RedAmon Files

Added

• Uncover Multi-Engine Target Expansion -- ProjectDiscovery's uncover integrated as GROUP 2b in the recon pipeline, running before Shodan and port scanning to expand the target surface. Queries up to 13 search engines simultaneously (Shodan, Censys, FOFA, ZoomEye, Netlas, CriminalIP, Quake, Hunter, PublicWWW, HunterHow, Google Custom Search, Onyphe, Driftnet) to discover exposed hosts, IPs, and endpoints associated with the target domain:
• Smart key reuse: automatically picks up API keys already configured for standalone OSINT enrichment modules -- no extra configuration needed if you already have Shodan/Censys/FOFA/etc. keys
• Docker-in-Docker: runs projectdiscovery/uncover:latest container with a dynamically generated provider-config.yaml containing only engines with valid credentials
• Engine-aware parsing: handles per-engine quirks -- Google URL-in-IP field, PublicWWW host-only results (no IP), Censys URL endpoints -- preventing silent data loss
• URL discovery: captures in-scope URLs from engines that populate the url field (Censys, PublicWWW, Google), stored as Endpoint nodes in Neo4j
• Pipeline merge: discovered subdomains injected into DNS structures so all downstream modules (port scan, HTTP probe, OSINT enrichment) process them automatically
• Neo4j graph: Subdomain, IP, Port, and Endpoint nodes with source tracking (uncover_sources, source_counts, total_raw, total_deduped)
• Frontend: embedded in OsintEnrichmentSection with enable/disable toggle and max results. Settings page groups uncover-specific keys under "Uncover (Multi-Engine Search)" with Standalone + Uncover badges on shared keys

• Tests: 80 unit tests across 3 test files

• Centralized IP Filtering (ip_filter.py) -- shared module replacing duplicate inline filtering across all OSINT enrichment modules. Filters RFC 1918 private, loopback, link-local, CGNAT, multicast, reserved ranges and CDN IPs (detected by Naabu/httpx). Used by all 9 enrichment modules before making external API calls

• Censys Platform API v3 Migration -- migrated from deprecated Basic Auth (API_ID/API_SECRET) to Bearer token auth (CENSYS_API_TOKEN + CENSYS_ORG_ID). Both recon pipeline and AI agent tool updated

• CriminalIP Agent Tool -- added criminalip_lookup to the AI agent tool registry for interactive IP threat intelligence queries

Fixed

• Silent data loss in uncover (Google/PublicWWW results dropped)
• Graph data loss (sources/source_counts metadata not written to Neo4j)
• Logging format violations (logger.* instead of print with pipeline prefix)
• Missing uncoverDockerImage Prisma schema field
• Missing Uncover entries in nodeMapping (SECTION_INPUT_MAP / SECTION_NODE_MAP)