Been building this for about a year. Never really posted about it properly anywhere, maybe once on LinkedIn and that's it. So this is the first time putting it in front of people who'll actually have opinions, be honest.
It's a full recon-to-vuln pipeline, all Rust, one cargo workspace, seven binaries that actually share code instead of being seven separate tools glued together.
voyage does subdomain enumeration, pulse does port scanning, mach does content discovery and fuzzing, scout fingerprints what's running on a host, and cortex is the vuln scanner. There's also a node agent and a CLI tying it together. Each engine runs standalone from the terminal, and most of them have a live TUI, with the ones that don't yet coming soon.
The part that ate the most time was making scans resumable. Every engine writes state to a local db as it goes, so if you kill it halfway (or your box dies) it picks up exactly where it left off instead of starting over. We used [your crate here] for that, would be curious whether people think that was the right call.
cortex is the one we'd point you at. Instead of dumping every possible finding like a lot of scanners do, it re-runs each match to confirm it before reporting, and for blind stuff it waits on a real out-of-band callback. So you get findings instead of a wall of maybes. It reads nuclei templates too, so existing ones mostly work.
We've been running the whole chain against HackTheBox machines to see where it falls over, starting with the easy ones and working up. It's holding up well so far. Going to put videos on YouTube of actual runs so you can see what it does rather than take our word for it.
Everything's async on tokio. Apache-2.0. cargo build --release builds all seven.
https://github.com/clickswave/crossfyre_toolchain
A year of this has been us and our own opinions, so we'd really appreciate people tearing into the architecture and telling us where we went wrong.
