rimscan-cli 1.0.0__py3-none-any.whl

rimscan_cli/recon/takeover.py

@@ -0,0 +1,302 @@
+"""Subdomain takeover detection using the can-i-take-over-xyz fingerprint database."""
+
+from __future__ import annotations
+
+import html
+import ipaddress
+import json
+import re
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import List, Optional, Pattern, Sequence, Tuple, Union
+
+import requests
+
+from rimscan_cli.recon._common import all_public
+from rimscan_cli.recon._http import make_session, read_capped
+from rimscan_cli.recon.resolver import ResolutionResult, ResolutionStatus
+
+__all__ = [
+    "DEFAULT_FINGERPRINTS_PATH",
+    "TakeoverVerdict",
+    "TakeoverFinding",
+    "Fingerprint",
+    "FingerprintDatabase",
+    "TakeoverDetector",
+]
+
+DEFAULT_FINGERPRINTS_PATH = Path(__file__).resolve().parents[1] / "data" / "fingerprints.json"
+_MAX_BODY_BYTES = 256 * 1024
+
+# The bundled upstream list leaves `cname` empty for many takeover-prone services, and
+# matching is by CNAME suffix, so those services could never be detected. These suffixes
+# are added to the upstream ones (matched by the entry's `service` name). Services that
+# are not identified by a CNAME at all (Digital Ocean NS delegation, for one) stay out.
+_SUPPLEMENTAL_CNAMES = {
+    "Campaign Monitor": ("createsend.com",),
+    "Canny": ("canny.io",),
+    "Cargo Collective": ("cargocollective.com",),
+    "Pantheon": ("pantheonsite.io",),
+    "Pingdom": ("stats.pingdom.com",),
+    "Readthedocs": ("readthedocs.io",),
+    "Short.io": ("short.io",),
+}
+
+# Hosting platforms whose servers belong to someone else. Many of them have an empty
+# `cname` list in the upstream fingerprints (GitHub Pages, Heroku, Netlify, Shopify, ...),
+# so matching by fingerprint alone would miss them when deciding what is safe to probe.
+_HOSTING_PLATFORMS = (
+    "github.io", "githubusercontent.com", "gitlab.io", "bitbucket.io",
+    "herokuapp.com", "herokudns.com", "herokussl.com",
+    "netlify.app", "netlify.com", "netlifyglobalcdn.com",
+    "myshopify.com", "shopify.com", "shopifycloud.com",
+    "vercel.app", "vercel-dns.com", "pages.dev", "workers.dev", "fly.dev", "onrender.com",
+    "surge.sh", "ghost.io", "wpengine.com", "wpenginepowered.com",
+    "squarespace.com", "wixdns.net", "webflow.io", "tumblr.com", "wordpress.com",
+    "cloudfront.net", "amazonaws.com", "elasticbeanstalk.com",
+    "azurewebsites.net", "azureedge.net", "trafficmanager.net", "cloudapp.azure.com",
+    "zendesk.com", "hubspot.net", "readthedocs.io", "unbouncepages.com",
+)
+
+
+class TakeoverVerdict(Enum):
+    VULNERABLE = "vulnerable"
+    LIKELY = "likely"
+    NOT_VULNERABLE = "not_vulnerable"
+    UNKNOWN_SERVICE = "unknown_service"
+
+
+@dataclass
+class TakeoverFinding:
+    hostname: str
+    verdict: TakeoverVerdict
+    service: Optional[str] = None
+    cname_chain: List[str] = field(default_factory=list)
+    evidence: str = ""
+
+
+@dataclass(frozen=True)
+class Fingerprint:
+    service: str
+    cnames: Tuple[str, ...]
+    vulnerable: bool
+    nxdomain: bool
+    pattern: Optional[Pattern[str]]
+    http_status: Optional[int]
+
+    @classmethod
+    def from_entry(cls, entry: dict) -> "Fingerprint":
+        text = (entry.get("fingerprint") or "").strip()
+        status = entry.get("http_status")
+        if text.startswith("HTTP_STATUS="):
+            status, text = int(text.split("=", 1)[1]), ""
+        service = entry.get("service", "unknown")
+        cnames = _usable_cnames(entry.get("cname") or []) + list(_SUPPLEMENTAL_CNAMES.get(service, ()))
+        return cls(
+            service=service,
+            cnames=tuple(dict.fromkeys(cnames)),
+            vulnerable=bool(entry.get("vulnerable")),
+            nxdomain=bool(entry.get("nxdomain")),
+            pattern=_compile_fingerprint(text),
+            http_status=status,
+        )
+
+    def matches_body(self, body: str) -> bool:
+        """True if the page text matches. Tried on the raw HTML and on its entity-decoded form.
+
+        The pattern is built from the entity-decoded fingerprint (``’`` becomes a
+        curly apostrophe), but a real page often carries the entity itself in its source.
+        """
+        if self.pattern is None:
+            return False
+        return self.pattern.search(body) is not None or self.pattern.search(html.unescape(body)) is not None
+
+
+def _usable_cnames(values) -> List[str]:
+    """Keep real domain suffixes; the upstream list also contains URLs and bare IPs."""
+    usable = []
+    for value in values:
+        value = value.lower().strip().lstrip(".")
+        if not value or "/" in value or ":" in value:
+            continue
+        try:
+            ipaddress.ip_address(value)
+        except ValueError:
+            usable.append(value)
+    return usable
+
+
+def _compile_fingerprint(text: str) -> Optional[Pattern[str]]:
+    """Turn an upstream fingerprint string into a case-insensitive pattern.
+
+    Upstream mixes literal text with regex (`.*`), markdown-escaped pipes (`|`),
+    HTML entities, and two alternative phrases joined by "` `".
+    """
+    if not text or text == "NXDOMAIN":
+        return None
+    parts = []
+    for alternative in text.split("` `"):
+        alternative = html.unescape(alternative.replace("|", "|")).strip()
+        if not alternative:
+            continue
+        looks_like_regex = any(token in alternative for token in (".*", "\\", "|"))
+        parts.append(alternative if looks_like_regex else re.escape(alternative))
+    try:
+        return re.compile("|".join(parts), re.IGNORECASE)
+    except re.error:
+        return re.compile(re.escape(text), re.IGNORECASE)
+
+
+class FingerprintDatabase:
+    def __init__(self, path: Union[str, Path, None] = None):
+        source = Path(path) if path else DEFAULT_FINGERPRINTS_PATH
+        entries = json.loads(source.read_text(encoding="utf-8"))
+        self.fingerprints = [Fingerprint.from_entry(entry) for entry in entries]
+        self._suffixes: List[Tuple[str, Fingerprint]] = sorted(
+            ((cname, fp) for fp in self.fingerprints for cname in fp.cnames),
+            key=lambda pair: len(pair[0]),
+            reverse=True,
+        )
+
+    def match(self, hostname: str) -> Optional[Fingerprint]:
+        hostname = hostname.lower().rstrip(".")
+        for suffix, fp in self._suffixes:
+            if hostname == suffix or hostname.endswith("." + suffix):
+                return fp
+        return None
+
+    def is_third_party(self, hostname: str) -> bool:
+        """True if `hostname` belongs to a service that is not the scan target's own.
+
+        Covers every fingerprint entry (vulnerable or not) and the built-in list of hosting
+        platforms, including those whose upstream entry has no CNAME suffix.
+        """
+        name = hostname.lower().rstrip(".")
+        if self.match(name) is not None:
+            return True
+        return any(name == suffix or name.endswith("." + suffix) for suffix in _HOSTING_PLATFORMS)
+
+
+class TakeoverDetector:
+    """Flag CNAMEs that point at third-party services with an unclaimed resource.
+
+    Only hosts whose CNAME chain matches a known service are checked. Each such host
+    receives at most one HTTPS and one HTTP GET request: the session does not retry and
+    redirects are not followed, so the response is the host's own. Hosts that resolve to
+    a non-public address are never contacted.
+    """
+
+    def __init__(self, database: FingerprintDatabase, timeout: float = 10.0, max_workers: int = 8):
+        self.db = database
+        self.timeout = timeout
+        self.max_workers = max_workers
+        self._session = make_session(retries=0)
+
+    def check_many(self, results: Sequence[ResolutionResult]) -> List[Optional[TakeoverFinding]]:
+        """Check hosts concurrently; findings follow the order of `results`."""
+        if not results:
+            return []
+        with ThreadPoolExecutor(max_workers=min(self.max_workers, len(results))) as pool:
+            return list(pool.map(self.check, results))
+
+    def check(self, result: ResolutionResult) -> Optional[TakeoverFinding]:
+        chain = result.cname_chain
+        if result.status not in (ResolutionStatus.CNAME, ResolutionStatus.DANGLING_CNAME) or not chain:
+            return None
+        dangling = result.status is ResolutionStatus.DANGLING_CNAME
+
+        matched = next(
+            ((hop, fp) for hop in reversed(chain) if (fp := self.db.match(hop)) is not None), None
+        )
+        if matched is None:
+            if dangling:
+                return self._finding(
+                    result, TakeoverVerdict.LIKELY, None,
+                    "dangling CNAME: the target does not exist and is not a known service",
+                )
+            return None
+        hop, fp = matched
+
+        if not fp.vulnerable:
+            return self._finding(
+                result, TakeoverVerdict.NOT_VULNERABLE, fp.service,
+                f"matched {fp.service}, which is not takeover-prone",
+            )
+        if fp.nxdomain:
+            if dangling:
+                return self._finding(
+                    result, TakeoverVerdict.VULNERABLE, fp.service,
+                    f"CNAME target {hop} does not resolve and {fp.service} allows claiming it",
+                )
+            return self._finding(
+                result, TakeoverVerdict.NOT_VULNERABLE, fp.service,
+                f"{fp.service} target {hop} still resolves",
+            )
+        if dangling:
+            return self._finding(
+                result, TakeoverVerdict.LIKELY, fp.service,
+                f"CNAME target {hop} does not resolve; {fp.service} is takeover-prone",
+            )
+        if fp.pattern is None and fp.http_status is None:
+            return self._finding(
+                result, TakeoverVerdict.LIKELY, fp.service,
+                f"points at takeover-prone {fp.service}; no automatic fingerprint, verify manually",
+            )
+        if result.a_records and not all_public(result.a_records):
+            return self._finding(
+                result, TakeoverVerdict.UNKNOWN_SERVICE, fp.service,
+                "resolves to a non-public address; not probed",
+            )
+        return self._check_http(result, fp)
+
+    def _check_http(self, result: ResolutionResult, fp: Fingerprint) -> TakeoverFinding:
+        response = self._fetch(result.hostname)
+        if response is None:
+            return self._finding(
+                result, TakeoverVerdict.UNKNOWN_SERVICE, fp.service,
+                "could not reach the host over HTTP or HTTPS",
+            )
+        status, body = response
+        body_match = fp.matches_body(body)
+        status_match = fp.http_status is None or status == fp.http_status
+
+        if fp.pattern is not None and body_match and status_match:
+            return self._finding(
+                result, TakeoverVerdict.VULNERABLE, fp.service,
+                f"HTTP {status} body matches the {fp.service} unclaimed-resource page",
+            )
+        if fp.pattern is not None and body_match:
+            return self._finding(
+                result, TakeoverVerdict.LIKELY, fp.service,
+                f"{fp.service} page text matched but HTTP {status} != expected {fp.http_status}",
+            )
+        if fp.pattern is None and status_match:
+            return self._finding(
+                result, TakeoverVerdict.LIKELY, fp.service,
+                f"{fp.service} returned the status ({status}) used as its takeover signal",
+            )
+        return self._finding(
+            result, TakeoverVerdict.NOT_VULNERABLE, fp.service,
+            f"{fp.service} host responded (HTTP {status}) without the unclaimed-resource page",
+        )
+
+    def _fetch(self, hostname: str) -> Optional[Tuple[int, str]]:
+        # Redirects are not followed: status-only fingerprints (e.g. an expected 301) would
+        # otherwise never match, and we would read pages from hosts outside the target.
+        for scheme in ("https", "http"):
+            try:
+                response = self._session.get(
+                    f"{scheme}://{hostname}", timeout=self.timeout, stream=True, allow_redirects=False
+                )
+                return response.status_code, read_capped(response, _MAX_BODY_BYTES)
+            except requests.RequestException:
+                continue
+        return None
+
+    @staticmethod
+    def _finding(
+        result: ResolutionResult, verdict: TakeoverVerdict, service: Optional[str], evidence: str
+    ) -> TakeoverFinding:
+        return TakeoverFinding(result.hostname, verdict, service, list(result.cname_chain), evidence)

rimscan_cli/scanner.py

@@ -0,0 +1,305 @@
+"""Scan orchestration: enumerate, resolve and audit a domain. The CLI is a thin layer over this."""
+
+from __future__ import annotations
+
+import ipaddress
+import json
+import logging
+import shutil
+import subprocess
+import tempfile
+from dataclasses import fields, is_dataclass
+from datetime import datetime, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence
+
+from rimscan_cli import __version__
+from rimscan_cli.recon._common import all_public, normalize_domain
+from rimscan_cli.recon.cert_audit import MAX_HOSTS as MAX_CERT_HOSTS
+from rimscan_cli.recon.cert_audit import CertAuditor
+from rimscan_cli.recon.dns_audit import DNSAuditor
+from rimscan_cli.recon.enumeration import DEFAULT_SOURCES, SubdomainEnumerator
+from rimscan_cli.recon.resolver import DNSResolver, ResolutionStatus
+from rimscan_cli.recon.secret_scan import MAX_HOSTS as MAX_SECRET_HOSTS
+from rimscan_cli.recon.secret_scan import SecretScanner
+from rimscan_cli.recon.takeover import FingerprintDatabase, TakeoverDetector, TakeoverVerdict
+
+logger = logging.getLogger(__name__)
+
+SCHEMA_VERSION = 1
+NUCLEI_EXCLUDED_TAGS = ("dos", "fuzz", "intrusive")
+SEVERITY_RANK = {"info": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}
+# When at least this share of lookups time out or error, "no findings" cannot be trusted.
+RESOLUTION_FAILURE_THRESHOLD = 0.5
+_TAKEOVER_SEVERITY = {
+    TakeoverVerdict.VULNERABLE.value: "high",
+    TakeoverVerdict.LIKELY.value: "medium",
+    TakeoverVerdict.UNKNOWN_SERVICE.value: "info",
+}
+
+Progress = Callable[[str], None]
+
+
+class InvalidArguments(Exception):
+    """The caller passed arguments that cannot be used (reported as a usage error)."""
+
+
+class AuthorizationError(InvalidArguments):
+    """An option that probes the target was requested without --authorized."""
+
+
+def to_jsonable(value: Any) -> Any:
+    if isinstance(value, Enum):
+        return value.value
+    if hasattr(value, "to_dict"):
+        return value.to_dict()
+    if is_dataclass(value) and not isinstance(value, type):
+        return {f.name: to_jsonable(getattr(value, f.name)) for f in fields(value)}
+    if isinstance(value, (list, tuple, set)):
+        return [to_jsonable(item) for item in value]
+    if isinstance(value, dict):
+        return {key: to_jsonable(item) for key, item in value.items()}
+    return value
+
+
+def _parse_nuclei_output(text: str) -> List[Dict[str, Any]]:
+    findings = []
+    for line in text.splitlines():
+        try:
+            raw = json.loads(line)
+        except ValueError:
+            continue
+        info = raw.get("info", {})
+        findings.append({
+            "template_id": raw.get("template-id"),
+            "name": info.get("name"),
+            "severity": info.get("severity", "info"),
+            "host": raw.get("host"),
+            "matched_at": raw.get("matched-at"),
+            "tags": info.get("tags", []),
+            "cve": (info.get("classification") or {}).get("cve-id") or [],
+        })
+    return findings
+
+
+def run_nuclei(hosts: Iterable[str], *, rate_limit: int = 75, timeout: float = 1800.0) -> Dict[str, Any]:
+    """Run Nuclei against `hosts` with dos, fuzz and intrusive templates excluded."""
+    binary = shutil.which("nuclei")
+    if not binary:
+        return {"status": "skipped", "reason": "nuclei executable not found in PATH"}
+    host_list = list(dict.fromkeys(hosts))
+    if not host_list:
+        return {"status": "skipped", "reason": "no live hosts"}
+
+    with tempfile.TemporaryDirectory(prefix="rimscan-cli-") as temp_dir:
+        targets = Path(temp_dir) / "targets.txt"
+        targets.write_text("\n".join(host_list) + "\n", encoding="utf-8")
+        command = [
+            binary, "-list", str(targets),
+            "-etags", ",".join(NUCLEI_EXCLUDED_TAGS),
+            "-rate-limit", str(rate_limit),
+            "-jsonl", "-silent", "-no-color", "-disable-update-check",
+        ]
+        try:
+            completed = subprocess.run(command, capture_output=True, text=True, timeout=timeout, check=False)
+        except subprocess.TimeoutExpired as exc:
+            partial = exc.stdout.decode("utf-8", "replace") if isinstance(exc.stdout, bytes) else (exc.stdout or "")
+            return {"status": "timeout", "timeout_seconds": timeout, "findings": _parse_nuclei_output(partial)}
+
+    result: Dict[str, Any] = {
+        "status": "completed" if completed.returncode == 0 else "failed",
+        "returncode": completed.returncode,
+        "findings": _parse_nuclei_output(completed.stdout),
+    }
+    if completed.returncode != 0:
+        result["stderr"] = completed.stderr[-500:]
+    return result
+
+
+def _validate(
+    domain: str,
+    *,
+    authorized: bool,
+    include_zone_transfer: bool,
+    include_secrets: bool,
+    include_nuclei: bool,
+    sources: Optional[Sequence[str]],
+    nameservers: Optional[Sequence[str]],
+) -> str:
+    """Return the normalized domain, or raise InvalidArguments / AuthorizationError."""
+    try:
+        domain = normalize_domain(domain)
+    except ValueError as exc:
+        raise InvalidArguments(str(exc)) from None
+    for flag, enabled in (
+        ("--secrets", include_secrets),
+        ("--nuclei", include_nuclei),
+        ("--zone-transfer", include_zone_transfer),
+    ):
+        if enabled and not authorized:
+            raise AuthorizationError(f"{flag} sends probes to the target's own servers and requires --authorized")
+    unknown = [name for name in sources or () if name not in DEFAULT_SOURCES]
+    if unknown:
+        raise InvalidArguments(f"unknown source(s): {', '.join(unknown)} (choose from {', '.join(DEFAULT_SOURCES)})")
+    for address in nameservers or ():
+        try:
+            ipaddress.ip_address(address)
+        except ValueError as exc:
+            raise InvalidArguments(str(exc)) from None
+    return domain
+
+
+def scan_domain(
+    domain: str,
+    *,
+    authorized: bool = False,
+    include_zone_transfer: bool = False,
+    include_secrets: bool = False,
+    include_certs: bool = True,
+    include_nuclei: bool = False,
+    include_third_party: bool = False,
+    bruteforce: bool = False,
+    sources: Optional[Sequence[str]] = None,
+    timeout: float = 10.0,
+    nameservers: Optional[Sequence[str]] = None,
+    nuclei_rate_limit: int = 75,
+    progress: Progress = lambda message: None,
+) -> Dict[str, Any]:
+    """Run a standalone scan and return a JSON-serializable result.
+
+    Raises InvalidArguments (AuthorizationError for a missing --authorized) before any
+    network activity if the arguments are unusable.
+
+    `nameservers` applies to DNS lookups only; TLS and HTTP probes use the system resolver.
+    Hosts that resolve to a non-public address are never probed. With `include_secrets` or
+    `include_nuclei`, hosts that CNAME to a known third-party service are skipped unless
+    `include_third_party` is set, because those servers belong to someone else.
+    """
+    domain = _validate(
+        domain,
+        authorized=authorized,
+        include_zone_transfer=include_zone_transfer,
+        include_secrets=include_secrets,
+        include_nuclei=include_nuclei,
+        sources=sources,
+        nameservers=nameservers,
+    )
+    warnings: List[str] = []
+    incomplete = False
+
+    progress(f"enumerating subdomains of {domain}")
+    # Repeated names are dropped so each source is queried, reported and warned about once.
+    chosen_sources = list(dict.fromkeys(sources)) if sources else list(DEFAULT_SOURCES)
+    enumerator = SubdomainEnumerator(domain, timeout=timeout)
+    subdomains = enumerator.run(
+        chosen_sources,
+        on_source_done=lambda name, count, status: progress(f"  {name}: {count} found ({status})"),
+    )
+    failed_sources = [name for name in chosen_sources if enumerator.source_status.get(name) != "ok"]
+    if failed_sources and len(failed_sources) == len(chosen_sources):
+        warnings.append("every enumeration source failed or timed out; the subdomain list is not reliable")
+        incomplete = not bruteforce
+    elif failed_sources:
+        warnings.append(f"enumeration sources failed or timed out: {', '.join(failed_sources)}")
+
+    resolver = DNSResolver(timeout=min(timeout, 5.0), nameservers=nameservers)
+    wildcard = resolver.detect_wildcard(domain)
+    if wildcard:
+        progress("wildcard DNS detected; wildcard answers are filtered out")
+    if bruteforce:
+        progress("brute-forcing common subdomain names")
+        subdomains |= enumerator.from_bruteforce(resolver)
+
+    hosts = sorted({domain, *subdomains})
+    progress(f"resolving {len(hosts)} hosts")
+    resolutions = resolver.resolve_many(hosts)
+    failed = [r for r in resolutions if r.status in (ResolutionStatus.TIMEOUT, ResolutionStatus.ERROR)]
+    if failed:
+        warnings.append(f"DNS resolution failed (timeout or error) for {len(failed)} of {len(resolutions)} hosts")
+        if len(failed) >= RESOLUTION_FAILURE_THRESHOLD * len(resolutions):
+            incomplete = True
+    live = [r for r in resolutions if r.is_live]
+    public_hosts = [r.hostname for r in live if all_public(r.a_records)]
+    non_public = [r.hostname for r in live if not all_public(r.a_records)]
+    if non_public:
+        progress(f"{len(non_public)} host(s) resolve to non-public addresses and will not be probed")
+
+    progress("checking for subdomain takeovers")
+    database = FingerprintDatabase()
+    detector = TakeoverDetector(database, timeout=timeout)
+    takeovers = [f for f in detector.check_many(resolutions) if f is not None and f.verdict is not TakeoverVerdict.NOT_VULNERABLE]
+
+    progress("auditing DNS records")
+    auditor = DNSAuditor(timeout=min(timeout, 5.0), nameservers=nameservers)
+    dns_findings = auditor.audit(domain, include_zone_transfer=include_zone_transfer)
+    if auditor.errors:
+        warnings.append(f"DNS audit incomplete: {'; '.join(auditor.errors)}")
+        incomplete = True
+
+    result: Dict[str, Any] = {
+        "schema_version": SCHEMA_VERSION,
+        "tool": {"name": "rimscan-cli", "version": __version__},
+        "scanned_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+        "domain": domain,
+        "wildcard_dns": wildcard,
+        "wildcard_filtered": sum(1 for r in resolutions if r.status is ResolutionStatus.WILDCARD),
+        "sources": dict(enumerator.source_status),
+        "subdomains": sorted(subdomains),
+        "resolutions": resolutions,
+        "takeover_findings": takeovers,
+        "dns_findings": dns_findings,
+    }
+    if include_certs:
+        progress(f"auditing TLS certificates on {len(public_hosts)} live hosts")
+        if len(public_hosts) > MAX_CERT_HOSTS:
+            warnings.append(
+                f"TLS audit limited to {MAX_CERT_HOSTS} of {len(public_hosts)} live hosts; the rest were not checked"
+            )
+        result["certificate_findings"] = CertAuditor(timeout=timeout).audit_many(public_hosts)
+
+    if include_secrets or include_nuclei:
+        third_party = {
+            r.hostname for r in resolutions if any(database.is_third_party(hop) for hop in r.cname_chain)
+        }
+        active_hosts = public_hosts if include_third_party else [h for h in public_hosts if h not in third_party]
+        skipped_third_party = [h for h in public_hosts if h not in active_hosts]
+        if skipped_third_party:
+            progress(
+                f"skipping {len(skipped_third_party)} host(s) that CNAME to third-party services "
+                "(use --include-third-party to probe them)"
+            )
+        result["active_targets"] = active_hosts
+        result["skipped_hosts"] = {"non_public": non_public, "third_party": skipped_third_party}
+        if include_secrets:
+            progress(f"scanning well-known paths on {len(active_hosts)} hosts for exposed secrets")
+            if len(active_hosts) > MAX_SECRET_HOSTS:
+                warnings.append(
+                    f"secret scan limited to {MAX_SECRET_HOSTS} of {len(active_hosts)} hosts; the rest were not checked"
+                )
+            result["secret_findings"] = SecretScanner(timeout=(min(timeout, 5.0), timeout)).scan_domain(active_hosts)
+        if include_nuclei:
+            progress("running nuclei")
+            result["nuclei"] = run_nuclei(active_hosts, rate_limit=nuclei_rate_limit)
+
+    result["warnings"] = warnings
+    result["incomplete"] = incomplete
+    return to_jsonable(result)
+
+
+def severity_counts(result: Dict[str, Any]) -> Dict[str, int]:
+    counts: Dict[str, int] = {}
+
+    def add(level: str) -> None:
+        counts[level] = counts.get(level, 0) + 1
+
+    for finding in result.get("takeover_findings", []):
+        add(_TAKEOVER_SEVERITY.get(finding["verdict"], "info"))
+    for key in ("dns_findings", "certificate_findings"):
+        for finding in result.get(key, []):
+            add(finding["severity"])
+    for _ in result.get("secret_findings", []):
+        add("high")
+    for finding in result.get("nuclei", {}).get("findings", []):
+        add(finding["severity"] if finding["severity"] in SEVERITY_RANK else "info")
+    return counts