refactor: modularize Katana and Dalfox into explicit workflow phases to improve pipeline execution flow.

Author: h0tak88r

internal/scanner/reflection/reflection.go

@@ -198,27 +198,74 @@ func ScanReflectionWithOptions(opts Options) (*Result, error) {
 		}
 	}
 
-	// ── Dalfox: confirm XSS on kxss findings that had {<} or {>} unfiltered ──
-	// These characters indicate the site doesn't filter angle brackets —
-	// the strongest signal for exploitable XSS. Feed only those URLs to dalfox.
-	xssCandidateURLs := extractAngleBracketURLs(findings)
-	if len(xssCandidateURLs) > 0 {
-		logger.GetLogger().Infof("[INFO] Running dalfox on %d kxss angle-bracket candidates", len(xssCandidateURLs))
-		runDalfoxOnURLs(xssCandidateURLs, opts.Domain, opts.Threads)
-	} else {
-		logger.GetLogger().Infof("[INFO] No angle-bracket candidates from kxss — skipping dalfox")
-		if scanID := utils.GetCurrentScanID(); scanID != "" {
-			_ = utils.WriteNoFindingsJSON(scanID, opts.Domain, "xss-detection", "dalfox-xss-results.json")
-		}
-	}
-
 	return &Result{
 		Domain:      opts.Domain,
 		Reflections: reflectionCount,
 		OutputFile:  outFile,
 	}, nil
 }
 
+// RunDalfoxPhase reads the kxss results for a domain, filters URLs where {<} or {>}
+// was unfiltered, and runs dalfox on those candidates as a separate pipeline phase.
+// Returns a non-nil error only on configuration failures (not on "no findings").
+func RunDalfoxPhase(domain string) error {
+	resultsDir := utils.GetResultsDir()
+	domainDir := filepath.Join(resultsDir, domain)
+	kxssFile := filepath.Join(domainDir, "vulnerabilities", "kxss-results.txt")
+
+	// Parse kxss text output: "URL: <url> Param: <p> Unfiltered: [{<} {>} ...]"
+	data, err := os.ReadFile(kxssFile)
+	if err != nil || len(strings.TrimSpace(string(data))) == 0 {
+		scanID := utils.GetCurrentScanID()
+		if scanID != "" {
+			_ = utils.WriteNoFindingsJSON(scanID, domain, "xss-detection", "dalfox-xss-results.json")
+		}
+		return nil
+	}
+
+	// Collect URLs where angle brackets were unfiltered
+	seen := make(map[string]struct{})
+	var candidates []string
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		hasAngle := strings.Contains(line, "{<}") || strings.Contains(line, "{>}")
+		if !hasAngle {
+			continue
+		}
+		// Extract the URL part: "URL: <url> Param: ..."
+		urlPart := ""
+		if idx := strings.Index(line, "URL: "); idx >= 0 {
+			rest := line[idx+5:]
+			if end := strings.Index(rest, " Param:"); end >= 0 {
+				urlPart = strings.TrimSpace(rest[:end])
+			} else {
+				urlPart = strings.TrimSpace(rest)
+			}
+		}
+		if urlPart != "" {
+			if _, ok := seen[urlPart]; !ok {
+				seen[urlPart] = struct{}{}
+				candidates = append(candidates, urlPart)
+			}
+		}
+	}
+
+	if len(candidates) == 0 {
+		logger.GetLogger().Infof("[INFO] Dalfox: no angle-bracket candidates from kxss for %s", domain)
+		if scanID := utils.GetCurrentScanID(); scanID != "" {
+			_ = utils.WriteNoFindingsJSON(scanID, domain, "xss-detection", "dalfox-xss-results.json")
+		}
+		return nil
+	}
+
+	logger.GetLogger().Infof("[INFO] Dalfox: running on %d kxss angle-bracket candidates for %s", len(candidates), domain)
+	runDalfoxOnURLs(candidates, domain, 50)
+	return nil
+}
+
 // xssFinding is one structured kxss result persisted to the dashboard.
 type xssFinding struct {
 	TemplateID string   `json:"template-id"`

internal/scanner/subdomain/subdomain.go

@@ -176,7 +176,7 @@ func RunSubdomainWithOptions(subdomain string, opts RunOptions) (*Result, error)
 		{"tech", "[Stage 2] Technology detection", func() error { _, err := tech.DetectTech(subdomainClean, 150); return err }, 0},
 		{"ports", "[Stage 2] Port scan", func() error { _, err := ports.ScanPorts(subdomainClean, 150); return err }, 0},
 		{"urls", "[Stage 2] URL collection", func() error { _, err := urls.CollectURLs(subdomainClean, 150, true); return err }, 0},
-		{"jsscan", "[Stage 2] JS scan", func() error {
+		{"js-analysis", "[Stage 2] JS secrets scan", func() error {
 			_, err := jsscan.Run(jsscan.Options{Domain: subdomainClean, Subdomain: subdomainClean, Threads: 150})
 			return err
 		}, 0},
@@ -262,6 +262,15 @@ func RunSubdomainWithOptions(subdomain string, opts RunOptions) (*Result, error)
 
 	wgPhase2.Wait()
 
+	// Phase 2.5: Katana (sequential — after URL collection, before deep scanning)
+	// Needs live hosts + initial URL corpus from Phase 2. Results merged into all-urls.txt
+	// so GF, reflection, and other Phase 3 tools see the complete URL set.
+	if err := utils.RunWorkflowPhase("katana", getNextStep(), totalSteps, "[Stage 2.5] Katana crawler", subdomainClean, 10*60, func() error {
+		return urls.RunKatanaPhase(subdomainClean)
+	}); err != nil {
+		logger.GetLogger().Infof("[WARN] Katana phase failed: %v", err)
+	}
+
 	// Phase 3: Deep Scan Group (Parallel, requires Stage 2 - specifically URLs)
 	var wgPhase3 sync.WaitGroup
 
@@ -271,7 +280,7 @@ func RunSubdomainWithOptions(subdomain string, opts RunOptions) (*Result, error)
 		return err
 	})
 
-	runParallelPhase(&wgPhase3, "jsendpoints", "[Stage 3] JS endpoint extraction", 0, func() error {
+	runParallelPhase(&wgPhase3, "js-endpoints", "[Stage 3] JS endpoint extraction", 0, func() error {
 		_, err := jsendpoints.Run(jsendpoints.Options{Domain: subdomainClean, Threads: 30})
 		return err
 	})
@@ -320,6 +329,14 @@ func RunSubdomainWithOptions(subdomain string, opts RunOptions) (*Result, error)
 
 	wgPhase3.Wait()
 
+	// Phase 4: Dalfox XSS confirmation (sequential, needs reflection/kxss results from Phase 3)
+	// Reads kxss-results.txt produced by the reflection phase above.
+	if err := utils.RunWorkflowPhase("xss-detection", getNextStep(), totalSteps, "[Stage 4] Dalfox XSS confirmation", subdomainClean, 20*60, func() error {
+		return reflection.RunDalfoxPhase(subdomainClean)
+	}); err != nil {
+		logger.GetLogger().Infof("[WARN] Dalfox XSS phase failed: %v", err)
+	}
+
 	logger.GetLogger().Infof("[OK] Full subdomain scan completed for %s", subdomain)
 
 	// Get subdomain directory path (resultsDir already declared earlier)

internal/scanner/urls/urls.go

@@ -33,6 +33,38 @@ type Result struct {
 	InterestingFile string
 }
 
+// RunKatanaPhase runs Katana crawling as a standalone pipeline phase for a domain.
+// Called explicitly by the subdomain workflow after URL collection completes.
+// Results are merged into all-urls.txt and persisted as katana-urls.json.
+func RunKatanaPhase(domain string) error {
+	resultsDir := utils.GetResultsDir()
+	dirDomain := extractRootDomain(domain)
+	domainDir := filepath.Join(resultsDir, dirDomain)
+	liveFile := filepath.Join(domainDir, "subs", "live-subs.txt")
+	allFile := filepath.Join(filepath.Join(domainDir, "urls"), "all-urls.txt")
+
+	fi, err := os.Stat(liveFile)
+	if err != nil || fi.Size() == 0 {
+		return fmt.Errorf("no live hosts file found for %s", domain)
+	}
+
+	kataURLs := runKatana(liveFile, domain)
+	if len(kataURLs) == 0 {
+		logger.GetLogger().Infof("[INFO] Katana: no URLs found for %s", domain)
+		return nil
+	}
+	logger.GetLogger().Infof("[OK] Katana: Found %d URLs for %s", len(kataURLs), domain)
+
+	existing, _ := readLines(allFile)
+	merged := uniqueStrings(append(existing, kataURLs...))
+	_ = utils.WriteLines(allFile, merged)
+
+	if scanID := utils.GetCurrentScanID(); scanID != "" {
+		_ = utils.WriteLinesAsJSON(scanID, dirDomain, "katana-crawler", "katana-urls.json", kataURLs)
+	}
+	return nil
+}
+
 // CollectURLs ensures live hosts exist for a domain and then collects URLs and JS URLs
 // using external tools (urlfinder and jsfinder), mirroring modules/urls.sh behaviour.
 // If skipSubdomainEnum is true, it treats the input as a single subdomain and skips
@@ -143,21 +175,6 @@ func CollectURLs(domain string, threads int, skipSubdomainEnum bool) (*Result, e
 		_ = utils.WriteLines(allFile, allURLs)
 	}
 
-	// 2b) Katana crawling — fast JS-aware crawler for deeper endpoint discovery
-	if fi, err2 := os.Stat(liveFile); err2 == nil && fi.Size() > 0 {
-		kataURLs := runKatana(liveFile, domain)
-		if len(kataURLs) > 0 {
-			logger.GetLogger().Infof("[OK] Katana: Found %d URLs for %s", len(kataURLs), domain)
-			existingURLs3, _ := readLines(allFile)
-			merged := uniqueStrings(append(existingURLs3, kataURLs...))
-			_ = utils.WriteLines(allFile, merged)
-			// Persist Katana results as their own dashboard module
-			if scanID := utils.GetCurrentScanID(); scanID != "" {
-				_ = utils.WriteLinesAsJSON(scanID, dirDomain, "katana-crawler", "katana-urls.json", kataURLs)
-			}
-		}
-	}
-
 	// 3) Collect JS URLs with embedded jsfinder over live hosts
 	if fi, err := os.Stat(liveFile); err == nil && fi.Size() > 0 {
 		logger.GetLogger().Infof("[INFO] Running embedded jsfinder on live hosts for %s", domain)