stackscan 2.2.2__tar.gz → 2.5.0__tar.gz

{stackscan-2.2.2 → stackscan-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackscan
-Version: 2.2.2
+Version: 2.5.0
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues
@@ -117,7 +117,7 @@ stackscan --cve-online example.com
 
 # Speed / coverage knobs
 stackscan --full --workers 500 --subdomain-limit 10000 example.com
-stackscan --full --site-limit 10 --workers 200 example.com
+stackscan --full --site-limit 20 --workers 200 example.com
 
 # JSON (full detail, includes timing) or a compact table
 stackscan --json example.com
@@ -169,7 +169,8 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--ports` / `--no-nmap` | off | Active port scan (nmap, else Python) / force the Python scanner. |
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
-| `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--site-limit` | `50` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--cve-min-confidence` | `50` | Hide CVE matches with confidence below N (`0` shows all). |
 | `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
 | `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |

{stackscan-2.2.2 → stackscan-2.5.0}/README.md

@@ -79,7 +79,7 @@ stackscan --cve-online example.com
 
 # Speed / coverage knobs
 stackscan --full --workers 500 --subdomain-limit 10000 example.com
-stackscan --full --site-limit 10 --workers 200 example.com
+stackscan --full --site-limit 20 --workers 200 example.com
 
 # JSON (full detail, includes timing) or a compact table
 stackscan --json example.com
@@ -131,7 +131,8 @@ Below are performance benchmarks conducted on two production targets using diffe
 | `--ports` / `--no-nmap` | off | Active port scan (nmap, else Python) / force the Python scanner. |
 | `--subdomains` | off | Enumerate subdomains (AXFR + wordlist + TLS SANs). |
 | `--subdomain-limit` | `5000` | Max ranked labels to resolve (`0` = full list). |
-| `--site-limit` | `20` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--site-limit` | `50` | Max derived sites to analyze from discovered open ports (`0` = unlimited). |
+| `--cve-min-confidence` | `50` | Hide CVE matches with confidence below N (`0` shows all). |
 | `--default-creds` | off | Bounded default-credential / open-device check (prompts before brute-forcing). |
 | `--full-auto` | off | Auto-accept every brute prompt on discovered devices (enables default-cred checks). |
 | `--cred-limit` | `50` | Max default-credential pairs per device (`0` = full SecLists list). |

{stackscan-2.2.2 → stackscan-2.5.0}/scripts/build_cve_db.py

@@ -138,6 +138,16 @@ def ranges_for(cve: dict[str, Any], needle: str) -> list[dict[str, str]]:
     return out
 
 
+def _skip_entry(cve: dict[str, Any]) -> bool:
+    status = str(cve.get("vulnStatus", "")).upper()
+    if status in {"REJECTED", "REPLACED", "DEPRECATED"}:
+        return True
+    descriptions = cve.get("descriptions") or []
+    if not english_summary(descriptions):
+        return True
+    return False
+
+
 def collect(product: str, vendor_product: str, throttle: float) -> list[dict[str, Any]]:
     needle = ":" + vendor_product + ":"
     entries: list[dict[str, Any]] = []
@@ -149,6 +159,8 @@ def collect(product: str, vendor_product: str, throttle: float) -> list[dict[str
         vulns = payload.get("vulnerabilities") or []
         for wrapper in vulns:
             cve = wrapper["cve"]
+            if _skip_entry(cve):
+                continue
             ranges = ranges_for(cve, needle)
             if not ranges:
                 continue

{stackscan-2.2.2 → stackscan-2.5.0}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.2.2"
+__version__ = "2.5.0"

{stackscan-2.2.2 → stackscan-2.5.0}/src/stackscan/analyzers/__init__.py

@@ -7,7 +7,7 @@ from stackscan.analyzers.cve import (
     software_from_ports,
 )
 from stackscan.analyzers.exposure import ExposureProbe, analyze_exposure
-from stackscan.analyzers.infra import analyze_infra
+from stackscan.analyzers.infra import analyze_infra, summarize_edge
 from stackscan.analyzers.osdetect import detect_os
 from stackscan.analyzers.security import analyze_security_headers
 from stackscan.analyzers.services import classify_services, port_category
@@ -19,6 +19,7 @@ __all__ = [
     "TechAnalyzer",
     "analyze_exposure",
     "analyze_infra",
+    "summarize_edge",
     "analyze_security_headers",
     "brute_devices",
     "detect_devices",

{stackscan-2.2.2 → stackscan-2.5.0}/src/stackscan/analyzers/cve.py

@@ -9,12 +9,13 @@ from functools import lru_cache
 from importlib import resources
 from typing import Any, cast
 
+from stackscan.analyzers.generic import SERVER_NAMES, extract_generic_software, is_commit_hash
 from stackscan.types import CveMatch, Headers, PortScan, Software
 
 CveEntry = dict[str, Any]
 _BACKPORT_DISTRO_RE = re.compile(
     r"(0?ubuntu0?[._]\d[\d.]+)"
-    r"|\b(ubuntu|debian|centos|rhel|red\s*hat|fedora|amzn|amazon|rocky|almalinux|alpine|raspbian|suse|opensuse)\b"
+    r"|\b(ubuntu|debian|centos|rhel|red\s*hat|fedora|amzn|amazon|rocky|almalinux|alpine|raspbian|suse|opensuse|oracle|sles)\b"
     r"|(\+deb\d+u?\d*)"
     r"|(-\d+ubuntu\d+(?![\d._]))"
     r"|(el\d+)"
@@ -99,7 +100,10 @@ _JQUERY_RE = re.compile("jquery[-/]?v?(\\d+\\.\\d+(?:\\.\\d+)?)", re.IGNORECASE)
 _GENERATOR_RE = re.compile(
     "<meta[^>]+name=[\\\"']generator[\\\"'][^>]+content=[\\\"']([^\\\"']+)[\\\"']", re.IGNORECASE
 )
-_SSH_RE = re.compile("openssh[_/-]?(\\d+\\.\\d+(?:p\\d+)?)", re.IGNORECASE)
+_SSH_RE = re.compile(r"openssh[\s_/:-](\d+\.\d+(?:p\d+)?)", re.IGNORECASE)
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
+)
 
 
 @lru_cache(maxsize=1)
@@ -177,8 +181,26 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
     server = headers.get("server")
     if server:
         server_os = _distro_tag(server)
-        for item in _tokens(server, "header:server", location, os=server_os):
+        server_items = _tokens(server, "header:server", location, os=server_os)
+        for item in server_items:
             add(item)
+        # If the Server banner names a known product without a version (e.g.
+        # "nginx" or "Apache"), still record it so it shows up in the software
+        # table even when no CVE can be matched yet.
+        if not server_items:
+            server_lower = server.lower()
+            for name in sorted(SERVER_NAMES, key=len, reverse=True):
+                if name in server_lower:
+                    add(
+                        Software(
+                            name=name.lower().replace(" ", ""),
+                            version=None,
+                            source="header:server",
+                            location=location,
+                            os=server_os,
+                        )
+                    )
+                    break
     powered = headers.get("x-powered-by")
     if powered:
         for item in _tokens(powered, "header:x-powered-by", location):
@@ -199,6 +221,22 @@ def extract_software(headers: Headers, body: str, location: str = "") -> list[So
                     location=location,
                 )
             )
+    core_match = _CORE_COMMIT_RE.search(body)
+    if core_match:
+        product = core_match.group(1).strip()
+        commit = core_match.group(2).lower()
+        if product:
+            add(
+                Software(
+                    name=product.lower().replace(" ", ""),
+                    version=commit,
+                    source="body:core-commit",
+                    location=location,
+                )
+            )
+
+    for item in extract_generic_software(body, location=location):
+        add(item)
     return software
 
 
@@ -211,6 +249,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
         if not blob:
             continue
         location = f"{port.host}:{port.port}" if port.host else f":{port.port}"
+        port_os = port.os or _distro_tag(blob)
         ssh = _SSH_RE.search(blob)
         if ssh:
             out.append(
@@ -219,7 +258,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                     version=ssh.group(1),
                     source="port-banner",
                     location=location,
-                    os=port.os,
+                    os=port_os,
                 )
             )
             continue
@@ -230,7 +269,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                     version=port.version,
                     source="port-banner",
                     location=location,
-                    os=port.os,
+                    os=port_os,
                 )
             )
     return out
@@ -240,7 +279,11 @@ _AUTHORITATIVE = {"header:server", "header:x-powered-by", "port-banner"}
 _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 
-def _confidence(version: str, rng: dict[str, str], source: str) -> int:
+def _confidence(version: str, rng: dict[str, str], source: str, backported: bool = False) -> int:
+    if backported:
+        if "start_incl" in rng or "start_excl" in rng:
+            return 35
+        return 20
     comps = len([c for c in re.split("[.\\-_]", version) if c[:1].isdigit()])
     bounded = ("start_incl" in rng or "start_excl" in rng) and (
         "end_incl" in rng or "end_excl" in rng
@@ -278,6 +321,8 @@ def _match_entries(
     version = item.version
     if not version:
         return
+    if is_commit_hash(version):
+        return
     backported = bool(item.os)
     caveat = "distro backport likely — patchlevel not in banner" if backported else ""
     for entry in entries:
@@ -286,7 +331,7 @@ def _match_entries(
         if hit_rng is None:
             continue
         cve_id = str(entry["id"])
-        confidence = 40 if backported else _confidence(version, hit_rng, item.source)
+        confidence = _confidence(version, hit_rng, item.source, backported=backported)
         record = agg.get(cve_id)
         if record is None:
             record = _CveAgg(
@@ -309,7 +354,8 @@ def _match_entries(
         if backported:
             record.unconfirmed = True
             record.caveat = caveat
-            record.confidence = min(record.confidence, 40)
+            if confidence < record.confidence:
+                record.confidence = confidence
         elif confidence > record.confidence:
             record.confidence = confidence
             record.version = version
@@ -363,7 +409,7 @@ def merge_cve_matches(offline: list[CveMatch], online: list[CveMatch]) -> list[C
     return _sort_matches(list(by_id.values()))
 
 
-def match_cves(software: list[Software]) -> list[CveMatch]:
+def match_cves(software: list[Software], *, min_confidence: int = 0) -> list[CveMatch]:
     db = load_cve_db()
     agg: dict[str, _CveAgg] = {}
     for item in software:
@@ -373,7 +419,10 @@ def match_cves(software: list[Software]) -> list[CveMatch]:
         entries = db.get(product_key)
         if entries:
             _match_entries(item, product_key, entries, agg)
-    return _agg_to_matches(agg)
+    matches = _agg_to_matches(agg)
+    if min_confidence > 0:
+        matches = [m for m in matches if m.confidence >= min_confidence]
+    return matches
 
 
 _NVD_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
@@ -450,7 +499,7 @@ def _nvd_summary(descriptions: list[dict[str, str]]) -> str:
 
 
 async def match_cves_online(
-    software: list[Software], *, timeout: float = 25.0, workers: int = 3
+    software: list[Software], *, timeout: float = 25.0, workers: int = 3, min_confidence: int = 0
 ) -> list[CveMatch]:
     import aiohttp
 
@@ -487,4 +536,7 @@ async def match_cves_online(
     for (product_key, item), entries in zip(products.items(), gathered, strict=True):
         if entries:
             _match_entries(item, product_key, entries, agg)
-    return _agg_to_matches(agg)
+    matches = _agg_to_matches(agg)
+    if min_confidence > 0:
+        matches = [m for m in matches if m.confidence >= min_confidence]
+    return matches

stackscan-2.5.0/src/stackscan/analyzers/generic.py

@@ -0,0 +1,319 @@
+from __future__ import annotations
+
+import re
+
+from stackscan.types import Software, Technology
+
+SERVER_NAMES: frozenset[str] = frozenset(
+    {
+        "nginx",
+        "apache",
+        "httpd",
+        "lighttpd",
+        "litespeed",
+        "caddy",
+        "openresty",
+        "iis",
+        "microsoft-iis",
+        "cherokee",
+        "h2o",
+        "boa",
+        "thttpd",
+        "mini_httpd",
+        "rejetto",
+        "cowboy",
+        "tornado",
+        "gunicorn",
+        "uwsgi",
+        "jetty",
+        "tomcat",
+        "apache tomcat",
+        "websphere",
+        "glassfish",
+        "play",
+        "spray",
+        "kestrel",
+        "cassini",
+        "kangle",
+        "resin",
+        "weblogic",
+        "zope",
+        "aolserver",
+        "yaws",
+    }
+)
+
+# Product names we never want to emit as a generic technology/software hit.
+_NOISE_NAMES: frozenset[str] = frozenset(
+    {
+        "http",
+        "https",
+        "www",
+        "html",
+        "css",
+        "json",
+        "xml",
+        "js",
+        "png",
+        "jpg",
+        "jpeg",
+        "gif",
+        "svg",
+        "ico",
+        "woff",
+        "woff2",
+        "ttf",
+        "eot",
+        "php",
+        "asp",
+        "aspx",
+        "jsp",
+        "cgi",
+    }
+)
+
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s_-]{1,40})\s+Core\s+\(([a-f0-9]{4,})\b\)", re.IGNORECASE
+)
+
+_POWERED_BY_VERSION_RE = re.compile(
+    r"(?:powered\s+by|running\s+on|built\s+with|made\s+with)\s+"
+    r"([A-Za-z][A-Za-z0-9_-]*(?:\s+[A-Za-z][A-Za-z0-9_-]*){0,4})"
+    r"\s+(?:v\.?|version\s*)?(\d+\.\d+(?:\.\d+)?)",
+    re.IGNORECASE,
+)
+
+_POWERED_BY_PLAIN_RE = re.compile(
+    r"(?:powered\s+by|running\s+on|built\s+with|made\s+with)\s+"
+    r"([A-Za-z][A-Za-z0-9_-]*(?:\s+[A-Za-z][A-Za-z0-9_-]*){0,4})"
+    r"(?!\s+(?:v\.?|version\s*)?\d)",
+    re.IGNORECASE,
+)
+
+_SERVER_VERSION_RE = re.compile(
+    r"\b("
+    + "|".join(re.escape(name) for name in sorted(SERVER_NAMES, key=len, reverse=True))
+    + r")[/ ]v?(\d+\.\d+(?:\.\d+){0,2})",
+    re.IGNORECASE,
+)
+
+_COMMIT_AFTER_NAME_RE = re.compile(
+    r"\b([A-Za-z][A-Za-z0-9._-]{1,40})\s+\(([a-f0-9]{7,40})\)", re.IGNORECASE
+)
+
+_STOPWORDS: frozenset[str] = frozenset(
+    {
+        "and",
+        "or",
+        "the",
+        "a",
+        "an",
+        "with",
+        "for",
+        "to",
+        "of",
+        "in",
+        "on",
+        "our",
+        "your",
+        "my",
+        "this",
+        "that",
+        "is",
+        "are",
+        "was",
+        "were",
+        "by",
+        "from",
+        "using",
+        "use",
+        "plus",
+        "via",
+    }
+)
+
+
+_VERSION_TOKEN_RE = re.compile(r"^v?\d[\w.]*$", re.IGNORECASE)
+
+
+def _normalize_name(name: str) -> str:
+    return " ".join(name.split()).strip()
+
+
+def _clean_product_name(name: str) -> str:
+    kept: list[str] = []
+    for word in _normalize_name(name).split():
+        if word.lower() in _STOPWORDS:
+            break
+        kept.append(word)
+    while len(kept) > 1 and _VERSION_TOKEN_RE.match(kept[-1]):
+        kept.pop()
+    return " ".join(kept)
+
+
+def _software_name(name: str) -> str:
+    return _normalize_name(name).lower().replace(" ", "")
+
+
+def _category(name: str) -> str:
+    if _software_name(name) in {n.replace(" ", "") for n in SERVER_NAMES}:
+        return "infrastructure"
+    return "service"
+
+
+def _is_noise(name: str) -> bool:
+    return _software_name(name) in _NOISE_NAMES
+
+
+def _is_plausible_name(name: str) -> bool:
+    """Reject single-letter-plus-digit noise (e.g. SVG path commands like M368)."""
+    return sum(1 for ch in name if ch.isalpha()) >= 2
+
+
+def is_commit_hash(value: str) -> bool:
+    """Return True when value looks like a Git commit hash rather than a version."""
+    if len(value) < 7:
+        return False
+    if value.startswith("v"):
+        return False
+    return bool(re.fullmatch(r"[a-f0-9]{7,40}", value))
+
+
+def extract_generic_tech(body: str) -> list[Technology]:
+    hits: list[tuple[str, str, str, str | None]] = []
+    seen: set[tuple[str, str | None]] = set()
+
+    def remember(name: str, evidence: str, version: str | None) -> None:
+        name = _clean_product_name(name)
+        if len(name) < 2 or _is_noise(name) or not _is_plausible_name(name):
+            return
+        key = (name.lower(), version)
+        if key in seen:
+            return
+        seen.add(key)
+        hits.append((name, evidence, _category(name), version))
+
+    for match in _SERVER_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        remember(name, f"body:{name}/{version}", version)
+
+    powered_starts: set[int] = set()
+    for match in _POWERED_BY_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        powered_starts.add(match.start())
+        if name and not _is_noise(name):
+            remember(name, f"body:powered-by {name} {version}", version)
+
+    for match in _POWERED_BY_PLAIN_RE.finditer(body):
+        if match.start() in powered_starts:
+            continue
+        name = _normalize_name(match.group(1))
+        if name and not _is_noise(name):
+            remember(name, f"body:powered-by {name}", None)
+
+    core_spans: set[tuple[int, int]] = set()
+    for match in _CORE_COMMIT_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name and not _is_noise(name):
+            remember(name, f"body:{name} Core ({commit})", commit)
+        core_spans.add(match.span())
+
+    def _overlaps_core(span: tuple[int, int]) -> bool:
+        start, end = span
+        for c_start, c_end in core_spans:
+            if start < c_end and end > c_start:
+                return True
+        return False
+
+    for match in _COMMIT_AFTER_NAME_RE.finditer(body):
+        if _overlaps_core(match.span()):
+            continue
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name and not _is_noise(name) and is_commit_hash(commit):
+            if (name.lower(), commit) not in seen:
+                remember(name, f"body:{name} ({commit})", commit)
+
+    return [
+        Technology(
+            name=name,
+            categories=(category,),
+            evidence=(evidence,),
+            confidence=70,
+            version=version,
+        )
+        for name, evidence, category, version in hits
+    ]
+
+
+def extract_generic_software(body: str, location: str = "") -> list[Software]:
+    out: list[Software] = []
+    seen: set[tuple[str, str | None]] = set()
+
+    def add(name: str, version: str | None, evidence: str) -> None:
+        name = _clean_product_name(name)
+        if len(name) < 2 or not _is_plausible_name(name):
+            return
+        sname = _software_name(name)
+        if sname in _NOISE_NAMES:
+            return
+        key = (sname, version)
+        if key in seen:
+            return
+        seen.add(key)
+        out.append(
+            Software(
+                name=sname,
+                version=version,
+                source=evidence,
+                location=location,
+            )
+        )
+
+    for match in _SERVER_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        add(name, version, f"body:{name}/{version}")
+
+    powered_starts: set[int] = set()
+    for match in _POWERED_BY_VERSION_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        version = match.group(2)
+        powered_starts.add(match.start())
+        if name:
+            add(name, version, f"body:powered-by {name} {version}")
+
+    for match in _POWERED_BY_PLAIN_RE.finditer(body):
+        if match.start() in powered_starts:
+            continue
+        name = _normalize_name(match.group(1))
+        if name:
+            add(name, None, f"body:powered-by {name}")
+
+    core_spans: set[tuple[int, int]] = set()
+    for match in _CORE_COMMIT_RE.finditer(body):
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name:
+            add(name, commit, f"body:core-commit {name} ({commit})")
+        core_spans.add(match.span())
+
+    def _overlaps_core(span: tuple[int, int]) -> bool:
+        start, end = span
+        for c_start, c_end in core_spans:
+            if start < c_end and end > c_start:
+                return True
+        return False
+
+    for match in _COMMIT_AFTER_NAME_RE.finditer(body):
+        if _overlaps_core(match.span()):
+            continue
+        name = _normalize_name(match.group(1))
+        commit = match.group(2).lower()
+        if name and is_commit_hash(commit):
+            add(name, commit, f"body:commit {name} ({commit})")
+
+    return out

{stackscan-2.2.2 → stackscan-2.5.0}/src/stackscan/analyzers/infra.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from collections.abc import Iterable
+
 from stackscan.types import Headers, InfraInfo
 
 _Signature = tuple[str, str, str | None]
@@ -92,6 +94,61 @@ def _proxy_notes(headers: Headers, host: str) -> list[str]:
     return notes
 
 
+_ROLE_LABEL: dict[str, str] = {"cdn": "CDN", "waf": "WAF", "proxy": "reverse proxy"}
+_ROLE_ORDER: tuple[str, ...] = ("cdn", "waf", "proxy")
+_ORG_SUFFIXES: tuple[str, ...] = (
+    ", inc.",
+    ", inc",
+    " inc.",
+    " inc",
+    " llc",
+    " ltd",
+    " ltd.",
+    " gmbh",
+    " corporation",
+    " technologies",
+)
+
+
+def _canonical_provider(org: str) -> str:
+    name = org.strip()
+    low = name.lower()
+    for suffix in _ORG_SUFFIXES:
+        if low.endswith(suffix):
+            name = name[: -len(suffix)].strip()
+            low = name.lower()
+    return name
+
+
+def summarize_edge(infra: InfraInfo, cdn_orgs: Iterable[str] = (), *, sep: str = " → ") -> str:
+    roles: dict[str, list[str]] = {}
+    order: list[str] = []
+    role_names = {"cdn": infra.cdn, "waf": infra.waf, "proxy": infra.proxy}
+    for role in _ROLE_ORDER:
+        for name in role_names[role]:
+            if name not in roles:
+                roles[name] = []
+                order.append(name)
+            if role not in roles[name]:
+                roles[name].append(role)
+    for org in cdn_orgs:
+        name = _canonical_provider(org)
+        if not name:
+            continue
+        if any(name.lower() in known.lower() or known.lower() in name.lower() for known in roles):
+            continue
+        roles[name] = ["cdn"]
+        order.append(name)
+    if not order:
+        return ""
+    order.sort(key=lambda n: 0 if ({"waf", "proxy"} & set(roles[n])) else 1)
+    parts: list[str] = []
+    for name in order:
+        labels = ", ".join(_ROLE_LABEL[r] for r in _ROLE_ORDER if r in roles[name])
+        parts.append(f"{name} ({labels})" if labels else name)
+    return sep.join(parts)
+
+
 def analyze_infra(headers: Headers, cookies: tuple[str, ...], host: str) -> InfraInfo:
     cdn = _collect(headers, CDN_SIGNATURES)
     waf = _collect(headers, WAF_SIGNATURES)

{stackscan-2.2.2 → stackscan-2.5.0}/src/stackscan/analyzers/osdetect.py

@@ -106,7 +106,9 @@ def detect_os(report: ScanReport) -> list[OsFinding]:
         for os, src in pairs:
             by_source.setdefault(src, []).append(os)
         dominant_source = max(by_source, key=lambda s: len(by_source[s]))
-        if dominant_source == "port-banner" or dominant_source.startswith(("header:", "meta:", "script")):
+        if dominant_source == "port-banner" or dominant_source.startswith(
+            ("header:", "meta:", "script")
+        ):
             category = "banner"
         elif dominant_source.startswith("port "):
             category = "network"