chore(deps): bump the modules group across 1 directory with 18 updates

Bumps the modules group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/projectdiscovery/clistats](https://github.com/projectdiscovery/clistats) | `0.1.7` | `0.1.9` | | [github.com/projectdiscovery/dsl](https://github.com/projectdiscovery/dsl) | `0.9.0` | `0.9.2` | | [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer) | `0.6.0` | `0.6.2` | | [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) | `1.1.73` | `1.1.75` | | [github.com/projectdiscovery/gozero](https://github.com/projectdiscovery/gozero) | `0.1.1-0.20260530071156-fa1dad563d76` | `0.1.1` | | [github.com/projectdiscovery/hmap](https://github.com/projectdiscovery/hmap) | `0.0.102` | `0.0.104` | | [github.com/projectdiscovery/networkpolicy](https://github.com/projectdiscovery/networkpolicy) | `0.1.56` | `0.1.57` | | [github.com/projectdiscovery/rawhttp](https://github.com/projectdiscovery/rawhttp) | `0.2.0` | `0.2.2` | | [github.com/projectdiscovery/retryabledns](https://github.com/projectdiscovery/retryabledns) | `1.0.116` | `1.0.118` | | [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) | `1.3.31` | `1.3.34` | | [github.com/projectdiscovery/tlsx](https://github.com/projectdiscovery/tlsx) | `1.4.3-0.20261020052910-acb80c2c7c75` | `1.4.4` | | [github.com/projectdiscovery/useragent](https://github.com/projectdiscovery/useragent) | `0.0.109` | `0.0.110` | | [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) | `0.11.13-0.20261103094816-5c0b20e35350` | `0.11.13` | | [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) | `0.3.6` | `0.3.8` | | [github.com/projectdiscovery/yamldoc-go](https://github.com/projectdiscovery/yamldoc-go) | `1.0.7` | `1.0.9` | | [github.com/projectdiscovery/asnmap](https://github.com/projectdiscovery/asnmap) | `1.1.1` | `1.2.0` | | [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck) | `1.3.2` | `1.4.0` | | [github.com/projectdiscovery/freeport](https://github.com/projectdiscovery/freeport) | `0.0.7` | `0.0.8` | Updates `github.com/projectdiscovery/clistats` from 0.1.7 to 0.1.9 - [Release notes](https://github.com/projectdiscovery/clistats/releases) - [Commits](https://github.com/projectdiscovery/clistats/compare/v0.1.7...v0.1.9) Updates `github.com/projectdiscovery/dsl` from 0.9.0 to 0.9.2 - [Release notes](https://github.com/projectdiscovery/dsl/releases) - [Commits](https://github.com/projectdiscovery/dsl/compare/v0.9.0...v0.9.2) Updates `github.com/projectdiscovery/fastdialer` from 0.6.0 to 0.6.2 - [Release notes](https://github.com/projectdiscovery/fastdialer/releases) - [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.6.0...v0.6.2) Updates `github.com/projectdiscovery/gologger` from 1.1.73 to 1.1.75 - [Release notes](https://github.com/projectdiscovery/gologger/releases) - [Commits](https://github.com/projectdiscovery/gologger/compare/v1.1.73...v1.1.75) Updates `github.com/projectdiscovery/gozero` from 0.1.1-0.20260530071156-fa1dad563d76 to 0.1.1 - [Release notes](https://github.com/projectdiscovery/gozero/releases) - [Commits](https://github.com/projectdiscovery/gozero/commits/v0.1.1) Updates `github.com/projectdiscovery/hmap` from 0.0.102 to 0.0.104 - [Release notes](https://github.com/projectdiscovery/hmap/releases) - [Commits](https://github.com/projectdiscovery/hmap/compare/v0.0.102...v0.0.104) Updates `github.com/projectdiscovery/networkpolicy` from 0.1.56 to 0.1.57 - [Release notes](https://github.com/projectdiscovery/networkpolicy/releases) - [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.56...v0.1.57) Updates `github.com/projectdiscovery/rawhttp` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/projectdiscovery/rawhttp/releases) - [Commits](https://github.com/projectdiscovery/rawhttp/compare/v0.2.0...v0.2.2) Updates `github.com/projectdiscovery/retryabledns` from 1.0.116 to 1.0.118 - [Release notes](https://github.com/projectdiscovery/retryabledns/releases) - [Commits](https://github.com/projectdiscovery/retryabledns/compare/v1.0.116...v1.0.118) Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.31 to 1.3.34 - [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases) - [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.31...v1.3.34) Updates `github.com/projectdiscovery/tlsx` from 1.4.3-0.20261020052910-acb80c2c7c75 to 1.4.4 - [Release notes](https://github.com/projectdiscovery/tlsx/releases) - [Commits](https://github.com/projectdiscovery/tlsx/commits/v1.4.4) Updates `github.com/projectdiscovery/useragent` from 0.0.109 to 0.0.110 - [Release notes](https://github.com/projectdiscovery/useragent/releases) - [Commits](https://github.com/projectdiscovery/useragent/compare/v0.0.109...v0.0.110) Updates `github.com/projectdiscovery/utils` from 0.11.13-0.20261103094816-5c0b20e35350 to 0.11.13 - [Release notes](https://github.com/projectdiscovery/utils/releases) - [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md) - [Commits](https://github.com/projectdiscovery/utils/commits/v0.11.13) Updates `github.com/projectdiscovery/wappalyzergo` from 0.3.6 to 0.3.8 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.3.6...v0.3.8) Updates `github.com/projectdiscovery/yamldoc-go` from 1.0.7 to 1.0.9 - [Release notes](https://github.com/projectdiscovery/yamldoc-go/releases) - [Commits](https://github.com/projectdiscovery/yamldoc-go/compare/v1.0.7...v1.0.9) Updates `github.com/projectdiscovery/asnmap` from 1.1.1 to 1.2.0 - [Release notes](https://github.com/projectdiscovery/asnmap/releases) - [Commits](https://github.com/projectdiscovery/asnmap/compare/v1.1.1...v1.2.0) Updates `github.com/projectdiscovery/cdncheck` from 1.3.2 to 1.4.0 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.3.2...v1.4.0) Updates `github.com/projectdiscovery/freeport` from 0.0.7 to 0.0.8 - [Release notes](https://github.com/projectdiscovery/freeport/releases) - [Commits](https://github.com/projectdiscovery/freeport/compare/v0.0.7...v0.0.8) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/asnmap dependency-version: 1.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: modules - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.4.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: modules - dependency-name: github.com/projectdiscovery/clistats dependency-version: 0.1.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/dsl dependency-version: 0.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/fastdialer dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/freeport dependency-version: 0.0.8 dependency-type: indirect update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/gologger dependency-version: 1.1.75 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/gozero dependency-version: 0.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/hmap dependency-version: 0.0.104 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/networkpolicy dependency-version: 0.1.57 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/rawhttp dependency-version: 0.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/retryabledns dependency-version: 1.0.118 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/retryablehttp-go dependency-version: 1.3.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/tlsx dependency-version: 1.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/useragent dependency-version: 0.0.110 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/utils dependency-version: 0.11.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/yamldoc-go dependency-version: 1.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules ... Signed-off-by: dependabot[bot] <[email protected]>
Merge pull request #8091 from projectdiscovery/dwisiswant0/fix/deps/bump-golang-org-x-net-brotli-and-klauspost
2026-11-09 04:09:43 -10:00 · 2026-11-09 10:33:01 +00:00 · 2026-11-09 11:29:19 +01:00 · 2026-11-09 13:15:27 +03:00 · 2026-11-09 16:12:03 +07:00 · 2026-11-09 16:11:23 +07:00
35 changed files with 1431 additions and 144 deletions
@@ -17,4 +17,4 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
-      - uses: crate-ci/[email protected]1.1
+      - uses: crate-ci/[email protected]2.0
@@ -166,6 +166,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -181,6 +181,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -164,6 +164,7 @@ TEMPLATES:
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
+   -plan string                           write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all templates matching current filters
@@ -313,6 +313,7 @@ on extensive configurability, massive extensibility and ease of use.`)
 		flagSet.StringSliceVarP(&options.Workflows, "workflows", "w", nil, "list of workflow or workflow directory to run (comma-separated, file)", goflags.FileCommaSeparatedStringSliceOptions),
 		flagSet.StringSliceVarP(&options.WorkflowURLs, "workflow-url", "wurl", nil, "workflow url or list containing workflow urls to run (comma-separated, file)", goflags.FileCommaSeparatedStringSliceOptions),
 		flagSet.BoolVar(&options.Validate, "validate", false, "validate the passed templates to nuclei"),
+		flagSet.StringVar(&options.PlanFile, "plan", "", "write the work a scan would do with its estimated cost to a jsonl file, then exit without sending requests to any target"),
 		flagSet.BoolVarP(&options.NoStrictSyntax, "no-strict-syntax", "nss", false, "disable strict syntax check on templates"),
 		flagSet.BoolVarP(&options.TemplateDisplay, "template-display", "td", false, "displays the templates content"),
 		flagSet.BoolVar(&options.TemplateList, "tl", false, "list all templates matching current filters"),
@@ -18,7 +18,7 @@ require (
 	github.com/alecthomas/chroma/v2 v2.27.0
 	github.com/alexsnet/go-vnc v0.1.0
 	github.com/alitto/pond v1.9.2
-	github.com/andybalholm/brotli v1.2.0
+	github.com/andybalholm/brotli v1.2.7
 	github.com/andygrunwald/go-jira v1.16.1
 	github.com/antchfx/htmlquery v1.3.7
 	github.com/antchfx/xmlquery v1.4.4
@@ -63,7 +63,7 @@ require (
 	github.com/jhump/protoreflect v1.17.0
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/kitabisa/go-ci v1.0.3
-	github.com/klauspost/compress v1.18.7
+	github.com/klauspost/compress v1.20.2
 	github.com/leslie-qiwa/flat v0.0.0-20230424180412-f9d1cf014baa
 	github.com/lib/pq v1.12.3
 	github.com/logrusorgru/aurora/v4 v4.0.0
@@ -78,37 +78,37 @@ require (
 	github.com/ory/dockertest/v3 v3.12.0
 	github.com/pkg/errors v0.9.1
 	github.com/praetorian-inc/fingerprintx v1.1.15
-	github.com/projectdiscovery/clistats v0.1.7
-	github.com/projectdiscovery/dsl v0.9.0
-	github.com/projectdiscovery/fastdialer v0.6.0
+	github.com/projectdiscovery/clistats v0.1.9
+	github.com/projectdiscovery/dsl v0.9.2
+	github.com/projectdiscovery/fastdialer v0.6.2
 	github.com/projectdiscovery/fasttemplate v0.0.2
 	github.com/projectdiscovery/gcache v0.0.0-20241015120333-12546c6e3f4c
 	github.com/projectdiscovery/goflags v0.2.1
 	github.com/projectdiscovery/goimpacket v0.1.1-0.20261007205806-6042a8213eeb
 	github.com/projectdiscovery/goja v0.0.0-20261012075649-9b78f2e05b9c
 	github.com/projectdiscovery/goja_nodejs v0.0.0-20260618132410-8519f75f703d
-	github.com/projectdiscovery/gologger v1.1.73
+	github.com/projectdiscovery/gologger v1.1.75
 	github.com/projectdiscovery/gostruct v0.0.2
 	github.com/projectdiscovery/govaluate v0.0.0-20261102102118-9294133b15a2
-	github.com/projectdiscovery/gozero v0.1.1-0.20260530071156-fa1dad563d76
-	github.com/projectdiscovery/hmap v0.0.102
+	github.com/projectdiscovery/gozero v0.1.1
+	github.com/projectdiscovery/hmap v0.0.104
 	github.com/projectdiscovery/httpx v1.12.0
 	github.com/projectdiscovery/interactsh v1.4.1
 	github.com/projectdiscovery/mapcidr v1.1.97
 	github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5
-	github.com/projectdiscovery/networkpolicy v0.1.56
+	github.com/projectdiscovery/networkpolicy v0.1.57
 	github.com/projectdiscovery/ratelimit v0.0.94
-	github.com/projectdiscovery/rawhttp v0.2.0
+	github.com/projectdiscovery/rawhttp v0.2.2
 	github.com/projectdiscovery/rdap v0.9.0
-	github.com/projectdiscovery/retryabledns v1.0.116
-	github.com/projectdiscovery/retryablehttp-go v1.3.31
+	github.com/projectdiscovery/retryabledns v1.0.118
+	github.com/projectdiscovery/retryablehttp-go v1.3.34
 	github.com/projectdiscovery/sarif v0.1.0
-	github.com/projectdiscovery/tlsx v1.4.3-0.20261020052910-acb80c2c7c75
+	github.com/projectdiscovery/tlsx v1.4.4
 	github.com/projectdiscovery/uncover v1.2.1
-	github.com/projectdiscovery/useragent v0.0.109
-	github.com/projectdiscovery/utils v0.11.13-0.20261103094816-5c0b20e35350
-	github.com/projectdiscovery/wappalyzergo v0.3.6
-	github.com/projectdiscovery/yamldoc-go v1.0.7
+	github.com/projectdiscovery/useragent v0.0.110
+	github.com/projectdiscovery/utils v0.11.13
+	github.com/projectdiscovery/wappalyzergo v0.3.8
+	github.com/projectdiscovery/yamldoc-go v1.0.9
 	github.com/redis/go-redis/v9 v9.19.0
 	github.com/remeh/sizedwaitgroup v1.0.0
 	github.com/rs/xid v1.6.0
@@ -129,14 +129,14 @@ require (
 	go.mongodb.org/mongo-driver v1.17.9
 	go.uber.org/multierr v1.11.0
 	golang.org/x/exp v0.0.0-20260527015227-08cc5374adb3
-	golang.org/x/net v0.59.0
+	golang.org/x/net v0.62.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.23.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/term v0.46.0
-	golang.org/x/text v0.42.0
+	golang.org/x/sync v0.24.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/term v0.47.0
+	golang.org/x/text v0.43.0
 	golang.org/x/time v0.15.0
-	golang.org/x/tools v0.49.0
+	golang.org/x/tools v0.52.0
 	google.golang.org/grpc v1.83.2
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
@@ -168,7 +168,6 @@ require (
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057 // indirect
-	github.com/Mzack9999/go-http-digest-auth-client v0.6.1-0.20220414142836-eb8883508809 // indirect
 	github.com/Mzack9999/goimpacket v0.0.0-20260420131935-a9fe473cda7d // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
@@ -372,10 +371,10 @@ require (
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/projectdiscovery/asnmap v1.1.1 // indirect
+	github.com/projectdiscovery/asnmap v1.2.0 // indirect
 	github.com/projectdiscovery/blackrock v0.0.2 // indirect
-	github.com/projectdiscovery/cdncheck v1.3.2 // indirect
-	github.com/projectdiscovery/freeport v0.0.7 // indirect
+	github.com/projectdiscovery/cdncheck v1.4.0 // indirect
+	github.com/projectdiscovery/freeport v0.0.8 // indirect
 	github.com/projectdiscovery/jarm-go v0.0.0-20260910160638-430e2bae86f6 // indirect
 	github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb // indirect
 	github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 // indirect
@@ -432,7 +431,7 @@ require (
 	github.com/ysmood/got v0.40.0 // indirect
 	github.com/ysmood/gson v0.7.3 // indirect
 	github.com/ysmood/leakless v0.9.0 // indirect
-	github.com/yuin/goldmark v1.7.17 // indirect
+	github.com/yuin/goldmark v1.8.6 // indirect
 	github.com/yuin/goldmark-emoji v1.0.6 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zcalusic/sysinfo v1.1.3 // indirect
@@ -455,8 +454,8 @@ require (
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	goftp.io/server/v2 v2.0.1 // indirect
 	golang.org/x/arch v0.3.0 // indirect
-	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/mod v0.42.0 // indirect
 	google.golang.org/api v0.264.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
@@ -120,8 +120,6 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057 h1:KFac3SiGbId8ub47e7kd2PLZeACxc1LkiiNoDOFRClE=
 github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057/go.mod h1:iLB2pivrPICvLOuROKmlqURtFIEsoJZaMidQfCG1+D4=
-github.com/Mzack9999/go-http-digest-auth-client v0.6.1-0.20220414142836-eb8883508809 h1:ZbFL+BDfBqegi+/Ssh7im5+aQfBRx6it+kHnC7jaDU8=
-github.com/Mzack9999/go-http-digest-auth-client v0.6.1-0.20220414142836-eb8883508809/go.mod h1:upgc3Zs45jBDnBT4tVRgRcgm26ABpaP7MoTSdgysca4=
 github.com/Mzack9999/go-rsync v0.0.0-20250821180103-81ffa574ef4d h1:DofPB5AcjTnOU538A/YD86/dfqSNTvQsAXgwagxmpu4=
 github.com/Mzack9999/go-rsync v0.0.0-20250821180103-81ffa574ef4d/go.mod h1:uzdh/m6XQJI7qRvufeBPDa+lj5SVCJO8B9eLxTbtI5U=
 github.com/Mzack9999/goimpacket v0.0.0-20260420131935-a9fe473cda7d h1:xX93NZHxxrHcmN4nn1owvJdr1E/l1kp1Rv7rMr9ly+U=
@@ -170,8 +168,8 @@ github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e
 github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/alitto/pond v1.9.2 h1:9Qb75z/scEZVCoSU+osVmQ0I0JOeLfdTDafrbcJ8CLs=
 github.com/alitto/pond v1.9.2/go.mod h1:xQn3P/sHTYcU/1BR3i86IGIrilcrGC2LiS+E2+CJWsI=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.7 h1:UgafRPGMam5ySHfRkhthMqOFA6IFoeF3D7mWIDLjG5A=
+github.com/andybalholm/brotli v1.2.7/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
 github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/andygrunwald/go-jira v1.16.1 h1:WoQEar5XoDRAibOgKzTFELlPNlKAtnfWr296R9zdFLA=
@@ -749,8 +747,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/kitabisa/go-ci v1.0.3 h1:JmIUIvcercRQc/9x/v02ydCCqU4MadSHaNaOF8T2pGA=
 github.com/kitabisa/go-ci v1.0.3/go.mod h1:e3wBSzaJbcifXrr/Gw2ZBLn44MmeqP5WySwXyHlCK/U=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
-github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.2 h1:v5tiZvm1KGLyg5d5oXdXe3lsSPrbEUiKoXGia//I7Qo=
+github.com/klauspost/compress v1.20.2/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -923,22 +921,22 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/praetorian-inc/fingerprintx v1.1.15 h1:CVIxrIQARbmdk5h8E9tIJZbvFoY2sGLLG9rpFVfQqpA=
 github.com/praetorian-inc/fingerprintx v1.1.15/go.mod h1:hqRroITBwKpP8BOGF+n/A+qv9wSF7OSVinmu5NCyOUI=
-github.com/projectdiscovery/asnmap v1.1.1 h1:ImJiKIaACOT7HPx4Pabb5dksolzaFYsD1kID2iwsDqI=
-github.com/projectdiscovery/asnmap v1.1.1/go.mod h1:QT7jt9nQanj+Ucjr9BqGr1Q2veCCKSAVyUzLXfEcQ60=
+github.com/projectdiscovery/asnmap v1.2.0 h1:xxZxVYJYPyBNbwF7jL/rtpThKBMdjomQBmlAZRqhq7E=
+github.com/projectdiscovery/asnmap v1.2.0/go.mod h1:0tNdUGHUE7TFWDaHZtuXcVpQfRTZZ1BKmFfl8gtQbiU=
 github.com/projectdiscovery/blackrock v0.0.2 h1:mxXdu0uM8P2L2Qi210COlU8QiICPFW/Rxk5QUhlPO2k=
 github.com/projectdiscovery/blackrock v0.0.2/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss=
-github.com/projectdiscovery/cdncheck v1.3.2 h1:I453ZWNBeG0WWIy3wi9412l4PTzorLgebEnqmbcpSfo=
-github.com/projectdiscovery/cdncheck v1.3.2/go.mod h1:5IkUMMlcGaeg1DWW5oJVd3r9X3EpJ88j5HxBeF4Me9M=
-github.com/projectdiscovery/clistats v0.1.7 h1:NXf4lUzx1QcbJd6QycNwwYHTv2FsW9MchQ2LsgSL6C0=
-github.com/projectdiscovery/clistats v0.1.7/go.mod h1:RxRGxhMzkT344VTTvZWIrojurUXdQQRN1yfwgg/88I8=
-github.com/projectdiscovery/dsl v0.9.0 h1:i1KyCbKJyKfHkgdbfh0JkWdd14APUjpEYf+GaYANlCg=
-github.com/projectdiscovery/dsl v0.9.0/go.mod h1:ntNFkkiYCTEosGFTbApA61RMrvJTCjnakPxnWj56MyY=
-github.com/projectdiscovery/fastdialer v0.6.0 h1:4ZeFQ6LyRH4D8e3qO/yzqIP4Cf9Fr0DduaVpJD6ENnE=
-github.com/projectdiscovery/fastdialer v0.6.0/go.mod h1:FpHwa9S5PUgfPbh+irOm+cdU6AO631XidxkhPwPv7yY=
+github.com/projectdiscovery/cdncheck v1.4.0 h1:FP+ALhMtm+HyE8WgeWp3lUvNp3WaE7LCsC7LpB9QsWw=
+github.com/projectdiscovery/cdncheck v1.4.0/go.mod h1:27FjISwBKtdQXsC31q16xspX5xAu0gbYfF0rs3yGNxs=
+github.com/projectdiscovery/clistats v0.1.9 h1:qIxxxjWYuxoGIG02jOeztvz/8metvay2pG2P+Xld154=
+github.com/projectdiscovery/clistats v0.1.9/go.mod h1:4TcGnCtsmyy9/pkKaRyqQmKQljwiOPTCc0nnbluhYX0=
+github.com/projectdiscovery/dsl v0.9.2 h1:6zwxEF1J7Vy3Ng4VeZ3xphDE9D+ZsF6VOUT+UjDOngk=
+github.com/projectdiscovery/dsl v0.9.2/go.mod h1:lD4o4Fqgql7YxZYYb4XYR9rHhMG5UZM3iB9MQx3/zKM=
+github.com/projectdiscovery/fastdialer v0.6.2 h1:SMf7/1IK/y6ThiDrLaEQ6/owZ5V5+uQPJZmsZVTA2Vs=
+github.com/projectdiscovery/fastdialer v0.6.2/go.mod h1:mZ6UOoMyTHCbn5nz6xzFmgwvushgY6/ecANYZe6XqrQ=
 github.com/projectdiscovery/fasttemplate v0.0.2 h1:h2cISk5xDhlJEinlBQS6RRx0vOlOirB2y3Yu4PJzpiA=
 github.com/projectdiscovery/fasttemplate v0.0.2/go.mod h1:XYWWVMxnItd+r0GbjA1GCsUopMw1/XusuQxdyAIHMCw=
-github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk=
-github.com/projectdiscovery/freeport v0.0.7/go.mod h1:cOhWKvNBe9xM6dFJ3RrrLvJ5vXx2NQ36SecuwjenV2k=
+github.com/projectdiscovery/freeport v0.0.8 h1:7EE+m7DY7Yc2afpB/F45V+zH2DL+M0skCSUc3gb5KUs=
+github.com/projectdiscovery/freeport v0.0.8/go.mod h1:dtIhwfdXOiA0gyr2PWno1X8RTqtzHbQDNfJGpSvptD4=
 github.com/projectdiscovery/gcache v0.0.0-20241015120333-12546c6e3f4c h1:s+lLAlrOrgwlPZQ9DFqNw+kia2nteKnJZ2Ek313yoUc=
 github.com/projectdiscovery/gcache v0.0.0-20241015120333-12546c6e3f4c/go.mod h1:rN35/D3lVx2YDeENFFz06uj8j3XIqK1Ym9XcISF5fzg=
 github.com/projectdiscovery/goflags v0.2.1 h1:XnSYvsCjUwHbZaaJUZ3YznCJPoXRk/IhTFP9Gecmx6M=
@@ -949,16 +947,16 @@ github.com/projectdiscovery/goja v0.0.0-20261012075649-9b78f2e05b9c h1:4H/CfVNlu
 github.com/projectdiscovery/goja v0.0.0-20261012075649-9b78f2e05b9c/go.mod h1:SO0AP+uKfYeeoR6jyVH/PKRYJE/f5gJrPMAM00iGEMc=
 github.com/projectdiscovery/goja_nodejs v0.0.0-20260618132410-8519f75f703d h1:fqqH9LHpN2WDz9QuxFrhKNxXSRtzk+Sa6jAhbB7tXcQ=
 github.com/projectdiscovery/goja_nodejs v0.0.0-20260618132410-8519f75f703d/go.mod h1:Ezmbgdaw4EunGGBU4MQViLoGMJc37LA3ip55YV3KeRI=
-github.com/projectdiscovery/gologger v1.1.73 h1:WX2nzq29cL7HdvOHqIttacoid/5lMwapyM7ukGU1jFY=
-github.com/projectdiscovery/gologger v1.1.73/go.mod h1:mJwODZcFDg70ihINpOvZevmBtgvpP8H9/l8Y+OPhZPY=
+github.com/projectdiscovery/gologger v1.1.75 h1:w+8DgCOCFpUegE2Ww8LQBUWPACkJUOvJ4Q1C0f2N9qI=
+github.com/projectdiscovery/gologger v1.1.75/go.mod h1:LDeWHizV+0QVuvDP4uJHM/M+eQlp0XLWlQ1z8PgOE1k=
 github.com/projectdiscovery/gostruct v0.0.2 h1:s8gP8ApugGM4go1pA+sVlPDXaWqNP5BBDDSv7VEdG1M=
 github.com/projectdiscovery/gostruct v0.0.2/go.mod h1:H86peL4HKwMXcQQtEa6lmC8FuD9XFt6gkNR0B/Mu5PE=
 github.com/projectdiscovery/govaluate v0.0.0-20261102102118-9294133b15a2 h1:aSLbDvrJQPlp4HvojU+bTU5XV8xdAVCjoc5gX1Wfbw4=
 github.com/projectdiscovery/govaluate v0.0.0-20261102102118-9294133b15a2/go.mod h1:Z3VjpUJV1pnXDwvAddA8aZ4e839SoeftB7CSdZntAVI=
-github.com/projectdiscovery/gozero v0.1.1-0.20260530071156-fa1dad563d76 h1:AN70bbi6BBs7KpIM9w0LxygUN7uzT/oH+owDIQ+Fz/k=
-github.com/projectdiscovery/gozero v0.1.1-0.20260530071156-fa1dad563d76/go.mod h1:cWHYnRXoYWHtTpOYyAp5laGYX8GH8ITUhgQaP8G/8FA=
-github.com/projectdiscovery/hmap v0.0.102 h1:ybPuf7UQvuOLiHLOUbVMvd+PSlItQU5iQpP1Erl8kaU=
-github.com/projectdiscovery/hmap v0.0.102/go.mod h1:IZ92wXFmxYpdn0euZ7VFmypzOBNDwq8c3yRyIIol6XE=
+github.com/projectdiscovery/gozero v0.1.1 h1:wLiJH11YTMzgrV9AWB24S08wYfGF4/ggm4xdlduQmLk=
+github.com/projectdiscovery/gozero v0.1.1/go.mod h1:RFHYWR70/YBV74h/0P2l0Crht6lHq8zhJfAluVg97OI=
+github.com/projectdiscovery/hmap v0.0.104 h1:38j4A2gttI48tI5MrdRV2ZTH3SWEysoSYeDxqYqW3rA=
+github.com/projectdiscovery/hmap v0.0.104/go.mod h1:koGp3dcpH+BNj/9JuoZnXhbRfAiZrgIiCzsiBCtSIFs=
 github.com/projectdiscovery/httpx v1.12.0 h1:NN5iDrw7NjPBDlACdjac4lePTQmZ5aOmgOzptMpP44c=
 github.com/projectdiscovery/httpx v1.12.0/go.mod h1:OgtyibNGdu9BrJxRdNKm280Davw1Z4s2FAhfPNNtLB4=
 github.com/projectdiscovery/interactsh v1.4.1 h1:EGHPJ1rnuxvILWfcoaRgb/Ykz67WiDXABRCSJN666GA=
@@ -973,34 +971,34 @@ github.com/projectdiscovery/mapcidr v1.1.97 h1:7FkxNNVXp+m1rIu5Nv/2SrF9k4+LwP8Qu
 github.com/projectdiscovery/mapcidr v1.1.97/go.mod h1:9dgTJh1SP02gYZdpzMjm6vtYFkEHQHoTyaVNvaeJ7lA=
 github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5 h1:L/e8z8yw1pfT6bg35NiN7yd1XKtJap5Nk6lMwQ0RNi8=
 github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5/go.mod h1:pGW2ncnTxTxHtP9wzcIJAB+3/NMp6IiuQWd2NK7K+oc=
-github.com/projectdiscovery/networkpolicy v0.1.56 h1:M/L421HFuN707oX0tLTzKZY46uRyaKwxAeyi0q8PlxI=
-github.com/projectdiscovery/networkpolicy v0.1.56/go.mod h1:N5bXm8L3UsDw51CeA1nhTsGEbQMbgL5lXTiIU013xd0=
+github.com/projectdiscovery/networkpolicy v0.1.57 h1:3P7esW8KE3yoZSE/GvswbSZ1bh8Gk+dURtvNlFzOid0=
+github.com/projectdiscovery/networkpolicy v0.1.57/go.mod h1:Ky0GOIqAL666JBHyHeIsQ5rjkET902I6XjGEpvCVx9s=
 github.com/projectdiscovery/ratelimit v0.0.94 h1:2qciSuUxarn73YGICZeprZtjrwyAH+0iVpdKzKCXoXE=
 github.com/projectdiscovery/ratelimit v0.0.94/go.mod h1:GAerX6s+eWRuACedHRv2/xmMtlW+VahZmbRstQh0sS0=
-github.com/projectdiscovery/rawhttp v0.2.0 h1:TGiHC5hydL97/zoi0WjEuNrfO6Gjtg9LeXndUf1Cq3M=
-github.com/projectdiscovery/rawhttp v0.2.0/go.mod h1:Waz+K5y6r44ElpqAoOfYtY03zrGGZ12nx0yDKq7Ot1E=
+github.com/projectdiscovery/rawhttp v0.2.2 h1:l1UvmSWrpd1wpTIlYKlP4VnmV3jhqR7P05wyDwKBml8=
+github.com/projectdiscovery/rawhttp v0.2.2/go.mod h1:Wg1bJ3DGXdVcU2ieU1NqT09rGolvp+FlVeo1QdTnRmg=
 github.com/projectdiscovery/rdap v0.9.0 h1:wPhHx5pQ2QI+WGhyNb2PjhTl0NtB39Nk7YFZ9cp8ZGA=
 github.com/projectdiscovery/rdap v0.9.0/go.mod h1:zk4yrJFQ2Hy36Aqk+DvotYQxYAeALaCJ5ORySkff36Q=
-github.com/projectdiscovery/retryabledns v1.0.116 h1:tK28PJ4tLO7bgM89RpIFjkfTPMSbRegwvg9mN/q6z78=
-github.com/projectdiscovery/retryabledns v1.0.116/go.mod h1:r3vH0AKYtJ9fculcqRFrdVYe2ABcHwZeR4C6j3rqCbY=
-github.com/projectdiscovery/retryablehttp-go v1.3.31 h1:0hSEZ5+jj6Oo1IL8qrytD36TK/qCxfe543jEaRqSTjs=
-github.com/projectdiscovery/retryablehttp-go v1.3.31/go.mod h1:/WEa7YejxTCXEMLCGfGYaC3JsgXgzuqw8rv8cb4buEc=
+github.com/projectdiscovery/retryabledns v1.0.118 h1:vrWzUgjRyD5fg2QiPF0boDuSL/QYuoxPftgpYQv2MiQ=
+github.com/projectdiscovery/retryabledns v1.0.118/go.mod h1:qHuxflnN8BWWqQ+N+TIe9OTqmaMpE/G2+36chAcFQhg=
+github.com/projectdiscovery/retryablehttp-go v1.3.34 h1:tp45jp3yAtXunuIPeOB1k4L/9vq4Tn9Lm0wkRHRKMnI=
+github.com/projectdiscovery/retryablehttp-go v1.3.34/go.mod h1:O/9n0ltIPaX06kpgPAz0Ncq4uPQXttSIWapSu4xvd3E=
 github.com/projectdiscovery/sarif v0.1.0 h1:O541T+a448nSJsmIMnXXSOeDQEzpnCAYvRfe0eG5h74=
 github.com/projectdiscovery/sarif v0.1.0/go.mod h1:LBC+reM3bkI3qIIhE0rZaINaYX6VG+En6u2hHa5mA7E=
 github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA=
 github.com/projectdiscovery/stringsutil v0.0.2/go.mod h1:EJ3w6bC5fBYjVou6ryzodQq37D5c6qbAYQpGmAy+DC0=
-github.com/projectdiscovery/tlsx v1.4.3-0.20261020052910-acb80c2c7c75 h1:3qJgfWzzwtFXc/vdUIurSzPzyjBH9NQe0wATkZMoQGI=
-github.com/projectdiscovery/tlsx v1.4.3-0.20261020052910-acb80c2c7c75/go.mod h1:8jqB9aHT6U8NkUsENvaSjD/iBEGB4Ta+CbJBMcvzP9c=
+github.com/projectdiscovery/tlsx v1.4.4 h1:XBoy/wwJ3pPwD+8vEtiIrJVJnC3QrKtVNRRZj3A0vH4=
+github.com/projectdiscovery/tlsx v1.4.4/go.mod h1:T26MvekV2O9keTvCKvij5pLEBb1OtC5LKYjAs/xgs1A=
 github.com/projectdiscovery/uncover v1.2.1 h1:8U46T/96CLT7BPoXBgkTvWqB06lOyeTSLvh5+UjzATE=
 github.com/projectdiscovery/uncover v1.2.1/go.mod h1:0p8onrWxfpXQEYs90ZDzTSpu1107gWmodX1NWqu/+z4=
-github.com/projectdiscovery/useragent v0.0.109 h1:b86BPdZvmgbJousa04jAugDRY4Y+rAvEamE0TFCPmeE=
-github.com/projectdiscovery/useragent v0.0.109/go.mod h1:sRyBqDAcD31RKYrO8fyXGowLd36fNwY1g0MNW9mp7zk=
-github.com/projectdiscovery/utils v0.11.13-0.20261103094816-5c0b20e35350 h1:uXqpYa6XKV9dCvoti9PbSgIWIsBKPu5YKMywB9G4q0Q=
-github.com/projectdiscovery/utils v0.11.13-0.20261103094816-5c0b20e35350/go.mod h1:TJgsyVjB02CavwZVFzUzPg6YOSJXQxLhL808JCiQKlU=
-github.com/projectdiscovery/wappalyzergo v0.3.6 h1:1FXCMeCa1xVu2zaW+eeBcbVxtlMStqGOlKcMLyh2pzI=
-github.com/projectdiscovery/wappalyzergo v0.3.6/go.mod h1:4E6+fh/ckaY3wo5tlM7lNYSkhuTYRHzu2YmGIRraXP0=
-github.com/projectdiscovery/yamldoc-go v1.0.7 h1:Odmjd1o4EkMff2F6QHi1dIYPIQPZUFy24YqmQCprmTk=
-github.com/projectdiscovery/yamldoc-go v1.0.7/go.mod h1:nqD1iPMcofpRA1DbXavPByJhWURrshT+l8WN9XjyQag=
+github.com/projectdiscovery/useragent v0.0.110 h1:hoKpQssbFLSSmK/Vxf/fG/a+PToEYdzLafG7HHbvCAc=
+github.com/projectdiscovery/useragent v0.0.110/go.mod h1:fOeQ2+nlOJHYuPpnWWrBz5q5dUo7efe/AmvWQdNsLUM=
+github.com/projectdiscovery/utils v0.11.13 h1:Mn3/rtyQvtn8XZy0UnVkxbAmn0afbHtWuMHUEztwWSw=
+github.com/projectdiscovery/utils v0.11.13/go.mod h1:TJgsyVjB02CavwZVFzUzPg6YOSJXQxLhL808JCiQKlU=
+github.com/projectdiscovery/wappalyzergo v0.3.8 h1:bjQ99Lanzj8l+2ENwt24/LdZ09uR9IxkamXssBXahIQ=
+github.com/projectdiscovery/wappalyzergo v0.3.8/go.mod h1:7gTNIjQSXsVmFDJJ3PT8+FhYE+dv6hZLGZSsRAEjVSw=
+github.com/projectdiscovery/yamldoc-go v1.0.9 h1:pms4u/qWaMYTMnI1R+MUKu/qRV3k/nruHG0wDj2IJmo=
+github.com/projectdiscovery/yamldoc-go v1.0.9/go.mod h1:9PyUvPQYG/JuO8ejBDwCcpCWk12/1R/i+7WUbsZ+KNY=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
@@ -1230,8 +1228,8 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.17 h1:p36OVWwRb246iHxA/U4p8OPEpOTESm4n+g+8t0EE5uA=
-github.com/yuin/goldmark v1.7.17/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.6 h1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=
+github.com/yuin/goldmark v1.8.6/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
 github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
 github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
@@ -1335,8 +1333,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1374,8 +1372,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1424,8 +1422,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1452,8 +1450,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1518,8 +1516,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1532,8 +1530,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1550,8 +1548,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1603,8 +1601,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -119,6 +119,14 @@ func ParseOptions(options *types.Options) {
 		options.Logger.Debug().Msgf("Store response directory specified, enabling \"store-resp\" flag automatically\n")
 		options.StoreResponse = true
 	}
+	// Derived before validation: -uncover-query turns uncover on, and -plan
+	// has to reject that before any target lookup starts.
+	if options.UncoverQuery != nil {
+		options.Uncover = true
+		if len(options.UncoverEngine) == 0 {
+			options.UncoverEngine = append(options.UncoverEngine, "shodan")
+		}
+	}
 	// Validate the options passed by the user and if any
 	// invalid options have been used, exit.
 	if err := ValidateOptions(options); err != nil {
@@ -138,13 +146,6 @@ func ParseOptions(options *types.Options) {
 		_ = os.Setenv("GITHUB_TOKEN", options.GitHubToken)
 	}

-	if options.UncoverQuery != nil {
-		options.Uncover = true
-		if len(options.UncoverEngine) == 0 {
-			options.UncoverEngine = append(options.UncoverEngine, "shodan")
-		}
-	}
-
 	if options.OfflineHTTP {
 		options.DisableHTTPProbe = true
 	}
@@ -162,6 +163,9 @@ func ValidateOptions(options *types.Options) error {
 		}
 		return errors.Wrap(errors.New(strings.Join(errs, ", ")), "validation failed for these fields")
 	}
+	if err := validatePlanOptions(options); err != nil {
+		return err
+	}
 	if options.Verbose && options.Silent {
 		return errors.New("both verbose and silent mode specified")
 	}
@@ -536,3 +540,22 @@ func getBoolEnvValue(key string) bool {
 	value := os.Getenv(key)
 	return strings.EqualFold(value, "true")
 }
+
+// validatePlanOptions rejects options that change the templates or targets
+// only once scanning starts, which a plan written beforehand cannot show.
+func validatePlanOptions(options *types.Options) error {
+	if options.PlanFile == "" {
+		return nil
+	}
+	switch {
+	case options.AutomaticScan:
+		return errors.New("-plan cannot be used with -automatic-scan, which picks templates while scanning")
+	case options.Uncover || len(options.UncoverQuery) > 0:
+		return errors.New("-plan cannot be used with -uncover, which finds targets over the network")
+	case options.PreflightPortScan:
+		return errors.New("-plan cannot be used with -preflight-portscan, which drops targets after scanning their ports")
+	case options.DASTServer || options.DASTProxy:
+		return errors.New("-plan cannot be used with -dast-server or -dast-proxy, which start a server instead of writing a plan")
+	}
+	return nil
+}
@@ -0,0 +1,98 @@
+package runner
+
+import (
+	"bufio"
+	"os"
+	"slices"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/loader"
+	"github.com/projectdiscovery/nuclei/v3/pkg/core"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
+	"github.com/projectdiscovery/nuclei/v3/pkg/utils/json"
+)
+
+// httpRequestSeconds is the time of one http request the plan costs are
+// weighted against (see core.PlanEntry.Cost).
+const httpRequestSeconds = 0.015
+
+// planSummary is the last line of a plan file, written once every entry is
+// known.
+type planSummary struct {
+	Entries int `json:"entries"`
+	// Alternatives are entries that run only when another of their origin
+	// fails, so they are left out of every other total.
+	Alternatives int `json:"alternatives,omitempty"`
+	Requests     int `json:"requests"`
+	Cost         int `json:"cost"`
+	// EstimatedSeconds is the largest of the time the rate limit allows, the
+	// cost spread over every concurrent slot, and the longest entry, whose
+	// requests run one after another. Hosts slower than the measured request
+	// time make the scan take longer.
+	EstimatedSeconds int `json:"estimated-seconds"`
+}
+
+// writePlan writes one JSON line per unit of work the scan would run,
+// followed by the summary. Targets are listed as given: inputs that the scan
+// would probe to an http url first are not probed here, since probing sends
+// requests.
+func (r *Runner) writePlan(store *loader.Store, engine *core.Engine) error {
+	if !r.options.DisableHTTPProbe && loader.IsHTTPBasedProtocolUsed(store) && r.isInputNonHTTP() {
+		r.Logger.Info().Msgf("Targets without a scheme are planned as given; the scan probes them for http(s) first")
+	}
+	file, err := os.Create(r.options.PlanFile)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = file.Close() }()
+	writer := bufio.NewWriter(file)
+	encoder := json.NewEncoder(writer)
+
+	var summary planSummary
+	var headlessCost, longest int
+	var encodeErr error
+	engine.Plan(slices.Concat(store.Templates(), store.Workflows()), r.inputProvider, r.options.DisableClustering, func(entry core.PlanEntry) {
+		if encodeErr != nil {
+			return
+		}
+		encodeErr = encoder.Encode(entry)
+		if entry.AlternativeTo != "" {
+			summary.Alternatives++
+			return
+		}
+		summary.Entries++
+		summary.Requests += entry.Requests
+		summary.Cost += entry.Cost
+		longest = max(longest, entry.Cost)
+		if entry.Protocol == types.HeadlessProtocol.String() {
+			headlessCost += entry.Cost
+		}
+	})
+	if encodeErr != nil {
+		return encodeErr
+	}
+	summary.EstimatedSeconds = r.estimateSeconds(summary.Requests, summary.Cost-headlessCost, headlessCost, longest)
+	if err := encoder.Encode(map[string]planSummary{"summary": summary}); err != nil {
+		return err
+	}
+	if err := writer.Flush(); err != nil {
+		return err
+	}
+	r.Logger.Info().Msgf("Plan written to %s: %d template runs, up to %d requests, about %ds", r.options.PlanFile, summary.Entries, summary.Requests, summary.EstimatedSeconds)
+	return nil
+}
+
+// estimateSeconds estimates the scan duration. Headless templates run in
+// their own, smaller pool, so their cost is spread over it separately.
+func (r *Runner) estimateSeconds(requests, cost, headlessCost, longest int) int {
+	seconds := float64(longest) * httpRequestSeconds
+	if r.options.RateLimit > 0 && r.options.RateLimitDuration > 0 {
+		seconds = max(seconds, float64(requests)/(float64(r.options.RateLimit)/r.options.RateLimitDuration.Seconds()))
+	}
+	if slots := r.options.TemplateThreads * r.options.BulkSize; slots > 0 {
+		seconds = max(seconds, float64(cost)*httpRequestSeconds/float64(slots))
+	}
+	if slots := r.options.HeadlessTemplateThreads * r.options.HeadlessBulkSize; slots > 0 {
+		seconds = max(seconds, float64(headlessCost)*httpRequestSeconds/float64(slots))
+	}
+	return int(seconds + 0.5)
+}
@@ -0,0 +1,26 @@
+package runner
+
+import (
+	"testing"
+
+	"github.com/projectdiscovery/goflags"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPlanRejectsOptionsThatChangeTargetsLater(t *testing.T) {
+	for name, options := range map[string]*types.Options{
+		"automatic scan": {PlanFile: "p", AutomaticScan: true},
+		"uncover":        {PlanFile: "p", Uncover: true},
+		"uncover query":  {PlanFile: "p", UncoverQuery: goflags.StringSlice{"example"}},
+		"preflight":      {PlanFile: "p", PreflightPortScan: true},
+		"dast server":    {PlanFile: "p", DASTServer: true},
+		"dast proxy":     {PlanFile: "p", DASTProxy: true},
+	} {
+		require.Error(t, validatePlanOptions(options), name)
+	}
+	require.NoError(t, validatePlanOptions(&types.Options{PlanFile: "p"}))
+	require.NoError(t, validatePlanOptions(&types.Options{Uncover: true}), "only -plan restricts them")
+	require.NoError(t, validatePlanOptions(&types.Options{UncoverQuery: goflags.StringSlice{"example"}}))
+	require.NoError(t, validatePlanOptions(&types.Options{DASTServer: true}))
+}
@@ -0,0 +1,24 @@
+package runner
+
+import (
+	"testing"
+	"time"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEstimateSecondsTakesTheSlowestBound(t *testing.T) {
+	r := &Runner{options: &types.Options{
+		RateLimit: 150, RateLimitDuration: time.Second,
+		TemplateThreads: 25, BulkSize: 25,
+		HeadlessTemplateThreads: 10, HeadlessBulkSize: 10,
+	}}
+
+	require.Equal(t, 20, r.estimateSeconds(3000, 3000, 0, 12), "rate limit bound")
+	require.Equal(t, 10, r.estimateSeconds(52, 41, 660, 660), "one long entry runs its requests in sequence")
+	require.Equal(t, 9, r.estimateSeconds(100, 0, 60000, 60), "headless cost spreads over the headless pool")
+
+	r.options.RateLimit = 0
+	require.Equal(t, 0, r.estimateSeconds(3000, 3000, 0, 1), "no rate limit, cost spread over 625 slots")
+}
@@ -147,10 +147,18 @@ func New(options *types.Options) (*Runner, error) {

 	//  Version check by default
 	if config.DefaultConfig.CanCheckForUpdates() {
-		latestIgnoreHash, versionCheckErr := installer.NucleiVersionCheck()
-		if versionCheckErr != nil {
-			if options.Verbose || options.Debug {
-				runner.Logger.Error().Msgf("nuclei version check failed got: %s\n", versionCheckErr)
+		// -plan sends no request it can avoid, so it skips the version and
+		// update checks; it still installs templates on a fresh setup, which
+		// would otherwise plan nothing
+		checkUpdates := options.PlanFile == ""
+		var latestIgnoreHash string
+		if checkUpdates {
+			var versionCheckErr error
+			latestIgnoreHash, versionCheckErr = installer.NucleiVersionCheck()
+			if versionCheckErr != nil {
+				if options.Verbose || options.Debug {
+					runner.Logger.Error().Msgf("nuclei version check failed got: %s\n", versionCheckErr)
+				}
 			}
 		}

@@ -171,17 +179,19 @@ func New(options *types.Options) (*Runner, error) {
 		if err := tm.FreshInstallIfNotExists(); err != nil {
 			runner.Logger.Warning().Msgf("Failed to install nuclei templates: %s\n", err)
 		}
-		if err := tm.UpdateIfOutdated(); err != nil {
-			runner.Logger.Warning().Msgf("Failed to update nuclei templates: %s\n", err)
+		if checkUpdates {
+			if err := tm.UpdateIfOutdated(); err != nil {
+				runner.Logger.Warning().Msgf("Failed to update nuclei templates: %s\n", err)
+			}
 		}

-		if config.DefaultConfig.IgnoreFileNeedsUpdate(latestIgnoreHash) {
+		if checkUpdates && config.DefaultConfig.IgnoreFileNeedsUpdate(latestIgnoreHash) {
 			if err := installer.UpdateIgnoreFile(); err != nil {
 				runner.Logger.Warning().Msgf("Failed to update .nuclei-ignore file: %s\n", err)
 			}
 		}

-		if options.UpdateTemplates {
+		if checkUpdates && options.UpdateTemplates {
 			// we automatically check for updates unless explicitly disabled
 			// this print statement is only to inform the user that there are no updates
 			noUpdates := !config.DefaultConfig.NeedsTemplateUpdate()
@@ -592,8 +602,13 @@ func (r *Runner) RunEnumeration() error {
 	httpclientpool.ResetConnectionStats()

 	// If the user has asked for DAST server mode, run the live
-	// DAST fuzzing server.
+	// DAST fuzzing server. -plan never reaches this with those flags set:
+	// validation rejects the combination, and this check covers a caller
+	// that skipped it.
 	if r.options.DASTServer || r.options.DASTProxy {
+		if err := validatePlanOptions(r.options); err != nil {
+			return err
+		}
 		execurOpts := &server.NucleiExecutorOptions{
 			Options:            r.options,
 			Output:             r.output,
@@ -817,6 +832,11 @@ func (r *Runner) RunEnumeration() error {
 		profiles.Prepare(slices.Concat(store.Templates(), store.Workflows()))
 		executorOpts.TargetScope = profiles
 	}
+	// before uncover, preflight, auth prefetch and probing below, all of which
+	// reach the network
+	if r.options.PlanFile != "" {
+		return r.writePlan(store, executorEngine)
+	}
 	// TODO: remove below functions after v3 or update warning messages
 	templates.PrintDeprecatedProtocolNameMsgIfApplicable(r.options.Silent, r.options.Verbose)

@@ -38,19 +38,7 @@ func (e *Engine) ExecuteScanWithOpts(ctx context.Context, templatesList []*templ

 	totalReqBeforeCluster := getRequestCount(templatesList) * int(target.Count())

-	// attempt to cluster templates if noCluster is false
-	var finalTemplates []*templates.Template
-	clusterCount := 0
-	if !noCluster {
-		var clusterMappings map[string][]string
-		finalTemplates, clusterCount, clusterMappings = templates.ClusterTemplates(templatesList, e.executerOpts)
-		// Store cluster mappings in executerOpts for SDK access (thread-safe)
-		if clusterMappings != nil {
-			e.executerOpts.ClusterMappings = types.NewClusterMappingsMap(clusterMappings)
-		}
-	} else {
-		finalTemplates = templatesList
-	}
+	finalTemplates, clusterCount := e.clusterTemplates(templatesList, noCluster)

 	totalReqAfterClustering := getRequestCount(finalTemplates) * int(target.Count())

@@ -186,6 +174,20 @@ func (e *Engine) executeHostSpray(ctx context.Context, templatesList []*template
 	return results
 }

+// clusterTemplates merges templates that send identical requests unless
+// noCluster is set, and returns the templates to run with the number merged.
+func (e *Engine) clusterTemplates(templatesList []*templates.Template, noCluster bool) ([]*templates.Template, int) {
+	if noCluster {
+		return templatesList, 0
+	}
+	finalTemplates, clusterCount, clusterMappings := templates.ClusterTemplates(templatesList, e.executerOpts)
+	// Store cluster mappings in executerOpts for SDK access (thread-safe)
+	if clusterMappings != nil {
+		e.executerOpts.ClusterMappings = types.NewClusterMappingsMap(clusterMappings)
+	}
+	return finalTemplates, clusterCount
+}
+
 // expectedWork returns the requests and the tasks the target-bound templates
 // will run. It counts only the template and target pairs that per-target
 // profiles select, so progress reflects the work that will be done. A task is
@@ -382,6 +382,19 @@ func newOriginAttempt() *originAttempt {
 	return attempt
 }

+// originScopeKey returns the key an origin-scoped template runs once per, and
+// false when the template runs on every target.
+func originScopeKey(template *templates.Template, value *contextargs.MetaInput) (string, bool) {
+	if template == nil || value == nil || !template.IsOriginScoped() {
+		return "", false
+	}
+	origin := normalize.Origin(value.Input)
+	if origin == "" {
+		return "", false
+	}
+	return template.ID + "\x00" + origin + "\x00" + value.CustomIP, true
+}
+
 // claimOriginScoped reports whether this caller should execute an origin-scoped
 // template. finish(true) records a successful run. finish(false) releases the
 // claim so a later target, including one that waited, can try again. Templates
@@ -389,14 +402,10 @@ func newOriginAttempt() *originAttempt {
 // key so each address selected for one URL is tested on its own.
 func (e *Engine) claimOriginScoped(template *templates.Template, value *contextargs.MetaInput) (finish func(bool), run bool) {
 	noop := func(bool) {}
-	if template == nil || value == nil || !template.IsOriginScoped() {
+	key, scoped := originScopeKey(template, value)
+	if !scoped {
 		return noop, true
 	}
-	origin := normalize.Origin(value.Input)
-	if origin == "" {
-		return noop, true
-	}
-	key := template.ID + "\x00" + origin + "\x00" + value.CustomIP
 	actual, _ := e.originScoped.LoadOrStore(key, newOriginAttempt())
 	slot := actual.(*originAttempt)

@@ -0,0 +1,156 @@
+package core
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"slices"
+	"strings"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/input/provider"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/contextargs"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
+)
+
+// PlanEntry is one unit of work a scan runs: a template, a cluster of
+// templates sharing one request, or a workflow, on one target.
+type PlanEntry struct {
+	// ID identifies the entry across runs of the same plan.
+	ID string `json:"id"`
+	// Target is empty for self-contained templates, which run once.
+	Target string `json:"target,omitempty"`
+	// IP is the address the target is pinned to, when it is.
+	IP        string   `json:"ip,omitempty"`
+	Templates []string `json:"templates"`
+	Protocol  string   `json:"protocol"`
+	// Requests is what the templates declare, the count -stats starts from.
+	// The scan sends fewer when a request needs a value the target lacks,
+	// such as {{DN}} on an ip.
+	Requests int `json:"requests"`
+	// Cost is Requests weighted by how long one request of the protocol
+	// takes, in http requests.
+	Cost int `json:"cost"`
+	// Dynamic marks entries whose requests depend on responses: workflows
+	// (only the root is counted), flows and fuzzing.
+	Dynamic bool `json:"dynamic,omitempty"`
+	// AlternativeTo is the id of an entry running the same origin-scoped
+	// template on the same origin. Workers race for an origin, so the scan
+	// runs whichever of the group claims it first, and another only when
+	// that run fails. Totals count the group once.
+	AlternativeTo string `json:"alternative-to,omitempty"`
+}
+
+// Plan reports the work ExecuteScanWithOpts would do with the same arguments,
+// without sending anything. It applies the same clustering, per-target
+// profiles and once-per-origin rule, so a pair is listed only if the scan
+// would run it. Later targets of an origin-scoped template are listed as
+// alternatives to the first, since the scan retries them when a run fails.
+func (e *Engine) Plan(templatesList []*templates.Template, target provider.InputProvider, noCluster bool, emit func(PlanEntry)) {
+	finalTemplates, _ := e.clusterTemplates(templatesList, noCluster)
+	// clustering does not keep an order; a plan is diffed and edited, so it does
+	finalTemplates = slices.SortedFunc(slices.Values(finalTemplates), func(a, b *templates.Template) int {
+		return strings.Compare(a.ID, b.ID)
+	})
+
+	var targetBound []*templates.Template
+	for _, template := range finalTemplates {
+		if template.SelfContained {
+			emit(withPlanID(planEntry(template, &contextargs.MetaInput{}, nil)))
+		} else {
+			targetBound = append(targetBound, template)
+		}
+	}
+
+	// entries are emitted as they are planned, so memory does not grow with
+	// the plan; only the first id per origin is kept
+	originIDs := make(map[string]string)
+	target.Iterate(func(value *contextargs.MetaInput) bool {
+		selection := e.selectionFor(value)
+		for _, template := range targetBound {
+			if selection != nil && !template.SelectedBy(selection) {
+				continue
+			}
+			entry := withPlanID(planEntry(template, value, selection))
+			if key, scoped := originScopeKey(template, value); scoped {
+				if id, seen := originIDs[key]; seen {
+					entry.AlternativeTo = id
+				} else {
+					originIDs[key] = entry.ID
+				}
+			}
+			emit(entry)
+		}
+		return true
+	})
+}
+
+func withPlanID(entry PlanEntry) PlanEntry {
+	entry.ID = planEntryID(entry)
+	return entry
+}
+
+// protocolCost is how many http requests one request of a protocol is worth
+// in time. Measured per call against a CDN-fronted site, where an http
+// request took about 15ms: a javascript call adds about 150ms of runtime, a
+// headless page load with waitload took about 1s. Unlisted protocols cost
+// about one round trip, like http.
+var protocolCost = map[types.ProtocolType]int{
+	types.JavascriptProtocol: 10,
+	types.HeadlessProtocol:   60,
+}
+
+func planEntry(template *templates.Template, value *contextargs.MetaInput, selection protocols.TemplateSelection) PlanEntry {
+	entry := PlanEntry{
+		Target:    value.Input,
+		IP:        value.CustomIP,
+		Templates: []string{template.ID},
+		Protocol:  template.Type().String(),
+		Requests:  template.TotalRequests,
+		Dynamic:   template.Flow != "" || template.IsFuzzableRequest(),
+	}
+	weight := func(protocol types.ProtocolType) int { return max(protocolCost[protocol], 1) }
+
+	switch {
+	case template.CompiledWorkflow != nil:
+		// only the root of a workflow is certain to run; subtemplates depend
+		// on what it matches
+		entry.Requests = 0
+		for _, workflow := range template.CompiledWorkflow.Workflows {
+			for _, executer := range workflow.Executers {
+				requests := executer.Executer.Requests()
+				entry.Requests += requests
+				entry.Cost += requests * weight(executer.TemplateType)
+			}
+		}
+		entry.Dynamic = true
+	case isCluster(template):
+		cluster := template.Executer.(*templates.ClusterExecuter)
+		entry.Templates = slices.Sorted(slices.Values(cluster.TemplateIDs(selection)))
+		// TotalRequests of a cluster counts only its http and dns requests,
+		// so an ssl cluster would show none
+		entry.Requests = cluster.Requests()
+		entry.Cost = entry.Requests * weight(template.Type())
+	case len(template.RequestsQueue) > 0:
+		// each block is weighted by its own protocol, so a template mixing
+		// http with javascript is not priced as all http
+		for _, request := range template.RequestsQueue {
+			entry.Cost += request.Requests() * weight(request.Type())
+		}
+	default:
+		entry.Cost = entry.Requests * weight(template.Type())
+	}
+	return entry
+}
+
+func isCluster(template *templates.Template) bool {
+	_, ok := template.Executer.(*templates.ClusterExecuter)
+	return ok
+}
+
+// planEntryID derives the id from what the entry runs, so planning the same
+// scan again yields the same ids.
+func planEntryID(entry PlanEntry) string {
+	sum := sha256.Sum256([]byte(entry.Target + "\x00" + entry.IP + "\x00" + strings.Join(entry.Templates, "\x00")))
+	return hex.EncodeToString(sum[:8])
+}
@@ -0,0 +1,156 @@
+package core
+
+import (
+	"context"
+	"sync"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/contextargs"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/headless"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/http"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
+	tmpltypes "github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPlanEntryCostWeightsByProtocol(t *testing.T) {
+	headless := &templates.Template{ID: "h", RequestsHeadless: []*headless.Request{{}}, TotalRequests: 2}
+	require.Equal(t, 120, planEntry(headless, &contextargs.MetaInput{Input: "t"}, nil).Cost)
+
+	plain := &templates.Template{ID: "p", TotalRequests: 2}
+	require.Equal(t, 2, planEntry(plain, &contextargs.MetaInput{Input: "t"}, nil).Cost, "unlisted protocols cost one request each")
+}
+
+// countedRequest is a request block with a fixed protocol and count.
+type countedRequest struct {
+	protocols.Request
+	protocol tmpltypes.ProtocolType
+	requests int
+}
+
+func (r countedRequest) Type() tmpltypes.ProtocolType { return r.protocol }
+func (r countedRequest) Requests() int                { return r.requests }
+
+func TestPlanEntryWeightsEachProtocolBlock(t *testing.T) {
+	// one http request and ten javascript calls: Type() reports http for the
+	// whole template, which would price it as 11
+	mixed := &templates.Template{
+		ID:            "mixed",
+		RequestsHTTP:  []*http.Request{{}},
+		TotalRequests: 11,
+		RequestsQueue: []protocols.Request{
+			countedRequest{protocol: tmpltypes.HTTPProtocol, requests: 1},
+			countedRequest{protocol: tmpltypes.JavascriptProtocol, requests: 10},
+		},
+	}
+	entry := planEntry(mixed, &contextargs.MetaInput{Input: "t"}, nil)
+	require.Equal(t, 11, entry.Requests)
+	require.Equal(t, 101, entry.Cost)
+}
+
+func TestPlanListsThePairsTheScanRuns(t *testing.T) {
+	options := &types.Options{BulkSize: 2, TemplateThreads: 2, HeadlessBulkSize: 1, HeadlessTemplateThreads: 1}
+	engine := New(options)
+	engine.SetExecuterOptions(&protocols.ExecutorOptions{
+		Logger:       engine.Logger,
+		Options:      options,
+		ResumeCfg:    types.NewResumeCfg(),
+		ProtocolType: tmpltypes.HTTPProtocol,
+		Progress:     &progressRecorder{},
+		TargetScope: scopeByInput{
+			"php":  {paths: []string{"thinkphp.yaml"}},
+			"none": {},
+		},
+	})
+
+	var (
+		mu   sync.Mutex
+		runs []string
+	)
+	var templatesList []*templates.Template
+	for _, path := range []string{"thinkphp.yaml", "generic.yaml"} {
+		templatesList = append(templatesList, &templates.Template{
+			ID:            path,
+			Path:          path,
+			TotalRequests: 3,
+			Executer:      &recordingExecuter{path: path, mu: &mu, runs: &runs},
+		})
+	}
+	selfContained := &templates.Template{ID: "self.yaml", Path: "self.yaml", SelfContained: true, TotalRequests: 1}
+	targets := &fakeTargetProvider{values: []*contextargs.MetaInput{{Input: "php"}, {Input: "none"}, {Input: "plain"}}}
+
+	var plan []PlanEntry
+	engine.Plan(append(templatesList, selfContained), targets, true, func(entry PlanEntry) { plan = append(plan, entry) })
+
+	require.Empty(t, plan[0].Target, "a self-contained template runs once, with no target")
+	require.Equal(t, []string{"self.yaml"}, plan[0].Templates)
+	var planned []string
+	ids := make(map[string]struct{})
+	for _, entry := range plan[1:] {
+		require.Equal(t, 3, entry.Requests)
+		planned = append(planned, entry.Templates[0]+"@"+entry.Target)
+		ids[entry.ID] = struct{}{}
+	}
+	require.Len(t, ids, len(plan)-1, "every entry has its own id")
+
+	var again []PlanEntry
+	engine.Plan(append(templatesList, selfContained), targets, true, func(entry PlanEntry) { again = append(again, entry) })
+	require.Equal(t, plan, again, "planning the same scan again yields the same entries and ids")
+
+	engine.ExecuteScanWithOpts(context.Background(), templatesList, targets, true)
+	require.ElementsMatch(t, runs, planned, "the plan lists exactly the pairs the scan runs")
+	require.ElementsMatch(t, []string{"thinkphp.yaml@php", "thinkphp.yaml@plain", "generic.yaml@plain"}, planned)
+}
+
+func TestPlanListsOriginAlternatives(t *testing.T) {
+	options := &types.Options{BulkSize: 1, TemplateThreads: 1, HeadlessBulkSize: 1, HeadlessTemplateThreads: 1}
+	engine := New(options)
+	engine.SetExecuterOptions(&protocols.ExecutorOptions{
+		Logger:       engine.Logger,
+		Options:      options,
+		ResumeCfg:    types.NewResumeCfg(),
+		ProtocolType: tmpltypes.HTTPProtocol,
+		Progress:     &progressRecorder{},
+	})
+
+	root := &templates.Template{
+		ID:            "root.yaml",
+		RequestsHTTP:  []*http.Request{{Path: []string{"{{RootURL}}/health"}}},
+		TotalRequests: 1,
+	}
+	require.True(t, root.IsOriginScoped())
+	generic := &templates.Template{ID: "generic.yaml", TotalRequests: 1}
+	targets := &fakeTargetProvider{values: []*contextargs.MetaInput{
+		{Input: "https://example.com/a"},
+		{Input: "https://example.com/b"},
+		{Input: "https://other.example/a"},
+		{Input: "https://example.com/a", CustomIP: "203.0.113.5"},
+	}}
+
+	var plan []PlanEntry
+	engine.Plan([]*templates.Template{generic, root}, targets, true, func(entry PlanEntry) {
+		plan = append(plan, entry)
+	})
+
+	var roots []PlanEntry
+	for _, entry := range plan {
+		if entry.Templates[0] == "root.yaml" {
+			roots = append(roots, entry)
+		}
+	}
+	require.Equal(t, []PlanEntry{
+		{ID: roots[0].ID, Target: "https://example.com/a", Templates: []string{"root.yaml"}, Protocol: "http", Requests: 1, Cost: 1},
+		{ID: roots[1].ID, Target: "https://example.com/b", Templates: []string{"root.yaml"}, Protocol: "http", Requests: 1, Cost: 1, AlternativeTo: roots[0].ID},
+		{ID: roots[2].ID, Target: "https://other.example/a", Templates: []string{"root.yaml"}, Protocol: "http", Requests: 1, Cost: 1},
+		{ID: roots[3].ID, Target: "https://example.com/a", IP: "203.0.113.5", Templates: []string{"root.yaml"}, Protocol: "http", Requests: 1, Cost: 1},
+	}, roots)
+	require.NotEqual(t, roots[0].ID, roots[3].ID, "a pinned address is its own attempt")
+
+	var again []PlanEntry
+	engine.Plan([]*templates.Template{generic, root}, targets, true, func(entry PlanEntry) {
+		again = append(again, entry)
+	})
+	require.Equal(t, plan, again)
+}
@@ -1,8 +1,10 @@
 package dns

 import (
+	"context"
 	"net"
 	"strings"
+	"time"

 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
@@ -16,6 +18,7 @@ import (
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/replacer"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/dns/dnsclientpool"
 	fileutil "github.com/projectdiscovery/utils/file"
+	iputil "github.com/projectdiscovery/utils/ip"
 )

 // Request contains a DNS protocol request to be made from a template
@@ -204,6 +207,48 @@ func resolverHost(resolver string) string {
 	return r
 }

+// pinResolverHost replaces a resolver host name with an address that the
+// network policy allows. The policy check passes when one address of the name
+// is allowed, and the dns client resolves the name again when it dials, so it
+// could otherwise reach a denied address of the same name.
+// The lookup stops after timeout, so a slow system resolver cannot hold the
+// request.
+func pinResolverHost(executionID, resolver, host string, timeout time.Duration) (string, error) {
+	// DoH and DoT resolvers dial through the scan dialer, which checks every
+	// address, and DoT verifies the certificate against the name.
+	if iputil.IsIP(host) || strings.HasPrefix(resolver, "doh:") || strings.HasPrefix(resolver, "dot:") {
+		return resolver, nil
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	addrs, err := net.DefaultResolver.LookupHost(ctx, host)
+	if err != nil {
+		return "", errors.Wrapf(err, "could not resolve dns resolver %s", resolver)
+	}
+	prefix, address := resolver, ""
+	if index := strings.LastIndex(resolver, host); index != -1 {
+		prefix, address = resolver[:index], resolver[index:]
+	}
+	port := "53"
+	if _, p, err := net.SplitHostPort(address); err == nil && p != "" {
+		port = p
+	}
+	for _, addr := range addrs {
+		if protocolstate.IsHostAllowed(executionID, addr) {
+			return prefix + net.JoinHostPort(addr, port), nil
+		}
+	}
+	return "", errors.Errorf("dns resolver %s is blocked by network policy", resolver)
+}
+
+// resolverLookupTimeout is the scan timeout, or ten seconds when it is not set.
+func resolverLookupTimeout(options *protocols.ExecutorOptions) time.Duration {
+	if options.Options.Timeout > 0 {
+		return time.Duration(options.Options.Timeout) * time.Second
+	}
+	return 10 * time.Second
+}
+
 func (request *Request) getDnsClient(options *protocols.ExecutorOptions, metadata map[string]interface{}) (*dnsclientpool.Client, error) {
 	dnsClientOptions := &dnsclientpool.Configuration{
 		Retries: request.Retries,
@@ -237,6 +282,11 @@ func (request *Request) getDnsClient(options *protocols.ExecutorOptions, metadat
 				if !protocolstate.IsHostAllowed(options.Options.ExecutionId, host) {
 					return nil, errors.Errorf("dns resolver %s is blocked by network policy", resolver)
 				}
+				pinned, err := pinResolverHost(options.Options.ExecutionId, resolver, host, resolverLookupTimeout(options))
+				if err != nil {
+					return nil, err
+				}
+				resolver = pinned
 			}
 			resolvers = append(resolvers, resolver)
 		}
@@ -93,7 +93,7 @@ func Get(options *types.Options, configuration *Configuration) (*Client, error)
 	if (configuration.Retries <= 1) && len(configuration.Resolvers) == 0 {
 		return cachedClient(resolversFor(options))
 	}
-	if len(options.InternalResolversList) == 0 && hasDohResolver(configuration.Resolvers) {
+	if len(options.InternalResolversList) == 0 && hasPolicyResolver(configuration.Resolvers) {
 		return getPolicyClient(options, configuration)
 	}
 	hash := configuration.Hash()
@@ -3,12 +3,14 @@ package dnsclientpool
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"net"
 	"net/http"
 	"strings"
 	"sync"
 	"sync/atomic"
+	"time"

 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
@@ -19,8 +21,8 @@ import (
 )

 // Client sends the DNS queries of a template. It sends queries for template
-// DoH resolvers itself, because the retryabledns DoH client dials and follows
-// redirects without the network policy of the scan.
+// DoH and DoT resolvers itself, because the retryabledns clients dial and
+// follow redirects without the network policy of the scan.
 type Client struct {
 	*retryabledns.Client

@@ -29,31 +31,51 @@ type Client struct {
 	index     uint32
 	doh       *doh.Client
 	transport *http.Transport
+	dial      func(ctx context.Context, network, address string) (net.Conn, error)
+	timeout   time.Duration
 }

-// resolver is one template resolver. url is empty for a resolver that
-// retryabledns queries over UDP, TCP or DoT.
+// resolver is one template resolver. url is set for a DoH resolver and dot
+// for a DoT resolver, and both are empty for a resolver that retryabledns
+// queries over UDP or TCP.
 type resolver struct {
 	url    string
 	method doh.Method
+	dot    string
 }

 var (
-	// policyClients holds the clients with DoH resolvers of each execution,
+	// policyClients holds the clients with DoH or DoT resolvers of each execution,
 	// because each one dials with the dialer of its execution.
 	policyClients = map[string]map[string]*Client{}
 	policyMu      sync.Mutex
+
+	// dotRootCAs verifies DoT certificates, and nil uses the system roots.
+	dotRootCAs *x509.CertPool
 )

-func hasDohResolver(resolvers []string) bool {
+func hasPolicyResolver(resolvers []string) bool {
 	for _, r := range resolvers {
-		if strings.HasPrefix(r, "doh:") {
+		if strings.HasPrefix(r, "doh:") || strings.HasPrefix(r, "dot:") {
 			return true
 		}
 	}
 	return false
 }

+// parseDotResolver returns the host and port of a resolver such as
+// dot:dns.example or dot:dns.example:853, in the same way as retryabledns.
+func parseDotResolver(r string) (resolver, bool) {
+	if !strings.HasPrefix(r, "dot:") {
+		return resolver{}, false
+	}
+	address := strings.TrimPrefix(r, "dot:")
+	if _, _, err := net.SplitHostPort(address); err != nil {
+		address = net.JoinHostPort(address, "853")
+	}
+	return resolver{dot: address}, true
+}
+
 // parseDohResolver returns the URL and method of a resolver such as
 // doh:https://dns.example/dns-query:get, in the same way as retryabledns.
 func parseDohResolver(r string) (resolver, bool) {
@@ -91,10 +113,14 @@ func getPolicyClient(options *types.Options, configuration *Configuration) (*Cli
 			client.resolvers = append(client.resolvers, parsed)
 			continue
 		}
+		if parsed, ok := parseDotResolver(r); ok {
+			client.resolvers = append(client.resolvers, parsed)
+			continue
+		}
 		client.resolvers = append(client.resolvers, resolver{})
 		networkResolvers = append(networkResolvers, r)
 	}
-	// Trace and the non DoH resolvers still go through retryabledns.
+	// Trace and the UDP and TCP resolvers still go through retryabledns.
 	if len(networkResolvers) == 0 {
 		networkResolvers = defaultResolvers
 	}
@@ -111,14 +137,16 @@ func getPolicyClient(options *types.Options, configuration *Configuration) (*Cli
 	// The scan dialer checks every address it connects to, so redirects
 	// and names that resolve to a denied address are refused too. It also
 	// goes through the scan proxy when one is set.
+	client.dial = func(ctx context.Context, network, address string) (net.Conn, error) {
+		dialers := protocolstate.GetDialersWithId(executionID)
+		if dialers == nil || dialers.Fastdialer == nil {
+			return nil, fmt.Errorf("dialers not initialized for %s", executionID)
+		}
+		return dialers.Fastdialer.Dial(ctx, network, address)
+	}
+	client.timeout = options.GetTimeouts().DialTimeout
 	client.transport = &http.Transport{
-		DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
-			dialers := protocolstate.GetDialersWithId(executionID)
-			if dialers == nil || dialers.Fastdialer == nil {
-				return nil, fmt.Errorf("dialers not initialized for %s", executionID)
-			}
-			return dialers.Fastdialer.Dial(ctx, network, address)
-		},
+		DialContext: client.dial,
 		// same as the retryabledns DoH client
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec G402
 	}
@@ -149,6 +177,8 @@ func (c *Client) Do(msg *dns.Msg) (*dns.Msg, error) {
 		r := c.resolvers[index%uint32(len(c.resolvers))]
 		if r.url != "" {
 			resp, err = c.doh.QueryWithDOHMsg(r.method, doh.Resolver{URL: r.url}, msg)
+		} else if r.dot != "" {
+			resp, err = c.queryDoT(r.dot, msg)
 		} else {
 			resp, err = c.Client.Do(msg)
 		}
@@ -159,7 +189,35 @@ func (c *Client) Do(msg *dns.Msg) (*dns.Msg, error) {
 	return resp, retryabledns.ErrRetriesExceeded
 }

-// Close drops the clients with DoH resolvers of an execution.
+// queryDoT sends a DNS message over TLS to address. It dials through the scan
+// dialer and verifies the certificate against the resolver host, as the
+// retryabledns DoT client does.
+func (c *Client) queryDoT(address string, msg *dns.Msg) (*dns.Msg, error) {
+	host, _, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, err
+	}
+	timeout := c.timeout
+	if timeout <= 0 {
+		timeout = retryabledns.DefaultOptions.Timeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	conn, err := c.dial(ctx, "tcp", address)
+	if err != nil {
+		return nil, err
+	}
+	tlsConn := tls.Client(conn, &tls.Config{ServerName: host, RootCAs: dotRootCAs, MinVersion: tls.VersionTLS12})
+	defer func() { _ = tlsConn.Close() }()
+	if err := tlsConn.HandshakeContext(ctx); err != nil {
+		return nil, err
+	}
+	dnsClient := &dns.Client{Net: "tcp-tls", Timeout: timeout}
+	resp, _, err := dnsClient.ExchangeWithConn(msg, &dns.Conn{Conn: tlsConn})
+	return resp, err
+}
+
+// Close drops the clients with DoH or DoT resolvers of an execution.
 func Close(executionID string) {
 	policyMu.Lock()
 	clients := policyClients[executionID]
@@ -0,0 +1,91 @@
+package dnsclientpool
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/require"
+)
+
+// newDotListener accepts TCP connections on 127.0.0.1, counts them and closes
+// them, so a test sees each DoT dial that reaches the address.
+func newDotListener(t *testing.T, hits *atomic.Int32) string {
+	t.Helper()
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = l.Close() })
+	go func() {
+		for {
+			conn, err := l.Accept()
+			if err != nil {
+				return
+			}
+			hits.Add(1)
+			_ = conn.Close()
+		}
+	}()
+	_, port, err := net.SplitHostPort(l.Addr().String())
+	require.NoError(t, err)
+	return port
+}
+
+func TestDotResolverObeysNetworkPolicy(t *testing.T) {
+	for _, host := range []string{"127.0.0.1", "localhost"} {
+		t.Run("denied address "+host, func(t *testing.T) {
+			var hits atomic.Int32
+			port := newDotListener(t, &hits)
+			// localhost passes the resolver check through ::1, while 127.0.0.1 is denied
+			options := dohOptions(t, []string{"127.0.0.1"})
+
+			client, err := Get(options, &Configuration{Retries: 2, Resolvers: []string{"dot:" + net.JoinHostPort(host, port)}})
+			require.NoError(t, err)
+			_, _ = client.Do(txtQuery())
+			require.Zero(t, hits.Load(), "DoT query reached a denied address")
+		})
+	}
+
+	t.Run("allowed address", func(t *testing.T) {
+		var hits atomic.Int32
+		port := newDotListener(t, &hits)
+		options := dohOptions(t, nil)
+
+		client, err := Get(options, &Configuration{Retries: 1, Resolvers: []string{"dot:127.0.0.1:" + port}})
+		require.NoError(t, err)
+		_, _ = client.Do(txtQuery())
+		require.Equal(t, int32(1), hits.Load())
+	})
+}
+
+func TestDotResolverAnswers(t *testing.T) {
+	// httptest gives a certificate for 127.0.0.1 and a pool that trusts it.
+	certs := httptest.NewTLSServer(http.NotFoundHandler())
+	t.Cleanup(certs.Close)
+	previous := dotRootCAs
+	dotRootCAs = certs.Client().Transport.(*http.Transport).TLSClientConfig.RootCAs
+	t.Cleanup(func() { dotRootCAs = previous })
+
+	l, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{Certificates: certs.TLS.Certificates, MinVersion: tls.VersionTLS12})
+	require.NoError(t, err)
+	server := &dns.Server{Listener: l, Net: "tcp-tls", Handler: dns.HandlerFunc(func(w dns.ResponseWriter, q *dns.Msg) {
+		m := new(dns.Msg)
+		m.SetReply(q)
+		rr, _ := dns.NewRR(`example.com. 60 IN TXT "dot-answer"`)
+		m.Answer = append(m.Answer, rr)
+		_ = w.WriteMsg(m)
+	})}
+	go func() { _ = server.ActivateAndServe() }()
+	t.Cleanup(func() { _ = server.Shutdown() })
+
+	options := dohOptions(t, nil)
+	client, err := Get(options, &Configuration{Retries: 2, Resolvers: []string{"dot:" + l.Addr().String()}})
+	require.NoError(t, err)
+	resp, err := client.Do(txtQuery())
+	require.NoError(t, err)
+	require.Len(t, resp.Answer, 1)
+	require.Contains(t, resp.Answer[0].String(), "dot-answer")
+}
@@ -195,7 +195,7 @@ func (request *Request) execute(input *contextargs.Context, domain string, metad
 	// perform trace if necessary (excluded from duration — only the query RTT is measured)
 	var traceData *retryabledns.TraceData
 	if request.Trace {
-		traceData, err = request.dnsClient.Trace(domain, request.question, request.TraceMaxRecursion)
+		traceData, err = trace(request.options.Options.ExecutionId, request.dnsClient, domain, request.question, request.TraceMaxRecursion)
 		if err != nil {
 			request.options.Output.Request(request.options.TemplatePath, domain, "dns", err)
 		}
@@ -0,0 +1,119 @@
+package dns
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/require"
+
+	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
+	"github.com/projectdiscovery/nuclei/v3/pkg/model"
+	"github.com/projectdiscovery/nuclei/v3/pkg/model/types/severity"
+)
+
+// startDNSServer answers every query with a TXT record, or with the A records
+// in addrs when the question is for name, and counts the queries.
+func startDNSServer(t *testing.T, name string, addrs []string, hits *atomic.Int32) string {
+	t.Helper()
+	pc, err := net.ListenPacket("udp", "127.0.0.1:0")
+	require.NoError(t, err)
+	server := &dns.Server{PacketConn: pc, Handler: dns.HandlerFunc(func(w dns.ResponseWriter, q *dns.Msg) {
+		hits.Add(1)
+		m := new(dns.Msg)
+		m.SetReply(q)
+		question := q.Question[0]
+		switch {
+		case question.Name == name && question.Qtype == dns.TypeA:
+			for _, addr := range addrs {
+				rr, _ := dns.NewRR(name + " 0 IN A " + addr)
+				m.Answer = append(m.Answer, rr)
+			}
+		case question.Name == name:
+		default:
+			rr, _ := dns.NewRR(question.Name + ` 0 IN TXT "answer"`)
+			m.Answer = append(m.Answer, rr)
+		}
+		_ = w.WriteMsg(m)
+	})}
+	go func() { _ = server.ActivateAndServe() }()
+	t.Cleanup(func() { _ = server.Shutdown() })
+	l, err := net.Listen("tcp", pc.LocalAddr().String())
+	require.NoError(t, err)
+	tcpServer := &dns.Server{Listener: l, Handler: server.Handler}
+	go func() { _ = tcpServer.ActivateAndServe() }()
+	t.Cleanup(func() { _ = tcpServer.Shutdown() })
+	return pc.LocalAddr().String()
+}
+
+// useSystemResolver sends the lookups of the process to the DNS server at address.
+func useSystemResolver(t *testing.T, address string) {
+	t.Helper()
+	previous := net.DefaultResolver
+	net.DefaultResolver = &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, network, _ string) (net.Conn, error) {
+			var d net.Dialer
+			return d.DialContext(ctx, "udp", address)
+		},
+	}
+	t.Cleanup(func() { net.DefaultResolver = previous })
+}
+
+func TestDNSResolverNameObeysNetworkPolicy(t *testing.T) {
+	// The resolver name has an allowed address and a denied address. The
+	// policy check passes because one address is allowed, so the query must
+	// not go to the denied one.
+	var deniedHits, systemHits atomic.Int32
+	denied := startDNSServer(t, "", nil, &deniedHits)
+	_, port, err := net.SplitHostPort(denied)
+	require.NoError(t, err)
+	system := startDNSServer(t, "resolver.nuclei-test.", []string{"127.0.0.1", "127.0.0.2"}, &systemHits)
+	useSystemResolver(t, system)
+
+	options := testutils.DefaultOptions.Copy()
+	options.SetExecutionID(t.Name())
+	options.ExcludeTargets = []string{"127.0.0.1"}
+	testutils.Init(options)
+	t.Cleanup(func() { testutils.Cleanup(options) })
+	executerOpts := testutils.NewMockExecuterOptions(options, &testutils.TemplateInfo{
+		ID:   "dns-resolver-policy",
+		Info: model.Info{SeverityHolder: severity.Holder{Severity: severity.Info}, Name: "test"},
+	})
+
+	for _, resolver := range []string{"resolver.nuclei-test:" + port, "tcp:resolver.nuclei-test:" + port} {
+		t.Run(resolver, func(t *testing.T) {
+			deniedHits.Store(0)
+			request := &Request{
+				RequestType: DNSRequestTypeHolder{DNSRequestType: TXT},
+				Class:       "INET",
+				Retries:     2,
+				Name:        "{{FQDN}}",
+				Resolvers:   []string{resolver},
+			}
+			require.NoError(t, request.Compile(executerOpts))
+
+			msg := new(dns.Msg)
+			msg.SetQuestion("example.com.", dns.TypeTXT)
+			_, _ = request.dnsClient.Do(msg)
+			require.Zero(t, deniedHits.Load(), "dns query reached a denied address")
+		})
+	}
+}
+
+func TestDNSResolverNameLookupStopsAtTimeout(t *testing.T) {
+	// The system resolver never answers, so the lookup that pins the resolver
+	// name must stop at the timeout.
+	silent, err := net.ListenPacket("udp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = silent.Close() })
+	useSystemResolver(t, silent.LocalAddr().String())
+
+	start := time.Now()
+	_, err = pinResolverHost(t.Name(), "silent.nuclei-test:53", "silent.nuclei-test", time.Second)
+	require.Error(t, err)
+	require.Less(t, time.Since(start), 4*time.Second, "the resolver lookup did not stop at the timeout")
+}
@@ -0,0 +1,88 @@
+package dns
+
+import (
+	"context"
+	"math/rand"
+	"net"
+
+	"github.com/miekg/dns"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/dns/dnsclientpool"
+	"github.com/projectdiscovery/retryabledns"
+	sliceutil "github.com/projectdiscovery/utils/slice"
+)
+
+// traceNameServerPort is the port of the name servers that a trace queries.
+var traceNameServerPort = "53"
+
+// trace follows the delegation of host from the root servers in the same way
+// as retryabledns.Client.Trace, but it skips name server addresses that the
+// network policy denies. The name servers come from the answers, so the owner
+// of a zone could otherwise send the queries of a trace to internal addresses.
+func trace(executionID string, client *dnsclientpool.Client, host string, requestType uint16, maxRecursion int) (*retryabledns.TraceData, error) {
+	var traceData retryabledns.TraceData
+	host = dns.CanonicalName(host)
+	servers := retryabledns.RootDNSServersIPv4
+	seenNS := make(map[string]struct{})
+	seenCName := make(map[string]int)
+	for i := 1; i < maxRecursion; i++ {
+		responses, err := client.QueryParallel(host, requestType, servers)
+		if err != nil {
+			return nil, err
+		}
+		for _, server := range servers {
+			seenNS[server] = struct{}{}
+		}
+		if len(responses) == 0 {
+			return &traceData, nil
+		}
+		for _, dnsData := range responses {
+			if dnsData != nil && len(dnsData.Resolver) > 0 {
+				traceData.DNSData = append(traceData.DNSData, dnsData)
+			}
+		}
+
+		var nameServers []string
+		var nextCname string
+		for _, dnsData := range responses {
+			if dnsData == nil {
+				continue
+			}
+			for _, ns := range dnsData.NS {
+				ips, err := net.DefaultResolver.LookupIP(context.Background(), "ip4", ns)
+				if err != nil {
+					continue
+				}
+				for _, ip := range ips {
+					if !protocolstate.IsHostAllowed(executionID, ip.String()) {
+						continue
+					}
+					nameServers = append(nameServers, net.JoinHostPort(ip.String(), traceNameServerPort))
+				}
+			}
+			if nextCname == "" && len(dnsData.CNAME) > 0 {
+				nextCname = dnsData.CNAME[0]
+			}
+		}
+		nameServers = sliceutil.Dedupe(nameServers)
+		if len(nameServers) == 0 {
+			break
+		}
+
+		server := nameServers[rand.Intn(len(nameServers))] // #nosec G404
+		if _, ok := seenNS[server]; ok && nextCname == "" {
+			break
+		}
+		servers = []string{server}
+
+		if nextCname != "" {
+			seenCName[nextCname]++
+			if seenCName[nextCname] > retryabledns.DefaultMaxPerCNAMEFollows {
+				break
+			}
+			host = nextCname
+		}
+	}
+	return &traceData, nil
+}
@@ -0,0 +1,124 @@
+package dns
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/require"
+
+	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
+	"github.com/projectdiscovery/nuclei/v3/pkg/model"
+	"github.com/projectdiscovery/nuclei/v3/pkg/model/types/severity"
+	"github.com/projectdiscovery/nuclei/v3/pkg/output"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/contextargs"
+	"github.com/projectdiscovery/retryabledns"
+)
+
+func serveTraceDNS(t *testing.T, address string, handler dns.HandlerFunc) string {
+	t.Helper()
+	pc, err := net.ListenPacket("udp", address)
+	require.NoError(t, err)
+	server := &dns.Server{PacketConn: pc, Handler: handler}
+	go func() { _ = server.ActivateAndServe() }()
+	t.Cleanup(func() { _ = server.Shutdown() })
+	return pc.LocalAddr().String()
+}
+
+func TestDNSTraceObeysNetworkPolicy(t *testing.T) {
+	// The zone of the traced name delegates to a name server on 127.0.0.1.
+	// The trace must query it when the policy allows the address, so that the
+	// test can see a trace that ignores the policy, and must skip it when the
+	// policy denies the address.
+	t.Run("allowed", func(t *testing.T) {
+		require.NotZero(t, runTraceAgainstLoopbackNameServer(t, nil), "trace did not query the allowed name server")
+	})
+	t.Run("denied", func(t *testing.T) {
+		require.Zero(t, runTraceAgainstLoopbackNameServer(t, []string{"127.0.0.1"}), "trace queried a denied name server")
+	})
+}
+
+func runTraceAgainstLoopbackNameServer(t *testing.T, excludeTargets []string) int32 {
+	t.Helper()
+	var internalHits atomic.Int32
+	internal := serveTraceDNS(t, "127.0.0.1:0", func(w dns.ResponseWriter, q *dns.Msg) {
+		internalHits.Add(1)
+		m := new(dns.Msg)
+		m.SetReply(q)
+		rr, _ := dns.NewRR(q.Question[0].Name + ` 0 IN TXT "internal"`)
+		m.Answer = append(m.Answer, rr)
+		_ = w.WriteMsg(m)
+	})
+	_, port, err := net.SplitHostPort(internal)
+	require.NoError(t, err)
+	previousPort := traceNameServerPort
+	traceNameServerPort = port
+	t.Cleanup(func() { traceNameServerPort = previousPort })
+
+	// public stands in for the root servers, the scan resolvers and the system resolver
+	public := serveTraceDNS(t, "127.0.0.1:0", func(w dns.ResponseWriter, q *dns.Msg) {
+		m := new(dns.Msg)
+		m.SetReply(q)
+		question := q.Question[0]
+		var rr dns.RR
+		switch {
+		case question.Name == "ns.nuclei-test." && question.Qtype == dns.TypeA:
+			rr, _ = dns.NewRR("ns.nuclei-test. 0 IN A 127.0.0.1")
+		case question.Name == "ns.nuclei-test.":
+		case question.Name == "trace.nuclei-test.":
+			rr, _ = dns.NewRR("trace.nuclei-test. 0 IN NS ns.nuclei-test.")
+		default:
+			rr, _ = dns.NewRR(question.Name + ` 0 IN TXT "public"`)
+		}
+		if rr != nil {
+			m.Answer = append(m.Answer, rr)
+		}
+		_ = w.WriteMsg(m)
+	})
+	previousRoots := retryabledns.RootDNSServersIPv4
+	retryabledns.RootDNSServersIPv4 = []string{public}
+	t.Cleanup(func() { retryabledns.RootDNSServersIPv4 = previousRoots })
+	previousResolver := net.DefaultResolver
+	net.DefaultResolver = &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, network, _ string) (net.Conn, error) {
+			var d net.Dialer
+			return d.DialContext(ctx, "udp", public)
+		},
+	}
+	t.Cleanup(func() { net.DefaultResolver = previousResolver })
+
+	options := testutils.DefaultOptions.Copy()
+	options.SetExecutionID(t.Name())
+	options.ExcludeTargets = excludeTargets
+	options.InternalResolversList = []string{public}
+	testutils.Init(options)
+	t.Cleanup(func() { testutils.Cleanup(options) })
+	executerOpts := testutils.NewMockExecuterOptions(options, &testutils.TemplateInfo{
+		ID:   "dns-trace-policy",
+		Info: model.Info{SeverityHolder: severity.Holder{Severity: severity.Info}, Name: "test"},
+	})
+
+	request := &Request{
+		RequestType: DNSRequestTypeHolder{DNSRequestType: TXT},
+		Class:       "INET",
+		Name:        "{{FQDN}}",
+		// One retry keeps the client keyed by this test's resolvers, so a
+		// client cached by an earlier run cannot point at a closed server.
+		Retries:           1,
+		Trace:             true,
+		TraceMaxRecursion: 5,
+	}
+	require.NoError(t, request.Compile(executerOpts))
+
+	var event output.InternalEvent
+	input := contextargs.NewWithInput(context.Background(), "trace.nuclei-test")
+	err = request.ExecuteWithResults(input, nil, nil, func(e *output.InternalWrappedEvent) {
+		event = e.InternalEvent
+	})
+	require.NoError(t, err)
+	require.Contains(t, event["trace"], "ns.nuclei-test", "trace did not query the root servers")
+	return internalHits.Load()
+}
@@ -23,6 +23,7 @@ import (
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/generators"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/helpers/eventcreator"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/helpers/responsehighlighter"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/render"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/utils/vardump"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/network/networkclientpool"
@@ -34,6 +35,7 @@ import (
 	"github.com/projectdiscovery/tlsx/pkg/tlsx/clients"
 	"github.com/projectdiscovery/tlsx/pkg/tlsx/openssl"
 	"github.com/projectdiscovery/utils/errkit"
+	iputil "github.com/projectdiscovery/utils/ip"
 	stringsutil "github.com/projectdiscovery/utils/strings"
 )

@@ -202,6 +204,21 @@ func (request *Request) GetID() string {
 	return request.ID
 }

+// allowedAddress returns the first address of host that the network policy allows.
+func (request *Request) allowedAddress(host string) (string, error) {
+	dnsData, err := request.dialer.GetDNSData(host)
+	if err != nil {
+		return "", err
+	}
+	addresses := append(append([]string{}, dnsData.A...), dnsData.AAAA...)
+	for _, address := range addresses {
+		if protocolstate.IsHostAllowed(request.options.Options.ExecutionId, address) {
+			return address, nil
+		}
+	}
+	return "", protocolstate.ErrHostDenied.Msgf(host)
+}
+
 // ExecuteWithResults executes the protocol requests and returns results instead of writing them.
 func (request *Request) ExecuteWithResults(input *contextargs.Context, dynamicValues, previous output.InternalEvent, callback protocols.OutputEventCallback) error {
 	hostPort := input.MetaInput.Input
@@ -255,6 +272,23 @@ func (request *Request) ExecuteWithResults(input *contextargs.Context, dynamicVa
 	} else {
 		hostIp = host
 	}
+	if !iputil.IsIP(hostIp) {
+		// The openssl scan mode runs the openssl binary, which resolves a host
+		// name again by itself, so it gets an address the policy allows.
+		address, err := request.allowedAddress(hostIp)
+		if err != nil {
+			requestOptions.Output.Request(requestOptions.TemplateID, input.MetaInput.Input, request.Type().String(), err)
+			requestOptions.Progress.IncrementFailedRequestsBy(1)
+			return errkit.Wrap(err, "could not resolve host")
+		}
+		hostIp = address
+	} else if !protocolstate.IsHostAllowed(request.options.Options.ExecutionId, hostIp) {
+		// A custom dialer can allow an address that the execution policy denies.
+		err := protocolstate.ErrHostDenied.Msgf(hostIp)
+		requestOptions.Output.Request(requestOptions.TemplateID, input.MetaInput.Input, request.Type().String(), err)
+		requestOptions.Progress.IncrementFailedRequestsBy(1)
+		return err
+	}

 	if err := request.options.HostBackoffWait(input.Context(), addressToDial); err != nil {
 		return err
@@ -0,0 +1,179 @@
+package ssl
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"math/big"
+	"net"
+	"slices"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/projectdiscovery/fastdialer/fastdialer"
+	"github.com/stretchr/testify/require"
+
+	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
+	"github.com/projectdiscovery/nuclei/v3/pkg/output"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/contextargs"
+	"github.com/projectdiscovery/tlsx/pkg/tlsx/openssl"
+)
+
+func selfSignedCertificate(t *testing.T, name string) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: name},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	require.NoError(t, err)
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
+
+// serveTLS counts the TLS handshakes that reach address.
+func serveTLS(t *testing.T, address, name string, handshakes *atomic.Int32) string {
+	t.Helper()
+	listener, err := tls.Listen("tcp", address, &tls.Config{Certificates: []tls.Certificate{selfSignedCertificate(t, name)}})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			go func() {
+				defer func() { _ = conn.Close() }()
+				_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
+				if conn.(*tls.Conn).Handshake() == nil {
+					handshakes.Add(1)
+				}
+			}()
+		}
+	}()
+	return listener.Addr().String()
+}
+
+func TestSSLOpenSSLObeysNetworkPolicy(t *testing.T) {
+	if !openssl.IsAvailable() {
+		t.Skip("openssl binary is not installed")
+	}
+	addrs, err := net.LookupHost("localhost")
+	if err != nil || len(addrs) < 2 {
+		t.Skip("localhost does not resolve to both loopback addresses")
+	}
+
+	// The policy allows 127.0.0.1 and denies ::1, so localhost passes the
+	// dial check. The openssl binary must not connect to ::1.
+	var allowedHandshakes, deniedHandshakes atomic.Int32
+	allowed := serveTLS(t, "127.0.0.1:0", "allowed", &allowedHandshakes)
+	_, port, err := net.SplitHostPort(allowed)
+	require.NoError(t, err)
+	serveTLS(t, net.JoinHostPort("::1", port), "denied", &deniedHandshakes)
+
+	options := testutils.DefaultOptions.Copy()
+	options.SetExecutionID(t.Name())
+	options.ExcludeTargets = []string{"::1"}
+	testutils.Init(options)
+	t.Cleanup(func() { testutils.Cleanup(options) })
+	executerOpts := testutils.NewMockExecuterOptions(options, &testutils.TemplateInfo{ID: "ssl-openssl-policy"})
+	executerOpts.IsMultiProtocol = true
+
+	request := &Request{ID: "ssl-openssl-policy", Address: "{{Host}}:{{Port}}", ScanMode: "openssl"}
+	require.NoError(t, request.Compile(executerOpts))
+	// The scan resolves names with the fastdialer, not the system resolver. On
+	// Windows the hosts file has no localhost entry, so the name does not resolve.
+	if !resolvesToBothLoopbacks(request) {
+		t.Skip("the scan dialer does not resolve localhost to both loopback addresses")
+	}
+
+	var event output.InternalEvent
+	input := contextargs.NewWithInput(context.Background(), net.JoinHostPort("localhost", port))
+	err = request.ExecuteWithResults(input, nil, nil, func(e *output.InternalWrappedEvent) {
+		event = e.InternalEvent
+	})
+	require.NoError(t, err)
+	require.Equal(t, "allowed", event["subject_cn"])
+	require.Zero(t, deniedHandshakes.Load(), "openssl connected to a denied address")
+}
+
+func resolvesToBothLoopbacks(request *Request) bool {
+	data, err := request.dialer.GetDNSData("localhost")
+	if err != nil {
+		return false
+	}
+	return slices.Contains(data.A, "127.0.0.1") && slices.Contains(data.AAAA, "::1")
+}
+
+func TestSSLOpenSSLLiteralIPObeysExecutionPolicy(t *testing.T) {
+	if !openssl.IsAvailable() {
+		t.Skip("openssl binary is not installed")
+	}
+
+	// The input pins ::1 as its custom ip, and a custom dialer with no deny
+	// list would connect to it. The execution policy denies it, so the openssl
+	// binary must not connect to it.
+	var deniedHandshakes atomic.Int32
+	denied := serveTLS(t, "[::1]:0", "denied", &deniedHandshakes)
+	_, port, err := net.SplitHostPort(denied)
+	require.NoError(t, err)
+
+	options := testutils.DefaultOptions.Copy()
+	options.SetExecutionID(t.Name())
+	options.ExcludeTargets = []string{"::1"}
+	testutils.Init(options)
+	t.Cleanup(func() { testutils.Cleanup(options) })
+	executerOpts := testutils.NewMockExecuterOptions(options, &testutils.TemplateInfo{ID: "ssl-openssl-literal-ip"})
+	executerOpts.IsMultiProtocol = true
+	customDialer, err := fastdialer.NewDialer(fastdialer.DefaultOptions)
+	require.NoError(t, err)
+	t.Cleanup(customDialer.Close)
+	executerOpts.CustomFastdialer = customDialer
+
+	request := &Request{ID: "ssl-openssl-literal-ip", Address: "{{Host}}:{{Port}}", ScanMode: "openssl"}
+	require.NoError(t, request.Compile(executerOpts))
+
+	input := contextargs.NewWithInput(context.Background(), net.JoinHostPort("localhost", port))
+	input.MetaInput.CustomIP = "::1"
+	err = request.ExecuteWithResults(input, nil, nil, func(*output.InternalWrappedEvent) {})
+	require.Error(t, err)
+	require.Zero(t, deniedHandshakes.Load(), "openssl connected to an address the execution policy denies")
+}
+
+func TestSSLOpenSSLCustomIPObeysNetworkPolicy(t *testing.T) {
+	if !openssl.IsAvailable() {
+		t.Skip("openssl binary is not installed")
+	}
+
+	// The input pins the denied address ::1 as its custom ip, so the request
+	// skips the name lookup. The openssl binary must still not connect to it.
+	var deniedHandshakes atomic.Int32
+	denied := serveTLS(t, "[::1]:0", "denied", &deniedHandshakes)
+	_, port, err := net.SplitHostPort(denied)
+	require.NoError(t, err)
+
+	options := testutils.DefaultOptions.Copy()
+	options.SetExecutionID(t.Name())
+	options.ExcludeTargets = []string{"::1"}
+	testutils.Init(options)
+	t.Cleanup(func() { testutils.Cleanup(options) })
+	executerOpts := testutils.NewMockExecuterOptions(options, &testutils.TemplateInfo{ID: "ssl-openssl-custom-ip"})
+	executerOpts.IsMultiProtocol = true
+
+	request := &Request{ID: "ssl-openssl-custom-ip", Address: "{{Host}}:{{Port}}", ScanMode: "openssl"}
+	require.NoError(t, request.Compile(executerOpts))
+
+	input := contextargs.NewWithInput(context.Background(), net.JoinHostPort("localhost", port))
+	input.MetaInput.CustomIP = "::1"
+	_ = request.ExecuteWithResults(input, nil, nil, func(*output.InternalWrappedEvent) {})
+	require.Zero(t, deniedHandshakes.Load(), "openssl connected to a denied custom ip")
+}
@@ -289,6 +289,18 @@ func (template *Template) SelectedBy(selection protocols.TemplateSelection) bool
 	return selection.Allows(template.Path)
 }

+// TemplateIDs returns the IDs of the members selection selects; a nil
+// selection selects every member.
+func (e *ClusterExecuter) TemplateIDs(selection protocols.TemplateSelection) []string {
+	ids := make([]string, 0, len(e.operators))
+	for _, operator := range e.operators {
+		if selection == nil || selection.Allows(operator.templatePath) {
+			ids = append(ids, operator.templateID)
+		}
+	}
+	return ids
+}
+
 // operatorsFor returns the members selected for input by per-target profiles.
 func (e *ClusterExecuter) operatorsFor(input *contextargs.MetaInput) []*clusteredOperator {
 	if e.options.TargetScope == nil {
@@ -251,6 +251,9 @@ type Options struct {
 	Silent bool
 	// Validate validates the templates passed to nuclei.
 	Validate bool
+	// PlanFile is where the work a scan would do is written as JSON lines;
+	// nuclei exits after writing it, without sending requests.
+	PlanFile string
 	// NoStrictSyntax disables strict syntax check on nuclei templates (allows custom key-value pairs).
 	NoStrictSyntax bool
 	// Verbose flag indicates whether to show verbose output or not
@@ -709,6 +712,7 @@ func (options *Options) Copy() *Options {
 		AutomaticScan:                  options.AutomaticScan,
 		Silent:                         options.Silent,
 		Validate:                       options.Validate,
+		PlanFile:                       options.PlanFile,
 		NoStrictSyntax:                 options.NoStrictSyntax,
 		Verbose:                        options.Verbose,
 		VerboseVerbose:                 options.VerboseVerbose,
@@ -17,6 +17,13 @@ func TestCopyPreservesPayloadRandomOrder(t *testing.T) {
 	}
 }

+func TestCopyPreservesPlanFile(t *testing.T) {
+	options := &Options{PlanFile: "plan.jsonl"}
+	if options.Copy().PlanFile != "plan.jsonl" {
+		t.Fatal("Copy must preserve PlanFile, or an embedded caller loses plan mode")
+	}
+}
+
 func TestToJSONMapRejectsKeysSharingAStringForm(t *testing.T) {
 	metadata := map[string]interface{}{
 		"labels": []interface{}{map[interface{}]interface{}{1: "int", 1.0: "float64"}},
Author	SHA1	Message	Date
dependabot[bot]	154db3b7e5	chore(deps): bump the modules group across 1 directory with 18 updates Bumps the modules group with 18 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [github.com/projectdiscovery/clistats](https://github.com/projectdiscovery/clistats) \| `0.1.7` \| `0.1.9` \| \| [github.com/projectdiscovery/dsl](https://github.com/projectdiscovery/dsl) \| `0.9.0` \| `0.9.2` \| \| [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer) \| `0.6.0` \| `0.6.2` \| \| [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) \| `1.1.73` \| `1.1.75` \| \| [github.com/projectdiscovery/gozero](https://github.com/projectdiscovery/gozero) \| `0.1.1-0.20260530071156-fa1dad563d76` \| `0.1.1` \| \| [github.com/projectdiscovery/hmap](https://github.com/projectdiscovery/hmap) \| `0.0.102` \| `0.0.104` \| \| [github.com/projectdiscovery/networkpolicy](https://github.com/projectdiscovery/networkpolicy) \| `0.1.56` \| `0.1.57` \| \| [github.com/projectdiscovery/rawhttp](https://github.com/projectdiscovery/rawhttp) \| `0.2.0` \| `0.2.2` \| \| [github.com/projectdiscovery/retryabledns](https://github.com/projectdiscovery/retryabledns) \| `1.0.116` \| `1.0.118` \| \| [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) \| `1.3.31` \| `1.3.34` \| \| [github.com/projectdiscovery/tlsx](https://github.com/projectdiscovery/tlsx) \| `1.4.3-0.20261020052910-acb80c2c7c75` \| `1.4.4` \| \| [github.com/projectdiscovery/useragent](https://github.com/projectdiscovery/useragent) \| `0.0.109` \| `0.0.110` \| \| [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) \| `0.11.13-0.20261103094816-5c0b20e35350` \| `0.11.13` \| \| [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) \| `0.3.6` \| `0.3.8` \| \| [github.com/projectdiscovery/yamldoc-go](https://github.com/projectdiscovery/yamldoc-go) \| `1.0.7` \| `1.0.9` \| \| [github.com/projectdiscovery/asnmap](https://github.com/projectdiscovery/asnmap) \| `1.1.1` \| `1.2.0` \| \| [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck) \| `1.3.2` \| `1.4.0` \| \| [github.com/projectdiscovery/freeport](https://github.com/projectdiscovery/freeport) \| `0.0.7` \| `0.0.8` \| Updates `github.com/projectdiscovery/clistats` from 0.1.7 to 0.1.9 - [Release notes](https://github.com/projectdiscovery/clistats/releases) - [Commits](https://github.com/projectdiscovery/clistats/compare/v0.1.7...v0.1.9) Updates `github.com/projectdiscovery/dsl` from 0.9.0 to 0.9.2 - [Release notes](https://github.com/projectdiscovery/dsl/releases) - [Commits](https://github.com/projectdiscovery/dsl/compare/v0.9.0...v0.9.2) Updates `github.com/projectdiscovery/fastdialer` from 0.6.0 to 0.6.2 - [Release notes](https://github.com/projectdiscovery/fastdialer/releases) - [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.6.0...v0.6.2) Updates `github.com/projectdiscovery/gologger` from 1.1.73 to 1.1.75 - [Release notes](https://github.com/projectdiscovery/gologger/releases) - [Commits](https://github.com/projectdiscovery/gologger/compare/v1.1.73...v1.1.75) Updates `github.com/projectdiscovery/gozero` from 0.1.1-0.20260530071156-fa1dad563d76 to 0.1.1 - [Release notes](https://github.com/projectdiscovery/gozero/releases) - [Commits](https://github.com/projectdiscovery/gozero/commits/v0.1.1) Updates `github.com/projectdiscovery/hmap` from 0.0.102 to 0.0.104 - [Release notes](https://github.com/projectdiscovery/hmap/releases) - [Commits](https://github.com/projectdiscovery/hmap/compare/v0.0.102...v0.0.104) Updates `github.com/projectdiscovery/networkpolicy` from 0.1.56 to 0.1.57 - [Release notes](https://github.com/projectdiscovery/networkpolicy/releases) - [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.56...v0.1.57) Updates `github.com/projectdiscovery/rawhttp` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/projectdiscovery/rawhttp/releases) - [Commits](https://github.com/projectdiscovery/rawhttp/compare/v0.2.0...v0.2.2) Updates `github.com/projectdiscovery/retryabledns` from 1.0.116 to 1.0.118 - [Release notes](https://github.com/projectdiscovery/retryabledns/releases) - [Commits](https://github.com/projectdiscovery/retryabledns/compare/v1.0.116...v1.0.118) Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.31 to 1.3.34 - [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases) - [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.31...v1.3.34) Updates `github.com/projectdiscovery/tlsx` from 1.4.3-0.20261020052910-acb80c2c7c75 to 1.4.4 - [Release notes](https://github.com/projectdiscovery/tlsx/releases) - [Commits](https://github.com/projectdiscovery/tlsx/commits/v1.4.4) Updates `github.com/projectdiscovery/useragent` from 0.0.109 to 0.0.110 - [Release notes](https://github.com/projectdiscovery/useragent/releases) - [Commits](https://github.com/projectdiscovery/useragent/compare/v0.0.109...v0.0.110) Updates `github.com/projectdiscovery/utils` from 0.11.13-0.20261103094816-5c0b20e35350 to 0.11.13 - [Release notes](https://github.com/projectdiscovery/utils/releases) - [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md) - [Commits](https://github.com/projectdiscovery/utils/commits/v0.11.13) Updates `github.com/projectdiscovery/wappalyzergo` from 0.3.6 to 0.3.8 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.3.6...v0.3.8) Updates `github.com/projectdiscovery/yamldoc-go` from 1.0.7 to 1.0.9 - [Release notes](https://github.com/projectdiscovery/yamldoc-go/releases) - [Commits](https://github.com/projectdiscovery/yamldoc-go/compare/v1.0.7...v1.0.9) Updates `github.com/projectdiscovery/asnmap` from 1.1.1 to 1.2.0 - [Release notes](https://github.com/projectdiscovery/asnmap/releases) - [Commits](https://github.com/projectdiscovery/asnmap/compare/v1.1.1...v1.2.0) Updates `github.com/projectdiscovery/cdncheck` from 1.3.2 to 1.4.0 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.3.2...v1.4.0) Updates `github.com/projectdiscovery/freeport` from 0.0.7 to 0.0.8 - [Release notes](https://github.com/projectdiscovery/freeport/releases) - [Commits](https://github.com/projectdiscovery/freeport/compare/v0.0.7...v0.0.8) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/asnmap dependency-version: 1.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: modules - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.4.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: modules - dependency-name: github.com/projectdiscovery/clistats dependency-version: 0.1.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/dsl dependency-version: 0.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/fastdialer dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/freeport dependency-version: 0.0.8 dependency-type: indirect update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/gologger dependency-version: 1.1.75 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/gozero dependency-version: 0.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/hmap dependency-version: 0.0.104 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/networkpolicy dependency-version: 0.1.57 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/rawhttp dependency-version: 0.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/retryabledns dependency-version: 1.0.118 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/retryablehttp-go dependency-version: 1.3.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/tlsx dependency-version: 1.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/useragent dependency-version: 0.0.110 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/utils dependency-version: 0.11.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/yamldoc-go dependency-version: 1.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules ... Signed-off-by: dependabot[bot] <[email protected]>	2026-11-09 10:33:01 +00:00
Mzack9999	5e3854e0f9	Merge pull request #8091 from projectdiscovery/dwisiswant0/fix/deps/bump-golang-org-x-net-brotli-and-klauspost fix(deps): bump golang.org/x/net, brotli, and klauspost/compress	2026-11-09 11:29:19 +01:00
Dogan Can Bakir	4505f0dcf0	Merge pull request #8033 from projectdiscovery/feat/scan-plan add -plan to write the work a scan would do with its cost	2026-11-09 13:15:27 +03:00
Mzack9999	c2673595c8	check trace name servers against the network policy (#8081 ) * filter trace * prove trace * rename responses	2026-11-09 16:12:03 +07:00
Mzack9999	82fd082d4e	pin template dns resolver names to an allowed address (#8084 ) * pin resolvers * Pin DoT * lookup timeout	2026-11-09 16:11:23 +07:00
Mzack9999	46859600b8	give openssl an address that the network policy allows (#8086 ) * pin address * Test CustomIP * check literals	2026-11-09 16:10:49 +07:00
Dogan Can Bakir	eb70852e7e	stream plan entries, list same-origin targets as alternatives	2026-11-09 09:29:46 +03:00
dependabot[bot]	afb307a5b1	chore(deps): bump crate-ci/typos (#8094 ) Bumps the workflows group with 1 update: [crate-ci/typos](https://github.com/crate-ci/typos). Updates `crate-ci/typos` from 1.51.1 to 1.52.0 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/main/CHANGELOG.md) - [Commits](https://github.com/crate-ci/typos/compare/v1.51.1...v1.52.0) --- updated-dependencies: - dependency-name: crate-ci/typos dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: workflows ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-11-09 06:22:50 +00:00
Dwi Siswanto	1c77b4a52c	fix(deps): bump golang.org/x/net, brotli, and klauspost/compress govulncheck reports 8 vulnerabilities in code that nuclei calls, spread across three modules. github.com/andybalholm/brotli v1.2.0 is affected by GO-2026-6888 (CVE-2026-111497, GHSA-c9gr-gmg4-2vqv), excessive memory allocation when decompressing crafted streams. Upgrade it to v1.2.7. github.com/klauspost/compress v1.18.7 is affected by GO-2026-6865 (CVE-2026-116591, GHSA-fpmh-frq8-7rj8), a panic on two-block frames. Upgrade it to v1.20.2. golang.org/x/net v0.59.0 is affected by GO-2026-6860 (CVE-2026-78661), quadratic complexity when coalescing html text nodes, and by five HTTP/2 advisories: GO-2026-6603 (CVE-2026-78659), GO-2026-6610 (CVE-2026-78660), GO-2026-6611 (CVE-2026-78669), GO-2026-6612 (CVE-2026-78663), and GO-2026-6617 (CVE-2026-97032). Upgrade it to v0.62.0, the first release that fixes all six. The x/net upgrade also raises golang.org/x/crypto to v0.58.0, golang.org/x/sys to v0.49.0, golang.org/x/term to v0.47.0, and golang.org/x/text to v0.43.0, which in turn raises golang.org/x/sync to v0.24.0 and golang.org/x/tools to v0.51.0. Fixes: #8090 Signed-off-by: Dwi Siswanto <[email protected]>	2026-11-08 14:21:56 +00:00
Mzack9999	78a0362bac	fix plan	2026-11-04 21:40:52 +01:00
Dogan Can Bakir	b7e7da9155	fix plan cluster and mixed-protocol costs, skip update checks and reject target-changing flags under -plan	2026-11-04 10:47:06 +03:00
Dogan Can Bakir	b7b4fb97e0	add -plan to write the work a scan would do with its cost, without sending requests	2026-11-03 20:42:14 +03:00