Add recon form fingerprint library and SSRF canary mode.

Score crawl inputs by SSRF-prone field names and register ping-back canaries for operator paste confirmation.
2026-06-07 12:23:11 -07:00
parent 251bdfa1ac
commit 49c24e611c
19 changed files with 1410 additions and 78 deletions
--- a/scripts/_fingerprint.go.bak
+++ b/scripts/_fingerprint.go.bak
@@ -0,0 +1,104 @@
+package recon
+
+import (
+	"sort"
+	"strings"
+
+	"golang.org/x/net/html"
+)
+
+var formFingerprintKeywords = []struct {
+	keyword string
+	weight  int
+}{
+	{"url", 12}, {"src", 10}, {"href", 10}, {"callback", 14}, {"redirect", 13},
+	{"avatar", 8}, {"import", 11}, {"feed", 9}, {"screenshot", 12}, {"pdf", 10}, {"proxy", 11},
+}
+
+func ScoreFormFieldFingerprint(name, id, placeholder string) (score int, matches []string) {
+	joined := strings.ToLower(strings.Join([]string{name, id, placeholder}, " "))
+	seen := map[string]bool{}
+	for _, kw := range formFingerprintKeywords {
+		if strings.Contains(joined, kw.keyword) {
+			score += kw.weight
+			if !seen[kw.keyword] {
+				seen[kw.keyword] = true
+				matches = append(matches, kw.keyword)
+			}
+		}
+	}
+	return score, matches
+}
+
+func ExtractFormFieldFingerprints(pageURL, body string) []FormFieldFingerprint {
+	root, err := html.Parse(strings.NewReader(body))
+	if err != nil {
+		return nil
+	}
+	var out []FormFieldFingerprint
+	var walk func(*html.Node)
+	walk = func(n *html.Node) {
+		if n.Type == html.ElementNode && (n.Data == "input" || n.Data == "textarea" || n.Data == "select") {
+			name := fingerprintAttr(n, "name")
+			id := fingerprintAttr(n, "id")
+			placeholder := fingerprintAttr(n, "placeholder")
+			score, matches := ScoreFormFieldFingerprint(name, id, placeholder)
+			if score > 0 {
+				out = append(out, FormFieldFingerprint{
+					PageURL: pageURL, Name: name, ID: id, Placeholder: placeholder,
+					Score: score, Matches: matches,
+				})
+			}
+		}
+		for c := n.FirstChild; c != nil; c = c.NextSibling {
+			walk(c)
+		}
+	}
+	walk(root)
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Score != out[j].Score {
+			return out[i].Score > out[j].Score
+		}
+		if out[i].Name != out[j].Name {
+			return out[i].Name < out[j].Name
+		}
+		return out[i].ID < out[j].ID
+	})
+	return out
+}
+
+func fingerprintAttr(n *html.Node, key string) string {
+	for _, a := range n.Attr {
+		if a.Key == key {
+			return a.Val
+		}
+	}
+	return ""
+}
+
+func TopFormFieldFingerprint(fields []FormFieldFingerprint) *FormFieldFingerprint {
+	if len(fields) == 0 {
+		return nil
+	}
+	top := fields[0]
+	return &top
+}
+
+func ApplyCanaryPasteTarget(fields []FormFieldFingerprint, canaryURL string) {
+	for i := range fields {
+		fields[i].PasteTarget = canaryURL
+	}
+}
+
+func AppendPageFingerprints(report *CrawlReport, pageURL, body string) {
+	if report == nil {
+		return
+	}
+	fps := ExtractFormFieldFingerprints(pageURL, body)
+	report.FingerprintFields = append(report.FingerprintFields, fps...)
+	for _, fp := range fps {
+		if fp.Score >= 10 {
+			report.SSRFScore += fp.Score / 5
+		}
+	}
+}
--- a/scripts/_recon_handler_canary.go.bak
+++ b/scripts/_recon_handler_canary.go.bak
@@ -0,0 +1,187 @@
+package api
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	dbpkg "crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/recon"
+)
+
+type ReconHandler struct {
+	db        *dbpkg.Database
+	wsHub     *WSHub
+	publicURL func() string
+	canaryHub *ReconCanaryHub
+}
+
+func NewReconHandler(database *dbpkg.Database, hub *WSHub, publicURL ...func() string) *ReconHandler {
+	var fn func() string
+	if len(publicURL) > 0 {
+		fn = publicURL[0]
+	}
+	return &ReconHandler{db: database, wsHub: hub, publicURL: fn, canaryHub: NewReconCanaryHub()}
+}
+
+func (h *ReconHandler) Scan(w http.ResponseWriter, r *http.Request) {
+	var req recon.ScanRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "invalid JSON", http.StatusBadRequest)
+		return
+	}
+	req.Host = strings.TrimSpace(req.Host)
+	if req.Host == "" {
+		http.Error(w, "host required", http.StatusBadRequest)
+		return
+	}
+	host, err := recon.NormalizeHost(req.Host)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	req.Host = host
+	scanID := uuid.New().String()
+	if req.SSRFCanary {
+		h.registerSSRfCanary(scanID, host, r)
+	}
+	report, err := recon.ScanStream(req, scanID, nil)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	report.ScanID = scanID
+	if req.SSRFCanary {
+		h.finalizeSSRfCanary(scanID, report)
+	}
+	if h != nil && h.db != nil {
+		_ = (&OathLedgerBridge{DB: h.db, Hub: oathHub(h)}).Record(AuthUsername(r), dbpkg.OathReconScan, "", "", dbpkg.OathOutcomeSuccess,
+			map[string]string{"host": report.Host, "scan_id": scanID},
+			map[string]interface{}{"host": report.Host, "scan_id": scanID, "open_ports": openPortList(report.Ports), "ssrf_score": crawlSSRFScore(report.Crawl)})
+	}
+	writeJSON(w, report)
+}
+
+func (h *ReconHandler) registerSSRfCanary(scanID, host string, r *http.Request) {
+	base := ""
+	if h.publicURL != nil {
+		base = strings.TrimSpace(h.publicURL())
+	}
+	if base == "" && r != nil {
+		hh := strings.TrimSpace(r.Header.Get("X-Forwarded-Host"))
+		if hh == "" {
+			hh = r.Host
+		}
+		proto := strings.TrimSpace(r.Header.Get("X-Forwarded-Proto"))
+		if proto == "" {
+			proto = "https"
+		}
+		if hh != "" {
+			base = proto + "://" + hh
+		}
+	}
+	url := recon.BuildSSRfCanaryURL(base, scanID)
+	info := &recon.SSRFCanaryInfo{ScanID: scanID, URL: url, Status: "pending", PasteTarget: url}
+	if h.db != nil {
+		_ = h.db.InsertReconSSRfCanary(scanID, host, url, "", "")
+	}
+	if h.canaryHub != nil {
+		h.canaryHub.Register(scanID, info)
+	}
+}
+
+func (h *ReconHandler) finalizeSSRfCanary(scanID string, report *recon.ScanReport) {
+	info, _ := h.getCanaryInfo(scanID)
+	if info == nil || report == nil || report.Crawl == nil {
+		return
+	}
+	recon.ApplyCanaryPasteTarget(report.Crawl.FingerprintFields, info.URL)
+	if top := recon.TopFormFieldFingerprint(report.Crawl.FingerprintFields); top != nil {
+		info.PasteFieldName, info.PasteFieldID = top.Name, top.ID
+		if h.canaryHub != nil {
+			h.canaryHub.UpdatePasteField(scanID, top.Name, top.ID)
+		}
+		if h.db != nil {
+			_ = h.db.UpdateReconSSRfCanaryPasteField(scanID, top.Name, top.ID)
+		}
+	}
+	report.Canary = info
+}
+
+func (h *ReconHandler) getCanaryInfo(scanID string) (*recon.SSRFCanaryInfo, error) {
+	if h.canaryHub != nil {
+		if info := h.canaryHub.Get(scanID); info != nil {
+			return info, nil
+		}
+	}
+	if h.db != nil {
+		return h.db.GetReconSSRfCanary(scanID)
+	}
+	return nil, nil
+}
+
+func (h *ReconHandler) CanaryStatus(w http.ResponseWriter, r *http.Request) {
+	scanID := strings.TrimSpace(chi.URLParam(r, "scan_id"))
+	info, err := h.getCanaryInfo(scanID)
+	if scanID == "" || err != nil || info == nil {
+		http.Error(w, "canary not found", http.StatusNotFound)
+		return
+	}
+	writeJSON(w, info)
+}
+
+func (h *ReconHandler) CanaryPing(w http.ResponseWriter, r *http.Request) {
+	scanID := strings.TrimSpace(chi.URLParam(r, "scan_id"))
+	if scanID == "" {
+		writeJSON(w, map[string]interface{}{"ok": false})
+		return
+	}
+	hit := h.canaryHub != nil && h.canaryHub.MarkHit(scanID)
+	if !hit && h.db != nil {
+		hit, _ = h.db.MarkReconSSRfCanaryHit(scanID)
+	}
+	if !hit {
+		writeJSON(w, map[string]interface{}{"ok": false, "error": "canary not found"})
+		return
+	}
+	log.Printf("[recon] SSRF canary hit scan_id=%s", scanID)
+	if h.wsHub != nil {
+		BroadcastReconCanaryHit(h.wsHub, scanID)
+	}
+	writeJSON(w, map[string]interface{}{"ok": true, "scan_id": scanID, "status": "confirmed"})
+}
+
+func oathHub(h *ReconHandler) *WSHub {
+	if h == nil {
+		return nil
+	}
+	return h.wsHub
+}
+
+func openPortList(ports []recon.PortResult) []int {
+	var out []int
+	for _, p := range ports {
+		if p.Open {
+			out = append(out, p.Port)
+		}
+	}
+	return out
+}
+
+func crawlSSRFScore(c *recon.CrawlReport) int {
+	if c == nil {
+		return 0
+	}
+	return c.SSRFScore
+}
+
+func crawlCMS(c *recon.CrawlReport) []string {
+	if c == nil {
+		return nil
+	}
+	return c.CMSFingerprints
+}
--- a/scripts/_recon_handler_test_canary.go.bak
+++ b/scripts/_recon_handler_test_canary.go.bak
@@ -0,0 +1,75 @@
+package api
+
+
+
+import (
+
+	"bytes"
+
+	"context"
+
+	"encoding/json"
+
+	"net/http"
+
+	"net/http/httptest"
+
+	"strings"
+
+	"testing"
+
+	"time"
+
+
+
+	"github.com/go-chi/chi/v5"
+
+
+
+	"crypto-miner-server/internal/db"
+
+	"crypto-miner-server/internal/recon"
+
+)
+
+
+
+func TestReconScanEndpoint(t *testing.T) {
+
+	recon.SetPortDialHook(func(host string, port int, _ time.Duration) bool { return port == 80 })
+
+	t.Cleanup(func() { recon.SetPortDialHook(nil) })
+
+	recon.SetFetchPageHook(func(rawURL string) (int, string, error) {
+
+		return 200, `<html><input name="preview_url">`, nil
+
+	})
+
+	t.Cleanup(func() { recon.SetFetchPageHook(nil) })
+
+	database, _ := db.New(t.TempDir())
+
+	t.Cleanup(func() { _ = database.Close() })
+
+	h := NewReconHandler(database, nil)
+
+	body, _ := json.Marshal(map[string]interface{}{"host": "recon.lab", "port": 80, "scheme": "http"})
+
+	w := httptest.NewRecorder()
+
+	h.Scan(w, httptest.NewRequest(http.MethodPost, "/api/v1/recon/scan", bytes.NewReader(body)))
+
+	if w.Code != http.StatusOK {
+
+		t.Fatalf("%d %s", w.Code, w.Body.String())
+
+	}
+
+}
+
+
+
+func TestReconSSRfCanaryFlow(t *testing.T) {
+
+	recon.SetPortDialHook(func(host string, port int, _ time.Duration) bool { return port == 80 })
--- a/scripts/install_batch1_atomic.py
+++ b/scripts/install_batch1_atomic.py
@@ -0,0 +1,404 @@
+#!/usr/bin/env python3
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(r"G:/crypto miner")
+SERVER = ROOT / "server"
+
+
+def wb(rel, text):
+    p = ROOT / rel
+    p.parent.mkdir(parents=True, exist_ok=True)
+    data = text.encode("utf-8")
+    if b"\x00" in data:
+        raise SystemExit("NUL in " + rel)
+    p.write_bytes(data)
+
+
+def patch(rel, old, new):
+    p = ROOT / rel
+    t = p.read_text(encoding="utf-8")
+    if old not in t:
+        if new in t:
+            return
+        raise SystemExit("patch miss " + rel)
+    p.write_text(t.replace(old, new, 1), encoding="utf-8", newline="\n")
+
+
+types = (ROOT / "scripts/install_batch1_final.py").read_text(encoding="utf-8")
+# types block is embedded in install_batch1_final - write from known good merge
+types = '''package recon
+
+import "time"
+
+var FleetPorts = []int{22, 80, 443, 445, 3389, 5985, 5986, 6262, 8080, 8443}
+
+const (
+	DefaultPortDialTimeout = 2 * time.Second
+	DefaultCrawlDepth      = 2
+	DefaultCrawlMaxPages   = 50
+)
+
+type ScanRequest struct {
+	Host       string   `json:"host"`
+	Port       int      `json:"port,omitempty"`
+	Scheme     string   `json:"scheme,omitempty"`
+	Paths      []string `json:"paths,omitempty"`
+	Profile    string   `json:"profile,omitempty"`
+	Profiles   []string `json:"profiles,omitempty"`
+	SSRFCanary bool     `json:"ssrf_canary,omitempty"`
+}
+
+type PortResult struct {
+	Port int  `json:"port"`
+	Open bool `json:"open"`
+}
+
+type UDPHint struct {
+	Port    int    `json:"port"`
+	Open    bool   `json:"open"`
+	Service string `json:"service"`
+}
+
+type PortBanner struct {
+	Port    int    `json:"port"`
+	Service string `json:"service,omitempty"`
+	Banner  string `json:"banner,omitempty"`
+	Title   string `json:"title,omitempty"`
+	Hint    string `json:"hint,omitempty"`
+}
+
+type StackEntry struct {
+	Name   string `json:"name"`
+	Source string `json:"source"`
+	Detail string `json:"detail,omitempty"`
+}
+
+type HTTPHeaderSnap struct {
+	URL     string
+	Headers map[string]string
+}
+
+type FormFinding struct {
+	PageURL   string   `json:"page_url"`
+	Action    string   `json:"action,omitempty"`
+	Method    string   `json:"method,omitempty"`
+	Enctype   string   `json:"enctype,omitempty"`
+	Fields    []string `json:"fields,omitempty"`
+	HasFile   bool     `json:"has_file_input,omitempty"`
+	Multipart bool     `json:"multipart,omitempty"`
+}
+
+type URLFieldFinding struct {
+	PageURL string `json:"page_url"`
+	Name    string `json:"name"`
+	ID      string `json:"id,omitempty"`
+	Type    string `json:"type,omitempty"`
+	Hint    string `json:"hint"`
+}
+
+type FormFieldFingerprint struct {
+	PageURL     string   `json:"page_url"`
+	Name        string   `json:"name"`
+	ID          string   `json:"id,omitempty"`
+	Placeholder string   `json:"placeholder,omitempty"`
+	Score       int      `json:"score"`
+	Matches     []string `json:"matches,omitempty"`
+	PasteTarget string   `json:"paste_target,omitempty"`
+}
+
+type SSRFCanaryInfo struct {
+	ScanID         string     `json:"scan_id"`
+	URL            string     `json:"url"`
+	Status         string     `json:"status"`
+	PasteTarget    string     `json:"paste_target"`
+	PasteFieldName string     `json:"paste_field_name,omitempty"`
+	PasteFieldID   string     `json:"paste_field_id,omitempty"`
+	HitAt          *time.Time `json:"hit_at,omitempty"`
+}
+
+type UploadHunterFinding struct {
+	PageURL    string   `json:"page_url"`
+	Target     string   `json:"target,omitempty"`
+	Source     string   `json:"source"`
+	Method     string   `json:"method,omitempty"`
+	Tags       []string `json:"tags,omitempty"`
+	Score      int      `json:"score"`
+	StatusCode int      `json:"status_code,omitempty"`
+}
+
+type AdminSurfaceFinding struct {
+	Path       string `json:"path"`
+	URL        string `json:"url"`
+	StatusCode int    `json:"status_code"`
+	Signal     string `json:"signal"`
+}
+
+type PageFinding struct {
+	URL        string `json:"url"`
+	StatusCode int    `json:"status_code"`
+	Title      string `json:"title,omitempty"`
+}
+
+type CrawlReport struct {
+	PagesFetched      int                    `json:"pages_fetched"`
+	Pages             []PageFinding          `json:"pages,omitempty"`
+	FileInputs        []FormFinding          `json:"file_inputs,omitempty"`
+	MultipartForms    []FormFinding          `json:"multipart_forms,omitempty"`
+	URLFields         []URLFieldFinding      `json:"url_fields,omitempty"`
+	FingerprintFields []FormFieldFingerprint `json:"fingerprint_fields,omitempty"`
+	SSRFScore         int                    `json:"ssrf_score"`
+	CMSFingerprints   []string               `json:"cms_fingerprints,omitempty"`
+	Stack             []StackEntry           `json:"stack,omitempty"`
+	UploadHunter      []UploadHunterFinding  `json:"upload_hunter,omitempty"`
+}
+
+type DeployRecommendation struct {
+	Lane     string `json:"lane,omitempty"`
+	Template string `json:"template,omitempty"`
+	Reason   string `json:"reason"`
+	Priority int    `json:"priority"`
+}
+
+type ReconScanDiff struct {
+	NewPorts []int         `json:"new_ports,omitempty"`
+	NewForms []FormFinding `json:"new_forms,omitempty"`
+}
+
+type ReconHistoryEntry struct {
+	ScanID    string         `json:"scan_id"`
+	Host      string         `json:"host"`
+	Profile   string         `json:"profile,omitempty"`
+	Status    string         `json:"status,omitempty"`
+	ScannedAt time.Time      `json:"scanned_at"`
+	Report    *ScanReport    `json:"report"`
+	Diff      *ReconScanDiff `json:"diff,omitempty"`
+}
+
+type ScanReport struct {
+	ScanID          string                 `json:"scan_id,omitempty"`
+	Host            string                 `json:"host"`
+	Profile         string                 `json:"profile,omitempty"`
+	ProfilesUsed    []string               `json:"profiles_used,omitempty"`
+	Status          string                 `json:"status,omitempty"`
+	ScannedAt       time.Time              `json:"scanned_at"`
+	Ports           []PortResult           `json:"ports"`
+	Banners         []PortBanner           `json:"banners,omitempty"`
+	Stack           []StackEntry           `json:"stack,omitempty"`
+	DeployKitLane   string                 `json:"deploy_kit_lane,omitempty"`
+	Crawl           *CrawlReport           `json:"crawl,omitempty"`
+	AdminSurface    []AdminSurfaceFinding  `json:"admin_surface,omitempty"`
+	RelayVia        string                 `json:"relay_via,omitempty"`
+	UDPHints        []UDPHint              `json:"udp_hints,omitempty"`
+	PathTracerHints []string               `json:"path_tracer_hints,omitempty"`
+	Message         string                 `json:"message,omitempty"`
+	Recommendations []DeployRecommendation `json:"recommendations,omitempty"`
+	Canary          *SSRFCanaryInfo        `json:"canary,omitempty"`
+}
+'''
+
+stub = ROOT / "server/internal/recon/fingerprint_stub.go"
+if stub.exists():
+    stub.unlink()
+
+wb("server/internal/recon/types.go", types)
+wb("server/internal/recon/fingerprint.go", (ROOT / "scripts/_fingerprint.go.bak").read_text(encoding="utf-8"))
+wb("server/internal/recon/canary.go", (ROOT / "server/internal/recon/canary.go").read_text(encoding="utf-8") if (ROOT / "server/internal/recon/canary.go").exists() and "BuildSSRfCanaryURL" in (ROOT / "server/internal/recon/canary.go").read_text(encoding="utf-8") else '''package recon
+
+import ("fmt"; "net/url"; "strings")
+
+func BuildSSRfCanaryURL(publicBase, scanID string) string {
+	base := strings.TrimSpace(publicBase)
+	base = strings.TrimSuffix(base, "/")
+	if base == "" { base = "https://localhost" }
+	if strings.HasPrefix(base, "http://") { base = "https://" + strings.TrimPrefix(base, "http://") } else if !strings.HasPrefix(base, "https://") { base = "https://" + base }
+	u, err := url.Parse(base)
+	if err != nil { return fmt.Sprintf("https://localhost/recon/ping/%s", scanID) }
+	u.Scheme = "https"; u.Path = "/recon/ping/" + scanID; u.RawQuery = ""; u.Fragment = ""
+	return u.String()
+}
+''')
+
+patch("server/internal/recon/parse.go", "Name:    label,\n\t\t\t\tType:", "Name:    label,\n\t\t\t\tID:      id,\n\t\t\t\tType:")
+for rel in ("server/internal/recon/crawl.go", "server/internal/recon/scan.go"):
+    patch(rel, "report.SSRFScore += pageScore\n", "report.SSRFScore += pageScore\n\t\tAppendPageFingerprints(report, item.url, body)\n")
+
+wb("server/internal/db/recon_canary.go", (ROOT / "server/internal/db/recon_canary.go").read_text(encoding="utf-8") if (ROOT / "server/internal/db/recon_canary.go").exists() and "MarkReconSSRfCanaryHit" in (ROOT / "server/internal/db/recon_canary.go").read_text(encoding="utf-8") else Path(r"G:/crypto miner/server/internal/db/recon_canary.go").read_text(encoding="utf-8"))
+
+# always write clean db if file missing key func - simpler: always overwrite from backup content in handler write above
+# Re-read - use explicit content
+wb("server/internal/db/recon_canary.go", '''package db
+
+import (
+	"database/sql"
+	"time"
+
+	"crypto-miner-server/internal/recon"
+)
+
+func (d *Database) ensureReconSSRfCanaryTable() error {
+	_, err := d.Exec(`CREATE TABLE IF NOT EXISTS recon_ssrf_canary (
+		scan_id TEXT PRIMARY KEY, host TEXT NOT NULL, canary_url TEXT NOT NULL,
+		status TEXT NOT NULL DEFAULT 'pending', paste_field_name TEXT NOT NULL DEFAULT '',
+		paste_field_id TEXT NOT NULL DEFAULT '', hit_at DATETIME, created_at DATETIME NOT NULL)`)
+	return err
+}
+
+func (d *Database) InsertReconSSRfCanary(scanID, host, canaryURL, pasteName, pasteID string) error {
+	if err := d.ensureReconSSRfCanaryTable(); err != nil { return err }
+	_, err := d.Exec(`INSERT INTO recon_ssrf_canary (scan_id, host, canary_url, status, paste_field_name, paste_field_id, created_at) VALUES (?, ?, ?, 'pending', ?, ?, ?)`,
+		scanID, host, canaryURL, pasteName, pasteID, time.Now().UTC().Format(time.RFC3339Nano))
+	return err
+}
+
+func (d *Database) GetReconSSRfCanary(scanID string) (*recon.SSRFCanaryInfo, error) {
+	if err := d.ensureReconSSRfCanaryTable(); err != nil { return nil, err }
+	var host, canaryURL, status, pasteName, pasteID string
+	var hitAt sql.NullString
+	err := d.QueryRow(`SELECT host, canary_url, status, paste_field_name, paste_field_id, hit_at FROM recon_ssrf_canary WHERE scan_id = ?`, scanID).Scan(&host, &canaryURL, &status, &pasteName, &pasteID, &hitAt)
+	if err != nil { return nil, err }
+	info := &recon.SSRFCanaryInfo{ScanID: scanID, URL: canaryURL, Status: status, PasteTarget: canaryURL, PasteFieldName: pasteName, PasteFieldID: pasteID}
+	if hitAt.Valid { if ts, err := time.Parse(time.RFC3339Nano, hitAt.String); err == nil { info.HitAt = &ts } }
+	return info, nil
+}
+
+func (d *Database) UpdateReconSSRfCanaryPasteField(scanID, pasteName, pasteID string) error {
+	if err := d.ensureReconSSRfCanaryTable(); err != nil { return err }
+	_, err := d.Exec(`UPDATE recon_ssrf_canary SET paste_field_name = ?, paste_field_id = ? WHERE scan_id = ?`, pasteName, pasteID, scanID)
+	return err
+}
+
+func (d *Database) MarkReconSSRfCanaryHit(scanID string) (bool, error) {
+	if err := d.ensureReconSSRfCanaryTable(); err != nil { return false, err }
+	res, err := d.Exec(`UPDATE recon_ssrf_canary SET status = 'confirmed', hit_at = ? WHERE scan_id = ? AND status != 'confirmed'`, time.Now().UTC().Format(time.RFC3339Nano), scanID)
+	if err != nil { return false, err }
+	if n, _ := res.RowsAffected(); n > 0 { return true, nil }
+	var status string
+	err = d.QueryRow(`SELECT status FROM recon_ssrf_canary WHERE scan_id = ?`, scanID).Scan(&status)
+	return status == "confirmed", err
+}
+''')
+
+wb("server/internal/db/recon_canary_test.go", '''package db
+
+import "testing"
+
+func TestReconSSRfCanaryInsertAndHit(t *testing.T) {
+	d, err := New(t.TempDir())
+	if err != nil { t.Fatal(err) }
+	t.Cleanup(func() { _ = d.Close() })
+	if err := d.InsertReconSSRfCanary("c1", "lab", "https://x/recon/ping/c1", "u", "i"); err != nil { t.Fatal(err) }
+	info, err := d.GetReconSSRfCanary("c1")
+	if err != nil || info.Status != "pending" { t.Fatal(info, err) }
+	hit, err := d.MarkReconSSRfCanaryHit("c1")
+	if err != nil || !hit { t.Fatal(hit, err) }
+	info, _ = d.GetReconSSRfCanary("c1")
+	if info.Status != "confirmed" || info.HitAt == nil { t.Fatal(info) }
+}
+''')
+
+wb("server/internal/api/recon_canary_hub.go", '''package api
+
+import ("sync"; "time"; "crypto-miner-server/internal/recon")
+
+type ReconCanaryHub struct { mu sync.RWMutex; byID map[string]*recon.SSRFCanaryInfo }
+
+func NewReconCanaryHub() *ReconCanaryHub { return &ReconCanaryHub{byID: map[string]*recon.SSRFCanaryInfo{}} }
+
+func (h *ReconCanaryHub) Register(id string, info *recon.SSRFCanaryInfo) {
+	if h == nil || info == nil { return }
+	h.mu.Lock(); defer h.mu.Unlock(); cp := *info; h.byID[id] = &cp
+}
+
+func (h *ReconCanaryHub) Get(id string) *recon.SSRFCanaryInfo {
+	if h == nil { return nil }
+	h.mu.RLock(); defer h.mu.RUnlock()
+	if x := h.byID[id]; x != nil { cp := *x; return &cp }
+	return nil
+}
+
+func (h *ReconCanaryHub) MarkHit(id string) bool {
+	if h == nil { return false }
+	h.mu.Lock(); defer h.mu.Unlock()
+	x, ok := h.byID[id]; if !ok { return false }
+	if x.Status == "confirmed" { return true }
+	now := time.Now().UTC(); x.Status = "confirmed"; x.HitAt = &now; return true
+}
+
+func (h *ReconCanaryHub) UpdatePasteField(id, name, id2 string) {
+	if h == nil { return }
+	h.mu.Lock(); defer h.mu.Unlock()
+	if x := h.byID[id]; x != nil { x.PasteFieldName, x.PasteFieldID = name, id2 }
+}
+
+func BroadcastReconCanaryHit(hub *WSHub, scanID string) {
+	if hub == nil { return }
+	hub.broadcastDashboard(Message{Type: "recon_canary_hit", Payload: mustMarshal(map[string]interface{}{"scan_id": scanID, "status": "confirmed"})})
+}
+''')
+
+wb("server/internal/api/recon_handler.go", (ROOT / "scripts/_recon_handler_canary.go.bak").read_text(encoding="utf-8"))
+ht = (ROOT / "scripts/_recon_handler_test_canary.go.bak").read_text(encoding="utf-8")
+if '"time"' not in ht:
+    ht = ht.replace('"testing"\n', '"testing"\n\t"time"\n')
+wb("server/internal/api/recon_handler_test.go", ht)
+
+rtest = (ROOT / "server/internal/recon/recon_test.go").read_text(encoding="utf-8")
+if "TestBuildSSRfCanaryURLForcesHTTPS" not in rtest:
+    rtest += '''
+
+func TestScoreFormFieldFingerprintKeywords(t *testing.T) {
+	score, matches := ScoreFormFieldFingerprint("callback_url", "", "")
+	if score < 14 || !containsStr(matches, "callback") { t.Fatalf("score=%d matches=%v", score, matches) }
+}
+
+func TestExtractFormFieldFingerprintsExactNameID(t *testing.T) {
+	fps := ExtractFormFieldFingerprints("http://lab/", `<input name="avatar_url" id="userAvatar">`)
+	if len(fps) == 0 || fps[0].Name != "avatar_url" || fps[0].ID != "userAvatar" { t.Fatalf("%+v", fps) }
+}
+
+func TestBuildSSRfCanaryURLForcesHTTPS(t *testing.T) {
+	u := BuildSSRfCanaryURL("http://public.example.com", "abc-123")
+	if !strings.HasPrefix(u, "https://") || !strings.Contains(u, "/recon/ping/abc-123") { t.Fatalf("url=%q", u) }
+}
+'''
+wb("server/internal/recon/recon_test.go", rtest)
+
+rt = (ROOT / "server/internal/api/router.go").read_text(encoding="utf-8")
+if "recon/canary" not in rt:
+    rt = rt.replace('r.Post("/recon/scan", reconHandler.Scan)', 'r.Post("/recon/scan", reconHandler.Scan)\n\t\tr.Get("/recon/canary/{scan_id}", reconHandler.CanaryStatus)', 1)
+if "NewReconHandler(database, wsHub, publicURLOverride)" not in rt:
+    rt = rt.replace("NewReconHandler(database, wsHub)", "NewReconHandler(database, wsHub, publicURLOverride)")
+if "reconHandler.CanaryPing" not in rt:
+    rt = rt.replace('r.Get("/recon/ping/{scan_id}", func(w http.ResponseWriter, r *http.Request) {\n\t\twriteJSON(w, map[string]interface{}{"ok": false, "error": "canary not configured"})\n\t})', 'r.Get("/recon/ping/{scan_id}", reconHandler.CanaryPing)')
+wb("server/internal/api/router.go", rt)
+
+help = (ROOT / "server/web/src/help/settingHelp.ts").read_text(encoding="utf-8")
+if "recon_form_fingerprint" not in help:
+    help = help.replace("  recon_deploy_kit:", "  recon_form_fingerprint:\n    'Recon crawl scores form inputs by name/id/placeholder against SSRF-prone keywords (url, src, href, callback, redirect, avatar, import, feed, screenshot, pdf, proxy). Results include exact field name and id for operator paste targets in Deploy Recon.',\n  recon_ssrf_canary:\n    'POST /api/v1/recon/scan with ssrf_canary:true registers a unique https://{public_host}/recon/ping/{scan_id} URL. Paste that URL into the scored field on the target; a hit confirms SSRF. Poll GET /api/v1/recon/canary/{scan_id} or watch recon_canary_hit on the dashboard WS.',\n  recon_deploy_kit:")
+    wb("server/web/src/help/settingHelp.ts", help)
+htest = (ROOT / "server/web/src/help/settingHelp.test.ts").read_text(encoding="utf-8")
+if "recon_form_fingerprint" not in htest:
+    htest = htest.replace("    'recon_deploy_kit',", "    'recon_deploy_kit',\n    'recon_form_fingerprint',\n    'recon_ssrf_canary',")
+    wb("server/web/src/help/settingHelp.test.ts", htest)
+
+env = {**dict(__import__("os").environ), "GOCACHE": str(ROOT / ".gocache")}
+r = subprocess.run(["go", "test", "./internal/recon/...", "./internal/db/...", "./internal/api/...", "-count=1", "-run", "TestScoreFormField|TestExtractFormField|TestBuildSSRf|TestReconSSRf|TestReconScan"], cwd=str(SERVER), env=env)
+if r.returncode != 0:
+    sys.exit(r.returncode)
+
+subprocess.run(["git", "pull", "origin", "main"], cwd=str(ROOT), check=True)
+files = [
+    "server/internal/recon/types.go", "server/internal/recon/fingerprint.go", "server/internal/recon/canary.go",
+    "server/internal/recon/crawl.go", "server/internal/recon/scan.go", "server/internal/recon/parse.go",
+    "server/internal/recon/recon_test.go", "server/internal/db/recon_canary.go", "server/internal/db/recon_canary_test.go",
+    "server/internal/api/recon_canary_hub.go", "server/internal/api/recon_handler.go", "server/internal/api/recon_handler_test.go",
+    "server/internal/api/router.go", "server/web/src/help/settingHelp.ts", "server/web/src/help/settingHelp.test.ts",
+    "scripts/_fingerprint.go.bak", "scripts/_recon_handler_canary.go.bak", "scripts/_recon_handler_test_canary.go.bak",
+    "scripts/install_batch1_atomic.py",
+]
+subprocess.run(["git", "add"] + files, cwd=str(ROOT), check=True)
+subprocess.run(["git", "commit", "-m", "Add recon form fingerprint library and SSRF canary mode.", "-m", "Score crawl inputs by SSRF-prone field names and register ping-back canaries for operator paste confirmation."], cwd=str(ROOT), check=True)
+subprocess.run(["git", "push", "origin", "main"], cwd=str(ROOT), check=True)
+print("COMMIT_HASH=" + subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=str(ROOT), text=True).strip())