "ORDER BY updated_at DESC"
+        )
+        rows = await cursor.fetchall()
+        return [{"tab_uid": row[0], "tab_name": row[1]} for row in rows]
+
+    async def delete_tab(self, tab_uid: str) -> None:
+        """Delete a tab's saved state and results by its stable tab_uid."""
+        if not tab_uid or not await self.ensure_open():
+            return
+
+        db = self._db
+        await db.execute("DELETE FROM intruder_state WHERE tab_uid = ?", (tab_uid,))
+        await db.execute("DELETE FROM intruder_results WHERE tab_uid = ?", (tab_uid,))
+        await db.commit()
+
+    async def save_result(
+        self,
+        result: IntruderResult,
+        project_id: int | None = None,
+        tab_uid: str = "",
+    ) -> None:
+        """Save a single intruder result to DB."""
+        if not await self.ensure_open():
+            return
+
+        await self._db.execute(
+            """INSERT INTO intruder_results
+               (project_id, attack_id, request_number, payload_values, request_raw,
+                response_raw, response_status, response_length, response_time_ms, error, timestamp, tab_uid)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+            (
+                project_id,
+                result.attack_id,
+                result.request_number,
+                json.dumps(result.payload_values),
+                result.request_raw,
+                result.response_raw,
+                result.response_status,
+                result.response_length,
+                result.response_time_ms,
+                result.error,
+                result.timestamp.isoformat(),
+                tab_uid,
+            ),
+        )
+        await self._db.commit()
+
+    async def get_results(
+        self,
+        attack_id: str | None = None,
+        limit: int = 1000,
+        tab_uid: str = "",
+    ) -> list[IntruderResult]:
+        """Load intruder results from DB.
+
+        Filters by attack_id if given, else by tab_uid if given (all results
+        across every attack ever run in that tab), else returns the most
+        recent `limit` results overall (legacy single-tab behavior).
+        """
+        if not await self.ensure_open():
+            return []
+
+        db = self._db
+        if attack_id:
+            cursor = await db.execute(
+                """SELECT id, attack_id, request_number, payload_values, request_raw,
+                          response_raw, response_status, response_length, response_time_ms, error, timestamp
+                   FROM intruder_results WHERE attack_id = ?
+                   ORDER BY request_number LIMIT ?""",
+                (attack_id, limit),
+            )
+        elif tab_uid:
+            cursor = await db.execute(
+                """SELECT id, attack_id, request_number, payload_values, request_raw,
+                          response_raw, response_status, response_length, response_time_ms, error, timestamp
+                   FROM intruder_results WHERE tab_uid = ?
+                   ORDER BY timestamp DESC LIMIT ?""",
+                (tab_uid, limit),
+            )
+        else:
+            cursor = await db.execute(
+                """SELECT id, attack_id, request_number, payload_values, request_raw,
+                          response_raw, response_status, response_length, response_time_ms, error, timestamp
+                   FROM intruder_results
+                   ORDER BY timestamp DESC LIMIT ?""",
+                (limit,),
+            )
+        rows = await cursor.fetchall()
+        results = []
+        for row in rows:
+            try:
+                ts = datetime.fromisoformat(row[10])
+                if ts.tzinfo is None:
+                    ts = ts.replace(tzinfo=timezone.utc)
+            except Exception:
+                ts = datetime.now(timezone.utc)
+            results.append(
+                IntruderResult(
+                    id=str(row[0]),
+                    attack_id=row[1],
+                    request_number=row[2],
+                    payload_values=json.loads(row[3]) if row[3] else [],
+                    request_raw=row[4],
+                    response_raw=row[5],
+                    response_status=row[6],
+                    response_length=row[7],
+                    response_time_ms=row[8],
+                    error=row[9],
+                    timestamp=ts,
+                )
+            )
+        return results