[BUG]: Shannon should stop immediately when website not reachable

[klausi]

Describe the bug

Shannon ran for 5 hours and spent $100, but it could not test exploits because the target site was not reachable. In the report it wrote:

Current Blocker: DDEV application stack not running in agent environment; https://default.frontend.example.ddev.site resolves to 127.0.0.1:443 (connection refused)

But I started DDEV on my local machine and the site is reachbale through my local browser. Maybe docker network issues? How do you run Shannon to test against a Docker-based local application running in other containers?

Can Shannon do a quick check if it can reach the target site from its containers and if not then stop immediately?

Steps to reproduce

1. Start DDEV site
2. Start Shannon with URL pointing to the DDEV site
3. Shanon never stops although it could not reach the site

Expected behaviour

Shannon stops immediately when URL not reachable

Actual behaviour

Shannon runs for 5 hours and wastes tokens.

Pre-submission checklist (required)

• I have searched the existing open issues and confirmed this bug has not already been reported.
• I am running the latest released version of shannon.

If applicable

• I have included relevant error messages, stack traces, or failure details.
• I have checked the audit logs and pasted the relevant errors.
• I have inspected the failed Temporal workflow run and included the failure reason.
• I have included clear steps to reproduce the issue.
• I have redacted any sensitive information (tokens, URLs, repo names).

Debugging details

No response

Screenshots

No response

Authentication method used

CLAUDE_CODE_OAUTH_TOKEN

Full ./shannon command with all flags used (with redactions)

./shannon start URL=https://example.ddev.site REPO=example CONFIG=./configs/mysite.yaml

Are you using any experimental models or providers other than default Anthropic models?

No

If Yes, which one (model/provider)?

No response

OS (with version)

Ubuntu 24.04

Docker version ('docker -v')

29.3.0

Additional context

No response

[ezl-keygraph]

Thanks for the report

For local setups, the URL passed should be host.docker.internal instead of localhost or 127.0.0.1 as documented in the README, since the target needs to be reachable from the containers

We’ll also add the target URL to the preflight checks in upcoming updates

[klausi]

Aha, totally missed that, thanks!

I think this bug report is still valid and 2 improvements can be made:

1. If URL is not reachable then stop test immediately and print error
2. If URL DNS resolves to 127.0.0.1 then and URL is not reachable then print error with hint to use docker URL instead.

[ezl-keygraph]

Yeah sure, will add preflight checks in the upcoming updates covering these. Thanks for reporting!

[daveashworth]

I'd like to add on to this that I just also burned $50+ in claude code credits because 1) it couldn't start the dev server and just kept trying 337 times until I realized what was happening. I had passed the correct URL parameter as documented in the README doc. Then during the exploitation phase, it was unable to authenticate through Clerk's 2FA, but kept trying to anyways. That burned another $33. These access issue type problems shouldn't keep being retried. Its frustrating b/c I've spent $80 and don't have a completed report now. The idea of this pen tester is really amazing and with some polish/updates I'd like to try again...

[keygraphVarun]

@ezl-keygraph will this be fixed in the npx branch?

[ezl-keygraph]

Yes, this will be fixed in the npx branch

[Karen86Tonoyan]

Chek my brachu i fixed wt., 24 mar 2026, 11:50 użytkownik ezl-keygraph ***@***.***> napisał:

…

*ezl-keygraph* left a comment (KeygraphHQ/shannon#244) <#244 (comment)> Yes, this will be fixed in the npx branch — Reply to this email directly, view it on GitHub <#244?email_source=notifications&email_token=BUHB4EYKJ2ZKM7VILMMLTD34SJR7JA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJRG4ZDCNBWGEZKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-4117214612>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BUHB4E7S3VVDA3KSZOICMFD4SJR7JAVCNFSM6AAAAACWUJ6RLKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCMJXGIYTINRRGI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>