feat: improved score, and detection filters

Author: dest4590

Cargo.lock

@@ -30,6 +30,7 @@ wildmatch = "2.5.0"
 lru = "0.16.2"
 sysinfo = "0.37.2"
 bloomfilter = "3.0"
+ipnet = "2"
 
 [profile.release]
 codegen-units = 1

Cargo.toml

@@ -9,7 +9,6 @@
 -   **Scan multiple detection categories** 🔍:
 
     -   **Network**: Detect potentially malicious IPv4/IPv6 addresses and URLs
-    -   **Crypto**: Find cryptographic implementations and sensitive material
     -   **Malicious**: Identify suspicious code patterns (backdoors, exploits, etc.)
     -   **Obfuscation**: Detect obfuscated code, high entropy, and suspicious naming patterns
 
@@ -24,7 +23,7 @@
     -   **Multi-threading**: Parallel processing of files for faster scanning
     -   **Fast mode**: Stop processing after first suspicious item
     -   **Path filtering**: Include or exclude paths matching patterns
-    -   **Custom ignore lists**: Skip specified suspicious or crypto keywords
+    -   **Custom ignore lists**: Skip specified suspicious keywords
 
 ## ⚙️ Installation
 
@@ -55,7 +54,6 @@ collapsescanner directory
 
 # Different detection modes
 collapsescanner file.jar --mode network
-collapsescanner file.jar --mode crypto
 collapsescanner file.jar --mode malicious
 collapsescanner file.jar --mode obfuscation
 
@@ -78,24 +76,26 @@ collapsescanner file.jar --threads 8
 collapsescanner file.jar --exclude "assets/**" --exclude "*.log" --find "com/example/*"
 
 # Skip specific keywords
-collapsescanner file.jar --ignore_keywords_file ignore_keywords.txt
+collapsescanner file.jar --ignore_keywords ignore_keywords.txt
 ```
 
 ## 🔍 Command-line Options
 
-| Option                   | Description                                                                         |
-| ------------------------ | ----------------------------------------------------------------------------------- |
-| `path`                   | Path to a JAR file, class file, or directory to scan                                |
-| `--mode`                 | Detection mode: `network`, `crypto`, `malicious`, `obfuscation`, or `all` (default) |
-| `--extract`              | Extract all resources from JAR files                                                |
-| `--strings`              | Extract all strings from class files                                                |
-| `--output`               | Specify the output directory (default: ./extracted)                                 |
-| `--json`                 | Export results in JSON format                                                       |
-| `-v, --verbose`          | Enable verbose output (shows size/entropy, etc.)                                    |
-| `--threads`              | Number of threads to use for parallel processing (0 = automatic based on CPU cores) |
-| `--exclude`              | Exclude paths matching the wildcard pattern (can be used multiple times)            |
-| `--find`                 | Only scan paths matching the wildcard pattern (can be used multiple times)          |
-| `--ignore_keywords_file` | Path to a .txt file with keywords to ignore (one per line)                          |
+| Option              | Description                                                                         |
+| ------------------- | ----------------------------------------------------------------------------------- |
+| `path`              | Path to a JAR file, class file, or directory to scan                                |
+| `--mode`            | Detection mode: `network`, `malicious`, `obfuscation`, or `all` (default)           |
+| `--extract`         | Extract all resources from JAR files                                                |
+| `--strings`         | Extract all strings from class files                                                |
+| `--output`          | Specify the output directory (default: ./extracted)                                 |
+| `--json`            | Export results in JSON format                                                       |
+| `-v, --verbose`     | Enable verbose output (shows size/entropy, etc.)                                    |
+| `--threads`         | Number of threads to use for parallel processing (0 = automatic based on CPU cores) |
+| `--exclude`         | Exclude paths matching the wildcard pattern (can be used multiple times)            |
+| `--find`            | Only scan paths matching the wildcard pattern (can be used multiple times)          |
+| `--ignore_keywords` | Path to a .txt file with keywords to ignore (one per line)                          |
+| `--show`            | Print a detailed findings report to the terminal (useful for interactive runs)      |
+| `--max_file_size`   | Maximum file size to scan (in MB). Files larger than this will be skipped.          |
 
 ## 🛡️ Detection Capabilities
 
@@ -114,7 +114,6 @@ CollapseScanner analyzes Java class files to find:
     -   Key management and password handling
 
 -   **Obfuscation indicators**:
-    -   Excessively long names
     -   Suspicious character sequences
     -   Unicode characters in identifiers
     -   High entropy (potentially obfuscated) files
@@ -151,30 +150,43 @@ cargo run --bin remapper input.jar output.jar
 <details><summary>📋 Example Output</summary>
 
 ```
-==== CollapseScanner - Enhanced Analysis ====
-🎯 Target: suspicious.jar
-🔧 Mode: All
-🚀 Starting scan...
-
-⚠️  Findings Report:
+╔══════════════════════════════════════════════════════════════════════════════╗
+║                              FINDINGS REPORT                                 ║
+╚══════════════════════════════════════════════════════════════════════════════╝
 
 📄 File: suspicious.jar/com/example/malicious/Payload.class
-  🌐 IPv4 Address: 192.168.1.100
-  🌐 IPv6 Address: 9e53:c40f:5969:6a04:68b6:2c98:5c80:25fb
-  🔗 URL: http://malicious-domain.com/c2
-  🔒 Crypto Keyword: 'encrypt' in "AES encryption used here"
-  ❗ Suspicious Keyword: 'payload' in "Executing payload"
-
-==== Scan Summary ====
-📈 Total Findings: 4
-  - Crypto Keyword: 1
-  - IPv4 Address: 1
-  - IPv6 Address: 1
-  - Suspicious Keyword: 1
-  - URL: 1
-
-📦 Resources extracted to ./extracted
-🔤 Strings extracted to ./extracted
+     🌐 IPv4 Address: 192.168.1.100
+     🔗 URL: http://malicious-domain.com/c2
+     🤖 Discord Webhook: https://discord.com/api/webhooks/12345/abcdef
+     ❗ Suspicious Keyword: 'payload' in "Executing payload"
+     🔥 High Entropy: Very High entropy value: 8.45 (threshold: 7.20) - suggests possible encryption or compression
+
+╔══════════════════════════════════════════════════════════════════════════════╗
+║                              SCAN SUMMARY                                    ║
+╚══════════════════════════════════════════════════════════════════════════════╝
+
+📊 Total Findings: 5 | Files with Findings: 1 | Risk Level: HIGH RISK (9/10)
+⏱️ Scan Time: 1.23s | Total Files Scanned: 12 | Processing Rate: 9.8 files/sec
+
+🔍 Findings Breakdown:
+
+  🌐 IPv4 Address (1)
+    • 192.168.1.100
+
+  🔗 URL (1)
+    • http://malicious-domain.com/c2
+
+  🤖 Discord Webhook (1)
+    • https://discord.com/api/webhooks/12345/abcdef
+
+  ❗ Suspicious Keyword (1)
+    • 'payload' in "Executing payload"
+
+  🔥 High Entropy (1)
+    • Very High entropy value: 8.45
+
+👻 Custom JVM Warning: Files with unusual magic bytes detected. These may require a custom ClassLoader.
+
 ```
 
 </details>

README.md

@@ -1,7 +1,5 @@
-use regex::Regex;
 use std::collections::HashSet;
 
-pub const NAME_LENGTH_THRESHOLD: usize = 100;
 pub const ENTROPY_THRESHOLD: f64 = 7.2;
 
 lazy_static::lazy_static! {
@@ -19,26 +17,13 @@ lazy_static::lazy_static! {
             "discord.com",
             "discordapp.com",
             "pastebin.com",
+            "bit.ly",
+            "tinyurl.com",
         ]
         .iter()
         .map(|&s| s.to_lowercase())
         .collect()
     };
-
-    pub static ref IP_REGEX: Regex =
-        Regex::new(r"\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b").unwrap();
-
-    pub static ref IPV6_REGEX: Regex =
-        Regex::new(r"(?i)\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b").unwrap();
-
-    pub static ref URL_REGEX: Regex =
-        Regex::new(r#"(?i)\b((?:https?://|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+|\(([^\s()<>]+|(\([^\s()<>]+\)))*\))+(?:\(([^\s()<>]+|(\([^\s()<>]+\)))*\)|[^\s`!()\[\]{};:'".,<>?«»""'']))"#).unwrap();
-
-    pub static ref CRYPTO_REGEX: Regex =
-        Regex::new(r"(?i)\b(aes|des|rsa|md5|sha[1-9]*-?\d*|blowfish|twofish|pgp|gpg|cipher|keystore|keygenerator|secretkey|password|encrypt|decrypt|hash|salt|ivParameterSpec|SecureRandom)\b").unwrap();
-
-    pub static ref MALICIOUS_PATTERN_REGEX: Regex =
-        Regex::new(r"(?i)\b(backdoor|exploit|payload|shellcode|bypass|rootkit|keylog|rat\b|trojan|malware|spyware|meterpreter|cobaltstrike|powershell|cmd\.exe|Runtime\.getRuntime\(\)\.exec|ProcessBuilder|loadLibrary|download|upload|socket\(|bind\(|connect\(|URL\(|URLConnection|Class\.forName|defineClass|getMethod|unsafe|jndi|ldap|rmi|base64|decode)\b").unwrap();
 }
 
 pub fn is_cached_safe_string(s: &str) -> bool {

src/database.rs

@@ -0,0 +1,141 @@
+use ipnet::IpNet;
+use regex::Regex;
+use std::collections::HashSet;
+use std::net::IpAddr;
+
+lazy_static::lazy_static! {
+    /// IPv4 address regex
+    pub static ref IP_REGEX: Regex = Regex::new(r"\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b").unwrap();
+
+    /// IPv6 address regex (simple/fast heuristic)
+    pub static ref IPV6_REGEX: Regex = Regex::new(r"(?i)\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b").unwrap();
+
+    /// URL detection regex (captures many common URL forms)
+    pub static ref URL_REGEX: Regex = Regex::new(r#"(?i)\b((?:https?://|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+|\(([^
+\s()<>]+|(\([^\s()<>]+\)))*\))+(?:\(([^
+\s()<>]+|(\([^\s()<>]+\)))*\)|[^\s`!()\[\]{};:'".,<>?«»""']))"#).unwrap();
+
+    /// Generic malicious / suspicious pattern keywords
+    pub static ref MALICIOUS_PATTERN_REGEX: Regex = Regex::new(r"(?i)\b(payload|powershell|cmd\.exe|Runtime\.getRuntime\(\)\.exec|ProcessBuilder|loadLibrary|socket\(|bind\(|connect\(|URL\(|URLConnection|Class\.forName|defineClass|getMethod|jndi|ldap|rmi)\b").unwrap();
+
+    /// Known "good" links / domains
+    pub static ref GOOD_LINKS: Vec<String> = vec![
+        "account.mojang.com".to_string(),
+        "aka.ms".to_string(),
+        "apache.org".to_string(),
+        "api.mojang.com".to_string(),
+        "api.spiget.org".to_string(),
+        "authserver.mojang.com".to_string(),
+        "bugs.mojang.com".to_string(),
+        "cabaletta/baritone".to_string(),
+        "ci.viaversion.com".to_string(),
+        "com/viaversion/".to_string(),
+        "docs.advntr.dev".to_string(),
+        "dominos.com".to_string(),
+        "dump.viaversion.com".to_string(),
+        "eclipse.org".to_string(),
+        "java.sun.org".to_string(),
+        "jo0001.github.io".to_string(),
+        "logging.apache.org".to_string(),
+        "login.live.com".to_string(),
+        "lwjgl.org".to_string(),
+        "minecraft.net".to_string(),
+        "minecraft.org".to_string(),
+        "minotar.net".to_string(),
+        "mojang.com".to_string(),
+        "netty.io".to_string(),
+        "optifine.net".to_string(),
+        "paulscode/sound/".to_string(),
+        "s.optifine.net".to_string(),
+        "sessionserver.mojang.com".to_string(),
+        "shader-tutorial.dev".to_string(),
+        "snoop.minecraft.net".to_string(),
+        "tools.ietf.org".to_string(),
+        "viaversion.com".to_string(),
+        "www.openssl.org".to_string(),
+        "www.rfc-editor.org".to_string(),
+        "www.slf4j.org".to_string(),
+        "www.w3.org".to_string(),
+        "yaml.org".to_string(),
+        "openssl.org".to_string(),
+        "yggdrasil-auth-session-staging.mojang.zone".to_string(),
+    ];
+
+    /// Known "good" / unreachable / reserved IPs and ranges
+    pub static ref GOOD_IPS: HashSet<&'static str> = {
+        let mut s = HashSet::new();
+        // Unspecified / non-routable single addresses
+        s.insert("0.0.0.0");
+        s.insert("::");
+
+        // Loopback
+        s.insert("127.0.0.1");
+        s.insert("::1");
+
+        // Broadcast
+        s.insert("255.255.255.255");
+
+        // Link-local (often unreachable from other networks)
+        s.insert("169.254.0.0/16");
+
+        // Documentation / TEST-NET ranges (RFC 5737) - used in examples/tests
+        s.insert("192.0.2.0/24");
+        s.insert("198.51.100.0/24");
+        s.insert("203.0.113.0/24");
+
+        // Private address ranges (commonly non-public)
+        s.insert("10.0.0.0/8");
+        s.insert("172.16.0.0/12");
+        s.insert("192.168.0.0/16");
+
+        // Minecraft UDP multicast address
+        s.insert("224.0.2.60");
+
+        // DNS resolvers
+        s.insert("8.8.8.8");
+        s.insert("8.8.4.4");
+        s.insert("1.1.1.1");
+        s.insert("9.9.9.9");
+
+        s
+    };
+
+    pub static ref GOOD_IP_ADDRS: HashSet<IpAddr> = {
+        let mut out = HashSet::new();
+        for s in GOOD_IPS.iter() {
+            if !s.contains('/') {
+                if let Ok(a) = s.parse::<IpAddr>() {
+                    out.insert(a);
+                }
+            }
+        }
+        out
+    };
+
+    pub static ref GOOD_IP_NETWORKS: Vec<IpNet> = {
+        let mut out = Vec::new();
+        for s in GOOD_IPS.iter() {
+            if s.contains('/') {
+                if let Ok(n) = s.parse::<IpNet>() {
+                    out.push(n);
+                }
+            }
+        }
+        out
+    };
+}
+
+pub fn is_known_good_ip(ip: &str) -> bool {
+    if let Ok(addr) = ip.parse::<IpAddr>() {
+        if GOOD_IP_ADDRS.contains(&addr) {
+            return true;
+        }
+
+        for net in GOOD_IP_NETWORKS.iter() {
+            if net.contains(&addr) {
+                return true;
+            }
+        }
+    }
+    false
+}