Exploit for recon-cockpit

## https://sploitus.com/exploit?id=EBA362D2-8BBB-53F2-AFAB-A8BB0039F27D
# ReconCockpit

A desktop cockpit that turns a penetration-testing recon workflow into a repeatable,
auditable pipeline — **with no LLM in the core**, because a security finding has to be
reproducible, not plausible.

It holds your session variables, suggests the next step from a preset pipeline (with the
command already filled in), runs the tool (active steps on **Run**, destructive steps only
on **Approve**), parses the output into structured facts, and renders the engagement as a
board / Obsidian-style graph / findings list / timeline.

The pipeline logic lives in one YAML knowledge base, so adding a technique is a data
change, not a code change. Built as a native desktop app (pywebview) over a Python
stdlib + SQLite core — no server, no cloud, nothing leaves the machine.

**Why it exists:** recon is a long chain of tools where the hard part is remembering what
to run next and keeping the results straight. This encodes that chain once and drives it
deterministically, so the operator decides *whether* to act and the cockpit handles
*what comes next*.

The companion note base it draws its methodology from is a separate project.

## Run
```bash
./desktop.sh        # native desktop window (pywebview) — no browser, no server
```

## Test the engine
```bash
.venv/bin/python -m unittest tests.test_core -v   # 39 tests
```

## Architecture
Local **desktop app**: native window (pywebview) + Python core, **no HTTP server**. The
UI (`frontend/index.html`) calls Python directly over the pywebview `js_api` bridge.
```
app/
  config.py       paths, risk tiers
  db.py           SQLite schema + additive migrations
  scope.py        ScopeGuard — refuses commands touching out-of-scope hosts
  variables.py    $VAR context (target / global / loot) + safe templating
  engine.py       unified rule engine: one KB (rules.yaml), one grammar, one done-set
  pipeline.py     target-level adapter over engine (suggest + co-pilot leads)
  node_actions.py per-graph-node adapter over engine (result-aware chaining)
  parsers/        tool output → tool-agnostic facts; registry in __init__.py
  facts.py        apply facts to the DB (dedup) + edges + timeline
  executor.py     resolve → scope-check → run → stream → parse → apply (+ risk gating)
  bridge.py       pywebview js_api — exposes the core to the webview
  desktop.py      native window entrypoint (python -m app.desktop)
  server.py       LEGACY optional browser shell (Starlette) — unused by the desktop app
  seed.py         demo engagement 'acme.corp'
pipeline/
  rules.yaml      the single fact→action KB (scope: engagement | node | both); each
                  rule's `then` = the vault's "→ Дальше"; `hint` rules = co-pilot leads
frontend/index.html  the whole UI (dark cockpit): board, Obsidian-style graph, drawers
```

### Dependency engine (Phase 2)
One `pipeline/rules.yaml` replaces the old `web-recon.yaml` + `node-actions.yaml`. A rule
declares conditions over the fact store (`when`), an action, what it `produces`, a tier, a
vault link, and a `scope` (attaches to a graph node, the engagement, or both). `app/engine.py`
evaluates all rules against one fact store with one unified done-set and returns the whole
frontier. Richer facts (`observations`, `loot`, `findings.class`, `assets.os`) let chains
branch: e.g. **params → classify by name → SQLi/XSS/LFI/SSRF routing → confirm → dump → loot →
crack/reuse**. `hint` rules surface the vault's cross-domain "→ Дальше" as co-pilot leads even
where automation isn't wired. Design docs: [docs/](docs/) (DATA-MODEL, DEPENDENCY-MAP,
GAP-ANALYSIS, RULE-SCHEMA).

### Risk tiers
`passive` (DNS/OSINT — auto) · `active` (touches target — needs Run) · `exploit`
(destructive — needs Approve). The executor enforces these; the scope guard is a hard
allowlist barrier on top.

### Adding a technique
Append a step/action to the `pipeline/*.yaml` files — no code change. Add a parser under
`app/parsers/` only if the tool needs structured extraction.

## Status
Core engine + desktop app + result-aware graph node-actions: done & tested.
**Vault-sourced dependency engine (HANDOFF-KB.md): done.** Phase 1 (audit/model) in
[docs/](docs/); Phase 2 (unified engine, richer facts, web-vuln fan-out, co-pilot leads)
implemented — 39 tests green. Live end-to-end on a real target still needs the operator's
toolbox (sqlmap/ffuf/etc.) + network; the engine chain is verified by tests and a scripted
`testphp.vulnweb.com`-shaped flow.