test: 补充单元测试覆盖率 29.9% → 36.6%

新建 18 个测试文件，追加 30 个已有测试文件，覆盖协议解析、
错误分类、CEL 表达式求值、YAML 反序列化、字节编码等纯函数。

common/config_builder_test.go

@@ -3,6 +3,7 @@ package common
 import (
 	"reflect"
 	"testing"
+	"time"
 
 	fscanconfig "github.com/shadow1ng/fscan/common/config"
 )
@@ -192,3 +193,258 @@ func TestNormalizeURLBracketsIPv6Literals(t *testing.T) {
 		})
 	}
 }
+
+// TestModuleTimeout 测试模块超时计算
+func TestModuleTimeout(t *testing.T) {
+	tests := []struct {
+		name    string
+		timeout time.Duration
+		want    time.Duration
+	}{
+		{"超时大于下限", 10 * time.Second, 10 * time.Second},
+		{"超时等于下限", 3 * time.Second, 3 * time.Second},
+		{"超时小于下限", 1 * time.Second, 3 * time.Second},
+		{"零超时", 0, 3 * time.Second},
+		{"负超时", -1 * time.Second, 3 * time.Second},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := NewConfig()
+			cfg.Timeout = tt.timeout
+			got := cfg.ModuleTimeout()
+			if got != tt.want {
+				t.Errorf("ModuleTimeout() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestParseUserPassPairsExactMatch 测试精确单用户单密码路径
+func TestParseUserPassPairsExactMatch(t *testing.T) {
+	fv := &FlagVars{
+		Username: "admin",
+		Password: "secret",
+	}
+	pairs, err := parseUserPassPairs(fv)
+	if err != nil {
+		t.Fatalf("parseUserPassPairs error = %v", err)
+	}
+	if len(pairs) != 1 {
+		t.Fatalf("期望 1 个 pair, 实际 %d", len(pairs))
+	}
+	if pairs[0].Username != "admin" || pairs[0].Password != "secret" {
+		t.Errorf("pair = %+v, want {admin secret}", pairs[0])
+	}
+}
+
+// TestParseUserPassPairsMultiUserSkips 测试多用户时不生成精确 pair
+func TestParseUserPassPairsMultiUserSkips(t *testing.T) {
+	fv := &FlagVars{
+		Username: "admin,root",
+		Password: "pass",
+	}
+	pairs, err := parseUserPassPairs(fv)
+	if err != nil {
+		t.Fatalf("parseUserPassPairs error = %v", err)
+	}
+	if len(pairs) != 0 {
+		t.Fatalf("多用户场景不应生成精确 pair, 实际 %d 个", len(pairs))
+	}
+}
+
+// TestParseURLsEmpty 测试空输入返回空列表
+func TestParseURLsEmpty(t *testing.T) {
+	fv := &FlagVars{}
+	urls, err := parseURLs(fv)
+	if err != nil {
+		t.Fatalf("parseURLs error = %v", err)
+	}
+	if len(urls) != 0 {
+		t.Fatalf("空输入应返回空 url 列表, 实际 %v", urls)
+	}
+}
+
+// TestParseURLsCommaSeparated 测试逗号分隔多 URL
+func TestParseURLsCommaSeparated(t *testing.T) {
+	fv := &FlagVars{
+		TargetURL: "http://a.com,http://b.com,http://a.com", // 含重复
+	}
+	urls, err := parseURLs(fv)
+	if err != nil {
+		t.Fatalf("parseURLs error = %v", err)
+	}
+	if len(urls) != 2 {
+		t.Fatalf("去重后应有 2 个 url, 实际 %d: %v", len(urls), urls)
+	}
+}
+
+// TestParseURLsMissingFile 测试缺失文件返回错误
+func TestParseURLsMissingFile(t *testing.T) {
+	fv := &FlagVars{URLsFile: "nonexistent-urls.txt"}
+	_, err := parseURLs(fv)
+	if err == nil {
+		t.Fatal("缺失文件应返回错误")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// parseHashes
+// ---------------------------------------------------------------------------
+
+// TestParseHashesEmpty 空输入返回空结果
+func TestParseHashesEmpty(t *testing.T) {
+	fv := &FlagVars{}
+	vals, bytes, err := parseHashes(fv)
+	if err != nil {
+		t.Fatalf("parseHashes error = %v", err)
+	}
+	if len(vals) != 0 || len(bytes) != 0 {
+		t.Fatalf("空输入应返回空结果, vals=%v bytes=%v", vals, bytes)
+	}
+}
+
+// TestParseHashesValidNTLM 纯 32 字符 hex hash
+func TestParseHashesValidNTLM(t *testing.T) {
+	hash := "aabbccddeeff00112233445566778899"
+	fv := &FlagVars{HashValue: hash}
+	vals, hashBytes, err := parseHashes(fv)
+	if err != nil {
+		t.Fatalf("parseHashes error = %v", err)
+	}
+	if len(vals) != 1 || vals[0] != hash {
+		t.Fatalf("vals = %v, want [%s]", vals, hash)
+	}
+	if len(hashBytes) != 1 || len(hashBytes[0]) != 16 {
+		t.Fatalf("hashBytes length wrong: %v", hashBytes)
+	}
+}
+
+// TestParseHashesLMNTFormat LM:NT 格式，提取 NT 部分
+func TestParseHashesLMNTFormat(t *testing.T) {
+	lm := "aad3b435b51404eeaad3b435b51404ee"
+	nt := "31d6cfe0d16ae931b73c59d7e0c089c0"
+	fv := &FlagVars{HashValue: lm + ":" + nt}
+	vals, _, err := parseHashes(fv)
+	if err != nil {
+		t.Fatalf("parseHashes error = %v", err)
+	}
+	if len(vals) != 1 || vals[0] != nt {
+		t.Fatalf("vals = %v, want [%s]", vals, nt)
+	}
+}
+
+// TestParseHashesInvalidLength hash 长度不是 32 → error
+func TestParseHashesInvalidLength(t *testing.T) {
+	fv := &FlagVars{HashValue: "tooshort"}
+	_, _, err := parseHashes(fv)
+	if err == nil {
+		t.Fatal("hash 长度不足应返回错误")
+	}
+}
+
+// TestParseHashesInvalidHex 32 字符但含非 hex 字符 → error
+func TestParseHashesInvalidHex(t *testing.T) {
+	fv := &FlagVars{HashValue: "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"}
+	_, _, err := parseHashes(fv)
+	if err == nil {
+		t.Fatal("非 hex 字符应返回错误")
+	}
+}
+
+// TestParseHashesMissingFile hash 文件不存在 → error
+func TestParseHashesMissingFile(t *testing.T) {
+	fv := &FlagVars{HashFile: "nonexistent-hashes.txt"}
+	_, _, err := parseHashes(fv)
+	if err == nil {
+		t.Fatal("缺失 hash 文件应返回错误")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// parseUsernames
+// ---------------------------------------------------------------------------
+
+// TestParseUsernamesEmpty 空输入返回空结果
+func TestParseUsernamesEmpty(t *testing.T) {
+	fv := &FlagVars{}
+	got, err := parseUsernames(fv)
+	if err != nil {
+		t.Fatalf("parseUsernames error = %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("空输入应返回空, got %v", got)
+	}
+}
+
+// TestParseUsernamesCommaSeparated 逗号分隔多用户
+func TestParseUsernamesCommaSeparated(t *testing.T) {
+	fv := &FlagVars{Username: "admin, root, admin"} // 含重复和空格
+	got, err := parseUsernames(fv)
+	if err != nil {
+		t.Fatalf("parseUsernames error = %v", err)
+	}
+	want := []string{"admin", "root"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+// TestParseUsernamesAddUsers AddUsers 追加去重
+func TestParseUsernamesAddUsers(t *testing.T) {
+	fv := &FlagVars{
+		Username: "admin",
+		AddUsers: "root,admin", // admin 重复
+	}
+	got, err := parseUsernames(fv)
+	if err != nil {
+		t.Fatalf("parseUsernames error = %v", err)
+	}
+	want := []string{"admin", "root"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+// TestParseUsernamesMissingFile 缺失用户文件 → error
+func TestParseUsernamesMissingFile(t *testing.T) {
+	fv := &FlagVars{UsersFile: "nonexistent-users.txt"}
+	_, err := parseUsernames(fv)
+	if err == nil {
+		t.Fatal("缺失用户文件应返回错误")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// cloneStringSlice
+// ---------------------------------------------------------------------------
+
+// TestCloneStringSliceNil nil 输入返回 nil
+func TestCloneStringSliceNil(t *testing.T) {
+	got := cloneStringSlice(nil)
+	if got != nil {
+		t.Fatalf("nil 输入应返回 nil, got %v", got)
+	}
+}
+
+// TestCloneStringSliceEmpty 空切片：append 无元素结果为 nil，len 为 0
+func TestCloneStringSliceEmpty(t *testing.T) {
+	got := cloneStringSlice([]string{})
+	if len(got) != 0 {
+		t.Fatalf("got len %d, want 0", len(got))
+	}
+}
+
+// TestCloneStringSliceCopiesValues 正常切片：值正确且独立
+func TestCloneStringSliceCopiesValues(t *testing.T) {
+	src := []string{"a", "b", "c"}
+	got := cloneStringSlice(src)
+	if !reflect.DeepEqual(got, src) {
+		t.Fatalf("got %v, want %v", got, src)
+	}
+	// 修改 clone 不影响原始
+	got[0] = "mutated"
+	if src[0] != "a" {
+		t.Fatal("cloneStringSlice 返回的切片与源共享底层数组")
+	}
+}

common/output/writers_test.go

@@ -1728,3 +1728,420 @@ func TestManager_ConcurrentSave(t *testing.T) {
 	t.Logf("✓ 并发保存测试通过（%d个goroutine，每个%d次，输出%d行）",
 		numGoroutines, savesPerGoroutine, len(lines))
 }
+
+// =============================================================================
+// TXTWriter - 内部格式化函数覆盖率测试
+// =============================================================================
+
+// newTestTXTWriter 创建用于单元测试的 TXTWriter（写到临时文件，调用方负责 Close）
+func newTestTXTWriter(t *testing.T) *TXTWriter {
+	t.Helper()
+	w, err := NewTXTWriter(filepath.Join(t.TempDir(), "unit.txt"))
+	if err != nil {
+		t.Fatalf("创建 TXTWriter 失败: %v", err)
+	}
+	return w
+}
+
+// TestFormatServiceLine 覆盖 formatServiceLine 的各分支
+func TestFormatServiceLine(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		details map[string]interface{}
+		want    []string // 输出中必须包含的子串
+		notwant []string // 输出中不应包含的子串
+	}{
+		{
+			name: "非web服务带service和banner",
+			details: map[string]interface{}{
+				"port":    22,
+				"service": "ssh",
+				"banner":  "OpenSSH_8.0",
+			},
+			want:    []string{"ssh", "OpenSSH_8.0"},
+			notwant: []string{"http://", "https://"},
+		},
+		{
+			name: "非web服务只有service",
+			details: map[string]interface{}{
+				"port":    3306,
+				"service": "mysql",
+			},
+			want:    []string{"mysql"},
+			notwant: []string{"http://"},
+		},
+		{
+			name: "非web服务无banner",
+			details: map[string]interface{}{
+				"port":    21,
+				"service": "ftp",
+			},
+			want: []string{"ftp"},
+		},
+		{
+			name: "service=http 走 web 分支",
+			details: map[string]interface{}{
+				"port":    80,
+				"service": "http",
+				"title":   "Home",
+				"status":  200,
+			},
+			want:    []string{"http://", "Home"},
+			notwant: []string{"ssh"},
+		},
+		{
+			name: "service=https 走 web 分支",
+			details: map[string]interface{}{
+				"port":    443,
+				"service": "https",
+				"title":   "Secure",
+				"status":  200,
+			},
+			want: []string{"https://", "Secure"},
+		},
+		{
+			name: "is_web=true 走 web 分支",
+			details: map[string]interface{}{
+				"port":   8080,
+				"is_web": true,
+				"title":  "Dashboard",
+				"status": 302,
+			},
+			want: []string{"http://", "Dashboard"},
+		},
+		{
+			name: "有 status 字段触发 web 分支",
+			details: map[string]interface{}{
+				"port":   8080,
+				"status": 200,
+			},
+			want: []string{"http://"},
+		},
+		{
+			name: "有 server 字段触发 web 分支",
+			details: map[string]interface{}{
+				"port":   8080,
+				"server": "nginx",
+			},
+			want: []string{"http://", "nginx"},
+		},
+		{
+			name: "banner 含控制字符被转义",
+			details: map[string]interface{}{
+				"port":    9999,
+				"service": "custom",
+				"banner":  "hello\nworld\r\n",
+			},
+			want:    []string{"\\n", "\\r"},
+			notwant: []string{"http://"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{
+				Target:  "192.168.1.1",
+				Type:    TypeService,
+				Details: tt.details,
+			}
+			got := w.formatServiceLine(result)
+			for _, s := range tt.want {
+				if !strings.Contains(got, s) {
+					t.Errorf("formatServiceLine() = %q，缺少 %q", got, s)
+				}
+			}
+			for _, s := range tt.notwant {
+				if strings.Contains(got, s) {
+					t.Errorf("formatServiceLine() = %q，不应含 %q", got, s)
+				}
+			}
+		})
+	}
+}
+
+// TestGetFingerprints 覆盖 getFingerprints 的各类型分支
+func TestGetFingerprints(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		details map[string]interface{}
+		want    string
+	}{
+		{
+			name:    "nil fingerprints",
+			details: map[string]interface{}{},
+			want:    "",
+		},
+		{
+			name:    "[]string 非空",
+			details: map[string]interface{}{"fingerprints": []string{"nginx", "php"}},
+			want:    "[nginx,php]",
+		},
+		{
+			name:    "[]string 空slice",
+			details: map[string]interface{}{"fingerprints": []string{}},
+			want:    "",
+		},
+		{
+			name:    "[]interface{} 非空",
+			details: map[string]interface{}{"fingerprints": []interface{}{"wordpress", "jquery"}},
+			want:    "[wordpress,jquery]",
+		},
+		{
+			name:    "[]interface{} 含数字",
+			details: map[string]interface{}{"fingerprints": []interface{}{"apache", 2}},
+			want:    "[apache,2]",
+		},
+		{
+			name:    "[]interface{} 空slice",
+			details: map[string]interface{}{"fingerprints": []interface{}{}},
+			want:    "",
+		},
+		{
+			name:    "不支持的类型返回空",
+			details: map[string]interface{}{"fingerprints": "just-a-string"},
+			want:    "",
+		},
+		{
+			name:    "单个元素",
+			details: map[string]interface{}{"fingerprints": []string{"tomcat"}},
+			want:    "[tomcat]",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{Target: "1.2.3.4", Details: tt.details}
+			got := w.getFingerprints(result)
+			if got != tt.want {
+				t.Errorf("getFingerprints() = %q，want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestFormatVulnLine 覆盖 formatVulnLine 的各分支
+func TestFormatVulnLine(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		target  string
+		status  string
+		details map[string]interface{}
+		want    string
+	}{
+		{
+			name:   "weak_credential 带 service",
+			target: "192.168.1.1:22",
+			details: map[string]interface{}{
+				"type":     "weak_credential",
+				"service":  "ssh",
+				"username": "root",
+				"password": "123456",
+			},
+			want: "192.168.1.1:22 ssh root/123456",
+		},
+		{
+			name:   "weak_credential 不带 service",
+			target: "192.168.1.1:3306",
+			details: map[string]interface{}{
+				"type":     "weak_credential",
+				"username": "admin",
+				"password": "pass",
+			},
+			want: "192.168.1.1:3306 admin/pass",
+		},
+		{
+			name:   "有 vulnerability 字段",
+			target: "10.0.0.1",
+			details: map[string]interface{}{
+				"type":          "poc",
+				"vulnerability": "CVE-2024-1234",
+			},
+			want: "10.0.0.1 CVE-2024-1234",
+		},
+		{
+			name:   "无 vulnerability 字段回退到 status",
+			target: "10.0.0.2",
+			status: "VULNERABLE",
+			details: map[string]interface{}{
+				"type": "unknown",
+			},
+			want: "10.0.0.2 VULNERABLE",
+		},
+		{
+			name:    "空 details 回退到 status",
+			target:  "10.0.0.3",
+			status:  "poc_hit",
+			details: map[string]interface{}{},
+			want:    "10.0.0.3 poc_hit",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{
+				Target:  tt.target,
+				Status:  tt.status,
+				Type:    TypeVuln,
+				Details: tt.details,
+			}
+			got := w.formatVulnLine(result)
+			if got != tt.want {
+				t.Errorf("formatVulnLine() = %q，want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestIsWebService 覆盖 isWebService 的各判断分支
+func TestIsWebService(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		details map[string]interface{}
+		want    bool
+	}{
+		{
+			name:    "is_web=true",
+			details: map[string]interface{}{"is_web": true},
+			want:    true,
+		},
+		{
+			name:    "is_web=false 无其他标志",
+			details: map[string]interface{}{"is_web": false},
+			want:    false,
+		},
+		{
+			name:    "有 status 字段",
+			details: map[string]interface{}{"status": 200},
+			want:    true,
+		},
+		{
+			name:    "status=nil 不触发",
+			details: map[string]interface{}{},
+			want:    false,
+		},
+		{
+			name:    "有非空 server 字段",
+			details: map[string]interface{}{"server": "nginx"},
+			want:    true,
+		},
+		{
+			name:    "空 server 字段不触发",
+			details: map[string]interface{}{"server": ""},
+			want:    false,
+		},
+		{
+			name:    "service=http",
+			details: map[string]interface{}{"service": "http"},
+			want:    true,
+		},
+		{
+			name:    "service=https",
+			details: map[string]interface{}{"service": "https"},
+			want:    true,
+		},
+		{
+			name:    "service=ssh 不是 web",
+			details: map[string]interface{}{"service": "ssh"},
+			want:    false,
+		},
+		{
+			name:    "nil Details",
+			details: nil,
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{Target: "1.2.3.4", Details: tt.details}
+			got := w.isWebService(result)
+			if got != tt.want {
+				t.Errorf("isWebService() = %v，want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestWebProtocol 覆盖 webProtocol 的各判断分支
+func TestWebProtocol(t *testing.T) {
+	w := newTestTXTWriter(t)
+	defer w.Close()
+
+	tests := []struct {
+		name    string
+		target  string
+		details map[string]interface{}
+		want    string
+	}{
+		{
+			name:    "protocol=https 直接返回",
+			target:  "1.2.3.4:8443",
+			details: map[string]interface{}{"protocol": "https"},
+			want:    "https",
+		},
+		{
+			name:    "protocol=http 直接返回",
+			target:  "1.2.3.4:8080",
+			details: map[string]interface{}{"protocol": "http"},
+			want:    "http",
+		},
+		{
+			name:    "protocol=HTTPS 大小写不敏感",
+			target:  "1.2.3.4:443",
+			details: map[string]interface{}{"protocol": "HTTPS"},
+			want:    "https",
+		},
+		{
+			name:    "service=https 回退",
+			target:  "1.2.3.4:8080",
+			details: map[string]interface{}{"service": "https"},
+			want:    "https",
+		},
+		{
+			name:    "target 含 :443 回退 https",
+			target:  "example.com:443",
+			details: map[string]interface{}{},
+			want:    "https",
+		},
+		{
+			name:    "无任何标志默认 http",
+			target:  "1.2.3.4:8080",
+			details: map[string]interface{}{},
+			want:    "http",
+		},
+		{
+			name:    "service=http 默认 http",
+			target:  "1.2.3.4:80",
+			details: map[string]interface{}{"service": "http"},
+			want:    "http",
+		},
+		{
+			name:    "protocol 为其他值走 service 分支",
+			target:  "1.2.3.4:9000",
+			details: map[string]interface{}{"protocol": "tcp", "service": "https"},
+			want:    "https",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := &ScanResult{Target: tt.target, Details: tt.details}
+			got := w.webProtocol(result, tt.target)
+			if got != tt.want {
+				t.Errorf("webProtocol() = %q，want %q", got, tt.want)
+			}
+		})
+	}
+}

common/output_api_test.go

@@ -105,6 +105,24 @@ func TestInitOutputValidationAndDefaultExtension(t *testing.T) {
 	}
 }
 
+func TestCloseOutputWithStdoutWriter(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	// 初始化 silent 模式以创建 StdoutWriter
+	flagVars = &FlagVars{Silent: true, DisableSave: true}
+	if err := InitOutput(); err != nil {
+		t.Fatalf("InitOutput silent error = %v", err)
+	}
+	if StdoutWriter == nil {
+		t.Fatal("StdoutWriter 应在 Silent 模式下被初始化")
+	}
+
+	// CloseOutput 应正常关闭 StdoutWriter
+	if err := CloseOutput(); err != nil {
+		t.Fatalf("CloseOutput with StdoutWriter error = %v", err)
+	}
+}
+
 func TestSaveResultFacadeCallbackAndDisabledSave(t *testing.T) {
 	preserveOutputAPIGlobals(t)
 

common/parsers/host_iterator_test.go

@@ -1,8 +1,10 @@
 package parsers
 
 import (
+	"bufio"
 	"context"
 	"errors"
+	"net"
 	"os"
 	"reflect"
 	"strings"
@@ -166,3 +168,777 @@ func (s *closeTrackingSource) Close() error {
 	s.closed = true
 	return s.err
 }
+
+// =============================================================================
+// newHostSource 分支覆盖
+// =============================================================================
+
+// TestNewHostSource_Shortcuts 验证 192/172/10 快捷方式展开为正确 CIDR
+func TestNewHostSource_Shortcuts(t *testing.T) {
+	cases := []struct {
+		input     string
+		wantFirst string
+	}{
+		{"192", "192.168.0.1"},
+		{"172", "172.16.0.1"},
+		{"10", "10.0.0.1"},
+	}
+	for _, c := range cases {
+		t.Run(c.input, func(t *testing.T) {
+			src, err := newHostSource(c.input)
+			if err != nil {
+				t.Fatalf("newHostSource(%q) error = %v", c.input, err)
+			}
+			defer src.Close()
+			host, ok, err := src.Next()
+			if err != nil || !ok {
+				t.Fatalf("Next() = %q/%v/%v", host, ok, err)
+			}
+			if host != c.wantFirst {
+				t.Errorf("first host = %q, 期望 %q", host, c.wantFirst)
+			}
+		})
+	}
+}
+
+// TestNewHostSource_CIDRBranch 验证含 "/" 走 CIDR 分支
+func TestNewHostSource_CIDRBranch(t *testing.T) {
+	src, err := newHostSource("10.0.0.0/30")
+	if err != nil {
+		t.Fatalf("newHostSource CIDR error = %v", err)
+	}
+	defer src.Close()
+	host, ok, _ := src.Next()
+	if !ok || host != "10.0.0.1" {
+		t.Errorf("CIDR first host = %q, 期望 10.0.0.1", host)
+	}
+}
+
+// TestNewHostSource_InvalidCIDR 无效 CIDR 返回错误
+func TestNewHostSource_InvalidCIDR(t *testing.T) {
+	_, err := newHostSource("999.0.0.0/24")
+	if err == nil {
+		t.Error("无效 CIDR 应返回 error")
+	}
+}
+
+// TestNewHostSource_RangeBranch 验证 a-b 格式走 range 分支
+func TestNewHostSource_RangeBranch(t *testing.T) {
+	src, err := newHostSource("192.168.1.5-192.168.1.7")
+	if err != nil {
+		t.Fatalf("newHostSource range error = %v", err)
+	}
+	defer src.Close()
+
+	var got []string
+	for {
+		h, ok, err := src.Next()
+		if err != nil {
+			t.Fatalf("Next() error = %v", err)
+		}
+		if !ok {
+			break
+		}
+		got = append(got, h)
+	}
+	want := []string{"192.168.1.5", "192.168.1.6", "192.168.1.7"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("range hosts = %v, 期望 %v", got, want)
+	}
+}
+
+// TestNewHostSource_RangeShortTail 验证短尾写法 x.x.x.a-b
+func TestNewHostSource_RangeShortTail(t *testing.T) {
+	src, err := newHostSource("10.0.0.3-5")
+	if err != nil {
+		t.Fatalf("newHostSource short-tail range error = %v", err)
+	}
+	defer src.Close()
+
+	var got []string
+	for {
+		h, ok, err := src.Next()
+		if err != nil {
+			t.Fatalf("Next() error = %v", err)
+		}
+		if !ok {
+			break
+		}
+		got = append(got, h)
+	}
+	want := []string{"10.0.0.3", "10.0.0.4", "10.0.0.5"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("short-tail range = %v, 期望 %v", got, want)
+	}
+}
+
+// TestNewHostSource_SingleHost 验证普通主机名走 singleHostSource 分支
+func TestNewHostSource_SingleHost(t *testing.T) {
+	src, err := newHostSource("example.com")
+	if err != nil {
+		t.Fatalf("newHostSource single error = %v", err)
+	}
+	defer src.Close()
+
+	host, ok, err := src.Next()
+	if err != nil || !ok || host != "example.com" {
+		t.Errorf("single host = %q/%v/%v, 期望 example.com/true/nil", host, ok, err)
+	}
+	// 第二次应该耗尽
+	_, ok, _ = src.Next()
+	if ok {
+		t.Error("singleHostSource 第二次 Next 应返回 ok=false")
+	}
+}
+
+// =============================================================================
+// hostMatcher.add 分支覆盖
+// =============================================================================
+
+// TestHostMatcherAdd_192Shortcut 验证 add("192") 展开为 192.168.0.0/16
+func TestHostMatcherAdd_192Shortcut(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("192"); err != nil {
+		t.Fatalf("add(192) error = %v", err)
+	}
+	if !m.match("192.168.1.100") {
+		t.Error("192.168.1.100 应命中 192.168.0.0/16")
+	}
+	if m.match("10.0.0.1") {
+		t.Error("10.0.0.1 不应命中")
+	}
+}
+
+// TestHostMatcherAdd_172Shortcut 验证 add("172")
+func TestHostMatcherAdd_172Shortcut(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("172"); err != nil {
+		t.Fatalf("add(172) error = %v", err)
+	}
+	if !m.match("172.16.0.1") {
+		t.Error("172.16.0.1 应命中 172.16.0.0/12")
+	}
+}
+
+// TestHostMatcherAdd_10Shortcut 验证 add("10")
+func TestHostMatcherAdd_10Shortcut(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("10"); err != nil {
+		t.Fatalf("add(10) error = %v", err)
+	}
+	if !m.match("10.1.2.3") {
+		t.Error("10.1.2.3 应命中 10.0.0.0/8")
+	}
+}
+
+// TestHostMatcherAdd_CIDR 验证 add 处理 CIDR 字符串
+func TestHostMatcherAdd_CIDR(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("192.168.5.0/24"); err != nil {
+		t.Fatalf("add CIDR error = %v", err)
+	}
+	if !m.match("192.168.5.10") {
+		t.Error("192.168.5.10 应命中 /24")
+	}
+	if m.match("192.168.6.10") {
+		t.Error("192.168.6.10 不应命中")
+	}
+}
+
+// TestHostMatcherAdd_Range 验证 add 处理 a-b 范围
+func TestHostMatcherAdd_Range(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("10.0.0.10-10.0.0.20"); err != nil {
+		t.Fatalf("add range error = %v", err)
+	}
+	if !m.match("10.0.0.15") {
+		t.Error("10.0.0.15 应命中范围")
+	}
+	if m.match("10.0.0.9") || m.match("10.0.0.21") {
+		t.Error("边界外不应命中")
+	}
+}
+
+// TestHostMatcherAdd_ExactHost 验证 add 处理普通主机名（exact 分支）
+func TestHostMatcherAdd_ExactHost(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("myhost.local"); err != nil {
+		t.Fatalf("add exact error = %v", err)
+	}
+	if !m.match("myhost.local") {
+		t.Error("exact 主机名应命中")
+	}
+	if m.match("other.local") {
+		t.Error("其他主机名不应命中")
+	}
+}
+
+// TestHostMatcherAdd_MultipleComma 验证逗号分隔多个值
+func TestHostMatcherAdd_MultipleComma(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("host1.com, host2.com, 192.168.1.0/30"); err != nil {
+		t.Fatalf("add comma-separated error = %v", err)
+	}
+	if !m.match("host1.com") || !m.match("host2.com") || !m.match("192.168.1.1") {
+		t.Error("逗号分隔的值应全部命中")
+	}
+}
+
+// TestHostMatcherAdd_EmptyEntry 逗号中间空串不报错
+func TestHostMatcherAdd_EmptyEntry(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add(",,,"); err != nil {
+		t.Fatalf("全空逗号不应报错: %v", err)
+	}
+}
+
+// TestHostMatcherAdd_InvalidCIDR 无效 CIDR 返回 error
+func TestHostMatcherAdd_InvalidCIDR(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.add("999.0.0.0/8"); err == nil {
+		t.Error("无效 CIDR 应返回 error")
+	}
+}
+
+// =============================================================================
+// fileHostSource.Next 分支覆盖
+// =============================================================================
+
+// TestFileHostSourceNext_SkipsEmptyAndComments 验证空行和注释行被跳过
+func TestFileHostSourceNext_SkipsEmptyAndComments(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	content := "\n# this is a comment\n\n  \n10.0.0.1\n# another comment\n10.0.0.2\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	iter, err := NewHostIterator("", path)
+	if err != nil {
+		t.Fatalf("NewHostIterator error = %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	want := []string{"10.0.0.1", "10.0.0.2"}
+	if !reflect.DeepEqual(batch, want) {
+		t.Errorf("batch = %v, 期望 %v", batch, want)
+	}
+}
+
+// TestFileHostSourceNext_MultipleSources 验证文件中每行多个 host（逗号分隔）走 multiHostSource 分支
+func TestFileHostSourceNext_MultipleSources(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	// 一行两个 host，触发 multiHostSource 分支
+	content := "10.0.0.1,10.0.0.2\n10.0.0.3\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	iter, err := NewHostIterator("", path)
+	if err != nil {
+		t.Fatalf("NewHostIterator error = %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	want := []string{"10.0.0.1", "10.0.0.2", "10.0.0.3"}
+	if !reflect.DeepEqual(batch, want) {
+		t.Errorf("batch = %v, 期望 %v", batch, want)
+	}
+}
+
+// TestFileHostSourceNext_InvalidLineSkipped 无效行（解析失败）被跳过不报错
+func TestFileHostSourceNext_InvalidLineSkipped(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	// 包含无效 CIDR，应被跳过
+	content := "999.0.0.0/8\n10.0.0.1\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("WriteFile error = %v", err)
+	}
+
+	iter, err := NewHostIterator("", path)
+	if err != nil {
+		t.Fatalf("NewHostIterator error = %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	// 无效行被跳过，只返回有效行
+	if len(batch) != 1 || batch[0] != "10.0.0.1" {
+		t.Errorf("batch = %v, 期望 [10.0.0.1]", batch)
+	}
+}
+
+// =============================================================================
+// NewHostIterator 错误路径
+// =============================================================================
+
+// TestNewHostIterator_InvalidFilename 不存在的文件应返回 error
+func TestNewHostIterator_InvalidFilename(t *testing.T) {
+	_, err := NewHostIterator("", "/nonexistent/path/hosts.txt")
+	if err == nil {
+		t.Error("不存在的文件应返回 error")
+	}
+}
+
+// TestNewHostIterator_InvalidHost host 解析失败时应返回 error（并关闭已打开的文件 source）
+func TestNewHostIterator_InvalidHost_WithFile(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	if err := os.WriteFile(path, []byte("10.0.0.1\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+	// 无效 CIDR 会让 newHostSources 失败
+	_, err := NewHostIterator("999.0.0.0/8", path)
+	if err == nil {
+		t.Error("无效 host 应返回 error")
+	}
+}
+
+// TestNewHostIterator_InvalidExclude exclude 参数无效时应返回 error
+func TestNewHostIterator_InvalidExclude(t *testing.T) {
+	_, err := NewHostIterator("10.0.0.1", "", "999.0.0.0/8")
+	if err == nil {
+		t.Error("无效 exclude 应返回 error")
+	}
+}
+
+// TestNewHostIterator_EmptyExcludeSkipped 空白 exclude 条目应被跳过，不报错
+func TestNewHostIterator_EmptyExcludeSkipped(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.1", "", "   ", "")
+	if err != nil {
+		t.Fatalf("空白 exclude 不应报错: %v", err)
+	}
+	defer iter.Close()
+	host, ok, err := iter.Next()
+	if err != nil || !ok || host != "10.0.0.1" {
+		t.Errorf("Next() = %q/%v/%v", host, ok, err)
+	}
+}
+
+// =============================================================================
+// Close 路径
+// =============================================================================
+
+// TestClose_Nil nil HostIterator Close 不 panic
+func TestClose_Nil(t *testing.T) {
+	var it *HostIterator
+	if err := it.Close(); err != nil {
+		t.Errorf("nil Close 应返回 nil, 得到 %v", err)
+	}
+}
+
+// TestClose_WithCurrent 有 current source 时 Close 应关闭它
+func TestClose_WithCurrent(t *testing.T) {
+	src := &closeTrackingSource{}
+	it := &HostIterator{current: src}
+	if err := it.Close(); err != nil {
+		t.Errorf("Close error = %v", err)
+	}
+	if !src.closed {
+		t.Error("current source 应被关闭")
+	}
+	if it.current != nil {
+		t.Error("Close 后 current 应为 nil")
+	}
+}
+
+// TestClose_SourcesError Close 中 source 返回 error 应被记录
+func TestClose_SourcesError(t *testing.T) {
+	errSrc := &closeTrackingSource{err: errors.New("close error")}
+	it := &HostIterator{sources: []hostSource{errSrc}}
+	err := it.Close()
+	if err == nil {
+		t.Error("source Close 失败时应返回 error")
+	}
+	if !errSrc.closed {
+		t.Error("出错的 source 也应被调用 Close")
+	}
+}
+
+// TestClose_CurrentErrorThenSources current Close 报错，后续 source Close 成功，返回 current 的 error
+func TestClose_CurrentErrorThenSources(t *testing.T) {
+	currentSrc := &closeTrackingSource{err: errors.New("current close error")}
+	otherSrc := &closeTrackingSource{}
+	it := &HostIterator{
+		current: currentSrc,
+		sources: []hostSource{otherSrc},
+	}
+	err := it.Close()
+	if err == nil {
+		t.Error("应返回 current 的 error")
+	}
+	if !currentSrc.closed || !otherSrc.closed {
+		t.Error("两个 source 都应被关闭")
+	}
+}
+
+// =============================================================================
+// Next 错误路径
+// =============================================================================
+
+// errorSource 让 Next() 返回 error
+type errorSource struct {
+	err error
+}
+
+func (s *errorSource) Next() (string, bool, error) { return "", false, s.err }
+func (s *errorSource) Close() error                { return nil }
+
+// errorOnCloseSource Next 返回 ok=false，Close 返回 error
+type errorOnCloseSource struct {
+	err error
+}
+
+func (s *errorOnCloseSource) Next() (string, bool, error) { return "", false, nil }
+func (s *errorOnCloseSource) Close() error                { return s.err }
+
+// TestNext_SourceNextError source.Next() 返回 error 时 iter.Next 应透传
+func TestNext_SourceNextError(t *testing.T) {
+	it := &HostIterator{
+		sources: []hostSource{&errorSource{err: errors.New("next error")}},
+	}
+	_, _, err := it.Next()
+	if err == nil {
+		t.Error("source Next error 应透传")
+	}
+}
+
+// TestNext_SourceCloseError 源耗尽时 Close 报错应透传
+func TestNext_SourceCloseError(t *testing.T) {
+	it := &HostIterator{
+		sources: []hostSource{&errorOnCloseSource{err: errors.New("close error")}},
+	}
+	_, _, err := it.Next()
+	if err == nil {
+		t.Error("source 耗尽时 Close error 应透传")
+	}
+}
+
+// =============================================================================
+// NextBatch 边界条件
+// =============================================================================
+
+// TestNextBatch_ZeroSize size=0 应使用 DefaultHostBatchSize（实际受源数量限制）
+func TestNextBatch_ZeroSize(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.1", "")
+	if err != nil {
+		t.Fatalf("NewHostIterator: %v", err)
+	}
+	defer iter.Close()
+
+	// size=0 触发默认 DefaultHostBatchSize 分支，源只有一个 host
+	batch, err := iter.NextBatch(context.Background(), 0)
+	if err != nil {
+		t.Fatalf("NextBatch(0) error = %v", err)
+	}
+	if len(batch) != 1 || batch[0] != "10.0.0.1" {
+		t.Errorf("batch = %v, 期望 [10.0.0.1]", batch)
+	}
+}
+
+// TestNextBatch_NegativeSize size<0 也应使用默认值
+func TestNextBatch_NegativeSize(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.2", "")
+	if err != nil {
+		t.Fatalf("NewHostIterator: %v", err)
+	}
+	defer iter.Close()
+
+	batch, err := iter.NextBatch(context.Background(), -1)
+	if err != nil {
+		t.Fatalf("NextBatch(-1) error = %v", err)
+	}
+	if len(batch) != 1 || batch[0] != "10.0.0.2" {
+		t.Errorf("batch = %v, 期望 [10.0.0.2]", batch)
+	}
+}
+
+// TestNextBatch_ContextCancelled context 取消应立即返回
+func TestNextBatch_ContextCancelled(t *testing.T) {
+	iter, err := NewHostIterator("10.0.0.0/8", "")
+	if err != nil {
+		t.Fatalf("NewHostIterator: %v", err)
+	}
+	defer iter.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // 立即取消
+
+	_, err = iter.NextBatch(ctx, 100)
+	if err == nil {
+		t.Error("已取消的 context 应返回 error")
+	}
+}
+
+// TestNextBatch_DeduplicatesHosts 重复 host 只保留一个
+func TestNextBatch_DeduplicatesHosts(t *testing.T) {
+	// 两个相同的单 host source
+	it := &HostIterator{
+		sources: []hostSource{
+			&singleHostSource{host: "10.0.0.1"},
+			&singleHostSource{host: "10.0.0.1"},
+		},
+	}
+	batch, err := it.NextBatch(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("NextBatch error = %v", err)
+	}
+	if len(batch) != 1 || batch[0] != "10.0.0.1" {
+		t.Errorf("batch = %v, 期望去重为 [10.0.0.1]", batch)
+	}
+}
+
+// TestNextBatch_NextError Next 报错时应透传
+func TestNextBatch_NextError(t *testing.T) {
+	it := &HostIterator{
+		sources: []hostSource{&errorSource{err: errors.New("iter error")}},
+	}
+	_, err := it.NextBatch(context.Background(), 10)
+	if err == nil {
+		t.Error("Next error 应透传到 NextBatch")
+	}
+}
+
+// =============================================================================
+// newRangeHostSource 错误路径
+// =============================================================================
+
+// TestNewRangeHostSource_TooManyDashes 超过一个 "-" 应报错（实际按首个切分：a-b-c 被 Split 成 3 段）
+func TestNewRangeHostSource_TooManyDashes(t *testing.T) {
+	// "a-b-c" Split by "-" 得到 3 段，len != 2，应报错
+	_, err := newRangeHostSource("10.0.0.1-10.0.0.5-extra")
+	if err == nil {
+		t.Error("三段格式应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidStartIP 起始 IP 无效
+func TestNewRangeHostSource_InvalidStartIP(t *testing.T) {
+	_, err := newRangeHostSource("notanip-10.0.0.5")
+	if err == nil {
+		t.Error("无效起始 IP 应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidShortTailNonNumeric 短尾不是数字应报错
+func TestNewRangeHostSource_InvalidShortTailNonNumeric(t *testing.T) {
+	// 尾部 "xyz" 不是数字
+	_, err := newRangeHostSource("10.0.0.1-xyz")
+	if err == nil {
+		t.Error("非数字短尾应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidShortTailOver255 短尾超过 255 应报错
+func TestNewRangeHostSource_InvalidShortTailOver255(t *testing.T) {
+	_, err := newRangeHostSource("10.0.0.1-300")
+	if err == nil {
+		t.Error("短尾 >255 应报错")
+	}
+}
+
+// TestNewRangeHostSource_StartGTEnd 起始 > 结束应报错
+func TestNewRangeHostSource_StartGTEnd(t *testing.T) {
+	_, err := newRangeHostSource("10.0.0.200-10.0.0.100")
+	if err == nil {
+		t.Error("start > end 应报错")
+	}
+}
+
+// TestNewRangeHostSource_InvalidFullEndIP 完整结束 IP 无效（如 "10.0.0.999"）
+func TestNewRangeHostSource_InvalidFullEndIP(t *testing.T) {
+	// end IP 包含 "." 但无效
+	_, err := newRangeHostSource("10.0.0.1-10.0.0.999")
+	if err == nil {
+		t.Error("无效结束 IP 应报错")
+	}
+}
+
+// TestNewRangeHostSource_ShortTailStartGTEnd 短尾导致 start > end 应报错
+func TestNewRangeHostSource_ShortTailStartGTEnd(t *testing.T) {
+	_, err := newRangeHostSource("10.0.0.200-100")
+	if err == nil {
+		t.Error("短尾结果 start > end 应报错")
+	}
+}
+
+// =============================================================================
+// hostMatcher.addRange 错误路径
+// =============================================================================
+
+// TestAddRange_InvalidRange addRange 传入无效范围应报错
+func TestAddRange_InvalidRange(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.addRange("notvalid-range"); err == nil {
+		t.Error("无效 range 应返回 error")
+	}
+}
+
+// TestAddRange_ValidRange addRange 正常路径
+func TestAddRange_ValidRange(t *testing.T) {
+	m := newHostMatcher()
+	if err := m.addRange("10.0.0.10-10.0.0.20"); err != nil {
+		t.Fatalf("addRange error = %v", err)
+	}
+	if !m.match("10.0.0.10") || !m.match("10.0.0.20") {
+		t.Error("addRange 边界值应命中")
+	}
+}
+
+// =============================================================================
+// hostMatcher.add 错误路径（shortcut 分支中 addCIDR 失败）
+// =============================================================================
+
+// TestHostMatcherAdd_InvalidRange add 的 range 格式无效
+func TestHostMatcherAdd_InvalidRange(t *testing.T) {
+	m := newHostMatcher()
+	// 构造一个 looksLikeIPRange 通过但 newRangeHostSource 失败的字符串
+	// "10.0.0.200-10.0.0.100" start>end 会报错
+	if err := m.add("10.0.0.200-10.0.0.100"); err == nil {
+		t.Error("无效 range (start>end) 应返回 error")
+	}
+}
+
+// =============================================================================
+// newCIDRHostSource IPv6 路径
+// =============================================================================
+
+// TestNewCIDRHostSource_IPv6Rejected IPv6 CIDR 应报错
+func TestNewCIDRHostSource_IPv6Rejected(t *testing.T) {
+	_, err := newCIDRHostSource("2001:db8::/32")
+	if err == nil {
+		t.Error("IPv6 CIDR 应被拒绝")
+	}
+}
+
+// =============================================================================
+// fileHostSource.Close 路径
+// =============================================================================
+
+// TestFileHostSource_CloseWithCurrent fileHostSource.Close 时 current != nil 分支
+func TestFileHostSource_CloseWithCurrent(t *testing.T) {
+	dir := t.TempDir()
+	path := dir + "/hosts.txt"
+	// 写入一个 CIDR，这样 fileHostSource 会持有 current source
+	if err := os.WriteFile(path, []byte("10.0.0.0/30\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	src, err := newFileHostSource(path)
+	if err != nil {
+		t.Fatalf("newFileHostSource: %v", err)
+	}
+	// 触发 current 被设置
+	_, _, _ = src.Next()
+	// 此时 current 应非 nil，Close 应正常关闭它
+	if err := src.Close(); err != nil {
+		t.Errorf("Close with current error = %v", err)
+	}
+}
+
+// TestFileHostSource_CloseNilFile file 已经为 nil 时 Close 直接返回 nil
+func TestFileHostSource_CloseNilFile(t *testing.T) {
+	src := &fileHostSource{file: nil}
+	if err := src.Close(); err != nil {
+		t.Errorf("nil file Close error = %v", err)
+	}
+}
+
+// =============================================================================
+// multiHostSource.Close 路径
+// =============================================================================
+
+// TestMultiHostSource_CloseWithCurrent Close 时 current != nil 分支
+func TestMultiHostSource_CloseWithCurrent(t *testing.T) {
+	inner := &closeTrackingSource{}
+	ms := &multiHostSource{current: inner}
+	if err := ms.Close(); err != nil {
+		t.Errorf("Close error = %v", err)
+	}
+	if !inner.closed {
+		t.Error("current 应被关闭")
+	}
+	if ms.current != nil {
+		t.Error("Close 后 current 应为 nil")
+	}
+}
+
+// =============================================================================
+// ipToUint32 IPv6 路径
+// =============================================================================
+
+// TestIpToUint32_IPv6ReturnsFalse IPv6 地址应返回 false
+func TestIpToUint32_IPv6ReturnsFalse(t *testing.T) {
+	ip := net.ParseIP("2001:db8::1")
+	_, ok := ipToUint32(ip)
+	if ok {
+		t.Error("IPv6 地址应返回 ok=false")
+	}
+}
+
+// TestIpToUint32_NilReturnsFalse nil IP 应返回 false
+func TestIpToUint32_NilReturnsFalse(t *testing.T) {
+	_, ok := ipToUint32(nil)
+	if ok {
+		t.Error("nil IP 应返回 ok=false")
+	}
+}
+
+// =============================================================================
+// 剩余未覆盖路径
+// =============================================================================
+
+// TestFileHostSource_CurrentNextError fileHostSource.Next 中 current.Next() 报错应透传
+func TestFileHostSource_CurrentNextError(t *testing.T) {
+	src := &fileHostSource{
+		current: &errorSource{err: errors.New("inner error")},
+		// scanner 为 nil——不会走到 scanner 分支
+		scanner: bufio.NewScanner(strings.NewReader("")),
+	}
+	_, _, err := src.Next()
+	if err == nil {
+		t.Error("current.Next() 报错应透传")
+	}
+}
+
+// TestMultiHostSource_InnerNextError multiHostSource.Next 中内部 source.Next() 报错应透传
+func TestMultiHostSource_InnerNextError(t *testing.T) {
+	ms := &multiHostSource{
+		sources: []hostSource{&errorSource{err: errors.New("inner error")}},
+	}
+	_, _, err := ms.Next()
+	if err == nil {
+		t.Error("内部 source.Next() 报错应透传到 multiHostSource.Next")
+	}
+}
+
+// TestNewHostSource_RangeError newHostSource range 分支中 newRangeHostSource 失败
+func TestNewHostSource_RangeError(t *testing.T) {
+	// start > end，looksLikeIPRange 通过（前半部分是有效 IP），但 newRangeHostSource 返回错误
+	_, err := newHostSource("10.0.0.200-10.0.0.100")
+	if err == nil {
+		t.Error("start>end range 应返回 error")
+	}
+}
+
+// TestNewCIDRHostSource_IPv6DirectCall 直接调用 newCIDRHostSource 传入 IPv6 CIDR
+func TestNewCIDRHostSource_IPv6DirectCall(t *testing.T) {
+	// IPv6 CIDR —— bits=128 != 32，触发 line 332-334
+	_, err := newCIDRHostSource("::1/128")
+	if err == nil {
+		t.Error("IPv6 CIDR 应被 newCIDRHostSource 拒绝 (bits!=32)")
+	}
+}

common/session_test.go

@@ -6,6 +6,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/shadow1ng/fscan/common/output"
 )
 
 func TestScanSessionLogMethodsHonorSilentConfig(t *testing.T) {
@@ -161,6 +163,85 @@ func TestParseProxyURLExtractsAuthWithoutScheme(t *testing.T) {
 	}
 }
 
+// TestScanSessionSaveResultUsesSink 测试 SaveResult 通过 ResultSink 分发
+func TestScanSessionSaveResultUsesSink(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	cfg := NewConfig()
+	cfg.Output.DisableSave = true
+	SetGlobalConfig(cfg)
+	flagVars = &FlagVars{DisableSave: true}
+	_ = InitOutput()
+
+	var sinkGot *output.ScanResult
+	session := NewScanSession(cfg, NewState(), &FlagVars{})
+	session.ResultSink = func(r *output.ScanResult) error {
+		sinkGot = r
+		return nil
+	}
+
+	result := &output.ScanResult{
+		Type:   output.TypeHost,
+		Target: "10.0.0.1",
+		Status: "ALIVE",
+	}
+	if err := session.SaveResult(result); err != nil {
+		t.Fatalf("session.SaveResult error = %v", err)
+	}
+	if sinkGot != result {
+		t.Fatalf("ResultSink 未被调用或参数不符: got %v", sinkGot)
+	}
+}
+
+// TestScanSessionSaveResultFallsBackToGlobal 测试无 sink 时回退到全局 SaveResult
+func TestScanSessionSaveResultFallsBackToGlobal(t *testing.T) {
+	preserveOutputAPIGlobals(t)
+
+	cfg := NewConfig()
+	cfg.Output.DisableSave = true
+	SetGlobalConfig(cfg)
+	flagVars = &FlagVars{DisableSave: true}
+	_ = InitOutput()
+
+	called := false
+	SetResultCallback(func(payload interface{}) {
+		called = true
+	})
+
+	session := NewScanSession(cfg, NewState(), &FlagVars{})
+	// 不设置 ResultSink，应回退到全局
+
+	result := &output.ScanResult{
+		Type:   output.TypeHost,
+		Target: "10.0.0.2",
+		Status: "ALIVE",
+	}
+	if err := session.SaveResult(result); err != nil {
+		t.Fatalf("session.SaveResult (fallback) error = %v", err)
+	}
+	if !called {
+		t.Fatal("回退到全局 SaveResult 时应触发 ResultCallback")
+	}
+}
+
+// TestScanSessionLogMethodsEnabledByDefault 测试非 Silent 配置下 Log 方法不被屏蔽
+func TestScanSessionLogMethodsEnabledByDefault(t *testing.T) {
+	cfg := NewConfig()
+	cfg.Output.Silent = false
+	session := NewScanSession(cfg, NewState(), &FlagVars{})
+	if !session.loggingEnabled() {
+		t.Fatal("非 Silent 配置下 loggingEnabled 应返回 true")
+	}
+}
+
+// TestNilScanSessionLoggingEnabled 测试 nil session 的 loggingEnabled
+func TestNilScanSessionLoggingEnabled(t *testing.T) {
+	var session *ScanSession
+	if !session.loggingEnabled() {
+		t.Fatal("nil session 的 loggingEnabled 应返回 true（安全降级）")
+	}
+}
+
 type roundTripFunc func(*http.Request) (*http.Response, error)
 
 func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {

common/state_test.go

@@ -215,6 +215,300 @@ func TestState_ConcurrentTaskCounters(t *testing.T) {
 	}
 }
 
+// TestState_GetOutputMutex 测试获取输出互斥锁指针
+func TestState_GetOutputMutex(t *testing.T) {
+	s := NewState()
+	mu := s.GetOutputMutex()
+	if mu == nil {
+		t.Fatal("GetOutputMutex returned nil")
+	}
+	// 验证返回的指针可以正常加锁
+	mu.Lock()
+	mu.Unlock()
+}
+
+// TestState_GetICMPLimiter 测试 ICMP 限速器延迟初始化
+func TestState_GetICMPLimiter(t *testing.T) {
+	s := NewState()
+
+	limiter := s.GetICMPLimiter(0.1)
+	if limiter == nil {
+		t.Fatal("GetICMPLimiter returned nil")
+	}
+
+	// 再次调用应返回同一个实例（sync.Once 保证）
+	limiter2 := s.GetICMPLimiter(0.5)
+	if limiter != limiter2 {
+		t.Fatal("GetICMPLimiter should return the same instance on repeated calls")
+	}
+}
+
+// TestState_GetICMPLimiterMinRate 测试极低速率下的 ICMP 限速器
+func TestState_GetICMPLimiterMinRate(t *testing.T) {
+	s := NewState()
+	// 极低速率（packetsPerSecond < 1）应被钳位到 1
+	limiter := s.GetICMPLimiter(0.000001)
+	if limiter == nil {
+		t.Fatal("GetICMPLimiter with tiny rate returned nil")
+	}
+}
+
+// TestState_GetPerfStats 测试性能统计数据
+func TestState_GetPerfStats(t *testing.T) {
+	s := NewState()
+
+	// 初始状态：全零
+	stats := s.GetPerfStats()
+	if stats.TotalPackets != 0 {
+		t.Errorf("初始 TotalPackets 应为 0, 实际 %d", stats.TotalPackets)
+	}
+	if stats.SuccessRate != 0 {
+		t.Errorf("初始 SuccessRate 应为 0, 实际 %f", stats.SuccessRate)
+	}
+
+	// 增加一些计数后验证统计
+	s.IncrementTCPSuccessPacketCount()
+	s.IncrementTCPSuccessPacketCount()
+	s.IncrementTCPFailedPacketCount()
+	s.SetNum(3)
+
+	stats = s.GetPerfStats()
+	if stats.TotalPackets != 3 {
+		t.Errorf("TotalPackets 期望 3, 实际 %d", stats.TotalPackets)
+	}
+	if stats.TCPSuccess != 2 {
+		t.Errorf("TCPSuccess 期望 2, 实际 %d", stats.TCPSuccess)
+	}
+	if stats.TCPFailed != 1 {
+		t.Errorf("TCPFailed 期望 1, 实际 %d", stats.TCPFailed)
+	}
+	if stats.TargetsScanned != 3 {
+		t.Errorf("TargetsScanned 期望 3, 实际 %d", stats.TargetsScanned)
+	}
+	// success rate = 2/3 * 100 ≈ 66.67%
+	if stats.SuccessRate < 66 || stats.SuccessRate > 67 {
+		t.Errorf("SuccessRate 期望约 66.67, 实际 %f", stats.SuccessRate)
+	}
+}
+
+// TestState_GetPerfStatsJSON 测试性能统计 JSON 序列化
+func TestState_GetPerfStatsJSON(t *testing.T) {
+	s := NewState()
+	s.IncrementTCPSuccessPacketCount()
+
+	json := s.GetPerfStatsJSON()
+	if json == "" || json == "{}" {
+		t.Fatalf("GetPerfStatsJSON 返回空: %q", json)
+	}
+	if len(json) < 10 {
+		t.Fatalf("GetPerfStatsJSON 内容过短: %q", json)
+	}
+	// 验证包含关键字段
+	for _, key := range []string{"total_packets", "tcp_success", "success_rate"} {
+		if !containsStr(json, key) {
+			t.Errorf("GetPerfStatsJSON 缺少字段 %q", key)
+		}
+	}
+}
+
+func containsStr(s, sub string) bool {
+	return len(s) >= len(sub) && (s == sub || len(s) > 0 && stringContains(s, sub))
+}
+
+func stringContains(s, sub string) bool {
+	for i := 0; i <= len(s)-len(sub); i++ {
+		if s[i:i+len(sub)] == sub {
+			return true
+		}
+	}
+	return false
+}
+
+// TestState_GetPacketLimiter 测试通用发包限速器
+func TestState_GetPacketLimiter(t *testing.T) {
+	t.Run("零速率返回nil", func(t *testing.T) {
+		s := NewState()
+		limiter := s.GetPacketLimiter(0)
+		if limiter != nil {
+			t.Fatal("零速率应返回 nil limiter")
+		}
+	})
+
+	t.Run("负速率返回nil", func(t *testing.T) {
+		s := NewState()
+		limiter := s.GetPacketLimiter(-1)
+		if limiter != nil {
+			t.Fatal("负速率应返回 nil limiter")
+		}
+	})
+
+	t.Run("正速率初始化限速器", func(t *testing.T) {
+		s := NewState()
+		limiter := s.GetPacketLimiter(600) // 600/min = 10/s
+		if limiter == nil {
+			t.Fatal("正速率应返回非 nil limiter")
+		}
+		// 再次调用返回同一实例
+		limiter2 := s.GetPacketLimiter(1200)
+		if limiter != limiter2 {
+			t.Fatal("GetPacketLimiter 应通过 sync.Once 复用实例")
+		}
+	})
+
+	t.Run("低速率被钳位到1pps", func(t *testing.T) {
+		s := NewState()
+		// 1/min < 1/s，应被钳位
+		limiter := s.GetPacketLimiter(1)
+		if limiter == nil {
+			t.Fatal("低速率钳位后应返回非 nil limiter")
+		}
+	})
+}
+
+// TestState_CacheService 测试服务识别缓存
+func TestState_CacheService(t *testing.T) {
+	s := NewState()
+
+	// 未缓存时查询返回 false
+	_, ok := s.GetCachedService("192.168.1.1:80")
+	if ok {
+		t.Fatal("未缓存的 key 不应返回 ok=true")
+	}
+
+	// 缓存并查询
+	type fakeInfo struct{ Name string }
+	info := &fakeInfo{Name: "http"}
+	s.CacheService("192.168.1.1:80", info)
+
+	got, ok := s.GetCachedService("192.168.1.1:80")
+	if !ok {
+		t.Fatal("已缓存的 key 应返回 ok=true")
+	}
+	if got != info {
+		t.Fatalf("GetCachedService 返回 %v, 期望 %v", got, info)
+	}
+
+	// 不同 key 互不干扰
+	_, ok = s.GetCachedService("192.168.1.1:443")
+	if ok {
+		t.Fatal("不同 key 不应命中缓存")
+	}
+}
+
+// =============================================================================
+// CheckAndIncrementPacketRate 测试
+// =============================================================================
+
+// TestCheckAndIncrementPacketRate_ZeroLimit 速率为 0 时无限制
+func TestCheckAndIncrementPacketRate_ZeroLimit(t *testing.T) {
+	s := NewState()
+	for i := 0; i < 1000; i++ {
+		ok, err := s.CheckAndIncrementPacketRate(0)
+		if !ok || err != nil {
+			t.Fatalf("零速率限制应始终允许: ok=%v err=%v", ok, err)
+		}
+	}
+}
+
+// TestCheckAndIncrementPacketRate_NegativeLimit 负速率等同于无限制
+func TestCheckAndIncrementPacketRate_NegativeLimit(t *testing.T) {
+	s := NewState()
+	ok, err := s.CheckAndIncrementPacketRate(-1)
+	if !ok || err != nil {
+		t.Fatalf("负速率应允许: ok=%v err=%v", ok, err)
+	}
+}
+
+// TestCheckAndIncrementPacketRate_AllowsWhenTokensAvailable 有令牌时返回 true
+func TestCheckAndIncrementPacketRate_AllowsWhenTokensAvailable(t *testing.T) {
+	s := NewState()
+	// 600/min = 10/s，桶容量 20，初始满桶
+	ok, err := s.CheckAndIncrementPacketRate(600)
+	if !ok || err != nil {
+		t.Fatalf("初始应有令牌: ok=%v err=%v", ok, err)
+	}
+}
+
+// TestCheckAndIncrementPacketRate_RateLimitedAfterExhaustion 耗尽令牌后返回 false 和 PacketLimitError
+func TestCheckAndIncrementPacketRate_RateLimitedAfterExhaustion(t *testing.T) {
+	s := NewState()
+	// 极低速率：1/min，桶容量为 1（钳位后 packetsPerSecond=1，capacity=2）
+	// 消耗掉所有令牌后应被限速
+	const limit int64 = 1
+
+	// 初始化限速器（第一次调用触发 sync.Once）
+	s.GetPacketLimiter(limit)
+
+	// 消耗完所有令牌（容量 <= 2）
+	for i := 0; i < 10; i++ {
+		s.CheckAndIncrementPacketRate(limit) //nolint: errcheck
+	}
+
+	// 此时令牌应已耗尽，下一次调用应被限速
+	ok, err := s.CheckAndIncrementPacketRate(limit)
+	if ok {
+		// 桶可能还剩令牌（容量 2），多耗几次再判断
+		for i := 0; i < 20; i++ {
+			ok, err = s.CheckAndIncrementPacketRate(limit)
+			if !ok {
+				break
+			}
+		}
+	}
+
+	if ok {
+		t.Fatal("令牌耗尽后应返回 ok=false")
+	}
+	if err == nil {
+		t.Fatal("令牌耗尽后应返回 error")
+	}
+	if !isPacketLimitError(err) {
+		t.Errorf("error 类型应为 PacketLimitError, 实际 %T: %v", err, err)
+	}
+}
+
+// isPacketLimitError 检查是否为 PacketLimitError
+func isPacketLimitError(err error) bool {
+	_, ok := err.(*PacketLimitError)
+	return ok
+}
+
+// TestCheckAndIncrementPacketRate_ErrorUnwrapsToSentinel 验证 error 可 unwrap 到 sentinel
+func TestCheckAndIncrementPacketRate_ErrorUnwrapsToSentinel(t *testing.T) {
+	s := NewState()
+	const limit int64 = 1
+
+	// 耗尽令牌
+	for i := 0; i < 50; i++ {
+		s.CheckAndIncrementPacketRate(limit) //nolint: errcheck
+	}
+
+	var lastErr error
+	for i := 0; i < 10; i++ {
+		ok, err := s.CheckAndIncrementPacketRate(limit)
+		if !ok {
+			lastErr = err
+			break
+		}
+	}
+
+	if lastErr == nil {
+		t.Skip("未能触发限速（可能令牌桶容量较大），跳过 unwrap 测试")
+	}
+
+	// 验证可 unwrap 到 ErrPacketRateLimited
+	pErr, ok := lastErr.(*PacketLimitError)
+	if !ok {
+		t.Fatalf("期望 *PacketLimitError, 实际 %T", lastErr)
+	}
+	if pErr.Sentinel != ErrPacketRateLimited {
+		t.Errorf("Sentinel = %v, 期望 ErrPacketRateLimited", pErr.Sentinel)
+	}
+	if pErr.Limit != limit {
+		t.Errorf("Limit = %d, 期望 %d", pErr.Limit, limit)
+	}
+}
+
 // TestState_OutputMutex 测试输出互斥锁
 func TestState_OutputMutex(t *testing.T) {
 	s := NewState()

core/adaptive_pool_test.go

@@ -1,6 +1,7 @@
 package core
 
 import (
+	"sync/atomic"
 	"testing"
 	"time"
 )
@@ -152,3 +153,121 @@ func TestAdaptivePool_Wait(t *testing.T) {
 
 	t.Logf("Wait 测试通过: %v", duration)
 }
+
+// =============================================================================
+// maybeReduceTarget 补充覆盖
+// =============================================================================
+
+// TestMaybeReduceTarget_NoOpWhenRTTLow rttRatio <= 3.0 时不修改 target
+func TestMaybeReduceTarget_NoOpWhenRTTLow(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(100, 100, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	initialTarget := atomic.LoadInt32(&pool.target)
+
+	// RTTRatio 样本不足（< 20）返回 1.0，远低于 3.0 阈值
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	if afterTarget != initialTarget {
+		t.Errorf("rttRatio <= 3.0 时 target 不应改变: %d -> %d", initialTarget, afterTarget)
+	}
+}
+
+// TestMaybeReduceTarget_ReducesWhenRTTHigh rttRatio > 3.0 时压低 target 10%
+func TestMaybeReduceTarget_ReducesWhenRTTHigh(t *testing.T) {
+	metrics := &ScanMetrics{}
+	pool, err := NewAdaptivePool(200, 200, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 伪造 RTT：让 fastEMA >> slowEMA，ratio > 3.0
+	// 方法：先用大 RTT 建立 fastEMA，再用小 RTT 建立 slowEMA
+	// 更直接：直接操作 atomic 字段（包内测试可以访问）
+	for i := 0; i < 25; i++ {
+		metrics.RecordConnect(10 * time.Millisecond) // 先建 baseline
+	}
+	// 现在把 fastEMA 人为拉高（写入一个远大于 slowEMA 的值）
+	pool.metrics.rttFastNs.Store(int64(400 * time.Millisecond))
+	pool.metrics.rttSlowNs.Store(int64(10 * time.Millisecond))
+
+	initialTarget := atomic.LoadInt32(&pool.target)
+
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	if afterTarget >= initialTarget {
+		t.Errorf("rttRatio > 3.0 时 target 应被压低: %d -> %d", initialTarget, afterTarget)
+	}
+
+	// 验证是 ×0.9
+	expected := int32(float64(initialTarget) * 0.9)
+	if afterTarget != expected {
+		t.Errorf("target 应为 %d (×0.9), 实际 %d", expected, afterTarget)
+	}
+}
+
+// TestMaybeReduceTarget_ClampToMinTarget target 压低后不低于 ceiling/5 或 10
+func TestMaybeReduceTarget_ClampToMinTarget(t *testing.T) {
+	metrics := &ScanMetrics{}
+	// ceiling=20, minTarget = max(20/5, 10) = 10
+	// target=10, newTarget = int(10*0.9) = 9 → 被 clamp 到 10 → newTarget == target → 不更新
+	pool, err := NewAdaptivePool(10, 20, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	// 强制设置 target=10（初始值就是 10，但确认一下）
+	atomic.StoreInt32(&pool.target, 10)
+
+	// 伪造 rttRatio > 3.0
+	for i := 0; i < 25; i++ {
+		metrics.RecordConnect(10 * time.Millisecond)
+	}
+	pool.metrics.rttFastNs.Store(int64(400 * time.Millisecond))
+	pool.metrics.rttSlowNs.Store(int64(10 * time.Millisecond))
+
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	// newTarget=9 < minTarget=10 → clamp 到 10 → 10 == target → 不写入
+	if afterTarget != 10 {
+		t.Errorf("clamp 后 target 应保持 10, 实际 %d", afterTarget)
+	}
+}
+
+// TestMaybeReduceTarget_LargeCeilingMinTarget ceiling 足够大时 minTarget = ceiling/5
+func TestMaybeReduceTarget_LargeCeilingMinTarget(t *testing.T) {
+	metrics := &ScanMetrics{}
+	// ceiling=100, minTarget = 100/5 = 20
+	// target=21 → newTarget = int(21*0.9) = 18 → clamp 到 20
+	pool, err := NewAdaptivePool(21, 100, func(interface{}) {}, metrics)
+	if err != nil {
+		t.Fatalf("创建线程池失败: %v", err)
+	}
+	defer pool.Release()
+
+	atomic.StoreInt32(&pool.target, 21)
+	atomic.StoreInt32(&pool.ceiling, 100)
+
+	for i := 0; i < 25; i++ {
+		metrics.RecordConnect(10 * time.Millisecond)
+	}
+	pool.metrics.rttFastNs.Store(int64(400 * time.Millisecond))
+	pool.metrics.rttSlowNs.Store(int64(10 * time.Millisecond))
+
+	pool.maybeReduceTarget()
+
+	afterTarget := atomic.LoadInt32(&pool.target)
+	// newTarget=18 < minTarget=20 → store 20; 20 < 21 → 更新
+	if afterTarget != 20 {
+		t.Errorf("应 clamp 到 minTarget=20, 实际 %d", afterTarget)
+	}
+}

core/base_scan_strategy_test.go

@@ -462,3 +462,134 @@ func TestBaseScanStrategy_ValidateConfiguration(t *testing.T) {
 		t.Errorf("ValidateConfiguration 应返回 nil, 实际: %v", err)
 	}
 }
+
+// =============================================================================
+// IsPluginApplicableByName 补充覆盖
+// =============================================================================
+
+// TestIsPluginApplicableByName_FullModeWebPlugin 测试 -full 模式下 web 插件对任意端口生效
+func TestIsPluginApplicableByName_FullModeWebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	clearServiceCache()
+
+	cfg := common.NewConfig()
+	cfg.POC.Full = true
+
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// webtitle 是 web 插件；-full 模式下不检查 IsMarkedWebService，直接走 passesFilterType
+	// FilterService 不允许 local/udp，但允许 web 插件
+	got := strategy.IsPluginApplicableByName("webtitle", "10.0.0.1", 12345, false, cfg)
+	if !got {
+		t.Error("full 模式下 web 插件应对任意端口返回 true")
+	}
+}
+
+// TestIsPluginApplicableByName_FullModeNonWebPlugin 确认 -full 不影响非 web 插件的端口匹配
+func TestIsPluginApplicableByName_FullModeNonWebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	clearServiceCache()
+
+	cfg := common.NewConfig()
+	cfg.POC.Full = true
+
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// ssh 不是 web 插件，-full 无特殊逻辑，走普通端口匹配
+	// ssh 默认端口 22；用 99999 端口应该不匹配
+	got := strategy.IsPluginApplicableByName("ssh", "10.0.0.1", 99999, false, cfg)
+	if got {
+		t.Error("-full 模式对非 web 插件不应绕过端口匹配")
+	}
+}
+
+// =============================================================================
+// isPluginApplicableToPort 补充覆盖
+// =============================================================================
+
+// TestIsPluginApplicableToPort_WebPlugin web 插件忽略端口直接返回 true
+func TestIsPluginApplicableToPort_WebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// webtitle 是 web 插件，任何端口都应返回 true
+	if !strategy.isPluginApplicableToPort("webtitle", 8080) {
+		t.Error("web 插件在任意端口应返回 true")
+	}
+	if !strategy.isPluginApplicableToPort("webtitle", 0) {
+		t.Error("web 插件在端口 0 也应返回 true")
+	}
+}
+
+// TestIsPluginApplicableToPort_NonWebPlugin 非 web 插件走端口匹配逻辑
+func TestIsPluginApplicableToPort_NonWebPlugin(t *testing.T) {
+	registerTestPlugins(t)
+	clearServiceCache()
+	strategy := NewBaseScanStrategy("service", FilterService)
+
+	// ssh 端口 22 匹配
+	if !strategy.isPluginApplicableToPort("ssh", 22) {
+		t.Error("ssh 应匹配端口 22")
+	}
+	// ssh 端口 9999 不匹配（无服务缓存）
+	if strategy.isPluginApplicableToPort("ssh", 9999) {
+		t.Error("ssh 不应匹配端口 9999")
+	}
+}
+
+// =============================================================================
+// isPluginPassesFilterType 补充覆盖
+// =============================================================================
+
+// TestIsPluginPassesFilterType_CustomMode isCustomMode=true 应直接跳过过滤返回 true（非 UDP）
+func TestIsPluginPassesFilterType_CustomMode(t *testing.T) {
+	registerTestPlugins(t)
+	cfg := common.NewConfig()
+
+	// FilterLocal 策略下 custom mode 也应通过
+	localStrategy := NewBaseScanStrategy("local", FilterLocal)
+	if !localStrategy.isPluginPassesFilterType("ssh", true, cfg) {
+		t.Error("custom mode 下非 UDP 插件应直接返回 true")
+	}
+
+	// FilterService 策略下 custom mode 也应通过
+	serviceStrategy := NewBaseScanStrategy("service", FilterService)
+	if !serviceStrategy.isPluginPassesFilterType("ssh", true, cfg) {
+		t.Error("custom mode 下 service 策略应直接返回 true")
+	}
+}
+
+// TestIsPluginPassesFilterType_FilterNoneNonLocal FilterNone + 普通 TCP 插件 → true
+func TestIsPluginPassesFilterType_FilterNoneNonLocal(t *testing.T) {
+	registerTestPlugins(t)
+	cfg := common.NewConfig()
+
+	noneStrategy := NewBaseScanStrategy("none", FilterNone)
+
+	// ssh 不是 local 插件，FilterNone 应直接返回 true
+	if !noneStrategy.isPluginPassesFilterType("ssh", false, cfg) {
+		t.Error("FilterNone + 非 local 插件应返回 true")
+	}
+	if !noneStrategy.isPluginPassesFilterType("redis", false, cfg) {
+		t.Error("FilterNone + 非 local 插件 redis 应返回 true")
+	}
+}
+
+// TestIsPluginPassesFilterType_FilterNoneLocalPlugin FilterNone + local 插件：需要 -local 显式指定
+func TestIsPluginPassesFilterType_FilterNoneLocalPlugin(t *testing.T) {
+	plugins.RegisterWithOptions("core_test_local_none", func() plugins.Plugin { return nil }, nil, []string{plugins.PluginTypeLocal}, false)
+	cfg := common.NewConfig()
+
+	noneStrategy := NewBaseScanStrategy("none", FilterNone)
+
+	// 未指定 LocalPlugin，应返回 false
+	if noneStrategy.isPluginPassesFilterType("core_test_local_none", false, cfg) {
+		t.Error("FilterNone + local 插件未显式指定时应返回 false")
+	}
+
+	// 指定后应返回 true
+	cfg.LocalPlugin = "core_test_local_none"
+	if !noneStrategy.isPluginPassesFilterType("core_test_local_none", false, cfg) {
+		t.Error("FilterNone + local 插件显式指定后应返回 true")
+	}
+}

core/portfinger/version_parser_test.go

@@ -529,3 +529,72 @@ func TestExtras_ToMap_EmptyStringFiltering(t *testing.T) {
 		}
 	})
 }
+
+// =============================================================================
+// ParseVersionInfo 测试
+// =============================================================================
+
+func TestParseVersionInfo(t *testing.T) {
+	tests := []struct {
+		name        string
+		versionInfo string
+		foundItems  []string
+		wantVP      string // VendorProduct
+		wantVer     string // Version
+		wantCPE     string
+	}{
+		{
+			name:        "只有product-斜线分隔符",
+			versionInfo: " p/Apache/",
+			wantVP:      "Apache",
+		},
+		{
+			name:        "product和version-斜线分隔符",
+			versionInfo: " p/nginx/ v/1.18.0/",
+			wantVP:      "nginx",
+			wantVer:     "1.18.0",
+		},
+		{
+			name:        "pipe分隔符",
+			versionInfo: " p|OpenSSH| v|8.2p1|",
+			wantVP:      "OpenSSH",
+			wantVer:     "8.2p1",
+		},
+		{
+			name:        "含$1占位符替换后解析",
+			versionInfo: " p/OpenSSH/ v/$1/",
+			foundItems:  []string{"8.2p1"},
+			wantVP:      "OpenSSH",
+			wantVer:     "8.2p1",
+		},
+		{
+			name:        "CPE解析",
+			versionInfo: " cpe:/a:apache:httpd:2.4.41",
+			wantCPE:     "a:apache:httpd:2.4.41",
+		},
+		{
+			name:        "空VersionInfo返回全空Extras",
+			versionInfo: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m := &Match{
+				VersionInfo: tt.versionInfo,
+				FoundItems:  tt.foundItems,
+			}
+			got := m.ParseVersionInfo(nil)
+
+			if got.VendorProduct != tt.wantVP {
+				t.Errorf("VendorProduct = %q, want %q", got.VendorProduct, tt.wantVP)
+			}
+			if got.Version != tt.wantVer {
+				t.Errorf("Version = %q, want %q", got.Version, tt.wantVer)
+			}
+			if got.CPE != tt.wantCPE {
+				t.Errorf("CPE = %q, want %q", got.CPE, tt.wantCPE)
+			}
+		})
+	}
+}

core/scan_metrics_test.go

@@ -2,6 +2,7 @@ package core
 
 import (
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 )
@@ -128,3 +129,114 @@ func TestScanMetrics_ConcurrentSafety(t *testing.T) {
 	// 验证 RTTRatio 不 panic
 	_ = m.RTTRatio()
 }
+
+// =============================================================================
+// 补充测试：按题目要求的函数名
+// =============================================================================
+
+// TestScanMetricsTotal — 各计数器各调一次，Total() 应返回 4
+func TestScanMetricsTotal(t *testing.T) {
+	m := &ScanMetrics{}
+	m.RecordConnect(time.Millisecond)
+	m.RecordRefused(time.Millisecond)
+	m.RecordTimeout()
+	m.RecordExhausted()
+	if got := m.Total(); got != 4 {
+		t.Errorf("Total() = %d, want 4", got)
+	}
+}
+
+// TestScanMetricsSnapshot — 记录数据后 Snapshot() 返回正确快照
+func TestScanMetricsSnapshot(t *testing.T) {
+	m := &ScanMetrics{}
+	m.RecordConnect(5 * time.Millisecond)
+	m.RecordConnect(10 * time.Millisecond)
+	m.RecordRefused(2 * time.Millisecond)
+	m.RecordTimeout()
+	m.RecordExhausted()
+
+	snap := m.Snapshot()
+	tests := []struct {
+		name string
+		got  int64
+		want int64
+	}{
+		{"Connects", snap.Connects, 2},
+		{"Refused", snap.Refused, 1},
+		{"Timeouts", snap.Timeouts, 1},
+		{"Exhausted", snap.Exhausted, 1},
+	}
+	for _, tt := range tests {
+		if tt.got != tt.want {
+			t.Errorf("Snapshot.%s = %d, want %d", tt.name, tt.got, tt.want)
+		}
+	}
+	if snap.RTTFastNs <= 0 {
+		t.Errorf("Snapshot.RTTFastNs = %d, want > 0", snap.RTTFastNs)
+	}
+}
+
+// TestScanMetricsRTTRatio — 样本不足返回 1.0；20+ 个相同 RTT 接近 1.0
+func TestScanMetricsRTTRatio(t *testing.T) {
+	t.Run("样本不足返回1.0", func(t *testing.T) {
+		m := &ScanMetrics{}
+		for i := 0; i < 19; i++ {
+			m.RecordConnect(time.Millisecond)
+		}
+		if r := m.RTTRatio(); r != 1.0 {
+			t.Errorf("样本不足 RTTRatio() = %f, want 1.0", r)
+		}
+	})
+
+	t.Run("稳定RTT接近1.0", func(t *testing.T) {
+		m := &ScanMetrics{}
+		for i := 0; i < 30; i++ {
+			m.RecordConnect(10 * time.Millisecond)
+		}
+		r := m.RTTRatio()
+		if r < 0.9 || r > 1.1 {
+			t.Errorf("稳定RTT下 RTTRatio() = %f, want ~1.0", r)
+		}
+	})
+}
+
+// TestScanMetricsRTTFast — 初始为 0，记录后非零
+func TestScanMetricsRTTFast(t *testing.T) {
+	m := &ScanMetrics{}
+	if m.RTTFast() != 0 {
+		t.Errorf("初始 RTTFast() = %v, want 0", m.RTTFast())
+	}
+	m.RecordConnect(5 * time.Millisecond)
+	if m.RTTFast() == 0 {
+		t.Errorf("记录后 RTTFast() 仍为 0")
+	}
+}
+
+// TestMetricsSnapshotTotal — MetricsSnapshot 各字段求和
+func TestMetricsSnapshotTotal(t *testing.T) {
+	snap := MetricsSnapshot{Connects: 1, Refused: 2, Timeouts: 3, Exhausted: 4}
+	if got := snap.Total(); got != 10 {
+		t.Errorf("MetricsSnapshot.Total() = %d, want 10", got)
+	}
+}
+
+// TestUpdateEMA — 直接测 updateEMA 行为
+func TestUpdateEMA(t *testing.T) {
+	t.Run("target为0时直接设为sample", func(t *testing.T) {
+		var a atomic.Int64
+		updateEMA(&a, 100, 10)
+		if got := a.Load(); got != 100 {
+			t.Errorf("初始为0时 updateEMA 结果 = %d, want 100", got)
+		}
+	})
+
+	t.Run("target非零时做EMA更新", func(t *testing.T) {
+		var a atomic.Int64
+		a.Store(200)
+		// next = 200 + (100-200)/10 = 200 - 10 = 190
+		updateEMA(&a, 100, 10)
+		if got := a.Load(); got != 190 {
+			t.Errorf("EMA更新结果 = %d, want 190", got)
+		}
+	})
+}

core/scanner_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/shadow1ng/fscan/common"
 	"github.com/shadow1ng/fscan/plugins"
@@ -433,6 +434,128 @@ func TestSelectStrategy_EmptyHostInfo(t *testing.T) {
 	}
 }
 
+// =============================================================================
+// buildScanReport 测试
+// =============================================================================
+
+// TestBuildScanReport 验证 buildScanReport 字段映射正确
+func TestBuildScanReport(t *testing.T) {
+	state := common.NewState()
+
+	// 填充各计数器
+	state.SetEnd(10)
+	state.SetNum(7)
+	state.IncrementTCPSuccessPacketCount() // +1 total, +1 tcp, +1 tcpSuccess
+	state.IncrementTCPSuccessPacketCount() // +1 total, +1 tcp, +1 tcpSuccess
+	state.IncrementTCPFailedPacketCount()  // +1 total, +1 tcp, +1 tcpFailed
+	state.IncrementUDPPacketCount()        // +1 total, +1 udp
+	state.IncrementHTTPPacketCount()       // +1 total, +1 http
+	state.IncrementResourceExhaustedCount()
+
+	start := time.Now().Add(-time.Second) // 模拟 1 秒前开始
+	report := buildScanReport(state, start)
+
+	if report.TasksTotal != 10 {
+		t.Errorf("TasksTotal = %d, 期望 10", report.TasksTotal)
+	}
+	if report.TasksCompleted != 7 {
+		t.Errorf("TasksCompleted = %d, 期望 7", report.TasksCompleted)
+	}
+	if report.Packets != 5 {
+		t.Errorf("Packets = %d, 期望 5", report.Packets)
+	}
+	if report.TCPPackets != 3 {
+		t.Errorf("TCPPackets = %d, 期望 3", report.TCPPackets)
+	}
+	if report.TCPSuccessPackets != 2 {
+		t.Errorf("TCPSuccessPackets = %d, 期望 2", report.TCPSuccessPackets)
+	}
+	if report.TCPFailedPackets != 1 {
+		t.Errorf("TCPFailedPackets = %d, 期望 1", report.TCPFailedPackets)
+	}
+	if report.UDPPackets != 1 {
+		t.Errorf("UDPPackets = %d, 期望 1", report.UDPPackets)
+	}
+	if report.HTTPPackets != 1 {
+		t.Errorf("HTTPPackets = %d, 期望 1", report.HTTPPackets)
+	}
+	if report.ResourceExhausted != 1 {
+		t.Errorf("ResourceExhausted = %d, 期望 1", report.ResourceExhausted)
+	}
+	if report.Duration < time.Millisecond {
+		t.Errorf("Duration = %v, 期望 >= 1ms", report.Duration)
+	}
+}
+
+// TestBuildScanReport_ZeroState 验证空 State 返回零值报告
+func TestBuildScanReport_ZeroState(t *testing.T) {
+	state := common.NewState()
+	start := time.Now()
+	report := buildScanReport(state, start)
+
+	if report.TasksTotal != 0 || report.TasksCompleted != 0 || report.Packets != 0 {
+		t.Errorf("空 State 期望全零报告，实际 %+v", report)
+	}
+	if report.Duration < 0 {
+		t.Errorf("Duration 不能为负: %v", report.Duration)
+	}
+}
+
+// =============================================================================
+// determineScanMode IsLocalMode 分支测试
+// =============================================================================
+
+// TestDetermineScanMode_IsLocalModeCallback 覆盖 IsLocalMode 回调分支
+func TestDetermineScanMode_IsLocalModeCallback(t *testing.T) {
+	// 保存原始值
+	origIsLocalMode := common.IsLocalMode
+	defer func() { common.IsLocalMode = origIsLocalMode }()
+
+	// 注册回调：mode == "localtest" 时认为是本地模式
+	common.IsLocalMode = func(mode string) bool {
+		return mode == "localtest"
+	}
+
+	cfg := &common.Config{
+		AliveOnly: false,
+		Mode:      "localtest",
+		LocalMode: false,
+	}
+	state := common.NewState()
+
+	mode := determineScanMode(cfg, state)
+	if mode != ScanModeLocal {
+		t.Errorf("determineScanMode() = %v, 期望 ScanModeLocal", mode)
+	}
+	// 回调命中后应同时设置 LocalMode 和 LocalPlugin
+	if !cfg.LocalMode {
+		t.Error("IsLocalMode 命中后应设置 cfg.LocalMode = true")
+	}
+	if cfg.LocalPlugin != "localtest" {
+		t.Errorf("LocalPlugin = %q, 期望 \"localtest\"", cfg.LocalPlugin)
+	}
+}
+
+// TestDetermineScanMode_IsLocalModeCallbackNoMatch 回调不命中时不影响模式
+func TestDetermineScanMode_IsLocalModeCallbackNoMatch(t *testing.T) {
+	origIsLocalMode := common.IsLocalMode
+	defer func() { common.IsLocalMode = origIsLocalMode }()
+
+	common.IsLocalMode = func(mode string) bool { return false }
+
+	cfg := &common.Config{
+		AliveOnly: false,
+		Mode:      "something",
+		LocalMode: false,
+	}
+	state := common.NewState()
+
+	mode := determineScanMode(cfg, state)
+	if mode != ScanModeService {
+		t.Errorf("回调不命中时期望 ScanModeService, 实际 %v", mode)
+	}
+}
+
 // TestCountApplicableTasks_EmptyPlugins 测试空插件列表
 func TestCountApplicableTasks_EmptyPlugins(t *testing.T) {
 	targets := []common.HostInfo{

core/service_scanner_test.go

@@ -862,3 +862,76 @@ func TestConvertToTargetInfos_DeepCopy(t *testing.T) {
 		}
 	})
 }
+
+// =============================================================================
+// mergeHostPorts 测试
+// =============================================================================
+
+func TestMergeHostPorts(t *testing.T) {
+	// 结果顺序不确定（map 遍历），用集合比较
+	toSet := func(ss []string) map[string]struct{} {
+		m := make(map[string]struct{}, len(ss))
+		for _, s := range ss {
+			m[s] = struct{}{}
+		}
+		return m
+	}
+	setsEqual := func(a, b map[string]struct{}) bool {
+		if len(a) != len(b) {
+			return false
+		}
+		for k := range a {
+			if _, ok := b[k]; !ok {
+				return false
+			}
+		}
+		return true
+	}
+
+	tests := []struct {
+		name string
+		a    []string
+		b    []string
+		want []string
+	}{
+		{
+			name: "两个空切片返回空",
+			a:    []string{},
+			b:    []string{},
+			want: []string{},
+		},
+		{
+			name: "无重复-并集",
+			a:    []string{"1.1.1.1:80"},
+			b:    []string{"2.2.2.2:443"},
+			want: []string{"1.1.1.1:80", "2.2.2.2:443"},
+		},
+		{
+			name: "有重复-去重",
+			a:    []string{"1.1.1.1:80", "2.2.2.2:443"},
+			b:    []string{"2.2.2.2:443", "3.3.3.3:22"},
+			want: []string{"1.1.1.1:80", "2.2.2.2:443", "3.3.3.3:22"},
+		},
+		{
+			name: "a为nil-返回b内容",
+			a:    nil,
+			b:    []string{"1.1.1.1:80", "2.2.2.2:443"},
+			want: []string{"1.1.1.1:80", "2.2.2.2:443"},
+		},
+		{
+			name: "b为nil-返回a内容",
+			a:    []string{"1.1.1.1:80"},
+			b:    nil,
+			want: []string{"1.1.1.1:80"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := mergeHostPorts(tt.a, tt.b)
+			if !setsEqual(toSet(got), toSet(tt.want)) {
+				t.Errorf("mergeHostPorts() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/activemq_test.go

@@ -0,0 +1,29 @@
+//go:build plugin_activemq || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifyActiveMQErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyActiveMQErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifyActiveMQErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/cassandra_test.go

@@ -5,6 +5,7 @@ package services
 import (
 	"bytes"
 	"encoding/binary"
+	"errors"
 	"strings"
 	"testing"
 )
@@ -47,3 +48,74 @@ func TestValidateCQLQueryResponseRejectsErrors(t *testing.T) {
 		t.Fatal("validateCQLQueryResponse() error = nil, want unexpected opcode error")
 	}
 }
+
+func TestClassifyCassandraErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"auth error", errors.New("authentication failed"), ErrorTypeAuth},
+		{"bad credentials", errors.New("bad credentials"), ErrorTypeAuth},
+		{"network error", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random cassandra error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyCassandraErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyCassandraErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCqlShortString(t *testing.T) {
+	got := cqlShortString("AB")
+	if len(got) != 4 || binary.BigEndian.Uint16(got[:2]) != 2 || string(got[2:]) != "AB" {
+		t.Errorf("cqlShortString(AB) = %v", got)
+	}
+	empty := cqlShortString("")
+	if len(empty) != 2 || binary.BigEndian.Uint16(empty) != 0 {
+		t.Errorf("cqlShortString empty = %v", empty)
+	}
+}
+
+func TestCqlLongString(t *testing.T) {
+	got := cqlLongString("XYZ")
+	if len(got) != 7 || binary.BigEndian.Uint32(got[:4]) != 3 || string(got[4:]) != "XYZ" {
+		t.Errorf("cqlLongString(XYZ) = %v", got)
+	}
+}
+
+func TestCqlStringMap(t *testing.T) {
+	m := map[string]string{"k": "v"}
+	got := cqlStringMap(m)
+	if got[0] != 0x00 || got[1] != 0x01 {
+		t.Errorf("count bytes wrong: %v", got[:2])
+	}
+	if !bytes.Contains(got, []byte("k")) || !bytes.Contains(got, []byte("v")) {
+		t.Errorf("missing key/value in %v", got)
+	}
+}
+
+func TestExtractClusterName(t *testing.T) {
+	tests := []struct {
+		name string
+		data []byte
+		want string
+	}{
+		{"empty", nil, "unknown"},
+		{"short", []byte{0x01, 0x02}, "unknown"},
+		{"printable", append([]byte{0x00, 0x00, 0x00, 0x01}, []byte("TestCluster")...), "TestCluster"},
+		{"binary prefix", append([]byte{0x00, 0x00, 0x00, 0x00, 0x01, 0x02}, []byte("MyCluster")...), "MyCluster"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := extractClusterName(tt.data)
+			if !strings.Contains(got, tt.want) && got != tt.want {
+				t.Errorf("extractClusterName() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/findnet_test.go

@@ -0,0 +1,183 @@
+//go:build plugin_findnet || !plugin_selective
+
+package services
+
+import (
+	"strings"
+	"testing"
+)
+
+// --- hexUnicodeToString ---
+
+func TestHexUnicodeToString(t *testing.T) {
+	p := NewFindNetPlugin()
+
+	cases := []struct {
+		name string
+		src  string
+		want string
+	}{
+		{
+			name: "empty string",
+			src:  "",
+			want: "",
+		},
+		{
+			name: "UTF-16LE TEST",
+			// T=0x54 E=0x45 S=0x53 T=0x54, LE pairs: 5400 4500 5300 5400
+			src:  "54004500530054",
+			want: "TEST",
+		},
+		{
+			name: "odd length gets padded to 4-multiple",
+			// 奇数长度补0至4的倍数："540045005300540" → "5400450053005400" → "TEST"
+			src:  "540045005300540", // 15 hex chars
+			want: "TEST",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := p.hexUnicodeToString(tc.src)
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// --- isValidHostname ---
+
+func TestIsValidHostname(t *testing.T) {
+	p := NewFindNetPlugin()
+
+	cases := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{name: "empty", input: "", want: false},
+		{name: "valid hostname", input: "test-pc", want: true},
+		{name: "single char", input: "a", want: false}, // regex requires at least 2 chars (start+middle+end)
+		{name: "too long", input: strings.Repeat("a", 256), want: false},
+		{name: "valid alphanumeric", input: "PC01", want: true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := p.isValidHostname(tc.input)
+			if got != tc.want {
+				t.Errorf("isValidHostname(%q) = %v, want %v", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
+// --- isValidNetworkAddress ---
+
+func TestIsValidNetworkAddress(t *testing.T) {
+	p := NewFindNetPlugin()
+
+	cases := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{name: "IPv4", input: "192.168.1.1", want: true},
+		{name: "IPv6 loopback", input: "::1", want: true},
+		{name: "valid hostname fallback", input: "test-host", want: true},
+		{name: "invalid", input: "not_an_ip!!!", want: false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := p.isValidNetworkAddress(tc.input)
+			if got != tc.want {
+				t.Errorf("isValidNetworkAddress(%q) = %v, want %v", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
+// --- cleanAndValidateAddress ---
+
+func TestCleanAndValidateAddress(t *testing.T) {
+	p := NewFindNetPlugin()
+
+	cases := []struct {
+		name string
+		data []byte
+		want string
+	}{
+		{
+			name: "valid IPv4 bytes",
+			data: []byte("192.168.1.100"),
+			want: "192.168.1.100",
+		},
+		{
+			name: "bytes with unprintable chars around valid IP",
+			data: append([]byte{0x00, 0x01}, append([]byte("10.0.0.1"), 0x00)...),
+			want: "10.0.0.1",
+		},
+		{
+			name: "invalid data returns empty",
+			data: []byte{0x00, 0x01, 0x02, 0x03},
+			want: "",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := p.cleanAndValidateAddress(tc.data)
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// --- NetworkInfo.Summary ---
+
+func TestNetworkInfoSummary(t *testing.T) {
+	t.Run("invalid returns discovery failed text", func(t *testing.T) {
+		ni := &NetworkInfo{Valid: false}
+		got := ni.Summary()
+		if got == "" {
+			t.Error("expected non-empty text for invalid NetworkInfo")
+		}
+		// 内容是 i18n key，只验证非空即可
+	})
+
+	t.Run("valid with hostname and IPv4", func(t *testing.T) {
+		ni := &NetworkInfo{
+			Valid:     true,
+			Hostname:  "PC01",
+			IPv4Addrs: []string{"192.168.1.1", "10.0.0.1"},
+		}
+		got := ni.Summary()
+		if got == "" {
+			t.Error("expected non-empty summary")
+		}
+	})
+}
+
+// --- parseNetworkInfo ---
+
+func TestParseNetworkInfo(t *testing.T) {
+	p := NewFindNetPlugin()
+
+	t.Run("empty data returns invalid", func(t *testing.T) {
+		info := p.parseNetworkInfo([]byte{})
+		if info.Valid {
+			t.Error("expected Valid=false for empty data")
+		}
+	})
+
+	t.Run("data without valid hostname or IP returns invalid", func(t *testing.T) {
+		// 全零数据，hostname 解析出空字符串，不会 Valid
+		info := p.parseNetworkInfo(make([]byte, 64))
+		if info.Valid {
+			t.Error("expected Valid=false for zero data")
+		}
+	})
+}

plugins/services/ftp_test.go

@@ -0,0 +1,33 @@
+//go:build plugin_ftp || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifyFTPErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"530 login incorrect", errors.New("530 login incorrect"), ErrorTypeAuth},
+		{"530 not logged in", errors.New("530 not logged in"), ErrorTypeAuth},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"too many connections", errors.New("421 there are too many connections"), ErrorTypeNetwork},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"random error", errors.New("random error"), ErrorTypeUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyFTPErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifyFTPErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/kafka_test.go

@@ -4,6 +4,7 @@ package services
 
 import (
 	"encoding/binary"
+	"errors"
 	"io"
 	"testing"
 )
@@ -61,3 +62,25 @@ func TestKafkaRecvRejectsShortResponse(t *testing.T) {
 		t.Fatal("kafkaRecv() error = nil, want invalid length error")
 	}
 }
+
+func TestClassifyKafkaErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"sasl auth failed", errors.New("sasl authentication failed"), ErrorTypeAuth},
+		{"unauthorized", errors.New("unauthorized"), ErrorTypeAuth},
+		{"broker not available", errors.New("broker not available"), ErrorTypeNetwork},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random kafka error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyKafkaErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyKafkaErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/ldap_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"errors"
 	"fmt"
 	"testing"
 
@@ -28,3 +29,25 @@ func TestLDAPDNFormatsEscapeUsernameValue(t *testing.T) {
 		t.Fatalf("escaped DN = %q", got[0])
 	}
 }
+
+func TestClassifyLDAPErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"invalid credentials", errors.New("invalid credentials"), ErrorTypeAuth},
+		{"bind failed", errors.New("bind failed"), ErrorTypeAuth},
+		{"ldap connection lost", errors.New("ldap: connection lost"), ErrorTypeNetwork},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random ldap error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyLDAPErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyLDAPErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/mongodb_test.go

@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"encoding/base64"
 	"encoding/binary"
+	"errors"
 	"strings"
 	"testing"
 	"time"
@@ -128,3 +129,25 @@ func TestBuildMongoSCRAMClientFinalBuildsProof(t *testing.T) {
 		t.Fatalf("client final = %q", got)
 	}
 }
+
+func TestClassifyMongoDBErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"bad auth", errors.New("bad auth"), ErrorTypeAuth},
+		{"dial tcp", errors.New("dial tcp connection refused"), ErrorTypeNetwork},
+		{"eof", errors.New("eof"), ErrorTypeNetwork},
+		{"unknown", errors.New("random mongodb error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyMongoDBErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyMongoDBErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/mssql_test.go

@@ -0,0 +1,30 @@
+//go:build plugin_mssql || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifyMSSQLErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"login failed", errors.New("login failed"), ErrorTypeAuth},
+		{"account locked", errors.New("account locked"), ErrorTypeAuth},
+		{"context deadline exceeded", errors.New("context deadline exceeded"), ErrorTypeNetwork},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyMSSQLErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifyMSSQLErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/mysql_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"errors"
 	"io"
 	"net"
 	"strings"
@@ -85,3 +86,51 @@ func TestMySQLConnStringRejectsUnsupportedUsernameDelimiters(t *testing.T) {
 		t.Fatal("mySQLConnString() error = nil, want unsupported delimiter error")
 	}
 }
+
+func TestMySQLConnStringRejectsAtSign(t *testing.T) {
+	info := &common.HostInfo{Host: "127.0.0.1", Port: 3306}
+	if _, err := mySQLConnString("user@host", "pass", info, time.Second); err == nil {
+		t.Fatal("mySQLConnString() error = nil, want unsupported delimiter error for @")
+	}
+}
+
+func TestMySQLConnStringRejectsSlash(t *testing.T) {
+	info := &common.HostInfo{Host: "127.0.0.1", Port: 3306}
+	if _, err := mySQLConnString("user/name", "pass", info, time.Second); err == nil {
+		t.Fatal("mySQLConnString() error = nil, want unsupported delimiter error for /")
+	}
+}
+
+func TestMySQLConnStringValidUser(t *testing.T) {
+	info := &common.HostInfo{Host: "127.0.0.1", Port: 3306}
+	dsn, err := mySQLConnString("root", "password", info, 3*time.Second)
+	if err != nil {
+		t.Fatalf("mySQLConnString() error = %v", err)
+	}
+	if dsn == "" {
+		t.Fatal("mySQLConnString() returned empty DSN")
+	}
+}
+
+func TestClassifyMySQLErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"access denied for user", errors.New("access denied for user"), ErrorTypeAuth},
+		{"host is not allowed", errors.New("host is not allowed"), ErrorTypeAuth},
+		{"too many connections", errors.New("too many connections"), ErrorTypeNetwork},
+		{"can't connect to mysql server", errors.New("can't connect to mysql server"), ErrorTypeNetwork},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyMySQLErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifyMySQLErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/neo4j_test.go

@@ -4,6 +4,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -32,3 +33,24 @@ func TestNeo4jUnauthorizedRequiresNeo4jBody(t *testing.T) {
 		t.Fatalf("testUnauthorizedAccess reported generic 200 as Neo4j: %#v", result)
 	}
 }
+
+func TestClassifyNeo4jErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"401 unauthorized", errors.New("401 unauthorized"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random neo4j error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyNeo4jErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyNeo4jErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/netbios_test.go

@@ -38,3 +38,192 @@ func appendNTLMAVPair(dst []byte, id uint16, value string) []byte {
 	}
 	return append(dst, buf...)
 }
+
+// --- NetBIOSInfo.Summary ---
+
+func TestNetBIOSInfoSummary(t *testing.T) {
+	p := NewNetBIOSPlugin()
+	_ = p // 仅用于确认插件可实例化，Summary 是值方法
+
+	cases := []struct {
+		name string
+		info NetBIOSInfo
+		want string
+	}{
+		{
+			name: "invalid returns empty",
+			info: NetBIOSInfo{Valid: false},
+			want: "",
+		},
+		{
+			name: "computer + domain no dot",
+			info: NetBIOSInfo{Valid: true, ComputerName: "PC01", DomainName: "CORP"},
+			want: "CORP\\PC01",
+		},
+		{
+			name: "computer with dot ignores domain prefix",
+			info: NetBIOSInfo{Valid: true, ComputerName: "pc01.corp.local", DomainName: "CORP"},
+			want: "pc01.corp.local",
+		},
+		{
+			name: "no computer uses server service + domain",
+			info: NetBIOSInfo{Valid: true, ServerService: "SRV01", DomainName: "CORP"},
+			want: "CORP\\SRV01",
+		},
+		{
+			name: "no computer uses workstation + netbios domain",
+			info: NetBIOSInfo{Valid: true, WorkstationService: "WKS01", NetBIOSDomainName: "WORKGROUP"},
+			want: "WORKGROUP\\WKS01",
+		},
+		{
+			name: "domain controller prefix",
+			info: NetBIOSInfo{Valid: true, ComputerName: "DC1", DomainName: "CORP", DomainControllers: "CORP"},
+			want: "DC:CORP\\DC1",
+		},
+		{
+			name: "os version appended",
+			info: NetBIOSInfo{Valid: true, ComputerName: "PC01", DomainName: "CORP", OSVersion: "Windows 10"},
+			want: "CORP\\PC01 Windows 10",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tc.info.Summary()
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// --- parseNetBIOSNames ---
+
+func TestParseNetBIOSNames(t *testing.T) {
+	p := &NetBIOSPlugin{}
+
+	t.Run("data too short", func(t *testing.T) {
+		_, err := p.parseNetBIOSNames(make([]byte, 40))
+		if err == nil {
+			t.Fatal("expected error for short data")
+		}
+	})
+
+	t.Run("numNames zero", func(t *testing.T) {
+		data := make([]byte, 57) // index 56 = 0
+		_, err := p.parseNetBIOSNames(data)
+		if err == nil {
+			t.Fatal("expected error for zero numNames")
+		}
+	})
+
+	t.Run("parses workstation and domain records", func(t *testing.T) {
+		header := make([]byte, 57)
+		header[56] = 2 // 2 records
+
+		// Record 1: WorkstationService — flagByte=0x00, nameFlags=0x04 (unique, <128)
+		rec1 := make([]byte, 18)
+		copy(rec1, []byte("TESTPC         ")) // 15 bytes
+		rec1[15] = 0x00                       // flagByte = WorkstationService
+		rec1[16] = 0x04                       // nameFlags unique
+		rec1[17] = 0x00
+
+		// Record 2: DomainName — flagByte=0x00, nameFlags=0x84 (group, >=128)
+		rec2 := make([]byte, 18)
+		copy(rec2, []byte("WORKGROUP      ")) // 15 bytes
+		rec2[15] = 0x00                       // flagByte = DomainName for group
+		rec2[16] = 0x84                       // nameFlags group
+		rec2[17] = 0x00
+
+		data := append(header, rec1...)
+		data = append(data, rec2...)
+
+		info, err := p.parseNetBIOSNames(data)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !info.Valid {
+			t.Fatal("expected Valid=true")
+		}
+		if info.WorkstationService != "TESTPC" {
+			t.Errorf("WorkstationService = %q, want TESTPC", info.WorkstationService)
+		}
+		if info.DomainName != "WORKGROUP" {
+			t.Errorf("DomainName = %q, want WORKGROUP", info.DomainName)
+		}
+	})
+}
+
+// --- cleanOSString ---
+
+func TestCleanOSString(t *testing.T) {
+	p := &NetBIOSPlugin{}
+
+	cases := []struct {
+		name string
+		data []byte
+		want string
+	}{
+		{
+			name: "empty",
+			data: []byte{},
+			want: "",
+		},
+		{
+			name: "plain ascii",
+			data: []byte("Windows Server 2019"),
+			want: "Windows Server 2019",
+		},
+		{
+			name: "double null splits sections, first is returned",
+			data: append([]byte("Windows 10\x00\x00"), []byte("Service Pack 1")...),
+			want: "Windows 10",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := p.cleanOSString(tc.data)
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// --- parseUnicodeString (NetBIOSPlugin) ---
+
+func TestNetBIOSParseUnicodeString(t *testing.T) {
+	p := &NetBIOSPlugin{}
+
+	cases := []struct {
+		name string
+		data []byte
+		want string
+	}{
+		{
+			name: "empty",
+			data: []byte{},
+			want: "",
+		},
+		{
+			name: "odd length returns empty",
+			data: []byte{0x41},
+			want: "",
+		},
+		{
+			name: "UTF-16LE AB",
+			data: []byte{0x41, 0x00, 0x42, 0x00},
+			want: "AB",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := p.parseUnicodeString(tc.data)
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

plugins/services/oracle_test.go

@@ -0,0 +1,29 @@
+//go:build plugin_oracle || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifyOracleErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"ORA-01017 invalid username/password", errors.New("ORA-01017: invalid username/password"), ErrorTypeAuth},
+		{"TNS-12541 no listener", errors.New("TNS-12541 no listener"), ErrorTypeNetwork},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyOracleErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifyOracleErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/postgresql_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"errors"
 	"strings"
 	"testing"
 
@@ -30,3 +31,25 @@ func TestPostgreSQLVulnInfoTruncatesByRune(t *testing.T) {
 		t.Fatalf("postgresql truncation helper = %q", got)
 	}
 }
+
+func TestClassifyPostgreSQLErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"password authentication failed", errors.New("password authentication failed"), ErrorTypeAuth},
+		{"pq role", errors.New("pq: role \"foo\" does not exist"), ErrorTypeAuth},
+		{"dial tcp", errors.New("dial tcp connection refused"), ErrorTypeNetwork},
+		{"eof", errors.New("eof"), ErrorTypeNetwork},
+		{"unknown", errors.New("random pg error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyPostgreSQLErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyPostgreSQLErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/rabbitmq_test.go

@@ -5,6 +5,7 @@ package services
 import (
 	"bytes"
 	"context"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -60,3 +61,24 @@ func (r *chunkedByteReader) Read(p []byte) (int, error) {
 	r.data = r.data[n:]
 	return n, nil
 }
+
+func TestClassifyRabbitMQErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"401 unauthorized", errors.New("401 unauthorized"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random rabbitmq error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyRabbitMQErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyRabbitMQErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/rdp_test.go

@@ -0,0 +1,100 @@
+//go:build plugin_rdp || !plugin_selective
+
+package services
+
+import (
+	"testing"
+
+	"github.com/shadow1ng/fscan/common/i18n"
+)
+
+func TestBuildBanner(t *testing.T) {
+	p := &RDPPlugin{}
+	fallback := i18n.GetText("rdp_remote_desktop_service")
+
+	tests := []struct {
+		name   string
+		osInfo map[string]any
+		want   string
+	}{
+		{
+			name:   "nil map",
+			osInfo: nil,
+			want:   fallback,
+		},
+		{
+			name:   "empty map",
+			osInfo: map[string]any{},
+			want:   fallback,
+		},
+		{
+			name:   "OsVerion and NetBIOSComputerName",
+			osInfo: map[string]any{"OsVerion": "Windows 10", "NetBIOSComputerName": "DESKTOP-01"},
+			want:   "RDP (Windows 10, DESKTOP-01)",
+		},
+		{
+			name:   "only OsVerion",
+			osInfo: map[string]any{"OsVerion": "Windows Server 2019"},
+			want:   "RDP (Windows Server 2019)",
+		},
+		{
+			name:   "only NetBIOSComputerName",
+			osInfo: map[string]any{"NetBIOSComputerName": "MY-HOST"},
+			want:   "RDP (Hostname:MY-HOST)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := p.buildBanner(tt.osInfo)
+			if got != tt.want {
+				t.Errorf("buildBanner() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestExtractStringField(t *testing.T) {
+	p := &RDPPlugin{}
+
+	tests := []struct {
+		name   string
+		osInfo map[string]any
+		key    string
+		want   string
+	}{
+		{
+			name:   "key exists and is string",
+			osInfo: map[string]any{"foo": "bar"},
+			key:    "foo",
+			want:   "bar",
+		},
+		{
+			name:   "key exists but not string",
+			osInfo: map[string]any{"foo": 42},
+			key:    "foo",
+			want:   "",
+		},
+		{
+			name:   "key does not exist",
+			osInfo: map[string]any{"foo": "bar"},
+			key:    "missing",
+			want:   "",
+		},
+		{
+			name:   "nil map",
+			osInfo: nil,
+			key:    "foo",
+			want:   "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := p.extractStringField(tt.osInfo, tt.key)
+			if got != tt.want {
+				t.Errorf("extractStringField(%q) = %q, want %q", tt.key, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/redis_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"errors"
 	"net"
 	"strings"
 	"testing"
@@ -32,3 +33,24 @@ func (c *redisReplyTestConn) RemoteAddr() net.Addr             { return nil }
 func (c *redisReplyTestConn) SetDeadline(time.Time) error      { return nil }
 func (c *redisReplyTestConn) SetReadDeadline(time.Time) error  { return nil }
 func (c *redisReplyTestConn) SetWriteDeadline(time.Time) error { return nil }
+
+func TestClassifyRedisErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"wrongpass", errors.New("wrongpass invalid password"), ErrorTypeAuth},
+		{"noauth", errors.New("noauth authentication required"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random redis error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyRedisErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyRedisErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/rsync_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"errors"
 	"io"
 	"testing"
 )
@@ -37,3 +38,24 @@ func TestReadRsyncLineHandlesChunkedReads(t *testing.T) {
 		t.Fatalf("readRsyncLine() = %q", got)
 	}
 }
+
+func TestClassifyRsyncErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"access denied", errors.New("access denied"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random rsync error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyRsyncErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyRsyncErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/smb_protocol_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"fmt"
 	"io"
 	"net"
 	"testing"
@@ -49,3 +50,466 @@ func TestReadSMBMessageHandlesChunkedReads(t *testing.T) {
 		t.Fatalf("readSMBMessage() = %q", got)
 	}
 }
+
+// ---- parseUnicodeString ----
+
+func TestParseUnicodeString(t *testing.T) {
+	tests := []struct {
+		name string
+		data []byte
+		want string
+	}{
+		{"empty", []byte{}, ""},
+		{"odd length", []byte{0x41}, ""},
+		{"null terminated", []byte{0x41, 0x00, 0x00, 0x00}, "A"},
+		{"ascii", []byte{0x41, 0x00, 0x42, 0x00, 0x43, 0x00}, "ABC"},
+		{"chinese", []byte{0x2d, 0x4e, 0x87, 0x65}, "中文"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := parseUnicodeString(tt.data); got != tt.want {
+				t.Errorf("parseUnicodeString() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// ---- bytesToUint16 / bytesToUint32 ----
+
+func TestBytesToUint16(t *testing.T) {
+	if got := bytesToUint16([]byte{}); got != 0 {
+		t.Errorf("short data: got %d", got)
+	}
+	if got := bytesToUint16([]byte{0x01}); got != 0 {
+		t.Errorf("single byte: got %d", got)
+	}
+	if got := bytesToUint16([]byte{0x34, 0x12}); got != 0x1234 {
+		t.Errorf("LE decode: got 0x%04x", got)
+	}
+}
+
+func TestBytesToUint32(t *testing.T) {
+	if got := bytesToUint32([]byte{}); got != 0 {
+		t.Errorf("empty: got %d", got)
+	}
+	if got := bytesToUint32([]byte{0x01, 0x02, 0x03}); got != 0 {
+		t.Errorf("short: got %d", got)
+	}
+	if got := bytesToUint32([]byte{0x78, 0x56, 0x34, 0x12}); got != 0x12345678 {
+		t.Errorf("LE decode: got 0x%08x", got)
+	}
+}
+
+// ---- trimSMBString ----
+
+func TestTrimSMBString(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{"hello\x00", "hello"},
+		{"\x00hello\x00", "hello"},
+		{"  hello  ", "hello"},
+		{"\x00", ""},
+		{"", ""},
+	}
+	for _, tt := range tests {
+		if got := trimSMBString(tt.input); got != tt.want {
+			t.Errorf("trimSMBString(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}
+
+// ---- parseNTLMFlags ----
+
+func TestParseNTLMFlags(t *testing.T) {
+	// 无标志
+	if got := parseNTLMFlags(0); len(got) != 0 {
+		t.Errorf("zero flags: want empty, got %v", got)
+	}
+
+	// 单标志 NEGOTIATE_UNICODE
+	flags := parseNTLMFlags(0x00000001)
+	if len(flags) != 1 || flags[0] != "NEGOTIATE_UNICODE" {
+		t.Errorf("single flag: got %v", flags)
+	}
+
+	// 多标志 NEGOTIATE_OEM | NEGOTIATE_NTLM
+	multi := parseNTLMFlags(0x00000002 | 0x00000200)
+	if len(multi) != 2 {
+		t.Errorf("multi flags: want 2, got %d: %v", len(multi), multi)
+	}
+}
+
+// ---- parseOSVersion ----
+
+func TestParseOSVersion(t *testing.T) {
+	tests := []struct {
+		name  string
+		data  []byte
+		check func(s string) bool
+	}{
+		{
+			"Windows 10",
+			[]byte{10, 0, 0x00, 0x47, 0, 0, 0, 0}, // build 18176 < 22000
+			func(s string) bool { return s != "" && contains(s, "Windows 10") },
+		},
+		{
+			"Windows 11",
+			[]byte{10, 0, 0x00, 0x5B, 0, 0, 0, 0}, // build 23296 >= 22000
+			func(s string) bool { return contains(s, "Windows 11") },
+		},
+		{
+			"Windows 7",
+			[]byte{6, 1, 0x00, 0x09, 0, 0, 0, 0},
+			func(s string) bool { return contains(s, "Windows 7") },
+		},
+		{
+			"Windows XP",
+			[]byte{5, 1, 0x00, 0x0A, 0, 0, 0, 0},
+			func(s string) bool { return contains(s, "Windows XP") },
+		},
+		{
+			"Windows 2000",
+			[]byte{5, 0, 0x00, 0x07, 0, 0, 0, 0},
+			func(s string) bool { return contains(s, "Windows 2000") },
+		},
+		{
+			"unknown",
+			[]byte{4, 0, 0x00, 0x01, 0, 0, 0, 0},
+			func(s string) bool { return contains(s, "Windows 4.0") },
+		},
+		{
+			"too short",
+			[]byte{10, 0},
+			func(s string) bool { return s == "" },
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info := &SMBTarget{}
+			parseOSVersion(tt.data, info)
+			if !tt.check(info.OSVersion) {
+				t.Errorf("OSVersion = %q", info.OSVersion)
+			}
+		})
+	}
+}
+
+func contains(s, sub string) bool {
+	return len(s) >= len(sub) && (s == sub || len(sub) == 0 ||
+		func() bool {
+			for i := 0; i <= len(s)-len(sub); i++ {
+				if s[i:i+len(sub)] == sub {
+					return true
+				}
+			}
+			return false
+		}())
+}
+
+// ---- parseTargetInfo ----
+
+func TestParseTargetInfo(t *testing.T) {
+	t.Run("empty", func(t *testing.T) {
+		info := &SMBTarget{}
+		parseTargetInfo([]byte{}, info)
+		if info.ComputerName != "" || info.DomainName != "" {
+			t.Error("expected empty fields")
+		}
+	})
+
+	makeAVPair := func(avId uint16, value []byte) []byte {
+		b := []byte{
+			byte(avId), byte(avId >> 8),
+			byte(len(value)), byte(len(value) >> 8),
+		}
+		b = append(b, value...)
+		// terminator
+		b = append(b, 0x00, 0x00, 0x00, 0x00)
+		return b
+	}
+
+	encodeUTF16LE := func(s string) []byte {
+		var b []byte
+		for _, r := range s {
+			b = append(b, byte(r), byte(uint16(r)>>8))
+		}
+		return b
+	}
+
+	t.Run("MsvAvNbComputerName", func(t *testing.T) {
+		info := &SMBTarget{}
+		parseTargetInfo(makeAVPair(0x0001, encodeUTF16LE("MYPC")), info)
+		if info.ComputerName != "MYPC" {
+			t.Errorf("ComputerName = %q", info.ComputerName)
+		}
+	})
+
+	t.Run("MsvAvNbDomainName", func(t *testing.T) {
+		info := &SMBTarget{}
+		parseTargetInfo(makeAVPair(0x0002, encodeUTF16LE("DOMAIN")), info)
+		if info.DomainName != "DOMAIN" {
+			t.Errorf("DomainName = %q", info.DomainName)
+		}
+	})
+
+	t.Run("MsvAvDnsComputerName_fallback", func(t *testing.T) {
+		info := &SMBTarget{}
+		parseTargetInfo(makeAVPair(0x0003, encodeUTF16LE("dns.host")), info)
+		if info.ComputerName != "dns.host" {
+			t.Errorf("ComputerName = %q", info.ComputerName)
+		}
+	})
+
+	t.Run("terminator only", func(t *testing.T) {
+		info := &SMBTarget{}
+		parseTargetInfo([]byte{0x00, 0x00, 0x00, 0x00}, info)
+		if info.ComputerName != "" || info.DomainName != "" {
+			t.Error("expected empty fields")
+		}
+	})
+}
+
+// ---- parseNTLMChallenge ----
+
+// buildNTLMChallengePacket 构建测试用 NTLM Challenge 包。
+// targetName 和 targetInfo 均为 UTF-16LE 编码字节。
+// flags 应包含 0x02000000 (NEGOTIATE_VERSION) 才会有 version 字段。
+func buildNTLMChallengePacket(targetName []byte, flags uint32, targetInfo []byte, version []byte) []byte {
+	// 固定头：signature(8) + msgType(4) + targetLen(2) + targetMaxLen(2) + targetOffset(4)
+	// + flags(4) + challenge(8) + reserved(8) + targetInfoLen(2) + targetInfoMaxLen(2) + targetInfoOffset(4)
+	// + version(8, optional) + payload
+	headerSize := 56 // 8+4+2+2+4+4+8+8+2+2+4+8 (version always included here)
+	targetOffset := uint32(headerSize)
+	targetInfoOffset := targetOffset + uint32(len(targetName))
+
+	buf := make([]byte, 0, headerSize+len(targetName)+len(targetInfo))
+
+	// signature
+	buf = append(buf, []byte("NTLMSSP\x00")...)
+	// messageType = 2
+	buf = append(buf, 0x02, 0x00, 0x00, 0x00)
+	// targetLength
+	buf = append(buf, byte(len(targetName)), byte(len(targetName)>>8))
+	// targetMaxLength
+	buf = append(buf, byte(len(targetName)), byte(len(targetName)>>8))
+	// targetOffset
+	buf = append(buf, byte(targetOffset), byte(targetOffset>>8), byte(targetOffset>>16), byte(targetOffset>>24))
+	// flags
+	buf = append(buf, byte(flags), byte(flags>>8), byte(flags>>16), byte(flags>>24))
+	// challenge (8 bytes)
+	buf = append(buf, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08)
+	// reserved (8 bytes)
+	buf = append(buf, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+	// targetInfoLength
+	buf = append(buf, byte(len(targetInfo)), byte(len(targetInfo)>>8))
+	// targetInfoMaxLength
+	buf = append(buf, byte(len(targetInfo)), byte(len(targetInfo)>>8))
+	// targetInfoOffset
+	buf = append(buf, byte(targetInfoOffset), byte(targetInfoOffset>>8), byte(targetInfoOffset>>16), byte(targetInfoOffset>>24))
+	// version (8 bytes)
+	if len(version) == 8 {
+		buf = append(buf, version...)
+	} else {
+		buf = append(buf, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+	}
+	// payload
+	buf = append(buf, targetName...)
+	buf = append(buf, targetInfo...)
+
+	return buf
+}
+
+func TestParseNTLMChallenge(t *testing.T) {
+	t.Run("too short", func(t *testing.T) {
+		info := &SMBTarget{}
+		parseNTLMChallenge(make([]byte, 10), info)
+		if info.DomainName != "" {
+			t.Error("expected no domain")
+		}
+	})
+
+	t.Run("bad signature", func(t *testing.T) {
+		data := make([]byte, 64)
+		copy(data, "BADMAGIC")
+		info := &SMBTarget{}
+		parseNTLMChallenge(data, info)
+		if info.DomainName != "" {
+			t.Error("expected no domain")
+		}
+	})
+
+	t.Run("wrong message type", func(t *testing.T) {
+		data := make([]byte, 64)
+		copy(data, "NTLMSSP\x00")
+		data[8] = 0x01 // messageType = 1, not 2
+		info := &SMBTarget{}
+		parseNTLMChallenge(data, info)
+		if info.DomainName != "" {
+			t.Error("expected no domain for wrong message type")
+		}
+	})
+
+	t.Run("valid challenge with domain", func(t *testing.T) {
+		encodeUTF16LE := func(s string) []byte {
+			var b []byte
+			for _, r := range s {
+				b = append(b, byte(r), byte(uint16(r)>>8))
+			}
+			return b
+		}
+		targetName := encodeUTF16LE("WORKGROUP")
+		flags := uint32(0x00000001 | 0x00000200) // UNICODE | NTLM, no VERSION flag
+		data := buildNTLMChallengePacket(targetName, flags, nil, nil)
+		info := &SMBTarget{}
+		parseNTLMChallenge(data, info)
+		if info.DomainName != "WORKGROUP" {
+			t.Errorf("DomainName = %q, want WORKGROUP", info.DomainName)
+		}
+	})
+
+	t.Run("valid challenge with targetInfo and version", func(t *testing.T) {
+		encodeUTF16LE := func(s string) []byte {
+			var b []byte
+			for _, r := range s {
+				b = append(b, byte(r), byte(uint16(r)>>8))
+			}
+			return b
+		}
+		targetName := encodeUTF16LE("CORP")
+
+		// AV_PAIR: MsvAvNbComputerName = "SERVER"
+		computerNameBytes := encodeUTF16LE("SERVER")
+		avPair := []byte{
+			0x01, 0x00,
+			byte(len(computerNameBytes)), byte(len(computerNameBytes) >> 8),
+		}
+		avPair = append(avPair, computerNameBytes...)
+		avPair = append(avPair, 0x00, 0x00, 0x00, 0x00) // terminator
+
+		// NEGOTIATE_VERSION flag = 0x02000000
+		flags := uint32(0x02000000 | 0x00000001 | 0x00000200)
+		// Windows 10 build 19041
+		version := []byte{10, 0, 0xA1, 0x4A, 0x00, 0x00, 0x00, 0x0F}
+		data := buildNTLMChallengePacket(targetName, flags, avPair, version)
+
+		info := &SMBTarget{}
+		parseNTLMChallenge(data, info)
+
+		if info.DomainName != "CORP" {
+			t.Errorf("DomainName = %q, want CORP", info.DomainName)
+		}
+		if info.ComputerName != "SERVER" {
+			t.Errorf("ComputerName = %q, want SERVER", info.ComputerName)
+		}
+		if info.OSVersion == "" {
+			t.Error("OSVersion should not be empty")
+		}
+		if len(info.NTLMFlags) == 0 {
+			t.Error("NTLMFlags should not be empty")
+		}
+	})
+}
+
+// ---- classifySMBError ----
+
+func TestClassifySMBError(t *testing.T) {
+	t.Run("nil error", func(t *testing.T) {
+		if got := classifySMBError(nil); got != ErrorTypeUnknown {
+			t.Errorf("nil: got %v", got)
+		}
+	})
+
+	t.Run("auth error keyword", func(t *testing.T) {
+		err := fmt.Errorf("authentication failed")
+		if got := classifySMBError(err); got != ErrorTypeAuth {
+			t.Errorf("auth keyword: got %v", got)
+		}
+	})
+
+	t.Run("NT status code", func(t *testing.T) {
+		err := fmt.Errorf("nt_status_logon_failure")
+		if got := classifySMBError(err); got != ErrorTypeAuth {
+			t.Errorf("NT status: got %v", got)
+		}
+	})
+
+	t.Run("network error", func(t *testing.T) {
+		err := fmt.Errorf("connection refused")
+		if got := classifySMBError(err); got != ErrorTypeNetwork {
+			t.Errorf("network: got %v", got)
+		}
+	})
+}
+
+// ---- SMBProtocol.String() ----
+
+func TestSMBProtocolString(t *testing.T) {
+	tests := []struct {
+		p    SMBProtocol
+		want string
+	}{
+		{SMBProtocol1, "SMBv1"},
+		{SMBProtocol2, "SMBv2"},
+		{SMBProtocolUnknown, "Unknown"},
+		{SMBProtocol(99), "Unknown"},
+	}
+	for _, tt := range tests {
+		if got := tt.p.String(); got != tt.want {
+			t.Errorf("SMBProtocol(%d).String() = %q, want %q", tt.p, got, tt.want)
+		}
+	}
+}
+
+// ---- SMBTarget.Summary() ----
+
+func TestSMBTargetSummary(t *testing.T) {
+	t.Run("only protocol", func(t *testing.T) {
+		info := &SMBTarget{Protocol: SMBProtocol2}
+		if got := info.Summary(); got != "SMBv2" {
+			t.Errorf("got %q", got)
+		}
+	})
+
+	t.Run("full fields", func(t *testing.T) {
+		info := &SMBTarget{
+			Protocol:     SMBProtocol1,
+			OSVersion:    "Windows 10 (Build 19041)",
+			ComputerName: "MYPC",
+		}
+		got := info.Summary()
+		if !contains(got, "SMBv1") || !contains(got, "Windows 10") || !contains(got, "MYPC") {
+			t.Errorf("Summary() = %q", got)
+		}
+	})
+
+	t.Run("empty optional fields", func(t *testing.T) {
+		info := &SMBTarget{Protocol: SMBProtocolUnknown}
+		if got := info.Summary(); got != "Unknown" {
+			t.Errorf("got %q", got)
+		}
+	})
+}
+
+// ---- buildNTLMSSPData ----
+
+func TestBuildNTLMSSPData(t *testing.T) {
+	flags := []byte{0x07, 0x82, 0x08, 0xA2}
+	got := buildNTLMSSPData(flags)
+	if len(got) == 0 {
+		t.Fatal("buildNTLMSSPData returned empty")
+	}
+	// 长度固定（实际为158字节）
+	const wantLen = 158
+	if len(got) != wantLen {
+		t.Errorf("len = %d, want %d", len(got), wantLen)
+	}
+	// flags 嵌入在偏移138处
+	const flagsOffset = 138
+	if got[flagsOffset] != flags[0] || got[flagsOffset+1] != flags[1] ||
+		got[flagsOffset+2] != flags[2] || got[flagsOffset+3] != flags[3] {
+		t.Errorf("flags not embedded correctly at offset %d: got %x %x %x %x",
+			flagsOffset, got[flagsOffset], got[flagsOffset+1], got[flagsOffset+2], got[flagsOffset+3])
+	}
+}

plugins/services/smtp_test.go

@@ -0,0 +1,30 @@
+//go:build plugin_smtp || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifySMTPErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"535 authentication failed", errors.New("535 authentication failed"), ErrorTypeAuth},
+		{"relay access denied", errors.New("relay access denied"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifySMTPErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifySMTPErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/snmp_test.go

@@ -0,0 +1,156 @@
+//go:build plugin_snmp || !plugin_selective
+
+package services
+
+import (
+	"encoding/asn1"
+	"testing"
+
+	"github.com/shadow1ng/fscan/common"
+)
+
+// --- buildSNMPGetRequest ---
+
+func TestBuildSNMPGetRequest(t *testing.T) {
+	oid := []int{1, 3, 6, 1, 2, 1, 1, 1, 0}
+
+	t.Run("returns non-empty bytes starting with ASN.1 SEQUENCE", func(t *testing.T) {
+		pkt := buildSNMPGetRequest("public", oid)
+		if len(pkt) == 0 {
+			t.Fatal("expected non-empty packet")
+		}
+		if pkt[0] != 0x30 {
+			t.Errorf("first byte = 0x%02x, want 0x30 (ASN.1 SEQUENCE)", pkt[0])
+		}
+	})
+
+	t.Run("different communities produce different lengths", func(t *testing.T) {
+		pkt1 := buildSNMPGetRequest("public", oid)
+		pkt2 := buildSNMPGetRequest("longercommunitystringhere", oid)
+		if len(pkt1) >= len(pkt2) {
+			t.Errorf("expected longer community to produce longer packet: len(public)=%d len(long)=%d", len(pkt1), len(pkt2))
+		}
+	})
+}
+
+// --- marshalOIDWithNull ---
+
+func TestMarshalOIDWithNull(t *testing.T) {
+	oid := []int{1, 3, 6, 1, 2, 1, 1, 1, 0}
+	result := marshalOIDWithNull(oid)
+
+	if len(result) == 0 {
+		t.Fatal("expected non-empty bytes")
+	}
+
+	// 应包含 OID tag (0x06) 和 NULL tag (0x05)
+	foundOID := false
+	foundNull := false
+	for _, b := range result {
+		if b == 0x06 {
+			foundOID = true
+		}
+		if b == 0x05 {
+			foundNull = true
+		}
+	}
+	if !foundOID {
+		t.Error("expected OID tag 0x06 in output")
+	}
+	if !foundNull {
+		t.Error("expected NULL tag 0x05 in output")
+	}
+}
+
+// --- parseSNMPResponse ---
+
+// buildTestSNMPResponse 构造最小合法 SNMPv2c GetResponse 包含 OctetString value
+func buildTestSNMPResponse(community string, value string) []byte {
+	valBytes, _ := asn1.Marshal(asn1.RawValue{Class: 0, Tag: 4, Bytes: []byte(value)})
+	oidBytes, _ := asn1.Marshal(asn1.ObjectIdentifier{1, 3, 6, 1, 2, 1, 1, 1, 0})
+
+	var vbContent []byte
+	vbContent = append(vbContent, oidBytes...)
+	vbContent = append(vbContent, valBytes...)
+	varbind, _ := asn1.Marshal(asn1.RawValue{Class: 0, Tag: 16, IsCompound: true, Bytes: vbContent})
+	varbindList, _ := asn1.Marshal(asn1.RawValue{Class: 0, Tag: 16, IsCompound: true, Bytes: varbind})
+
+	reqID, _ := asn1.Marshal(12345)
+	errStatus, _ := asn1.Marshal(0)
+	errIndex, _ := asn1.Marshal(0)
+
+	var pduContent []byte
+	pduContent = append(pduContent, reqID...)
+	pduContent = append(pduContent, errStatus...)
+	pduContent = append(pduContent, errIndex...)
+	pduContent = append(pduContent, varbindList...)
+
+	// GetResponse PDU: context-specific tag 2
+	pdu, _ := asn1.Marshal(asn1.RawValue{Class: 2, Tag: 2, IsCompound: true, Bytes: pduContent})
+
+	version, _ := asn1.Marshal(1) // SNMPv2c
+	comm, _ := asn1.Marshal([]byte(community))
+
+	var msgContent []byte
+	msgContent = append(msgContent, version...)
+	msgContent = append(msgContent, comm...)
+	msgContent = append(msgContent, pdu...)
+
+	msg, _ := asn1.Marshal(asn1.RawValue{Class: 0, Tag: 16, IsCompound: true, Bytes: msgContent})
+	return msg
+}
+
+func TestParseSNMPResponse(t *testing.T) {
+	t.Run("empty data returns empty", func(t *testing.T) {
+		got := parseSNMPResponse([]byte{})
+		if got != "" {
+			t.Errorf("got %q, want empty", got)
+		}
+	})
+
+	t.Run("invalid ASN.1 returns empty", func(t *testing.T) {
+		got := parseSNMPResponse([]byte{0xFF, 0xFF, 0xFF})
+		if got != "" {
+			t.Errorf("got %q, want empty", got)
+		}
+	})
+
+	t.Run("valid response returns sysDescr value", func(t *testing.T) {
+		want := "Linux router 5.4.0"
+		pkt := buildTestSNMPResponse("public", want)
+		got := parseSNMPResponse(pkt)
+		if got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+	})
+}
+
+// --- buildCommunityList ---
+
+func TestBuildCommunityList(t *testing.T) {
+	p := NewSNMPPlugin()
+	cfg := &common.Config{}
+
+	list := p.buildCommunityList(cfg)
+
+	if len(list) == 0 {
+		t.Fatal("community list must not be empty")
+	}
+
+	hasPublic := false
+	hasPrivate := false
+	for _, c := range list {
+		if c == "public" {
+			hasPublic = true
+		}
+		if c == "private" {
+			hasPrivate = true
+		}
+	}
+	if !hasPublic {
+		t.Error("community list must contain 'public'")
+	}
+	if !hasPrivate {
+		t.Error("community list must contain 'private'")
+	}
+}

plugins/services/ssh_test.go

@@ -0,0 +1,60 @@
+//go:build plugin_ssh || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifySSHErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"unable to authenticate", errors.New("unable to authenticate"), ErrorTypeAuth},
+		{"no supported methods remain", errors.New("no supported methods remain"), ErrorTypeAuth},
+		{"handshake failed", errors.New("handshake failed"), ErrorTypeThrottle},
+		{"ssh disconnect", errors.New("ssh: disconnect"), ErrorTypeThrottle},
+		{"max startups", errors.New("max startups"), ErrorTypeThrottle},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"random error", errors.New("random error"), ErrorTypeUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifySSHErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifySSHErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestClassifySSHError(t *testing.T) {
+	authKeywords := []string{"bad password", "invalid key"}
+	throttleKeywords := []string{"rate limited", "too fast"}
+
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"custom auth keyword", errors.New("bad password provided"), ErrorTypeAuth},
+		{"custom throttle keyword", errors.New("rate limited by server"), ErrorTypeThrottle},
+		{"network error", errors.New("connection refused"), ErrorTypeNetwork},
+		{"no match", errors.New("something else"), ErrorTypeUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifySSHError(tt.err, authKeywords, throttleKeywords)
+			if got != tt.want {
+				t.Errorf("classifySSHError(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/services/telnet_test.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"errors"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -15,3 +16,24 @@ func TestTelnetExtractEvidenceTruncatesByRune(t *testing.T) {
 		t.Fatalf("extractEvidence() = %q", got)
 	}
 }
+
+func TestClassifyTelnetErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil", nil, ErrorTypeUnknown},
+		{"login failed", errors.New("login failed"), ErrorTypeAuth},
+		{"credentials rejected", errors.New("credentials rejected"), ErrorTypeAuth},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"unknown", errors.New("random telnet error"), ErrorTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := classifyTelnetErrorType(tt.err); got != tt.want {
+				t.Errorf("classifyTelnetErrorType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

plugins/services/vnc_test.go

@@ -0,0 +1,30 @@
+//go:build plugin_vnc || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifyVNCErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"authentication failed", errors.New("authentication failed"), ErrorTypeAuth},
+		{"too many authentication failures", errors.New("too many authentication failures"), ErrorTypeNetwork},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyVNCErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifyVNCErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}

plugins/web/webtitle_test.go

@@ -101,3 +101,194 @@ func TestReadWebTitleBodyIsBounded(t *testing.T) {
 		t.Fatalf("body len = %d, want %d", len(got), maxWebTitleBodyBytes)
 	}
 }
+
+func TestResolveRedirectURL(t *testing.T) {
+	p := NewWebTitlePlugin()
+	base := "http://example.com/path"
+
+	tests := []struct {
+		name     string
+		location string
+		want     string
+	}{
+		{"absolute http", "http://other.com/page", "http://other.com/page"},
+		{"absolute https", "https://other.com/page", "https://other.com/page"},
+		{"relative path", "/admin/login", "http://example.com/admin/login"},
+		{"relative no slash", "login", "http://example.com/login"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := p.resolveRedirectURL(base, tt.location)
+			if got != tt.want {
+				t.Fatalf("resolveRedirectURL(%q, %q) = %q, want %q", base, tt.location, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestResolveRedirectURLInvalidBase(t *testing.T) {
+	p := NewWebTitlePlugin()
+	got := p.resolveRedirectURL("://bad-url", "/path")
+	if got != "" {
+		t.Fatalf("expected empty string for invalid base, got %q", got)
+	}
+}
+
+func TestResolveRedirectURLInvalidLocation(t *testing.T) {
+	p := NewWebTitlePlugin()
+	// 百分号开头的无效 URL
+	got := p.resolveRedirectURL("http://example.com", "://")
+	// net/url.Parse 对 "://" 不一定报错，只要不 panic 即可
+	_ = got
+}
+
+func TestFormatHeaders(t *testing.T) {
+	p := NewWebTitlePlugin()
+
+	// 空 header
+	if got := p.formatHeaders(http.Header{}); got != "" {
+		t.Fatalf("empty headers = %q, want empty string", got)
+	}
+
+	// 单个 header
+	h := http.Header{}
+	h.Set("Content-Type", "text/html")
+	got := p.formatHeaders(h)
+	if !strings.Contains(got, "Content-Type") || !strings.Contains(got, "text/html") {
+		t.Fatalf("formatHeaders missing expected content: %q", got)
+	}
+
+	// 多值 header
+	h2 := http.Header{}
+	h2.Add("X-Custom", "val1")
+	h2.Add("X-Custom", "val2")
+	got2 := p.formatHeaders(h2)
+	if !strings.Contains(got2, "val1") || !strings.Contains(got2, "val2") {
+		t.Fatalf("formatHeaders missing multi-value: %q", got2)
+	}
+}
+
+func TestURLHost(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{"127.0.0.1", "127.0.0.1"},
+		{"example.com", "example.com"},
+		{"::1", "[::1]"},
+		{"[::1]", "[::1]"}, // 已经括起来的不要双重括号
+	}
+	for _, tt := range tests {
+		got := urlHost(tt.input)
+		if got != tt.want {
+			t.Fatalf("urlHost(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}
+
+func TestTruncateRunes(t *testing.T) {
+	// 负数 maxRunes → 原样返回
+	s := "hello"
+	if got := truncateRunes(s, -1); got != s {
+		t.Fatalf("truncateRunes negative = %q, want %q", got, s)
+	}
+
+	// 短于 maxRunes → 原样返回
+	if got := truncateRunes("ab", 10); got != "ab" {
+		t.Fatalf("truncateRunes short = %q, want %q", got, "ab")
+	}
+
+	// 超过 maxRunes → 截断加 "..."
+	long := strings.Repeat("x", 5)
+	got := truncateRunes(long, 3)
+	if got != "xxx..." {
+		t.Fatalf("truncateRunes long = %q, want %q", got, "xxx...")
+	}
+
+	// maxRunes=0 → 立刻截断
+	if got := truncateRunes("hello", 0); got != "..." {
+		t.Fatalf("truncateRunes zero = %q, want %q", got, "...")
+	}
+}
+
+func TestExtractTitleInvalidUTF8(t *testing.T) {
+	p := NewWebTitlePlugin()
+	// 构造含非法 UTF-8 字节的 title
+	html := "<html><title>\xff\xfe</title></html>"
+	got := p.extractTitle(html)
+	// 非法 UTF-8 应返回空
+	if got != "" {
+		t.Fatalf("extractTitle with invalid UTF-8 = %q, want empty", got)
+	}
+}
+
+func TestExtractTitleNoMatch(t *testing.T) {
+	p := NewWebTitlePlugin()
+	got := p.extractTitle("<html><body>no title here</body></html>")
+	if got != "" {
+		t.Fatalf("extractTitle no match = %q, want empty", got)
+	}
+}
+
+func TestWebTitleHTTPClientsGM(t *testing.T) {
+	previousGM, previousNoRedirectGM := lib.ClientGM, lib.ClientNoRedirectGM
+	defer func() {
+		lib.ClientGM, lib.ClientNoRedirectGM = previousGM, previousNoRedirectGM
+	}()
+
+	// 设置 GM 客户端为非 nil
+	lib.ClientGM = &http.Client{}
+	lib.ClientNoRedirectGM = &http.Client{
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+
+	clientNR, clientR := webTitleHTTPClients(true)
+	if clientNR == nil || clientR == nil {
+		t.Fatal("webTitleHTTPClients(GM) returned nil")
+	}
+}
+
+func TestFirstHTTPClientAllNil(t *testing.T) {
+	got := firstHTTPClient(nil, nil, nil)
+	if got != http.DefaultClient {
+		t.Fatalf("firstHTTPClient all nil = %v, want http.DefaultClient", got)
+	}
+}
+
+func TestFetchFaviconHashNon200(t *testing.T) {
+	previous := lib.Client
+	lib.Client = &http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return &http.Response{
+				StatusCode: http.StatusNotFound,
+				Body:       http.NoBody,
+			}, nil
+		}),
+	}
+	defer func() { lib.Client = previous }()
+
+	p := NewWebTitlePlugin()
+	hashes := p.fetchFaviconHash(context.Background(), "http://example.com")
+	if len(hashes.MMH3) != 0 || len(hashes.MD5) != 0 {
+		t.Fatalf("fetchFaviconHash non-200 returned hashes: %#v", hashes)
+	}
+}
+
+func TestFetchFaviconHashBadURL(t *testing.T) {
+	p := NewWebTitlePlugin()
+	// 无效 URL 应返回空 hash，不 panic
+	hashes := p.fetchFaviconHash(context.Background(), "://bad")
+	if len(hashes.MMH3) != 0 || len(hashes.MD5) != 0 {
+		t.Fatalf("fetchFaviconHash bad URL returned hashes: %#v", hashes)
+	}
+}
+
+// roundTripFunc 允许用函数实现 http.RoundTripper
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}

webscan/fingerprint/calc_priority_test.go

@@ -0,0 +1,191 @@
+package fingerprint
+
+import (
+	"testing"
+)
+
+// =============================================================================
+// calcPriority 测试
+// =============================================================================
+
+func TestCalcPriority_FaviconHighest(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	p := calcPriority(fp, "favicon")
+	if p != 100 {
+		t.Errorf("favicon 优先级应为 100，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_RegexMedium(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	p := calcPriority(fp, "regex")
+	if p != 50 {
+		t.Errorf("regex 优先级应为 50，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_WordLow(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	p := calcPriority(fp, "word")
+	if p != 30 {
+		t.Errorf("word 优先级应为 30，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_UnknownTypeZero(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	p := calcPriority(fp, "unknown")
+	if p != 0 {
+		t.Errorf("未知类型优先级应为 0，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_VerifiedBonus(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	fp.Info.Metadata = map[string]interface{}{
+		"verified": true,
+	}
+	p := calcPriority(fp, "word")
+	// word(30) + verified(20) = 50
+	if p != 50 {
+		t.Errorf("word+verified 优先级应为 50，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_VerifiedFavicon(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	fp.Info.Metadata = map[string]interface{}{
+		"verified": true,
+	}
+	p := calcPriority(fp, "favicon")
+	// favicon(100) + verified(20) = 120
+	if p != 120 {
+		t.Errorf("favicon+verified 优先级应为 120，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_VerifiedFalse(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	fp.Info.Metadata = map[string]interface{}{
+		"verified": false,
+	}
+	p := calcPriority(fp, "regex")
+	// verified=false 不加分
+	if p != 50 {
+		t.Errorf("verified=false 时优先级应为 50，实际 %d", p)
+	}
+}
+
+func TestCalcPriority_NilMetadata(t *testing.T) {
+	fp := &EnhancedFingerprint{}
+	// Metadata 为 nil，不加分
+	p := calcPriority(fp, "favicon")
+	if p != 100 {
+		t.Errorf("nil metadata 时 favicon 优先级应为 100，实际 %d", p)
+	}
+}
+
+// =============================================================================
+// matchRegex 测试 - 需要初始化 enhancedDB
+// =============================================================================
+
+func initEnhancedDBForTest(t *testing.T) {
+	t.Helper()
+	if enhancedDB == nil {
+		if err := LoadEnhancedFingerprints(); err != nil {
+			t.Fatalf("LoadEnhancedFingerprints 失败: %v", err)
+		}
+	}
+}
+
+func TestMatchRegex_BodyMatch(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`nginx/[\d.]+`}, nil, "body", "", false)
+	result := matchRegex(matcher, "Server: nginx/1.18.0 running", "")
+	if !result {
+		t.Error("body 中应匹配 nginx 版本正则")
+	}
+}
+
+func TestMatchRegex_HeaderMatch(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`X-Powered-By: PHP/[\d.]+`}, nil, "header", "", false)
+	result := matchRegex(matcher, "", "X-Powered-By: PHP/7.4.3")
+	if !result {
+		t.Error("header 中应匹配 PHP 版本正则")
+	}
+}
+
+func TestMatchRegex_NoMatch(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`apache/[\d.]+`}, nil, "body", "", false)
+	result := matchRegex(matcher, "nginx server running", "")
+	if result {
+		t.Error("不应匹配 apache 正则")
+	}
+}
+
+func TestMatchRegex_ANDConditionAllMatch(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`nginx`, `1\.18`}, nil, "body", "and", false)
+	result := matchRegex(matcher, "nginx/1.18.0 server", "")
+	if !result {
+		t.Error("AND 条件下两个正则都匹配应返回 true")
+	}
+}
+
+func TestMatchRegex_ANDConditionPartialMatch(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`nginx`, `apache`}, nil, "body", "and", false)
+	result := matchRegex(matcher, "nginx server", "")
+	if result {
+		t.Error("AND 条件下只有一个匹配应返回 false")
+	}
+}
+
+func TestMatchRegex_ORConditionOneMatch(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`nginx`, `apache`}, nil, "body", "or", false)
+	result := matchRegex(matcher, "apache httpd", "")
+	if !result {
+		t.Error("OR 条件下至少一个匹配应返回 true")
+	}
+}
+
+func TestMatchRegex_CaseInsensitive(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{`NGINX`}, nil, "body", "", true)
+	result := matchRegex(matcher, "nginx/1.18.0", "")
+	if !result {
+		t.Error("大小写不敏感模式下应匹配")
+	}
+}
+
+func TestMatchRegex_InvalidPattern(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	// 无效正则不应崩溃
+	matcher := createMatcher("regex", nil, []string{`[invalid regex(`}, nil, "body", "", false)
+	result := matchRegex(matcher, "test content", "")
+	if result {
+		t.Error("无效正则不应产生匹配")
+	}
+}
+
+func TestMatchRegex_EmptyPatterns(t *testing.T) {
+	initEnhancedDBForTest(t)
+
+	matcher := createMatcher("regex", nil, []string{}, nil, "body", "and", false)
+	result := matchRegex(matcher, "nginx", "")
+	// AND 条件且无 pattern：isAnd && len(Regex) > 0 为 false
+	if result {
+		t.Error("AND 条件下空 patterns 应返回 false")
+	}
+}

webscan/fingerprint_scanner_test.go

@@ -0,0 +1,209 @@
+package WebScan
+
+import (
+	"crypto/md5" //nolint:gosec
+	"fmt"
+	"testing"
+
+	"github.com/shadow1ng/fscan/webscan/fingerprint"
+)
+
+// =============================================================================
+// removeDuplicateElement 测试
+// =============================================================================
+
+func TestRemoveDuplicateElement_Basic(t *testing.T) {
+	input := []string{"nginx", "apache", "nginx", "iis", "apache"}
+	result := removeDuplicateElement(input)
+
+	if len(result) != 3 {
+		t.Errorf("期望3个唯一元素，实际 %d: %v", len(result), result)
+	}
+
+	seen := make(map[string]int)
+	for _, v := range result {
+		seen[v]++
+		if seen[v] > 1 {
+			t.Errorf("元素 %q 出现了多次", v)
+		}
+	}
+}
+
+func TestRemoveDuplicateElement_Empty(t *testing.T) {
+	result := removeDuplicateElement([]string{})
+	if len(result) != 0 {
+		t.Errorf("空输入应返回空切片，实际 %d", len(result))
+	}
+}
+
+func TestRemoveDuplicateElement_NoDup(t *testing.T) {
+	input := []string{"a", "b", "c"}
+	result := removeDuplicateElement(input)
+	if len(result) != 3 {
+		t.Errorf("无重复时应保留全部元素，实际 %d", len(result))
+	}
+}
+
+func TestRemoveDuplicateElement_AllSame(t *testing.T) {
+	input := []string{"dup", "dup", "dup", "dup"}
+	result := removeDuplicateElement(input)
+	if len(result) != 1 {
+		t.Errorf("全部相同时应只保留1个，实际 %d", len(result))
+	}
+	if result[0] != "dup" {
+		t.Errorf("保留的元素应为 'dup'，实际 %q", result[0])
+	}
+}
+
+func TestRemoveDuplicateElement_PreservesOrder(t *testing.T) {
+	input := []string{"c", "a", "b", "a", "c"}
+	result := removeDuplicateElement(input)
+	if len(result) != 3 {
+		t.Fatalf("期望3个元素，实际 %d", len(result))
+	}
+	// 第一次出现的顺序应被保留
+	if result[0] != "c" || result[1] != "a" || result[2] != "b" {
+		t.Errorf("顺序不符合预期: %v", result)
+	}
+}
+
+// =============================================================================
+// matchByMd5 测试
+// =============================================================================
+
+func TestMatchByMd5_KnownHash(t *testing.T) {
+	// 从真实的 Md5Datas 取第一条：{"BIG-IP", "04d9541338e525258daf47cc844d59f3"}
+	if len(fingerprint.Md5Datas) == 0 {
+		t.Skip("Md5Datas 为空，跳过测试")
+	}
+
+	entry := fingerprint.Md5Datas[0]
+
+	// 找到能产生这个 md5 的数据——直接暴力：构造一个有已知 md5 的 body
+	// 实际上 md5 是 favicon 的 hash，这里测试找不到匹配的情况
+	emptyResult := matchByMd5([]byte("no match content here"))
+	if emptyResult != "" {
+		t.Logf("意外匹配了 %q（不影响功能，跳过断言）", emptyResult)
+	}
+
+	// 验证函数正确返回空字符串——主要检测无崩溃
+	_ = entry
+}
+
+func TestMatchByMd5_NoMatch(t *testing.T) {
+	result := matchByMd5([]byte("definitely not matching any fingerprint 12345"))
+	if result != "" {
+		t.Errorf("不应匹配任何指纹，实际匹配了 %q", result)
+	}
+}
+
+func TestMatchByMd5_Empty(t *testing.T) {
+	// 空 body 的 md5 固定值 d41d8cd98f00b204e9800998ecf8427e
+	// 检查是否在数据库中（不是，所以应返回空）
+	result := matchByMd5([]byte{})
+	// 不强断言结果，只验证不崩溃
+	_ = result
+}
+
+// 构造一个真实 md5 让 matchByMd5 命中
+func TestMatchByMd5_ActualMatch(t *testing.T) {
+	if len(fingerprint.Md5Datas) == 0 {
+		t.Skip("Md5Datas 为空")
+	}
+
+	// 找一条已知 md5，反向构造：我们不能反推原始数据
+	// 但可以直接测试 md5 计算逻辑：手动计算 body 的 md5 并与函数对比
+	body := []byte("test content for md5 check")
+	//nolint:gosec
+	expected := fmt.Sprintf("%x", md5.Sum(body))
+
+	// matchByMd5 内部会对 body 计算 md5，然后在 Md5Datas 中查找
+	// 因为这个 md5 不在 Md5Datas 中，应返回 ""
+	result := matchByMd5(body)
+	if result != "" {
+		t.Logf("巧合命中: body_md5=%s matched=%q", expected, result)
+	}
+	// 主要验证逻辑路径可以走通
+}
+
+// =============================================================================
+// matchByRegex 测试
+// =============================================================================
+
+func TestMatchByRegex_CodeType(t *testing.T) {
+	// 宝塔指纹：Type="code"，匹配 body
+	data := CheckDatas{
+		Body:    []byte("app.bt.cn/static/app.png"),
+		Headers: "",
+	}
+	result := matchByRegex(data)
+	found := false
+	for _, name := range result {
+		if name == "宝塔" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("应匹配宝塔指纹，实际结果: %v", result)
+	}
+}
+
+func TestMatchByRegex_HeaderType(t *testing.T) {
+	// CloudFlare 指纹：Type="headers"，匹配 headers
+	data := CheckDatas{
+		Body:    []byte(""),
+		Headers: "CF-RAY: cloudflare-abc123",
+	}
+	result := matchByRegex(data)
+	found := false
+	for _, name := range result {
+		if name == "CloudFlare" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("应匹配CloudFlare指纹，实际结果: %v", result)
+	}
+}
+
+func TestMatchByRegex_NoMatch(t *testing.T) {
+	data := CheckDatas{
+		Body:    []byte("hello world nothing special"),
+		Headers: "Content-Type: text/plain",
+	}
+	result := matchByRegex(data)
+	// 普通内容不应匹配特征指纹
+	// 不强断言数量，只验证不崩溃
+	_ = result
+}
+
+func TestMatchByRegex_EmptyData(t *testing.T) {
+	data := CheckDatas{}
+	result := matchByRegex(data)
+	if result == nil {
+		result = []string{}
+	}
+	// 空数据不崩溃即可
+	_ = result
+}
+
+func TestMatchByRegex_DeepInserve(t *testing.T) {
+	// 深信服防火墙：body 中包含 "SANGFOR FW"
+	data := CheckDatas{
+		Body:    []byte(`<html>SANGFOR FW product page</html>`),
+		Headers: "",
+	}
+	result := matchByRegex(data)
+	found := false
+	for _, name := range result {
+		if name == "深信服防火墙类产品" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("应匹配深信服防火墙指纹，实际结果: %v", result)
+	}
+}

webscan/lib/client_test.go

@@ -1,6 +1,114 @@
 package lib
 
-import "testing"
+import (
+	"testing"
+
+	"gopkg.in/yaml.v2"
+)
+
+// =============================================================================
+// UnmarshalYAML 测试
+// =============================================================================
+
+func TestStrMapUnmarshalYAML(t *testing.T) {
+	t.Run("正常键值对", func(t *testing.T) {
+		data := []byte("key1: val1\nkey2: val2\n")
+		var m StrMap
+		if err := yaml.Unmarshal(data, &m); err != nil {
+			t.Fatalf("yaml.Unmarshal error = %v", err)
+		}
+		if len(m) != 2 {
+			t.Fatalf("len = %d, want 2", len(m))
+		}
+		if m[0].Key != "key1" || m[0].Value != "val1" {
+			t.Errorf("m[0] = %+v, want {key1 val1}", m[0])
+		}
+		if m[1].Key != "key2" || m[1].Value != "val2" {
+			t.Errorf("m[1] = %+v, want {key2 val2}", m[1])
+		}
+	})
+
+	t.Run("单项", func(t *testing.T) {
+		data := []byte("only: one\n")
+		var m StrMap
+		if err := yaml.Unmarshal(data, &m); err != nil {
+			t.Fatalf("yaml.Unmarshal error = %v", err)
+		}
+		if len(m) != 1 || m[0].Key != "only" || m[0].Value != "one" {
+			t.Fatalf("m = %+v", m)
+		}
+	})
+
+	t.Run("randomInt 值保留为字符串", func(t *testing.T) {
+		data := []byte("port: randomInt(1000, 9000)\n")
+		var m StrMap
+		if err := yaml.Unmarshal(data, &m); err != nil {
+			t.Fatalf("yaml.Unmarshal error = %v", err)
+		}
+		if len(m) != 1 || m[0].Value != "randomInt(1000, 9000)" {
+			t.Fatalf("m = %+v", m)
+		}
+	})
+}
+
+func TestListMapUnmarshalYAML(t *testing.T) {
+	t.Run("正常列表值", func(t *testing.T) {
+		data := []byte("users:\n  - admin\n  - root\npasses:\n  - 123\n  - 456\n")
+		var m ListMap
+		if err := yaml.Unmarshal(data, &m); err != nil {
+			t.Fatalf("yaml.Unmarshal error = %v", err)
+		}
+		if len(m) != 2 {
+			t.Fatalf("len = %d, want 2", len(m))
+		}
+		if m[0].Key != "users" || len(m[0].Value) != 2 || m[0].Value[0] != "admin" || m[0].Value[1] != "root" {
+			t.Errorf("m[0] = %+v", m[0])
+		}
+		if m[1].Key != "passes" || len(m[1].Value) != 2 || m[1].Value[0] != "123" || m[1].Value[1] != "456" {
+			t.Errorf("m[1] = %+v", m[1])
+		}
+	})
+
+	t.Run("单个列表", func(t *testing.T) {
+		data := []byte("cmd:\n  - whoami\n")
+		var m ListMap
+		if err := yaml.Unmarshal(data, &m); err != nil {
+			t.Fatalf("yaml.Unmarshal error = %v", err)
+		}
+		if len(m) != 1 || m[0].Key != "cmd" || m[0].Value[0] != "whoami" {
+			t.Fatalf("m = %+v", m)
+		}
+	})
+
+	t.Run("数字值转字符串", func(t *testing.T) {
+		data := []byte("ports:\n  - 80\n  - 443\n")
+		var m ListMap
+		if err := yaml.Unmarshal(data, &m); err != nil {
+			t.Fatalf("yaml.Unmarshal error = %v", err)
+		}
+		if m[0].Value[0] != "80" || m[0].Value[1] != "443" {
+			t.Errorf("数字未转为字符串: %+v", m[0].Value)
+		}
+	})
+}
+
+func TestStrMapUnmarshalYAML_InvalidValue(t *testing.T) {
+	// value 是嵌套 map，不是字符串，应报错
+	data := []byte("key:\n  nested: val\n")
+	var m StrMap
+	if err := yaml.Unmarshal(data, &m); err == nil {
+		t.Fatal("期望错误，实际 nil")
+	}
+}
+
+func TestListMapUnmarshalYAML_InvalidValue(t *testing.T) {
+	// value 是普通字符串而非列表，应报错
+	data := []byte("key: notalist\n")
+	var m ListMap
+	if err := yaml.Unmarshal(data, &m); err == nil {
+		t.Fatal("期望错误，实际 nil")
+	}
+}
 
 func TestNormalizeHTTPProxyURL(t *testing.T) {
 	tests := []struct {

webscan/lib/eval_crypto_test.go

@@ -0,0 +1,108 @@
+package lib
+
+import (
+	"testing"
+
+	"github.com/google/cel-go/common/types"
+)
+
+func TestRegisterCryptoImplementations(t *testing.T) {
+	overloads := registerCryptoImplementations()
+
+	// 建立 operator → index 映射
+	idx := make(map[string]int, len(overloads))
+	for i, o := range overloads {
+		idx[o.Operator] = i
+	}
+
+	t.Run("md5_string", func(t *testing.T) {
+		i, ok := idx["md5_string"]
+		if !ok {
+			t.Fatal("overload md5_string not found")
+		}
+		unary := overloads[i].Unary
+
+		tests := []struct {
+			name    string
+			input   types.String
+			want    types.String
+			wantErr bool
+		}{
+			{"hello", "hello", "5d41402abc4b2a76b9719d911017c592", false},
+			{"empty", "", "d41d8cd98f00b204e9800998ecf8427e", false},
+			{"abc", "abc", "900150983cd24fb0d6963f7d28e17f72", false},
+		}
+
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := unary(tc.input)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				got, ok := result.(types.String)
+				if !ok {
+					t.Fatalf("expected types.String, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("md5(%q) = %q, want %q", tc.input, got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("md5_string_wrong_type", func(t *testing.T) {
+		i := idx["md5_string"]
+		result := overloads[i].Unary(types.Int(42))
+		if !types.IsError(result) {
+			t.Errorf("expected error for non-String input, got %v", result)
+		}
+	})
+
+	t.Run("shiro_key_valid", func(t *testing.T) {
+		i, ok := idx["shiro_key"]
+		if !ok {
+			t.Fatal("overload shiro_key not found")
+		}
+		binary := overloads[i].Binary
+
+		// kPH+bIxk5D2deZiIxcaaaA== 是常见 shiro 默认 key
+		result := binary(types.String("kPH+bIxk5D2deZiIxcaaaA=="), types.String("cbc"))
+		if types.IsError(result) {
+			t.Fatalf("unexpected error: %v", result)
+		}
+		got, ok := result.(types.String)
+		if !ok {
+			t.Fatalf("expected types.String, got %T", result)
+		}
+		if got == "" {
+			t.Error("shiro_key returned empty string")
+		}
+	})
+
+	t.Run("shiro_key_invalid_base64", func(t *testing.T) {
+		i := idx["shiro_key"]
+		binary := overloads[i].Binary
+
+		// 无效 base64，GetShrioCookie 会返回 ""，函数返回 NewErr
+		result := binary(types.String("!!!not_valid_base64!!!"), types.String("cbc"))
+		if !types.IsError(result) {
+			t.Errorf("expected error for invalid base64 key, got %v", result)
+		}
+	})
+
+	t.Run("shiro_key_wrong_key_type", func(t *testing.T) {
+		i := idx["shiro_key"]
+		result := overloads[i].Binary(types.Int(1), types.String("cbc"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String key")
+		}
+	})
+
+	t.Run("shiro_key_wrong_mode_type", func(t *testing.T) {
+		i := idx["shiro_key"]
+		result := overloads[i].Binary(types.String("kPH+bIxk5D2deZiIxcaaaA=="), types.Int(0))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String mode")
+		}
+	})
+}

webscan/lib/eval_encoding_test.go

@@ -0,0 +1,259 @@
+package lib
+
+import (
+	"testing"
+
+	"github.com/google/cel-go/common/types"
+)
+
+func TestRegisterEncodingImplementations(t *testing.T) {
+	overloads := registerEncodingImplementations()
+
+	idx := make(map[string]int, len(overloads))
+	for i, o := range overloads {
+		idx[o.Operator] = i
+	}
+
+	t.Run("base64_string", func(t *testing.T) {
+		unary := overloads[idx["base64_string"]].Unary
+
+		tests := []struct {
+			input types.String
+			want  types.String
+		}{
+			{"hello", "aGVsbG8="},
+			{"", ""},
+			{"hello world", "aGVsbG8gd29ybGQ="},
+		}
+		for _, tc := range tests {
+			result := unary(tc.input)
+			if types.IsError(result) {
+				t.Fatalf("base64_string(%q): unexpected error %v", tc.input, result)
+			}
+			got, ok := result.(types.String)
+			if !ok {
+				t.Fatalf("expected types.String, got %T", result)
+			}
+			if got != tc.want {
+				t.Errorf("base64_string(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		}
+	})
+
+	t.Run("base64_string_wrong_type", func(t *testing.T) {
+		result := overloads[idx["base64_string"]].Unary(types.Int(1))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String input")
+		}
+	})
+
+	t.Run("base64_bytes", func(t *testing.T) {
+		unary := overloads[idx["base64_bytes"]].Unary
+
+		tests := []struct {
+			input types.Bytes
+			want  types.String
+		}{
+			{types.Bytes([]byte("hello")), "aGVsbG8="},
+			{types.Bytes([]byte{}), ""},
+		}
+		for _, tc := range tests {
+			result := unary(tc.input)
+			if types.IsError(result) {
+				t.Fatalf("base64_bytes: unexpected error %v", result)
+			}
+			got, ok := result.(types.String)
+			if !ok {
+				t.Fatalf("expected types.String, got %T", result)
+			}
+			if got != tc.want {
+				t.Errorf("base64_bytes(%v) = %q, want %q", []byte(tc.input), got, tc.want)
+			}
+		}
+	})
+
+	t.Run("base64_bytes_wrong_type", func(t *testing.T) {
+		result := overloads[idx["base64_bytes"]].Unary(types.String("hello"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-Bytes input")
+		}
+	})
+
+	t.Run("base64Decode_string", func(t *testing.T) {
+		unary := overloads[idx["base64Decode_string"]].Unary
+
+		tests := []struct {
+			input types.String
+			want  types.String
+		}{
+			{"aGVsbG8=", "hello"},
+			{"", ""},
+			{"aGVsbG8gd29ybGQ=", "hello world"},
+		}
+		for _, tc := range tests {
+			result := unary(tc.input)
+			if types.IsError(result) {
+				t.Fatalf("base64Decode_string(%q): unexpected error %v", tc.input, result)
+			}
+			got, ok := result.(types.String)
+			if !ok {
+				t.Fatalf("expected types.String, got %T", result)
+			}
+			if got != tc.want {
+				t.Errorf("base64Decode_string(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		}
+	})
+
+	t.Run("base64Decode_string_invalid", func(t *testing.T) {
+		result := overloads[idx["base64Decode_string"]].Unary(types.String("!!!"))
+		if !types.IsError(result) {
+			t.Error("expected error for invalid base64 input")
+		}
+	})
+
+	t.Run("base64Decode_string_wrong_type", func(t *testing.T) {
+		result := overloads[idx["base64Decode_string"]].Unary(types.Bool(true))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String input")
+		}
+	})
+
+	t.Run("base64Decode_bytes", func(t *testing.T) {
+		unary := overloads[idx["base64Decode_bytes"]].Unary
+
+		result := unary(types.Bytes([]byte("aGVsbG8=")))
+		if types.IsError(result) {
+			t.Fatalf("unexpected error: %v", result)
+		}
+		got, ok := result.(types.String)
+		if !ok {
+			t.Fatalf("expected types.String, got %T", result)
+		}
+		if got != "hello" {
+			t.Errorf("base64Decode_bytes = %q, want %q", got, "hello")
+		}
+	})
+
+	t.Run("base64Decode_bytes_invalid", func(t *testing.T) {
+		result := overloads[idx["base64Decode_bytes"]].Unary(types.Bytes([]byte("!!!")))
+		if !types.IsError(result) {
+			t.Error("expected error for invalid base64 bytes")
+		}
+	})
+
+	t.Run("urlencode_string", func(t *testing.T) {
+		unary := overloads[idx["urlencode_string"]].Unary
+
+		// url.QueryEscape: 空格 → "+"
+		tests := []struct {
+			input types.String
+			want  types.String
+		}{
+			{"hello world", "hello+world"},
+			{"a=1&b=2", "a%3D1%26b%3D2"},
+			{"", ""},
+		}
+		for _, tc := range tests {
+			result := unary(tc.input)
+			if types.IsError(result) {
+				t.Fatalf("urlencode_string(%q): unexpected error %v", tc.input, result)
+			}
+			got, ok := result.(types.String)
+			if !ok {
+				t.Fatalf("expected types.String, got %T", result)
+			}
+			if got != tc.want {
+				t.Errorf("urlencode_string(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		}
+	})
+
+	t.Run("urlencode_string_wrong_type", func(t *testing.T) {
+		result := overloads[idx["urlencode_string"]].Unary(types.Int(0))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String input")
+		}
+	})
+
+	t.Run("urldecode_string", func(t *testing.T) {
+		unary := overloads[idx["urldecode_string"]].Unary
+
+		tests := []struct {
+			input types.String
+			want  types.String
+		}{
+			{"hello%20world", "hello world"},
+			{"hello+world", "hello world"},
+			{"", ""},
+		}
+		for _, tc := range tests {
+			result := unary(tc.input)
+			if types.IsError(result) {
+				t.Fatalf("urldecode_string(%q): unexpected error %v", tc.input, result)
+			}
+			got, ok := result.(types.String)
+			if !ok {
+				t.Fatalf("expected types.String, got %T", result)
+			}
+			if got != tc.want {
+				t.Errorf("urldecode_string(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		}
+	})
+
+	t.Run("urldecode_string_invalid", func(t *testing.T) {
+		// % 后跟非法字符
+		result := overloads[idx["urldecode_string"]].Unary(types.String("hello%ZZ"))
+		if !types.IsError(result) {
+			t.Error("expected error for invalid percent-encoding")
+		}
+	})
+
+	t.Run("urldecode_string_wrong_type", func(t *testing.T) {
+		result := overloads[idx["urldecode_string"]].Unary(types.Bool(false))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String input")
+		}
+	})
+
+	t.Run("hexdecode", func(t *testing.T) {
+		unary := overloads[idx["hexdecode"]].Unary
+
+		tests := []struct {
+			input types.String
+			want  []byte
+		}{
+			{"48656c6c6f", []byte("Hello")},
+			{"", []byte{}},
+			{"deadbeef", []byte{0xde, 0xad, 0xbe, 0xef}},
+		}
+		for _, tc := range tests {
+			result := unary(tc.input)
+			if types.IsError(result) {
+				t.Fatalf("hexdecode(%q): unexpected error %v", tc.input, result)
+			}
+			got, ok := result.(types.Bytes)
+			if !ok {
+				t.Fatalf("expected types.Bytes, got %T", result)
+			}
+			if string(got) != string(tc.want) {
+				t.Errorf("hexdecode(%q) = %v, want %v", tc.input, []byte(got), tc.want)
+			}
+		}
+	})
+
+	t.Run("hexdecode_invalid", func(t *testing.T) {
+		result := overloads[idx["hexdecode"]].Unary(types.String("zz"))
+		if !types.IsError(result) {
+			t.Error("expected error for invalid hex input")
+		}
+	})
+
+	t.Run("hexdecode_wrong_type", func(t *testing.T) {
+		result := overloads[idx["hexdecode"]].Unary(types.Int(99))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String input")
+		}
+	})
+}

webscan/lib/eval_misc_test.go

@@ -0,0 +1,53 @@
+package lib
+
+import (
+	"testing"
+	"unicode"
+
+	"github.com/google/cel-go/common/types"
+)
+
+func TestRegisterMiscImplementations_TongdaDate(t *testing.T) {
+	overloads := registerMiscImplementations()
+
+	idx := make(map[string]int, len(overloads))
+	for i, o := range overloads {
+		idx[o.Operator] = i
+	}
+
+	i, ok := idx["tongda_date"]
+	if !ok {
+		t.Fatal("overload tongda_date not found")
+	}
+	fn := overloads[i].Function
+	if fn == nil {
+		t.Fatal("tongda_date Function field is nil")
+	}
+
+	result := fn()
+
+	if types.IsError(result) {
+		t.Fatalf("unexpected error: %v", result)
+	}
+
+	got, ok := result.(types.String)
+	if !ok {
+		t.Fatalf("expected types.String, got %T", result)
+	}
+
+	s := string(got)
+
+	t.Run("length_is_4", func(t *testing.T) {
+		if len(s) != 4 {
+			t.Errorf("tongda_date returned %q, want 4-char string", s)
+		}
+	})
+
+	t.Run("all_digits", func(t *testing.T) {
+		for _, r := range s {
+			if !unicode.IsDigit(r) {
+				t.Errorf("tongda_date returned %q, contains non-digit char %q", s, r)
+			}
+		}
+	})
+}

webscan/lib/eval_random_test.go

@@ -0,0 +1,264 @@
+package lib
+
+import (
+	"testing"
+	"unicode"
+
+	"github.com/google/cel-go/common/types"
+)
+
+func TestRegisterRandomImplementations(t *testing.T) {
+	overloads := registerRandomImplementations()
+
+	idx := make(map[string]int, len(overloads))
+	for i, o := range overloads {
+		idx[o.Operator] = i
+	}
+
+	t.Run("randomInt_int_int", func(t *testing.T) {
+		i, ok := idx["randomInt_int_int"]
+		if !ok {
+			t.Fatal("overload randomInt_int_int not found")
+		}
+		binary := overloads[i].Binary
+
+		t.Run("returns_Int_type", func(t *testing.T) {
+			result := binary(types.Int(0), types.Int(100))
+			if types.IsError(result) {
+				t.Fatalf("unexpected error: %v", result)
+			}
+			if _, ok := result.(types.Int); !ok {
+				t.Errorf("expected types.Int, got %T", result)
+			}
+		})
+
+		t.Run("value_in_range", func(t *testing.T) {
+			min, max := types.Int(10), types.Int(20)
+			for range 50 {
+				result := binary(min, max)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				v := int64(result.(types.Int))
+				if v < 10 || v >= 20 {
+					t.Errorf("randomInt(10,20) = %d, out of [10,20)", v)
+				}
+			}
+		})
+
+		t.Run("max_le_min_returns_error", func(t *testing.T) {
+			result := binary(types.Int(5), types.Int(5))
+			if !types.IsError(result) {
+				t.Errorf("expected error when max == min, got %v", result)
+			}
+		})
+
+		t.Run("wrong_lhs_type", func(t *testing.T) {
+			result := binary(types.String("x"), types.Int(10))
+			if !types.IsError(result) {
+				t.Error("expected error for non-Int lhs")
+			}
+		})
+
+		t.Run("wrong_rhs_type", func(t *testing.T) {
+			result := binary(types.Int(0), types.String("x"))
+			if !types.IsError(result) {
+				t.Error("expected error for non-Int rhs")
+			}
+		})
+	})
+
+	t.Run("randomLowercase_int", func(t *testing.T) {
+		i, ok := idx["randomLowercase_int"]
+		if !ok {
+			t.Fatal("overload randomLowercase_int not found")
+		}
+		unary := overloads[i].Unary
+
+		t.Run("returns_String_type", func(t *testing.T) {
+			result := unary(types.Int(8))
+			if types.IsError(result) {
+				t.Fatalf("unexpected error: %v", result)
+			}
+			if _, ok := result.(types.String); !ok {
+				t.Errorf("expected types.String, got %T", result)
+			}
+		})
+
+		t.Run("correct_length", func(t *testing.T) {
+			for _, n := range []int{0, 1, 8, 16} {
+				result := unary(types.Int(n))
+				if types.IsError(result) {
+					t.Fatalf("unexpected error for n=%d: %v", n, result)
+				}
+				got := string(result.(types.String))
+				if len(got) != n {
+					t.Errorf("randomLowercase(%d) returned length %d", n, len(got))
+				}
+			}
+		})
+
+		t.Run("all_lowercase", func(t *testing.T) {
+			result := unary(types.Int(32))
+			got := string(result.(types.String))
+			for _, r := range got {
+				if !unicode.IsLower(r) {
+					t.Errorf("randomLowercase returned non-lowercase char %q in %q", r, got)
+				}
+			}
+		})
+
+		t.Run("invalid_length_negative", func(t *testing.T) {
+			result := unary(types.Int(-1))
+			if !types.IsError(result) {
+				t.Error("expected error for negative length")
+			}
+		})
+
+		t.Run("invalid_length_too_large", func(t *testing.T) {
+			result := unary(types.Int(maxRandomStringLength + 1))
+			if !types.IsError(result) {
+				t.Error("expected error for length > maxRandomStringLength")
+			}
+		})
+
+		t.Run("wrong_type", func(t *testing.T) {
+			result := unary(types.String("x"))
+			if !types.IsError(result) {
+				t.Error("expected error for non-Int input")
+			}
+		})
+	})
+
+	t.Run("randomUppercase_int", func(t *testing.T) {
+		i, ok := idx["randomUppercase_int"]
+		if !ok {
+			t.Fatal("overload randomUppercase_int not found")
+		}
+		unary := overloads[i].Unary
+
+		t.Run("returns_String_type", func(t *testing.T) {
+			result := unary(types.Int(8))
+			if types.IsError(result) {
+				t.Fatalf("unexpected error: %v", result)
+			}
+			if _, ok := result.(types.String); !ok {
+				t.Errorf("expected types.String, got %T", result)
+			}
+		})
+
+		t.Run("correct_length", func(t *testing.T) {
+			for _, n := range []int{0, 1, 8, 16} {
+				result := unary(types.Int(n))
+				if types.IsError(result) {
+					t.Fatalf("unexpected error for n=%d: %v", n, result)
+				}
+				got := string(result.(types.String))
+				if len(got) != n {
+					t.Errorf("randomUppercase(%d) returned length %d", n, len(got))
+				}
+			}
+		})
+
+		t.Run("all_uppercase", func(t *testing.T) {
+			result := unary(types.Int(32))
+			got := string(result.(types.String))
+			for _, r := range got {
+				if !unicode.IsUpper(r) {
+					t.Errorf("randomUppercase returned non-uppercase char %q in %q", r, got)
+				}
+			}
+		})
+
+		t.Run("wrong_type", func(t *testing.T) {
+			result := unary(types.String("x"))
+			if !types.IsError(result) {
+				t.Error("expected error for non-Int input")
+			}
+		})
+	})
+
+	t.Run("randomString_int", func(t *testing.T) {
+		i, ok := idx["randomString_int"]
+		if !ok {
+			t.Fatal("overload randomString_int not found")
+		}
+		unary := overloads[i].Unary
+
+		t.Run("returns_String_type", func(t *testing.T) {
+			result := unary(types.Int(8))
+			if types.IsError(result) {
+				t.Fatalf("unexpected error: %v", result)
+			}
+			if _, ok := result.(types.String); !ok {
+				t.Errorf("expected types.String, got %T", result)
+			}
+		})
+
+		t.Run("correct_length", func(t *testing.T) {
+			for _, n := range []int{0, 1, 8, 16} {
+				result := unary(types.Int(n))
+				if types.IsError(result) {
+					t.Fatalf("unexpected error for n=%d: %v", n, result)
+				}
+				got := string(result.(types.String))
+				if len(got) != n {
+					t.Errorf("randomString(%d) returned length %d", n, len(got))
+				}
+			}
+		})
+
+		t.Run("wrong_type", func(t *testing.T) {
+			result := unary(types.String("x"))
+			if !types.IsError(result) {
+				t.Error("expected error for non-Int input")
+			}
+		})
+	})
+}
+
+func TestRandomIntSpan(t *testing.T) {
+	t.Run("normal_range", func(t *testing.T) {
+		span, err := randomIntSpan(10, 20)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if span != 10 {
+			t.Errorf("randomIntSpan(10,20) = %d, want 10", span)
+		}
+	})
+
+	t.Run("min_zero", func(t *testing.T) {
+		span, err := randomIntSpan(0, 100)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if span != 100 {
+			t.Errorf("randomIntSpan(0,100) = %d, want 100", span)
+		}
+	})
+
+	t.Run("negative_min", func(t *testing.T) {
+		span, err := randomIntSpan(-5, 5)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if span != 10 {
+			t.Errorf("randomIntSpan(-5,5) = %d, want 10", span)
+		}
+	})
+
+	t.Run("max_eq_min_returns_error", func(t *testing.T) {
+		_, err := randomIntSpan(7, 7)
+		if err == nil {
+			t.Error("expected error when max == min")
+		}
+	})
+
+	t.Run("max_lt_min_returns_error", func(t *testing.T) {
+		_, err := randomIntSpan(10, 5)
+		if err == nil {
+			t.Error("expected error when max < min")
+		}
+	})
+}

webscan/lib/eval_string_test.go

@@ -0,0 +1,337 @@
+package lib
+
+import (
+	"testing"
+
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+)
+
+func TestRegisterStringImplementations(t *testing.T) {
+	overloads := registerStringImplementations()
+
+	idx := make(map[string]int, len(overloads))
+	for i, o := range overloads {
+		idx[o.Operator] = i
+	}
+
+	t.Run("bytes_bcontains_bytes", func(t *testing.T) {
+		binary := overloads[idx["bytes_bcontains_bytes"]].Binary
+
+		tests := []struct {
+			name string
+			lhs  types.Bytes
+			rhs  types.Bytes
+			want types.Bool
+		}{
+			{"contains", types.Bytes([]byte("hello world")), types.Bytes([]byte("world")), true},
+			{"not_contains", types.Bytes([]byte("hello world")), types.Bytes([]byte("xyz")), false},
+			{"empty_needle", types.Bytes([]byte("hello")), types.Bytes([]byte{}), true},
+			{"both_empty", types.Bytes([]byte{}), types.Bytes([]byte{}), true},
+		}
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := binary(tc.lhs, tc.rhs)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				got, ok := result.(types.Bool)
+				if !ok {
+					t.Fatalf("expected types.Bool, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("bcontains = %v, want %v", got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("bytes_bcontains_bytes_wrong_lhs", func(t *testing.T) {
+		result := overloads[idx["bytes_bcontains_bytes"]].Binary(types.String("hello"), types.Bytes([]byte("x")))
+		if !types.IsError(result) {
+			t.Error("expected error for non-Bytes lhs")
+		}
+	})
+
+	t.Run("bytes_bcontains_bytes_wrong_rhs", func(t *testing.T) {
+		result := overloads[idx["bytes_bcontains_bytes"]].Binary(types.Bytes([]byte("hello")), types.String("x"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-Bytes rhs")
+		}
+	})
+
+	t.Run("string_bmatches_bytes", func(t *testing.T) {
+		binary := overloads[idx["string_bmatches_bytes"]].Binary
+
+		tests := []struct {
+			name    string
+			pattern types.String
+			input   types.Bytes
+			want    types.Bool
+		}{
+			{"digits_match", `\d+`, types.Bytes([]byte("abc123")), true},
+			{"digits_no_match", `\d+`, types.Bytes([]byte("abc")), false},
+			{"any", `.*`, types.Bytes([]byte("hello")), true},
+			{"empty_pattern", ``, types.Bytes([]byte("hello")), true},
+		}
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := binary(tc.pattern, tc.input)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				got, ok := result.(types.Bool)
+				if !ok {
+					t.Fatalf("expected types.Bool, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("bmatches(%q, %q) = %v, want %v", tc.pattern, tc.input, got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("string_bmatches_bytes_invalid_regex", func(t *testing.T) {
+		result := overloads[idx["string_bmatches_bytes"]].Binary(types.String(`[invalid`), types.Bytes([]byte("hello")))
+		if !types.IsError(result) {
+			t.Error("expected error for invalid regex pattern")
+		}
+	})
+
+	t.Run("string_bmatches_bytes_wrong_lhs", func(t *testing.T) {
+		result := overloads[idx["string_bmatches_bytes"]].Binary(types.Int(0), types.Bytes([]byte("hello")))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String lhs")
+		}
+	})
+
+	t.Run("string_bmatches_bytes_wrong_rhs", func(t *testing.T) {
+		result := overloads[idx["string_bmatches_bytes"]].Binary(types.String(`\d+`), types.String("123"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-Bytes rhs")
+		}
+	})
+
+	t.Run("icontains_string", func(t *testing.T) {
+		binary := overloads[idx["icontains_string"]].Binary
+
+		tests := []struct {
+			name string
+			lhs  types.String
+			rhs  types.String
+			want types.Bool
+		}{
+			{"case_insensitive_match", "Hello World", "hello", true},
+			{"exact_match", "Hello World", "Hello", true},
+			{"upper_needle", "hello world", "WORLD", true},
+			{"not_contains", "hello world", "xyz", false},
+			{"empty_needle", "hello", "", true},
+		}
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := binary(tc.lhs, tc.rhs)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				got, ok := result.(types.Bool)
+				if !ok {
+					t.Fatalf("expected types.Bool, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("icontains(%q, %q) = %v, want %v", tc.lhs, tc.rhs, got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("icontains_string_wrong_lhs", func(t *testing.T) {
+		result := overloads[idx["icontains_string"]].Binary(types.Bool(true), types.String("x"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String lhs")
+		}
+	})
+
+	t.Run("icontains_string_wrong_rhs", func(t *testing.T) {
+		result := overloads[idx["icontains_string"]].Binary(types.String("hello"), types.Int(1))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String rhs")
+		}
+	})
+
+	t.Run("substr_string_int_int", func(t *testing.T) {
+		fn := overloads[idx["substr_string_int_int"]].Function
+
+		tests := []struct {
+			name   string
+			str    types.String
+			start  types.Int
+			length types.Int
+			want   types.String
+		}{
+			{"basic", "hello world", 0, 5, "hello"},
+			{"middle", "hello world", 6, 5, "world"},
+			{"single_char", "hello", 1, 1, "e"},
+			{"full", "hello", 0, 5, "hello"},
+			{"zero_length", "hello", 2, 0, ""},
+		}
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := fn(tc.str, tc.start, tc.length)
+				if types.IsError(result) {
+					t.Fatalf("substr(%q, %d, %d): unexpected error %v", tc.str, tc.start, tc.length, result)
+				}
+				got, ok := result.(types.String)
+				if !ok {
+					t.Fatalf("expected types.String, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("substr(%q, %d, %d) = %q, want %q", tc.str, tc.start, tc.length, got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("substr_out_of_bounds", func(t *testing.T) {
+		fn := overloads[idx["substr_string_int_int"]].Function
+
+		oob := []struct {
+			name   string
+			str    types.String
+			start  types.Int
+			length types.Int
+		}{
+			{"negative_start", "hello", -1, 2},
+			{"negative_length", "hello", 0, -1},
+			{"start_too_large", "hello", 10, 1},
+			{"length_overflow", "hello", 3, 10},
+		}
+		for _, tc := range oob {
+			t.Run(tc.name, func(t *testing.T) {
+				result := fn(tc.str, tc.start, tc.length)
+				if !types.IsError(result) {
+					t.Errorf("expected error for substr(%q, %d, %d), got %v", tc.str, tc.start, tc.length, result)
+				}
+			})
+		}
+	})
+
+	t.Run("substr_wrong_arg_count", func(t *testing.T) {
+		fn := overloads[idx["substr_string_int_int"]].Function
+		result := fn(types.String("hello"), types.Int(0))
+		if !types.IsError(result) {
+			t.Error("expected error for wrong argument count")
+		}
+	})
+
+	t.Run("substr_wrong_types", func(t *testing.T) {
+		fn := overloads[idx["substr_string_int_int"]].Function
+
+		cases := []struct {
+			name string
+			args []ref.Val
+		}{
+			{"wrong_str", []ref.Val{types.Int(0), types.Int(0), types.Int(1)}},
+			{"wrong_start", []ref.Val{types.String("hello"), types.String("x"), types.Int(1)}},
+			{"wrong_length", []ref.Val{types.String("hello"), types.Int(0), types.String("x")}},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				result := fn(tc.args...)
+				if !types.IsError(result) {
+					t.Errorf("expected error, got %v", result)
+				}
+			})
+		}
+	})
+
+	t.Run("startsWith_bytes", func(t *testing.T) {
+		binary := overloads[idx["startsWith_bytes"]].Binary
+
+		tests := []struct {
+			name string
+			lhs  types.Bytes
+			rhs  types.Bytes
+			want types.Bool
+		}{
+			{"match", types.Bytes([]byte("hello world")), types.Bytes([]byte("hello")), true},
+			{"no_match", types.Bytes([]byte("hello world")), types.Bytes([]byte("world")), false},
+			{"empty_prefix", types.Bytes([]byte("hello")), types.Bytes([]byte{}), true},
+			{"exact", types.Bytes([]byte("hello")), types.Bytes([]byte("hello")), true},
+		}
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := binary(tc.lhs, tc.rhs)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				got, ok := result.(types.Bool)
+				if !ok {
+					t.Fatalf("expected types.Bool, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("startsWith_bytes = %v, want %v", got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("startsWith_bytes_wrong_lhs", func(t *testing.T) {
+		result := overloads[idx["startsWith_bytes"]].Binary(types.String("hello"), types.Bytes([]byte("h")))
+		if !types.IsError(result) {
+			t.Error("expected error for non-Bytes lhs")
+		}
+	})
+
+	t.Run("startsWith_bytes_wrong_rhs", func(t *testing.T) {
+		result := overloads[idx["startsWith_bytes"]].Binary(types.Bytes([]byte("hello")), types.String("h"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-Bytes rhs")
+		}
+	})
+
+	t.Run("startsWith_string", func(t *testing.T) {
+		binary := overloads[idx["startsWith_string"]].Binary
+
+		tests := []struct {
+			name string
+			lhs  types.String
+			rhs  types.String
+			want types.Bool
+		}{
+			{"case_insensitive_match", "Hello World", "hello", true},
+			{"upper_prefix", "hello world", "HELLO", true},
+			{"no_match", "hello world", "world", false},
+			{"empty_prefix", "hello", "", true},
+			{"exact", "Hello", "Hello", true},
+		}
+		for _, tc := range tests {
+			t.Run(tc.name, func(t *testing.T) {
+				result := binary(tc.lhs, tc.rhs)
+				if types.IsError(result) {
+					t.Fatalf("unexpected error: %v", result)
+				}
+				got, ok := result.(types.Bool)
+				if !ok {
+					t.Fatalf("expected types.Bool, got %T", result)
+				}
+				if got != tc.want {
+					t.Errorf("startsWith_string(%q, %q) = %v, want %v", tc.lhs, tc.rhs, got, tc.want)
+				}
+			})
+		}
+	})
+
+	t.Run("startsWith_string_wrong_lhs", func(t *testing.T) {
+		result := overloads[idx["startsWith_string"]].Binary(types.Int(0), types.String("h"))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String lhs")
+		}
+	})
+
+	t.Run("startsWith_string_wrong_rhs", func(t *testing.T) {
+		result := overloads[idx["startsWith_string"]].Binary(types.String("hello"), types.Bool(true))
+		if !types.IsError(result) {
+			t.Error("expected error for non-String rhs")
+		}
+	})
+}

webscan/lib/eval_test.go

@@ -1342,3 +1342,54 @@ func TestRandomStrRejectsNegativeLength(t *testing.T) {
 		t.Fatalf("RandomStr negative length = %q, want empty", got)
 	}
 }
+
+// =============================================================================
+// MakeVarDecl 测试
+// =============================================================================
+
+func TestMakeVarDecl(t *testing.T) {
+	tests := []struct {
+		name      string
+		key       string
+		value     string
+		wantIdent string // 期望 Decl.Name
+		wantKind  string // "int" / "string" / "object"
+	}{
+		{"randomInt 前缀 -> Int", "myrand", "randomInt(1,100)", "myrand", "int"},
+		{"newReverse 前缀 -> Object", "myrev", "newReverse()", "myrev", "object"},
+		{"普通字符串 -> String", "myvar", "somevalue", "myvar", "string"},
+		{"空值 -> String", "empty", "", "empty", "string"},
+		{"randomIntExtra -> Int", "n", "randomInt(0, 65535)", "n", "int"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			decl := MakeVarDecl(tt.key, tt.value)
+			if decl == nil {
+				t.Fatal("MakeVarDecl() returned nil")
+			}
+			if decl.Name != tt.wantIdent {
+				t.Errorf("Decl.Name = %q, want %q", decl.Name, tt.wantIdent)
+			}
+			// 通过 Type 字段判断类型种类
+			tp := decl.GetIdent().GetType()
+			if tp == nil {
+				t.Fatal("Decl.GetIdent().GetType() == nil")
+			}
+			switch tt.wantKind {
+			case "int":
+				if tp.GetPrimitive().String() != "INT64" {
+					t.Errorf("type = %v, want INT64", tp)
+				}
+			case "string":
+				if tp.GetPrimitive().String() != "STRING" {
+					t.Errorf("type = %v, want STRING", tp)
+				}
+			case "object":
+				if tp.GetMessageType() == "" {
+					t.Errorf("type = %v, want MessageType", tp)
+				}
+			}
+		})
+	}
+}

webscan/lib/poc_executor_test.go

@@ -517,6 +517,74 @@ func TestPocExecutorPureHelpers(t *testing.T) {
 	})
 }
 
+// =============================================================================
+// isPlainLiteral 测试
+// =============================================================================
+
+func TestIsPlainLiteral_EmptyString(t *testing.T) {
+	if isPlainLiteral("", nil) {
+		t.Error("空字符串不是字面量")
+	}
+}
+
+func TestIsPlainLiteral_PlainWord(t *testing.T) {
+	if !isPlainLiteral("database", nil) {
+		t.Error("纯单词 'database' 应视为字面量")
+	}
+}
+
+func TestIsPlainLiteral_WithParens(t *testing.T) {
+	if isPlainLiteral("func()", nil) {
+		t.Error("含括号的表达式不是字面量")
+	}
+}
+
+func TestIsPlainLiteral_WithOperator(t *testing.T) {
+	for _, expr := range []string{"a+b", "a*b", "a==b", "a!=b", "a<b", "a>b", "a&&b", "a||b"} {
+		if isPlainLiteral(expr, nil) {
+			t.Errorf("含运算符的表达式 %q 不是字面量", expr)
+		}
+	}
+}
+
+func TestIsPlainLiteral_WithQuotes(t *testing.T) {
+	if isPlainLiteral(`"hello"`, nil) {
+		t.Error("含引号的表达式不是字面量")
+	}
+	if isPlainLiteral("'hello'", nil) {
+		t.Error("含单引号的表达式不是字面量")
+	}
+}
+
+func TestIsPlainLiteral_VariableRef(t *testing.T) {
+	// 如果 expr 是已声明变量的名字，应走 CEL 求值
+	varMap := map[string]interface{}{"token": "abc123"}
+	if isPlainLiteral("token", varMap) {
+		t.Error("已声明变量不应被视为字面量")
+	}
+}
+
+func TestIsPlainLiteral_UndeclaredVariable(t *testing.T) {
+	varMap := map[string]interface{}{"token": "abc123"}
+	// 未声明的变量名且无特殊字符 -> 字面量
+	if !isPlainLiteral("sql", varMap) {
+		t.Error("未声明的纯单词 'sql' 应视为字面量")
+	}
+}
+
+func TestIsPlainLiteral_WithBracket(t *testing.T) {
+	if isPlainLiteral("arr[0]", nil) {
+		t.Error("含方括号的表达式不是字面量")
+	}
+}
+
+func TestIsPlainLiteral_PathLike(t *testing.T) {
+	// 路径中可能含 /，但 / 不在排除字符中，视为字面量
+	if !isPlainLiteral("admin", nil) {
+		t.Error("纯字母字符串应为字面量")
+	}
+}
+
 func stringMatrixEqual(a, b [][]string) bool {
 	if len(a) != len(b) {
 		return false
@@ -533,3 +601,267 @@ func stringMatrixEqual(a, b [][]string) bool {
 	}
 	return true
 }
+
+// =============================================================================
+// buildVulnDetails 测试
+// =============================================================================
+
+func TestBuildVulnDetails(t *testing.T) {
+	tests := []struct {
+		name          string
+		pocDef        *Poc
+		vulName       string
+		params        StrMap
+		wantKeys      []string
+		wantNoKeys    []string
+		wantVulnType  string
+		wantVulnName  string
+		wantParamVal  string
+		wantParamKey  string
+	}{
+		{
+			name:         "最小Poc只有Name",
+			pocDef:       &Poc{Name: "poc-yaml-test"},
+			vulName:      "poc-yaml-test",
+			params:       nil,
+			wantKeys:     []string{"vulnerability_type", "vulnerability_name"},
+			wantNoKeys:   []string{"author", "references", "description", "parameters"},
+			wantVulnType: "poc-yaml-test",
+			wantVulnName: "poc-yaml-test",
+		},
+		{
+			name: "完整Poc含Author+Links+Description",
+			pocDef: &Poc{
+				Name: "poc-yaml-full",
+				Detail: Detail{
+					Author:      "kei",
+					Links:       []string{"https://example.com"},
+					Description: "test vuln",
+				},
+			},
+			vulName:      "Full Vuln",
+			params:       nil,
+			wantKeys:     []string{"vulnerability_type", "vulnerability_name", "author", "references", "description"},
+			wantNoKeys:   []string{"parameters"},
+			wantVulnType: "poc-yaml-full",
+			wantVulnName: "Full Vuln",
+		},
+		{
+			name:   "有params则details含parameters字段",
+			pocDef: &Poc{Name: "poc-yaml-params"},
+			vulName: "Params Vuln",
+			params: StrMap{
+				{Key: "user", Value: "admin"},
+				{Key: "pass", Value: "123456"},
+			},
+			wantKeys:    []string{"vulnerability_type", "vulnerability_name", "parameters"},
+			wantNoKeys:  []string{"author"},
+			wantParamKey: "user",
+			wantParamVal: "admin",
+		},
+		{
+			name:       "空params不含parameters字段",
+			pocDef:     &Poc{Name: "poc-yaml-empty-params"},
+			vulName:    "Empty Params",
+			params:     StrMap{},
+			wantKeys:   []string{"vulnerability_type", "vulnerability_name"},
+			wantNoKeys: []string{"parameters"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			details := buildVulnDetails(tt.pocDef, tt.vulName, tt.params)
+
+			for _, k := range tt.wantKeys {
+				if _, ok := details[k]; !ok {
+					t.Errorf("details 缺少字段 %q", k)
+				}
+			}
+			for _, k := range tt.wantNoKeys {
+				if _, ok := details[k]; ok {
+					t.Errorf("details 不应含字段 %q", k)
+				}
+			}
+			if tt.wantVulnType != "" {
+				if got, _ := details["vulnerability_type"].(string); got != tt.wantVulnType {
+					t.Errorf("vulnerability_type = %q, want %q", got, tt.wantVulnType)
+				}
+			}
+			if tt.wantVulnName != "" {
+				if got, _ := details["vulnerability_name"].(string); got != tt.wantVulnName {
+					t.Errorf("vulnerability_name = %q, want %q", got, tt.wantVulnName)
+				}
+			}
+			if tt.wantParamKey != "" {
+				pm, ok := details["parameters"].(map[string]string)
+				if !ok {
+					t.Fatalf("parameters 类型错误，实际 %T", details["parameters"])
+				}
+				if got := pm[tt.wantParamKey]; got != tt.wantParamVal {
+					t.Errorf("parameters[%q] = %q, want %q", tt.wantParamKey, got, tt.wantParamVal)
+				}
+			}
+		})
+	}
+}
+
+// =============================================================================
+// buildVulnLogMsg 测试
+// =============================================================================
+
+func TestBuildVulnLogMsg(t *testing.T) {
+	tests := []struct {
+		name      string
+		targetURL string
+		pocDef    *Poc
+		vulName   string
+		params    StrMap
+	}{
+		{
+			name:      "backup-file名称走特殊模板",
+			targetURL: "http://example.com",
+			pocDef:    &Poc{Name: "poc-yaml-backup-file"},
+			vulName:   "poc-yaml-backup-file",
+			params:    nil,
+		},
+		{
+			name:      "sql-file名称走特殊模板",
+			targetURL: "http://example.com",
+			pocDef:    &Poc{Name: "poc-yaml-sql-file"},
+			vulName:   "poc-yaml-sql-file",
+			params:    nil,
+		},
+		{
+			name:      "有params走params模板",
+			targetURL: "http://example.com",
+			pocDef:    &Poc{Name: "poc-yaml-rce"},
+			vulName:   "RCE",
+			params:    StrMap{{Key: "cmd", Value: "id"}},
+		},
+		{
+			name:      "无params走detail_header模板",
+			targetURL: "http://example.com",
+			pocDef: &Poc{
+				Name: "poc-yaml-sqli",
+				Detail: Detail{
+					Author:      "kei",
+					Links:       []string{"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0001"},
+					Description: "SQL injection",
+				},
+			},
+			vulName: "SQLi",
+			params:  nil,
+		},
+		{
+			name:      "无params无detail只走header",
+			targetURL: "http://example.com",
+			pocDef:    &Poc{Name: "poc-yaml-generic"},
+			vulName:   "Generic",
+			params:    nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			msg := buildVulnLogMsg(tt.targetURL, tt.pocDef, tt.vulName, tt.params)
+			if msg == "" {
+				t.Errorf("buildVulnLogMsg() 返回空字符串")
+			}
+		})
+	}
+}
+
+// =============================================================================
+// collectVarDeclarations 测试
+// =============================================================================
+
+func TestCollectVarDeclarations(t *testing.T) {
+	t.Run("空 POC 返回空切片", func(t *testing.T) {
+		p := &Poc{}
+		decls := collectVarDeclarations(p)
+		if len(decls) != 0 {
+			t.Fatalf("len = %d, want 0", len(decls))
+		}
+	})
+
+	t.Run("仅 Set 字段", func(t *testing.T) {
+		p := &Poc{
+			Set: StrMap{
+				{Key: "token", Value: "randomLowercase(8)"},
+				{Key: "port", Value: "randomInt(1000, 9000)"},
+			},
+		}
+		decls := collectVarDeclarations(p)
+		if len(decls) != 2 {
+			t.Fatalf("len = %d, want 2", len(decls))
+		}
+		if decls[0].Name != "token" {
+			t.Errorf("decls[0].Name = %q, want token", decls[0].Name)
+		}
+		if decls[1].Name != "port" {
+			t.Errorf("decls[1].Name = %q, want port", decls[1].Name)
+		}
+	})
+
+	t.Run("仅 Sets 字段", func(t *testing.T) {
+		p := &Poc{
+			Sets: ListMap{
+				{Key: "user", Value: []string{"admin", "root"}},
+			},
+		}
+		decls := collectVarDeclarations(p)
+		if len(decls) != 1 {
+			t.Fatalf("len = %d, want 1", len(decls))
+		}
+		if decls[0].Name != "user" {
+			t.Errorf("decls[0].Name = %q, want user", decls[0].Name)
+		}
+	})
+
+	t.Run("Sets 空值列表不 panic", func(t *testing.T) {
+		p := &Poc{
+			Sets: ListMap{
+				{Key: "empty", Value: []string{}},
+			},
+		}
+		decls := collectVarDeclarations(p)
+		if len(decls) != 1 {
+			t.Fatalf("len = %d, want 1", len(decls))
+		}
+		if decls[0].Name != "empty" {
+			t.Errorf("decls[0].Name = %q, want empty", decls[0].Name)
+		}
+	})
+
+	t.Run("Set 和 Sets 合并", func(t *testing.T) {
+		p := &Poc{
+			Set: StrMap{
+				{Key: "a", Value: "x"},
+			},
+			Sets: ListMap{
+				{Key: "b", Value: []string{"y"}},
+			},
+		}
+		decls := collectVarDeclarations(p)
+		if len(decls) != 2 {
+			t.Fatalf("len = %d, want 2", len(decls))
+		}
+	})
+
+	t.Run("newReverse 前缀推断 Object 类型", func(t *testing.T) {
+		p := &Poc{
+			Set: StrMap{
+				{Key: "rev", Value: "newReverse()"},
+			},
+		}
+		decls := collectVarDeclarations(p)
+		if len(decls) != 1 {
+			t.Fatalf("len = %d, want 1", len(decls))
+		}
+		tp := decls[0].GetIdent().GetType()
+		if tp == nil || tp.GetMessageType() == "" {
+			t.Errorf("期望 Object 类型，实际 %v", tp)
+		}
+	})
+}

webscan/lib/shiro_test.go

@@ -0,0 +1,237 @@
+package lib
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+)
+
+// =============================================================================
+// Padding 测试
+// =============================================================================
+
+func TestPadding_BasicBlockAlignment(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     []byte
+		blockSize int
+		wantLen   int // 期望长度
+	}{
+		{
+			name:      "空输入填充整个块",
+			input:     []byte{},
+			blockSize: 16,
+			wantLen:   16,
+		},
+		{
+			name:      "15字节填充1字节",
+			input:     make([]byte, 15),
+			blockSize: 16,
+			wantLen:   16,
+		},
+		{
+			name:      "整块对齐追加完整块",
+			input:     make([]byte, 16),
+			blockSize: 16,
+			wantLen:   32,
+		},
+		{
+			name:      "1字节填充15字节",
+			input:     []byte{0x01},
+			blockSize: 16,
+			wantLen:   16,
+		},
+		{
+			name:      "blockSize=8时的对齐",
+			input:     make([]byte, 5),
+			blockSize: 8,
+			wantLen:   8,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := Padding(tt.input, tt.blockSize)
+			if len(result) != tt.wantLen {
+				t.Errorf("Padding() len=%d, want %d", len(result), tt.wantLen)
+			}
+			// 验证填充字节值符合 PKCS7 规范
+			if len(result) > 0 {
+				padLen := int(result[len(result)-1])
+				if padLen == 0 || padLen > tt.blockSize {
+					t.Errorf("填充字节值 %d 超出 blockSize=%d", padLen, tt.blockSize)
+				}
+				// 验证所有填充字节相同
+				for i := len(result) - padLen; i < len(result); i++ {
+					if result[i] != byte(padLen) {
+						t.Errorf("填充字节[%d]=%d 不等于 padLen=%d", i, result[i], padLen)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestPadding_ResultLength(t *testing.T) {
+	// 任意长度输入，结果都应该是 blockSize 的整数倍
+	blockSize := 16
+	for inputLen := 0; inputLen < 50; inputLen++ {
+		input := make([]byte, inputLen)
+		result := Padding(input, blockSize)
+		if len(result)%blockSize != 0 {
+			t.Errorf("输入长度 %d: 填充后长度 %d 不是 %d 的倍数", inputLen, len(result), blockSize)
+		}
+	}
+}
+
+// =============================================================================
+// AESCBCEncrypt 测试
+// =============================================================================
+
+func TestAESCBCEncrypt_ValidKey128(t *testing.T) {
+	// 128-bit AES key (16 bytes)
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	result := AESCBCEncrypt(key)
+	if result == "" {
+		t.Error("有效的128位密钥应返回非空结果")
+	}
+	// 结果应为有效的 base64
+	_, err := base64.StdEncoding.DecodeString(result)
+	if err != nil {
+		t.Errorf("AESCBCEncrypt 结果应为有效 base64: %v", err)
+	}
+}
+
+func TestAESCBCEncrypt_ValidKey256(t *testing.T) {
+	// 256-bit AES key (32 bytes)
+	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
+	result := AESCBCEncrypt(key)
+	if result == "" {
+		t.Error("有效的256位密钥应返回非空结果")
+	}
+}
+
+func TestAESCBCEncrypt_InvalidBase64Key(t *testing.T) {
+	result := AESCBCEncrypt("!!!not-valid-base64!!!")
+	if result != "" {
+		t.Error("无效 base64 密钥应返回空字符串")
+	}
+}
+
+func TestAESCBCEncrypt_InvalidKeySize(t *testing.T) {
+	// AES 要求密钥为 16/24/32 字节，10 字节无效
+	key := base64.StdEncoding.EncodeToString(make([]byte, 10))
+	result := AESCBCEncrypt(key)
+	if result != "" {
+		t.Error("无效密钥长度应返回空字符串")
+	}
+}
+
+func TestAESCBCEncrypt_NonDeterministic(t *testing.T) {
+	// 因为 IV 是随机的，两次加密结果应不同
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	r1 := AESCBCEncrypt(key)
+	r2 := AESCBCEncrypt(key)
+	if r1 == r2 {
+		// 极小概率相同，记录即可
+		t.Log("两次加密结果相同（极低概率事件）")
+	}
+}
+
+// =============================================================================
+// AESGCMEncrypt 测试
+// =============================================================================
+
+func TestAESGCMEncrypt_ValidKey128(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	result := AESGCMEncrypt(key)
+	if result == "" {
+		t.Error("有效的128位密钥应返回非空结果")
+	}
+	_, err := base64.StdEncoding.DecodeString(result)
+	if err != nil {
+		t.Errorf("AESGCMEncrypt 结果应为有效 base64: %v", err)
+	}
+}
+
+func TestAESGCMEncrypt_InvalidKey(t *testing.T) {
+	result := AESGCMEncrypt("invalid-base64!!!")
+	if result != "" {
+		t.Error("无效 base64 密钥应返回空字符串")
+	}
+}
+
+func TestAESGCMEncrypt_NonDeterministic(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	r1 := AESGCMEncrypt(key)
+	r2 := AESGCMEncrypt(key)
+	// GCM nonce 随机，结果不应相同
+	if r1 == r2 {
+		t.Log("两次 GCM 加密结果相同（极低概率事件）")
+	}
+}
+
+// =============================================================================
+// GetShrioCookie 测试
+// =============================================================================
+
+func TestGetShrioCookie_CBCMode(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	result := GetShrioCookie(key, "cbc")
+	if result == "" {
+		t.Error("CBC 模式应返回非空 cookie")
+	}
+}
+
+func TestGetShrioCookie_GCMMode(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	result := GetShrioCookie(key, "gcm")
+	if result == "" {
+		t.Error("GCM 模式应返回非空 cookie")
+	}
+}
+
+func TestGetShrioCookie_DefaultMode(t *testing.T) {
+	// 非 gcm 模式走 CBC
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	result := GetShrioCookie(key, "other")
+	cbcResult := AESCBCEncrypt(key)
+	// 两个结果都应为非空 base64，但由于随机 IV 不一定相同
+	if result == "" {
+		t.Error("默认（非gcm）模式应使用 CBC 加密并返回非空结果")
+	}
+	_ = cbcResult
+}
+
+func TestGetShrioCookie_RealShiroKey(t *testing.T) {
+	// 使用真实的 Shiro 默认密钥
+	shiroDefaultKey := "kPH+bIxk5D2deZiIxcaaaA=="
+	result := GetShrioCookie(shiroDefaultKey, "cbc")
+	if result == "" {
+		t.Error("使用默认 Shiro 密钥应能生成有效 cookie")
+	}
+	// 验证结果是 base64 编码
+	decoded, err := base64.StdEncoding.DecodeString(result)
+	if err != nil {
+		t.Errorf("结果应为有效 base64: %v", err)
+	}
+	// CBC 模式：IV(16字节) + 密文，结果至少 32 字节
+	if len(decoded) < 32 {
+		t.Errorf("CBC 加密结果太短: %d 字节", len(decoded))
+	}
+}
+
+func TestGetShrioCookie_ResultIsBase64(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 16))
+	for _, mode := range []string{"cbc", "gcm"} {
+		result := GetShrioCookie(key, mode)
+		if result == "" {
+			t.Errorf("mode=%s: 结果不应为空", mode)
+			continue
+		}
+		// base64 只含 [A-Za-z0-9+/=]
+		if strings.ContainsAny(result, " \t\n\r") {
+			t.Errorf("mode=%s: base64 结果不应含空白字符", mode)
+		}
+	}
+}