stackscan 2.2.1__tar.gz → 2.3.0__tar.gz

{stackscan-2.2.1 → stackscan-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackscan
-Version: 2.2.1
+Version: 2.3.0
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues
@@ -117,7 +117,7 @@ stackscan --cve-online example.com
 
 # Speed / coverage knobs
 stackscan --full --workers 500 --subdomain-limit 10000 example.com
-stackscan --full --site-limit 10 --workers 200 example.com
+stackscan --full --site-limit 20 --workers 200 example.com
 
 # JSON (full detail, includes timing) or a compact table
 stackscan --json example.com
@@ -169,10 +169,13 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--ports` / `--no-nmap` | off | Active port scan (nmap, else Python) / force the Python scanner. |
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
-| `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
-| `--default-creds` | off | Bounded default-credential / open-device check. |
+| `--site-limit` | `50` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--cve-min-confidence` | `50` | Hide CVE matches with confidence below N (`0` shows all). |
+| `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
+| `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |
 | `--cve-online` | off | Also query NVD live for detected products. |
+| `--parse-social` | off | Extract social media and contact links from the page. |
 | `--workers` | `350` | Parallel workers for ports/subdomains/creds. |
 | `--concurrency` | `10` | Concurrent targets. |
 | `--sigdb` / `--no-builtin` / `--no-sources` | – | Signature database selection. |

{stackscan-2.2.1 → stackscan-2.3.0}/README.md

@@ -79,7 +79,7 @@ stackscan --cve-online example.com
 
 # Speed / coverage knobs
 stackscan --full --workers 500 --subdomain-limit 10000 example.com
-stackscan --full --site-limit 10 --workers 200 example.com
+stackscan --full --site-limit 20 --workers 200 example.com
 
 # JSON (full detail, includes timing) or a compact table
 stackscan --json example.com
@@ -131,10 +131,13 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--ports` / `--no-nmap` | off | Active port scan (nmap, else Python) / force the Python scanner. |
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
-| `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
-| `--default-creds` | off | Bounded default-credential / open-device check. |
+| `--site-limit` | `50` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--cve-min-confidence` | `50` | Hide CVE matches with confidence below N (`0` shows all). |
+| `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
+| `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |
 | `--cve-online` | off | Also query NVD live for detected products. |
+| `--parse-social` | off | Extract social media and contact links from the page. |
 | `--workers` | `350` | Parallel workers for ports/subdomains/creds. |
 | `--concurrency` | `10` | Concurrent targets. |
 | `--sigdb` / `--no-builtin` / `--no-sources` | – | Signature database selection. |

{stackscan-2.2.1 → stackscan-2.3.0}/scripts/build_cve_db.py

@@ -138,6 +138,16 @@ def ranges_for(cve: dict[str, Any], needle: str) -> list[dict[str, str]]:
     return out
 
 
+def _skip_entry(cve: dict[str, Any]) -> bool:
+    status = str(cve.get("vulnStatus", "")).upper()
+    if status in {"REJECTED", "REPLACED", "DEPRECATED"}:
+        return True
+    descriptions = cve.get("descriptions") or []
+    if not english_summary(descriptions):
+        return True
+    return False
+
+
 def collect(product: str, vendor_product: str, throttle: float) -> list[dict[str, Any]]:
     needle = ":" + vendor_product + ":"
     entries: list[dict[str, Any]] = []
@@ -149,6 +159,8 @@ def collect(product: str, vendor_product: str, throttle: float) -> list[dict[str
         vulns = payload.get("vulnerabilities") or []
         for wrapper in vulns:
             cve = wrapper["cve"]
+            if _skip_entry(cve):
+                continue
             ranges = ranges_for(cve, needle)
             if not ranges:
                 continue

{stackscan-2.2.1 → stackscan-2.3.0}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.2.1"
+__version__ = "2.3.0"

{stackscan-2.2.1 → stackscan-2.3.0}/src/stackscan/analyzers/__init__.py

@@ -1,4 +1,4 @@
-from stackscan.analyzers.creds import check_default_creds
+from stackscan.analyzers.creds import brute_devices, detect_devices
 from stackscan.analyzers.cve import (
     extract_software,
     match_cves,
@@ -8,8 +8,10 @@ from stackscan.analyzers.cve import (
 )
 from stackscan.analyzers.exposure import ExposureProbe, analyze_exposure
 from stackscan.analyzers.infra import analyze_infra
+from stackscan.analyzers.osdetect import detect_os
 from stackscan.analyzers.security import analyze_security_headers
 from stackscan.analyzers.services import classify_services, port_category
+from stackscan.analyzers.social import parse_social
 from stackscan.analyzers.tech import TechAnalyzer
 
 __all__ = [
@@ -18,9 +20,12 @@ __all__ = [
     "analyze_exposure",
     "analyze_infra",
     "analyze_security_headers",
-    "check_default_creds",
+    "brute_devices",
+    "detect_devices",
+    "detect_os",
     "classify_services",
     "port_category",
+    "parse_social",
     "extract_software",
     "match_cves",
     "match_cves_online",

{stackscan-2.2.1 → stackscan-2.3.0}/src/stackscan/analyzers/creds.py

@@ -7,7 +7,7 @@ from functools import lru_cache
 
 import aiohttp
 
-from stackscan.types import CredFinding, PortScan
+from stackscan.types import BruteTarget, CredFinding, PortScan
 from stackscan.utils import db_dir
 
 _CREDS_URL = "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Default-Credentials/default-passwords.csv"
@@ -40,6 +40,27 @@ _DEVICE_KEYWORDS = (
     "network camera",
     "surveillance",
     "uc-httpd",
+    "go2rtc",
+    "rtsp",
+)
+_CAMERA_KEYWORDS = (
+    "camera",
+    "ipcam",
+    "netcam",
+    "webcam",
+    "dvr",
+    "nvr",
+    "cctv",
+    "hikvision",
+    "dahua",
+    "axis",
+    "foscam",
+    "vivotek",
+    "webcamxp",
+    "network camera",
+    "surveillance",
+    "go2rtc",
+    "rtsp",
 )
 _BUILTIN_CREDS: tuple[tuple[str, str], ...] = (
     ("admin", "admin"),
@@ -105,6 +126,9 @@ def load_default_creds() -> tuple[tuple[str, str], ...]:
     return tuple(combined)
 
 
+_RTSP_PORTS: frozenset[int] = frozenset({554, 8554})
+
+
 def _http_ports(scan: PortScan | None) -> list[tuple[int, bool]]:
     if scan is None:
         return []
@@ -113,7 +137,12 @@ def _http_ports(scan: PortScan | None) -> list[tuple[int, bool]]:
         service = (port.service or "").lower()
         if port.port in (443, 8443, 2083) or "https" in service or "ssl" in service:
             out.append((port.port, True))
-        elif "http" in service or port.port in (80, 8080, 8000, 8081, 8888, 9000, 631, 7547):
+        elif (
+            "http" in service
+            or port.port in (80, 8080, 8000, 8081, 8888, 9000, 631, 7547)
+            or port.port in _RTSP_PORTS
+            or "rtsp" in service
+        ):
             out.append((port.port, False))
     return out
 
@@ -123,45 +152,49 @@ def _looks_like_device(realm: str, server: str) -> bool:
     return any(keyword in blob for keyword in _DEVICE_KEYWORDS)
 
 
-async def check_default_creds(
+def _is_camera(realm: str, server: str) -> bool:
+    blob = f"{realm} {server}".lower()
+    return any(keyword in blob for keyword in _CAMERA_KEYWORDS)
+
+
+async def detect_devices(
     host: str,
     scan: PortScan | None,
     *,
     timeout: float = 6.0,
     insecure: bool = True,
     workers: int = 10,
-    cred_limit: int = 100,
-) -> list[CredFinding]:
+) -> tuple[list[CredFinding], list[BruteTarget]]:
     ports = _http_ports(scan)
     if not ports:
-        return []
-    creds = await asyncio.to_thread(load_default_creds)
-    if cred_limit > 0:
-        creds = creds[:cred_limit]
+        return ([], [])
     connector = aiohttp.TCPConnector(ssl=False, limit=max(workers, 1))
     client_timeout = aiohttp.ClientTimeout(total=timeout)
     semaphore = asyncio.Semaphore(max(workers, 1))
     findings: list[CredFinding] = []
+    candidates: list[BruteTarget] = []
     async with aiohttp.ClientSession(connector=connector, timeout=client_timeout) as session:
 
-        async def check(port: int, tls: bool) -> None:
+        async def probe(port: int, tls: bool) -> None:
             async with semaphore:
-                finding = await _check_endpoint(session, host, port, tls, creds)
-            if finding is not None:
-                findings.append(finding)
+                result = await _probe_endpoint(session, host, port, tls)
+            if isinstance(result, BruteTarget):
+                candidates.append(result)
+            elif result is not None:
+                findings.append(result)
 
-        await asyncio.gather(*(check(port, tls) for port, tls in ports))
-    findings.sort(key=lambda f: (f.kind != "default-creds", f.kind != "open-no-auth", f.target))
-    return findings
+        await asyncio.gather(*(probe(port, tls) for port, tls in ports))
+    findings.sort(key=lambda f: f.target)
+    candidates.sort(key=lambda c: (c.host, c.port))
+    return (findings, candidates)
 
 
-async def _check_endpoint(
+async def _probe_endpoint(
     session: aiohttp.ClientSession,
     host: str,
     port: int,
     tls: bool,
-    creds: tuple[tuple[str, str], ...],
-) -> CredFinding | None:
+) -> CredFinding | BruteTarget | None:
     scheme = "https" if tls else "http"
     url = f"{scheme}://{host}:{port}/"
     target = f"{host}:{port}"
@@ -172,7 +205,7 @@ async def _check_endpoint(
             realm = resp.headers.get("WWW-Authenticate", "")
     except (aiohttp.ClientError, TimeoutError, OSError):
         return None
-    device = _looks_like_device(realm, server)
+    device = _looks_like_device(realm, server) or port in _RTSP_PORTS
     if status != 401:
         if device or _looks_like_device("", server):
             return CredFinding(
@@ -184,25 +217,64 @@ async def _check_endpoint(
         return None
     if not device:
         return None
-    hit = await _try_defaults(session, url, creds)
-    if hit is not None:
-        username, password = hit
-        return CredFinding(
-            target=target,
-            service=f"{scheme} ({server or realm or 'device'})",
-            kind="default-creds",
-            detail="default credentials accepted via HTTP Basic auth",
-            username=username,
-            password=password,
-        )
-    return CredFinding(
-        target=target,
+    return BruteTarget(
+        host=host,
+        port=port,
+        tls=tls,
         service=f"{scheme} ({server or realm or 'device'})",
-        kind="auth-required",
-        detail="device auth required; no default credential matched",
+        is_camera=_is_camera(realm, server) or port in _RTSP_PORTS,
     )
 
 
+async def brute_devices(
+    targets: list[BruteTarget],
+    *,
+    timeout: float = 6.0,
+    insecure: bool = True,
+    workers: int = 10,
+    cred_limit: int = 100,
+) -> list[CredFinding]:
+    if not targets:
+        return []
+    creds = await asyncio.to_thread(load_default_creds)
+    if cred_limit > 0:
+        creds = creds[:cred_limit]
+    connector = aiohttp.TCPConnector(ssl=False, limit=max(workers, 1))
+    client_timeout = aiohttp.ClientTimeout(total=timeout)
+    semaphore = asyncio.Semaphore(max(workers, 1))
+    findings: list[CredFinding] = []
+    async with aiohttp.ClientSession(connector=connector, timeout=client_timeout) as session:
+
+        async def run(target: BruteTarget) -> None:
+            async with semaphore:
+                hit = await _try_defaults(session, target.url, creds)
+            if hit is not None:
+                username, password = hit
+                findings.append(
+                    CredFinding(
+                        target=target.target,
+                        service=target.service,
+                        kind="default-creds",
+                        detail="default credentials accepted via HTTP Basic auth",
+                        username=username,
+                        password=password,
+                    )
+                )
+            else:
+                findings.append(
+                    CredFinding(
+                        target=target.target,
+                        service=target.service,
+                        kind="auth-required",
+                        detail="device auth required; no default credential matched",
+                    )
+                )
+
+        await asyncio.gather(*(run(target) for target in targets))
+    findings.sort(key=lambda f: (f.kind != "default-creds", f.target))
+    return findings
+
+
 async def _try_defaults(
     session: aiohttp.ClientSession, url: str, creds: tuple[tuple[str, str], ...]
 ) -> tuple[str, str] | None:

{stackscan-2.2.1 → stackscan-2.3.0}/src/stackscan/analyzers/cve.py

@@ -9,9 +9,20 @@ from functools import lru_cache
 from importlib import resources
 from typing import Any, cast
 
+from stackscan.analyzers.generic import SERVER_NAMES, extract_generic_software, is_commit_hash
 from stackscan.types import CveMatch, Headers, PortScan, Software
 
 CveEntry = dict[str, Any]
+_BACKPORT_DISTRO_RE = re.compile(
+    r"(0?ubuntu0?[._]\d[\d.]+)"
+    r"|\b(ubuntu|debian|centos|rhel|red\s*hat|fedora|amzn|amazon|rocky|almalinux|alpine|raspbian|suse|opensuse|oracle|sles)\b"
+    r"|(\+deb\d+u?\d*)"
+    r"|(-\d+ubuntu\d+(?![\d._]))"
+    r"|(el\d+)"
+    r"|(\.fc\d+)"
+    r"|(~bpo\d+\+[\w]+)",
+    re.I,
+)
 CveDb = dict[str, list[CveEntry]]
 _NAME_MAP: dict[str, str] = {
     "nginx": "nginx",
@@ -89,7 +100,10 @@ _JQUERY_RE = re.compile("jquery[-/]?v?(\\d+\\.\\d+(?:\\.\\d+)?)", re.IGNORECASE)
 _GENERATOR_RE = re.compile(
     "<meta[^>]+name=[\\\"']generator[\\\"'][^>]+content=[\\\"']([^\\\"']+)[\\\"']", re.IGNORECASE
 )
-_SSH_RE = re.compile("openssh[_/-]?(\\d+\\.\\d+(?:p\\d+)?)", re.IGNORECASE)
+_SSH_RE = re.compile(r"openssh[\s_/:-](\d+\.\d+(?:p\d+)?)", re.IGNORECASE)
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
+)
 
 
 @lru_cache(maxsize=1)
@@ -109,6 +123,11 @@ def load_cve_db() -> CveDb:
     return cast("CveDb", products)
 
 
+def _distro_tag(text: str) -> str:
+    match = _BACKPORT_DISTRO_RE.search(text)
+    return match.group(0) if match else ""
+
+
 def _parse_version(value: str) -> tuple[tuple[int, str], ...]:
     parts: list[tuple[int, str]] = []
     for chunk in re.split("[.\\-_]", value.strip()):
@@ -140,10 +159,12 @@ def _in_range(version: str, rng: dict[str, str]) -> bool:
     return bool(rng)
 
 
-def _tokens(value: str, source: str, location: str) -> list[Software]:
+def _tokens(value: str, source: str, location: str, os: str = "") -> list[Software]:
     found: list[Software] = []
     for name, version in _TOKEN_RE.findall(value):
-        found.append(Software(name=name.lower(), version=version, source=source, location=location))
+        found.append(
+            Software(name=name.lower(), version=version, source=source, location=location, os=os)
+        )
     return found
 
 
@@ -159,8 +180,27 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
 
     server = headers.get("server")
     if server:
-        for item in _tokens(server, "header:server", location):
+        server_os = _distro_tag(server)
+        server_items = _tokens(server, "header:server", location, os=server_os)
+        for item in server_items:
             add(item)
+        # If the Server banner names a known product without a version (e.g.
+        # "nginx" or "Apache"), still record it so it shows up in the software
+        # table even when no CVE can be matched yet.
+        if not server_items:
+            server_lower = server.lower()
+            for name in sorted(SERVER_NAMES, key=len, reverse=True):
+                if name in server_lower:
+                    add(
+                        Software(
+                            name=name.lower().replace(" ", ""),
+                            version=None,
+                            source="header:server",
+                            location=location,
+                            os=server_os,
+                        )
+                    )
+                    break
     powered = headers.get("x-powered-by")
     if powered:
         for item in _tokens(powered, "header:x-powered-by", location):
@@ -181,6 +221,22 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
                     location=location,
                 )
             )
+    core_match = _CORE_COMMIT_RE.search(body)
+    if core_match:
+        product = core_match.group(1).strip()
+        commit = core_match.group(2).lower()
+        if product:
+            add(
+                Software(
+                    name=product.lower().replace(" ", ""),
+                    version=commit,
+                    source="body:core-commit",
+                    location=location,
+                )
+            )
+
+    for item in extract_generic_software(body, location=location):
+        add(item)
     return software
 
 
@@ -193,11 +249,16 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
         if not blob:
             continue
         location = f"{port.host}:{port.port}" if port.host else f":{port.port}"
+        port_os = port.os or _distro_tag(blob)
         ssh = _SSH_RE.search(blob)
         if ssh:
             out.append(
                 Software(
-                    name="openssh", version=ssh.group(1), source="port-banner", location=location
+                    name="openssh",
+                    version=ssh.group(1),
+                    source="port-banner",
+                    location=location,
+                    os=port_os,
                 )
             )
             continue
@@ -208,6 +269,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                     version=port.version,
                     source="port-banner",
                     location=location,
+                    os=port_os,
                 )
             )
     return out
@@ -217,20 +279,24 @@ _AUTHORITATIVE = {"header:server", "header:x-powered-by", "port-banner"}
 _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 
-def _confidence(version: str, rng: dict[str, str], source: str) -> int:
-    score = 55
+def _confidence(version: str, rng: dict[str, str], source: str, backported: bool = False) -> int:
+    if backported:
+        # Distro backports are a common source of phantom CVEs because the
+        # banner version does not reveal the patchlevel. Keep them below the
+        # default confidence threshold so they only appear when explicitly asked.
+        if "start_incl" in rng or "start_excl" in rng:
+            return 45
+        return 25
     comps = len([c for c in re.split("[.\\-_]", version) if c[:1].isdigit()])
-    if comps >= 3:
-        score += 20
-    elif comps >= 2:
-        score += 12
     bounded = ("start_incl" in rng or "start_excl" in rng) and (
         "end_incl" in rng or "end_excl" in rng
     )
-    score += 12 if bounded else 6
-    if source in _AUTHORITATIVE:
-        score += 12
-    return max(30, min(98, score))
+    authoritative = source in _AUTHORITATIVE
+    if authoritative and bounded and comps >= 3:
+        return 98
+    if (authoritative or bounded) and comps >= 2:
+        return 91
+    return 85
 
 
 @dataclass
@@ -245,6 +311,8 @@ class _CveAgg:
     url: str | None
     locations: set[str] = field(default_factory=set[str])
     sources: set[str] = field(default_factory=set[str])
+    unconfirmed: bool = False
+    caveat: str = ""
 
 
 def _match_entries(
@@ -256,13 +324,17 @@ def _match_entries(
     version = item.version
     if not version:
         return
+    if is_commit_hash(version):
+        return
+    backported = bool(item.os)
+    caveat = "distro backport likely — patchlevel not in banner" if backported else ""
     for entry in entries:
         ranges = cast("list[dict[str, str]]", entry.get("ranges") or [])
         hit_rng = next((r for r in ranges if _in_range(version, r)), None)
         if hit_rng is None:
             continue
         cve_id = str(entry["id"])
-        confidence = _confidence(version, hit_rng, item.source)
+        confidence = _confidence(version, hit_rng, item.source, backported=backported)
         record = agg.get(cve_id)
         if record is None:
             record = _CveAgg(
@@ -274,13 +346,20 @@ def _match_entries(
                 confidence=confidence,
                 summary=str(entry.get("summary", "")),
                 url=entry.get("url"),
+                unconfirmed=backported,
+                caveat=caveat,
             )
             agg[cve_id] = record
         if item.location:
             record.locations.add(item.location)
         if item.source:
             record.sources.add(item.source)
-        if confidence > record.confidence:
+        if backported:
+            record.unconfirmed = True
+            record.caveat = caveat
+            if confidence < record.confidence:
+                record.confidence = confidence
+        elif confidence > record.confidence:
             record.confidence = confidence
             record.version = version
 
@@ -298,6 +377,8 @@ def _agg_to_matches(agg: dict[str, _CveAgg]) -> list[CveMatch]:
             url=r.url,
             locations=tuple(sorted(r.locations)),
             sources=tuple(sorted(r.sources)),
+            unconfirmed=r.unconfirmed,
+            caveat=r.caveat,
         )
         for r in agg.values()
     ]
@@ -331,7 +412,7 @@ def merge_cve_matches(offline: list[CveMatch], online: list[CveMatch]) -> list[C
     return _sort_matches(list(by_id.values()))
 
 
-def match_cves(software: list[Software]) -> list[CveMatch]:
+def match_cves(software: list[Software], *, min_confidence: int = 0) -> list[CveMatch]:
     db = load_cve_db()
     agg: dict[str, _CveAgg] = {}
     for item in software:
@@ -341,7 +422,10 @@ def match_cves(software: list[Software]) -> list[CveMatch]:
         entries = db.get(product_key)
         if entries:
             _match_entries(item, product_key, entries, agg)
-    return _agg_to_matches(agg)
+    matches = _agg_to_matches(agg)
+    if min_confidence > 0:
+        matches = [m for m in matches if m.confidence >= min_confidence]
+    return matches
 
 
 _NVD_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
@@ -418,7 +502,7 @@ def _nvd_summary(descriptions: list[dict[str, str]]) -> str:
 
 
 async def match_cves_online(
-    software: list[Software], *, timeout: float = 25.0, workers: int = 3
+    software: list[Software], *, timeout: float = 25.0, workers: int = 3, min_confidence: int = 0
 ) -> list[CveMatch]:
     import aiohttp
 
@@ -455,4 +539,7 @@ async def match_cves_online(
     for (product_key, item), entries in zip(products.items(), gathered, strict=True):
         if entries:
             _match_entries(item, product_key, entries, agg)
-    return _agg_to_matches(agg)
+    matches = _agg_to_matches(agg)
+    if min_confidence > 0:
+        matches = [m for m in matches if m.confidence >= min_confidence]
+    return matches