souleyez 2.43.34__py3-none-any.whl → 3.0.7__py3-none-any.whl

souleyez/core/tool_chaining.py

@@ -4,12 +4,12 @@ souleyez.core.tool_chaining - Intelligent tool chaining and workflow automation
 
 Automatically triggers follow-up scans based on discovered services and findings.
 """
-from typing import List, Dict, Any, Optional
+
 from dataclasses import dataclass, field
 from datetime import datetime
+from typing import Any, Dict, List, Optional
 from urllib.parse import urlparse
 
-
 # Category constants for chain rules
 CATEGORY_CTF = "ctf"  # Lab/learning scenarios - vulnerable by design
 CATEGORY_ENTERPRISE = "enterprise"  # Real-world enterprise testing
@@ -58,7 +58,8 @@ CATEGORY_ICONS = {
 SERVICE_GROUPS = {
     "http": {
         "services": ["http", "https", "http-alt", "http-proxy", "https-alt"],
-        "ports": [80, 443, 8080, 8000, 8443, 3000, 5000, 8888, 9000, 9090],
+        # Port 11434 is Ollama API - runs HTTP but nmap often identifies as "unknown"
+        "ports": [80, 443, 8080, 8000, 8443, 3000, 5000, 8888, 9000, 9090, 11434],
     },
     "smb": {
         "services": ["microsoft-ds", "netbios-ssn", "smb"],
@@ -113,6 +114,103 @@ SERVICE_GROUPS = {
 }
 
 
+def should_test_url_for_sqli(endpoint_url: str) -> bool:
+    """
+    Determine if a URL should be tested for SQL injection.
+
+    This filters out URLs that are unlikely to have injectable parameters,
+    while allowing URLs that might have forms or query parameters.
+
+    Args:
+        endpoint_url: The URL to evaluate
+
+    Returns:
+        True if the URL should be tested, False if it should be skipped
+
+    Examples:
+        >>> should_test_url_for_sqli("http://example.com/payroll_app.php")
+        True  # Dynamic page, might have forms
+        >>> should_test_url_for_sqli("http://example.com/index.php")
+        False  # Common default page, rarely injectable
+        >>> should_test_url_for_sqli("http://example.com/search.php?q=test")
+        True  # Has query parameters
+        >>> should_test_url_for_sqli("http://example.com/phpinfo.php")
+        False  # phpinfo output, not injectable
+        >>> should_test_url_for_sqli("http://example.com/cgi-bin/")
+        False  # Directory, not a script
+        >>> should_test_url_for_sqli("http://example.com/")
+        False  # No path, no params
+    """
+    from urllib.parse import urlparse
+
+    path_lower = endpoint_url.lower()
+    has_params = "?" in endpoint_url
+
+    # URLs with query params should generally be tested - they have injection points
+    # But still skip known non-injectable apps even with params
+    if has_params:
+        # Even with params, skip known non-injectable applications
+        hard_skip = [
+            "/phpmyadmin/",  # phpMyAdmin - DB admin tool, not a target
+            "/phpmyadmin?",  # phpMyAdmin with params
+        ]
+        if any(pattern in path_lower for pattern in hard_skip):
+            return False
+        # Skip static files with version/cache-busting params
+        # These are not injectable: /jquery.js?v=1.2.3, /style.css?ver=5.0
+        if ".js?" in path_lower or ".css?" in path_lower:
+            return False
+        # Has params and not in hard skip - test it
+        return True
+
+    # No query params - apply stricter filtering
+    # Skip known non-injectable paths (only when no params)
+    skip_patterns = [
+        "/twiki/",  # TWiki wiki - not SQLi vulnerable
+        "/phpmyadmin/",  # phpMyAdmin - DB admin, not SQLi target
+        "/phpmyadmin.",  # phpMyAdmin CSS/JS files
+        "/phpinfo",  # phpinfo() output - no injection
+        "/cgi-bin/",  # Base CGI dir without script - no injection
+        "/misc/",  # Drupal/CMS static assets directory
+        "/modules/",  # Drupal modules directory (static files)
+    ]
+    if any(pattern in path_lower for pattern in skip_patterns):
+        return False
+
+    # No params - require dynamic extension that might have forms
+    dynamic_extensions = (".php", ".asp", ".aspx", ".jsp", ".do", ".action", ".cgi")
+    is_dynamic = any(path_lower.endswith(ext) for ext in dynamic_extensions)
+
+    if not is_dynamic:
+        # No params and not a dynamic page - skip
+        return False
+
+    # Skip common default/utility pages that rarely have injectable forms
+    useless_dynamic_pages = [
+        "/index.php",
+        "/index.asp",
+        "/index.aspx",
+        "/index.jsp",
+        "/default.php",
+        "/default.asp",
+        "/default.aspx",
+        "/home.php",
+        "/home.asp",
+        "/info.php",
+        "/test.php",
+    ]
+    if not has_params:
+        # Only check this list for pages without params
+        try:
+            parsed = urlparse(endpoint_url)
+            if parsed.path.lower() in useless_dynamic_pages:
+                return False
+        except Exception:
+            pass
+
+    return True
+
+
 def classify_os_device(os_string: str, services: list) -> dict:
     """
     Classify OS and device type from nmap output.
@@ -271,8 +369,8 @@ def get_managed_hosting_platform(
 # These patterns identify URLs/paths that should be skipped for specific tools
 # to reduce noise and wasted scans.
 
-import re
 import logging
+import re
 
 logger = logging.getLogger(__name__)
 
@@ -777,9 +875,9 @@ class ChainRule:
                 # Check product version (e.g., 'version:nginx:<1.19', 'version:apache:>=2.4.49,<=2.4.50')
                 # cond_value format: 'product:version_conditions'
                 from souleyez.core.version_utils import (
-                    parse_version_spec,
                     matches_version,
                     normalize_product_name,
+                    parse_version_spec,
                 )
 
                 target_product, version_conditions = parse_version_spec(cond_value)
@@ -916,7 +1014,7 @@ class ChainRule:
             # For has:services condition, extract port from the services array
             # Prioritize HTTP services for web tools (gobuster, nuclei, etc.)
             services = context.get("services", [])
-            http_ports = {80, 443, 8080, 8443, 8000, 8888, 3000, 5000}
+            http_ports = {80, 443, 8080, 8443, 8000, 8888, 3000, 5000, 11434}
 
             # First pass: look for HTTP service by name or common HTTP ports
             for svc in services:
@@ -1502,23 +1600,15 @@ class ToolChaining:
                     ],
                     description="WordPress detected, scanning for vulnerabilities with WPScan",
                 ),
-                # phpMyAdmin → SQLMap (common SQLi target)
-                ChainRule(
-                    trigger_tool="gobuster",
-                    trigger_condition="finding:phpmyadmin",
-                    target_tool="sqlmap",
-                    priority=8,
-                    args_template=[
-                        "-u",
-                        "{target}",
-                        "--batch",
-                        "--forms",
-                        "--level=2",
-                        "--risk=2",
-                        "--threads=5",
-                    ],
-                    description="phpMyAdmin found, testing for SQL injection",
-                ),
+                # phpMyAdmin → SQLMap - DISABLED
+                # phpMyAdmin is a database management tool with proper authentication.
+                # It doesn't have SQLi in its login form. Use nuclei/searchsploit instead.
+                # ChainRule(
+                #     trigger_tool="gobuster",
+                #     trigger_condition="finding:phpmyadmin",
+                #     target_tool="sqlmap",
+                #     ...
+                # ),
                 # === END WordPress-specific chains ===
                 # Dalfox - Deep XSS scan if nuclei hints at XSS
                 ChainRule(
@@ -1677,9 +1767,11 @@ class ToolChaining:
                     description="Domain member detected, scanning subnet for Domain Controller",
                 ),
                 # Kerbrute chains - enumerate users via Kerberos when domain discovered
+                # IMPORTANT: Require port 88 (Kerberos) to be open - not just "has:domains"
+                # Samba workgroups report as "domains" but are NOT Active Directory
                 ChainRule(
                     trigger_tool="enum4linux",
-                    trigger_condition="has:domains",
+                    trigger_condition="has:domains & port:88",
                     target_tool="kerbrute",
                     priority=6,
                     args_template=[
@@ -1690,11 +1782,11 @@ class ToolChaining:
                         "{dc_ip}",
                         "data/wordlists/ad_users.txt",
                     ],
-                    description="Domain discovered via SMB - enumerating users via Kerberos",
+                    description="Active Directory detected (Kerberos port 88 open) - enumerating users",
                 ),
                 ChainRule(
                     trigger_tool="crackmapexec",
-                    trigger_condition="has:domains",
+                    trigger_condition="has:domains & port:88",
                     target_tool="kerbrute",
                     priority=6,
                     args_template=[
@@ -1705,7 +1797,7 @@ class ToolChaining:
                         "{dc_ip}",
                         "data/wordlists/ad_users.txt",
                     ],
-                    description="Domain discovered via SMB - enumerating users via Kerberos",
+                    description="Active Directory detected (Kerberos port 88 open) - enumerating users",
                 ),
             ]
         )
@@ -1981,9 +2073,10 @@ class ToolChaining:
                     description="Domain discovered - enumerating all objects to find hidden users",
                 ),
                 # Kerbrute user enumeration (works even when anonymous LDAP is blocked)
+                # IMPORTANT: Require port 88 (Kerberos) - LDAP alone doesn't mean AD
                 ChainRule(
                     trigger_tool="ldapsearch",
-                    trigger_condition="has:domains",
+                    trigger_condition="has:domains & port:88",
                     target_tool="kerbrute",
                     priority=6,
                     args_template=[
@@ -1994,7 +2087,7 @@ class ToolChaining:
                         "{dc_ip}",
                         "data/wordlists/ad_users.txt",
                     ],
-                    description="Domain discovered via LDAP - enumerating users via Kerberos",
+                    description="Active Directory detected (Kerberos port 88 open) - enumerating users",
                 ),
             ]
         )
@@ -2175,49 +2268,28 @@ class ToolChaining:
             )
         )
 
-        # Gobuster discovered PHP files → crawl base URL once to find parametrized URLs
-        # NOTE: Special handling in auto_chain() limits to ONE crawl per base URL
-        self.rules.append(
-            ChainRule(
-                trigger_tool="gobuster",
-                trigger_condition="has:php_files",
-                target_tool="sqlmap",
-                priority=7,
-                args_template=[
-                    "-u",
-                    "{target}",
-                    "--batch",
-                    "--crawl=2",
-                    "--risk=2",
-                    "--level=3",
-                    "--forms",
-                    "--threads=5",
-                ],
-                description="PHP files discovered, crawling site to find parametrized pages and forms",
-            )
-        )
+        # Gobuster discovered PHP files → crawl base URL - DISABLED
+        # Reason: katana→sqlmap handles this better by targeting specific parametrized URLs.
+        # Crawling the base URL with SQLMap is slow and often wasteful.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="gobuster",
+        #         trigger_condition="has:php_files",
+        #         target_tool="sqlmap",
+        #         ...
+        #     )
+        # )
 
-        # Gobuster discovered ASP/ASPX files → crawl base URL once to find parametrized URLs
-        # Same logic as PHP files - ASP is common in Windows/IIS environments
-        self.rules.append(
-            ChainRule(
-                trigger_tool="gobuster",
-                trigger_condition="has:asp_files",
-                target_tool="sqlmap",
-                priority=7,
-                args_template=[
-                    "-u",
-                    "{target}",
-                    "--batch",
-                    "--crawl=2",
-                    "--risk=2",
-                    "--level=3",
-                    "--forms",
-                    "--threads=5",
-                ],
-                description="ASP/ASPX files discovered, crawling site to find parametrized pages and forms",
-            )
-        )
+        # Gobuster discovered ASP/ASPX files → crawl base URL - DISABLED
+        # Reason: katana→sqlmap handles this better by targeting specific parametrized URLs.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="gobuster",
+        #         trigger_condition="has:asp_files",
+        #         target_tool="sqlmap",
+        #         ...
+        #     )
+        # )
 
         # SMART API DISCOVERY CHAIN
         # Replaced broken direct SQLMap rules with intelligent two-step approach
@@ -2885,37 +2957,44 @@ class ToolChaining:
         )
 
         # ffuf found parameters → test with SQLMap (skip for LFI scans)
-        self.rules.append(
-            ChainRule(
-                trigger_tool="ffuf",
-                trigger_condition="has:parameters_found & !is:lfi_scan",
-                target_tool="sqlmap",
-                priority=9,
-                args_template=["-u", "{target}", "--batch", "--level=2", "--risk=2"],
-                description="Parameters discovered, testing for SQL injection",
-            )
-        )
+        # DISABLED: This rule passes {target} (original ffuf target) to sqlmap,
+        # which is useless - we need actual discovered endpoints with parameters.
+        # The smart chain (rule #-1) in auto_chain() handles ffuf → sqlmap properly
+        # by parsing ffuf output and testing discovered endpoints.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="ffuf",
+        #         trigger_condition="has:parameters_found & !is:lfi_scan",
+        #         target_tool="sqlmap",
+        #         priority=9,
+        #         args_template=["-u", "{target}", "--batch", "--level=2", "--risk=2"],
+        #         description="Parameters discovered, testing for SQL injection",
+        #     )
+        # )
 
         # ffuf found parameters → test with Nuclei XSS (skip for LFI scans)
-        self.rules.append(
-            ChainRule(
-                trigger_tool="ffuf",
-                trigger_condition="has:parameters_found & !is:lfi_scan",
-                target_tool="nuclei",
-                priority=8,
-                args_template=[
-                    "-tags",
-                    "xss,rxss",
-                    "-severity",
-                    "critical,high,medium",
-                    "-rate-limit",
-                    "50",
-                    "-c",
-                    "10",
-                ],
-                description="Parameters discovered, testing for XSS",
-            )
-        )
+        # DISABLED: Same issue as above - uses {target} instead of discovered parameters.
+        # Running XSS scans on bare directories like /cgi-bin/ is useless.
+        # Smart chains in auto_chain() handle ffuf → nuclei properly.
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="ffuf",
+        #         trigger_condition="has:parameters_found & !is:lfi_scan",
+        #         target_tool="nuclei",
+        #         priority=8,
+        #         args_template=[
+        #             "-tags",
+        #             "xss,rxss",
+        #             "-severity",
+        #             "critical,high,medium",
+        #             "-rate-limit",
+        #             "50",
+        #             "-c",
+        #             "10",
+        #         ],
+        #         description="Parameters discovered, testing for XSS",
+        #     )
+        # )
 
         # Gobuster found API endpoints → parameter fuzzing with ffuf
         self.rules.extend(
@@ -3135,27 +3214,17 @@ class ToolChaining:
             )
         )
 
-        # Custom PHP → SQLMap standard crawl
-        self.rules.append(
-            ChainRule(
-                trigger_tool="gobuster",
-                trigger_condition="category:custom_php",
-                target_tool="sqlmap",
-                priority=7,
-                args_template=[
-                    "-u",
-                    "{target}",
-                    "--batch",
-                    "--crawl=2",
-                    "--forms",
-                    "--level=2",
-                    "--risk=2",
-                    "--smart",
-                    "--threads=5",
-                ],
-                description="Custom PHP app detected, scan forms for SQL injection",
-            )
-        )
+        # Custom PHP → SQLMap standard crawl - DISABLED
+        # Reason: katana→sqlmap handles this better by targeting specific parametrized URLs.
+        # The "custom_php" category is too broad (default for unrecognized paths).
+        # self.rules.append(
+        #     ChainRule(
+        #         trigger_tool="gobuster",
+        #         trigger_condition="category:custom_php",
+        #         target_tool="sqlmap",
+        #         ...
+        #     )
+        # )
 
         # === END Directory Category Chain Rules ===
 
@@ -4518,8 +4587,8 @@ class ToolChaining:
         """Generate ChainRules from CVE database for version-aware chaining."""
         try:
             from souleyez.core.cve_mappings import (
-                get_all_cves,
                 generate_version_condition,
+                get_all_cves,
             )
         except ImportError:
             return  # CVE mappings not available
@@ -4650,8 +4719,8 @@ class ToolChaining:
 
         # Verify license allows auto-chaining
         try:
+            from souleyez.feature_flags.features import Feature, FeatureFlags
             from souleyez.licensing import get_active_license
-            from souleyez.feature_flags.features import Features, Feature
 
             license_info = get_active_license()
             # Check tier directly - if license exists with PRO tier, allow it
@@ -4663,7 +4732,7 @@ class ToolChaining:
                 elif license_info.is_valid and license_info.tier:
                     user_tier = license_info.tier
 
-            if not Features.is_enabled(Feature.AUTO_CHAINING, user_tier):
+            if not FeatureFlags.is_enabled(Feature.AUTO_CHAINING, user_tier):
                 # User doesn't have PRO - disable auto-chaining
                 from souleyez.log_config import get_logger
 
@@ -4691,9 +4760,9 @@ class ToolChaining:
         try:
             from souleyez import config
 
-            return config.get("ai.chain_mode", "suggest")
+            return config.get("ai.chain_mode", "off")
         except Exception:
-            return "suggest"  # Default to suggest mode
+            return "off"  # Default to off - AI advisor is opt-in
 
     def get_ai_recommendations(
         self,
@@ -5266,9 +5335,9 @@ class ToolChaining:
                 ...
             ]
         """
-        from souleyez.log_config import get_logger
         from souleyez.core.web_utils import check_http_redirect
         from souleyez.engine.background import get_job
+        from souleyez.log_config import get_logger
 
         logger = get_logger(__name__)
 
@@ -5939,9 +6008,9 @@ class ToolChaining:
                         if is_wordlist:
                             logger.info(f"Discovered potential wordlist: {path_url}")
                             try:
-                                import urllib.request
-                                import ssl
                                 import os as os_module
+                                import ssl
+                                import urllib.request
 
                                 # Create discovered wordlists directory
                                 wordlist_dir = os_module.path.join(
@@ -6031,8 +6100,14 @@ class ToolChaining:
                         f"http_fingerprint detected CMS: {cms_detected.get('name')} ({cms_confidence} confidence)"
                     )
 
-                    # Trigger appropriate CMS scanner
-                    if "wordpress" in cms_name:
+                    # Only trigger CMS scanners with high confidence detection
+                    # Medium/low confidence often means false positives (e.g., SPAs returning
+                    # non-404 for /wp-admin/ paths). Require 2+ paths matched for high confidence.
+                    if cms_confidence != "high":
+                        logger.info(
+                            f"Skipping CMS scanner - {cms_confidence} confidence is insufficient (need 'high')"
+                        )
+                    elif "wordpress" in cms_name:
                         try:
                             enqueue_job(
                                 tool="wpscan",
@@ -6329,10 +6404,10 @@ class ToolChaining:
                 if is_tables_phase and not is_dump_phase and tables and len(tables) > 0:
                     # Just finished --tables phase, use hybrid approach
                     from souleyez.intelligence.sensitive_tables import (
-                        prioritize_tables,
+                        is_sensitive_table_name,
                         is_system_database,
                         is_system_table,
-                        is_sensitive_table_name,
+                        prioritize_tables,
                     )
                     from souleyez.log_config import get_logger
 
@@ -6632,8 +6707,8 @@ class ToolChaining:
                 if is_dump_phase:
                     # === Chain to Hydra for credential reuse testing ===
                     from souleyez.engine.background import enqueue_job
-                    from souleyez.storage.hosts import HostManager
                     from souleyez.log_config import get_logger
+                    from souleyez.storage.hosts import HostManager
 
                     logger = get_logger(__name__)
 
@@ -6777,8 +6852,8 @@ class ToolChaining:
                             hash_groups[hash_type].append(cred)
 
                     if hash_groups:
-                        import tempfile
                         import os
+                        import tempfile
 
                         # Map hash types to hashcat modes
                         hashcat_modes = {
@@ -6927,10 +7002,11 @@ class ToolChaining:
                 # Check if databases were enumerated (trigger --tables per database)
                 elif databases and len(databases) > 0:
                     # Filter out system databases (zero pentest value)
+                    import re
+
                     from souleyez.intelligence.sensitive_tables import (
                         is_system_database,
                     )
-                    import re
 
                     def is_garbage_db_name(name: str) -> bool:
                         """Detect SQLMap marker strings or broken extraction results."""
@@ -8544,6 +8620,11 @@ class ToolChaining:
 
                         # === SQLMap for testable endpoints ===
                         # Skip SQLMap if this was an LFI fuzz scan - results are LFI payloads, not SQLi targets
+
+                        # Use helper function to filter non-injectable URLs
+                        if not should_test_url_for_sqli(endpoint_url):
+                            continue
+
                         if (
                             not is_lfi_scan
                             and status_code in testable_statuses
@@ -8698,8 +8779,8 @@ class ToolChaining:
                         lfi_extract_args = ["--max-urls", "10"]
 
                         # Write URLs to temp file for batch processing
-                        import tempfile
                         import os as os_module
+                        import tempfile
 
                         tmp_dir = os_module.path.join(
                             os_module.path.expanduser("~"), ".souleyez", "tmp"
@@ -8942,8 +9023,8 @@ class ToolChaining:
                         path = ""
 
                     # Create temp file with usernames
-                    import tempfile
                     import os as os_module
+                    import tempfile
 
                     tmp_dir = os_module.path.join(
                         os_module.path.expanduser("~"), ".souleyez", "tmp"
@@ -9190,6 +9271,54 @@ class ToolChaining:
                         ):
                             continue
 
+                        # Skip external URLs - only test URLs on the original target host
+                        try:
+                            from urllib.parse import urlparse
+
+                            parsed_url = urlparse(url)
+                            parsed_target = urlparse(target)
+                            if parsed_url.netloc and parsed_target.netloc:
+                                if (
+                                    parsed_url.netloc.lower()
+                                    != parsed_target.netloc.lower()
+                                ):
+                                    logger.debug(f"  Skipping external URL: {url}")
+                                    continue
+                        except Exception:
+                            pass
+
+                        # Skip non-injectable paths (TWiki, phpMyAdmin, Apache dir params)
+                        skip_patterns = [
+                            "/twiki/",  # TWiki wiki - not SQLi vulnerable
+                            "/phpmyadmin/",  # phpMyAdmin - DB admin, not SQLi
+                            "/phpmyadmin.",  # phpMyAdmin CSS/JS files
+                            "?c=d",
+                            "?c=s",
+                            "?c=m",
+                            "?c=n",  # Apache dir listing sort params
+                            "?o=a",
+                            "?o=d",  # Apache dir listing order params
+                            ";o=a",
+                            ";o=d",  # Apache dir listing (semicolon variant)
+                            "/misc/",  # Drupal/CMS static assets directory
+                            "/modules/",  # Drupal modules directory (static files)
+                        ]
+                        # Also skip static files with version/cache-busting params
+                        # These are not injectable: /jquery.js?v=1.2.3, /style.css?ver=5.0
+                        if ".js?" in path_lower or ".css?" in path_lower:
+                            logger.debug(
+                                f"  Skipping static file with cache param: {url}"
+                            )
+                            continue
+                        if any(pattern in path_lower for pattern in skip_patterns):
+                            logger.debug(f"  Skipping non-injectable path: {url}")
+                            continue
+
+                        # Skip URLs without real parameters (just base URL or path)
+                        if "?" not in url and url not in forms_found:
+                            logger.debug(f"  Skipping URL without parameters: {url}")
+                            continue
+
                         # Determine if this is a form (POST) or URL param (GET)
                         is_form = url in forms_found
 
@@ -9593,8 +9722,8 @@ class ToolChaining:
 
                 if asrep_hashes:
                     # Create temp file with AS-REP hashes for hashcat
-                    import tempfile
                     import os
+                    import tempfile
 
                     # Create hash file (uses secure tempdir)
                     hash_file = tempfile.NamedTemporaryFile(
@@ -9643,8 +9772,8 @@ class ToolChaining:
 
                 if hashes:
                     # Create temp file with NTLM hashes for hashcat
-                    import tempfile
                     import os
+                    import tempfile
 
                     # Create hash file in format: username:hash (uses secure tempdir)
                     hash_file = tempfile.NamedTemporaryFile(
@@ -9831,7 +9960,8 @@ class ToolChaining:
                             stored_creds = cred_mgr.list_credentials(
                                 engagement_id, host_id=host["id"]
                             )
-                            # Find SMB/Windows credentials
+                            # Find SMB/Windows credentials - prefer passwords over hashes
+                            # Hashes require different auth flags and may be from later chain stages
                             for cred in stored_creds:
                                 if cred.get("service") in [
                                     "smb",
@@ -9839,8 +9969,12 @@ class ToolChaining:
                                     "ldap",
                                     "windows",
                                 ]:
-                                    smb_creds = cred
-                                    break
+                                    # Only use password-type creds, not hashes
+                                    # Hashes need --hash flag and may be stale from previous runs
+                                    cred_type = cred.get("credential_type", "password")
+                                    if cred_type in ["password", "plaintext"]:
+                                        smb_creds = cred
+                                        break
                     except Exception as e:
                         logger.debug(f"Could not get stored credentials: {e}")
 
@@ -9877,14 +10011,10 @@ class ToolChaining:
                                 f"Using stored credentials ({username}) for share access"
                             )
                         else:
-                            # Use null session - smbmap handles this with empty creds
+                            # Use null session - smbmap defaults to anonymous without -u/-p
                             smbmap_args = [
                                 "-H",
                                 target,
-                                "-u",
-                                "",
-                                "-p",
-                                "",
                                 "-r",
                                 share_name,
                                 "--depth",
@@ -9991,8 +10121,9 @@ class ToolChaining:
 
                 if password_changed and username and new_password:
                     # Check for existing evil-winrm job for same user to avoid duplicates
+                    from datetime import datetime, timedelta, timezone
+
                     from souleyez.engine.background import list_jobs
-                    from datetime import datetime, timezone, timedelta
 
                     try:
                         all_jobs = list_jobs(limit=500)
@@ -10077,9 +10208,10 @@ class ToolChaining:
                         f"Secretsdump extracted {hashes_count} NTLM hash(es), chaining to hashcat"
                     )
 
-                    from souleyez.engine.background import enqueue_job
-                    import tempfile
                     import os
+                    import tempfile
+
+                    from souleyez.engine.background import enqueue_job
 
                     # Create a temporary hash file for hashcat
                     # Format: username:rid:lm:nt::: (but hashcat mode 1000 just needs NT hash)
@@ -10139,9 +10271,10 @@ class ToolChaining:
                         f"GetNPUsers extracted {hashes_count} AS-REP hash(es), chaining to hashcat"
                     )
 
-                    from souleyez.engine.background import enqueue_job
                     import os
 
+                    from souleyez.engine.background import enqueue_job
+
                     # Create a hash file for hashcat
                     hash_dir = os.path.join(
                         os.path.expanduser("~"), ".souleyez", "hashes"
@@ -10330,10 +10463,11 @@ class ToolChaining:
                 hashes = parse_results.get("hashes", [])
 
                 if hashes:
+                    import os
+                    import tempfile
+
                     from souleyez.engine.background import enqueue_job
                     from souleyez.log_config import get_logger
-                    import tempfile
-                    import os
 
                     logger = get_logger(__name__)
                     logger.info(
@@ -10382,9 +10516,9 @@ class ToolChaining:
 
                 if users:
                     # Create temp file with enumerated WordPress usernames
-                    import tempfile
                     import os
                     import re
+                    import tempfile
 
                     fd, usernames_file = tempfile.mkstemp(
                         suffix=".txt", prefix="wpscan_users_"
@@ -10446,8 +10580,8 @@ class ToolChaining:
 
                 if usernames:
                     # Create temp file with validated usernames
-                    import tempfile
                     import os
+                    import tempfile
 
                     fd, usernames_file = tempfile.mkstemp(
                         suffix=".txt", prefix="hydra_users_"
@@ -10496,8 +10630,8 @@ class ToolChaining:
                 credentials = parse_results.get("credentials", [])
                 if credentials:
                     from souleyez.engine.background import enqueue_job
-                    from souleyez.storage.hosts import HostManager
                     from souleyez.log_config import get_logger
+                    from souleyez.storage.hosts import HostManager
 
                     logger = get_logger(__name__)
 
@@ -10571,82 +10705,15 @@ class ToolChaining:
                     except Exception as e:
                         logger.debug(f"Evil-WinRM chain check failed: {e}")
 
-                # === Hydra credentials found → SSH shell access (Linux) ===
-                if credentials:
-                    from souleyez.engine.background import enqueue_job
-                    from souleyez.storage.hosts import HostManager
-                    from souleyez.log_config import get_logger
-
-                    logger = get_logger(__name__)
-
-                    try:
-                        host_manager = HostManager()
-                        target_host = target.split(":")[0] if ":" in target else target
-
-                        host = host_manager.get_host_by_ip(engagement_id, target_host)
-                        if host:
-                            services = host_manager.get_host_services(host["id"])
-                            ssh_svc = next(
-                                (s for s in services if s.get("port") == 22), None
-                            )
-
-                            if ssh_svc:
-                                # SSH is available - create SSH command execution job
-                                for cred in credentials:  # Process all credentials
-                                    username = cred.get("username")
-                                    password = cred.get("password")
-
-                                    if username and password:
-                                        # Check if SSH chain already ran for this user
-                                        from souleyez.storage.database import Database
-
-                                        try:
-                                            db = Database()
-                                            existing = db.execute(
-                                                """SELECT id FROM jobs WHERE engagement_id = ?
-                                                   AND tool = 'nxc' AND args LIKE '%ssh%'
-                                                   AND args LIKE ? AND status != 'killed' LIMIT 1""",
-                                                (engagement_id, f'%-u", "{username}%'),
-                                            )
-                                            if existing:
-                                                continue
-                                        except Exception:
-                                            pass
-
-                                        # Use nxc (netexec) to test SSH shell access
-                                        ssh_job_id = enqueue_job(
-                                            tool="nxc",
-                                            target=target_host,
-                                            args=[
-                                                "ssh",
-                                                target_host,
-                                                "-u",
-                                                username,
-                                                "-p",
-                                                password,
-                                                "-x",
-                                                "whoami && id && hostname",
-                                            ],
-                                            label="hydra",
-                                            engagement_id=engagement_id,
-                                            parent_id=job.get("id"),
-                                            reason=f"Auto-triggered by hydra: Testing SSH shell access with {username}",
-                                            rule_id=-28,  # Smart chain: hydra → nxc ssh (shell)
-                                        )
-                                        job_ids.append(ssh_job_id)
-                                        logger.info(
-                                            f"  nxc SSH job #{ssh_job_id} for {username}"
-                                        )
-                    except Exception as e:
-                        logger.debug(f"SSH shell chain check failed: {e}")
+                # NOTE: SSH shell chain removed - spawn shell directly from Hydra job via [s] option
 
                 return job_ids
 
             # === NetExec (nxc) credential chain: valid creds → evil_winrm, Kerberoasting, secretsdump ===
             elif tool == "nxc":
                 from souleyez.engine.background import enqueue_job
-                from souleyez.storage.hosts import HostManager
                 from souleyez.log_config import get_logger
+                from souleyez.storage.hosts import HostManager
 
                 logger = get_logger(__name__)
                 logger.info(
@@ -11370,8 +11437,8 @@ class ToolChaining:
                 host_manager = None
                 credentials_manager = None
                 try:
-                    from souleyez.storage.hosts import HostManager
                     from souleyez.storage.credentials import CredentialsManager
+                    from souleyez.storage.hosts import HostManager
 
                     host_manager = HostManager()
                     credentials_manager = CredentialsManager()
@@ -11632,8 +11699,8 @@ class ToolChaining:
                             spray_password = credentials_found[0].get("password", "")
                             if spray_password and len(all_users) > 1:
                                 # Create temporary user list file
-                                import tempfile
                                 import os
+                                import tempfile
 
                                 # Write users to temp file
                                 users_file = os.path.join(
@@ -11724,8 +11791,8 @@ class ToolChaining:
 
                         if domain:
                             # Create temp file with discovered users
-                            import tempfile
                             import os as os_module
+                            import tempfile
 
                             users_file = os_module.path.join(
                                 tempfile.gettempdir(),
@@ -12076,7 +12143,7 @@ class ToolChaining:
         # === END PRE-DEDUPLICATION ===
 
         try:
-            from souleyez.engine.background import enqueue_job, list_jobs, _lock
+            from souleyez.engine.background import _lock, enqueue_job, list_jobs
 
             for cmd in commands:
                 cmd_target = cmd.get("target", "")