ReconHound

1. Introduction

ReconHound is an External Attack Surface Management (EASM) and Threat Intelligence engine built for analysts, Red Teams, and researchers. It automates reconnaissance and unifies the results in a real-time graphical interface.

What is "EASM & Threat Intelligence Engine"?

External Attack Surface Management (EASM) is the process of discovering, monitoring, and evaluating internet-exposed assets to identify attack vectors before adversaries do. ReconHound acts as an engine that enriches this data with threat intelligence, actively validates findings, and qualifies real-world exploitation risk. It transforms terabytes of raw, noisy internet telemetry into prioritized, actionable intelligence, enabling security teams to focus on what truly matters.

2. Architecture & Correlation Pipeline

The ReconHound engine executes an asynchronous 5-stage pipeline designed to transform raw OSINT and active scans into a high-fidelity relational graph model:

Relational Topology Hierarchy (Host-Centric & Target-Driven)

The structured data synthesized into the Graph organizes nodes through an agile, **Host-Centric** attack chain architecture:

Target Query Root (Anchor with Full DNS Inventory: all_domains & all_subdomains)
  ├── CONTAINS_TARGET ──► Target Hosts / IPs (with metadata badge 🌐 N FQDNs)
  │     └── EXPOSES ──► Services / Ports (Local 1:N Instances per Host)
  │           └── HAS_VULN ──► CVEs (Global Deduplicated N:M Entities)
  │                 ├── ENRICHED_WITH ──► FIRST EPSS + CISA KEV
  │                 └── WEAPONIZED_BY ──► ExploitDB + GitHub PoCs
  └── CONTAINS_TARGET ──► Explicit FQDN Targets (Scan Targets Marked On-Demand)
        └── RESOLVES_TO ──► Resolved Hosts / IPs

Recursive Retroactive Discovery Engine & Incremental Fusion (Smart Upsert)

The core technological differentiator of ReconHound compared to static asset discovery scanners is its Autonomous Recursive Surface Expansion Cycle. Rather than confining analysis to initial query blocks (such as a single ASN, Org name, or CIDR range), the engine launches a multi-tier heuristic correlation chain in real time:

Target Query (e.g. org:'ACME Corp')
  │
  ├─► [1. Primary Recon] ───────► Host Profiling + TLS / HTTP Banners
  │                                     │
  │                                     ▼ Heuristic Domain Extraction
  ├─► [2. Cascading Enumeration] ─► crt.sh + Reverse WHOIS (Domains & Subdomains)
  │                                     │
  │                                     ▼ Concurrent DNS Resolution (A/AAAA)
  ├─► [3. Network Expansion] ───► Discovery of New Satellite IP Infrastructure
  │                                     │
  │                                     ▼ Retroactive Passive Profiling
  └─► [4. Incremental Fusion] ──► SQLite Smart Upsert: Preserved History + Merged Provenance

3. Installation Guide (Quickstart)

ReconHound runs natively across Linux, macOS, and Windows (via WSL2).

Step 1: Clone and Install Dependencies

# Clone repository
git clone https://github.com/ls4ss/ReconHound.git
cd ReconHound

# Run the automated installer, bootstrap dependencies,
# configure capabilities, and set up your secure Dashboard Admin credentials.
reconx config setup

Step 2: Active Scan Binaries (Masscan & Nuclei)

The reconx config setup routine automatically verifies and configures raw socket network capabilities (setcap) and templates. To manually install the binaries:

# Installation (Debian / Ubuntu / Kali Linux)
sudo apt update && sudo apt install -y masscan

# Grant non-root Linux capabilities for WebUI execution:
sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip $(which masscan)

# Installation (Nuclei via Go or pre-built binary):
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip $(which masscan)

Step 3: Local Exploit Database (ExploitDB)

The local exploit database cache is initialized automatically during setup. To update it on demand:

reconx config update

4. Configuration & API Keys

ReconHound includes free out-of-the-box fallbacks (crt.sh, HackerTarget, FIRST EPSS, CISA KEV, and GitHub PoC API). To unlock deeper network range profiling, configure your API keys in .env:

The .env file is automatically created from .env.example during setup. Configure your keys as needed:

# ==============================================================================
# ReconHound - External Attack Surface Management & Threat Intelligence Engine
# Copy this file to .env and insert your API keys as needed.
# ==============================================================================

# [Required for Shodan Queries, Subnets, DNS & Banner Reconnaissance]
SHODAN_API_KEY=

# [Required for V3: AlienVault OTX Threat Actors & Malware extraction]
ALIENVAULT_API_KEY=

# [Required for V3: SecurityTrails Subdomain & Passive IP Enumeration]
SECURITYTRAILS_API_KEY=

# [Optional: Censys Platform API v3 Personal Access Token & Org ID]
CENSYS_PAT_TOKEN=
CENSYS_ORG_ID=

# [Optional: Censys Legacy API ID & Secret]
CENSYS_API_ID=
CENSYS_API_SECRET=

# [Optional: NVD API Key for Accelerated CVSS & CWE Enrichment]
NVD_API_KEY=

# [Optional: WhoisFreaks API Key for Structured Reverse WHOIS Domain Mapping]
WHOISFREAKS_API_KEY=

# [Optional: GitHub Personal Access Token for Public Exploit & PoC Hunting]
GITHUB_TOKEN=

Diagnostics & Automated Pre-requisite Configuration

Verify environment health, Python dependencies, operational folders, permissions, and live API endpoints:

# Display complete diagnostics table for system and APIs
reconx config check

# Automatically diagnose and configure missing prerequisites
reconx config setup

5. ReconExec

The command-line interface is driven by Typer and styled with Rich, providing clean formatting, asynchronous progress indicators, and high-visibility risk tables.

Usage: reconexec [OPTIONS] COMMAND [ARGS]...                                   
                                                                                
╭─ Global Recon Scans ─────────────────────────────────────────────────────────╮
│ all         Execute passive attack surface mapping using ALL modules.        │
╰──────────────────────────────────────────────────────────────────────────────╯
╭─ Targeted Recon Modules ─────────────────────────────────────────────────────╮
│ shodan      Execute passive scan using the 'Shodan' module.                  │
│ censys      Execute passive scan using the 'Censys' module.                  │
│ crtsh       Execute passive scan using the 'crt.sh' module.                  │
│ whois       Execute passive scan using the 'Reverse WHOIS' module.           │
│ sectrails   Execute passive scan using the 'SecurityTrails' module.          │
│ axfr        Execute passive scan using the 'Zone Transfer' module.           │
│ otx         Execute passive scan using the 'AlienVault OTX' module.          │
╰──────────────────────────────────────────────────────────────────────────────╯
╭─ Utility & Intelligence ─────────────────────────────────────────────────────╮
│ intel       Execute advanced threat intelligence lookups.                    │
╰──────────────────────────────────────────────────────────────────────────────╯
╭─ System & Configuration ─────────────────────────────────────────────────────╮
│ version     Show ReconExec version and maintainer information.               │
│ config      Manage configuration, setup, and system updates                  │
╰──────────────────────────────────────────────────────────────────────────────╯

Target Scan Modes

Recon Modules & Flags

SQLite EASM Persistence

# Scan domain and persist into ./data/dbs/company.sqlite
reconx all company.com --create-db company

# Scan subnet and persist into ./data/dbs/datacenter.sqlite
reconx all 198.51.100.0/24 --create-db datacenter

Executive Reports & Export

# 1. Executive Markdown Report
reconx all company.com -o markdown -f executive_report.md

# 2. Standalone Styled HTML Report (Print & PDF Ready)
reconx all company.com -o html -f easm_report.html

# 3. Structured JSON for SIEM/SOAR integration
reconx all company.com -o json -f attack_surface.json

# 4. Tabular CSV for Spreadsheet Analysis
reconx all company.com -o csv -f vulnerabilities.csv

# 5. Batch export of all formats into a directory
reconx all company.com -o all -d ./exports/company/

6. ReconHound Dashboard

ReconHound provides an interactive graph visualization experience inspired by SpecterOps BloodHound, powered by FastAPI and Cytoscape.js.

⠀⠀⠀⠀⡀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⣷⠀⠀⢰⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⣿⣧⠀⣼⣿⣇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⢸⣿⣿⡆⠘⣿⣿⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⣸⣿⣿⣿⡄⠙⠛⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⣿⣿⣿⣿⣷⡀⣿⣿⣿⣿⠿⠿⢿⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀   RECONHOUND DAEMON
⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣄⡀⢻⣿⣿⣿⠟⢿⣿⠛⣦⡀⢻⣿⡇⠀   ==================================
⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠛⣶⡞⠻⣶⠛⢻⡄⠹⠀⠀   [✓] Attack Surface Dashboard UI
⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣷⣾⣿⣶⣿⣿⠆⠀⠀   [✓] Threat Tracking Engine
⠀⢠⣿⣿⣿⡄⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣏⣉⣉⣉⣉⣉⣉⣉⣉⣉⡉⠀⠀⠀   Usage: reconexec hound start
⠀⢸⣿⣿⣿⣷⡀⠻⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠃⠀⠀⠀
⠀⣿⣿⣿⣿⣿⣷⣶⣶⣶⣶⣶⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀

Daemon Server Commands

Graph-First UX & Floating Lead Management

ReconHound adopts a Graph-First interaction model. Instead of relying on cluttered sidebars, you manage your passive attack surface directly from the canvas itself.

• Target Root Persistence: The central node (target_root) acts as your scope anchor. Even if you deselect all leads or click "Collapse All", this node remains visible on the canvas.
• Cinematic Auto-Centering: If the target_root becomes the only visible node, the camera will smoothly glide and zoom into it automatically.
• Floating Leads Modal (Context Menu): Right-click the target_root node and select "Explore Leads..." to open an interactive, translucent modal directly in the center of the graph featuring a real-time search bar. From here, you can seamlessly search, filter, and select passive IPs, Domains, and Subdomains to expand the visual tree. (You can quickly dismiss it by clicking anywhere on the canvas or pressing ESC).
• Intelligent Auto-Select: If your initial scan discovers a very small footprint (50 leads or less), the engine will preemptively select and render them all upon your first dashboard load, avoiding unnecessary manual clicks.
• Canvas HUD Search: The search bar is now embedded directly as a floating HUD in the top-left of the canvas, maximizing tactical screen real estate.
• Clean Canvas (BloodHound-style): The graph starts completely clean, showing only the root node. Expanding assets no longer forces target updates in the database, promoting a fluid, passive exploration.
• CLI Command reconx hound restart: Enables seamless, instant restart of the WebGUI backend without dropping dependencies during development.

Graph-First UX & Floating Lead Management

ReconHound adopts a Graph-First interaction model. Instead of relying on cluttered sidebars, you manage your passive attack surface directly from the canvas itself.

• Target Root Persistence: The central node (target_root) acts as your scope anchor. Even if you deselect all leads or click "Collapse All", this node remains visible on the canvas.
• Cinematic Auto-Centering: If the target_root becomes the only visible node, the camera will smoothly glide and zoom into it automatically.
• Floating Leads Modal (Context Menu): Right-click the target_root node and select "Explore Leads..." to open an interactive, translucent modal directly in the center of the graph featuring a real-time search bar. From here, you can seamlessly search, filter, and select passive IPs, Domains, and Subdomains to expand the visual tree. (You can quickly dismiss it by clicking anywhere on the canvas or pressing ESC).
• Intelligent Auto-Select: If your initial scan discovers a very small footprint (50 leads or less), the engine will preemptively select and render them all upon your first dashboard load, avoiding unnecessary manual clicks.
• Canvas HUD Search: The search bar is now embedded directly as a floating HUD in the top-left of the canvas, maximizing tactical screen real estate.

Graph Topology & Semantic Visual Guide

Edge Semantics & Relational Topology

Directed relationship edges represent resolution, exposure, and threat ancestry in the attack surface graph:

Graph Physics (V3 Engine)

• Dynamic Square Root bounding box layout organizes highly dense nodes (hundreds of ports) into proportional grids without breaking horizontal space.
• Complete elimination of artificial clusters: rendering reflects a 1:1 state of the SQLite DB.
• Safety prompt (window.confirm) applied automatically before rendering >500 nodes.

Target Management, Active Port Scanning (Masscan) & Nuclei (IPs and FQDNs)

ReconHound includes native Target Management, Active Port Scanning (Masscan) and Active Vulnerability Scanning (Nuclei) modules with hybrid support for both IP Addresses and FQDNs (Domains / Subdomains):

• FQDN Targets & Reverse Proxy / CDN / Virtual Host Bypass: In modern architectures protected by WAFs, Cloudflare, AWS CloudFront, Akamai, or Nginx/Apache Virtual Hosts, direct raw IP scanning fails because virtual hosts require the TLS Server Name Indication (SNI) handshake and the application HTTP Host: header. ReconHound allows setting Domains and Subdomains directly as scan targets (Set as Target (FQDN)). When dispatching Nuclei, the engine attacks endpoints https://<fqdn> and http://<fqdn> directly, preserving full web routing and virtual host context. When dispatching Masscan, the engine resolves the FQDN's IP via DNS for raw SYN packet port scanning.
• Dynamic FQDN ➔ IP Live Resolution & Graph Linkage (RESOLVES_TO): When an FQDN target (Domain or Subdomain) is scanned, the engine executes live authoritative DNS resolution:
  • New / Unlisted IP: Dynamically creates a new IP node in the database and renders it on the graph, establishing a direct RESOLVES_TO edge originating from the FQDN.
  • Existing IP in Graph: If the resolved IP is already cataloged (even if previously disconnected or associated elsewhere), the relationship is automatically formalized by adding the direct RESOLVES_TO edge between the FQDN and the IP.
  • Port Reconciliation: Existing passive ports on that IP are promoted to Confirmed Active (appending Masscan to source provenance and enriching banners/versions), while newly discovered active ports are dynamically created under the host IP node with atomic deduplication per (IP, Port, Protocol).
• Right-Click Target Marking & Bulk Selection: Right-click any IP, Domain, or Subdomain node on the graph to toggle it with Set as Target (or Remove Target). Furthermore, right-clicking on root nodes like Target Root or Domains / Subdomains (FQDN Targets) allows you to mark or unmark all associated resolved IPs in bulk with a single click (Set all N resolved IPs as Targets / Remove all N IPs from Targets).
• Visual Highlight in Graph (.is-target): Any marked target node (IP, Domain, or Subdomain) is highlighted with a solid 3px Neon Cyan (#00f0ff) outline in Cytoscape.js.
• Clean & Focused Asset Inspector: The sidebar Asset Inspector is 100% dedicated to deep technical asset intelligence, host metadata, IP geolocation, and risk metrics, leaving scanning operational triggers cleanly within the context menu.
• Mandatory "Confirmed Active" Enforcement for Nuclei on IPs: By default, Nuclei vulnerability scanning on raw IPs only executes against endpoints confirmed as "Confirmed Active". If an IP target has mapped passive ports that are not yet actively confirmed, Nuclei requests Masscan to perform a targeted verification strictly against those passive ports. If verified active, Nuclei proceeds with template scanning; if no ports respond or if the target has zero mapped ports in the database, the Nuclei scan is skipped with the exact reason logged to the live console.
• Smart Nuclei Template Auto-Updates: Prior to dispatching vulnerability scans, ReconHound automatically checks and updates the official community templates (nuclei -update-templates). The engine employs an asynchronous mutex lock and a 1-hour TTL cooldown cache, preventing concurrent file race conditions or redundant download delays when scanning large batches of target hosts.
• Dynamic Streaming Watchdog & Nuclei Partial Persistence: The Nuclei engine features an asynchronous Idle Watchdog monitoring real-time stdout/stderr heartbeat alongside an absolute safety execution ceiling (max_timeout). Highly active, productive scans are never killed prematurely, while unresponsive targets trigger fast termination on idle. In the event of timeouts, user cancellation, or unexpected errors, a graceful shutdown (SIGTERM followed by SIGKILL fallback) guarantees 100% persistence of all findings and vulnerabilities discovered up to that point in SQLite and Cytoscape.js.
• Smart Port Exclusion: Across all port scanning profiles (Top 100, Web Ports, Custom, or All Ports), any port already in Confirmed Active status is automatically excluded from the probes sent to Masscan. This dramatically reduces target infrastructure load, eliminates redundant network traffic, and skips scanning entirely if all requested ports are already active.
• 2-Phase Priority Pipeline for All Ports (0-65535): When running full 65,535-port sweeps, the scanner executes a specialized two-stage strategy:
  • Phase 1 (Immediate Target Confirmation): Ultra-fast targeted scan strictly against the target's unverified passive ports (e.g. ports discovered via Shodan/Censys). Status updates and visual node confirmation to Confirmed Active occur in the first 1-2 seconds.
  • Phase 2 (Remaining 65,535-Port Sweep): Batch sweep across all remaining unexplored ports, excluding already confirmed and Phase 1 tested ports. This ensures that even if partial timeouts or manual interruptions occur, known services are already safely verified and persisted.
• Port Presets & Rate Control: Built-in profiles (Top 100 Ports, Web Ports: 80,443,8080,8443..., All Ports: 0-65535, Custom), packet rate slider (100 to 10,000 pps), and flags for -Pn (disable ping) and --banners (banner grabbing & service product/version detection).
• Visual Differentiation, Source Traceability & Atomic Persistence: Actively confirmed ports render in solid Emerald Green (#27ae60 with #2ecc71 border) with solid green relationship edges (#2ecc71), distinguishing them from unverified passive services (Dark Slate with dashed amber border #f59e0b). Vulnerabilities identified by Nuclei receive an explicit Source: Nuclei badge across graph views, node inspectors, and Risk Metrics accordions.
• Adaptive Dynamic Timeout & Graceful SIGINT Shutdown: Masscan execution timeout is dynamically computed based on the actual number of target ports, packet rate (rate in pps), and total number of targets in the scan batch ($N$). This adaptive formulation prevents premature termination during 65,535-port full sweeps at conservative rates (e.g. 100 or 250 pps). If timeout is reached or a scan is manually cancelled, the engine issues a preliminary SIGINT signal, allowing Masscan to flush its socket buffers and write 100% of discovered ports and banners cleanly to the SQLite database.
• Persistent SQLite Scan Logs & Frontend Auto-Reconnection: All active scanning execution events (Masscan and Nuclei) are atomically and relationally persisted to the scan_logs table in the active SQLite database. If the browser is refreshed, crashes, or is opened after a background scan, the live console (#scan-live-console) automatically re-hydrates historical logs with accurate timestamps and log levels. If scans are currently running on the server, the frontend automatically resumes real-time polling without manual intervention.
• Active Verification Reset (Remove Verified Active): Right-click any active service node to remove its Confirmed Active status, or right-click root/parent nodes (IP, Domain) to reset all associated active services in bulk. The service returns to passive status in the database and graph without losing stored banners or port records, enabling on-demand re-validation via Masscan or Nuclei.

Interactive Navigation, Controls & Context Menu

• Left-Click (Drag): Continuous smooth panning across the attack surface graph.
• Left-Click (Node): Single asset selection and opens the Lateral Asset Inspector.
• Ctrl + Left-Click (or Cmd on macOS): Additive sequential multi-selection to select multiple target nodes simultaneously.
• Right-Click (Node): Opens the Custom Context Menu with quick actions:
  • Set as Target / Remove Target: Mark or unmark the selected IP address or FQDN for active scanning.
  • Set all N resolved IPs as Targets / Remove all N IPs: Bulk target management available on Target Root and FQDN Targets (Domain / Subdomain).
  • Remove Verified Active: Reset active verification on single or bulk services to enable fresh on-demand re-validation.
  • Collapse / Uncollapse Services: Group or expand services under the IP host.
  • Collapse / Uncollapse Vulnerabilities: Group or expand direct IP or service vulnerabilities.
  • Inspect Details: Open the detailed technical asset drawer.
  • Focus Node: Instantly zoom and center directly onto the target asset.
  • Copy Domain / Subdomain / IP / CVE: Copy the exact asset identifier to the clipboard.
• Right-Click (Drag on Canvas): Box Area Selection to group and reposition blocks of nodes together.
• Layout Algorithms:
  • Hierarchical DAG (Default): Structured vertical DAG layout (Target Root ➔ Host IPs / FQDN Targets ➔ Services ➔ Vulnerabilities / CVEs) with balanced matrix fan-out for dense enterprise attack surfaces without overlapping.
  • Force-Directed: Organic physics simulation with smooth spring transitions and calibrated repulsion.
  • Concentric & Grid: Concentric orbital rings and uniform asset matrices.
• Strict Attack Path Isolation:

  When applying any risk or vulnerability filter (e.g. Critical, CISA KEV, 3D Risk Matrix), the graph isolates strictly the direct attack vector (Target Root ──► Host IP / FQDN Target ──► Service / Port ──► CVE). Harmless sibling subdomains and clean non-vulnerable IPs are automatically pruned, delivering laser-focused threat intelligence without background noise.

• Quick Risk Filters:
  • CISA KEV Only: Restricts graph to active in-the-wild exploited vulnerabilities.
  • High EPSS (> 50%): Prioritizes imminent weaponization probabilities.
  • Critical Vulnerabilities (CVSS 9.0+): Isolates findings with maximum severity.
  • Hide Low & Info Findings: Filters out informational noise from the graph.
  • Nuclei Scan Findings Only: Restricts graph to findings discovered by Nuclei.
  • Public Exploits / PoCs: Filters for weaponized exploits in ExploitDB and GitHub.
  • Exposed Services Branches: Highlights paths with exposed services.
  • Verified Active Services Only: Shows only services actively verified by Masscan/active scans.
  • Vulnerable Services Only: Isolates services with associated vulnerabilities.
  • Search with Downstream Inheritance: Search by IP, domain, or port preserving ancestry to target root and child services/CVEs.
• Smart Double-Click Collapse: Double-clicking proactively seeks out all expanded parent paths of a shared child node to ensure it collapses correctly across the UI.

Lateral Asset Inspector & Bidirectional Navigation

Left-clicking any node on the graph opens the Asset Inspector drawer displaying deep technical metadata and cross-focus controls:

• Bidirectional Domain ⇄ IP Navigation:
  • Inspecting a Domain or Subdomain displays its Resolved IP with a dedicated [ ⌖ Focus ] button to center the camera on the IP node with 1 click.
  • Inspecting a Host IP displays all active Resolving Domains / Hosts with 1-click crosshair focus buttons.
• IP Geolocation & City/State: City, Region/State, Country, ASN and Organization mapped via Shodan/Censys and BGP/RDAP fallback, complete with coordinates (Latitude/Longitude) and an interactive [ 📍 View on Map ] button linking directly to Google Maps.
• Risk Metrics & Vulnerability Intel: CVSS v3.1 vectors, associated CWE taxonomy, FIRST EPSS probability percentage and percentile, CISA KEV catalog status, and direct links to verified weaponization proofs.
• Full Responsive Architecture: Fully adapted for desktops, laptops, tablets (retractable drawer with backdrop) and mobile smartphones (100vw drawer with touch controls).
• Threat Intelligence: Vulnerability nodes now display a dedicated Threat Actors & Malware accordion (integrated via AlienVault OTX), automatically extracted by the engine.
• API Resilience (CTI): The engine overrides strict SNI checks to seamlessly query threat intel APIs under firewalls (e.g., SecurityTrails).

Global Inventory & Safe Asset Deletion (Cascade Deletion)

Located on the left sidebar (below the database selector), the Inventory button opens a spreadsheet-style slide-up drawer containing the complete inventory of the active database:

• Global View (Bypasses UI Filters): Lists all FQDNs and IPs stored in the SQLite database, displaying exact counts of Services, Ports, and Vulnerabilities (CVEs), regardless of active graph filters or who the current targets are.
• 1-Click Target Toggle: In the Actions column, effortlessly manage active targets by clicking the target icon ( gray crosshair to add, or green check to remove).
• Safe Deletion with Impact Analysis: Clicking the red trash bin () in the Actions column triggers the backend Impact Analysis engine. It pre-calculates and displays a confirmation modal with the exact cascaded dependencies that will be destroyed (e.g., "Deleting this IP will also destroy 5 Services, 15 CVEs, and 2 DNS edges"). Upon confirmation, the asset is safely deleted, preserving strict SQLite referential integrity.
• Intelligent Real-Time Search: Instant client-side filtering for assets, types, and ports directly from the drawer header.