Method _run_dns_passive

recon_engine.py:339–404

(self, target: str)

                open_ports.append({"port": port, "scheme": scheme,
                                   "url": f"{scheme}://{host}:{port}"})

        threads = [threading.Thread(target=probe, args=(p,), daemon=True)
                   for p in COMMON_WEB_PORTS]
        for t in threads:
            t.start()
        for t in threads:
            t.join(timeout=6)
        open_ports.sort(key=lambda p: p["port"])

        result.findings = [
            _make_finding(
                "port_scan", host, VulnSeverity.INFO,
                title=f"Open port {p['port']}/tcp ({p['scheme'].upper()})",
                description=f"{p['url']} is reachable and speaks {p['scheme']}.",
                port=p["port"], matched_at=p["url"],
            ) for p in open_ports
        ]
        result.artifacts = {"host": host, "ports": open_ports,
                            "scanned": list(COMMON_WEB_PORTS)}
        # 'ok' when we found something; 'partial' when the sweep ran but nothing
        # was open (still a valid, useful answer).
        result.status = "ok" if open_ports else "partial"
        result.duration_seconds = round(time.monotonic() - started, 2)
        return result

    def _run_tls_audit(self, target: str) -> ReconResult:
        result = ReconResult(recon_type=ReconType.TLS_AUDIT, target=target)
        started = time.monotonic()
        try:
            from sslyze import (
                ServerNetworkLocation,
                Scanner,
                ServerScanRequest,
                ScanCommand,
            )
        except ImportError as exc:
            result.status = "error"
            result.error_message = f"sslyze not installed: {exc}"
            result.duration_seconds = time.monotonic() - started
            return result

        host, port = _split_host_port(target, default_port=443)
        try:
            location = ServerNetworkLocation(hostname=host, port=port)
            request = ServerScanRequest(
                server_location=location,
                scan_commands={
                    ScanCommand.CERTIFICATE_INFO,
                    ScanCommand.SSL_2_0_CIPHER_SUITES,
                    ScanCommand.SSL_3_0_CIPHER_SUITES,
                    ScanCommand.TLS_1_0_CIPHER_SUITES,
                    ScanCommand.TLS_1_1_CIPHER_SUITES,
                    ScanCommand.TLS_1_2_CIPHER_SUITES,
                    ScanCommand.TLS_1_3_CIPHER_SUITES,
                    ScanCommand.HEARTBLEED,
                    ScanCommand.ROBOT,
                    ScanCommand.OPENSSL_CCS_INJECTION,
                    ScanCommand.HTTP_HEADERS,