Add recon upload hunter and admin surface probing for owned-target scans.

Extend web crawl with multipart/drag-drop/JS upload ranking and probe common admin paths for 200 vs 401/403 signals in scan JSON.

server/internal/recon/scan.go

@@ -183,6 +183,9 @@ func runOwnedTargetScan(req ScanRequest, scanID string, emit StreamEmit) (*ScanR
 	if !opts.SkipPorts {
 		ports := scanPortsList(host, portsToScan)
 		report.Ports = ports
+		for _, p := range ports {
+			emitReconPort(emit, scanID, host, p)
+		}
 		report.Banners = GrabBanners(host, ports)
 	}
 	if shouldCrawlProfile(req, uxProfile, report.Ports, opts) {
@@ -259,6 +262,7 @@ func crawlWithOptions(host string, port int, scheme string, seedPaths []string,
 		report.PagesFetched++
 		title, _ := htmlParseTitle(body)
 		report.Pages = append(report.Pages, PageFinding{URL: item.url, StatusCode: status, Title: title})
+		emitReconPage(emit, scanID, host, item.url, status, title)
 		if len(headers) > 0 { headerSnaps = append(headerSnaps, HTTPHeaderSnap{URL: item.url, Headers: headers}) }
 		htmlBodies = append(htmlBodies, body)
 		files, multi, fields, pageScore, cms := ParseHTML(item.url, body)
@@ -267,6 +271,7 @@ func crawlWithOptions(host string, port int, scheme string, seedPaths []string,
 		report.URLFields = append(report.URLFields, fields...)
 		report.SSRFScore += pageScore
 		report.CMSFingerprints = mergeCMS(report.CMSFingerprints, cms)
+		emitReconFindings(emit, scanID, host, files, multi, fields)
 		if item.depth >= maxDepth { continue }
 		for _, link := range extractLinks(body) {
 			abs, err := resolveSameOrigin(base, link)
@@ -280,6 +285,47 @@ func crawlWithOptions(host string, port int, scheme string, seedPaths []string,
 	return report, nil
 }
 
+func emitReconPort(emit StreamEmit, scanID, host string, p PortResult) {
+	if emit == nil {
+		return
+	}
+	emit("recon_port", map[string]interface{}{"scan_id": scanID, "host": host, "port": p.Port, "open": p.Open})
+}
+
+func emitReconPage(emit StreamEmit, scanID, host, pageURL string, status int, title string) {
+	if emit == nil {
+		return
+	}
+	emit("recon_page", map[string]interface{}{"scan_id": scanID, "host": host, "url": pageURL, "status_code": status, "title": title})
+}
+
+func emitReconFindings(emit StreamEmit, scanID, host string, files, multi []FormFinding, fields []URLFieldFinding) {
+	if emit == nil {
+		return
+	}
+	for _, f := range files {
+		emit("recon_finding", map[string]interface{}{"scan_id": scanID, "host": host, "kind": "file_input", "finding": f})
+	}
+	for _, f := range multi {
+		emit("recon_finding", map[string]interface{}{"scan_id": scanID, "host": host, "kind": "multipart_form", "finding": f})
+	}
+	for _, f := range fields {
+		emit("recon_finding", map[string]interface{}{"scan_id": scanID, "host": host, "kind": "url_field", "finding": f})
+	}
+}
+
+func formFindingKey(f FormFinding) string {
+	return f.PageURL + "|" + f.Action + "|" + strings.Join(f.Fields, ",")
+}
+
+func collectFormFindings(r *ScanReport) []FormFinding {
+	if r == nil || r.Crawl == nil {
+		return nil
+	}
+	out := append([]FormFinding{}, r.Crawl.FileInputs...)
+	return append(out, r.Crawl.MultipartForms...)
+}
+
 func OpenPorts(ports []PortResult) []int { var o []int; for _, p := range ports { if p.Open { o = append(o, p.Port) } }; return o }
 func DiffReports(prev, cur *ScanReport) *ReconScanDiff {
 	if cur == nil { return nil }