The scanner connected. That was the easy part.

Last time, the whole win was that the scanner connected at all. Trawl spots the
local process, the page swaps to a URL box, and it starts crawling. But a scanner
that connects and finds nothing is just a slow way to load a webpage.

So this time I made it actually find the flags. On the mock CTF site I built last
time to be broken, the web scan went from 4 findings to 18. Counting the image
tools, the whole thing now gets 23 of the 26.

Teaching it to decode, not just fetch

A flag is almost never sitting in plain text waiting to be read. It’s base64
hiding in a cookie. It’s hex in a JavaScript variable. It’s a colour written as
CSS escape codes, or an array of numbers XORed against a single byte, or an ETag
that’s really just base64 printed backwards.

So the scanner now tries all of those on everything it pulls down: every page,
every script, every response header. It keeps a result only when a decode
actually produces a flag, and shuts up otherwise. That last part matters more
than it sounds. A tool that reports something on every site is noise, not a
finding.

One challenge hid an AES key and its payload in an image’s metadata. The rule I
keep breaking my own back over is no dependencies, nothing borrowed, so instead
of pulling in a crypto library I wrote AES by hand and checked it against the
official test vectors. It works. I would not recommend the experience.

The bug that made a working scanner look broken

For a while every scan felt like it hung. The scanner was fine. localhost was the
problem.

localhost resolves to the IPv6 address first. My test site only listened on IPv4.
Windows takes about two seconds to give up on the dead address before falling
back to the one that works, and two seconds across fifteen requests is a scan
that looks frozen. The fix was one line: try IPv4 first. The debugging was not one
line.

Then, the morning I went to cut the release, a routine Rust update added a new
lint and broke the build on code I hadn’t touched in weeks. Pinned the version,
fixed the lint, shipped.

AI helped with the writing and some of the mechanical refactors, but the real
time went where it always goes: into the two seconds nobody sees, and the
compiler that changed its mind overnight.

The feature list sounds small again. Reads a site, decodes what it finds, cracks
an image. The list is never the part that takes the week.

Next up is JWTs, so the scanner can start forging its way into the challenges it
currently just knocks on.