Yogesh OjhaandClaude Opus 5 6b4eac833f fix(scan): close the last gaps between a scan context and its tools ...

A pass over every tool the resolved config reaches, driving a real run
end to end and reading the argv each client builds.

vhost swept http:// whatever the run asked for. FfufClient took a scheme
argument nothing passed, so https_only did not hold for virtual-host
discovery — a hole in the setting shipped earlier today.

tlsx never went through the proxy. It was handed HTTP_PROXY env vars,
which a raw TLS dial does not read, and tlsx does define -proxy:

  -proxy socks5://u:p@10.0.0.1:1080  accepted
  -proxy 10.0.0.1:1080               first path segment cannot contain colon
  -proxy http://10.0.0.1:8080        proxy: unknown scheme: http

so it takes the URL when the scan's proxy is socks5, and refuses through
availability() otherwise rather than dialling direct. is_socks5() now
holds that decision for both tlsx and naabu.

Screenshots had no rate limit at any level: no field on the config and no
-rate-limit in the capture arguments, so a ceiling did not bind the
render pass.

The context's follow-redirects override reached only nuclei. The control
offers "Engine default", which promises an override, and http_probe and
endpoint_probe used their own setting regardless. origin_probe and
session_check keep theirs, which are requirements rather than
preferences.

basic auth with both fields blank sent Authorization: Basic Og== to every
target. Every other auth type already guarded on truthiness.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ

2026-09-13 12:31:26 +05:30

..

__init__.py

feat(scans): expansion phase — cdn check, port scan, http probe

2026-06-26 16:17:52 +05:30

client.py

fix(scan): close the last gaps between a scan context and its tools

2026-09-13 12:31:26 +05:30

parser.py

fix(ipv6): give tools an authority they can parse

2026-09-13 11:34:01 +05:30