small tweak to scope logic

bbot/modules/base.py

@@ -61,8 +61,6 @@ class BaseModule:
 
         failed_request_abort_threshold (int): Threshold for setting error state after failed HTTP requests (only takes effect when `request_with_fail_count()` is used. Default is 5.
 
-        _scope_shepherding (bool): When set to False, prevents events generated by this module from being automatically marked as in-scope. Default is True. Useful for low-confidence modules like speculate and ipneighbor.
-
         _preserve_graph (bool): When set to True, accept events that may be duplicates but are necessary for construction of complete graph. Typically only enabled for output modules that need to maintain full chains of events, e.g. `neo4j` and `json`. Default is False.
 
         _stats_exclude (bool): Whether to exclude this module from scan statistics. Default is False.
@@ -101,7 +99,6 @@ class BaseModule:
     batch_wait = 10
     failed_request_abort_threshold = 5
 
-    _scope_shepherding = True
     _preserve_graph = False
     _stats_exclude = False
     _qsize = 0

bbot/modules/internal/speculate.py

@@ -30,7 +30,6 @@ class speculate(BaseInternalModule):
         "ports": "The set of ports to speculate on",
     }
     scope_distance_modifier = 1
-    _scope_shepherding = False
     _priority = 4
 
     async def setup(self):

bbot/modules/ipneighbor.py

@@ -11,7 +11,6 @@ class ipneighbor(BaseModule):
     options = {"num_bits": 4}
     options_desc = {"num_bits": "Netmask size (in CIDR notation) to check. Default is 4 bits (16 hosts)"}
     scope_distance_modifier = 1
-    _scope_shepherding = False
 
     async def setup(self):
         self.processed = set()

bbot/scanner/manager.py

@@ -263,12 +263,12 @@ async def _emit_event(self, event, **kwargs):
             # make sure we preserve its chain of parents
             source = event.source
             if source.internal and (event_will_be_output or event._graph_important):
-                if event_in_report_distance:
+                source_in_report_distance = source.scope_distance <= self.scan.scope_report_distance
+                if source_in_report_distance:
                     source.internal = False
-                already_graph_important = bool(source._graph_important)
-                if not already_graph_important:
+                if not source._graph_important:
                     source._graph_important = True
-                    log.debug(f"re-queuing internal event {source} with parent {event}")
+                    log.debug(f"Re-queuing internal event {source} with parent {event}")
                     self.queue_event(source)
 
             # now that the event is properly tagged, we can finally make decisions about it