update

Author: h0tak88r

internal/modules/dalfox/dalfox.go

@@ -35,7 +35,7 @@ func RunDalfox(domain string, threads int) (*Result, error) {
 	resultsDir := utils.GetResultsDir()
 	domainDir := filepath.Join(resultsDir, domain)
 	urlsFile := filepath.Join(domainDir, "urls", "all-urls.txt")
-	inFile := filepath.Join(domainDir, "vulnerabilities", "xss", "gf-results.txt")
+	inFile := filepath.Join(domainDir, "vulnerabilities", "xss", gf.ResultFileForPattern("xss"))
 	outFile := filepath.Join(domainDir, "dalfox-results.txt")
 
 	if err := utils.EnsureDir(filepath.Dir(outFile)); err != nil {

internal/modules/db/db.go

@@ -482,6 +482,16 @@ func DeleteScan(scanID string) error {
 	return dbInstance.DeleteScan(scanID)
 }
 
+// CountScansWithTargetExcluding counts scans sharing a target except the given scan_id.
+func CountScansWithTargetExcluding(excludeScanID, target string) (int, error) {
+	if dbInstance == nil {
+		if err := Init(); err != nil {
+			return 0, err
+		}
+	}
+	return dbInstance.CountScansWithTargetExcluding(excludeScanID, target)
+}
+
 // Close closes the database connection pool
 func Close() {
 	if dbInstance != nil {

internal/modules/db/postgres.go

@@ -1543,6 +1543,19 @@ func (p *PostgresDB) DeleteScan(scanID string) error {
 	return nil
 }
 
+// CountScansWithTargetExcluding returns how many scans share this target besides excludeScanID.
+func (p *PostgresDB) CountScansWithTargetExcluding(excludeScanID, target string) (int, error) {
+	var n int
+	err := p.pool.QueryRow(p.ctx,
+		`SELECT COUNT(*)::int FROM scans WHERE target = $1 AND scan_id != $2`,
+		target, excludeScanID,
+	).Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("count scans by target: %v", err)
+	}
+	return n, nil
+}
+
 // ListVulnerableDNSProviders returns all vulnerable DNS providers from the database
 func (p *PostgresDB) ListVulnerableDNSProviders() (map[string]string, error) {
 	rows, err := p.pool.Query(p.ctx, `

internal/modules/db/sqlite.go

@@ -1486,6 +1486,19 @@ func (s *SQLiteDB) DeleteScan(scanID string) error {
 	return nil
 }
 
+// CountScansWithTargetExcluding returns how many scans share this target besides excludeScanID.
+func (s *SQLiteDB) CountScansWithTargetExcluding(excludeScanID, target string) (int, error) {
+	var n int
+	err := s.db.QueryRow(
+		`SELECT COUNT(*) FROM scans WHERE target = ? AND scan_id != ?;`,
+		target, excludeScanID,
+	).Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("count scans by target: %v", err)
+	}
+	return n, nil
+}
+
 // ListVulnerableDNSProviders returns all vulnerable DNS providers from the database for SQLite
 func (s *SQLiteDB) ListVulnerableDNSProviders() (map[string]string, error) {
 	rows, err := s.db.Query(`

internal/modules/db/types.go

@@ -109,6 +109,8 @@ type DB interface {
 	// FailStaleActiveScans marks running/starting/paused/cancelling scans as failed (e.g. after API restart).
 	FailStaleActiveScans() (int64, error)
 	DeleteScan(scanID string) error
+	// CountScansWithTargetExcluding counts rows with the same target excluding one scan_id.
+	CountScansWithTargetExcluding(excludeScanID, target string) (int, error)
 	// ListAllScanIDs returns every scan_id in the scans table (newest first).
 	ListAllScanIDs() ([]string, error)
 	// ListScanIDsForDomainRoot returns scan IDs whose target is the root domain or a host under it (sub.example.com for example.com).

internal/modules/gf/gf.go

@@ -19,6 +19,12 @@ type Result struct {
 	ResultFiles  []string
 }
 
+// ResultFileForPattern returns the GF output filename for a pattern directory
+// (e.g. img-traversal → gf-img-traversal-results.txt).
+func ResultFileForPattern(pattern string) string {
+	return fmt.Sprintf("gf-%s-results.txt", pattern)
+}
+
 // Options for GF scan
 type Options struct {
 	Domain    string // Domain name (for directory structure)
@@ -92,7 +98,7 @@ func ScanGFWithOptions(opts Options) (*Result, error) {
 			continue
 		}
 
-		outFile := filepath.Join(outDir, "gf-results.txt")
+		outFile := filepath.Join(outDir, ResultFileForPattern(pattern))
 		if err := runGFPattern(urlsFile, pattern, outFile); err != nil {
 			log.Printf("[WARN] GF pattern %s failed: %v", pattern, err)
 			continue

internal/modules/gobot/api.go

@@ -124,11 +124,6 @@ type ScanStatusResponse struct {
 	Error       *string    `json:"error,omitempty"`
 }
 
-type ScanListResponse struct {
-	ActiveScans    []ScanInfo `json:"active_scans"`
-	CompletedScans []ScanInfo `json:"completed_scans"`
-}
-
 // reconcileStaleScansOnStartup marks DB scans that were still "running" as failed. In-memory
 // workers are gone after restart; leaving them active confuses the dashboard.
 func reconcileStaleScansOnStartup() {
@@ -170,6 +165,9 @@ func setupAPI() *gin.Engine {
 	// Both /ui and /ui/* use the same handler — no redirect loops.
 	r.GET("/ui", serveDashboardUI)
 	r.GET("/ui/*filepath", serveDashboardUI)
+	// Deep link: /scans/:scanId (same SPA; client router reads pathname)
+	r.GET("/scans", serveDashboardUI)
+	r.GET("/scans/*filepath", serveDashboardUI)
 
 	// Public: SPA reads this before login (no JWT).
 	r.GET("/api/config", apiConfigHandler)
@@ -183,7 +181,11 @@ func setupAPI() *gin.Engine {
 		apiGroup.DELETE("/domains/:domain", apiDeleteDomain)
 		apiGroup.GET("/domains/:domain/subdomains", apiListSubdomains)
 		apiGroup.GET("/scans", apiListScans)
+		apiGroup.GET("/scans/:id/results/summary", apiScanResultsSummary)
+		apiGroup.GET("/scans/:id/results/files", apiScanResultFiles)
+		apiGroup.GET("/scans/:id/results/file", apiScanResultFileContent)
 		apiGroup.GET("/scans/:id/artifacts", apiListScanArtifacts)
+		apiGroup.GET("/scans/:id", apiGetScan)
 		apiGroup.POST("/scans/bulk-delete", apiBulkDeleteScans)
 		apiGroup.POST("/scans/clear-all", apiClearAllScans)
 		apiGroup.DELETE("/scans/:id", apiDeleteScan)
@@ -204,6 +206,7 @@ func setupAPI() *gin.Engine {
 		apiGroup.POST("/monitor/subdomain-targets/:id/pause", apiPauseMonitorSubdomainTarget)
 		apiGroup.POST("/monitor/subdomain-targets/:id/resume", apiResumeMonitorSubdomainTarget)
 		apiGroup.GET("/r2/files", apiR2Files)
+		apiGroup.POST("/r2/delete", apiR2Delete)
 	}
 
 	// Scan endpoints
@@ -255,9 +258,6 @@ func setupAPI() *gin.Engine {
 		internal.POST("/send-message", sendMessageToDiscord)
 	}
 
-	// List all scans (legacy path)
-	r.GET("/scans", auth, listScans)
-
 	// Utility endpoints
 	r.POST("/cleanup", auth, cleanupHandler)
 
@@ -1643,41 +1643,6 @@ func downloadScanResults(c *gin.Context) {
 	c.File(tmpFile.Name())
 }
 
-func listScans(c *gin.Context) {
-	// #9: Pull active from memory, historical from DB (newest first, deterministic).
-	scansMutex.RLock()
-	active := make([]ScanInfo, 0, len(activeScans))
-	for _, scan := range activeScans {
-		active = append(active, *scan)
-	}
-	scansMutex.RUnlock()
-
-	// Fetch up to 50 recent scans from DB for the completed list.
-	completed := make([]ScanInfo, 0, 50)
-	if dbScans, err := db.ListRecentScans(50); err == nil {
-		for _, s := range dbScans {
-			if s.Status == "running" {
-				continue // already in active list
-			}
-			completed = append(completed, ScanInfo{
-				ScanID:      s.ScanID,
-				Type:        s.ScanType,
-				ScanType:    s.ScanType,
-				Target:      s.Target,
-				Status:      s.Status,
-				StartTime:   s.StartedAt,
-				StartedAt:   s.StartedAt,
-				CompletedAt: s.CompletedAt,
-			})
-		}
-	}
-
-	c.JSON(http.StatusOK, ScanListResponse{
-		ActiveScans:    active,
-		CompletedScans: completed,
-	})
-}
-
 // Helper functions
 
 // generateScanID returns a cryptographically random UUID v4 (#1).
@@ -1835,6 +1800,8 @@ func executeScan(scanID string, command []string, scanType string) {
 	}
 	// Index any final tool-generated artifacts (nuclei/ffuf/gf/tech/etc) that bypass wrappers.
 	indexScanArtifacts(scanID, scanType, target)
+	// domain_run / subdomain_run delete local results after upload — backfill from R2 for the UI table.
+	indexWorkflowArtifactsFromR2(scanID, scanType, target)
 
 	scansMutex.Lock()
 	delete(activeScans, scanID)
@@ -1934,6 +1901,117 @@ func indexScanArtifacts(scanID, scanType, target string) {
 	}
 }
 
+// targetHostForR2Prefixes mirrors the UI r2PrefixesForScan hostname normalization (app.js).
+func targetHostForR2Prefixes(target string) string {
+	t := strings.TrimSpace(target)
+	t = strings.TrimPrefix(strings.TrimPrefix(t, "http://"), "https://")
+	if i := strings.Index(t, "/"); i >= 0 {
+		t = t[:i]
+	}
+	t = strings.TrimPrefix(strings.ToLower(t), "www.")
+	return t
+}
+
+// workflowScanR2Prefixes returns R2 key prefixes used for domain_run / subdomain_run (matches app.js default branch).
+func workflowScanR2Prefixes(target string) []string {
+	h := targetHostForR2Prefixes(target)
+	if h == "" {
+		return nil
+	}
+	seen := map[string]struct{}{}
+	var out []string
+	add := func(p string) {
+		if p == "" {
+			return
+		}
+		if _, ok := seen[p]; ok {
+			return
+		}
+		seen[p] = struct{}{}
+		out = append(out, p)
+	}
+	add("new-results/" + h + "/")
+	add("results/" + h + "/")
+	add("lite/" + h + "/")
+	add("new-results/misconfig/" + h + "/")
+	add("misconfig/" + h + "/")
+	return out
+}
+
+// isR2KeyIndexableArtifact matches shouldSkipArtifact extension rules for workflow backfill.
+func isR2KeyIndexableArtifact(key string) bool {
+	name := strings.ToLower(filepath.Base(key))
+	if strings.HasPrefix(name, ".lite-uploads-") {
+		return false
+	}
+	if strings.HasPrefix(name, "temp-") || strings.Contains(name, "dangling-ip-temp") {
+		return false
+	}
+	if strings.EqualFold(name, "temp-url.txt") {
+		return false
+	}
+	ext := strings.ToLower(filepath.Ext(name))
+	switch ext {
+	case ".txt", ".json", ".log", ".csv", ".html", ".md", ".bin":
+		return true
+	default:
+		return false
+	}
+}
+
+// indexWorkflowArtifactsFromR2 populates scan_artifacts from R2 listings for domain_run / subdomain_run.
+// Full-domain and single-subdomain workflows delete local result dirs on completion, so post-scan
+// filesystem indexing finds nothing; uploads still land in R2. Backfilling here makes the scan modal
+// use the same indexed-artifact table as other scans instead of the raw R2 fallback.
+func indexWorkflowArtifactsFromR2(scanID, scanType, target string) {
+	st := strings.ToLower(strings.TrimSpace(scanType))
+	if st != "domain_run" && st != "subdomain_run" {
+		return
+	}
+	if strings.TrimSpace(scanID) == "" || !r2storage.IsEnabled() {
+		return
+	}
+	prefixes := workflowScanR2Prefixes(target)
+	if len(prefixes) == 0 {
+		return
+	}
+	seenKey := map[string]struct{}{}
+	for _, prefix := range prefixes {
+		objs, err := r2storage.ListObjectsRecursive(prefix)
+		if err != nil {
+			log.Printf("[indexWorkflowArtifactsFromR2] list prefix %q: %v", prefix, err)
+			continue
+		}
+		for _, o := range objs {
+			if o.Size == 0 {
+				continue
+			}
+			if !isR2KeyIndexableArtifact(o.Key) {
+				continue
+			}
+			if _, dup := seenKey[o.Key]; dup {
+				continue
+			}
+			seenKey[o.Key] = struct{}{}
+			pub := r2storage.PublicURLForKey(o.Key)
+			if pub == "" {
+				continue
+			}
+			art := &db.ScanArtifact{
+				ScanID:    scanID,
+				FileName:  filepath.Base(o.Key),
+				R2Key:     o.Key,
+				PublicURL: pub,
+				SizeBytes: o.Size,
+				CreatedAt: o.LastModified,
+			}
+			if err := db.AppendScanArtifact(art); err != nil {
+				log.Printf("[indexWorkflowArtifactsFromR2] append %s: %v", o.Key, err)
+			}
+		}
+	}
+}
+
 func shouldSkipArtifact(path string) bool {
 	name := strings.ToLower(filepath.Base(path))
 	if strings.HasPrefix(name, ".lite-uploads-") {
@@ -1942,6 +2020,9 @@ func shouldSkipArtifact(path string) bool {
 	if strings.HasPrefix(name, "temp-") || strings.Contains(name, "dangling-ip-temp") {
 		return true
 	}
+	if strings.EqualFold(name, "temp-url.txt") {
+		return true
+	}
 	ext := strings.ToLower(filepath.Ext(name))
 	switch ext {
 	case ".txt", ".json", ".log", ".csv", ".html", ".md", ".bin":

internal/modules/gobot/commands.go

@@ -363,6 +363,11 @@ func runScanBackground(scanID, scanType, target string, command []string, s *dis
 		log.Printf("[INFO] Updated database scan status for %s to %s", scanID, status)
 	}
 
+	// Match API executeScan: index R2 artifacts for workflow scans (local dirs are cleaned up before indexing).
+	if err == nil && status == "completed" && (scanType == "domain_run" || scanType == "subdomain_run") {
+		indexWorkflowArtifactsFromR2(scanID, scanType, target)
+	}
+
 	// Update Discord message
 	embed := createScanEmbed(scanType, target, status)
 	if isCancelled {