Generate prioritized recommendations.

Get baseline response for comparison.

Get SSL certificate information.

Get request headers including auth.

Get request headers.

Get or create socket connection.

Search GitHub for PoC repositories.

Track email open via tracking pixel.

Check if endpoint has ID-like parameter.

Identify potential attack chains from findings.

Inject payload into URL parameter.

Load built-in templates.

Load campaigns from disk.

Load custom templates from disk.

Run nmap scan and parse results.

Strip non-numeric patch suffixes so NVD keyword searches are more likely to match. Examples: "8.4p1" → "8.4" "3.6.2b1" → "

Map Metasploit check result codes to our status strings.

Parse simple cron expression and return next run time. Supports: minute hour day month weekday

Parse endpoint definition.

Parse nmap XML output and return services list.

Parse nmap XML output.

Parse LLM output into structured RemediationPlan.

Parse security scheme definition.

Write run + confirmed findings + remediations to SQLite.

BLUE-3: Apply safe remediations with dry_run=False.

RED-2: Metasploit check-only confirmation. Strategy: 1. CVE-based check — look up CVE ID in our module map, run check()

BLUE-2: Generate AI remediation scripts for each confirmed finding. Capped at _MAX_REMEDIATION_TARGETS highest-CVSS unique exposures to

RED-1: Network scan + CVE lookup per service.

BLUE-1: Check if confirmed vulnerabilities show signs of prior exploitation. Inspects local log files for IOC patterns associated wit

BLUE-4: Re-run exploit check to confirm vulnerability is now closed.

Direct socket probe to confirm a service is reachable. Used for auxiliary scanner modules where module.check doesn't apply.

Perform reverse DNS (PTR) lookup for an IP address.

Main scheduler loop.

Compute 0–100 score and list of deduction reasons.

Send message via TCP/TLS.

Send message via UDP.

Check if event meets severity threshold.

Parse the script for file paths and snapshot them before modification.

Fallback socket-based port scanner.

Test for JWT algorithm confusion vulnerability.

Test for authentication bypass vulnerabilities.

Test rate limiting on authentication endpoints.

Test for Broken Object Level Authorization (BOLA/IDOR).

Test for broken authentication issues.

Test for injection vulnerabilities.

Test for mass assignment vulnerabilities.

Add a target to the campaign.

Audit passwords from a file (one per line). Skips blank lines and comments.

Calculate an absolute risk score (0–100) from a list of CVE dicts. Uses absolute weight accumulation (not ratio-based) so that having mo

Run compliance check against a standard. Args: target: Target being assessed standard_id: ID of the standard to check

Find all modules relevant to a service and run check() on each. Returns results for every applicable module.

Logout and close connection.

Create a new scheduled scan. Args: name: Schedule name target: Target to scan modules: List of scan modul

Delete a schedule.

Discover common OpenAPI spec locations. Args: base_url: Base URL of the API Returns: List of potential spec

Validate targets against ROE. Returns: (warnings, allowed_targets) - warnings: human-readable scope violatio

Export a single event. Args: event: Event to export Returns: True if successful

Export multiple events. Args: events: Events to export Returns: Tuple of (successful, failed) counts

Export audit results as CSV (no plaintext passwords).

Generate an evidence-grade DOCX report. Requires: pip install python-docx

Export audit results as JSON (no plaintext passwords).

Export a scan result as events. Args: result: Scan result to export Returns: Tuple of (successful, failed) c

Return scanner/check modules for a given service name or port. Used as fallback when no CVE-specific module mapping exists.

Return the relevant prerequisite checks for a given finding.

Format remediation guide as readable text. Args: guide: The remediation guide Returns: Formatted string

Create from dictionary.

Create campaign from dictionary.

Create event from a Finding.

Create events from a ScanResult.

Generate remediation scripts for a confirmed exploit finding. Args: result: An ExploitResult with status=CONFIRMED

Generate remediation scripts for a service misconfiguration (no CVE required). Useful for: exposed Redis, weak SSH config, open Teln

Generate HTML report. Args: scan_results: List of scan results config: Report configuration ai_analysis:

Generate JSON report. Args: scan_results: List of scan results config: Report configuration Returns:

Generate a memorable passphrase from a word list. Example output (5 words): Alpine-Bridge-Castle-Desert-Ember-42! Args:

Ask the LLM to generate a step-by-step remediation plan.

Get all events for a campaign.

Generate executive summary for non-technical stakeholders. Returns: Executive-friendly summary

Confirmed exposures per run for the last N days.

Get landing page template by ID.

Risk score per run for the last N days.

Get a specific standard by ID.

Get campaign statistics.

Aggregate stats across all runs.

Perform rate-limited HEAD request.