autopwn 개발기 ③ — 첫 라이브 런, SSE 67줄, 그리고 남은 nmap 버그

curl -s -H "X-API-Key:$KEY" -H "Content-Type: application/json" \
  -d '{"host":"8.8.8.8"}' http://127.0.0.1:8080/scope/check
# {"target":"8.8.8.8","allowed":false,"reason":"target is not in any allow entry"}

curl -s -H "X-API-Key:$KEY" -H "Content-Type: application/json" \
  -d '{"host":"198.51.100.42"}' http://127.0.0.1:8080/scope/check
# {"target":"198.51.100.42","allowed":true,"reason":"matches network entry"}

# 등록 안 된 외부 IP → deny
$ curl -s -H "X-API-Key:$KEY" -d '{"host":"8.8.8.8"}' \
    http://127.0.0.1:8080/scope/check
{
  "target": "8.8.8.8",
  "allowed": false,
  "reason": "target is not in any allow entry"
}
 
# allowlist 의 lab 네트워크 → allow
$ curl -s -H "X-API-Key:$KEY" -d '{"host":"172.18.0.12"}' \
    http://127.0.0.1:8080/scope/check
{
  "target": "172.18.0.12",
  "allowed": true,
  "reason": "matches network entry"
}

curl -N -H "X-API-Key:$KEY" http://127.0.0.1:8080/events/stream

curl -s -H "X-API-Key:$KEY" -H "Content-Type: application/json" \
  -d '{"playbook":"recon_basic","target":"198.51.100.42"}' \
  http://127.0.0.1:8080/playbooks/run

{
  "run_id": "bf07939f7eca403e87ba7ee8945f4fba",
  "playbook": "recon_basic",
  "target": "198.51.100.42",
  "state": "queued",
  "steps": [
    { "id": "discover", "state": "pending" },
    { "id": "vuln_hints", "state": "pending" }
  ],
  "created_at": "2026-05-17T15:35:02Z"
}

# api/playbooks/recon_basic.yaml
name: recon_basic
description: TCP connect 스캔 + 서비스 핑거프린팅. Proxychains/Tor 친화적.
inputs:
  - target
disallow_ai: false
steps:
  - id: discover
    tool: nmap
    args:
      flags: "-sT -Pn --top-ports 1000 -sV --reason"
 
  - id: vuln_hints
    tool: nmap
    when: "len(ctx['results']['discover']['open_ports']) > 0"
    args:
      flags: "-sT -Pn --script=banner,http-title -p {{ results.discover.open_ports_csv }}"

event: ready
data: {"ts":"...","channels":["autopwn:events","autopwn:events:scan","autopwn:events:session"]}
 
event: run.started
data: {"run_id":"bf07939...","playbook":"recon_basic","target":"198.51.100.42"}
 
event: step.running
data: {"run_id":"bf07939...","step":"discover","summary":null}
 
event: heartbeat
data: {"ts":"..."}
... (60회 heartbeat × 15초) ...
 
event: step.succeeded
data: {"run_id":"bf07939...","step":"discover","summary":"1 host(s), 8 open ports [proxied/connect-only]"}
 
event: step.skipped
data: {"run_id":"bf07939...","step":"vuln_hints","summary":"when=false"}
 
event: step.succeeded
data: {"run_id":"bf07939...","step":"vuln_hints"}
 
event: run.succeeded
data: {"run_id":"bf07939...","state":"succeeded"}

$ curl -N -H "X-API-Key:$KEY" http://127.0.0.1:8080/events/stream
event: ready                channels=[autopwn:events, …:scan, …:session]
event: run.started          playbook=web_vuln_chain  target=172.18.0.12
event: step.running         step=port_check
event: step.succeeded       step=port_check       summary=1 host, 1 open port (8983/tcp)
event: step.running         step=nuclei_web
event: tool.progress        (nuclei stdout 라이브 스트림)
event: step.succeeded       step=nuclei_web       summary=0 finding(s) (crit=0, high=0)
event: step.skipped         step=nuclei_followup  summary=when=false
event: run.succeeded
 
event: heartbeat            (15초마다 — autopwn API 가 보내는 SSE keepalive,
                             실제 활동 아님)

grep -c '^event:' /tmp/autopwn-sse.log
# 68

[1  00:35:09] state=running
[2  00:35:24] state=running
...
[59 00:49:41] state=running
[60 00:49:56] state=succeeded

"1 host(s), 8 open ports [proxied/connect-only]"

"len(ctx['results']['discover']['open_ports']) > 0"

curl -s -H "X-API-Key:$KEY" "http://127.0.0.1:8080/findings?run_id=$RUN_ID" | jq .
# []

Task #5 — nmap adapter: open_ports 파싱 / Finding 등록
- ctx['results'][step_id]['open_ports']: list[int]
- ctx['results'][step_id]['open_ports_csv']: str (vuln_hints 의 -p 인자용)
- Finding(host, port, service, banner) row 등록