feat: expand URL and JS URL detection patterns and improve UI rendering for URL findings

Author: h0tak88r

internal/modules/gobot/scan_results_api.go

@@ -673,7 +673,7 @@ func inferReconKind(fileName string) string {
 	case strings.HasSuffix(b, ".log"):
 		return "logs"
 	// JS URLs
-	case strings.Contains(b, "js-url") || strings.Contains(b, "jsurl"):
+	case strings.Contains(b, "js-url") || strings.Contains(b, "jsurl") || strings.Contains(b, "js-enum"):
 		return "js_urls"
 	// JS secrets / exposures → vuln
 	case strings.Contains(b, "js-secret") || strings.Contains(b, "js-exposure") || strings.Contains(b, "secret") || strings.Contains(b, "exposure"):
@@ -684,6 +684,7 @@ func inferReconKind(fileName string) string {
 		return "subdomains"
 	// URLs / cnames
 	case strings.Contains(b, "all-url") || strings.Contains(b, "interesting-url") || strings.Contains(b, "cname") ||
+		strings.Contains(b, "urls.json") || strings.Contains(b, "url-enum") || strings.Contains(b, "url-collection") ||
 		(strings.HasSuffix(b, "urls.txt") && !strings.Contains(b, "js")):
 		return "urls"
 	// Tech detection

internal/modules/gobot/ui/app.js

@@ -3558,7 +3558,14 @@ function previewDataToFlatRows(data, file) {
         for (const item of obj[k]) {
           if (typeof item === 'object') pushObj(item);
           else {
-            rows.push({ file: file.file_name, module, source: file.source || '—', severity: '—', target: '—', finding: normalizeFindingText(item) });
+            const str = String(item || '').trim();
+            const isURL = str.startsWith('http://') || str.startsWith('https://');
+            rows.push({
+              file: file.file_name, module, source: file.source || '—',
+              severity: '—',
+              target: isURL ? str : '—',
+              finding: isURL ? module : normalizeFindingText(str)
+            });
           }
         }
       }
@@ -3715,10 +3722,10 @@ function inferKindFromFileName(fileName) {
   if (b.includes('live') && (b.includes('host') || b.includes('subs'))) return 'subdomains';
   if (b.includes('httpx') || b.includes('live-hosts')) return 'subdomains';
   // URLs
-  if (b.includes('all-url') || b.includes('interesting-url') || (b.endsWith('urls.txt') && !b.includes('js'))) return 'urls';
+  if (b.includes('all-url') || b.includes('interesting-url') || b.includes('urls.json') || b.includes('url-enum') || b.includes('url-collection') || (b.endsWith('urls.txt') && !b.includes('js'))) return 'urls';
   if (b.includes('cname')) return 'urls';
   // JS URLs
-  if (b.includes('js-url') || b.includes('jsurl') || b === 'js-urls.json') return 'js_urls';
+  if (b.includes('js-url') || b.includes('jsurl') || b.includes('js-enum') || b === 'js-urls.json') return 'js_urls';
   // JS secrets / exposures
   if (b.includes('js-secret') || b.includes('js-exposure') || b.includes('secret') || b.includes('exposure')) return 'vuln';
   // Tech detection