stackscan 2.6.0__tar.gz → 2.7.1__tar.gz

{stackscan-2.6.0 → stackscan-2.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: stackscan
-Version: 2.6.0
+Version: 2.7.1
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues
@@ -77,6 +77,26 @@ pip install "stackscan[geo]"   # offline IP geolocation via geoip2 + a MaxMind .
 `nmap` is used for port scans when present; without it a pure-Python scanner is
 used automatically.
 
+### Inside the reekeer shell
+
+stackscan is also a [reekeer](https://github.com/reekeer/reekeer) plugin, mounted
+at `/tools/recon/stackscan` (alias `ss`):
+
+```bash
+reekeer exec /plugins install reekeer/stackscan
+```
+
+Hosted there it drops the banner and the window title and hands the scan back as
+data for reekeer to render in the shell's own tables, so it reads as a command of
+the shell rather than a script being shelled out to. Every flag behaves the same,
+and standalone (`pip`, `uvx stackscan`) is unchanged.
+
+In reekeer's window the scan also gets a form. stackscan says which of its flags
+are worth a control — the targets, the four switches that decide how deep a scan
+goes, and the bounds worth changing when one is too slow — and reekeer draws
+those. The rest are not hidden: the argument line under the form still takes
+anything argparse takes, `--help` included.
+
 ---
 
 ## ✨ Features
@@ -194,6 +214,46 @@ Below are performance benchmarks conducted on two production targets using diffe
 
 ---
 
+## 🛰 Runner mode
+
+`stackscan --runner` turns the scanner into a worker for a StackScan panel: it
+claims jobs (`POST /api/jobs/claim`), fingerprints each target with the normal
+engine, and posts the results back (`POST /api/results`). It needs nothing but
+network access to the panel — no database, no Redis, no shared filesystem.
+
+```bash
+STACKSCAN_BACKEND_URL=https://panel.example STACKSCAN_WORKER_TOKEN=… \
+  stackscan --runner
+```
+
+| Variable | Default | What it is |
+| --- | --- | --- |
+| `STACKSCAN_BACKEND_URL` | `http://localhost:8787` | Panel base URL |
+| `STACKSCAN_WORKER_TOKEN` | — | Shared worker token, sent as `X-Worker-Token` |
+| `STACKSCAN_RUNNER_ID` | `runner-<host>-<pid>` | Stable id for this runner |
+| `STACKSCAN_RUNNER_BATCH` | `5` | Jobs claimed per cycle |
+| `STACKSCAN_RUNNER_IDLE` | `5` | Seconds to wait when the queue is empty |
+| `STACKSCAN_RUNNER` | — | Truthy value selects runner mode without the flag |
+
+Every one has a flag (`--backend`, `--worker-token`, `--runner-id`, `--batch`,
+`--sigdb`, `--user-agent`), and `--once` runs a single claim/scan/report cycle,
+which is what you want in a cron job or a smoke test. The runner profile is
+deliberately lean — DNS, TLS, geo and IP info, no ports, CVEs or brute passes —
+because it is meant for volume rather than depth.
+
+Packaged for it:
+
+```bash
+docker build -t stackscan:latest .
+docker run --rm -e STACKSCAN_BACKEND_URL=http://panel:8787 \
+  -e STACKSCAN_WORKER_TOKEN=… stackscan:latest
+```
+
+Runner mode is refused inside the reekeer shell: it is a loop that runs until it
+is killed, and a shell command that never answers is not a command.
+
+---
+
 ## 🚀 Smart Scan Pipeline
 
 The Smart Scan engine performs multiple analysis stages to collect infrastructure, technology, and security information about the target before generating the final report.
@@ -325,6 +385,8 @@ stackscan/
 │   ├── config/        ← bundled + sourced sigdb loading
 │   ├── data/          ← builtin.sigdb, cve.json.gz, subdomains.txt
 │   ├── render.py      ← the colorized panel report
+│   ├── embed.py       ← findings as data, and the form, for reekeer to draw
+│   ├── runner.py      ← panel worker: claim jobs, scan, report back
 │   ├── scan.py        ← per-target orchestration
 │   └── cli.py         ← argument parsing and entry point
 ├── scripts/           ← build_cve_db.py (NVD → offline dataset)

{stackscan-2.6.0 → stackscan-2.7.1}/README.md

@@ -39,6 +39,26 @@ pip install "stackscan[geo]"   # offline IP geolocation via geoip2 + a MaxMind .
 `nmap` is used for port scans when present; without it a pure-Python scanner is
 used automatically.
 
+### Inside the reekeer shell
+
+stackscan is also a [reekeer](https://github.com/reekeer/reekeer) plugin, mounted
+at `/tools/recon/stackscan` (alias `ss`):
+
+```bash
+reekeer exec /plugins install reekeer/stackscan
+```
+
+Hosted there it drops the banner and the window title and hands the scan back as
+data for reekeer to render in the shell's own tables, so it reads as a command of
+the shell rather than a script being shelled out to. Every flag behaves the same,
+and standalone (`pip`, `uvx stackscan`) is unchanged.
+
+In reekeer's window the scan also gets a form. stackscan says which of its flags
+are worth a control — the targets, the four switches that decide how deep a scan
+goes, and the bounds worth changing when one is too slow — and reekeer draws
+those. The rest are not hidden: the argument line under the form still takes
+anything argparse takes, `--help` included.
+
 ---
 
 ## ✨ Features
@@ -156,6 +176,46 @@ Below are performance benchmarks conducted on two production targets using diffe
 
 ---
 
+## 🛰 Runner mode
+
+`stackscan --runner` turns the scanner into a worker for a StackScan panel: it
+claims jobs (`POST /api/jobs/claim`), fingerprints each target with the normal
+engine, and posts the results back (`POST /api/results`). It needs nothing but
+network access to the panel — no database, no Redis, no shared filesystem.
+
+```bash
+STACKSCAN_BACKEND_URL=https://panel.example STACKSCAN_WORKER_TOKEN=… \
+  stackscan --runner
+```
+
+| Variable | Default | What it is |
+| --- | --- | --- |
+| `STACKSCAN_BACKEND_URL` | `http://localhost:8787` | Panel base URL |
+| `STACKSCAN_WORKER_TOKEN` | — | Shared worker token, sent as `X-Worker-Token` |
+| `STACKSCAN_RUNNER_ID` | `runner-<host>-<pid>` | Stable id for this runner |
+| `STACKSCAN_RUNNER_BATCH` | `5` | Jobs claimed per cycle |
+| `STACKSCAN_RUNNER_IDLE` | `5` | Seconds to wait when the queue is empty |
+| `STACKSCAN_RUNNER` | — | Truthy value selects runner mode without the flag |
+
+Every one has a flag (`--backend`, `--worker-token`, `--runner-id`, `--batch`,
+`--sigdb`, `--user-agent`), and `--once` runs a single claim/scan/report cycle,
+which is what you want in a cron job or a smoke test. The runner profile is
+deliberately lean — DNS, TLS, geo and IP info, no ports, CVEs or brute passes —
+because it is meant for volume rather than depth.
+
+Packaged for it:
+
+```bash
+docker build -t stackscan:latest .
+docker run --rm -e STACKSCAN_BACKEND_URL=http://panel:8787 \
+  -e STACKSCAN_WORKER_TOKEN=… stackscan:latest
+```
+
+Runner mode is refused inside the reekeer shell: it is a loop that runs until it
+is killed, and a shell command that never answers is not a command.
+
+---
+
 ## 🚀 Smart Scan Pipeline
 
 The Smart Scan engine performs multiple analysis stages to collect infrastructure, technology, and security information about the target before generating the final report.
@@ -287,6 +347,8 @@ stackscan/
 │   ├── config/        ← bundled + sourced sigdb loading
 │   ├── data/          ← builtin.sigdb, cve.json.gz, subdomains.txt
 │   ├── render.py      ← the colorized panel report
+│   ├── embed.py       ← findings as data, and the form, for reekeer to draw
+│   ├── runner.py      ← panel worker: claim jobs, scan, report back
 │   ├── scan.py        ← per-target orchestration
 │   └── cli.py         ← argument parsing and entry point
 ├── scripts/           ← build_cve_db.py (NVD → offline dataset)

{stackscan-2.6.0 → stackscan-2.7.1}/pyproject.toml

@@ -67,6 +67,20 @@ Issues = "https://github.com/reekeer/stackscan/issues"
 [project.scripts]
 stackscan = "stackscan.cli:main"
 
+# Mounts stackscan inside the reekeer shell as /recon/stackscan.
+#
+# Not `/tools/recon`: a root that holds every plugin distinguishes none of them, so the category is
+# the top-level group.
+#
+# Name, version, description, authors and dependencies are read from [project] above, so nothing is
+# repeated here. No arguments are declared on purpose: stackscan's own argparse keeps ownership of all
+# of them, including `--help` and the `sigdb` subcommand, and reekeer hands it the raw tokens.
+[tool.reekeer]
+group = "/recon"
+entrypoint = "stackscan.cli:main"
+python-root = "src"
+aliases = ["ss"]
+
 [tool.hatch.version]
 path = "src/stackscan/__init__.py"
 

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.6.0"
+__version__ = "2.7.1"

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/analyzers/creds.py

@@ -42,6 +42,29 @@ _DEVICE_KEYWORDS = (
     "uc-httpd",
     "go2rtc",
     "rtsp",
+    "mikrotik",
+    "routeros",
+    "webfig",
+    "openwrt",
+    "dd-wrt",
+    "pfsense",
+    "opnsense",
+    "ubnt",
+    "ubiquiti",
+    "unifi",
+    "tp-link",
+    "tplink",
+    "d-link",
+    "dlink",
+    "netgear",
+    "zyxel",
+    "huawei",
+    "tenda",
+    "asuswrt",
+    "idrac",
+    "ilo",
+    "ipmi",
+    "supermicro",
 )
 _CAMERA_KEYWORDS = (
     "camera",
@@ -199,31 +222,45 @@ async def _probe_endpoint(
     url = f"{scheme}://{host}:{port}/"
     target = f"{host}:{port}"
     try:
-        async with session.get(url, allow_redirects=False) as resp:
+        async with session.get(url, allow_redirects=True) as resp:
             status = resp.status
             server = resp.headers.get("Server", "")
             realm = resp.headers.get("WWW-Authenticate", "")
+            body = ""
+            if status < 400:
+                body = (await resp.content.read(20000)).decode("utf-8", "replace")
     except (aiohttp.ClientError, TimeoutError, OSError):
         return None
-    device = _looks_like_device(realm, server) or port in _RTSP_PORTS
-    if status != 401:
-        if device or _looks_like_device("", server):
-            return CredFinding(
-                target=target,
-                service=f"{scheme} ({server or 'device'})",
-                kind="open-no-auth",
-                detail=f"HTTP {status} without authentication",
+
+    if status == 401:
+        if _looks_like_device(realm, server) or port in _RTSP_PORTS:
+            return BruteTarget(
+                host=host,
+                port=port,
+                tls=tls,
+                service=f"{scheme} ({server or realm or 'device'})",
+                is_camera=_is_camera(realm, server) or port in _RTSP_PORTS,
+                login="basic",
             )
         return None
-    if not device:
-        return None
-    return BruteTarget(
-        host=host,
-        port=port,
-        tls=tls,
-        service=f"{scheme} ({server or realm or 'device'})",
-        is_camera=_is_camera(realm, server) or port in _RTSP_PORTS,
-    )
+
+    blob = f"{server} {realm} {body}".lower()
+    if "mikrotik" in blob or "routeros" in blob:
+        return BruteTarget(host=host, port=port, tls=tls, service="RouterOS", login="mikrotik")
+    if "unifi" in server.lower() or ("unifi" in blob and "login" in blob):
+        return BruteTarget(host=host, port=port, tls=tls, service="UniFi", login="unifi")
+    if status == 200 and 'type="password"' in blob and "<form" in blob:
+        return BruteTarget(
+            host=host, port=port, tls=tls, service=f"{scheme} login form", login="form"
+        )
+    if _looks_like_device("", server):
+        return CredFinding(
+            target=target,
+            service=f"{scheme} ({server or 'device'})",
+            kind="open-no-auth",
+            detail=f"HTTP {status} without authentication",
+        )
+    return None
 
 
 async def brute_devices(
@@ -247,7 +284,7 @@ async def brute_devices(
 
         async def run(target: BruteTarget) -> None:
             async with semaphore:
-                hit = await _try_defaults(session, target.url, creds)
+                hit = await _brute_login(session, target, creds)
             if hit is not None:
                 username, password = hit
                 findings.append(
@@ -255,7 +292,7 @@ async def brute_devices(
                         target=target.target,
                         service=target.service,
                         kind="default-creds",
-                        detail="default credentials accepted via HTTP Basic auth",
+                        detail=f"default credentials accepted ({target.login} login)",
                         username=username,
                         password=password,
                     )
@@ -275,6 +312,18 @@ async def brute_devices(
     return findings
 
 
+async def _brute_login(
+    session: aiohttp.ClientSession, target: BruteTarget, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    if target.login == "mikrotik":
+        return await _try_mikrotik(session, target.url, creds)
+    if target.login == "unifi":
+        return await _try_unifi(session, target.url, creds)
+    if target.login == "form":
+        return await _try_form(session, target.url, creds)
+    return await _try_defaults(session, target.url, creds)
+
+
 async def _try_defaults(
     session: aiohttp.ClientSession, url: str, creds: tuple[tuple[str, str], ...]
 ) -> tuple[str, str] | None:
@@ -288,3 +337,70 @@ async def _try_defaults(
             return None
         await asyncio.sleep(0.05)
     return None
+
+
+async def _try_mikrotik(
+    session: aiohttp.ClientSession, base_url: str, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    url = base_url.rstrip("/") + "/rest/system/resource"
+    for username, password in creds:
+        try:
+            async with session.get(
+                url, auth=aiohttp.BasicAuth(username, password), allow_redirects=False
+            ) as resp:
+                if resp.status == 200:
+                    return (username, password)
+                if resp.status == 404:
+                    return None
+        except (aiohttp.ClientError, TimeoutError, OSError):
+            return None
+        await asyncio.sleep(0.05)
+    return None
+
+
+async def _try_unifi(
+    session: aiohttp.ClientSession, base_url: str, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    endpoints = ("/api/login", "/api/auth/login")
+    for username, password in creds:
+        payload = {"username": username, "password": password}
+        for endpoint in endpoints:
+            url = base_url.rstrip("/") + endpoint
+            try:
+                async with session.post(url, json=payload, allow_redirects=False) as resp:
+                    if resp.status == 200:
+                        return (username, password)
+            except (aiohttp.ClientError, TimeoutError, OSError):
+                continue
+        await asyncio.sleep(0.05)
+    return None
+
+
+_FORM_ENDPOINTS = ("/login", "/", "/admin/login", "/api/login", "/j_security_check")
+
+
+async def _try_form(
+    session: aiohttp.ClientSession, base_url: str, creds: tuple[tuple[str, str], ...]
+) -> tuple[str, str] | None:
+    for username, password in creds:
+        data = {
+            "username": username,
+            "password": password,
+            "user": username,
+            "pass": password,
+            "j_username": username,
+            "j_password": password,
+        }
+        for endpoint in _FORM_ENDPOINTS:
+            url = base_url.rstrip("/") + endpoint
+            try:
+                async with session.post(url, data=data, allow_redirects=False) as resp:
+                    location = resp.headers.get("Location", "").lower()
+                    if resp.status in (301, 302, 303) and not any(
+                        marker in location for marker in ("login", "error", "denied", "auth")
+                    ):
+                        return (username, password)
+            except (aiohttp.ClientError, TimeoutError, OSError):
+                continue
+        await asyncio.sleep(0.05)
+    return None

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/analyzers/cve.py

@@ -106,12 +106,26 @@ _CORE_COMMIT_RE = re.compile(
 )
 
 
+def _cve_bytes() -> bytes | None:
+    from stackscan.config.sources import SourceStore
+
+    override = SourceStore().resolve_cve()
+    if override is not None:
+        try:
+            return override.read_bytes()
+        except OSError:
+            pass
+    try:
+        return resources.files("stackscan.data").joinpath("cve.json.gz").read_bytes()
+    except (FileNotFoundError, ModuleNotFoundError, OSError):
+        return None
+
+
 @lru_cache(maxsize=1)
 def load_cve_db() -> CveDb:
     empty: CveDb = {}
-    try:
-        raw = resources.files("stackscan.data").joinpath("cve.json.gz").read_bytes()
-    except (FileNotFoundError, ModuleNotFoundError, OSError):
+    raw = _cve_bytes()
+    if raw is None:
         return empty
     try:
         data = cast("dict[str, Any]", json.loads(gzip.decompress(raw)))

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/analyzers/osdetect.py

@@ -106,7 +106,9 @@ def detect_os(report: ScanReport) -> list[OsFinding]:
         for os, src in pairs:
             by_source.setdefault(src, []).append(os)
         dominant_source = max(by_source, key=lambda s: len(by_source[s]))
-        if dominant_source == "port-banner" or dominant_source.startswith(("header:", "meta:", "script")):
+        if dominant_source == "port-banner" or dominant_source.startswith(
+            ("header:", "meta:", "script")
+        ):
             category = "banner"
         elif dominant_source.startswith("port "):
             category = "network"

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/analyzers/services.py

@@ -163,6 +163,15 @@ def _service_from_tech(tech: Technology) -> ServiceFinding | None:
             evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
             severity=_SEVERITY["database"],
         )
+    categories = {category.lower() for category in tech.categories}
+    for kind in ("admin-panel", "database"):
+        if kind in categories:
+            return ServiceFinding(
+                name=tech.name,
+                kind=kind,
+                evidence=" ".join(tech.evidence) or f"tech: {tech.name}",
+                severity=_SEVERITY[kind],
+            )
     return None
 
 

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/analyzers/social.py

@@ -37,10 +37,14 @@ def _social_link(raw: str, base_url: str) -> SocialLink | None:
     low = value.lower()
     if low.startswith("mailto:"):
         addr = value[7:].split("?", 1)[0].strip()
-        return SocialLink("Email", "mailto:" + addr, addr) if addr else None
+        if addr and "@" in addr and "." in addr.split("@", 1)[-1]:
+            return SocialLink("Email", "mailto:" + addr, addr)
+        return None
     if low.startswith("tel:"):
         num = value[4:].strip()
-        return SocialLink("Phone", value, num) if num else None
+        if sum(char.isdigit() for char in num) >= 6:
+            return SocialLink("Phone", value, num)
+        return None
     if low.startswith("//"):
         value = "https:" + value
     elif not low.startswith(("http://", "https://")):

{stackscan-2.6.0 → stackscan-2.7.1}/src/stackscan/analyzers/tech.py

@@ -40,17 +40,51 @@ def _script_srcs(html: str) -> list[str]:
 _CLASS_ATTR_RE = re.compile(r'\bclass\s*=\s*"([^"]*)"|\bclass\s*=\s*\'([^\']*)\'', re.I)
 
 
-_CSS_UTILITY_EXACT: frozenset[str] = frozenset({
-    "container", "flex", "grid", "block", "inline", "inline-block", "hidden",
-    "table", "table-cell", "table-row", "flow-root", "contents",
-    "float-left", "float-right", "float-none", "clear-left", "clear-right",
-    "clear-both", "clear-none", "isolate", "isolation-auto",
-    "object-contain", "object-cover", "object-fill", "object-none", "object-scale-down",
-    "overflow-auto", "overflow-hidden", "overflow-visible", "overflow-scroll",
-    "overscroll-auto", "overscroll-contain", "overscroll-none",
-    "visible", "invisible", "collapse",
-    "static", "fixed", "absolute", "relative", "sticky",
-})
+_CSS_UTILITY_EXACT: frozenset[str] = frozenset(
+    {
+        "container",
+        "flex",
+        "grid",
+        "block",
+        "inline",
+        "inline-block",
+        "hidden",
+        "table",
+        "table-cell",
+        "table-row",
+        "flow-root",
+        "contents",
+        "float-left",
+        "float-right",
+        "float-none",
+        "clear-left",
+        "clear-right",
+        "clear-both",
+        "clear-none",
+        "isolate",
+        "isolation-auto",
+        "object-contain",
+        "object-cover",
+        "object-fill",
+        "object-none",
+        "object-scale-down",
+        "overflow-auto",
+        "overflow-hidden",
+        "overflow-visible",
+        "overflow-scroll",
+        "overscroll-auto",
+        "overscroll-contain",
+        "overscroll-none",
+        "visible",
+        "invisible",
+        "collapse",
+        "static",
+        "fixed",
+        "absolute",
+        "relative",
+        "sticky",
+    }
+)
 # Tailwind-style utilities: px-4, w-full, bg-red-500, my-auto, backdrop-blur, etc.
 _CSS_UTILITY_RE = re.compile(
     r"^[a-z]+(-[a-z]+)?-(\d+|auto|full|screen|px|sm|md|lg|xl|2xl|3xl|4xl|5xl|6xl|7xl|8xl|9xl|none|hidden|visible|inherit|current|transparent|black|white|blur|opacity|saturate|sepia|grayscale|contrast|brightness|invert|drop-shadow|hue-rotate|shadow|sm|md|lg|xl)$",
@@ -118,7 +152,9 @@ def _confidence(evidence: list[str]) -> int:
 
 
 _VERSION_RE = re.compile(r"(\d+\.\d+(?:\.\d+)?(?:[-+.]?[a-zA-Z0-9]+)?)")
-_CORE_COMMIT_RE = re.compile(r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE)
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
+)
 
 
 def _version_key(version: str) -> tuple[int, int, int, int]:
@@ -274,9 +310,7 @@ class TechAnalyzer:
             self._add(acc, matcher.match(result.body), "body")
             self._add(acc, matcher.match(result.url), "url")
             for token in _framework_tokens(result.body):
-                self._add(
-                    acc, matcher.match_search({"framework": token}), f"framework:{token}"
-                )
+                self._add(acc, matcher.match_search({"framework": token}), f"framework:{token}")
         self._curated(acc, result)
         by_name: dict[str, _Hit] = {}
         for hit in acc.values():
@@ -336,4 +370,9 @@ class TechAnalyzer:
                 add(name, "service", f"body:{name} Core ({commit})", version=commit)
 
         for tech in extract_generic_tech(result.body):
-            add(tech.name, tech.categories[0] if tech.categories else "service", tech.evidence[0], tech.version)
+            add(
+                tech.name,
+                tech.categories[0] if tech.categories else "service",
+                tech.evidence[0],
+                tech.version,
+            )