SOME ADDITIONS

app.py

@@ -330,22 +330,25 @@ def handle_scan(data):
             web_log(f"⚠️ Nuclei Warning: {str(e)}")
             nuclei_vulns = []
 
+        # Combine ZAP's dynamic findings with Nuclei's CVE template findings
         # Combine ZAP's dynamic findings with Nuclei's CVE template findings
         raw_vulns = zap_vulns + nuclei_vulns
 
-        # 🔴 INJECT WAF FINDING INTO THE REPORT
-        if detected_waf and detected_waf not in ["None Detected", "Unknown"]:
-            raw_vulns.append({
-                'type': f"Security Control: {detected_waf} Detected",
-                'severity': "INFO",
-                'url': target,
-                'payload': f"Edge Security Signatures matched for {detected_waf}",
-                'proof_of_concept': "N/A",
-                'impact': "The target is actively defended by a Web Application Firewall. This mitigates many automated attacks, blocks malicious payloads, and actively challenges bots.",
-                'remediation': "This is a positive security control. Ensure the WAF is configured in blocking mode with updated rulesets."
-            })
-
         web_log("--- PHASE 3: SMART DEDUPLICATION & THREAT SCORING ---")
+        web_log("[*] Starting Smart Analysis, Deduplication & Verification...")
+        
+        # 🔴 BULLETPROOF FALLBACK: Always define the variable before the try block
+        verified_vulns = raw_vulns 
+        
+        try:
+            # Here is where your deduplication logic happens (e.g., removing duplicates)
+            unique_vulns = {v['type']: v for v in raw_vulns}.values()
+            verified_vulns = list(unique_vulns)
+            web_log(f"✅ Analysis Complete: Condensed {len(raw_vulns)} alerts into {len(verified_vulns)} unique threats.")
+        except Exception as e:
+            web_log(f"⚠️ Deduplication Warning: {str(e)}. Proceeding with raw data.")
+
+        web_log("--- PHASE 3.5: ACTIVE EXPLOIT VERIFICATION ---")
         try:
             exploiter = ExploiterEngine(verified_vulns, auth_header=auth_token, logger_callback=web_log)
             verified_vulns = exploiter.start() 

modules/nuclei_engine.py

@@ -33,41 +33,43 @@ class NucleiEngine:
             # Run Nuclei (Timeout after 5 minutes to keep it fast)
             subprocess.run(cmd, capture_output=True, text=True, timeout=300)
             
+            # Parse the JSON results exported by Nuclei
             # Parse the JSON results exported by Nuclei
             if os.path.exists(output_file):
                 with open(output_file, "r") as f:
                     for line in f:
                         try:
-                            data = json.loads(line.strip())
+                            parsed = json.loads(line.strip())
                             
-                            # BULLETPROOF PARSING: If Nuclei returns a list, grab the first item
-                            if isinstance(data, list):
-                                if not data: continue
-                                data = data[0]
-                                
-                            if not isinstance(data, dict):
-                                continue
+                            # Force everything into a list so we can loop safely
+                            items = parsed if isinstance(parsed, list) else [parsed]
 
-                            info = data.get('info', {})
-                            
-                            # Extract CVE ID if it exists
-                            cve_id = ""
-                            classification = info.get('classification', {})
-                            if isinstance(classification, dict) and 'cve-id' in classification and classification['cve-id']:
-                                cve_id = f"[{classification['cve-id'][0]}] "
+                            for data in items:
+                                if not isinstance(data, dict):
+                                    continue
+                                
+                                info = data.get('info', {})
+                                if not isinstance(info, dict):
+                                    info = {}
+                                
+                                # Extract CVE ID if it exists
+                                cve_id = ""
+                                classification = info.get('classification', {})
+                                if isinstance(classification, dict) and 'cve-id' in classification and classification['cve-id']:
+                                    cve_id = f"[{classification['cve-id'][0]}] "
 
-                            poc_payload = data.get('curl-command', 'N/A')
-                            
-                            finding = {
-                                'type': f"NUCLEI: {cve_id}{info.get('name', 'Unknown Vulnerability')}",
-                                'severity': info.get('severity', 'high').upper(),
-                                'url': data.get('matched-at', self.target_url),
-                                'payload': data.get('extracted-results', [''])[0] if data.get('extracted-results') else data.get('matcher-name', 'Template Match'),
-                                'proof_of_concept': poc_payload,
-                                'impact': info.get('description', 'Exploitable CVE identified by Nuclei template engine.'),
-                                'remediation': info.get('remediation', 'Apply the latest vendor patches immediately.')
-                            }
-                            findings.append(finding)
+                                poc_payload = data.get('curl-command', 'N/A')
+                                
+                                finding = {
+                                    'type': f"NUCLEI: {cve_id}{info.get('name', 'Unknown Vulnerability')}",
+                                    'severity': info.get('severity', 'high').upper(),
+                                    'url': data.get('matched-at', self.target_url),
+                                    'payload': data.get('extracted-results', [''])[0] if data.get('extracted-results') else data.get('matcher-name', 'Template Match'),
+                                    'proof_of_concept': poc_payload,
+                                    'impact': info.get('description', 'Exploitable CVE identified by Nuclei template engine.'),
+                                    'remediation': info.get('remediation', 'Apply the latest vendor patches immediately.')
+                                }
+                                findings.append(finding)
                         except json.JSONDecodeError:
                             continue
                 os.remove(output_file) # Cleanup

templates/index.html

@@ -513,8 +513,18 @@
                 mapContainer.classList.remove('hidden');
                 rootNodeId = url;
                 graphData = { nodes: [{ id: rootNodeId, group: 'root' }], links: [] };
-                if (!Graph) init3DGraph();
-                else Graph.graphData(graphData);
+                
+                // We must wait 100ms for the CSS 'hidden' class to disappear so WebGL knows the canvas size!
+                setTimeout(() => {
+                    if (!Graph) {
+                        init3DGraph();
+                    } else {
+                        // Force resize and update
+                        Graph.width(document.getElementById('mapContainer').clientWidth);
+                        Graph.height(350);
+                        Graph.graphData(graphData);
+                    }
+                }, 100);
             }
             
             const status = document.getElementById('statusIndicator');