No additional context supplied.
"
+ summary=html.escape(str(item.get("summary", "Observation"))),
+ tool=html.escape(str(item.get("tool", "unknown"))),
+ command=_format_html_command(item),
+ timing=_format_html_timing(item),
+ severity=(
+ f"
Launch Scoped Scan
-
All scans are read-only. Provide a target host and optional parameters, then launch the scan.
+
All scans are read-only and operate with a conservative reconnaissance profile. Provide a single host to scan; network ranges require explicit authorization.
diff --git a/reconscript/templates/report_detail.html b/reconscript/templates/report_detail.html
index 53debf2..e330eac 100644
--- a/reconscript/templates/report_detail.html
+++ b/reconscript/templates/report_detail.html
@@ -1,26 +1,43 @@
+
+
{% extends 'layout.html' %}
{% block content %}
Report {{ report_id }}
-
Target: {{ report.target }}
-
Evidence level: {{ report.evidence_level }}
-
Report hash: {{ report.report_hash }}
- {% if report.consent_signed_by %}
-
Consent signer: {{ report.consent_signed_by }}
- {% endif %}
+
Target: {{ report.metadata.target }}
+
Resolved: {{ report.metadata.resolved_target }}
+
Evidence level: {{ report.metadata.evidence_level }}
+
Profile: {{ report.metadata.profile.name }} (TCP max {{ report.metadata.profile.max_tcp_ports }}, concurrency {{ report.metadata.profile.tcp_concurrency }})
+
Authorization confirmed: {{ 'yes' if report.metadata.consent_present else 'no' }}
Started: {{ report.started_at }} | Completed: {{ report.completed_at }}
-
Open ports
-
- {% for port in report.open_ports %}
- - {{ port }}
- {% else %}
- - No open ports detected.
- {% endfor %}
-
-
HTTP Checks
-
{{ report.http_checks | tojson(indent=2) }}
+
Scanned TCP ports: {{ report.metadata.scanned_tcp_ports|join(', ') }}
+
Scanned UDP ports: {{ report.metadata.scanned_udp_ports|join(', ') }}
+
+
Artifacts
+
{{ report.artifacts | tojson(indent=2) }}
+
Findings
-
{{ report.findings | tojson(indent=2) }}
+ {% if report.findings %}
+
+ {% else %}
+
No findings recorded.
+ {% endif %}
+
Download report JSON
{% endblock %}
diff --git a/reconscript/ui.py b/reconscript/ui.py
index b380337..e6e3a93 100644
--- a/reconscript/ui.py
+++ b/reconscript/ui.py
@@ -1,4 +1,6 @@
-"""Flask UI for ReconScript without authentication or consent requirements."""
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
+"""Flask UI for ReconScript with safe default scanning profiles."""
from __future__ import annotations
@@ -20,8 +22,8 @@
from .core import ReconError, run_recon
from .logging import configure_logging
-from .metrics import metrics_payload
from .report import ensure_results_dir, persist_report
+from .scanner import profile_for_evidence
from .scope import validate_target
LOGGER = logging.getLogger(__name__)
@@ -59,6 +61,8 @@ def health() -> tuple[str, int]:
@app.route("/metrics")
def metrics() -> Response:
+ from .metrics import metrics_payload
+
payload, content_type = metrics_payload()
if not payload:
return Response("", status=204)
@@ -67,22 +71,49 @@ def metrics() -> Response:
@app.route("/", methods=["GET", "POST"])
def index():
if request.method == "POST":
- target = request.form.get("target", "")
+ target = request.form.get("target", "").strip()
expected_ip = request.form.get("expected_ip") or None
hostname = request.form.get("hostname") or None
evidence_level = request.form.get("evidence_level", "low")
+ authorization = request.form.get("authorization") == "on"
ports_raw = request.form.get("ports", "")
ports = (
[int(p.strip()) for p in ports_raw.split(",") if p.strip()]
if ports_raw
else None
)
+
+ if not authorization:
+ flash(
+ (
+ "You must confirm 'I have authorization to scan this target' "
+ "before running a scan."
+ ),
+ "error",
+ )
+ return render_template("index.html")
+
try:
validate_target(target, expected_ip=expected_ip)
except Exception as exc: # pragma: no cover - input validation
flash(str(exc), "error")
return render_template("index.html")
+ try:
+ profile = profile_for_evidence(evidence_level)
+ except ValueError as exc:
+ flash(str(exc), "error")
+ return render_template("index.html")
+
+ network_like = (
+ any(symbol in target for symbol in ("/", "*")) or "," in target
+ )
+ if network_like:
+ LOGGER.info(
+ "ui.scan.wide_scope",
+ extra={"event": "ui.scan.wide_scope", "target": target},
+ )
+
try:
LOGGER.info(
"ui.scan.request",
@@ -93,6 +124,7 @@ def index():
"ports": ports,
"expected_ip": expected_ip,
"evidence_level": evidence_level,
+ "profile": profile.as_dict(),
},
)
report = run_recon(
@@ -101,6 +133,7 @@ def index():
ports=ports,
expected_ip=expected_ip,
evidence_level=evidence_level,
+ profile=profile,
)
except ReconError as exc:
flash(str(exc), "error")
@@ -121,7 +154,9 @@ def index():
"event": "ui.scan.completed",
"target": target,
"report_id": persisted.report_id,
- "open_ports": report.get("open_ports", []),
+ "open_ports": report.get("artifacts", {})
+ .get("tcp", {})
+ .get("open_ports", []),
},
)
return redirect(url_for("report_detail", report_id=persisted.report_id))
diff --git a/tests/integration/test_safe_profile_smoke.py b/tests/integration/test_safe_profile_smoke.py
new file mode 100644
index 0000000..31ac465
--- /dev/null
+++ b/tests/integration/test_safe_profile_smoke.py
@@ -0,0 +1,28 @@
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
+"""Smoke test ensuring a safe profile run persists a report."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from reconscript.core import run_recon
+from reconscript.report import persist_report
+
+
+@pytest.mark.integration
+def test_safe_profile_persists_report(tmp_path: Path) -> None:
+ report = run_recon(target="127.0.0.1", ports=[80], evidence_level="low")
+ persisted = persist_report(report)
+ try:
+ stored = json.loads(persisted.report_file.read_text(encoding="utf-8"))
+ assert stored["metadata"]["profile"]["name"].startswith("safe")
+ assert stored["findings"], "Expected findings in persisted report"
+ assert all(len(f["raw_snippet"]) <= 400 for f in stored["findings"])
+ finally:
+ import shutil
+
+ shutil.rmtree(persisted.base, ignore_errors=True)
diff --git a/tests/integration/test_scan_mock.py b/tests/integration/test_scan_mock.py
index 6af62a0..bbf6217 100644
--- a/tests/integration/test_scan_mock.py
+++ b/tests/integration/test_scan_mock.py
@@ -1,4 +1,6 @@
-from __future__ import annotations
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
+"""Integration tests for safe-profile scans against a local mock server."""
import http.server
import json
@@ -36,25 +38,30 @@ def mock_server() -> tuple[str, int]:
@pytest.mark.integration
-def test_scan_low_and_medium_levels(mock_server) -> None:
+def test_safe_profile_generates_required_metadata(mock_server) -> None:
host, port = mock_server
- report_low = run_recon(target=host, ports=[port], evidence_level="low")
- assert port in report_low["open_ports"]
+ report = run_recon(target=host, ports=[port], evidence_level="low")
- persisted = persist_report(report_low)
+ tcp_artifacts = report["artifacts"]["tcp"]
+ assert port in tcp_artifacts["open_ports"]
+
+ for finding in report["findings"]:
+ assert {
+ "tool",
+ "cmdline",
+ "summary",
+ "started_at",
+ "completed_at",
+ "raw_snippet",
+ }.issubset(finding)
+ assert len(finding["raw_snippet"]) <= 400
+
+ persisted = persist_report(report)
try:
report_data = json.loads(persisted.report_file.read_text(encoding="utf-8"))
stored_hash = report_data["report_hash"]
assert stored_hash == compute_report_hash(report_data)
-
- http_data = report_data["http_checks"][str(port)]
- assert "raw_request" not in http_data
- assert "raw_response" not in http_data
- assert http_data["headers"]["Set-Cookie"] == "[redacted]"
-
- report_medium = run_recon(target=host, ports=[port], evidence_level="medium")
- http_medium = report_medium["http_checks"][port]
- assert http_medium.get("screenshots") == []
- assert "raw_response" not in http_medium
+ assert report_data["metadata"]["profile"]["name"].startswith("safe")
+ assert all(len(f["raw_snippet"]) <= 400 for f in report_data["findings"])
finally:
shutil.rmtree(persisted.base, ignore_errors=True)
diff --git a/tests/integration/test_scan_scanme.py b/tests/integration/test_scan_scanme.py
index 540c064..0443195 100644
--- a/tests/integration/test_scan_scanme.py
+++ b/tests/integration/test_scan_scanme.py
@@ -1,3 +1,5 @@
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
from __future__ import annotations
import os
@@ -14,4 +16,5 @@
)
def test_scan_scanme() -> None:
report = run_recon(target="scanme.nmap.org", evidence_level="low")
- assert "open_ports" in report
+ assert "artifacts" in report
+ assert "findings" in report
diff --git a/tests/test_core_safe_profile.py b/tests/test_core_safe_profile.py
new file mode 100644
index 0000000..4ac25b4
--- /dev/null
+++ b/tests/test_core_safe_profile.py
@@ -0,0 +1,33 @@
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
+"""Tests for the safe default recon workflow."""
+
+from __future__ import annotations
+
+from reconscript.core import run_recon
+from reconscript.scanner import profile_for_evidence
+
+
+def test_run_recon_safe_defaults() -> None:
+ profile = profile_for_evidence("low")
+ report = run_recon(
+ target="127.0.0.1", ports=[80], evidence_level="low", profile=profile
+ )
+
+ metadata = report["metadata"]
+ assert metadata["profile"]["allow_credentialed"] is False
+ assert metadata["profile"]["dir_enum"] in {"low", "medium", "none"}
+
+ findings = report["findings"]
+ assert isinstance(findings, list)
+ assert findings, "Expected at least one finding even if target is quiet"
+ for finding in findings:
+ assert {
+ "tool",
+ "cmdline",
+ "summary",
+ "started_at",
+ "completed_at",
+ "raw_snippet",
+ }.issubset(finding.keys())
+ assert len(finding["raw_snippet"]) <= 400
diff --git a/tests/test_reporters.py b/tests/test_reporters.py
index 619f5a8..a969b00 100644
--- a/tests/test_reporters.py
+++ b/tests/test_reporters.py
@@ -7,15 +7,32 @@
def sample_report() -> dict[str, object]:
return {
- "target": "example.com",
- "hostname": "example.com",
- "ports": [80, 443],
- "open_ports": [80],
+ "metadata": {
+ "target": "example.com",
+ "hostname": "example.com",
+ "scanned_tcp_ports": [80, 443],
+ "profile": {
+ "name": "safe-default",
+ "max_tcp_ports": 100,
+ "tcp_concurrency": 10,
+ "dir_enum": "low",
+ "allow_credentialed": False,
+ },
+ },
+ "artifacts": {
+ "http": {
+ "services": {80: {"status_code": 200, "url": "http://example.com"}}
+ },
+ "tcp": {"open_ports": [80]},
+ },
"findings": [
{
- "port": 80,
- "issue": "missing_security_headers",
- "details": {"header": "Strict-Transport-Security"},
+ "tool": "http-check",
+ "cmdline": "http --url http://example.com",
+ "summary": "HTTP responded with 200 OK without Strict-Transport-Security.",
+ "raw_snippet": "Header Strict-Transport-Security missing",
+ "started_at": "2024-01-01T00:00:00Z",
+ "completed_at": "2024-01-01T00:00:01Z",
}
],
"runtime": {"started_at": "2024-01-01T00:00:00Z"},
@@ -27,7 +44,7 @@ def test_render_markdown_fallback_contains_sections() -> None:
assert "# ReconScript Report" in markdown
assert "## Findings" in markdown
assert "## Recommendations" in markdown
- assert "Strict-Transport-Security" in markdown
+ assert "http --url http://example.com" in markdown
def test_write_report_markdown(tmp_path: Path) -> None:
diff --git a/tests/test_scanner_profile.py b/tests/test_scanner_profile.py
new file mode 100644
index 0000000..502840d
--- /dev/null
+++ b/tests/test_scanner_profile.py
@@ -0,0 +1,37 @@
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
+"""Unit tests for ReconProfile defaults and helpers."""
+
+from __future__ import annotations
+
+import pytest
+
+from reconscript.scanner import ReconProfile, profile_for_evidence
+
+
+def test_recon_profile_defaults() -> None:
+ profile = ReconProfile(name="test-profile")
+ assert profile.max_tcp_ports == 100
+ assert profile.tcp_concurrency == 10
+ assert profile.dir_enum == "low"
+ assert profile.timeouts["http"] == pytest.approx(5.0)
+ assert profile.rate_limits["tcp"] == (5.0, 5.0)
+
+
+def test_profile_for_evidence_levels() -> None:
+ low = profile_for_evidence("low")
+ medium = profile_for_evidence("medium")
+ high = profile_for_evidence("high")
+
+ assert low.dir_enum == "low"
+ assert medium.dir_enum == "medium"
+ assert high.dir_enum == "none"
+ assert high.max_tcp_ports > medium.max_tcp_ports >= low.max_tcp_ports
+
+
+def test_limit_ports_enforces_cap() -> None:
+ profile = ReconProfile(name="cap-test", max_tcp_ports=3)
+ ports = profile.limit_ports([80, 443, 8080, 8443])
+ assert len(ports) == 3
+ assert ports[0] == 80
+ assert 443 in ports
diff --git a/tests/test_ui_safe_profile.py b/tests/test_ui_safe_profile.py
new file mode 100644
index 0000000..d83476a
--- /dev/null
+++ b/tests/test_ui_safe_profile.py
@@ -0,0 +1,100 @@
+# Authorized testing only — do not scan targets without explicit permission.
+# This tool is non-intrusive by default and will not perform exploitation or credentialed checks.
+"""UI tests ensuring authorization gating and report persistence."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from reconscript.ui import create_app
+
+
+@pytest.fixture()
+def ui_app(monkeypatch, tmp_path: Path):
+ monkeypatch.setenv("RESULTS_DIR", str(tmp_path))
+
+ saved_report: dict[str, Any] = {
+ "metadata": {
+ "target": "127.0.0.1",
+ "resolved_target": "127.0.0.1",
+ "hostname": None,
+ "version": "test",
+ "evidence_level": "low",
+ "profile": {
+ "name": "test",
+ "max_tcp_ports": 10,
+ "tcp_concurrency": 2,
+ "udp_pass": True,
+ "dns_active": True,
+ "dns_passive": True,
+ "dir_enum": "low",
+ "allow_credentialed": False,
+ "timeouts": {},
+ "rate_limits": {},
+ },
+ "consent_present": False,
+ "scanned_tcp_ports": [80],
+ "scanned_udp_ports": [53],
+ },
+ "artifacts": {},
+ "findings": [
+ {
+ "tool": "test",
+ "cmdline": "cmd --arg",
+ "summary": "ok",
+ "started_at": "2024-01-01T00:00:00Z",
+ "completed_at": "2024-01-01T00:00:01Z",
+ "raw_snippet": "evidence",
+ }
+ ],
+ }
+
+ def fake_run_recon(**_: Any) -> dict[str, Any]:
+ return json.loads(json.dumps(saved_report))
+
+ monkeypatch.setattr("reconscript.ui.run_recon", fake_run_recon)
+
+ app = create_app()
+ app.config.update(TESTING=True)
+ return app
+
+
+def test_ui_requires_authorization(ui_app) -> None:
+ client = ui_app.test_client()
+ response = client.post(
+ "/",
+ data={
+ "target": "127.0.0.1",
+ "evidence_level": "low",
+ # No authorization checkbox
+ },
+ follow_redirects=True,
+ )
+ assert response.status_code == 200
+ assert "I have authorization" in response.get_data(as_text=True)
+
+
+def test_ui_runs_scan_without_consent(ui_app, tmp_path: Path) -> None:
+ client = ui_app.test_client()
+ response = client.post(
+ "/",
+ data={
+ "target": "127.0.0.1",
+ "evidence_level": "low",
+ "authorization": "on",
+ },
+ follow_redirects=False,
+ )
+ assert response.status_code == 302
+
+ results_dir = Path(ui_app.config["UPLOAD_FOLDER"]).parent
+ report_dirs = [path for path in results_dir.iterdir() if path.is_dir()]
+ assert report_dirs, "Expected a persisted report directory"
+ report_file = report_dirs[0] / "report.json"
+ stored = json.loads(report_file.read_text(encoding="utf-8"))
+ assert stored["findings"][0]["cmdline"] == "cmd --arg"
+ assert len(stored["findings"][0]["raw_snippet"]) <= 400