Function stashAndUpdatePwn

web/scripts/ragnar_modern.js:7088–7142

()

    _ndBusy(btn, true, 'Listening…');
    out.classList.remove('hidden');
    out.innerHTML = '<p class="text-sm text-gray-400">Passively capturing TLS/QUIC handshakes on the segment…</p>';
    try {
        _tlsFillIfaces();
        const qs = '?seconds=' + encodeURIComponent(secs) + (iface ? '&interface=' + encodeURIComponent(iface) : '') + (noquic ? '&no_quic=1' : '');
        const d = await fetchAPI('/api/net/tls-watch' + qs);
        if (!d || d.success === false) {
            const msg = (d && d.error) || 'failed';
            let extra = '';
            if (d && d.missing_tool === 'tcpdump') extra = ' <button onclick="installNetTool(\'tcpdump\', this, runTlsWatch)" class="ml-2 underline text-cyan-400">Install tcpdump</button>';
            out.innerHTML = '<p class="text-sm text-red-400">Error: ' + escapeHtml(msg) + extra + '</p>';
            return;
        }
        const [cls, label] = _TLS_VERDICT_STYLE[d.verdict] || _TLS_VERDICT_STYLE.unknown;
        let html = `<div class="mb-2 px-3 py-2 rounded border ${cls} text-sm">${label}</div>`;
        html += `<p class="text-xs text-gray-500 mb-2">Interface: ${escapeHtml(d.interface || '—')} · ${d.seconds}s window · ${d.tls || 0} TLS · ${d.quic || 0} QUIC handshake(s)</p>`;
        const S = d.sessions || [];
        if (!S.length) {
            html += '<p class="text-sm text-gray-400">No TLS/QUIC handshakes observed. On a switched network you need a SPAN/mirror port to see other hosts.</p>';
        } else {
            html += '<table class="min-w-full text-xs text-gray-300 whitespace-nowrap"><thead>' +
                '<tr class="text-left text-gray-500"><th class="px-2 py-1">Proto</th><th class="px-2 py-1">Endpoints</th><th class="px-2 py-1">SNI</th><th class="px-2 py-1">ALPN</th><th class="px-2 py-1">JA4</th><th class="px-2 py-1">Negotiated</th></tr></thead><tbody>';
            S.forEach(s => {
                const alpn = (s.alpn || []).join(',') || '—';
                const neg = s.negotiated_version ? (_tlsVerName(s.negotiated_version) + (s.cipher ? ' ' + s.cipher : '')) : '—';
                const bad = (s.findings || []).some(f => f.severity === 'high');
                const dup = (s.count > 1) ? ` <span class="text-slate-500" title="${s.count} duplicate connections collapsed">×${s.count}</span>` : '';
                html += `<tr class="border-t border-slate-800 align-top">
                    <td class="px-2 py-1 uppercase ${s.proto === 'quic' ? 'text-cyan-300' : 'text-gray-400'}">${escapeHtml(s.proto)}</td>
                    <td class="px-2 py-1 font-mono text-gray-400">${escapeHtml(s.src)} → ${escapeHtml(s.dst)}${dup}</td>
                    <td class="px-2 py-1 ${bad ? 'text-red-300' : 'text-gray-200'}">${escapeHtml(s.sni || '—')}</td>
                    <td class="px-2 py-1 text-gray-400">${escapeHtml(alpn)}</td>
                    <td class="px-2 py-1 font-mono text-gray-300" title="${escapeHtml(s.ja4_r || '')}">${escapeHtml(s.ja4 || '—')}</td>
                    <td class="px-2 py-1 text-gray-400">${escapeHtml(neg)}</td>
                </tr>`;
                (s.findings || []).forEach(f => {
                    html += `<tr class="border-0"><td></td><td colspan="5" class="px-2 pb-1 text-xs ${_TLS_SEV_COLOR[f.severity] || 'text-gray-400'}">└ ${escapeHtml(f.severity)} ${escapeHtml(f.code)}: ${escapeHtml(f.message)}</td></tr>`;
                });
            });
            html += '</tbody></table>';
        }
        out.innerHTML = html;
    } catch (e) {
        out.innerHTML = '<p class="text-sm text-red-400">Failed: ' + escapeHtml(e.message) + '</p>';
    } finally {
        _ndBusy(btn, false);
    }
}

// ---- SSH Watch (passive regreSSHion / Terrapin observer) -------------------
const _SSH_VERDICT_STYLE = {
    clean:       ['bg-green-950/40 border-green-900 text-green-400', '✓ No SSH posture issues — modern algorithms, no regreSSHion pattern'],
    suspicious:  ['bg-amber-950/50 border-amber-800 text-amber-300', '⚠ SSH exposure — regreSSHion posture, Terrapin, or weak algorithms; review the findings'],
    unknown:     ['bg-slate-800 border-slate-700 text-slate-400', '— Could not determine'],
};
const _SSH_SEV_COLOR = { high: 'text-red-300', warn: 'text-amber-300', notice: 'text-gray-300', info: 'text-gray-500' };
function _sshFillIfaces() {
    const sel = document.getElementById('ssh-iface');
    if (!sel || sel.dataset.filled === '1') return Promise.resolve();