stackscan 2.2.2__tar.gz → 2.3.0__tar.gz

{stackscan-2.2.2 → stackscan-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackscan
-Version: 2.2.2
+Version: 2.3.0
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues
@@ -117,7 +117,7 @@ stackscan --cve-online example.com
 
 # Speed / coverage knobs
 stackscan --full --workers 500 --subdomain-limit 10000 example.com
-stackscan --full --site-limit 10 --workers 200 example.com
+stackscan --full --site-limit 20 --workers 200 example.com
 
 # JSON (full detail, includes timing) or a compact table
 stackscan --json example.com
@@ -169,7 +169,8 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--ports` / `--no-nmap` | off | Active port scan (nmap, else Python) / force the Python scanner. |
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
-| `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--site-limit` | `50` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--cve-min-confidence` | `50` | Hide CVE matches with confidence below N (`0` shows all). |
 | `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
 | `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |

{stackscan-2.2.2 → stackscan-2.3.0}/README.md

@@ -79,7 +79,7 @@ stackscan --cve-online example.com
 
 # Speed / coverage knobs
 stackscan --full --workers 500 --subdomain-limit 10000 example.com
-stackscan --full --site-limit 10 --workers 200 example.com
+stackscan --full --site-limit 20 --workers 200 example.com
 
 # JSON (full detail, includes timing) or a compact table
 stackscan --json example.com
@@ -131,7 +131,8 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--ports` / `--no-nmap` | off | Active port scan (nmap, else Python) / force the Python scanner. |
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
-| `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--site-limit` | `50` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--cve-min-confidence` | `50` | Hide CVE matches with confidence below N (`0` shows all). |
 | `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
 | `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |

{stackscan-2.2.2 → stackscan-2.3.0}/scripts/build_cve_db.py

@@ -138,6 +138,16 @@ def ranges_for(cve: dict[str, Any], needle: str) -> list[dict[str, str]]:
     return out
 
 
+def _skip_entry(cve: dict[str, Any]) -> bool:
+    status = str(cve.get("vulnStatus", "")).upper()
+    if status in {"REJECTED", "REPLACED", "DEPRECATED"}:
+        return True
+    descriptions = cve.get("descriptions") or []
+    if not english_summary(descriptions):
+        return True
+    return False
+
+
 def collect(product: str, vendor_product: str, throttle: float) -> list[dict[str, Any]]:
     needle = ":" + vendor_product + ":"
     entries: list[dict[str, Any]] = []
@@ -149,6 +159,8 @@ def collect(product: str, vendor_product: str, throttle: float) -> list[dict[str
         vulns = payload.get("vulnerabilities") or []
         for wrapper in vulns:
             cve = wrapper["cve"]
+            if _skip_entry(cve):
+                continue
             ranges = ranges_for(cve, needle)
             if not ranges:
                 continue

{stackscan-2.2.2 → stackscan-2.3.0}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.2.2"
+__version__ = "2.3.0"

{stackscan-2.2.2 → stackscan-2.3.0}/src/stackscan/analyzers/cve.py

@@ -9,12 +9,13 @@ from functools import lru_cache
 from importlib import resources
 from typing import Any, cast
 
+from stackscan.analyzers.generic import SERVER_NAMES, extract_generic_software, is_commit_hash
 from stackscan.types import CveMatch, Headers, PortScan, Software
 
 CveEntry = dict[str, Any]
 _BACKPORT_DISTRO_RE = re.compile(
     r"(0?ubuntu0?[._]\d[\d.]+)"
-    r"|\b(ubuntu|debian|centos|rhel|red\s*hat|fedora|amzn|amazon|rocky|almalinux|alpine|raspbian|suse|opensuse)\b"
+    r"|\b(ubuntu|debian|centos|rhel|red\s*hat|fedora|amzn|amazon|rocky|almalinux|alpine|raspbian|suse|opensuse|oracle|sles)\b"
     r"|(\+deb\d+u?\d*)"
     r"|(-\d+ubuntu\d+(?![\d._]))"
     r"|(el\d+)"
@@ -99,7 +100,10 @@ _JQUERY_RE = re.compile("jquery[-/]?v?(\\d+\\.\\d+(?:\\.\\d+)?)", re.IGNORECASE)
 _GENERATOR_RE = re.compile(
     "<meta[^>]+name=[\\\"']generator[\\\"'][^>]+content=[\\\"']([^\\\"']+)[\\\"']", re.IGNORECASE
 )
-_SSH_RE = re.compile("openssh[_/-]?(\\d+\\.\\d+(?:p\\d+)?)", re.IGNORECASE)
+_SSH_RE = re.compile(r"openssh[\s_/:-](\d+\.\d+(?:p\d+)?)", re.IGNORECASE)
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
+)
 
 
 @lru_cache(maxsize=1)
@@ -177,8 +181,26 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
     server = headers.get("server")
     if server:
         server_os = _distro_tag(server)
-        for item in _tokens(server, "header:server", location, os=server_os):
+        server_items = _tokens(server, "header:server", location, os=server_os)
+        for item in server_items:
             add(item)
+        # If the Server banner names a known product without a version (e.g.
+        # "nginx" or "Apache"), still record it so it shows up in the software
+        # table even when no CVE can be matched yet.
+        if not server_items:
+            server_lower = server.lower()
+            for name in sorted(SERVER_NAMES, key=len, reverse=True):
+                if name in server_lower:
+                    add(
+                        Software(
+                            name=name.lower().replace(" ", ""),
+                            version=None,
+                            source="header:server",
+                            location=location,
+                            os=server_os,
+                        )
+                    )
+                    break
     powered = headers.get("x-powered-by")
     if powered:
         for item in _tokens(powered, "header:x-powered-by", location):
@@ -199,6 +221,22 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
                     location=location,
                 )
             )
+    core_match = _CORE_COMMIT_RE.search(body)
+    if core_match:
+        product = core_match.group(1).strip()
+        commit = core_match.group(2).lower()
+        if product:
+            add(
+                Software(
+                    name=product.lower().replace(" ", ""),
+                    version=commit,
+                    source="body:core-commit",
+                    location=location,
+                )
+            )
+
+    for item in extract_generic_software(body, location=location):
+        add(item)
     return software
 
 
@@ -211,6 +249,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
         if not blob:
             continue
         location = f"{port.host}:{port.port}" if port.host else f":{port.port}"
+        port_os = port.os or _distro_tag(blob)
         ssh = _SSH_RE.search(blob)
         if ssh:
             out.append(
@@ -219,7 +258,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                     version=ssh.group(1),
                     source="port-banner",
                     location=location,
-                    os=port.os,
+                    os=port_os,
                 )
             )
             continue
@@ -230,7 +269,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                     version=port.version,
                     source="port-banner",
                     location=location,
-                    os=port.os,
+                    os=port_os,
                 )
             )
     return out
@@ -240,7 +279,14 @@ _AUTHORITATIVE = {"header:server", "header:x-powered-by", "port-banner"}
 _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 
-def _confidence(version: str, rng: dict[str, str], source: str) -> int:
+def _confidence(version: str, rng: dict[str, str], source: str, backported: bool = False) -> int:
+    if backported:
+        # Distro backports are a common source of phantom CVEs because the
+        # banner version does not reveal the patchlevel. Keep them below the
+        # default confidence threshold so they only appear when explicitly asked.
+        if "start_incl" in rng or "start_excl" in rng:
+            return 45
+        return 25
     comps = len([c for c in re.split("[.\\-_]", version) if c[:1].isdigit()])
     bounded = ("start_incl" in rng or "start_excl" in rng) and (
         "end_incl" in rng or "end_excl" in rng
@@ -278,6 +324,8 @@ def _match_entries(
     version = item.version
     if not version:
         return
+    if is_commit_hash(version):
+        return
     backported = bool(item.os)
     caveat = "distro backport likely — patchlevel not in banner" if backported else ""
     for entry in entries:
@@ -286,7 +334,7 @@ def _match_entries(
         if hit_rng is None:
             continue
         cve_id = str(entry["id"])
-        confidence = 40 if backported else _confidence(version, hit_rng, item.source)
+        confidence = _confidence(version, hit_rng, item.source, backported=backported)
         record = agg.get(cve_id)
         if record is None:
             record = _CveAgg(
@@ -309,7 +357,8 @@ def _match_entries(
         if backported:
             record.unconfirmed = True
             record.caveat = caveat
-            record.confidence = min(record.confidence, 40)
+            if confidence < record.confidence:
+                record.confidence = confidence
         elif confidence > record.confidence:
             record.confidence = confidence
             record.version = version
@@ -363,7 +412,7 @@ def merge_cve_matches(offline: list[CveMatch], online: list[CveMatch]) -> list[C
     return _sort_matches(list(by_id.values()))
 
 
-def match_cves(software: list[Software]) -> list[CveMatch]:
+def match_cves(software: list[Software], *, min_confidence: int = 0) -> list[CveMatch]:
     db = load_cve_db()
     agg: dict[str, _CveAgg] = {}
     for item in software:
@@ -373,7 +422,10 @@ def match_cves(software: list[Software]) -> list[CveMatch]:
         entries = db.get(product_key)
         if entries:
             _match_entries(item, product_key, entries, agg)
-    return _agg_to_matches(agg)
+    matches = _agg_to_matches(agg)
+    if min_confidence > 0:
+        matches = [m for m in matches if m.confidence >= min_confidence]
+    return matches
 
 
 _NVD_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
@@ -450,7 +502,7 @@ def _nvd_summary(descriptions: list[dict[str, str]]) -> str:
 
 
 async def match_cves_online(
-    software: list[Software], *, timeout: float = 25.0, workers: int = 3
+    software: list[Software], *, timeout: float = 25.0, workers: int = 3, min_confidence: int = 0
 ) -> list[CveMatch]:
     import aiohttp
 
@@ -487,4 +539,7 @@ async def match_cves_online(
     for (product_key, item), entries in zip(products.items(), gathered, strict=True):
         if entries:
             _match_entries(item, product_key, entries, agg)
-    return _agg_to_matches(agg)
+    matches = _agg_to_matches(agg)
+    if min_confidence > 0:
+        matches = [m for m in matches if m.confidence >= min_confidence]
+    return matches

stackscan-2.3.0/src/stackscan/analyzers/generic.py

@@ -0,0 +1,271 @@
+from __future__ import annotations
+
+import re
+
+from stackscan.types import Software, Technology
+
+SERVER_NAMES: frozenset[str] = frozenset({
+    "nginx",
+    "apache",
+    "httpd",
+    "lighttpd",
+    "litespeed",
+    "caddy",
+    "openresty",
+    "iis",
+    "microsoft-iis",
+    "cherokee",
+    "h2o",
+    "boa",
+    "thttpd",
+    "mini_httpd",
+    "rejetto",
+    "cowboy",
+    "tornado",
+    "gunicorn",
+    "uwsgi",
+    "jetty",
+    "tomcat",
+    "apache tomcat",
+    "websphere",
+    "glassfish",
+    "play",
+    "spray",
+    "kestrel",
+    "cassini",
+    "kangle",
+    "resin",
+    "weblogic",
+    "zope",
+    "aolserver",
+    "yaws",
+})
+
+# Product names we never want to emit as a generic technology/software hit.
+_NOISE_NAMES: frozenset[str] = frozenset({
+    "http",
+    "https",
+    "www",
+    "html",
+    "css",
+    "json",
+    "xml",
+    "js",
+    "png",
+    "jpg",
+    "jpeg",
+    "gif",
+    "svg",
+    "ico",
+    "woff",
+    "woff2",
+    "ttf",
+    "eot",
+    "php",
+    "asp",
+    "aspx",
+    "jsp",
+    "cgi",
+})
+
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s_-]{1,40})\s+Core\s+\(([a-f0-9]{4,})\b\)", re.IGNORECASE
+)
+
+_POWERED_BY_VERSION_RE = re.compile(
+    r"(?:powered\s+by|running\s+on|built\s+with|made\s+with)\s+"
+    r"([A-Za-z][A-Za-z0-9_-]*(?:\s+[A-Za-z][A-Za-z0-9_-]*){0,4})"
+    r"\s+(?:v\.?|version\s*)?(\d+\.\d+(?:\.\d+)?)",
+    re.IGNORECASE,
+)
+
+_POWERED_BY_PLAIN_RE = re.compile(
+    r"(?:powered\s+by|running\s+on|built\s+with|made\s+with)\s+"
+    r"([A-Za-z][A-Za-z0-9_-]*(?:\s+[A-Za-z][A-Za-z0-9_-]*){0,4})"
+    r"(?!\s+(?:v\.?|version\s*)?\d)",
+    re.IGNORECASE,
+)
+
+_SERVER_VERSION_RE = re.compile(
+    r"\b("
+    + "|".join(re.escape(name) for name in sorted(SERVER_NAMES, key=len, reverse=True))
+    + r")[/ ]v?(\d+\.\d+(?:\.\d+){0,2})",
+    re.IGNORECASE,
+)
+
+_COMMIT_AFTER_NAME_RE = re.compile(
+    r"\b([A-Za-z][A-Za-z0-9\s_-]{1,40})\s+\(?([a-f0-9]{7,40})\b\)?", re.IGNORECASE
+)
+
+
+def _normalize_name(name: str) -> str:
+    return " ".join(name.split()).strip()
+
+
+def _software_name(name: str) -> str:
+    return _normalize_name(name).lower().replace(" ", "")
+
+
+def _category(name: str) -> str:
+    if _software_name(name) in {n.replace(" ", "") for n in SERVER_NAMES}:
+        return "infrastructure"
+    return "service"
+
+
+def _is_noise(name: str) -> bool:
+    return _software_name(name) in _NOISE_NAMES
+
+
+def _is_plausible_name(name: str) -> bool:
+    """Reject single-letter-plus-digit noise (e.g. SVG path commands like M368)."""
+    return sum(1 for ch in name if ch.isalpha()) >= 2
+
+
+def is_commit_hash(value: str) -> bool:
+    """Return True when value looks like a Git commit hash rather than a version."""
+    if len(value) < 7:
+        return False
+    if value.startswith("v"):
+        return False
+    return bool(re.fullmatch(r"[a-f0-9]{7,40}", value))
+
+
+def extract_generic_tech(body: str) -> list[Technology]:
+    """Return generic service/infrastructure technologies found in the body.
+
+    This is meant to catch products and commit hashes that do not have a
+    dedicated signature in the bundled database, e.g. a 404 page footer that
+    says ``nginx/1.24.0`` or ``CurseForge Core (a26fded)``.
+    """
+    hits: list[tuple[str, str, str, str | None]] = []
+    seen: set[tuple[str, str | None]] = set()
+
+    def remember(name: str, evidence: str, version: str | None) -> None:
+        name = _normalize_name(name)
+        if len(name) < 2 or _is_noise(name) or not _is_plausible_name(name):
+            return
+        key = (name.lower(), version)
+        if key in seen:
+            return
+        seen.add(key)
+        hits.append((name, evidence, _category(name), version))
+
+    for match in _SERVER_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        remember(name, f"body:{name}/{version}", version)
+
+    for match in _POWERED_BY_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        if name and not _is_noise(name):
+            remember(name, f"body:powered-by {name} {version}", version)
+
+    for match in _POWERED_BY_PLAIN_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        if name and not _is_noise(name):
+            remember(name, f"body:powered-by {name}", None)
+
+    core_spans: set[tuple[int, int]] = set()
+    for match in _CORE_COMMIT_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name and not _is_noise(name):
+            remember(name, f"body:{name} Core ({commit})", commit)
+        core_spans.add(match.span())
+
+    def _overlaps_core(span: tuple[int, int]) -> bool:
+        start, end = span
+        for c_start, c_end in core_spans:
+            if start < c_end and end > c_start:
+                return True
+        return False
+
+    # Product name directly followed by a short hex commit (no "Core" keyword).
+    for match in _COMMIT_AFTER_NAME_RE.finditer(body):
+        if _overlaps_core(match.span()):
+            continue
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name and not _is_noise(name) and is_commit_hash(commit):
+            # Prefer the Core match if we already have one for the same product.
+            if (name.lower(), commit) not in seen:
+                remember(name, f"body:{name} ({commit})", commit)
+
+    return [
+        Technology(
+            name=name,
+            categories=(category,),
+            evidence=(evidence,),
+            confidence=70,
+            version=version,
+        )
+        for name, evidence, category, version in hits
+    ]
+
+
+def extract_generic_software(body: str, location: str = "") -> list[Software]:
+    """Return Software records for generic product/version/commit patterns."""
+    out: list[Software] = []
+    seen: set[tuple[str, str | None]] = set()
+
+    def add(name: str, version: str | None, evidence: str) -> None:
+        name = _normalize_name(name)
+        if len(name) < 2 or not _is_plausible_name(name):
+            return
+        sname = _software_name(name)
+        if sname in _NOISE_NAMES:
+            return
+        key = (sname, version)
+        if key in seen:
+            return
+        seen.add(key)
+        out.append(
+            Software(
+                name=sname,
+                version=version,
+                source=evidence,
+                location=location,
+            )
+        )
+
+    for match in _SERVER_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        add(name, version, f"body:{name}/{version}")
+
+    for match in _POWERED_BY_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        if name:
+            add(name, version, f"body:powered-by {name} {version}")
+
+    for match in _POWERED_BY_PLAIN_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        if name:
+            add(name, None, f"body:powered-by {name}")
+
+    core_spans: set[tuple[int, int]] = set()
+    for match in _CORE_COMMIT_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name:
+            add(name, commit, f"body:core-commit {name} ({commit})")
+        core_spans.add(match.span())
+
+    def _overlaps_core(span: tuple[int, int]) -> bool:
+        start, end = span
+        for c_start, c_end in core_spans:
+            if start < c_end and end > c_start:
+                return True
+        return False
+
+    for match in _COMMIT_AFTER_NAME_RE.finditer(body):
+        if _overlaps_core(match.span()):
+            continue
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name and is_commit_hash(commit):
+            add(name, commit, f"body:commit {name} ({commit})")
+
+    return out

{stackscan-2.2.2 → stackscan-2.3.0}/src/stackscan/analyzers/services.py

@@ -143,6 +143,11 @@ def _tech_name(tech: Technology) -> str:
 
 
 def _service_from_tech(tech: Technology) -> ServiceFinding | None:
+    """Map meaningful technologies to service findings.
+
+    Generic infrastructure/proxy/service hits (nginx, Cloudflare, HTTP/3, …)
+    live in the Technologies table; they are intentionally not duplicated here.
+    """
     name = _tech_name(tech)
     if name in _ADMIN_TECHS:
         return ServiceFinding(
@@ -158,21 +163,6 @@ def _service_from_tech(tech: Technology) -> ServiceFinding | None:
             evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
             severity=_SEVERITY["database"],
         )
-    if name in _SECURITY_TECHS:
-        return ServiceFinding(
-            name=_SECURITY_TECHS[name],
-            kind="service",
-            evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
-            severity=_SEVERITY["service"],
-        )
-    for category in tech.categories or ():
-        if category in {"database", "service", "infrastructure", "security"}:
-            return ServiceFinding(
-                name=tech.name,
-                kind=category if category != "service" else "service",
-                evidence=" ".join(tech.evidence) or f"category: {category}",
-                severity=_SEVERITY.get(category, "INFO"),
-            )
     return None
 
 

{stackscan-2.2.2 → stackscan-2.3.0}/src/stackscan/analyzers/tech.py

@@ -4,6 +4,7 @@ import re
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any, cast
 
+from stackscan.analyzers.generic import extract_generic_tech
 from stackscan.types import FetchResult, Technology
 from stackscan.utils import host_of
 
@@ -39,6 +40,36 @@ def _script_srcs(html: str) -> list[str]:
 _CLASS_ATTR_RE = re.compile(r'\bclass\s*=\s*"([^"]*)"|\bclass\s*=\s*\'([^\']*)\'', re.I)
 
 
+_CSS_UTILITY_EXACT: frozenset[str] = frozenset({
+    "container", "flex", "grid", "block", "inline", "inline-block", "hidden",
+    "table", "table-cell", "table-row", "flow-root", "contents",
+    "float-left", "float-right", "float-none", "clear-left", "clear-right",
+    "clear-both", "clear-none", "isolate", "isolation-auto",
+    "object-contain", "object-cover", "object-fill", "object-none", "object-scale-down",
+    "overflow-auto", "overflow-hidden", "overflow-visible", "overflow-scroll",
+    "overscroll-auto", "overscroll-contain", "overscroll-none",
+    "visible", "invisible", "collapse",
+    "static", "fixed", "absolute", "relative", "sticky",
+})
+# Tailwind-style utilities: px-4, w-full, bg-red-500, my-auto, backdrop-blur, etc.
+_CSS_UTILITY_RE = re.compile(
+    r"^[a-z]+(-[a-z]+)?-(\d+|auto|full|screen|px|sm|md|lg|xl|2xl|3xl|4xl|5xl|6xl|7xl|8xl|9xl|none|hidden|visible|inherit|current|transparent|black|white|blur|opacity|saturate|sepia|grayscale|contrast|brightness|invert|drop-shadow|hue-rotate|shadow|sm|md|lg|xl)$",
+    re.IGNORECASE,
+)
+
+
+def _is_likely_css_utility(token: str) -> bool:
+    if token in _CSS_UTILITY_EXACT:
+        return True
+    lowered = token.lower()
+    if _CSS_UTILITY_RE.match(token):
+        return True
+    # Tailwind arbitrary values such as bg-[#123], w-[100px], top-[1px]
+    if "-[" in lowered and lowered.endswith("]"):
+        return True
+    return False
+
+
 def _framework_tokens(html: str) -> tuple[str, ...]:
     tokens: set[str] = set()
     for match in _CLASS_ATTR_RE.finditer(html):
@@ -47,7 +78,7 @@ def _framework_tokens(html: str) -> tuple[str, ...]:
             continue
         for token in value.split():
             token = token.strip()
-            if len(token) >= 3:
+            if len(token) >= 3 and not _is_likely_css_utility(token):
                 tokens.add(token)
     return tuple(tokens)
 
@@ -58,6 +89,7 @@ class _Hit:
     category: str | None = None
     evidence: list[str] = field(default_factory=list[str])
     item: SigDBItem | None = None
+    version: str | None = None
 
 
 _EVIDENCE_WEIGHTS: tuple[tuple[str, int], ...] = (
@@ -86,6 +118,7 @@ def _confidence(evidence: list[str]) -> int:
 
 
 _VERSION_RE = re.compile(r"(\d+\.\d+(?:\.\d+)?(?:[-+.]?[a-zA-Z0-9]+)?)")
+_CORE_COMMIT_RE = re.compile(r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE)
 
 
 def _version_key(version: str) -> tuple[int, int, int, int]:
@@ -262,7 +295,7 @@ class TechAnalyzer:
                 evidence=tuple(hit.evidence),
                 location=location,
                 confidence=_confidence(hit.evidence),
-                version=_infer_version(hit.item, hit.evidence),
+                version=hit.version or _infer_version(hit.item, hit.evidence),
             )
             for hit in by_name.values()
         ]
@@ -271,7 +304,7 @@ class TechAnalyzer:
 
     def _curated(self, acc: dict[str, _Hit], result: FetchResult) -> None:
 
-        def add(name: str, category: str, evidence: str) -> None:
+        def add(name: str, category: str, evidence: str, version: str | None = None) -> None:
             key = f"curated:{name.lower()}"
             hit = acc.get(key)
             if hit is None:
@@ -279,6 +312,8 @@ class TechAnalyzer:
                 acc[key] = hit
             if evidence not in hit.evidence:
                 hit.evidence.append(evidence)
+            if version and not hit.version:
+                hit.version = version
 
         for header, needle, name, category in _HEADER_TECH:
             value = result.headers.get(header)
@@ -293,3 +328,12 @@ class TechAnalyzer:
             for prefix, name, category in _COOKIE_TECH:
                 if cname.startswith(prefix):
                     add(name, category, f"cookie:{cname}")
+
+        for match in _CORE_COMMIT_RE.finditer(result.body):
+            name = match.group(1).strip()
+            commit = match.group(2).lower()
+            if name:
+                add(name, "service", f"body:{name} Core ({commit})", version=commit)
+
+        for tech in extract_generic_tech(result.body):
+            add(tech.name, tech.categories[0] if tech.categories else "service", tech.evidence[0], tech.version)