Metadata-Version: 2.4
Name: stapler-scanner
Version: 1.2.2
Summary: Stapler - industrial-grade network, web, server vulnerability scanning and exploit framework
Author: Stapler Security
License: MIT
Keywords: security,scanner,vulnerability,exploit,pentest
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: requests>=2.31
Requires-Dist: click>=8.1
Requires-Dist: rich>=13.6
Requires-Dist: flask>=3.0
Requires-Dist: pyyaml>=6.0
Requires-Dist: packaging>=23.0
Provides-Extra: dev
Requires-Dist: pytest>=7.4; extra == "dev"
Requires-Dist: ruff>=0.4; extra == "dev"
Requires-Dist: mypy>=1.9; extra == "dev"
Provides-Extra: brute
Requires-Dist: paramiko>=3; extra == "brute"

# Stapler

Industrial-grade, from-scratch network / web / server vulnerability scanning
and exploit framework for Python. Cross-platform (Windows + Linux auto-detect),
with a shared engine exposed through both a CLI and a web dashboard.

> Use only on systems and networks you are authorized to test.

## Install

```bash
pip install stapler-scanner
```

## Quick start

```bash
stapler selftest                 # verify modules load
stapler scan 192.168.1.0/24     # full automated scan (network+web+server+exploits)
stapler scan https://host/      # web-app focused scan
stapler exploit --list          # list exploit modules
stapler update                  # pull latest CVEs from CISA KEV + NVD
stapler report --format html    # render the last scan
stapler serve                   # launch the web dashboard
```

## Architecture

- `stapler.core` — platform detection, config, DB, scheduler, orchestrator, updater.
- `stapler.modules.network` — host discovery, port scan, service/version, OS fingerprint.
- `stapler.modules.web` — headers, tech detection, dir brute, SSL/TLS, OWASP checks.
- `stapler.modules.server` — SSH audit, software versions, misconfig.
- `stapler.modules.exploits` — RCE tier, Windows 10 tier, and signature-based CVEs
  (auto-loaded from `exploits_db.json`, refreshed by `stapler update`).
- `stapler.web` — Flask REST API + dashboard.
- `stapler.reporting` — JSON / HTML / CSV / Markdown reports with CVSS-style scoring.

## Safety

Detection runs by default. Active exploitation is gated behind `--exploit --yes`
and prints an authorized-use warning before any payload is sent.

## License

MIT
