flowchart TD
    A[User provides -u URL or -l FILE] --> B[Normalize & deduplicate targets]
    B --> C[Launch ThreadPoolExecutor]
    C --> D[For each target]

    D --> E1[probe_joomla<br/>GET /, meta, manifest,<br/>static assets, README]
    E1 --> F1{Joomla! detected?}
    F1 -- No --> R1[Status: NOT_JOOMLA]

    F1 -- Yes --> E2[probe_jce<br/>GET jce.xml, endpoints,<br/>JCE-specific markers]
    E2 --> F2{JCE detected?}
    F2 -- No --> R2[Status: SAFE<br/>JCE not installed]

    F2 -- Yes --> F3{Version >= 2.9.99.5?}
    F3 -- Yes --> R3[Status: PATCHED]

    F3 -- No --> E3[extract_csrf<br/>Parse Joomla! CSRF token]
    E3 --> F4{Token found?}
    F4 -- No --> R4[Status: PATCHED<br/>CSRF missing → likely hardened]

    F4 -- Yes --> E5[Build math-verifier payload<br/>masta-cve-2026-48907-poc ...]
    E5 --> E6[Vector 1: Multipart POST<br/>profile_file upload to tmp/]
    E6 --> F5{HTTP 200?}

    F5 -- Yes --> E7["GET /tmp/masta-{rand}.xml.php"]
    E7 --> F6{Body contains<br/>MATHOK:3105:END ?}
    F6 -- Yes --> R5[Status: VULNERABLE<br/>Confidence: CONFIRMED]
    F6 -- No --> E8[Vector 2: Browser chain<br/>upload + rename via RPC]
    E8 --> F7{RCE confirmed?}
    F7 -- Yes --> R5

    F7 -- No --> E9[Check for WAF block page]
    E9 --> F8{WAF detected?}
    F8 -- Yes --> R6[Status: BLOCKED_BY_WAF]
    F8 -- No --> R7[Status: SAFE]

    F5 -- No --> E8

    R1 --> S[Append result to Excel + Terminal card]
    R2 --> S
    R3 --> S
    R4 --> S
    R5 --> S
    R6 --> S
    R7 --> S

    S --> D
    D --> T[Print Summary Dashboard]
    T --> U[Save Excel Report to reports/]
    U --> V[Print cleanup reminder for<br/>all uploaded POC files]

    style R5 fill:#ff0000,stroke:#333,color:#fff
    style R3 fill:#32CD32,stroke:#333,color:#000
    style R6 fill:#FFD700,stroke:#333,color:#000