Add keyless Retire.js and bounded Wapiti modules with opt-in Nuclei checks

.github/workflows/deploy-hf.yml

@@ -22,7 +22,7 @@ jobs:
           ZAP_API_KEY: test-key
         run: python3 -m pytest -q tests/
       - name: Validate Python backend syntax
-        run: python3 -m py_compile app/main.py app/pipeline.py app/web_modules.py app/config.py app/review.py app/zap_control.py app/scope.py app/jwtcheck.py app/storage.py
+        run: python3 -m py_compile app/main.py app/pipeline.py app/web_modules.py app/client_modules.py app/wapiti_guard.py app/wapiti_runner.py app/config.py app/review.py app/zap_control.py app/scope.py app/jwtcheck.py app/storage.py
       - name: Validate dashboard JavaScript syntax
         run: |
           python3 - <<'PY'
@@ -37,6 +37,15 @@ jobs:
         run: |
           docker build --progress plain -t asfb-ci .
           docker run --rm -v "$PWD/tests:/app/tests:ro" --entrypoint /bin/sh asfb-ci -ec '
+            /usr/local/bin/node /opt/retire/lib/cli.js --help > /tmp/retire-help
+            grep -q -- "--path" /tmp/retire-help
+            grep -q -- "--jsrepo" /tmp/retire-help
+            grep -q -- "--exitwith" /tmp/retire-help
+            /usr/local/bin/node /app/tests/retire_offline_smoke.js
+            /opt/wapiti/bin/python /app/app/wapiti_runner.py --help > /tmp/wapiti-help
+            grep -q -- "--max-scan-time" /tmp/wapiti-help
+            grep -q -- "--no-bugreport" /tmp/wapiti-help
+            /opt/wapiti/bin/python /app/tests/wapiti_offline_smoke.py
             test -f /opt/nikto/program/nikto.pl
             test -f /opt/testssl/testssl.sh
             ruby -c /app/app/wpscan_runner.rb

AGENTS.md

@@ -6,3 +6,5 @@
 - Do not execute project code, tests, scanners, containers, or installation commands on the owner's device.
 - Run validation only on GitHub-hosted Actions runners. Deployment runs on Hugging Face through the existing main-branch workflow.
 - Do not initiate live scans as part of verification. Use offline tests and mocked target/provider responses.
+
+- Prefer modules and providers that work without API keys. Keep optional credentials optional and disclose keyless coverage limitations. Do not add required API-key setup to the full pipeline.

Dockerfile

@@ -16,9 +16,23 @@ RUN gem install wpscan -v 4.2.0 --no-document
 # Metadata is fetched during the remote image build, never during a target scan.
 RUN wpscan --update
 
+FROM node:22-bookworm-slim AS js-tools
+RUN npm install --global retire@6.1.0
+RUN mkdir -p /opt/retire-db && node -e "fetch('https://raw.githubusercontent.com/RetireJS/retire.js/6.1.0/repository/jsrepository-v5.json').then(r => { if (!r.ok) throw Error(r.status); return r.text(); }).then(t => { JSON.parse(t); require('fs').writeFileSync('/opt/retire-db/jsrepository-v5.json', t); }).catch(e => { console.error(e); process.exit(1); })"
+
+FROM python:3.12-slim-bookworm AS wapiti-tools
+RUN python -m venv --copies /opt/wapiti && /opt/wapiti/bin/pip install --no-cache-dir wapiti3==3.3.2
+
 FROM zaproxy/zap-stable
 USER root
 COPY --from=wp-tools /usr/local/ /usr/local/
+COPY --from=js-tools /usr/local/bin/node /usr/local/bin/node
+COPY --from=js-tools /usr/local/lib/node_modules/retire /opt/retire
+COPY --from=js-tools /opt/retire-db /opt/retire-db
+COPY --from=wapiti-tools /opt/wapiti /opt/wapiti
+COPY --from=wapiti-tools /usr/local/bin/python3.12 /usr/local/bin/python3.12
+COPY --from=wapiti-tools /usr/local/lib/libpython3.12.so* /usr/local/lib/
+COPY --from=wapiti-tools /usr/local/lib/python3.12 /usr/local/lib/python3.12
 COPY --from=wp-tools /root/.cache/wpscan/db /opt/wpscan-db
 COPY --from=pd-tools /opt/nikto /opt/nikto
 COPY --from=pd-tools /opt/testssl /opt/testssl
@@ -29,7 +43,7 @@ COPY --from=pd-tools /usr/local/bin/gau /usr/local/bin/gau
 COPY --from=pd-tools /usr/local/bin/ffuf /usr/local/bin/ffuf
 COPY --from=pd-tools /usr/local/bin/dalfox /usr/local/bin/dalfox
 COPY --from=pd-tools /opt/sqlmap /opt/sqlmap
-RUN apt-get update && apt-get install -y --no-install-recommends python3-venv python3-pip perl libxml-writer-perl libxml-libxml-perl libjson-perl libnet-ssleay-perl libio-socket-ssl-perl openssl libcurl4 libyaml-0-2 libgmp10 libffi8 libgdbm6 libgdbm-compat4 libreadline8 zlib1g procps dnsutils ldnsutils coreutils bsdextrautils xxd gawk socat curl libidn2-0 && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends python3-venv python3-pip perl libxml-writer-perl libxml-libxml-perl libjson-perl libnet-ssleay-perl libio-socket-ssl-perl openssl libcurl4 libyaml-0-2 libgmp10 libffi8 libgdbm6 libgdbm-compat4 libreadline8 zlib1g procps dnsutils ldnsutils coreutils bsdextrautils xxd gawk socat curl libidn2-0 libstdc++6 libsqlite3-0 && rm -rf /var/lib/apt/lists/*
 RUN python3 -m venv /opt/asfb-venv && /opt/asfb-venv/bin/pip install --no-cache-dir fastapi==0.115.12 uvicorn==0.34.2 python-multipart==0.0.20 httpx==0.28.1 arjun==2.2.7 PyYAML==6.0.2
 WORKDIR /app
 COPY --chown=zap:zap app /app/app

app/client_modules.py

@@ -0,0 +1,254 @@
+"""Keyless Retire.js sampling and a bounded Wapiti profile."""
+import asyncio
+import json
+import re
+import tempfile
+from html.parser import HTMLParser
+from pathlib import Path
+from urllib.parse import urljoin, urlsplit
+
+import httpx
+
+from . import config
+from .pipeline import execute
+from .scope import public_host
+from .web_modules import same_origin, read_report, alert
+
+
+class FetchProblem(ValueError):
+    pass
+
+
+async def fetch_sample(url, agent, maximum):
+    """Read a bounded current response on HF; never follow redirects."""
+    import os
+    public_host(urlsplit(url).hostname, os.environ.get("ALLOW_PRIVATE_TARGETS") == "1")
+
+    async def fetch():
+        async with httpx.AsyncClient(timeout=5, follow_redirects=False, trust_env=False) as client:
+            async with client.stream("GET", url, headers={"User-Agent": agent}) as response:
+                if response.status_code != 200:
+                    raise FetchProblem("HTTP " + str(response.status_code))
+                data = bytearray()
+                async for chunk in response.aiter_bytes(chunk_size=16384):
+                    if len(data) + len(chunk) > maximum:
+                        raise FetchProblem("response exceeds sample byte limit")
+                    data.extend(chunk)
+                return bytes(data), str(response.headers.get("content-type", "")).lower()
+    return await asyncio.wait_for(fetch(), 8)
+
+
+class ScriptInventory(HTMLParser):
+    def __init__(self, target):
+        super().__init__()
+        self.target, self.urls, self.inline = target, [], []
+        self.current = None
+        self.inline_bytes = 0
+
+    def handle_starttag(self, tag, attrs):
+        if tag != "script":
+            return
+        attrs = dict(attrs)
+        src = attrs.get("src")
+        if src:
+            try:
+                candidate = urljoin(self.target, src)
+                if same_origin(candidate, self.target):
+                    self.urls.append(candidate)
+            except ValueError:
+                pass
+            self.current = None
+        elif str(attrs.get("type", "")).lower() in ("", "text/javascript", "application/javascript", "module"):
+            self.current = []
+
+    def handle_data(self, data):
+        if self.current is not None and self.inline_bytes < config.RETIRE_MAX_FILE_BYTES:
+            self.current.append(data)
+            self.inline_bytes += len(data.encode("utf-8"))
+
+    def handle_endtag(self, tag):
+        if tag == "script" and self.current is not None:
+            code = "".join(self.current).encode("utf-8")
+            if code.strip() and len(code) <= config.RETIRE_MAX_FILE_BYTES:
+                self.inline.append(code)
+            self.current = None
+
+
+def parse_retire(report, mapping):
+    results = []
+    entries = report.get("data", []) if isinstance(report, dict) else []
+    if not isinstance(entries, list):
+        return []
+    for entry in entries:
+        if not isinstance(entry, dict) or not isinstance(entry.get("file"), str):
+            continue
+        target = mapping.get(str(Path(entry["file"]).resolve()))
+        if target is None:
+            continue
+        for component in entry.get("results", []):
+            if not isinstance(component, dict):
+                continue
+            for vuln in component.get("vulnerabilities", []):
+                if not isinstance(vuln, dict):
+                    continue
+                ids = vuln.get("identifiers") or {}
+                if not isinstance(ids, dict):
+                    ids = {}
+                cves = ids.get("CVE") or []
+                references = ", ".join(str(v) for v in cves[:8]) if isinstance(cves, list) else str(cves)
+                risk = str(vuln.get("severity") or "info").title()
+                if risk not in ("Low", "Medium", "High", "Critical"):
+                    risk = "Informational"
+                title = str(component.get("component") or "JavaScript library") + " " + str(component.get("version") or "")
+                description = ("Unverified library/version advisory match. " + str(ids.get("summary") or vuln.get("details") or "") +
+                               ("; " + references if references else ""))
+                results.append(alert("retirejs", title, target, description, risk, references))
+    return results[:config.WEB_FINDINGS_LIMIT]
+
+
+async def retirejs(url, host, agent, delay, discovered):
+    reasons, samples = [], []
+    parser = ScriptInventory(url)
+    try:
+        body, content_type = await fetch_sample(url, agent, config.WEB_PREFLIGHT_MAX_BYTES)
+        if "html" in content_type or body.lstrip().lower().startswith((b"<!doctype html", b"<html")):
+            parser.feed(body.decode("utf-8", "replace"))
+        elif "javascript" in content_type or urlsplit(url).path.lower().endswith(".js"):
+            samples.append((url, body))
+    except (FetchProblem, httpx.HTTPError, asyncio.TimeoutError, ValueError) as exc:
+        reasons.append("Page sampling: " + (str(exc) if isinstance(exc, FetchProblem) else exc.__class__.__name__))
+    candidates = list(dict.fromkeys(parser.urls + [
+        item for item in discovered if isinstance(item, str) and same_origin(item, url) and
+        urlsplit(item).path.lower().endswith((".js", ".mjs"))]))
+    limit = config.RETIRE_MAX_FILES
+    selected = candidates[:max(0, limit - len(samples))]
+    if len(selected) < len(candidates):
+        reasons.append("JavaScript URL sample limited to " + str(len(selected)))
+    for candidate in selected:
+        await asyncio.sleep(max(config.REQUEST_DELAY_MIN, float(delay)))
+        try:
+            body, content_type = await fetch_sample(candidate, agent, config.RETIRE_MAX_FILE_BYTES)
+            if "html" in content_type or body.lstrip().lower().startswith((b"<!doctype html", b"<html")):
+                raise FetchProblem("HTML returned instead of JavaScript")
+            if "javascript" not in content_type and not urlsplit(candidate).path.lower().endswith((".js", ".mjs")):
+                raise FetchProblem("Response not identified as JavaScript")
+            if body:
+                samples.append((candidate, body))
+        except (FetchProblem, httpx.HTTPError, asyncio.TimeoutError, ValueError) as exc:
+            reasons.append("Script sampling: " + (str(exc) if isinstance(exc, FetchProblem) else exc.__class__.__name__))
+    inline_limit = max(0, limit - len(samples))
+    samples.extend((url, body) for body in parser.inline[:inline_limit])
+    if len(parser.inline) > inline_limit:
+        reasons.append("Inline JavaScript sample limited")
+    if not samples:
+        reason = "; ".join(reasons) or "No same-origin or inline JavaScript available"
+        return {"status": "skipped", "source": "retirejs", "alerts": [], "target": url,
+                "reason": reason, "output": "Retire.js skipped: " + reason}
+    with tempfile.TemporaryDirectory(prefix="asfb-retirejs-") as tmp:
+        root = Path(tmp)
+        assets = root / "assets"
+        assets.mkdir()
+        mapping = {}
+        for index, (source, body) in enumerate(samples):
+            folder = assets / str(index)
+            folder.mkdir()
+            name = re.sub(r"[^A-Za-z0-9_.-]", "_", Path(urlsplit(source).path).name)[:100]
+            if not name.lower().endswith(".js"):
+                name = "sample.js"
+            filename = folder / name
+            filename.write_bytes(body)
+            mapping[str(filename.resolve())] = source
+        report_path = str(root / "report.json")
+        ignore_path = root / "ignore.json"
+        ignore_path.write_text("[]", encoding="utf-8")
+        rows, status = await execute([
+            "/usr/local/bin/node", "/opt/retire/lib/cli.js", "--path", str(assets),
+            "--jsrepo", "/opt/retire-db/jsrepository-v5.json", "--cachedir", str(root / "cache"),
+            "--ignorefile", str(ignore_path), "--outputformat", "json",
+            "--outputpath", report_path, "--exitwith", "13"],
+            config.RETIRE_TIMEOUT_SECONDS)
+        report = read_report(report_path)
+        findings = parse_retire(report, mapping)
+    diagnostic = [row[:180] for row in rows if row.startswith(("[stderr]", "[diagnostic]"))]
+    code13 = any(row.strip() == "[diagnostic] Process exit code: 13" for row in rows)
+    if code13 and isinstance(report, dict) and findings and not report.get("errors"):
+        status = "findings"
+        diagnostic = [s for s in diagnostic if s != "[diagnostic] Process exit code: 13"]
+    if not isinstance(report, dict) or not isinstance(report.get("data"), list):
+        if status == "completed":
+            status = "failed"
+        reasons.append("No readable Retire.js JSON report")
+    elif report.get("errors"):
+        reasons.append("Retire.js reported scanner errors")
+        if status in ("completed", "findings"):
+            status = "partial" if findings else "failed"
+    if reasons and status in ("completed", "findings"):
+        status = "partial"
+    reasons.extend(diagnostic)
+    reasons.append("Bounded JavaScript sample using the image-bundled advisory snapshot")
+    return {"status": status, "source": "retirejs", "target": url, "alerts": findings,
+            "sampled_files": len(samples), "reason": "; ".join(reasons)[:500],
+            "output": f"Retire.js: {len(samples)} sampled files; {len(findings)} unverified advisory matches; status: {status}"}
+
+
+def parse_wapiti(report, target):
+    findings = []
+    groups = report.get("vulnerabilities", {}) if isinstance(report, dict) else {}
+    if not isinstance(groups, dict):
+        return []
+    risks = {0: "Informational", 1: "Low", 2: "Medium", 3: "High", 4: "Critical"}
+    for category, entries in groups.items():
+        if not isinstance(entries, list):
+            continue
+        for item in entries:
+            if not isinstance(item, dict) or str(item.get("method", "GET")).upper() not in ("GET", "HEAD"):
+                continue
+            candidate = urljoin(target, str(item.get("path") or target))
+            if same_origin(candidate, target):
+                findings.append(alert("wapiti", "Wapiti: " + str(category), candidate,
+                                      item.get("info") or "Unverified Wapiti observation",
+                                      risks.get(item.get("level"), "Informational"),
+                                      item.get("module", "")))
+    return findings[:config.WEB_FINDINGS_LIMIT]
+
+
+async def wapiti(url, host, agent, delay):
+    with tempfile.TemporaryDirectory(prefix="asfb-wapiti-") as tmp:
+        root = Path(tmp)
+        report_path, stats_path = str(root / "report.json"), str(root / "stats.json")
+        args = ["/opt/wapiti/bin/python", "/app/app/wapiti_runner.py",
+                "--asfb-stats", stats_path, "--asfb-delay", str(delay),
+                "--asfb-budget", str(config.WAPITI_REQUEST_LIMIT),
+                "-u", url, "--scope", "url", "-m", "csp,http_headers,cookieflags",
+                "--headless", "no", "--tasks", "1", "-d", "0",
+                "--max-links-per-page", "1", "--max-files-per-dir", "1",
+                "--max-scan-time", str(config.WAPITI_SCAN_SECONDS), "--max-attack-time", "5",
+                "--max-parameters", "5", "-t", "5", "-A", agent, "--verify-ssl", "1",
+                "--store-session", str(root / "session"), "--store-config", str(root / "config"),
+                "--no-bugreport", "-f", "json", "-o", report_path]
+        rows, status = await execute(args, config.WAPITI_TIMEOUT_SECONDS)
+        report, stats = read_report(report_path), read_report(stats_path)
+    findings = parse_wapiti(report, url)
+    reasons = [row[:180] for row in rows if row.startswith(("[stderr]", "[diagnostic]"))]
+    if not isinstance(report, dict) or not isinstance(report.get("vulnerabilities"), dict):
+        if status == "completed":
+            status = "failed"
+        reasons.append("No valid Wapiti JSON report produced")
+    if isinstance(stats, dict):
+        if stats.get("limit_reached") or stats.get("response_limited") or stats.get("blocked"):
+            if status == "completed":
+                status = "partial"
+            reasons.append("Origin/method/request/response guard limited coverage")
+    else:
+        if status == "completed":
+            status = "partial"
+        reasons.append("Wapiti guard telemetry unavailable")
+    if any("maximum scan time" in row.lower() or "max scan time" in row.lower() for row in rows):
+        if status == "completed":
+            status = "partial"
+        reasons.append("Wapiti scan deadline reached")
+    reasons.append("Limited GET/HEAD CSP, header and cookie profile; no browser or injection modules")
+    return {"status": status, "source": "wapiti", "target": url, "alerts": findings,
+            "request_count": stats.get("requests", 0) if isinstance(stats, dict) else 0,
+            "reason": "; ".join(reasons)[:500],
+            "output": f"Wapiti: {len(findings)} unverified findings; status: {status}"}

app/config.py

@@ -90,6 +90,8 @@ NUCLEI_CATALOG_PAGE_SIZE = 30
 
 # Optional curated profiles (not enabled unless explicitly selected).
 NUCLEI_OPTIONAL_TEMPLATE_PATHS = {
+    "directory-listing": "/app/app/nuclei-templates/directory-listing.yaml",
+    "openapi-json": "/app/app/nuclei-templates/openapi-json.yaml",
     "bounty-ultimate-lite": "/app/app/nuclei-templates/bounty-ultimate-lite.yaml",
     "bounty-ultimate-medium": "/app/app/nuclei-templates/bounty-ultimate-medium.yaml",
     "bounty-ultimate-large": "/app/app/nuclei-templates/bounty-ultimate-large.yaml",
@@ -128,3 +130,11 @@ TESTSSL_TIMEOUT_SECONDS = 90
 WEB_PREFLIGHT_MAX_BYTES = 524288
 WEB_REPORT_MAX_BYTES = 2000000
 WEB_FINDINGS_LIMIT = 100
+
+# Keyless browser-free modules; downloaded target samples exist only in HF temp directories.
+RETIRE_MAX_FILES = 4
+RETIRE_MAX_FILE_BYTES = 524288
+RETIRE_TIMEOUT_SECONDS = 20
+WAPITI_REQUEST_LIMIT = 12
+WAPITI_SCAN_SECONDS = 25
+WAPITI_TIMEOUT_SECONDS = 40

app/index.html

@@ -13,11 +13,11 @@ button.danger{background:#fff0f2;color:#a53551;border:1px solid #e8b8c3}button.d
 <header><div><h1>ASFB <span class="tag">v0.1</span></h1><div class="muted">Bug bounty scope manager · OWASP ZAP passive analysis</div></div><div class="topbar"><button onclick="refresh()">Connect</button></div></header>
 <div class="notice">Importing scope is not approval to scan. Check each program's automation rules and test only accounts/assets you are authorized to use. Scanning uses a sequential passive queue and requires confirmation of program policy.</div>
 <nav class="tabs" aria-label="Workspace tabs"><button class="tab active" id="tab-scope" onclick="switchTab('scope')">Scope & scanning</button><button class="tab" id="tab-findings" onclick="switchTab('findings')">Findings <span id="findBadge">0</span></button><button class="tab" id="tab-jobs" onclick="switchTab('jobs')">Scan jobs</button><button class="tab" id="tab-settings" onclick="switchTab('settings')">Settings</button><button class="tab" id="tab-logs" onclick="switchTab('logs')">Logs</button></nav><div class="pane" id="pane-scope"><div class="grid"><section class="card"><h2>1. Import HackerOne scope</h2><div class="controls"><input id="file" type="file" accept=".csv,text/csv"/><button onclick="upload()">Import CSV</button><button id="clearScope" class="danger" disabled onclick="clearScope()">Clear imported scope</button></div><p class="muted">Headers supported: Asset name, Type, Coverage, Max. severity, Bounty, Last update, Resolved Reports, plus common API export variants.</p></section>
-<section class="card"><h2>2. Scan settings</h2><div class="controls" style="margin-bottom:12px"><label><input type="checkbox" id="modZap" checked/> ZAP passive</label><label><input type="checkbox" id="modGau"/> GAU archives</label><label><input type="checkbox" id="modKatana"/> Katana crawler</label><label><input type="checkbox" id="modHttpx"/> HTTPX probe</label><label><input type="checkbox" id="modNuclei"/> Nuclei tech checks</label></div><div class="field"><label>Pipeline order (comma-separated, edit to rearrange)</label><input id="stageOrder" value="gau, katana, httpx, zap-passive, nuclei, nikto, wpscan, testssl, ffuf, arjun, dalfox, sqlmap"/></div><p class="muted">Katana and Nuclei generate additional requests, independently of the ZAP request setting. Enable only when program policy permits these modules.</p><div class="controls"><div class="field"><label>Custom User-Agent</label><input id="agent" value="ASFB-Research/0.1"/></div><div class="field"><label>Requests (max 10)</label><input id="requests" type="number" min="1" max="10" value="1"/></div></div><div class="controls" style="margin-top:10px"><div class="field"><label>Identity</label><select id="account"><option value="">Anonymous</option></select></div><div class="field"><label>Delay, seconds</label><input id="delay" type="number" value="1.5" min="1" max="30" step=".5"/></div></div><div style="margin-top:15px"><label><input type="checkbox" id="policy"/> I have checked this program's rules and confirm this passive automated testing is permitted.</label></div><p id="selected" class="muted">Select targets in the scope filters below.</p><button id="start" disabled onclick="scan()">Queue selected scans</button><p id="scanHint" class="muted">Select eligible web assets and confirm the program policy.</p></section></div>
+<section class="card"><h2>2. Scan settings</h2><div class="controls" style="margin-bottom:12px"><label><input type="checkbox" id="modZap" checked/> ZAP passive</label><label><input type="checkbox" id="modGau"/> GAU archives</label><label><input type="checkbox" id="modKatana"/> Katana crawler</label><label><input type="checkbox" id="modHttpx"/> HTTPX probe</label><label><input type="checkbox" id="modNuclei"/> Nuclei tech checks</label></div><div class="field"><label>Pipeline order (comma-separated, edit to rearrange)</label><input id="stageOrder" value="gau, katana, httpx, zap-passive, nuclei, nikto, wpscan, testssl, wapiti, retirejs, ffuf, arjun, dalfox, sqlmap"/></div><p class="muted">Katana and Nuclei generate additional requests, independently of the ZAP request setting. Enable only when program policy permits these modules.</p><div class="controls"><div class="field"><label>Custom User-Agent</label><input id="agent" value="ASFB-Research/0.1"/></div><div class="field"><label>Requests (max 10)</label><input id="requests" type="number" min="1" max="10" value="1"/></div></div><div class="controls" style="margin-top:10px"><div class="field"><label>Identity</label><select id="account"><option value="">Anonymous</option></select></div><div class="field"><label>Delay, seconds</label><input id="delay" type="number" value="1.5" min="1" max="30" step=".5"/></div></div><div style="margin-top:15px"><label><input type="checkbox" id="policy"/> I have checked this program's rules and confirm this passive automated testing is permitted.</label></div><p id="selected" class="muted">Select targets in the scope filters below.</p><button id="start" disabled onclick="scan()">Queue selected scans</button><p id="scanHint" class="muted">Select eligible web assets and confirm the program policy.</p></section></div>
 <section class="card"><h2>Scope assets</h2><p class="muted">Select any imported asset, including manual-review scope entries. Only explicit web-compatible URLs can run HTTP scanner modules; non-web selections stay selected. Up to 1,000 web jobs queued sequentially.</p><div class="controls"><div class="field"><label>Search</label><input id="search" placeholder="Hostname / description" oninput="render()"/></div><div class="field"><label>Minimum max. severity</label><select id="severity" onchange="render()"><option value="all">All</option><option value="medium">Medium+</option><option value="high">High+</option><option value="critical">Critical only</option></select></div><div class="field"><label>Maximum resolved reports</label><input id="reports" type="number" min="0" placeholder="Any" oninput="render()"/></div></div><div class="controls" style="margin-top:13px"><label><input id="bounty" type="checkbox" onchange="render()"/> Reward eligible only</label><label><input id="compatible" type="checkbox" onchange="render()"/> Web-compatible only</label></div><div class="controls" style="margin-top:14px"><button class="secondary" onclick="selectFiltered()">Choose all matching filters</button><button class="secondary" onclick="selectFirst40()">Choose first 1000 matching</button><button class="secondary" onclick="clearSelection()">Clear selection</button><button class="secondary" onclick="copySelectedScope()">Copy selected scope</button><span id="selectionCount" class="tag">0 selected</span></div><div id="selectedTargets" class="controls" style="margin-top:12px"></div><div class="stats" style="margin:15px 0"><div class="stat"><b id="total">0</b><small>Imported assets</small></div><div class="stat"><b id="filtered">0</b><small>Filtered assets</small></div></div><div class="scroll"><table><thead><tr><th>Choose</th><th>Asset / description</th><th>Type</th><th>Max. severity</th><th>Bounty</th><th>Resolved</th></tr></thead><tbody id="rows"></tbody></table></div></section>
 </div></div><div class="pane" id="pane-settings" hidden><section class="card"><h2>Offline JWT review</h2><div class="field" style="margin-top:14px"><label>Offline JWT metadata inspection (never saved)</label><textarea id="jwt" rows="2" placeholder="Paste a test JWT here"></textarea><button class="secondary" onclick="inspectJwt()">Inspect JWT locally on backend</button><pre id="jwtResults" class="results"></pre></div></section>
 <div class="grid"><section class="card"><h2>Account profiles (session only)</h2><div class="controls"><div class="field"><label>Account label</label><input id="aname" placeholder="Test account A"/></div><div class="field"><label>Exact host</label><input id="ahost" placeholder="api.example.org"/></div></div><div class="field" style="margin-top:10px"><label>Cookie header (not persisted)</label><input id="acookie" type="password" autocomplete="off" placeholder="session=..."/></div><button style="margin-top:12px" onclick="addAccount()">Add account</button><p class="muted">Do not use other users' credentials. Cookies stay in backend process memory, not disk.</p></section>
-</div><section class="card"><h2>General settings</h2><p class="muted">Limits apply per scan job, not globally across all browser sessions.</p><div class="toolbar"><div class="field"><label>Pipeline order</label><input id="settingsOrder" value="gau, katana, httpx, zap-passive, nuclei, nikto, wpscan, testssl, ffuf, arjun, dalfox, sqlmap"/></div><div class="field"><label>Discovery endpoint budget</label><input id="settingsLimit" type="number" min="1" max="2000" value="100"/></div><div class="field"><label>ZAP total request budget</label><input id="settingsBudget" type="number" min="1" max="2000" value="100"/></div></div><p class="muted">Settings are scoped to this browser tab. Modules execute sequentially in the specified order.</p><button class="secondary" onclick="applySettings()">Apply pipeline settings</button></section><section class="card" id="nucleiSettings"><h2>Nuclei · Template selection</h2>
+</div><section class="card"><h2>General settings</h2><p class="muted">Limits apply per scan job, not globally across all browser sessions.</p><div class="toolbar"><div class="field"><label>Pipeline order</label><input id="settingsOrder" value="gau, katana, httpx, zap-passive, nuclei, nikto, wpscan, testssl, wapiti, retirejs, ffuf, arjun, dalfox, sqlmap"/></div><div class="field"><label>Discovery endpoint budget</label><input id="settingsLimit" type="number" min="1" max="2000" value="100"/></div><div class="field"><label>ZAP total request budget</label><input id="settingsBudget" type="number" min="1" max="2000" value="100"/></div></div><p class="muted">Settings are scoped to this browser tab. Modules execute sequentially in the specified order.</p><button class="secondary" onclick="applySettings()">Apply pipeline settings</button></section><section class="card" id="nucleiSettings"><h2>Nuclei · Template selection</h2>
 <p class="muted">Combine any bundled profiles, compatible community templates, and custom YAML. This selection applies to new scans only. Community and custom templates must pass the server's GET/HEAD-only validation; dynamic DSL, POST requests, remote interactions, and unsafe paths are blocked.</p>
 <div class="grid">
 <div><h3>Bundled templates and presets</h3><div id="nucleiBuiltins" class="template-choices">
@@ -39,7 +39,7 @@ button.danger{background:#fff0f2;color:#a53551;border:1px solid #e8b8c3}button.d
 <div class="controls"><input type="file" id="nucleiFile" accept=".yaml,.yml,text/yaml" multiple onchange="importNucleiFiles(this.files)" /><button class="secondary" onclick="el('nucleiCustom').value=''">Clear custom YAML</button></div>
 <textarea id="nucleiCustom" rows="7" spellcheck="false" placeholder="id: your-safe-template&#10;info:&#10;  name: ...&#10;  severity: info&#10;http:&#10;  - method: GET&#10;    path: [&#34;{{BaseURL}}/robots.txt&#34;]&#10;    matchers: ..."></textarea>
 <div class="controls"><button class="secondary" onclick="validateNucleiSelection()">Validate selection &amp; budget</button><span id="nucleiReady" class="subtle">Selections are included in new scan requests.</span></div></section>
-<section class="card"><h2>GAU · Archive discovery</h2><div class="toolbar"><div class="field"><label for="settingsGauMode">Archive mode</label><select id="settingsGauMode"><option value="balanced" selected>Balanced (OTX + URLScan)</option><option value="expanded">Expanded (also try Common Crawl)</option></select></div></div><p class="muted">Balanced avoids repeated slow archive lookups for hosts with no historical results. Expanded includes Common Crawl, with independent timeouts and cooldowns. A zero-result archive query does not prove that the host has no endpoints.</p></section><section class="card"><h2>Advanced settings · Individual modules</h2><div class="toolbar"><div class="field"><label>HTTPX: URLs per job</label><input id="settingsHttpx" type="number" value="10" min="1" max="100"/></div><div class="field"><label>Katana: maximum depth</label><input id="settingsKatana" type="number" value="1" min="1" max="5"/></div><div class="field"><label>ZAP: max discovered URLs</label><input id="settingsZap" type="number" value="5" min="1" max="100"/></div></div><div class="grid" style="margin-top:14px"><div><h2>FFUF · Content discovery</h2><p class="muted">Bounded 10-path dictionary, one request per second, single-target consent required.</p></div><div><h2>Arjun · Parameter discovery</h2><p class="muted">Bounded per-target parameter discovery; bounded by a process timeout.</p></div><div><h2>Dalfox · XSS review</h2><p class="muted">Single-target XSS review; output requires manual verification.</p></div><div><h2>SQLmap · SQL injection review</h2><p class="muted">Single parameterized target, low-risk boolean tests; no database extraction.</p></div></div><div class="controls" style="margin-top:13px"><label><input id="modFfuf" type="checkbox"/> FFUF</label><label><input id="modArjun" type="checkbox"/> Arjun</label><label><input id="modDalfox" type="checkbox"/> Dalfox</label><label><input id="modSqlmap" type="checkbox"/> SQLmap</label><label><input id="modNikto" type="checkbox"/> Nikto</label><label><input id="modWpscan" type="checkbox"/> WPScan</label><label><input id="modTestssl" type="checkbox"/> testssl.sh</label><button class="secondary" onclick="enableFullPipeline()">Enable all modules</button></div><p class="muted">WPScan runs only after a current-page WordPress check. testssl.sh runs only for HTTPS and uses a limited server-defaults profile. Skipped stages include a reason in job logs. Nikto uses bounded information and configuration checks. WPScan vulnerability lookups require a WPSCAN_API_TOKEN Space secret; without it, inventory still works.</p><p><label><input id="activeConsent" type="checkbox"/> I have verified this program authorizes active tests against this selected asset.</label></p><p class="notice">These tools may run in an explicitly authorized batch of up to 100 selected targets. They require separate active-testing confirmation. A public Space still lacks strong access control; only test targets and techniques you are authorized to assess.</p></section></div><div class="pane" id="pane-logs" hidden><section class="card"><div class="controls"><h2>Full scan logs</h2><button class="secondary" onclick="copyLogs()">Copy logs</button><button class="secondary" onclick="loadLogs(true)">Refresh</button></div><pre id="fullLogs" class="results">No logs yet.</pre></section></div><div class="pane" id="pane-findings" hidden><section class="card"><div class="controls" style="justify-content:space-between"><h2>Findings explorer</h2><div class="controls"><button class="secondary" onclick="loadScans()">Refresh detections</button><button class="secondary" onclick="clearFindings()">Clear detections</button><button class="secondary" onclick="fullReport()">Full report JSON</button><button class="secondary" onclick="exportFindings()">Export filtered JSON</button><button class="secondary" onclick="exportCSV()">Export filtered CSV</button></div></div><p class="muted">Heuristic scanner alerts, not confirmed vulnerabilities. Repeated detections on the same URL and rule are grouped.</p><div class="summary" id="findSummary"></div><div id="fileExposurePanel" class="exposure-panel" hidden><div class="controls" style="justify-content:space-between"><strong>Potential file exposures <span id="fileExposureCount"></span></strong><span class="subtle">Tool-reported candidates, not confirmed vulnerabilities</span></div><div id="fileExposureList"></div></div><div class="toolbar" style="margin-top:16px"><div class="field"><label>Search</label><input id="findSearch" placeholder="Rule, URL, details..." oninput="renderFindings()"/></div><div class="field"><label>Severity</label><select id="findSeverity" onchange="renderFindings()"><option value="all">All</option><option>Critical</option><option>High</option><option>Medium</option><option>Low</option><option>Informational</option></select></div><div class="field"><label>Confidence</label><select id="findConfidence" onchange="renderFindings()"><option value="all">All</option><option>High</option><option>Medium</option><option>Low</option></select></div><div class="field"><label>Source</label><select id="findSource" onchange="renderFindings()"><option value="all">All tools</option><option value="zap">ZAP</option><option value="nuclei">Nuclei</option><option value="dalfox">Dalfox</option><option value="nikto">Nikto</option><option value="wpscan">WPScan</option><option value="testssl">testssl.sh</option></select></div><div class="field"><label>Host</label><select id="findHost" onchange="renderFindings()"><option value="all">All hosts</option></select></div><div class="field"><label>Sort</label><select id="findSort" onchange="renderFindings()"><option value="severity">Severity first</option><option value="confidence">Confidence first</option><option value="host">Host A-Z</option><option value="count">Most repeated</option></select></div></div><div id="findCount" class="subtle" style="margin-top:13px"></div><div id="findList"></div></section></div><div class="pane" id="pane-jobs" hidden><section class="card"><div class="controls" style="justify-content:space-between"><h2>Scan jobs</h2><div class="controls"><button class="secondary" onclick="loadScans(true)">Refresh jobs</button><button class="secondary" id="pauseUpdates" onclick="toggleAutoRefresh()">Pause live updates</button><button id="cancelAllJobs" class="danger" disabled onclick="cancelAllJobs()">Cancel all jobs</button></div></div><div class="summary" id="jobSummary"></div><div id="scans"></div></section></div>
+<section class="card"><h2>GAU · Archive discovery</h2><div class="toolbar"><div class="field"><label for="settingsGauMode">Archive mode</label><select id="settingsGauMode"><option value="balanced" selected>Balanced (OTX + URLScan)</option><option value="expanded">Expanded (also try Common Crawl)</option></select></div></div><p class="muted">Balanced avoids repeated slow archive lookups for hosts with no historical results. Expanded includes Common Crawl, with independent timeouts and cooldowns. A zero-result archive query does not prove that the host has no endpoints.</p></section><section class="card"><h2>Advanced settings · Individual modules</h2><div class="toolbar"><div class="field"><label>HTTPX: URLs per job</label><input id="settingsHttpx" type="number" value="10" min="1" max="100"/></div><div class="field"><label>Katana: maximum depth</label><input id="settingsKatana" type="number" value="1" min="1" max="5"/></div><div class="field"><label>ZAP: max discovered URLs</label><input id="settingsZap" type="number" value="5" min="1" max="100"/></div></div><div class="grid" style="margin-top:14px"><div><h2>FFUF · Content discovery</h2><p class="muted">Bounded 10-path dictionary, one request per second, single-target consent required.</p></div><div><h2>Arjun · Parameter discovery</h2><p class="muted">Bounded per-target parameter discovery; bounded by a process timeout.</p></div><div><h2>Dalfox · XSS review</h2><p class="muted">Single-target XSS review; output requires manual verification.</p></div><div><h2>SQLmap · SQL injection review</h2><p class="muted">Single parameterized target, low-risk boolean tests; no database extraction.</p></div></div><div class="controls" style="margin-top:13px"><label><input id="modFfuf" type="checkbox"/> FFUF</label><label><input id="modArjun" type="checkbox"/> Arjun</label><label><input id="modDalfox" type="checkbox"/> Dalfox</label><label><input id="modSqlmap" type="checkbox"/> SQLmap</label><label><input id="modNikto" type="checkbox"/> Nikto</label><label><input id="modWpscan" type="checkbox"/> WPScan</label><label><input id="modTestssl" type="checkbox"/> testssl.sh</label><label><input id="modWapiti" type="checkbox"/> Wapiti</label><label><input id="modRetirejs" type="checkbox"/> Retire.js</label><button class="secondary" onclick="enableFullPipeline()">Enable all modules</button></div><p class="muted">WPScan runs only after a current-page WordPress check. testssl.sh runs only for HTTPS and uses a limited server-defaults profile. Skipped stages include a reason in job logs. Nikto uses bounded information and configuration checks. All modules work without API keys. WPScan provides inventory without a key; vulnerability database lookups remain optional. Wapiti checks CSP, HTTP headers and cookie flags with GET/HEAD requests. Retire.js samples up to four same-origin or inline scripts and skips pages without usable JavaScript.</p><p><label><input id="activeConsent" type="checkbox"/> I have verified this program authorizes active tests against this selected asset.</label></p><p class="notice">These tools may run in an explicitly authorized batch of up to 100 selected targets. They require separate active-testing confirmation. A public Space still lacks strong access control; only test targets and techniques you are authorized to assess.</p></section></div><div class="pane" id="pane-logs" hidden><section class="card"><div class="controls"><h2>Full scan logs</h2><button class="secondary" onclick="copyLogs()">Copy logs</button><button class="secondary" onclick="loadLogs(true)">Refresh</button></div><pre id="fullLogs" class="results">No logs yet.</pre></section></div><div class="pane" id="pane-findings" hidden><section class="card"><div class="controls" style="justify-content:space-between"><h2>Findings explorer</h2><div class="controls"><button class="secondary" onclick="loadScans()">Refresh detections</button><button class="secondary" onclick="clearFindings()">Clear detections</button><button class="secondary" onclick="fullReport()">Full report JSON</button><button class="secondary" onclick="exportFindings()">Export filtered JSON</button><button class="secondary" onclick="exportCSV()">Export filtered CSV</button></div></div><p class="muted">Heuristic scanner alerts, not confirmed vulnerabilities. Repeated detections on the same URL and rule are grouped.</p><div class="summary" id="findSummary"></div><div id="fileExposurePanel" class="exposure-panel" hidden><div class="controls" style="justify-content:space-between"><strong>Potential file exposures <span id="fileExposureCount"></span></strong><span class="subtle">Tool-reported candidates, not confirmed vulnerabilities</span></div><div id="fileExposureList"></div></div><div class="toolbar" style="margin-top:16px"><div class="field"><label>Search</label><input id="findSearch" placeholder="Rule, URL, details..." oninput="renderFindings()"/></div><div class="field"><label>Severity</label><select id="findSeverity" onchange="renderFindings()"><option value="all">All</option><option>Critical</option><option>High</option><option>Medium</option><option>Low</option><option>Informational</option></select></div><div class="field"><label>Confidence</label><select id="findConfidence" onchange="renderFindings()"><option value="all">All</option><option>High</option><option>Medium</option><option>Low</option></select></div><div class="field"><label>Source</label><select id="findSource" onchange="renderFindings()"><option value="all">All tools</option><option value="zap">ZAP</option><option value="nuclei">Nuclei</option><option value="dalfox">Dalfox</option><option value="nikto">Nikto</option><option value="wpscan">WPScan</option><option value="testssl">testssl.sh</option><option value="wapiti">Wapiti</option><option value="retirejs">Retire.js</option></select></div><div class="field"><label>Host</label><select id="findHost" onchange="renderFindings()"><option value="all">All hosts</option></select></div><div class="field"><label>Sort</label><select id="findSort" onchange="renderFindings()"><option value="severity">Severity first</option><option value="confidence">Confidence first</option><option value="host">Host A-Z</option><option value="count">Most repeated</option></select></div></div><div id="findCount" class="subtle" style="margin-top:13px"></div><div id="findList"></div></section></div><div class="pane" id="pane-jobs" hidden><section class="card"><div class="controls" style="justify-content:space-between"><h2>Scan jobs</h2><div class="controls"><button class="secondary" onclick="loadScans(true)">Refresh jobs</button><button class="secondary" id="pauseUpdates" onclick="toggleAutoRefresh()">Pause live updates</button><button id="cancelAllJobs" class="danger" disabled onclick="cancelAllJobs()">Cancel all jobs</button></div></div><div class="summary" id="jobSummary"></div><div id="scans"></div></section></div>
 <p id="message" class="muted" role="status" aria-live="polite"></p></main>
 <script>
 let assets=[],selectedIds=new Set(),visibleWebIds=[],scanJobs=[],findings=[],currentTab="scope";
@@ -115,7 +115,7 @@ async function scan(){
    el('nucleiReady').textContent='Validated '+check.templates.length+' templates, estimated '+check.per_target_requests+' requests per target; up to '+check.max_targets_within_budget+' targets per Nuclei job.';
   }catch(e){return message('Nuclei preflight failed before queuing: '+e.message,true);}
  }
-const active=modules.some(m=>['ffuf','arjun','dalfox','sqlmap','nikto','wpscan','testssl'].includes(m));if(active&&ids.length>100)return message('Active review allows up to 100 approved targets per batch.',true);if(active&&!el('activeConsent').checked)return message('Confirm active review authorization under Settings.',true);
+const active=modules.some(m=>['ffuf','arjun','dalfox','sqlmap','nikto','wpscan','testssl','wapiti','retirejs'].includes(m));if(active&&ids.length>100)return message('Active review allows up to 100 approved targets per batch.',true);if(active&&!el('activeConsent').checked)return message('Confirm active review authorization under Settings.',true);
  if(!el('policy').checked)return message('Confirm the program policy first.',true);
  try{
   let r;
@@ -233,7 +233,7 @@ function applySettings(){
  }catch(e){message(e.message,true)}
 }
 function enabledModulesFrom(raw){
- const names={"gau":"modGau","katana":"modKatana","httpx":"modHttpx","zap-passive":"modZap","nuclei":"modNuclei","ffuf":"modFfuf","arjun":"modArjun","dalfox":"modDalfox","sqlmap":"modSqlmap","nikto":"modNikto","wpscan":"modWpscan","testssl":"modTestssl"};
+ const names={"gau":"modGau","katana":"modKatana","httpx":"modHttpx","zap-passive":"modZap","nuclei":"modNuclei","ffuf":"modFfuf","arjun":"modArjun","dalfox":"modDalfox","sqlmap":"modSqlmap","nikto":"modNikto","wpscan":"modWpscan","testssl":"modTestssl","wapiti":"modWapiti","retirejs":"modRetirejs"};
  const order=raw.split(",").map(s=>s.trim().toLowerCase()).filter(Boolean);
  if(order.length!==new Set(order).size||order.some(n=>!names[n]))throw Error("Invalid or duplicate pipeline stage.");
  const selected=Object.keys(names).filter(n=>el(names[n])?.checked);
@@ -241,8 +241,8 @@ function enabledModulesFrom(raw){
  return order.filter(n=>el(names[n]).checked);
 }
 function enableFullPipeline(){
- for(const id of ["modZap","modGau","modKatana","modHttpx","modNuclei","modFfuf","modArjun","modDalfox","modSqlmap","modNikto","modWpscan","modTestssl"])el(id).checked=true;
- const order="gau, katana, httpx, zap-passive, nuclei, nikto, wpscan, testssl, ffuf, arjun, dalfox, sqlmap";
+ for(const id of ["modZap","modGau","modKatana","modHttpx","modNuclei","modFfuf","modArjun","modDalfox","modSqlmap","modNikto","modWpscan","modTestssl","modWapiti","modRetirejs"])el(id).checked=true;
+ const order="gau, katana, httpx, zap-passive, nuclei, nikto, wpscan, testssl, wapiti, retirejs, ffuf, arjun, dalfox, sqlmap";
  el("stageOrder").value=order;el("settingsOrder").value=order;
  message("All modules enabled. Runtime applicability checks skip unsuitable stages. Confirm active-testing authorization before queuing.");
 }

app/main.py

@@ -582,7 +582,7 @@ async def run_scan_job(identifier, spec):
                     job["alerts"].extend(result["alerts"])
                 elif module in WEB_MODULES:
                     result = await run_web_module(
-                        module, url, host, spec.user_agent, spec.delay_seconds)
+                        module, url, host, spec.user_agent, spec.delay_seconds, endpoints)
                     job["reviews"].append(result)
                     job["alerts"].extend(result.get("alerts", []))
                 elif module in ACTIVE_MODULES:

app/nuclei-templates/directory-listing.yaml

@@ -0,0 +1,27 @@
+id: asfb-directory-listing
+info:
+  name: Directory listing page observed
+  author: asfb
+  severity: info
+  description: An index page with directory navigation was observed. This does not establish sensitive file exposure.
+  tags: exposure,listing
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status: [200]
+      - type: word
+        part: header
+        words: ["text/html"]
+        case-insensitive: true
+      - type: regex
+        part: body
+        regex:
+          - '(?i)<title>\s*Index of [^<]*</title>'
+      - type: word
+        part: body
+        words: ["Parent Directory", "href="]
+        condition: and

app/nuclei-templates/openapi-json.yaml

@@ -0,0 +1,26 @@
+id: asfb-openapi-json
+info:
+  name: OpenAPI document available
+  author: asfb
+  severity: info
+  description: A structured API specification is accessible at a common path. Public documentation may be intentional and is not an authorization bypass.
+  tags: exposure,api,metadata
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/openapi.json"
+      - "{{BaseURL}}/swagger.json"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status: [200]
+      - type: regex
+        part: body
+        regex:
+          - '"openapi"\s*:\s*"3\.'
+          - '"swagger"\s*:\s*"2\.'
+        condition: or
+      - type: regex
+        part: body
+        regex:
+          - '"paths"\s*:\s*\{'

app/pipeline.py

@@ -87,9 +87,10 @@ async def nuclei(url, host, agent, urls=None, default_ids=None,
     # on /app/main.js or /manifest.json can produce misleading or wasted requests.
     origin = urlsplit(url)._replace(path="/", query="", fragment="").geturl()
     exposure_profile = any(name.startswith("bounty-ultimate-") for name in selected_ids)
-    if exposure_profile:
+    if exposure_profile or "openapi-json" in selected_ids:
         targets = [origin]
-        scope_strategy = "origin-only exposure profile"
+        scope_strategy = ("origin-only exposure profile" if exposure_profile
+                          else "origin-only API metadata profile")
     else:
         def target_priority(candidate):
             parts = urlsplit(candidate)

app/wapiti_guard.py

@@ -0,0 +1,90 @@
+"""Request guard installed only inside the dedicated Wapiti subprocess."""
+import asyncio
+import ipaddress
+import os
+import socket
+import time
+from urllib.parse import urlsplit
+
+import httpx
+
+
+def origin(value):
+    p = urlsplit(str(value))
+    if p.scheme not in ("http", "https") or not p.hostname or p.username or p.password:
+        raise ValueError("Invalid HTTP origin")
+    return p.scheme, p.hostname, p.port if p.port is not None else (443 if p.scheme == "https" else 80)
+
+
+async def validate_public(host):
+    addresses = await asyncio.to_thread(socket.getaddrinfo, host, None, 0, socket.SOCK_STREAM)
+    if not addresses:
+        raise ValueError("No DNS addresses")
+    if os.environ.get("ALLOW_PRIVATE_TARGETS") != "1":
+        if any(not ipaddress.ip_address(row[4][0]).is_global for row in addresses):
+            raise ValueError("Non-public DNS address")
+
+
+class BoundedStream(httpx.AsyncByteStream):
+    def __init__(self, wrapped, limit, guard):
+        self.wrapped, self.limit, self.guard = wrapped, limit, guard
+
+    async def __aiter__(self):
+        count = 0
+        async for chunk in self.wrapped:
+            count += len(chunk)
+            if count > self.limit:
+                self.guard.response_limited = True
+                raise httpx.ReadError("ASFB Wapiti response size limit reached")
+            yield chunk
+
+    async def aclose(self):
+        await self.wrapped.aclose()
+
+
+class RequestGuard:
+    def __init__(self, target, delay, limit=12, max_bytes=1048576):
+        self.target_origin = origin(target)
+        self.delay, self.limit, self.max_bytes = max(1.0, float(delay)), limit, max_bytes
+        self.requests, self.blocked = 0, 0
+        self.limit_reached, self.response_limited = False, False
+        self.last_started = None
+        self.lock = asyncio.Lock()
+
+    def wrap(self, original):
+        async def send(client, request, **kwargs):
+            try:
+                allowed = origin(request.url) == self.target_origin and request.method in ("GET", "HEAD")
+            except ValueError:
+                allowed = False
+            if not allowed:
+                self.blocked += 1
+                raise httpx.RequestError("ASFB Wapiti request outside the allowed origin/method", request=request)
+            async with self.lock:
+                if self.requests >= self.limit:
+                    self.limit_reached = True
+                    raise httpx.RequestError("ASFB Wapiti request budget reached", request=request)
+                if self.last_started is not None:
+                    await asyncio.sleep(max(0.0, self.delay - (time.monotonic() - self.last_started)))
+                try:
+                    await validate_public(self.target_origin[1])
+                except (OSError, ValueError) as exc:
+                    raise httpx.RequestError("ASFB Wapiti DNS validation failed", request=request) from exc
+                self.requests += 1
+                self.last_started = time.monotonic()
+                requested_stream = kwargs.get("stream", False)
+                kwargs.update(follow_redirects=False, stream=True)
+                response = await original(client, request, **kwargs)
+                response.stream = BoundedStream(response.stream, self.max_bytes, self)
+                if not requested_stream:
+                    try:
+                        await response.aread()
+                    except BaseException:
+                        await response.aclose()
+                        raise
+                return response
+        return send
+
+    def report(self):
+        return {"requests": self.requests, "blocked": self.blocked,
+                "limit_reached": self.limit_reached, "response_limited": self.response_limited}

app/wapiti_runner.py

@@ -0,0 +1,37 @@
+"""Run the pinned Wapiti CLI with the ASFB origin/method/budget guard."""
+import json
+import sys
+from pathlib import Path
+
+import httpx
+from wapiti_guard import RequestGuard
+
+
+def pop_option(name, default=None):
+    if name not in sys.argv:
+        return default
+    index = sys.argv.index(name)
+    value = sys.argv[index + 1]
+    del sys.argv[index:index + 2]
+    return value
+
+
+def main():
+    stats = pop_option("--asfb-stats")
+    delay = float(pop_option("--asfb-delay", "1.5"))
+    budget = int(pop_option("--asfb-budget", "12"))
+    guard = None
+    if "-u" in sys.argv:
+        target = sys.argv[sys.argv.index("-u") + 1]
+        guard = RequestGuard(target, delay, budget)
+        httpx.AsyncClient.send = guard.wrap(httpx.AsyncClient.send)
+    try:
+        from wapitiCore.main.wapiti import wapiti_asyncio_wrapper
+        wapiti_asyncio_wrapper()
+    finally:
+        if stats and guard:
+            Path(stats).write_text(json.dumps(guard.report()), encoding="utf-8")
+
+
+if __name__ == "__main__":
+    main()

app/web_modules.py

@@ -14,7 +14,7 @@ from . import config
 from .pipeline import execute, in_host
 from .scope import public_host
 
-MODULES = {"nikto", "wpscan", "testssl"}
+MODULES = {"nikto", "wpscan", "testssl", "wapiti", "retirejs"}
 
 
 def same_origin(candidate, target):
@@ -188,9 +188,14 @@ def command(module, target, host, agent, report, delay):
     raise ValueError("Unknown web module")
 
 
-async def run_web_module(module, url, host, agent, delay=1.5):
+async def run_web_module(module, url, host, agent, delay=1.5, discovered=None):
     if module not in MODULES or not in_host(url, host):
         raise ValueError("Invalid module or out-of-scope web target")
+    if module in ("wapiti", "retirejs"):
+        from . import client_modules
+        if module == "retirejs":
+            return await client_modules.retirejs(url, host, agent, delay, discovered or [])
+        return await client_modules.wapiti(url, host, agent, delay)
     target, evidence = url, ""
     if module == "testssl" and urlsplit(url).scheme != "https":
         return {"status": "skipped", "alerts": [], "target": url,

docs/MODULE_ROADMAP.md

@@ -14,16 +14,27 @@ All three require the existing active-testing confirmation, appear in job logs,
 
 Use **Settings → Enable all modules** to select every currently implemented stage. This preserves the separate authorization checkbox. The server checks applicability when each job runs, regardless of how modules were selected.
 
-WPScan inventory works without a vulnerability API token. For vulnerability database lookups, optionally set **WPSCAN_API_TOKEN** as a Hugging Face Space **secret**. It is read from the tool's documented environment variable, never inserted into command arguments or returned report metadata. Metadata is fetched during the remote image build; scans use --no-update and isolated temporary cookie/cache paths. See [WPScan's license](https://github.com/wpscanteam/wpscan/blob/v4.2.0/LICENSE) for its usage terms.
+All implemented modules work without API keys. WPScan runs its inventory profile without a key and clearly reports unavailable vulnerability database coverage. A WPSCAN_API_TOKEN Space secret remains optional for users who already have one; it is never needed to run the pipeline.
+
+## Second group: keyless additions
+
+| Module / check | State | Runtime applicability and limits |
+| --- | --- | --- |
+| [Retire.js 6.1.0](https://github.com/RetireJS/retire.js/blob/6.1.0/node/README.md) | Implemented | Samples current-page inline scripts and same-origin script URLs, including JS inventory from earlier discovery stages. Maximum 4 files, 512 KiB per file, no redirects. Skips if no usable JavaScript is available. Runs the scanner on HF temporary files as data; never executes target JavaScript. Uses an image-bundled upstream advisory snapshot and no runtime API/key. Findings retain their original source URLs. Snapshot freshness and bounded sampling limit coverage. |
+| [Wapiti 3.3.2](https://github.com/wapiti-scanner/wapiti/wiki) | Implemented, limited profile | Browser-free CSP, HTTP-header and cookie-flag checks. Exact selected URL scope, guarded exact origin, GET/HEAD only, 12-request hard limit, configured request delay, no redirects, 25-second scan / 40-second process deadline. No injection modules, form submissions, endpoint callbacks or automatic bug reports. Separate Python 3.12 environment matches upstream requirements. |
+| Directory listing Nuclei template | Implemented, opt-in | HTML index title plus directory-navigation markers and HTTP 200. Informational observation; does not prove sensitive file exposure. |
+| OpenAPI JSON Nuclei template | Implemented, opt-in | Two common JSON paths, version and paths-object markers, HTTP 200. Runs at the origin once even when discovery found many asset paths. Public API documentation may be intentional. |
+
+Both modules appear in Settings, Enable all modules, source filters and stage logs. Sampling failures and guard limits are reported explicitly. Tests include the actual installed Retire.js scanner on a synthetic JS fixture and the actual installed Wapiti engine behind a mocked HTTP transport; they send no live-target traffic.
 
 ## Requested next groups
 
 | Requested feature | State | Intended input / applicability gate |
 | --- | --- | --- |
-| More [Nuclei templates](https://docs.projectdiscovery.io/templates/introduction) | Planned, WIP | Reviewed HTTP templates, technology gates, exact-origin constraints, existing request budgets and validation. |
-| [Gemini Nuclei template generation](https://ai.google.dev/gemini-api/docs/structured-output) | Planned | Separate draft-generation action with a Space secret and configurable model. Generated templates must pass existing template restrictions and Nuclei validation before explicit selection. Do not auto-run generated YAML. |
-| [Wapiti](https://github.com/wapiti-scanner/wapiti) | Planned | Explicit web asset, capped crawl/attack modules, selected methods, exact-origin policy. |
-| [Retire.js](https://github.com/RetireJS/retire.js) | Planned | Bounded same-origin JavaScript files or uploaded source; not arbitrary domain text passed to a filesystem scanner. |
+| More [Nuclei templates](https://docs.projectdiscovery.io/templates/introduction) | Two added; further expansion WIP | Reviewed HTTP templates, technology gates, exact-origin constraints, existing request budgets and validation. |
+| [Gemini Nuclei template generation](https://ai.google.dev/gemini-api/docs/structured-output) | Deferred under keyless preference | Hosted Gemini generation needs API credentials, so it is not part of the keyless pipeline. Any future optional integration would use a separate draft-generation action with a Space secret and configurable model. Generated templates must pass existing template restrictions and Nuclei validation before explicit selection. Do not auto-run generated YAML. |
+| [Wapiti](https://github.com/wapiti-scanner/wapiti) | Limited profile implemented | Further profiles need separately reviewed request/method limits. |
+| [Retire.js](https://github.com/RetireJS/retire.js) | Implemented for web JavaScript | Source/SBOM upload workflows remain future work. |
 | [TruffleHog](https://github.com/trufflesecurity/trufflehog) | Planned | Explicit repository/artifact input on remote infrastructure. Redacted secret findings; verification behavior must be explicit. |
 | [OWASP Amass](https://github.com/owasp-amass/amass) | Planned | Passive domain discovery first. Newly discovered subdomains are inventory and do not automatically become authorized scan targets. |
 | [OWASP dep-scan](https://github.com/owasp-dep-scan/dep-scan) | Planned | Source, SBOM or container artifact; a URL-only job is inapplicable. |

tests/retire_offline_smoke.js

@@ -0,0 +1,24 @@
+// No target JavaScript is executed. Retire scans this synthetic fixture as data.
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const cp = require("child_process");
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "asfb-retire-smoke-"));
+try {
+  const assets = path.join(root, "assets");
+  fs.mkdirSync(assets);
+  fs.writeFileSync(path.join(assets, "jquery-1.6.1.js"), "/* Synthetic file-name detector fixture. */");
+  const report = path.join(root, "report.json");
+  const result = cp.spawnSync("/usr/local/bin/node", ["/opt/retire/lib/cli.js", "--path", assets,
+    "--jsrepo", "/opt/retire-db/jsrepository-v5.json", "--outputformat", "json",
+    "--outputpath", report, "--exitwith", "13"], {encoding:"utf8", timeout:20000});
+  if (result.status !== 13) throw Error("Expected Retire vulnerability exit code 13: " + result.stderr);
+  const data = JSON.parse(fs.readFileSync(report, "utf8"));
+  if (!data.data.some(f => f.results.some(c => c.component === "jquery" && c.vulnerabilities?.length))) {
+    throw Error("The installed Retire scanner did not report the known fixture");
+  }
+  if (data.errors.length) throw Error(JSON.stringify(data.errors));
+  process.stdout.write("Retire.js installed-engine offline smoke passed\n");
+} finally {
+  fs.rmSync(root, {recursive:true, force:true});
+}

tests/test_client_modules.py

@@ -0,0 +1,161 @@
+import asyncio
+import json
+from pathlib import Path
+from unittest.mock import patch
+
+import httpx
+import pytest
+
+from app import client_modules as tools, config, main, nuclei_catalog, pipeline, web_modules
+from test_worker_pipeline import run_job
+
+
+def test_script_inventory_keeps_same_origin_and_javascript_inline_only():
+    parser = tools.ScriptInventory("https://example.org/")
+    parser.feed('<script src="/app.js"></script><script src="https://outside.org/a.js"></script>'
+                '<script src="https://example.org:8443/a.js"></script>'
+                '<script>/*! jQuery v1.6.1 */</script><script type="application/ld+json">{}</script>')
+    assert parser.urls == ["https://example.org/app.js"]
+    assert len(parser.inline) == 1
+
+
+def test_retire_no_javascript_skips_without_starting_node():
+    async def fetch(*args): return b"<html>No scripts</html>", "text/html"
+    with patch.object(tools, "fetch_sample", fetch), patch.object(tools, "execute") as execute:
+        result = asyncio.run(tools.retirejs("https://example.org/", "example.org", "Test", 1.5, []))
+    assert result["status"] == "skipped"
+    assert not execute.called
+
+
+def test_retire_fetch_failure_does_not_claim_a_clean_scan():
+    async def fetch(*args): raise httpx.ReadTimeout("mock")
+    with patch.object(tools, "fetch_sample", fetch), patch.object(tools, "execute") as execute:
+        result = asyncio.run(tools.retirejs("https://example.org/", "example.org", "Test", 1.5, []))
+    assert result["status"] == "skipped"
+    assert "ReadTimeout" in result["reason"]
+    assert not execute.called
+
+
+def test_retire_samples_bounded_files_uses_bundled_database_and_maps_findings():
+    fetches = []
+    async def fetch(url, *args):
+        fetches.append(url)
+        if url == "https://example.org/":
+            scripts = "".join(f'<script src="/jquery-{i}.js"></script>' for i in range(8))
+            return scripts.encode(), "text/html"
+        return b"/* sample */", "application/javascript"
+    async def execute(args, timeout):
+        assert "--includeOsv" not in args
+        assert args[args.index("--jsrepo") + 1] == "/opt/retire-db/jsrepository-v5.json"
+        root = Path(args[args.index("--path") + 1])
+        files = sorted(root.rglob("*.js"))
+        assert len(files) == config.RETIRE_MAX_FILES
+        assert files[0].name == "jquery-0.js"
+        report = {"data": [{"file": str(files[0]), "results": [
+            {"component": "jquery", "version": "1.6.1", "vulnerabilities": [
+                {"severity": "high", "identifiers": {"CVE": ["CVE-TEST"], "summary": "Mock candidate"}}]}]}],
+                  "errors": []}
+        Path(args[args.index("--outputpath") + 1]).write_text(json.dumps(report))
+        return ["[diagnostic] Process exit code: 13"], "failed"
+    async def sleep(*args): pass
+    with patch.object(tools, "fetch_sample", fetch), patch.object(tools, "execute", execute), \
+         patch.object(tools.asyncio, "sleep", sleep):
+        result = asyncio.run(tools.retirejs("https://example.org/", "example.org", "Test", 1.5,
+                                           ["https://outside.org/out.js"]))
+    assert result["status"] == "partial"  # More JS existed than the configured sample.
+    assert result["sampled_files"] == 4
+    assert result["alerts"][0]["url"] == "https://example.org/jquery-0.js"
+    assert result["alerts"][0]["risk"] == "High"
+    assert len(fetches) == 5
+    assert "Process exit code: 13" not in result["reason"]
+
+
+def test_retire_unknown_report_path_is_never_assigned_to_the_target(tmp_path):
+    known = str((tmp_path / "known.js").resolve())
+    report = {"data": [{"file": str(tmp_path / "outside.js"), "results": [
+        {"component": "x", "version": "1", "vulnerabilities": [{"severity": "high"}]}]}]}
+    assert tools.parse_retire(report, {known: "https://example.org/a.js"}) == []
+
+
+@pytest.mark.parametrize("guard_stats,expected", [
+    ({"requests": 2}, "completed"),
+    ({"requests": 12, "limit_reached": True}, "partial"),
+    ({"requests": 1, "blocked": 1}, "partial"),
+])
+def test_wapiti_cli_profile_and_coverage(guard_stats, expected):
+    async def execute(args, timeout):
+        assert args[args.index("-m") + 1] == "csp,http_headers,cookieflags"
+        assert args[args.index("--scope") + 1] == "url"
+        assert args[args.index("--headless") + 1] == "no"
+        assert "--no-bugreport" in args
+        Path(args[args.index("-o") + 1]).write_text(json.dumps({
+            "vulnerabilities": {"Header": [{"method": "GET", "path": "/",
+                                           "level": 1, "info": "missing", "module": "http_headers"}]}}))
+        Path(args[args.index("--asfb-stats") + 1]).write_text(json.dumps(guard_stats))
+        return [], "completed"
+    with patch.object(tools, "execute", execute):
+        result = asyncio.run(tools.wapiti("https://example.org/", "example.org", "Test", 1.5))
+    assert result["status"] == expected
+    assert result["alerts"][0]["source"] == "wapiti"
+
+
+def test_wapiti_missing_report_is_failed():
+    async def execute(*args): return [], "completed"
+    with patch.object(tools, "execute", execute):
+        result = asyncio.run(tools.wapiti("https://example.org/", "example.org", "Test", 1.5))
+    assert result["status"] == "failed"
+
+
+def test_wapiti_parser_filters_other_origins_and_methods():
+    report = {"vulnerabilities": {"Mock": [
+        {"method": "GET", "path": "https://outside.org/", "info": "outside"},
+        {"method": "POST", "path": "/", "info": "wrong method"},
+        {"method": "GET", "path": "/", "info": "kept", "level": 1}]}}
+    findings = tools.parse_wapiti(report, "https://example.org/")
+    assert len(findings) == 1 and findings[0]["description"] == "kept"
+
+
+def test_new_module_dispatch_receives_discovery_inventory():
+    seen = []
+    async def retire(*args):
+        seen.extend(args[-1])
+        return {"status": "skipped", "alerts": [], "reason": "No JS"}
+    with patch.object(tools, "retirejs", retire):
+        result = asyncio.run(web_modules.run_web_module(
+            "retirejs", "https://example.org/", "example.org", "Test",
+            discovered=["https://example.org/a.js"]))
+    assert result["status"] == "skipped"
+    assert seen == ["https://example.org/a.js"]
+
+
+def test_worker_new_modules_and_skip_are_isolated():
+    run, job = run_job(["retirejs", "wapiti", "httpx"])
+    async def module(name, *args):
+        return {"status": "skipped" if name == "retirejs" else "completed", "alerts": [], "output": name}
+    async def probe(*args): return {"status": "completed", "probes": []}
+    with patch.object(main, "public_host"), patch.object(main, "run_web_module", module), \
+         patch.object(main, "probe", probe):
+        asyncio.run(run())
+    assert job["status"] == "completed"
+    assert job["pipeline"]["retirejs"] == "skipped"
+    assert job["pipeline"]["httpx"] == "completed"
+
+
+def test_optional_nuclei_templates_validate_and_do_not_change_defaults():
+    for name in ("directory-listing", "openapi-json"):
+        assert name in nuclei_catalog.builtins()
+        assert name not in config.NUCLEI_DEFAULT_IDS
+        content = nuclei_catalog.bundled_content(name)
+        nuclei_catalog.validate_template(content)
+        assert nuclei_catalog.estimate_requests(content) <= 2
+
+
+def test_openapi_fixed_paths_run_only_at_origin():
+    async def execute(args, deadline):
+        targets = Path(args[args.index("-l") + 1]).read_text().splitlines()
+        assert targets == ["https://example.org/"]
+        return [], "completed"
+    with patch.object(pipeline, "execute", execute):
+        result = asyncio.run(pipeline.nuclei("https://example.org/", "example.org", "Test",
+                            ["https://example.org/app.js"], default_ids=["openapi-json"]))
+    assert result["targets_checked"] == 1

tests/test_wapiti_guard.py

@@ -0,0 +1,59 @@
+import asyncio
+from unittest.mock import patch
+
+import httpx
+import pytest
+
+from app import wapiti_guard as module
+
+
+async def no_dns(*args): pass
+
+
+@pytest.mark.parametrize("url,method", [
+    ("https://outside.org/", "GET"),
+    ("https://example.org:8443/", "GET"),
+    ("http://example.org/", "GET"),
+    ("https://example.org/", "POST"),
+])
+def test_guard_blocks_unapproved_origin_and_methods(url, method):
+    async def scenario():
+        guard = module.RequestGuard("https://example.org/", 1.5)
+        async def original(*args, **kwargs): raise AssertionError("must not send")
+        with pytest.raises(httpx.RequestError):
+            await guard.wrap(original)(object(), httpx.Request(method, url))
+        assert guard.blocked == 1 and guard.requests == 0
+    asyncio.run(scenario())
+
+
+def test_guard_disables_redirects_and_limits_number_of_requests():
+    async def scenario():
+        guard = module.RequestGuard("https://example.org/", 1.5, limit=1)
+        async def original(client, request, **kwargs):
+            assert kwargs["follow_redirects"] is False
+            assert kwargs["stream"] is True
+            return httpx.Response(302, headers={"location": "https://outside.org/"}, content=b"", request=request)
+        request = httpx.Request("GET", "https://example.org/")
+        with patch.object(module, "validate_public", no_dns):
+            response = await guard.wrap(original)(object(), request, follow_redirects=True)
+            assert response.status_code == 302
+            with pytest.raises(httpx.RequestError):
+                await guard.wrap(original)(object(), request)
+        assert guard.requests == 1 and guard.limit_reached
+    asyncio.run(scenario())
+
+
+def test_guard_stops_large_stream():
+    async def scenario():
+        class Stream(httpx.AsyncByteStream):
+            async def __aiter__(self):
+                yield b"0123456789"
+            async def aclose(self): pass
+        guard = module.RequestGuard("https://example.org/", 1.5, max_bytes=3)
+        async def original(client, request, **kwargs):
+            return httpx.Response(200, stream=Stream(), request=request)
+        with patch.object(module, "validate_public", no_dns):
+            with pytest.raises(httpx.ReadError):
+                await guard.wrap(original)(object(), httpx.Request("GET", "https://example.org/"))
+        assert guard.response_limited
+    asyncio.run(scenario())

tests/wapiti_offline_smoke.py

@@ -0,0 +1,49 @@
+"""Exercise the real installed Wapiti engine using a mocked HTTP transport."""
+import json
+import socket
+import sys
+import tempfile
+from pathlib import Path
+
+import httpx
+
+sys.path.insert(0, "/app/app")
+import wapiti_guard
+import wapiti_runner
+
+calls = []
+
+
+async def no_dns(*args):
+    pass
+
+
+async def fake_send(client, request, **kwargs):
+    calls.append((str(request.url), request.method))
+    assert str(request.url).startswith("https://example.invalid/")
+    assert request.method in ("GET", "HEAD")
+    assert kwargs["follow_redirects"] is False
+    return httpx.Response(200, content=b"<html><title>Offline fixture</title></html>",
+                          headers={"content-type": "text/html", "set-cookie": "fixture=value; Path=/"},
+                          request=request)
+
+
+wapiti_guard.validate_public = no_dns
+httpx.AsyncClient.send = fake_send
+socket.gethostbyname = lambda *args: "93.184.216.34"
+with tempfile.TemporaryDirectory() as tmp:
+    root = Path(tmp)
+    report, stats = root / "report.json", root / "stats.json"
+    sys.argv = ["wapiti_runner.py", "--asfb-stats", str(stats), "--asfb-delay", "1",
+                "--asfb-budget", "12", "-u", "https://example.invalid/", "--scope", "url",
+                "-m", "csp,http_headers,cookieflags", "--headless", "no", "--tasks", "1",
+                "-d", "0", "--max-scan-time", "15", "--max-attack-time", "3",
+                "--store-session", str(root / "session"), "--store-config", str(root / "config"),
+                "--no-bugreport", "-f", "json", "-o", str(report)]
+    wapiti_runner.main()
+    result = json.loads(report.read_text())
+    assert result["vulnerabilities"], result
+    assert any(result["vulnerabilities"].values()), result
+    assert calls
+    assert json.loads(stats.read_text())["requests"] > 0
+print("Wapiti installed-engine offline smoke passed")