v4.2.3: full recon arsenal (KingOfBugBounty), version bump

RECON_SYS enriched with the concrete bug-bounty recon arsenal and tool pipelines
(subfinder/amass/assetfinder/crt.sh → httpx liveness → gau/waybackurls/katana/
gospider URL harvest → JS analysis & secret regexes → arjun/x8 params → gf vuln
patterns + qsreplace → ffuf/feroxbuster content discovery → naabu ports → dnsx/
nuclei takeovers → cloud bucket grep → targeted nuclei → chained pipeline),
passive-first and scope-respecting. Shared by the black-box run path, so it
applies identically to the CLI, the REPL and the web console.

Version bumped to 4.2.3 across CLI/clap/web/README/TUTORIAL. 423 tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

neurosploit-rs/Cargo.lock

@@ -940,7 +940,7 @@ dependencies = [
 
 [[package]]
 name = "neurosploit"
-version = "4.2.2"
+version = "4.2.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -957,7 +957,7 @@ dependencies = [
 
 [[package]]
 name = "neurosploit-harness"
-version = "4.2.2"
+version = "4.2.3"
 dependencies = [
  "anyhow",
  "base64",

neurosploit-rs/Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
 resolver = "2"
 
 [workspace.package]
-version = "4.2.2"
+version = "4.2.3"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/JoasASantos/NeuroSploit"

neurosploit-rs/app/src/main.rs

@@ -13,8 +13,8 @@ use std::path::{Path, PathBuf};
 #[command(
     name = "neurosploit",
     version,
-    about = "NeuroSploit v4.2.2 — multi-model autonomous pentest harness",
-    long_about = "NeuroSploit v4.2.2 — a Rust multi-model harness that drives a pool of LLMs \
+    about = "NeuroSploit v4.2.3 — multi-model autonomous pentest harness",
+    long_about = "NeuroSploit v4.2.3 — a Rust multi-model harness that drives a pool of LLMs \
 (API key or local subscription: Claude/Codex/Gemini/Grok/OpenCode/Hermes) to autonomously test a target. \
 After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
 them in parallel, then validates every finding by cross-model voting before reporting.\n\n\

neurosploit-rs/crates/harness/src/pipeline.rs

@@ -94,7 +94,20 @@ const RECON_SYS: &str = "You are an elite web recon specialist on an AUTHORIZED
 - Fingerprint the tech stack and EXACT versions (server, framework, libraries, CMS, JS libs) from headers, HTML, asset paths and JS.\n\
 - Analyze responses deeply: status codes, ALL headers, Set-Cookie flags, verbose errors/stack traces, content types, and length/timing differentials.\n\
 - Map auth (cookie/JWT/OAuth), APIs (REST & GraphQL), and any dev/staging/internal hosts referenced anywhere.\n\
-- BUG-BOUNTY RECON TRICKS (use what's installed; degrade gracefully): expand scope — subdomains via crt.sh / `subfinder` / `amass`, resolve live with `httpx`/`httprobe`; harvest historical URLs with `gau` / `waybackurls` / `katana` (old & forgotten endpoints, staging); filter interesting URLs with `gf` patterns (ssrf, redirect, xss, sqli, idor); discover params with `arjun` + params seen in JS/wayback; content-discovery with `ffuf`/`feroxbuster` on each host and vhost; check `/.git`,`/.env`,`/api`,`/v1`,`/graphql`,`/swagger`,`/actuator`,`/debug`, and dangling CNAMEs (subdomain takeover). Prioritise auth/reset/payment/upload/admin/export flows.\n\
+- BUG-BOUNTY RECON ARSENAL (use what's installed; degrade gracefully to curl; PASSIVE-first; stay in scope; never hammer — respect rate limits, don't degrade the service). Chain the tools the way a top bug-hunter does:\n\
+  · SUBDOMAINS (passive): `subfinder -d <apex> -all -silent`, `amass enum -passive -d <apex>`, `assetfinder --subs-only <apex>`, and `curl -s \"https://crt.sh/?q=%25.<apex>&output=json\" | jq -r '.[].name_value'`. Merge + unique (`anew`/`sort -u`). (The harness also pre-seeds live in-scope subdomains for a wildcard scope — test ALL of them.)\n\
+  · LIVE HOSTS: `cat subs | httpx -silent -threads 150 -title -status-code -tech-detect -web-server` — note each host's status; 401/403 = auth surface worth a bypass; filter soft-404s.\n\
+  · URL/ENDPOINT HARVEST: `echo <host> | waybackurls`, `gau <host> --threads 50`, `katana -u https://<host> -d 5 -jc -silent`, `gospider -s https://<host> -d 5`. These surface forgotten/staging/old endpoints. De-dup with `uro`.\n\
+  · JS ANALYSIS: pull every `.js` (`katana ... | grep '\\.js$' | httpx -silent`), then grep for routes `/(api|v[0-9])/`, hidden params, secrets (`AKIA[0-9A-Z]{16}`, `AIza[0-9A-Za-z_-]{35}`, `api_key|token|secret`), and `sourceMappingURL`. Run `nuclei -t exposures/` on JS URLs.\n\
+  · PARAMS: `arjun -i urls -oT params --stable`, `x8`, plus params seen in JS/wayback; `unfurl -u keys < urls | sort -u`.\n\
+  · GF VULN PATTERNS (then act): `cat urls | gf xss|gf sqli|gf ssrf|gf redirect|gf lfi` → test with `qsreplace` (e.g. ssrf → `qsreplace 'http://169.254.169.254/latest/meta-data/'`, sqli → `qsreplace \"'\"`, lfi → `qsreplace '../../etc/passwd'`).\n\
+  · CONTENT DISCOVERY: `ffuf -u https://<host>/FUZZ -w <wordlist> -mc 200,301,302,403 -recursion` / `feroxbuster -u https://<host> --auto-tune -x php,asp,jsp,bak,old`; always check `/.git`,`/.env`,`/config.php`,`/wp-config.php`,`/api`,`/v1`,`/graphql`,`/swagger`,`/actuator`,`/debug`,`/.well-known`.\n\
+  · PORTS (in scope only): `naabu -host <host> -top-ports 1000 -silent | httpx -silent`.\n\
+  · DNS/TAKEOVER: `dnsx -silent -a -cname -resp < subs`; dangling CNAME → takeover: `cat subs | httpx -silent | nuclei -t takeovers/`.\n\
+  · CLOUD: grep URLs for `s3.amazonaws.com`, `storage.googleapis.com`, `blob.core.windows.net`; `cloud_enum -l targets`.\n\
+  · TARGETED NUCLEI: `nuclei -l live -t exposures/,misconfiguration/,takeovers/ -severity critical,high,medium -silent` (targeted, not noisy mass-scan).\n\
+  · PIPELINE example: `subfinder -d <apex> -all -silent | httpx -silent | katana -d 3 -jc | gf sqli | nuclei -t exploits/ -severity critical,high`.\n\
+  Prioritise auth/reset/payment/upload/admin/export flows and the less-hardened subdomains.\n\
 Base everything on real observed responses — never assume. Reply with a COMPACT JSON object with keys {tech, versions, endpoints, params, apis, auth, js_findings, secrets, hosts, subdomains, wayback_hits, notes}. No prose.";
 
 /// Operator directives (focus instructions + auth material) prepended to