feat: widen port enumeration across recon stages

2026-06-29 19:43:56 -04:00
parent b76d2bcfc6
commit 94c8bbede9
6 changed files with 106 additions and 5 deletions
@@ -82,8 +82,18 @@ def _looks_like_ip(v) -> bool:
        return False


-def run(targets: list[str], *, timeout: float = 180.0, rate_limit: int | None = None) -> tuple[list[HttpProbe], object]:
+def run(
+    targets: list[str],
+    *,
+    timeout: float = 180.0,
+    rate_limit: int | None = None,
+    ports: list[int] | None = None,
+) -> tuple[list[HttpProbe], object]:
    cmd = [BINARY, "-json", "-td", "-silent", "-title", "-tech-detect", "-web-server", "-status-code"]
+    # Without -p, httpx only probes 80/443. Feed it the ports discovered by
+    # naabu/nmap so web apps on non-standard ports (e.g. 5000, 8080) are probed.
+    if ports:
+        cmd += ["-p", ",".join(str(p) for p in sorted(set(ports)))]
    if rate_limit:
        cmd += ["-rate-limit", str(rate_limit)]
    res = run_tool(cmd, timeout=timeout, input_text="\n".join(targets) + "\n")