Yogesh OjhaandClaude Opus 5 f178a5952f fix(proxy): carry the scan's proxy and headers into the last three tools ...

Three tools took the scan's network config and dropped part of it.

The banner prober spoke SOCKS5 to whatever proxy it was given. A scan
context holding an http:// proxy made every handshake fail, and the stage
reported "no banner returned by N ports" rather than a problem. It now
speaks SOCKS5 or HTTP CONNECT by scheme (tools/banner/proxy.py, tested
against a stub proxy), and refuses a scheme it cannot carry before any
port is touched instead of dialling direct.

naabu was handed the resolved URL whole. Its -proxy is socks5 only and
takes no inline credentials, so http:// or any password quietly did not
apply. proxy_args() renders -proxy host:port with -proxy-auth beside it,
and names the reason when the proxy cannot be expressed, which port_scan
and host_discovery report as partial. -passive is an HTTPS call to
Shodan, so it goes through proxy_env instead, which passive_ports was not
passing at all.

wafw00f got the proxy but never the headers, so an authenticated surface
was fingerprinted unauthenticated. It takes a file rather than a value,
so the run writes one 0600 temp file and removes it after.

proxy_env moves to shared/services/proxy_resolve.py now that naabu wants
it too, and host_port() lands in shared/utils/net.py for the bracketed
IPv6 authority CONNECT needs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ

2026-09-13 11:25:48 +05:30

..

ai

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

api_key

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

asset_export

fix(exports): make the evidence switch do something

2026-09-13 09:17:55 +05:30

asset_query

feat(correlation): correlate across every target, not just inside one scan

2026-09-13 09:32:22 +05:30

bounty_providers

feat(bounty-hub): read Intigriti through its researcher API

2026-09-12 23:35:59 +05:30

correlation

feat(correlation): correlate across every target, not just inside one scan

2026-09-13 09:32:22 +05:30

orchestrator

fix(secrets): keep scan credentials out of the command log

2026-09-13 11:16:23 +05:30

surface_query

feat(exports): write the rows a query returns to a file

2026-09-13 08:04:10 +05:30

__init__.py

Refactor validation and DNS tools, implementation of onboarding wizard

2026-06-21 21:56:20 +05:30

activity_log.py

fix(scans): one NUL byte in a response no longer costs a 66-minute stage

2026-09-06 03:59:33 +05:30

bgp_summary.py

Refactor validation and DNS tools, implementation of onboarding wizard

2026-06-21 21:56:20 +05:30

bounty_feed.py

feat(bounty-hub): read Intigriti through its researcher API

2026-09-12 23:35:59 +05:30

bounty_programs.py

feat(bounty-hub): read Intigriti through its researcher API

2026-09-12 23:35:59 +05:30

celery_dispatch.py

feat(exports): run an export as a job, and keep the recipe

2026-09-13 08:21:50 +05:30

cert_freshness.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

debounce.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

endpoint_inventory.py

feat(endpoints): drop junk URLs by rule before the insert and after the probe

2026-09-12 18:24:07 +05:30

endpoint_judge.py

feat(endpoints): drop junk URLs by rule before the insert and after the probe

2026-09-12 18:24:07 +05:30

endpoint_noise.py

feat(endpoints): drop junk URLs by rule before the insert and after the probe

2026-09-12 18:24:07 +05:30

event_publisher.py

Refactor validation and DNS tools, implementation of onboarding wizard

2026-06-21 21:56:20 +05:30

exploitation.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

focused.py

feat(bounty-hub): watch a program

2026-09-12 21:51:18 +05:30

interest.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

ip_asn.py

fix(recon): correlate the estate, not the provider it rents

2026-09-12 22:49:52 +05:30

ip_inventory.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

launch_plan.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

locks.py

feat(bounty-hub): read Intigriti through its researcher API

2026-09-12 23:35:59 +05:30

notification_sync.py

feat(bounty-hub): watch a program

2026-09-12 21:51:18 +05:30

notification.py

feat(bounty-hub): watch a program

2026-09-12 21:51:18 +05:30

notifier.py

feat(bounty-hub): watch a program

2026-09-12 21:51:18 +05:30

nvd_corpus.py

feat(cve): CVEs become a surface of their own

2026-09-12 18:28:41 +05:30

organization.py

fix(api): two names that reduce to the same slug returned 500

2026-09-07 07:04:45 +05:30

origin_exposure.py

fix(recon): correlate the estate, not the provider it rents

2026-09-12 22:49:52 +05:30

planner_stats.py

perf: make the read path scale with the estate

2026-09-12 08:49:41 +05:30

port_inventory.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

proxy_resolve.py

fix(proxy): carry the scan's proxy and headers into the last three tools

2026-09-13 11:25:48 +05:30

proxy_sync.py

feat(endpoints): drop junk URLs by rule before the insert and after the probe

2026-09-12 18:24:07 +05:30

recheck.py

feat(scans): compare two runs, and prove they are comparable first

2026-09-12 06:18:23 +05:30

report_fonts.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

retention.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

scan_factory.py

feat(targets): store the assets you already know and seed every scan with them

2026-09-13 07:21:10 +05:30

scan_resolve.py

fix(secrets): keep scan credentials out of the command log

2026-09-13 11:16:23 +05:30

scan_scope.py

feat(connectors): browsing lands in the endpoints inventory

2026-09-12 16:39:23 +05:30

schedule_timing.py

feat: implement scan scheduling functionality

2026-06-24 08:10:21 +05:30

scope_filter.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

screenshot_store.py

feat(web-assets): group web assets that render the same page

2026-09-13 07:40:11 +05:30

software_match.py

feat(cve): CVEs become a surface of their own

2026-09-12 18:28:41 +05:30

surface_scope_sync.py

feat(exports): run an export as a job, and keep the recipe

2026-09-13 08:21:50 +05:30

tag.py

fix(api): two names that reduce to the same slug returned 500

2026-09-07 07:04:45 +05:30

target_seeds.py

feat(targets): store the assets you already know and seed every scan with them

2026-09-13 07:21:10 +05:30

threat_intel.py

feat(cve): CVEs become a surface of their own

2026-09-12 18:28:41 +05:30

vuln_inventory.py

feat(cve): CVEs become a surface of their own

2026-09-12 18:28:41 +05:30

vuln_templates.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

vulnx.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

watch_sync.py

feat(targets): store the assets you already know and seed every scan with them

2026-09-13 07:21:10 +05:30

web_hygiene.py

feat(hygiene): derive web hygiene checks from stored responses

2026-09-12 10:11:41 +05:30

wordlists.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30