Add adversarial-nations sweep: PAN-OS < 10.2.14 fingerprint, US-adversarial country list

inputs/countries.yaml

@@ -1,20 +1,56 @@
 scan_profile:
-  name: "example-sweep"
+  name: "adversarial-nations-panos"
-  rate: 1000
+  rate: 3000
   max_hosts_per_country: null
 
 countries:
-  - code: VE
+  # Largest internet footprint first — most likely to surface exposed devices
+  - code: RU
     priority: high
     exclude_cidrs: []
+    notes: "Russia"
 
-  - code: US
+  - code: CN
+    priority: high
+    exclude_cidrs: []
+    notes: "China"
+
+  - code: IR
+    priority: high
+    exclude_cidrs: []
+    notes: "Iran"
+
+  - code: BY
     priority: medium
-    exclude_cidrs:
+    exclude_cidrs: []
-      - "10.0.0.0/8"
+    notes: "Belarus"
-      - "172.16.0.0/12"
-      - "192.168.0.0/16"
 
-  - code: NL
+  - code: VE
+    priority: medium
+    exclude_cidrs: []
+    notes: "Venezuela"
+
+  - code: SY
+    priority: medium
+    exclude_cidrs: []
+    notes: "Syria"
+
+  - code: NI
     priority: low
     exclude_cidrs: []
+    notes: "Nicaragua"
+
+  - code: CU
+    priority: low
+    exclude_cidrs: []
+    notes: "Cuba"
+
+  - code: MM
+    priority: low
+    exclude_cidrs: []
+    notes: "Myanmar"
+
+  - code: KP
+    priority: low
+    exclude_cidrs: []
+    notes: "North Korea — minimal public internet, low yield expected"

inputs/targets.yaml

@@ -1,4 +1,35 @@
 targets:
+  - name: "Palo Alto PAN-OS < 10.2.14"
+    tags: [panos, firewall, palo-alto, cve-2024-3400, network-device]
+    ports: [443, 4443, 8443]
+    probes:
+      - type: https
+        path: "/api/?type=version"
+        method: GET
+        match_in: body
+        patterns: ["sw-version"]
+        version_extract: "<sw-version>([0-9]+\\.[0-9]+\\.[0-9]+)"
+        version_compare:
+          operator: "<"
+          value: "10.2.14"
+        confidence: high
+
+      - type: https
+        path: "/php/login.php"
+        method: GET
+        match_in: [body, headers]
+        patterns:
+          - "Palo Alto Networks"
+          - "PAN-OS"
+        confidence: low
+
+      - type: https
+        path: "/global-protect/portal/gp-portal-esp.esp"
+        method: GET
+        match_in: body
+        patterns: ["globalprotect", "PAN-OS"]
+        confidence: low
+
   - name: "Ubuntu 24.04 SSH"
     tags: [linux, ubuntu, ssh]
     ports: [22]