- Collapsible categories: Left arrow collapses selected server's category,
Right arrow expands all. Category headers show ▶/▼ indicators.
- Smart icons: Unknown/Generic servers with PE VersionInfo show 📦 (identified
program) or ⚙ (known process) instead of ❓
- Exe path shortcuts: o=open folder in Explorer, y=copy exe path, p=copy
folder path. Works in both server list and detail popup.
- Status toast: brief green notification for path actions (auto-clears 3s)
- System(4) fingerprints: WinRM, HttpSys entries for ports 80/5357/5985/47001
- Fix version extraction from HTTP banners (skip HTTP/1.1 status line)
Wappalyzer migration:
- Extract 1,882 header signatures from hardcoded Rust to data/wappalyzer.json
- JSON loaded via include_str! + OnceLock (same pattern as fingerprints)
- wappalyzer_db.rs reduced from 2,717 to 168 lines
Smart technology upgrading:
- Wappalyzer detections now feed back into main classification
- upgrade_kind_from_techs() promotes generic kinds to specific ones:
Nginx + WordPress headers → WordPress, NodeJs + Next.js → NextJs, etc.
- Only upgrades when detection is more specific (CMS > Framework > Runtime)
- Covers 40+ frameworks/CMS: WordPress, Django, Laravel, Next.js, etc.
Upstream sync:
- scripts/sync_wappalyzer.py fetches latest data from github.com/dochne/wappalyzer
- Converts Wappalyzer format to our JSON format
- Preserves custom signatures not in upstream
- Run: python scripts/sync_wappalyzer.py && cargo build
Fingerprint database migration:
- Extract 663 fingerprints from 9,500-line Rust static array to data/fingerprints.json
- JSON loaded via include_str! + OnceLock (compile-time embedded, parsed once)
- New fingerprints can be added by editing JSON — no Rust code changes needed
- fingerprints.rs reduced from 9,500 to 422 lines (JSON loader + ServerKind parser)
Runtime process attribution:
- Add Windows PE VersionInfo reader (GetFileVersionInfoW API) to extract
ProductName, FileDescription, CompanyName from exe files
- ListeningPort gains product_name, file_description, company_name fields
- display_name()/display_description() methods use VersionInfo for Unknown entries
- Detail popup shows Product and Company fields
IIS false positive fix:
- Add HttpSys ServerKind for Windows HTTP.sys kernel-mode HTTP server
- Remove "microsoft-httpapi" from IIS fingerprints (HTTP.sys != IIS)
- Remove default_ports from IIS entries (port alone is not evidence of IIS)
- Remove overly broad "was" cmdline match that could false-positive
New fingerprints: VS Code, Psmux, Chrome mDNS (port 5353)
- Devices: Integrate IEEE OUI database (39K vendors) for accurate manufacturer names
- Topology: Show all system-configured DNS servers with active/inactive status
- Packets: Add TCP flags (SYN/ACK/FIN/RST/PSH), TTL, seq/ack numbers, window size,
raw payload hex dump, protocol stats bar, and show control packets (SYN/FIN/RST)
- Dashboard: Add 'm' key to toggle world map to fullscreen view with connection dots
- Sniffer: Increase buffer from 200 to 5000 packets for better analysis
