diff --git a/.gitbook/assets/ui-screenshots/01-cloud-auth.png b/.gitbook/assets/ui-screenshots/01-cloud-auth.png new file mode 100644 index 0000000..b0fe026 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/01-cloud-auth.png differ diff --git a/.gitbook/assets/ui-screenshots/02-cloud-organization.png b/.gitbook/assets/ui-screenshots/02-cloud-organization.png new file mode 100644 index 0000000..ef70d73 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/02-cloud-organization.png differ diff --git a/.gitbook/assets/ui-screenshots/03-cloud-documentation.png b/.gitbook/assets/ui-screenshots/03-cloud-documentation.png new file mode 100644 index 0000000..7700c12 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/03-cloud-documentation.png differ diff --git a/.gitbook/assets/ui-screenshots/03b-cloud-documentation-full.png b/.gitbook/assets/ui-screenshots/03b-cloud-documentation-full.png new file mode 100644 index 0000000..52c3af5 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/03b-cloud-documentation-full.png differ diff --git a/.gitbook/assets/ui-screenshots/10-app-dashboard.png b/.gitbook/assets/ui-screenshots/10-app-dashboard.png new file mode 100644 index 0000000..47e6a75 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/10-app-dashboard.png differ diff --git a/.gitbook/assets/ui-screenshots/11-app-workspaces.png b/.gitbook/assets/ui-screenshots/11-app-workspaces.png new file mode 100644 index 0000000..4396f91 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/11-app-workspaces.png differ diff --git a/.gitbook/assets/ui-screenshots/12-app-runners.png b/.gitbook/assets/ui-screenshots/12-app-runners.png new file mode 100644 index 0000000..f8e79b3 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/12-app-runners.png differ diff --git a/.gitbook/assets/ui-screenshots/13-app-scans.png b/.gitbook/assets/ui-screenshots/13-app-scans.png new file mode 100644 index 0000000..796c761 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/13-app-scans.png differ diff --git a/.gitbook/assets/ui-screenshots/14-app-workflows.png b/.gitbook/assets/ui-screenshots/14-app-workflows.png new file mode 100644 index 0000000..49686b4 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/14-app-workflows.png differ diff --git a/.gitbook/assets/ui-screenshots/15-app-tasks.png b/.gitbook/assets/ui-screenshots/15-app-tasks.png new file mode 100644 index 0000000..c9866e8 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/15-app-tasks.png differ diff --git a/.gitbook/assets/ui-screenshots/16-app-tasks-run.png b/.gitbook/assets/ui-screenshots/16-app-tasks-run.png new file mode 100644 index 0000000..7172852 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/16-app-tasks-run.png differ diff --git a/.gitbook/assets/ui-screenshots/17-app-findings.png b/.gitbook/assets/ui-screenshots/17-app-findings.png new file mode 100644 index 0000000..05b5c71 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/17-app-findings.png differ diff --git a/.gitbook/assets/ui-screenshots/18-app-reports.png b/.gitbook/assets/ui-screenshots/18-app-reports.png new file mode 100644 index 0000000..a721cab Binary files /dev/null and b/.gitbook/assets/ui-screenshots/18-app-reports.png differ diff --git a/.gitbook/assets/ui-screenshots/19-app-tokens.png b/.gitbook/assets/ui-screenshots/19-app-tokens.png new file mode 100644 index 0000000..387998e Binary files /dev/null and b/.gitbook/assets/ui-screenshots/19-app-tokens.png differ diff --git a/.gitbook/assets/ui-screenshots/20-app-workspace-detail.png b/.gitbook/assets/ui-screenshots/20-app-workspace-detail.png new file mode 100644 index 0000000..67ef3d4 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/20-app-workspace-detail.png differ diff --git a/.gitbook/assets/ui-screenshots/21-app-scan-detail.png b/.gitbook/assets/ui-screenshots/21-app-scan-detail.png new file mode 100644 index 0000000..84fd3b5 Binary files /dev/null and b/.gitbook/assets/ui-screenshots/21-app-scan-detail.png differ diff --git a/.gitbook/assets/ui-screenshots/22-app-workflow-detail.png b/.gitbook/assets/ui-screenshots/22-app-workflow-detail.png new file mode 100644 index 0000000..176f3cb Binary files /dev/null and b/.gitbook/assets/ui-screenshots/22-app-workflow-detail.png differ diff --git a/SUMMARY.md b/SUMMARY.md index dde86e9..ab9933e 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -30,6 +30,36 @@ * [Profiles](in-depth/concepts/profiles.md) * [Deployment](in-depth/deployment.md) +## UI guide + +* [Overview](ui/README.md) +* Quickstart + * [First run in 5 minutes](ui/quickstart.md) + * [Sign in & first login](ui/sign-in.md) + * [Global interface](ui/global-interface.md) + * [Dashboard](ui/dashboard.md) + * [Workspaces](ui/workspaces.md) + * [Targets](ui/targets.md) + * [Runners](ui/runners.md) + * [Findings](ui/findings.md) + * [Reports](ui/reports.md) +* Attacks + * [Attack capabilities](ui/attack-capabilities.md) + * [Available scans](ui/available-scans.md) + * [Available workflows](ui/available-workflows.md) + * [Meta options](ui/meta-options.md) + * [Attack patterns](ui/attack-patterns.md) +* Concepts + * [Platform overview](ui/platform-overview.md) + * [Glossary](ui/glossary.md) +* Power features + * [AI suggestions](ui/ai-suggestions.md) + * [Chores & owner features](ui/chores.md) +* Account & API + * [Profile, organization, billing](ui/profile-billing.md) + * [API tokens](ui/api-tokens.md) +* [Quick reference](ui/quick-reference.md) + ## For developers * [Development setup](for-developers/development-setup.md) diff --git a/ui/README.md b/ui/README.md new file mode 100644 index 0000000..93680ca --- /dev/null +++ b/ui/README.md @@ -0,0 +1,15 @@ +# UI guide + +This section is the end-user reference for the **Secator web interface** — for analysts, pentesters and team admins who use the platform through the browser rather than the CLI. + +It is organized in five parts: + +| Part | What it covers | +|---|---| +| **Quickstart** | Log in, run your first scan, find your way around the UI. | +| **Attacks** | What the platform can do, the catalog of every scan and workflow with their full task tree. | +| **Concepts** | The glossary of platform-specific terms and a high-level architectural overview. | +| **Power features** | AI suggestions, scheduling, owner-only controls. | +| **Account & API** | Profile, organization, billing, API tokens. | + +If you are looking for the **CLI** documentation (`secator x`, `secator w`, `secator s`, library usage, writing custom tasks/workflows), see the rest of this site under *Getting started* and *In-depth*. diff --git a/ui/ai-suggestions.md b/ui/ai-suggestions.md new file mode 100644 index 0000000..3cb29ed --- /dev/null +++ b/ui/ai-suggestions.md @@ -0,0 +1,42 @@ +# AI suggestions + +Suggestions are *actionable hints* generated automatically from the findings already collected in a workspace. They show up in the workspace's **Suggestions** tab and (optionally) appear on the Dashboard via the **View suggestions** button. + +### Where they come from + +Once **AI suggestions** is enabled (Workspace settings → *General* tab), a background job analyses each new wave of findings — open ports, exposed certificates, subdomains, web technologies, leaked emails — and proposes follow-up actions. There is no manual prompt to write; suggestions are pushed asynchronously as data accrues. + +### What a suggestion looks like + +Each suggestion is an expandable card with: + +- **A title and an icon** — at a glance, the kind of action proposed (run a scan, run a workflow, run a single tool, add a target). +- **A natural-language `message`** — *why* the system proposed this. Examples: *"Ports 22, 80, 443 detected on `host-3.acme.com` — running an `sshaudit` task could surface weak ciphers"*, or *"`api.acme.com` was discovered via subdomain enumeration but is not yet a target — adding it lets you scan its endpoints"*. +- **`help` lines** — short reminders or warnings about the proposed action (run hours impact, scope, expected duration). +- **A `cost_evaluation`** — an estimate of how many run hours / how much wall-time the action will consume so you can decide before clicking. +- **A list of related runs** — if you have already executed similar runners on this target, they are linked here so you can compare results. + +### Suggestion types + +| Type | What clicking it does | +|---|---| +| **Runner** (scan / workflow / task) | Opens the *Run* form pre-filled with the suggested runner, target, and options. You can review and tweak before launching. | +| **Add target** | Opens the *Target* form pre-filled with the asset the system thinks should be in scope. Useful right after a subdomain or DNS recon run. | + +### Actions on a suggestion + +- **Run now** — Launches the proposed runner immediately. Once executed, the suggestion is marked *done* and decorated with the run's status. +- **Add target** — Opens the target sheet, with workspace and asset pre-filled. +- **Dismiss** — Removes the suggestion from the active list. Useful when the suggestion does not apply to your engagement. + +> [!note] +> Suggestions are workspace-scoped. Disabling AI suggestions in *Workspace settings → General* stops new suggestions from being generated; existing ones stay until dismissed or executed. + +### Tuning what suggestions you get + +- **Workspace scope** (allowlist / denylist) — Suggestions only consider in-scope assets. +- **Display settings** (Workspace settings → *Display* tab) — Hiding finding types you don't care about prevents suggestions of that flavour. +- **Notifications** — You can subscribe to a notification when a new suggestion appears (Workspace settings → *Notifications* tab). + +> [!tip] +> Use suggestions as a *checklist*, not a roadmap. Always review the proposed options and the cost estimate before clicking *Run now*. diff --git a/ui/api-tokens.md b/ui/api-tokens.md new file mode 100644 index 0000000..d39bf6b --- /dev/null +++ b/ui/api-tokens.md @@ -0,0 +1,15 @@ +# API tokens + +![API tokens page](../.gitbook/assets/ui-screenshots/19-app-tokens.png) + +Programmatic access to the Secator API is gated by tokens you manage from the **API Tokens** page in the user menu. You can: + +- **List tokens** with their name, scopes, creation date, expiration, and status (active, expired, revoked). +- **Create token** — Set a name, choose scopes (read / write / admin and finer-grained), and pick an expiration (preset durations of 7d, 30d, 90d, 1 year, or a custom date). The token value is shown **once** at creation — copy it immediately. + +> [!caution] +> The token value cannot be recovered after the creation dialog is dismissed. If you lose it, you must revoke and recreate the token. Treat it like a password — keep it out of git, CI logs, and shared docs. + +- **Edit** name and scopes of existing tokens. +- **Delete** (revoke) a token with confirmation. +- **Filter** the list by status. diff --git a/ui/attack-capabilities.md b/ui/attack-capabilities.md new file mode 100644 index 0000000..5942da1 --- /dev/null +++ b/ui/attack-capabilities.md @@ -0,0 +1,94 @@ +# Attack capabilities + +The platform's offensive and defensive capabilities are organised here by **intrusion layer** — from zero-touch passive intelligence (Layer 1) to live exploitation (Layer 5). This is the same way a serious engagement scope is written: *"OK for layers 1-3, written authorization required beyond"*. + +When you discuss scope with a client, refer to a layer rather than naming individual tools — every layer maps to a curated set of profiles, workflows and tasks below. + +> [!note] +> Higher layers always include the capabilities of the layers beneath them when they need to (e.g. a Layer 4 vuln scan first runs Layer 2 probes to discover the surface). The layer boundaries are about **what new traffic the platform sends to the target**, not about which tools "could" run. + +### Layer 1 — Passive intelligence + +Zero requests sent to the target. All data comes from third-party datasets (Wayback, Common Crawl, certificate transparency, breach corpora, public source code, social platforms). + +Safe to run during scoping, on out-of-scope assets, or when stealth is mandatory. Use the `passive` profile to lock the platform into this layer. + +| Capability | Tools | +|---|---| +| Subdomain enumeration | `subfinder`, `xurlfind3r` | +| URL harvesting | `gau`, `xurlfind3r`, `urlfinder` | +| WHOIS / domain info | `jswhois`, `whois` | +| ASN / IP intelligence | `getasn` | +| Known-CVE lookup | `searchsploit`, `search_vulns` | +| Email breach lookup | `h8mail` | +| Username correlation | `maigret` | +| Public secret hunting | `gitleaks` (on public git repos) | + +### Layer 2 — Active probing + +Sends TCP / HTTP / DNS / ICMP probes to the target but **no offensive payload**. Just enough traffic to map the surface and fingerprint services. + +Equivalent to standard pre-engagement recon. Most clients accept this as soon as the IP / domain is in scope. + +| Capability | Tools | +|---|---| +| DNS resolution | `dnsx` | +| Port scanning | `nmap`, `naabu` | +| HTTP probing | `httpx` | +| Network discovery (LAN) | `arpscan`, `arp`, `fping`, `mapcidr`, `netdetect` | +| TLS posture | `testssl` | +| SSH hardening | `sshaudit` | +| WAF fingerprinting | `wafw00f` | + +### Layer 3 — Crawling & content discovery + +Walks the application like a user or a search-engine spider, plus directory / parameter brute-force on the discovered surface. Consumes target bandwidth but does not yet send injection payloads. + +Use when the scope is *web app testing* without explicit authorization for vuln scanning. + +| Capability | Tools | +|---|---| +| Active crawling | `katana`, `gospider`, `cariddi` | +| Directory / file brute-force | `feroxbuster`, `dirsearch`, `ffuf` | +| HTTP parameter discovery | `arjun`, `x8` | +| In-response secret hunting | `trufflehog` | +| Pattern matching for vuln candidates | `gf` (SQLi / SSRF / LFI / RCE / IDOR / debug paths) | + +### Layer 4 — Vulnerability scanning + +Sends template- or signature-based payloads to verify whether known issues exist. Findings carry CVE / CVSS / severity data and may include reproducible request/response evidence (records). + +Requires written authorization. Choose `aggressive` for speed, `polite` for production targets. + +| Capability | Tools | +|---|---| +| Generic vulnerability scanner | `nuclei` (10 000+ templates: CVEs, misconfigs, exposed panels) | +| Multipurpose recon-to-vuln pipeline | `bbot` | +| Container / filesystem CVE scanning | `trivy`, `grype` | +| WordPress audit | `wpscan`, `wpprobe` | +| Reflected / stored / DOM XSS | `dalfox` | +| Subdomain-takeover detection | `subdomain_recon` workflow (chains `subfinder → dnsx → httpx → nuclei` takeover templates) | + +### Layer 5 — Exploitation + +Live exploit attempts against confirmed vulnerabilities. **Do not run** unless you have explicit authorization in writing and a controlled rollback plan. + +| Capability | Tools | +|---|---| +| 40x bypass attempts | `bup` (30+ techniques: header injection, path tricks, method override) | +| Known-CVE exploitation modules | `msfconsole` (Metasploit) | + +> [!caution] +> Layer 5 produces real changes on the target — application state, audit logs, sometimes data. Always run inside a lab/staging environment before pointing at production. Verify the workspace's [scope](glossary.md#g-scope) before launching. + +The full content of each scan and each workflow follows directly below. + + + +--- + +See the full content of every scan and workflow in: + +- [Available scans](available-scans.md) +- [Available workflows](available-workflows.md) + diff --git a/ui/attack-patterns.md b/ui/attack-patterns.md new file mode 100644 index 0000000..563e907 --- /dev/null +++ b/ui/attack-patterns.md @@ -0,0 +1,78 @@ +# Attack patterns + +This is the *cookbook* of the platform — concrete, intent-driven recipes. Each pattern says *what you want to do*, *what to click*, and *where to look at the result*. Pick the closest pattern to your engagement, then tune the options to your scope. + +### Bug bounty — out-of-scope guard + +**Goal:** confirm a candidate asset is in scope before any active probe. + +1. Workspace settings → *Scope* tab → enter the program's allowlist patterns (and denylist for explicit out-of-scope domains). +2. Run **`subdomain_recon`** workflow with profile **`passive`** on the program's apex domain. +3. Open the *Findings → Subdomain* tab. Subdomains that fall outside the allowlist are tagged `scope-mismatch` and shown in red. +4. Resolve / drop the out-of-scope ones before adding them as targets. + +> [!tip] +> Combine with the *Suggestions* tab: the platform proposes adding only allowlist-compatible subdomains as new targets. + +### Authenticated web app scan + +**Goal:** scan an app behind a login. + +1. Get a valid session token / API key from the app. +2. Open the *Run* form for the **`url_crawl`** workflow on your target URL. +3. In *Options*, set **Headers** to: `Authorization: Bearer `. For cookie-based auth use `Cookie: session=...`. +4. Optionally set **Method** + **Data** if the app expects POST navigation (rare). +5. Chain with **`url_vuln`** in the same workspace — both will reuse the workspace targets and you'll get `nuclei` + `dalfox` running with the same auth context. + +> [!warning] +> Pick the **`polite`** profile for production apps to avoid filling the audit log with rate-limited 429s. + +### WordPress CVE audit + +**Goal:** find known CVEs on a WordPress install. + +1. Run the **`wordpress`** workflow with profile **`aggressive`** if scope allows, otherwise **`polite`**. +2. Open *Findings → Vulnerability*. Filter by **Severity** ≥ High. +3. Each vulnerability with an `id` (CVE) shows a **Source** badge (`wpscan`, `wpprobe`, `nuclei`). +4. The **Exploit** tab right next to it lists `searchsploit` matches: ready-to-use PoCs for the same CVE. + +### Find leaked secrets in a target's JS + +**Goal:** identify hardcoded API keys / tokens shipped in front-end JS. + +1. Run **`url_crawl`** with the **`hunt_secrets`** profile on the target. +2. Wait for the run to complete. Switch to *Findings → Tag*. +3. Filter by tag value: `aws_key`, `api_key`, `jwt`, `private_key`, `slack_webhook`, `gcp_credentials`. +4. Click any finding → the *Record* link shows the exact JS file and line where the secret was found. + +### Internal CIDR mapping + +**Goal:** map a /24 internal network during an on-site engagement. + +1. Add the CIDR (e.g. `10.0.0.0/24`) as a target in the workspace. +2. Run **`cidr_recon`** workflow with profile **`active`**. +3. Open the workspace's *Overview* tab → **Infrastructure Graph** to see the live host topology. +4. Switch to *Findings → Port* to see the open services per host, then chain `nmap` (deep) tasks on interesting hosts. + +> [!note] +> Layer 2 traffic (ARP, ICMP) requires the worker to be on the same network — typically a worker deployed inside the client's environment. + +### 40x bypass on a forbidden endpoint + +**Goal:** see if a `403 Forbidden` page can be reached through bypass techniques. + +1. From *Tasks → Run a task*, pick **`bup`**. +2. Set the target URL to the forbidden endpoint (e.g. `https://target/admin`). +3. Leave the default 30+ techniques enabled. +4. The runner shows a per-technique table: bypass technique → response status → response size. Anything other than the original 403 is worth investigating manually. + +### Unknown-tech triage + +**Goal:** you have a black-box target and don't know yet which workflow fits. + +1. Add the target. +2. Run the **`url`** scan with profile **`passive`** + **`http_headless`**. +3. Open *Findings → URL* and look at the **Tech** column. The detected stack (PHP, Drupal, Spring, …) tells you which dedicated workflow to run next: `wordpress` for WP, `url_vuln` + `dalfox` for generic webapp, `code_scan` if a public repo was discovered, etc. + +> [!tip] +> The *Suggestions* tab usually proposes the right next workflow automatically based on the detected technologies. Save these clicks by enabling AI suggestions in workspace settings. diff --git a/ui/available-scans.md b/ui/available-scans.md new file mode 100644 index 0000000..3e27921 --- /dev/null +++ b/ui/available-scans.md @@ -0,0 +1,120 @@ +# Available scans + +5 scans ship with the platform. Each one bundles several workflows to cover an entire engagement type. Pick one, point it at a target, and the matching combination of crawling, fuzzing, and vulnerability checks runs automatically. + +Scans are picked from the **Run** form (Workspace → *Run* → *Scan* tab). + +--- + +### `domain` + +_Domain scan_ + +Comprehensive security assessment of a domain, combining multiple workflows for complete coverage. +Performs domain reconnaissance, subdomain discovery, host reconnaissance, URL crawling, and +vulnerability scanning. Provides a full picture of the domain's attack surface, infrastructure, +and potential security issues. Ideal for thorough domain-level security assessments. + +**Input types:** `host` + +**Tags:** `recon` `dns` `ssl` `network` `http` `crawl` `takeovers` `vuln` `secrets` + +**Workflows it runs:** + +- [`domain_recon`](./available-workflows.md#domain_recon) +- [`subdomain_recon`](./available-workflows.md#subdomain_recon) +- [`host_recon`](./available-workflows.md#host_recon) +- [`url_crawl`](./available-workflows.md#url_crawl) +- [`url_vuln`](./available-workflows.md#url_vuln) + + +--- + +### `host` + +_Host scan_ + +In-depth security assessment of a specific host or IP address. +Combines host reconnaissance with URL crawling and vulnerability scanning to identify +open ports, running services, web applications, and potential security weaknesses. +Perfect for targeted host-level security testing and penetration testing. + +**Input types:** `host` `ip` + +**Tags:** `recon` `dns` `network` `http` `crawl` `ssl` `vuln` `secrets` + +**Workflows it runs:** + +- [`host_recon`](./available-workflows.md#host_recon) +- [`url_crawl`](./available-workflows.md#url_crawl) +- [`url_vuln`](./available-workflows.md#url_vuln) + + +--- + +### `network` + +_Internal network scan_ + +Comprehensive security assessment of an internal network or CIDR range. +Discovers live hosts, scans for services and vulnerabilities, and performs URL-based +testing on discovered web applications. Combines CIDR reconnaissance with web application +security testing. Essential for internal network security assessments and lateral movement testing. + +**Input types:** `cidr_range` `slug` + +**Tags:** `recon` `cidr` `dns` `network` `internal` `http` `crawl` `ssl` `vuln` `secrets` + +**Workflows it runs:** + +- [`cidr_recon`](./available-workflows.md#cidr_recon) +- [`host_recon`](./available-workflows.md#host_recon) +- [`url_crawl`](./available-workflows.md#url_crawl) +- [`url_vuln`](./available-workflows.md#url_vuln) + + +--- + +### `subdomain` + +_Subdomain scan_ + +Complete security assessment focused on subdomain discovery and testing. +Discovers all subdomains of a target domain, performs reconnaissance on discovered hosts, +crawls web applications, and scans for vulnerabilities. Identifies the full subdomain +attack surface and potential security issues. Crucial for comprehensive domain security testing. + +**Input types:** `host` + +**Tags:** `recon` `dns` `network` `http` `crawl` `ssl` `takeovers` `vuln` `secrets` + +**Workflows it runs:** + +- [`subdomain_recon`](./available-workflows.md#subdomain_recon) +- [`host_recon`](./available-workflows.md#host_recon) +- [`url_crawl`](./available-workflows.md#url_crawl) +- [`url_vuln`](./available-workflows.md#url_vuln) + + +--- + +### `url` + +_URL scan_ + +Thorough security assessment of web applications and URLs. +Combines URL crawling, fuzzing, and vulnerability scanning to discover hidden content, +identify potential attack vectors, and find security vulnerabilities. Tests for common +web vulnerabilities including XSS, injection flaws, and misconfigurations. Essential for web application security testing. + +**Input types:** `url` + +**Tags:** `http` `crawl` `fuzz` `vuln` `secrets` + +**Workflows it runs:** + +- [`url_crawl`](./available-workflows.md#url_crawl) +- [`url_fuzz`](./available-workflows.md#url_fuzz) +- [`url_params_fuzz`](./available-workflows.md#url_params_fuzz) +- [`url_vuln`](./available-workflows.md#url_vuln) + diff --git a/ui/available-workflows.md b/ui/available-workflows.md new file mode 100644 index 0000000..46174c2 --- /dev/null +++ b/ui/available-workflows.md @@ -0,0 +1,385 @@ +# Available workflows + +15 workflows ship with the platform. Each one chains tasks (security tools) into a coherent recon or assessment flow. The task tree below each workflow is the live view you see when monitoring a run; conditions (`if …`) reflect the option flags that gate each task. + +Workflows are picked from the **Run** form (Workspace → *Run* → *Workflow* tab). + +--- + +### `cidr_recon` + +_Local network reconnaissance_ + +Discovers and analyzes hosts within a CIDR range or local network through ARP / ICMP scanning. +Maps IP addresses and identifies live hosts. +Useful for local network security assessments and penetration testing. + +**Input types:** `cidr_range` `ip` `slug` + +**Tags:** `recon` `cidr` `network` `vuln` `internal` + +**Task tree:** + +- 📂 ***discover*** *(parallel group)* + - 🔧 `netdetect` — Discover local network CIDR ranges — *if `targets`* + - 🔧 `arp` — Discover neighbors with ARP requests — *if `targets`* +- 🔧 `prompt` — Select a CIDR range manually +- 📂 ***probe*** *(parallel group)* + - 🔧 `arpscan` — Discover hosts with ARP requests + - 🔧 `fping` — Discover hosts with ICMP requests + - 🔧 `nmap` — Discover live hosts with ping scan + + +--- + +### `code_scan` + +_Code vulnerability scan and secret hunt_ + +Analyzes source code repositories and filesystems for security vulnerabilities and exposed secrets. +Scans dependencies for known CVEs, detects hardcoded credentials, API keys, and sensitive data +in code. Supports multiple input types including local paths, Git repositories, and cloud storage. +Essential for DevSecOps and identifying security issues before deployment. + +**Input types:** `path` `url` `gcs_url` `string` + +**Tags:** `vuln` `secret` `code` + +**Task tree:** + +- 🔧 `_group` + + +--- + +### `domain_recon` + +_Domain reconnaissance_ + +Performs comprehensive reconnaissance on a domain to gather essential information. +Collects WHOIS data, probes HTTP services, detects technologies, analyzes SSL/TLS security, +resolves DNS records, retrieves ASN information, and identifies any Web Application Firewalls (WAF). +Ideal for understanding a domain's infrastructure and security posture before deeper testing. + +**Input types:** `host` + +**Tags:** `recon` `dns` `ssl` `http` + +**Task tree:** + +- 🔧 `_group` +- 🔧 `wafw00f` — Check WAF — *if `!passive`* + + +--- + +### `host_recon` + +_Host reconnaissance_ + +Performs comprehensive reconnaissance on a host or IP address to identify open ports and services. +Combines multiple port scanning techniques, detects service versions, searches for known vulnerabilities, +audits SSH configurations, and probes HTTP services. Optionally runs nuclei scans for network and +SSL vulnerabilities. Essential for understanding a host's security posture and attack surface. + +**Input types:** `ip` `host` `cidr_range` + +**Tags:** `recon` `network` `http` + +**Task tree:** + +- 🔧 `_group` +- 🔧 `nmap` — Detect services and versions — *if `!passive`* +- 🔧 `sshaudit` — Audit SSH port — *if `!passive`* +- 🔧 `httpx` — Probe HTTP services on open ports — *if `!passive`* +- 📂 ***nuclei*** *(parallel group)* + - 🔧 `nuclei/network` — Scan network and SSL vulnerabilities — *if `nuclei`* + - 🔧 `nuclei/url` — Search for vulnerabilities on alive HTTP services — *if `nuclei`* +- 📂 ***vuln*** *(parallel group)* + - 🔧 `searchsploit` — Search for related exploits — *if `exploiters`* + - 🔧 `search_vulns` — Search for related vulns and exploits — *if `exploiters`* + + +--- + +### `js_secrets_params_hunt` + +_JS secrets and params recon_ + +Crawls the target with multiple engines, hunts for JavaScript variables and secret patterns +using gf, scans HTTP responses with TruffleHog, discovers hidden parameters with Arjun, and +optionally scans tagged URLs with nuclei for vulnerabilities. + +**Input types:** `url` + +**Tags:** `http` `crawl` `secrets` `params` `vuln` + +**Task tree:** + +- 📂 ***crawl*** *(parallel group)* + - 🔧 `gospider` — Crawl target with an alternative engine + - 🔧 `katana` — Crawl target to discover endpoints + - 🔧 `cariddi` — Hunt URL patterns and juicy endpoints +- 🔧 `httpx` — Probe discovered URLs and store responses +- 📂 ***pattern_analysis*** *(parallel group)* + - 🔧 `gf/interestingparams` — Hunt interesting parameters and potential injection points + - 🔧 `gf/idor` — Hunt IDOR-like parameters +- 📂 ***secrets_hunt*** *(parallel group)* + - 🔧 `trufflehog` — Find secrets in HTTP responses — *if `hunt_secrets`* +- 📂 ***extract_params*** *(parallel group)* + - 🔧 `arjun` — Extract parameters from GF-tagged URLs +- 🔧 `nuclei` — Scan GF/Arjun URLs for vulnerabilities — *if `nuclei`* + + +--- + +### `subdomain_recon` + +_Subdomain reconnaissance_ + +Discovers subdomains associated with a target domain using multiple passive and active techniques. +Combines passive sources, DNS queries, TLS certificate analysis, and optional brute-force methods. +Verifies discovered subdomains, checks for subdomain takeover vulnerabilities, and can optionally +test SSL/TLS security or hunt for secrets in HTTP responses. Perfect for mapping attack surface. + +**Input types:** `host` + +**Tags:** `recon` `dns` `http` `ssl` `secrets` `takeovers` + +**Task tree:** + +- 🔧 `httpx/tls` — Find subdomains through TLS certificates — *if `!passive`* +- 📂 ***hunt*** *(parallel group)* + - 🔧 `subfinder` — List subdomains (passive) — *if `!active`* + - 🔧 `gau` — List subdomains (passive) — *if `!active`* + - 🔧 `dnsx/brute` — Bruteforce subdomains (DNS) — *if `brute_dns`* + - 🔧 `ffuf/url` — Bruteforce subdomains (URL) — *if `brute_http`* + - 🔧 `ffuf/host` — Bruteforce subdomains (Host header) — *if `brute_http`* +- 📂 ***probe*** *(parallel group)* + - 🔧 `dnsx/probe` — Verify subdomains by probing DNS records + - 🔧 `httpx/probe` — Run HTTP probes on subdomains — *if `!passive`* +- 📂 ***vuln*** *(parallel group)* + - 🔧 `testssl` — Test SSL/TLS security on subdomains — *if `test_ssl`* + - 🔧 `nuclei` — Check for subdomain takeovers — *if `!passive`* + - 🔧 `trufflehog` — Find secrets in HTTP responses — *if `hunt_secrets`* +- 🔧 `search_vulns` — Search for related vulns and exploits + + +--- + +### `url_bypass` + +_4xx URL bypass techniques_ + +Attempts to bypass access restrictions on URLs that return 4xx status codes (forbidden, not found, etc.). +Uses various HTTP header manipulation and path traversal techniques to potentially gain access +to protected resources. Useful for finding misconfigured access controls and authorization bypasses. + +**Input types:** `url` + +**Tags:** `http` `bypass` + +**Task tree:** + +- 🔧 `bup` — Bypass 4xx + + +--- + +### `url_crawl` + +_URL crawl_ + +Rapidly crawls and discovers URLs from a target website using multiple crawling engines. +Supports both passive sources (collecting from external databases) and active crawlers +(spidering the website directly). Identifies interesting patterns, endpoints, and parameters. +Can optionally hunt for secrets in HTTP responses and probe URLs for additional information. + +**Input types:** `url` + +**Tags:** `http` `crawl` `secrets` + +**Task tree:** + +- 📂 ***crawl*** *(parallel group)* + - 🔧 `xurlfind3r` — Crawl URLs from passive sources — *if `crawlers`* + - 🔧 `urlfinder` — Crawl URLs from passive sources — *if `crawlers`* + - 🔧 `gau` — Crawl URLs from passive sources — *if `crawlers`* + - 🔧 `katana` — Crawl URLs — *if `crawlers`* + - 🔧 `gospider` — Crawl URLs — *if `crawlers`* + - 🔧 `cariddi` — Hunt URLs patterns — *if `crawlers`* +- 🔧 `httpx` — Run HTTP probes on unverified URLs — *if `!passive`* +- 📂 ***data_hunt*** *(parallel group)* + - 🔧 `trufflehog` — Find secrets in HTTP responses — *if `hunt_secrets`* + - 🔧 `maigret` — Hunt email addresses found — *if `hunt_secrets`* + + +--- + +### `url_dirsearch` + +_URL directory search_ + +Searches for hidden directories and files on web servers using content discovery techniques. +Probes URLs for directory listings, optionally bruteforces directories and crawls discovered +directory contents. Can hunt for sensitive files and secrets in HTTP responses. +Helpful for finding hidden admin panels, backup files, and exposed directories. + +**Input types:** `url` `host` `host:port` `ip` + +**Tags:** `http` `dir` `secrets` + +**Task tree:** + +- 🔧 `httpx` — Run HTTP probes on URLs +- 🔧 `ffuf` — Search for HTTP directories — *if `hunt_dirs`* +- 🔧 `katana` — Crawl files from HTTP directories — *if `hunt_files`* +- 🔧 `trufflehog` — Find secrets in HTTP responses — *if `hunt_files`* + + +--- + +### `url_fuzz` + +_URL fuzz (slow)_ + +Performs comprehensive fuzzing of URLs to discover hidden content and directories. +Uses multiple fuzzing engines (dirsearch, feroxbuster, ffuf) with intelligent calibration +to filter false positives. Probes discovered URLs, captures screenshots when configured, +and optionally hunts for secrets in HTTP responses. Thorough but time-intensive. + +**Input types:** `url` + +**Tags:** `http` `fuzz` `secrets` + +**Task tree:** + +- 📂 ***fuzz*** *(parallel group)* + - 🔧 `feroxbuster` — Fuzz URLs — *if `fuzzers`* + - 🔧 `ffuf` — Fuzz URLs — *if `fuzzers`* +- 🔧 `httpx` — Run HTTP probes on fuzzed URLs +- 🔧 `trufflehog` — Find secrets in HTTP responses — *if `hunt_secrets`* + + +--- + +### `url_params_fuzz` + +_URL parameter fuzzing_ + +Identifies and tests URL parameters for vulnerabilities through intelligent fuzzing. +Extracts parameters from URLs using multiple techniques, then fuzzes them with various payloads +to discover potential security issues. Probes fuzzed URLs to verify results and optionally +hunts for secrets in responses. Effective for finding hidden parameters and testing input validation. + +**Input types:** `url` + +**Tags:** `http` `fuzz` `secrets` + +**Task tree:** + +- 🔧 `httpx` — Probe URLs and eliminate unresponsive ones — *if `probe`* +- 🔧 `urlparser` — Extract base URLs +- 📂 ***extract_params*** *(parallel group)* + - 🔧 `arjun` — Extract parameters from URLs — *if `fuzzers`* + - 🔧 `x8` — Bruteforce URL params — *if `fuzzers`* +- 🔧 `ffuf` — Fuzz URL params — *if `fuzz_values`* +- 🔧 `trufflehog` — Find secrets in HTTP responses — *if `hunt_secrets`* + + +--- + +### `url_secrets_hunt` + +_URL secrets hunt_ + +Searches for exposed secrets, credentials, and sensitive information in web content. +Probes URLs and analyzes HTTP responses for API keys, passwords, tokens, private keys, +and other confidential data. Uses TruffleHog to detect various secret patterns. +Critical for identifying accidental credential exposure and sensitive data leaks. + +**Input types:** `url` + +**Tags:** `http` `fuzz` `secrets` + +**Task tree:** + +- 🔧 `httpx` — Run HTTP probes on URLs +- 🔧 `trufflehog` — Find secrets in HTTP responses + + +--- + +### `url_vuln` + +_URL vulnerability scan (gf, dalfox)_ + +Scans URLs for common web vulnerabilities using pattern matching and automated testing tools. +Identifies potential XSS, LFI, SSRF, RCE, IDOR, and other vulnerability indicators in URL parameters. +Tests discovered vulnerable patterns with specialized tools like Dalfox for XSS exploitation. +Optionally runs comprehensive nuclei scans for additional HTTP vulnerability detection. + +**Input types:** `url` + +**Tags:** `http` `vuln` + +**Task tree:** + +- 📂 ***pattern_analysis*** *(parallel group)* + - 🔧 `gf/xss` — Hunt XSS params + - 🔧 `gf/lfi` — Hunt LFI params + - 🔧 `gf/ssrf` — Hunt SSRF params + - 🔧 `gf/rce` — Hunt RCE params + - 🔧 `gf/interestingparams` — Hunt interest params + - 🔧 `gf/idor` — Hunt Idor params + - 🔧 `gf/debug_logic` — Hunt debug params +- 📂 ***vuln_scan*** *(parallel group)* + - 🔧 `dalfox` — Attack XSS vulnerabilities — *if `!passive`* + - 🔧 `nuclei` — Search for HTTP vulns — *if `nuclei`* + + +--- + +### `user_hunt` + +_User account search_ + +Searches for user accounts and associated information across various online platforms and services. +Takes usernames, email addresses, or other identifiers and queries multiple sources to find +associated accounts, password leaks, and online profiles. Useful for OSINT investigations, +credential stuffing prevention checks, and understanding a user's digital footprint. + +**Input types:** `slug` `string` `email` + +**Tags:** `user_account` `leak` + +**Task tree:** + +- 📂 ***hunt_users*** *(parallel group)* + - 🔧 `maigret` — Hunt user accounts + - 🔧 `h8mail` — Find password leaks + + +--- + +### `wordpress` + +_Wordpress vulnerability scan_ + +Specialized security assessment for WordPress websites and installations. +Identifies WordPress version, installed themes and plugins, known vulnerabilities, +misconfigurations, and weak configurations. Uses multiple WordPress-specific tools +to provide comprehensive coverage. Critical for WordPress site security audits. + +**Input types:** `url` `ip` `host` `host:port` + +**Tags:** `http` `wordpress` `vuln` + +**Task tree:** + +- 🔧 `httpx` — URL probe +- 📂 ***hunt_wordpress*** *(parallel group)* + - 🔧 `wpscan` — WPScan + - 🔧 `wpprobe` — WPProbe + - 🔧 `nuclei` — Nuclei Wordpress scan + diff --git a/ui/catalog.json b/ui/catalog.json new file mode 100644 index 0000000..cf9415c --- /dev/null +++ b/ui/catalog.json @@ -0,0 +1,962 @@ +{ + "scans": [ + { + "name": "domain", + "description": "Domain scan", + "long_description": "Comprehensive security assessment of a domain, combining multiple workflows for complete coverage.\nPerforms domain reconnaissance, subdomain discovery, host reconnaissance, URL crawling, and\nvulnerability scanning. Provides a full picture of the domain's attack surface, infrastructure,\nand potential security issues. Ideal for thorough domain-level security assessments.", + "tags": [ + "recon", + "dns", + "ssl", + "network", + "http", + "crawl", + "takeovers", + "vuln", + "secrets" + ], + "input_types": [ + "host" + ], + "workflows": [ + "domain_recon", + "subdomain_recon", + "host_recon", + "url_crawl", + "url_vuln" + ] + }, + { + "name": "host", + "description": "Host scan", + "long_description": "In-depth security assessment of a specific host or IP address.\nCombines host reconnaissance with URL crawling and vulnerability scanning to identify\nopen ports, running services, web applications, and potential security weaknesses.\nPerfect for targeted host-level security testing and penetration testing.", + "tags": [ + "recon", + "dns", + "network", + "http", + "crawl", + "ssl", + "vuln", + "secrets" + ], + "input_types": [ + "host", + "ip" + ], + "workflows": [ + "host_recon", + "url_crawl", + "url_vuln" + ] + }, + { + "name": "network", + "description": "Internal network scan", + "long_description": "Comprehensive security assessment of an internal network or CIDR range.\nDiscovers live hosts, scans for services and vulnerabilities, and performs URL-based\ntesting on discovered web applications. Combines CIDR reconnaissance with web application\nsecurity testing. Essential for internal network security assessments and lateral movement testing.", + "tags": [ + "recon", + "cidr", + "dns", + "network", + "internal", + "http", + "crawl", + "ssl", + "vuln", + "secrets" + ], + "input_types": [ + "cidr_range", + "slug" + ], + "workflows": [ + "cidr_recon", + "host_recon", + "url_crawl", + "url_vuln" + ] + }, + { + "name": "subdomain", + "description": "Subdomain scan", + "long_description": "Complete security assessment focused on subdomain discovery and testing.\nDiscovers all subdomains of a target domain, performs reconnaissance on discovered hosts,\ncrawls web applications, and scans for vulnerabilities. Identifies the full subdomain\nattack surface and potential security issues. Crucial for comprehensive domain security testing.", + "tags": [ + "recon", + "dns", + "network", + "http", + "crawl", + "ssl", + "takeovers", + "vuln", + "secrets" + ], + "input_types": [ + "host" + ], + "workflows": [ + "subdomain_recon", + "host_recon", + "url_crawl", + "url_vuln" + ] + }, + { + "name": "url", + "description": "URL scan", + "long_description": "Thorough security assessment of web applications and URLs.\nCombines URL crawling, fuzzing, and vulnerability scanning to discover hidden content,\nidentify potential attack vectors, and find security vulnerabilities. Tests for common\nweb vulnerabilities including XSS, injection flaws, and misconfigurations. Essential for web application security testing.", + "tags": [ + "http", + "crawl", + "fuzz", + "vuln", + "secrets" + ], + "input_types": [ + "url" + ], + "workflows": [ + "url_crawl", + "url_fuzz", + "url_params_fuzz", + "url_vuln" + ] + } + ], + "workflows": [ + { + "name": "cidr_recon", + "description": "Local network reconnaissance", + "long_description": "Discovers and analyzes hosts within a CIDR range or local network through ARP / ICMP scanning.\nMaps IP addresses and identifies live hosts.\nUseful for local network security assessments and penetration testing.", + "tags": [ + "recon", + "cidr", + "network", + "vuln", + "internal" + ], + "input_types": [ + "cidr_range", + "ip", + "slug" + ], + "tree": [ + { + "type": "group", + "name": "discover", + "children": [ + { + "type": "task", + "name": "netdetect", + "description": "Discover local network CIDR ranges", + "condition": "targets" + }, + { + "type": "task", + "name": "arp", + "description": "Discover neighbors with ARP requests", + "condition": "targets" + } + ] + }, + { + "type": "task", + "name": "prompt", + "description": "Select a CIDR range manually", + "condition": null + }, + { + "type": "group", + "name": "probe", + "children": [ + { + "type": "task", + "name": "arpscan", + "description": "Discover hosts with ARP requests", + "condition": null + }, + { + "type": "task", + "name": "fping", + "description": "Discover hosts with ICMP requests", + "condition": null + }, + { + "type": "task", + "name": "nmap", + "description": "Discover live hosts with ping scan", + "condition": null + } + ] + } + ] + }, + { + "name": "code_scan", + "description": "Code vulnerability scan and secret hunt", + "long_description": "Analyzes source code repositories and filesystems for security vulnerabilities and exposed secrets.\nScans dependencies for known CVEs, detects hardcoded credentials, API keys, and sensitive data\nin code. Supports multiple input types including local paths, Git repositories, and cloud storage.\nEssential for DevSecOps and identifying security issues before deployment.", + "tags": [ + "vuln", + "secret", + "code" + ], + "input_types": [ + "path", + "url", + "gcs_url", + "string" + ], + "tree": [ + { + "type": "task", + "name": "_group", + "description": "", + "condition": null + } + ] + }, + { + "name": "domain_recon", + "description": "Domain reconnaissance", + "long_description": "Performs comprehensive reconnaissance on a domain to gather essential information.\nCollects WHOIS data, probes HTTP services, detects technologies, analyzes SSL/TLS security,\nresolves DNS records, retrieves ASN information, and identifies any Web Application Firewalls (WAF).\nIdeal for understanding a domain's infrastructure and security posture before deeper testing.", + "tags": [ + "recon", + "dns", + "ssl", + "http" + ], + "input_types": [ + "host" + ], + "tree": [ + { + "type": "task", + "name": "_group", + "description": "", + "condition": null + }, + { + "type": "task", + "name": "wafw00f", + "description": "Check WAF", + "condition": "!passive" + } + ] + }, + { + "name": "host_recon", + "description": "Host reconnaissance", + "long_description": "Performs comprehensive reconnaissance on a host or IP address to identify open ports and services.\nCombines multiple port scanning techniques, detects service versions, searches for known vulnerabilities,\naudits SSH configurations, and probes HTTP services. Optionally runs nuclei scans for network and\nSSL vulnerabilities. Essential for understanding a host's security posture and attack surface.", + "tags": [ + "recon", + "network", + "http" + ], + "input_types": [ + "ip", + "host", + "cidr_range" + ], + "tree": [ + { + "type": "task", + "name": "_group", + "description": "", + "condition": null + }, + { + "type": "task", + "name": "nmap", + "description": "Detect services and versions", + "condition": "!passive" + }, + { + "type": "task", + "name": "sshaudit", + "description": "Audit SSH port", + "condition": "!passive" + }, + { + "type": "task", + "name": "httpx", + "description": "Probe HTTP services on open ports", + "condition": "!passive" + }, + { + "type": "group", + "name": "nuclei", + "children": [ + { + "type": "task", + "name": "nuclei/network", + "description": "Scan network and SSL vulnerabilities", + "condition": "nuclei" + }, + { + "type": "task", + "name": "nuclei/url", + "description": "Search for vulnerabilities on alive HTTP services", + "condition": "nuclei" + } + ] + }, + { + "type": "group", + "name": "vuln", + "children": [ + { + "type": "task", + "name": "searchsploit", + "description": "Search for related exploits", + "condition": "exploiters" + }, + { + "type": "task", + "name": "search_vulns", + "description": "Search for related vulns and exploits", + "condition": "exploiters" + } + ] + } + ] + }, + { + "name": "js_secrets_params_hunt", + "description": "JS secrets and params recon", + "long_description": "Crawls the target with multiple engines, hunts for JavaScript variables and secret patterns\nusing gf, scans HTTP responses with TruffleHog, discovers hidden parameters with Arjun, and\noptionally scans tagged URLs with nuclei for vulnerabilities.", + "tags": [ + "http", + "crawl", + "secrets", + "params", + "vuln" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "group", + "name": "crawl", + "children": [ + { + "type": "task", + "name": "gospider", + "description": "Crawl target with an alternative engine", + "condition": null + }, + { + "type": "task", + "name": "katana", + "description": "Crawl target to discover endpoints", + "condition": null + }, + { + "type": "task", + "name": "cariddi", + "description": "Hunt URL patterns and juicy endpoints", + "condition": null + } + ] + }, + { + "type": "task", + "name": "httpx", + "description": "Probe discovered URLs and store responses", + "condition": null + }, + { + "type": "group", + "name": "pattern_analysis", + "children": [ + { + "type": "task", + "name": "gf/interestingparams", + "description": "Hunt interesting parameters and potential injection points", + "condition": null + }, + { + "type": "task", + "name": "gf/idor", + "description": "Hunt IDOR-like parameters", + "condition": null + } + ] + }, + { + "type": "group", + "name": "secrets_hunt", + "children": [ + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": "hunt_secrets" + } + ] + }, + { + "type": "group", + "name": "extract_params", + "children": [ + { + "type": "task", + "name": "arjun", + "description": "Extract parameters from GF-tagged URLs", + "condition": null + } + ] + }, + { + "type": "task", + "name": "nuclei", + "description": "Scan GF/Arjun URLs for vulnerabilities", + "condition": "nuclei" + } + ] + }, + { + "name": "subdomain_recon", + "description": "Subdomain reconnaissance", + "long_description": "Discovers subdomains associated with a target domain using multiple passive and active techniques.\nCombines passive sources, DNS queries, TLS certificate analysis, and optional brute-force methods.\nVerifies discovered subdomains, checks for subdomain takeover vulnerabilities, and can optionally\ntest SSL/TLS security or hunt for secrets in HTTP responses. Perfect for mapping attack surface.", + "tags": [ + "recon", + "dns", + "http", + "ssl", + "secrets", + "takeovers" + ], + "input_types": [ + "host" + ], + "tree": [ + { + "type": "task", + "name": "httpx/tls", + "description": "Find subdomains through TLS certificates", + "condition": "!passive" + }, + { + "type": "group", + "name": "hunt", + "children": [ + { + "type": "task", + "name": "subfinder", + "description": "List subdomains (passive)", + "condition": "!active" + }, + { + "type": "task", + "name": "gau", + "description": "List subdomains (passive)", + "condition": "!active" + }, + { + "type": "task", + "name": "dnsx/brute", + "description": "Bruteforce subdomains (DNS)", + "condition": "brute_dns" + }, + { + "type": "task", + "name": "ffuf/url", + "description": "Bruteforce subdomains (URL)", + "condition": "brute_http" + }, + { + "type": "task", + "name": "ffuf/host", + "description": "Bruteforce subdomains (Host header)", + "condition": "brute_http" + } + ] + }, + { + "type": "group", + "name": "probe", + "children": [ + { + "type": "task", + "name": "dnsx/probe", + "description": "Verify subdomains by probing DNS records", + "condition": null + }, + { + "type": "task", + "name": "httpx/probe", + "description": "Run HTTP probes on subdomains", + "condition": "!passive" + } + ] + }, + { + "type": "group", + "name": "vuln", + "children": [ + { + "type": "task", + "name": "testssl", + "description": "Test SSL/TLS security on subdomains", + "condition": "test_ssl" + }, + { + "type": "task", + "name": "nuclei", + "description": "Check for subdomain takeovers", + "condition": "!passive" + }, + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": "hunt_secrets" + } + ] + }, + { + "type": "task", + "name": "search_vulns", + "description": "Search for related vulns and exploits", + "condition": null + } + ] + }, + { + "name": "url_bypass", + "description": "4xx URL bypass techniques", + "long_description": "Attempts to bypass access restrictions on URLs that return 4xx status codes (forbidden, not found, etc.).\nUses various HTTP header manipulation and path traversal techniques to potentially gain access\nto protected resources. Useful for finding misconfigured access controls and authorization bypasses.", + "tags": [ + "http", + "bypass" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "task", + "name": "bup", + "description": "Bypass 4xx", + "condition": null + } + ] + }, + { + "name": "url_crawl", + "description": "URL crawl", + "long_description": "Rapidly crawls and discovers URLs from a target website using multiple crawling engines.\nSupports both passive sources (collecting from external databases) and active crawlers\n(spidering the website directly). Identifies interesting patterns, endpoints, and parameters.\nCan optionally hunt for secrets in HTTP responses and probe URLs for additional information.", + "tags": [ + "http", + "crawl", + "secrets" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "group", + "name": "crawl", + "children": [ + { + "type": "task", + "name": "xurlfind3r", + "description": "Crawl URLs from passive sources", + "condition": "crawlers" + }, + { + "type": "task", + "name": "urlfinder", + "description": "Crawl URLs from passive sources", + "condition": "crawlers" + }, + { + "type": "task", + "name": "gau", + "description": "Crawl URLs from passive sources", + "condition": "crawlers" + }, + { + "type": "task", + "name": "katana", + "description": "Crawl URLs", + "condition": "crawlers" + }, + { + "type": "task", + "name": "gospider", + "description": "Crawl URLs", + "condition": "crawlers" + }, + { + "type": "task", + "name": "cariddi", + "description": "Hunt URLs patterns", + "condition": "crawlers" + } + ] + }, + { + "type": "task", + "name": "httpx", + "description": "Run HTTP probes on unverified URLs", + "condition": "!passive" + }, + { + "type": "group", + "name": "data_hunt", + "children": [ + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": "hunt_secrets" + }, + { + "type": "task", + "name": "maigret", + "description": "Hunt email addresses found", + "condition": "hunt_secrets" + } + ] + } + ] + }, + { + "name": "url_dirsearch", + "description": "URL directory search", + "long_description": "Searches for hidden directories and files on web servers using content discovery techniques.\nProbes URLs for directory listings, optionally bruteforces directories and crawls discovered\ndirectory contents. Can hunt for sensitive files and secrets in HTTP responses.\nHelpful for finding hidden admin panels, backup files, and exposed directories.", + "tags": [ + "http", + "dir", + "secrets" + ], + "input_types": [ + "url", + "host", + "host:port", + "ip" + ], + "tree": [ + { + "type": "task", + "name": "httpx", + "description": "Run HTTP probes on URLs", + "condition": null + }, + { + "type": "task", + "name": "ffuf", + "description": "Search for HTTP directories", + "condition": "hunt_dirs" + }, + { + "type": "task", + "name": "katana", + "description": "Crawl files from HTTP directories", + "condition": "hunt_files" + }, + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": "hunt_files" + } + ] + }, + { + "name": "url_fuzz", + "description": "URL fuzz (slow)", + "long_description": "Performs comprehensive fuzzing of URLs to discover hidden content and directories.\nUses multiple fuzzing engines (dirsearch, feroxbuster, ffuf) with intelligent calibration\nto filter false positives. Probes discovered URLs, captures screenshots when configured,\nand optionally hunts for secrets in HTTP responses. Thorough but time-intensive.", + "tags": [ + "http", + "fuzz", + "secrets" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "group", + "name": "fuzz", + "children": [ + { + "type": "task", + "name": "feroxbuster", + "description": "Fuzz URLs", + "condition": "fuzzers" + }, + { + "type": "task", + "name": "ffuf", + "description": "Fuzz URLs", + "condition": "fuzzers" + } + ] + }, + { + "type": "task", + "name": "httpx", + "description": "Run HTTP probes on fuzzed URLs", + "condition": null + }, + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": "hunt_secrets" + } + ] + }, + { + "name": "url_params_fuzz", + "description": "URL parameter fuzzing", + "long_description": "Identifies and tests URL parameters for vulnerabilities through intelligent fuzzing.\nExtracts parameters from URLs using multiple techniques, then fuzzes them with various payloads\nto discover potential security issues. Probes fuzzed URLs to verify results and optionally\nhunts for secrets in responses. Effective for finding hidden parameters and testing input validation.", + "tags": [ + "http", + "fuzz", + "secrets" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "task", + "name": "httpx", + "description": "Probe URLs and eliminate unresponsive ones", + "condition": "probe" + }, + { + "type": "task", + "name": "urlparser", + "description": "Extract base URLs", + "condition": null + }, + { + "type": "group", + "name": "extract_params", + "children": [ + { + "type": "task", + "name": "arjun", + "description": "Extract parameters from URLs", + "condition": "fuzzers" + }, + { + "type": "task", + "name": "x8", + "description": "Bruteforce URL params", + "condition": "fuzzers" + } + ] + }, + { + "type": "task", + "name": "ffuf", + "description": "Fuzz URL params", + "condition": "fuzz_values" + }, + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": "hunt_secrets" + } + ] + }, + { + "name": "url_secrets_hunt", + "description": "URL secrets hunt", + "long_description": "Searches for exposed secrets, credentials, and sensitive information in web content.\nProbes URLs and analyzes HTTP responses for API keys, passwords, tokens, private keys,\nand other confidential data. Uses TruffleHog to detect various secret patterns.\nCritical for identifying accidental credential exposure and sensitive data leaks.", + "tags": [ + "http", + "fuzz", + "secrets" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "task", + "name": "httpx", + "description": "Run HTTP probes on URLs", + "condition": null + }, + { + "type": "task", + "name": "trufflehog", + "description": "Find secrets in HTTP responses", + "condition": null + } + ] + }, + { + "name": "url_vuln", + "description": "URL vulnerability scan (gf, dalfox)", + "long_description": "Scans URLs for common web vulnerabilities using pattern matching and automated testing tools.\nIdentifies potential XSS, LFI, SSRF, RCE, IDOR, and other vulnerability indicators in URL parameters.\nTests discovered vulnerable patterns with specialized tools like Dalfox for XSS exploitation.\nOptionally runs comprehensive nuclei scans for additional HTTP vulnerability detection.", + "tags": [ + "http", + "vuln" + ], + "input_types": [ + "url" + ], + "tree": [ + { + "type": "group", + "name": "pattern_analysis", + "children": [ + { + "type": "task", + "name": "gf/xss", + "description": "Hunt XSS params", + "condition": null + }, + { + "type": "task", + "name": "gf/lfi", + "description": "Hunt LFI params", + "condition": null + }, + { + "type": "task", + "name": "gf/ssrf", + "description": "Hunt SSRF params", + "condition": null + }, + { + "type": "task", + "name": "gf/rce", + "description": "Hunt RCE params", + "condition": null + }, + { + "type": "task", + "name": "gf/interestingparams", + "description": "Hunt interest params", + "condition": null + }, + { + "type": "task", + "name": "gf/idor", + "description": "Hunt Idor params", + "condition": null + }, + { + "type": "task", + "name": "gf/debug_logic", + "description": "Hunt debug params", + "condition": null + } + ] + }, + { + "type": "group", + "name": "vuln_scan", + "children": [ + { + "type": "task", + "name": "dalfox", + "description": "Attack XSS vulnerabilities", + "condition": "!passive" + }, + { + "type": "task", + "name": "nuclei", + "description": "Search for HTTP vulns", + "condition": "nuclei" + } + ] + } + ] + }, + { + "name": "user_hunt", + "description": "User account search", + "long_description": "Searches for user accounts and associated information across various online platforms and services.\nTakes usernames, email addresses, or other identifiers and queries multiple sources to find\nassociated accounts, password leaks, and online profiles. Useful for OSINT investigations,\ncredential stuffing prevention checks, and understanding a user's digital footprint.", + "tags": [ + "user_account", + "leak" + ], + "input_types": [ + "slug", + "string", + "email" + ], + "tree": [ + { + "type": "group", + "name": "hunt_users", + "children": [ + { + "type": "task", + "name": "maigret", + "description": "Hunt user accounts", + "condition": null + }, + { + "type": "task", + "name": "h8mail", + "description": "Find password leaks", + "condition": null + } + ] + } + ] + }, + { + "name": "wordpress", + "description": "Wordpress vulnerability scan", + "long_description": "Specialized security assessment for WordPress websites and installations.\nIdentifies WordPress version, installed themes and plugins, known vulnerabilities,\nmisconfigurations, and weak configurations. Uses multiple WordPress-specific tools\nto provide comprehensive coverage. Critical for WordPress site security audits.", + "tags": [ + "http", + "wordpress", + "vuln" + ], + "input_types": [ + "url", + "ip", + "host", + "host:port" + ], + "tree": [ + { + "type": "task", + "name": "httpx", + "description": "URL probe", + "condition": null + }, + { + "type": "group", + "name": "hunt_wordpress", + "children": [ + { + "type": "task", + "name": "wpscan", + "description": "WPScan", + "condition": null + }, + { + "type": "task", + "name": "wpprobe", + "description": "WPProbe", + "condition": null + }, + { + "type": "task", + "name": "nuclei", + "description": "Nuclei Wordpress scan", + "condition": null + } + ] + } + ] + } + ] +} diff --git a/ui/chores.md b/ui/chores.md new file mode 100644 index 0000000..94f77b4 --- /dev/null +++ b/ui/chores.md @@ -0,0 +1,29 @@ +# Chores & owner features + +### Chores + +Chores are scheduled background jobs (recurring scans, attack-surface monitoring, cleanup tasks). They are created automatically whenever you launch a runner with anything other than *Once* in the [Scheduling tab](runners.md#scheduling-a-run) — that turns the runner into a chore. + +The **Chores** page lists all chores with their schedule (next-run time, frequency) and last-run status. Clicking a chore opens a detail view similar to a runner: status, next run, full execution history, logs. + +From a chore detail page you can: + +- **Pause / Resume** the schedule without losing its history. +- **Edit** the schedule (switch from daily to weekly, change the natural-language expression). +- **Delete** the chore — past runs stay archived in the Runners list. +- **Run now** — trigger an out-of-band execution without affecting the next scheduled tick. + +> [!note] +> Chores must be enabled for the workspace by an **owner** on the [Features](chores.md) page first. Without that toggle, the *Scheduling* tab on the Run form will let you pick a schedule but the chore won't actually start firing. + +### Features (owner only) + +The **Features** page is visible only to users with the *owner* role. Non-owners are redirected to the Dashboard. + +From here an owner can: + +- **Pick a workspace** to configure (if more than one exists). +- **Toggle optional features** for that workspace, including chore-based automation (attack-surface monitoring, AI suggestions, scheduled scans). +- **Open the Chores page** directly to inspect what is currently scheduled. + +A warning is shown if you try to toggle features on the *system* workspace. diff --git a/ui/dashboard.md b/ui/dashboard.md new file mode 100644 index 0000000..be07ad0 --- /dev/null +++ b/ui/dashboard.md @@ -0,0 +1,10 @@ +# Dashboard + +![Dashboard](../.gitbook/assets/ui-screenshots/10-app-dashboard.png) + +The dashboard is your activity overview for the current workspace. You can: + +- **Create a new workspace** if none exists yet. +- **See findings broken down by severity** (Critical, High, Medium, Low, Info). Click any segment to jump to the matching filter on the Findings page. +- **See runner status summaries** for Scans, Workflows, and Tasks. Click a status badge to filter the Runners page by that status. +- **See the last 5 runners** with their status and start time. Click a row to open the runner. diff --git a/ui/findings.md b/ui/findings.md new file mode 100644 index 0000000..0630487 --- /dev/null +++ b/ui/findings.md @@ -0,0 +1,46 @@ +# Findings + +![Findings page](../.gitbook/assets/ui-screenshots/17-app-findings.png) + +Findings are the structured results produced by your runs. The Findings page has a tab per finding type and shows them in a sortable, filterable table. + +> [!note] +> The tabs you see on this page are not arbitrary categories — each one corresponds to a **structured output schema** that every tool emits. When `katana`, `gospider` and `gau` all surface the same URL, the platform recognises them as the same `url` object and merges them into a single row, while still tracking *which* tools found it (you'll see all three in the *Source* column). The same dedup applies cross-tool to vulnerabilities (matched on CVE + target), ports (host + port + protocol), certificates (fingerprint), and so on. This is why a workspace that ran 9 workflows shows a clean unified findings list rather than 9 raw outputs to merge by hand. + +### Finding types you can browse + +| Type | What it represents | Source tools (examples) | +|---|---|---| +| **Vulnerability** | A detected issue on a target — CVE, misconfiguration, weak TLS, exposed panel, default credential, XSS, SQLi, SSRF, takeover candidate, etc. Carries severity, CVSS, CVE refs, evidence, and a `confidence` score. | `nuclei`, `dalfox`, `wpscan`, `wpprobe`, `trivy`, `grype`, `testssl`, `sshaudit`, `bbot`, `nmap` scripts | +| **Exploit** | A known public exploit matched against a detected product/version, with a link to its source (ExploitDB, Metasploit module, GitHub PoC). | `searchsploit`, `search_vulns`, `msfconsole` | +| **Domain / Subdomain** | DNS asset discovered for the engagement, with resolved IPs and registration data. | `subfinder`, `dnsx`, `jswhois` | +| **IP** | An IPv4/IPv6 address discovered through DNS resolution, ASN lookup, or network discovery, plus open ports and ASN owner. | `dnsx`, `getasn`, `arpscan`, `fping`, `mapcidr` | +| **Port** | An open service on a host, with banner, protocol, and detected product/version. | `nmap`, `naabu` | +| **URL** | A web endpoint with HTTP status, content-type, length, screenshot, detected technologies, and `is_root` / `verified` flags. | `httpx`, `katana`, `gospider`, `cariddi`, `gau`, `xurlfind3r`, `urlfinder`, `feroxbuster`, `dirsearch`, `ffuf` | +| **Tag** | A semantic marker attached to a finding (e.g. `email_address`, `aws_key`, `juicy_extension`, `pattern:sqli`). | Generated by `cariddi`, `gf`, `trufflehog`, `gitleaks` | +| **Record** | A raw HTTP request/response pair, with stored body and screenshot path, used as evidence for vulnerability findings. | `httpx`, `katana`, `dalfox`, `nuclei` | +| **User Account** | An identity discovered for a target — email, username, social profile, breach mention. | `h8mail`, `maigret` | +| **Certificate** | A TLS certificate with issuer, validity range, SANs, and weakness flags. | `testssl`, `httpx` | + +### Actions on the Findings page + +- **Switch tabs** to change the finding type displayed. +- **Search** by free text. +- **Filter** with a query panel that supports MongoDB-style operators (`$regex`, `$ne`, `$in`, `$nin`, etc.) — useful for advanced triage. +- **Sort** by any column. +- **Select** one or many findings via checkboxes (with select-all). +- **Bulk actions** on the selection — mark as false positive, reopen, or update status. +- **Click a finding** to open the detail panel: full description, evidence, request/response, screenshots, source scanner, CVSS, CVE, severity, status, and links to impacted targets and the runners that found it. + +### Visualisations + +Two specialized views help you make sense of large result sets: + +- **Sitemap** — Tree view of discovered URLs grouped by path. Click any node to filter the URL findings to that prefix. +- **Infrastructure force graph** — 3D force-directed graph showing relationships between domains, IPs, ports, certificates, and targets. Pan and zoom with the mouse, click a node to focus, and use it to spot exposed assets at a glance. + +### Badges you will see on findings + +Severity, CVSS score, CVE, source scanner, HTTP status code, content type and length, detected technologies, and HTTP method. + +A *single* finding details page (`Finding details`) is also available for sharing direct links — it shows everything the inline panel does but as a full page. diff --git a/ui/global-interface.md b/ui/global-interface.md new file mode 100644 index 0000000..76c025b --- /dev/null +++ b/ui/global-interface.md @@ -0,0 +1,23 @@ +# Global interface + +Every page shares the same top bar: + +| Element | What it does | +|---|---| +| **Logo** | Returns to the Dashboard. | +| **Main navigation** | Dashboard, Workspaces, Findings, Runners, Reports, (Features for owners). | +| **Search** | Global search across workspaces and runners. Type at least 2 characters; results refresh after 500 ms (debounced); matches are prefix-based and case-insensitive. Each result shows the entity type and a short context line. | +| **Organization switcher** | Switch between organizations you belong to. Shows the current org's name and description. | +| **Theme toggle** | Light, Dark, or System (follows OS preference). The choice is remembered across sessions. | +| **Notifications bell** | Shows the unread count, refreshing every 30 seconds. Click to read recent notifications, mark them as read, or jump to the related runner / finding / workspace. Notification subscriptions are configured per workspace under *Workspace settings → Notifications*. | +| **User menu** | Profile, Organization, API Keys, run-hours indicator, Logout. | + +### Mobile usage + +The interface is fully responsive: + +- **Hamburger menu** replaces the top navigation; tap to open a drawer with the main links. +- **Sheets** (full-height side panels) replace popovers for forms and detail views, making editing comfortable on small screens. +- **Tables** become single-column cards on narrow viewports; sort/filter controls move into a bottom sheet. +- **Touch targets** are sized for thumbs. +- The **organization switcher** and **user menu** open as bottom sheets. diff --git a/ui/glossary.md b/ui/glossary.md new file mode 100644 index 0000000..e71a265 --- /dev/null +++ b/ui/glossary.md @@ -0,0 +1,24 @@ +# Glossary + +A short cheat-sheet of platform-specific terms. Other sections link to these definitions. + +| Term | Definition | +|---|---| +| **Organization** | The top-level tenant. Holds users, billing, and one or many workspaces. Switch organizations from the top-bar selector. | +| **Workspace** | An engagement-scoped container: targets, runners, findings, reports, members, scope. Most actions in the UI are workspace-scoped. | +| **Target** | An in-scope asset (URL, domain, subdomain, host, IP, CIDR). Belongs to a workspace; cannot be scanned without a legal-authorization confirmation. | +| **Task** | The smallest unit of automation: one execution of one tool (`nmap`, `httpx`, `nuclei`, …) with its options. | +| **Workflow** | A predefined chain of tasks that share inputs/outputs (e.g. `url_crawl` runs `katana → httpx → trufflehog`). 15 workflows ship with the platform. | +| **Scan** | The highest-level composition: a bundle of workflows for an entire engagement type (`domain`, `host`, `subdomain`, `url`, `network`). 5 scans ship with the platform. | +| **Runner** | The generic name for any executed task / workflow / scan. The *Runners* page lists all of them; *Tasks* / *Workflows* / *Scans* pages list only their own type. | +| **Chore** | A scheduled, recurring runner (attack-surface monitoring, periodic scans, cleanup). Created and toggled on the *Features* page (owner only). | +| **Finding** | A structured result produced by a runner: a vulnerability, a discovered URL, an open port, a leaked email, etc. Each finding has a type, a source tool, evidence, and a status. | +| **Exploit** | A finding type representing a public PoC matched against a detected product/version. Sources: ExploitDB, Metasploit, GitHub. | +| **Record** | A finding type holding a stored HTTP request/response pair, used as evidence on vulnerability findings. | +| **Tag** | A semantic marker on a finding (`email_address`, `aws_key`, `pattern:sqli`, `juicy_extension`). Generated by tooling like `cariddi`, `gf`, `trufflehog`, `gitleaks`. | +| **Suggestion** | An AI-generated, actionable hint based on existing findings. Either proposes running a specific runner, or adding a target the system identified. See [AI suggestions](ai-suggestions.md). | +| **Profile** | A preset of options applied in bulk to a runner — `aggressive`, `passive`, `stealth`, `default`. Picked on the *Run* form. | +| **Scope** | The allowlist + denylist of patterns that constrain what can be added as a target and what is included in suggestions/scans. Configured in workspace settings. | +| **Run hours** | The metering unit of platform usage. Visible in the user menu; capped per organization plan. Aggressive profiles consume faster than passive ones. | +| **Report** | A client-ready deliverable assembled from selected findings of a workspace. Built in the Report editor; exportable. | +| **API token** | A credential to call the Secator API outside the UI. Created in the *API Keys* page; the secret is shown once — copy it immediately. | diff --git a/ui/meta-options.md b/ui/meta-options.md new file mode 100644 index 0000000..42b4929 --- /dev/null +++ b/ui/meta-options.md @@ -0,0 +1,76 @@ +# Meta options + +Meta options are *transverse* flags that apply across most tasks, regardless of the underlying tool. They appear in the **Options** panel of the *Run* form, in the runner's option summary card, and in the dynamic forms generated for each task. + +> [!note] +> Each task can override or hide an option that does not apply to it (e.g. *Match codes* does not show up on tasks that do not produce HTTP responses). The list below is the **superset** — what you can find across the platform. + +### Performance + +| Option | Default | What it does | When to tune it | +|---|---|---|---| +| **Rate limit** | tool-specific | Upper limit on requests **per second**. | Production targets, WAF-protected sites. The `polite` profile sets it to 100; `aggressive` to 10 000; `paranoid` to 5. | +| **Threads** | `50` | Number of concurrent workers inside a single tool. | Lower for fragile targets, raise for cooperative ones. | +| **Delay** | `0` | Seconds to wait **between** successive requests. | Combined with a low rate-limit, useful for stealth or shared infrastructure. | +| **Timeout** | tool-specific | Per-request timeout in seconds. | Slow / unstable targets; cap to protect your [run hours](glossary.md#g-run-hours). | +| **Retries** | `0` to `2` | Re-send a failed request before giving up. | Lossy networks, rate-limited APIs (combine with *Delay*). | +| **Proxy** | none | Route the tool's traffic through HTTP / SOCKS5 / `proxychains`. | Egress through Burp Suite, route via VPN, or pick the `tor` profile. | + +> [!tip] +> Most of these are bundled into [profiles](runners.md#available-profiles). When in doubt pick `polite`, `paranoid`, `aggressive`, `insane` or `tor` instead of editing each option by hand. + +### HTTP requests + +Apply to every web-facing task (`httpx`, `katana`, `gospider`, `cariddi`, `dirsearch`, `feroxbuster`, `ffuf`, `nuclei`, `dalfox`, …). + +| Option | What it does | When to use | +|---|---|---| +| **Method** | HTTP verb (`GET`, `POST`, `PUT`, `DELETE`, …). | Probing CRUD endpoints. | +| **Headers** | Custom request headers, repeatable. | `Authorization` for authenticated scans, `Host` for virtual-host probing, custom CSRF tokens. | +| **Data** | Request body content (form-encoded, JSON, raw). | POST-based fuzzing, GraphQL endpoints, JSON APIs. | +| **User agent** | Custom `User-Agent` header. | Bypass UA-based filtering; identify yourself in the client's logs. | +| **Follow redirect** | Follow `30x` redirects automatically. | Login redirects, virtual hosts that redirect to canonical domains. | +| **Depth** | Maximum recursion depth for crawlers. | Bound a passive crawl that would otherwise spider an entire SaaS. | +| **Replay proxy** | Replay every request through a separate proxy *after* execution (typically Burp). | Hand off to manual review without slowing the live run. | +| **Wordlist** | Custom wordlist for fuzzing tasks. | Targeted dictionaries (CMS-specific, language-specific, client-supplied). | + +### Response filtering + +When a task produces many HTTP responses, these options pick which become findings. + +The `match-*` family is **inclusive** — only responses matching at least one criterion are kept. The `filter-*` family is **exclusive** — responses matching are dropped. + +| Option | What it matches | +|---|---| +| **Match codes** | HTTP status codes to keep (e.g. `200,301,401`). | +| **Match regex** | Response body matches this regex. | +| **Match size** / **Match words** | Body byte size / word count to keep. | +| **Filter codes** | HTTP status codes to drop (e.g. `404,403`). | +| **Filter regex** | Drop responses whose body matches this regex. | +| **Filter size** / **Filter words** | Drop by body size / word count — useful to hide a fixed-length error page. | + +> [!tip] +> A common URL-fuzz preset is *Match codes* `200,204,301,302,401,403,405,500` plus *Filter size* on the boilerplate length of the target's 404 page. The `url_crawl` workflow already ships with the match-codes preset. + +### Port scanning + +Apply to the network-scanning tasks (`nmap`, `naabu`). + +| Option | What it does | When to use | +|---|---|---| +| **Ports** | Specific TCP ports (comma-list) **or** `-` for all 65 535. | Tailored scans (`80,443,8080,8443` for web-only) or full surface mapping. | +| **Top ports** | Scan the *top N* most common ports per nmap's frequency database. | Faster than scanning all 65 535 while still covering the realistic surface. | +| **Skip host discovery** | Tell nmap to assume the host is up and skip the ICMP / ARP probe. | When the target blocks ICMP — without this nmap may report *"host down"* and abort. | +| **Fragment** *(profile-only)* | Split SYN packets into IP fragments for IDS/IPS evasion. | Picked via the `sneaky` profile. | +| **TCP SYN stealth** *(profile-only)* | SYN scan (`-sS`) without completing the TCP handshake. | Lower footprint in target logs. Picked via the `stealth` profile. | + +> [!warning] +> The default `nmap` task sweeps *top-1000 TCP ports* and uses ICMP host discovery. On hosts where outbound ICMP is blocked, this returns *"host down"* and the deeper scan never runs. Either pick the `all_ports` profile, set explicit *Ports*, or enable **Skip host discovery**. + +### Workspace & output + +| Option | What it does | +|---|---| +| **Workspace** | Saves all reports under a workspace-named scope. In the UI this is the workspace selector at the top of the Run form. | +| **Output** | Built-in export formats (`txt`, `csv`, `json`, `gdrive`). In the UI this is exposed via [Reports](reports.md). | +| **Drivers** | Stream live results to an external destination during execution (MongoDB, GCS). Configured at the worker level, not from the UI. | diff --git a/ui/platform-overview.md b/ui/platform-overview.md new file mode 100644 index 0000000..402d151 --- /dev/null +++ b/ui/platform-overview.md @@ -0,0 +1,22 @@ +# Platform overview + +Secator orchestrates more than 45 specialized open-source security tools through three layers of automation: + +| Type | What it is | +|---|---| +| **Task** | A single tool execution (e.g. `nmap`, `httpx`, `nuclei`) with its options. | +| **Workflow** | A predefined chain of tasks that share inputs and outputs (e.g. *url_crawl*, *subdomain_recon*). | +| **Scan** | A higher-level composition of workflows for an entire engagement (e.g. *host*, *domain*, *network*). | + +When you launch a runner, the platform: + +1. Resolves the input target against the workspace **scope** (allowlist / denylist). +2. Applies the chosen **profile** (aggressive, passive, stealth, default) to fill in option presets. +3. Schedules the underlying tasks across a worker pool and streams the **task tree** to the UI in real time. +4. Normalises every tool's output into the same **finding** schema, deduplicates across tools, and stores it in the workspace. +5. Aggregates findings into per-workspace charts, sitemaps, and an **infrastructure force graph**. + +Both *Available scans* and *Available workflows* below list every runner that ships with the platform, with the full task tree per workflow. + +> [!note] +> Scans, workflows and tasks are configured as YAML files inside the secator package. The cards below are generated directly from those files, so they always reflect what you can launch from the *Run* form. diff --git a/ui/profile-billing.md b/ui/profile-billing.md new file mode 100644 index 0000000..2d2ba1c --- /dev/null +++ b/ui/profile-billing.md @@ -0,0 +1,11 @@ +# Profile, organization, billing + +![Organization page (cloud auth UI)](../.gitbook/assets/ui-screenshots/02-cloud-organization.png) + +Accessible from the user menu in the top-right corner. Most of these screens live in the Cloud UI and open in the same tab via a transparent redirect: + +- **Profile** — Your name, avatar, email, password. +- **Organization** — Members, invitations, roles, and organization-level settings. +- **API Keys** — Same page as [API tokens](api-tokens.md). +- **Run hours** — Visible in the user menu; tracks consumption against your plan. +- **Logout** — Ends your session and returns you to the auth page. diff --git a/ui/quick-reference.md b/ui/quick-reference.md new file mode 100644 index 0000000..049ce57 --- /dev/null +++ b/ui/quick-reference.md @@ -0,0 +1,24 @@ +# Quick reference — what's where + +| You want to… | Go to | +|---|---| +| See an overview of your activity | **Dashboard** | +| Create a workspace | **Workspaces → Create workspace** | +| Add an asset to scan | Workspace → **Targets** tab → **Add target** | +| Run a tool once | **Tasks → Run a task** | +| Run a chained recon flow | **Workflows → Run a workflow** | +| Run a full engagement scan | **Scans → Run a scan** | +| Watch a run live | Click any runner row, or click its status badge | +| Triage results | **Findings** (filter by type, severity, status) | +| See your URL map | **Findings → Sitemap** view | +| See infra relationships | **Findings → Infrastructure** force graph | +| Build a client deliverable | **Reports → Create report** | +| Generate an API key | User menu → **API Keys → Create token** | +| Schedule recurring scans | Owner → **Features**, then **Chores** | +| Change theme / language | Top bar theme toggle / user menu | +| Invite a teammate | Workspace settings → **Users** tab | +| Restrict scanning scope | Workspace settings → **Scope** tab | +| Tune AI suggestions | Workspace settings → **General** + **Display** + **Notifications** | +| See run-hour usage | User menu → run-hours indicator | + +If you need to reach support or read more advanced documentation, use the link in the user menu or visit `https://docs.freelabz.com`. diff --git a/ui/quickstart.md b/ui/quickstart.md new file mode 100644 index 0000000..413d373 --- /dev/null +++ b/ui/quickstart.md @@ -0,0 +1,22 @@ +# Quickstart — first run in 5 minutes + +If you only have five minutes, follow these four steps and you will see your first findings appear: + +1. **Sign in** at `secator.local:3000` (or your team's URL) with email + password, Google, or GitHub. +2. **Create a workspace** from the Dashboard prompt or from *Workspaces → Create workspace*. Name it after the engagement (e.g. `client-acme-feb`). The workspace is the container for everything that follows — targets, runs, findings, reports. +3. **Add a target** in the workspace's *Targets* tab. Pick the type (`url`, `domain`, `subdomain`, `host`, `cidr`, …), paste the asset, and tick the legal authorization checkbox. +4. **Run a scan**. Click *Run* on the workspace overview and pick the **`url`** scan if you added a URL, or the **`domain`** / **`subdomain`** / **`host`** / **`network`** scan that matches your target type. Leave defaults, accept the legal terms, hit *Run*. + +> [!tip] +> Within seconds the Runner detail page shows a **task tree** filling in (each tool turns green as it finishes) and the **Findings tabs** populate live — vulnerabilities, ports, URLs, certificates. You don't need to refresh; the page polls every 20 seconds while a run is in progress. + +What to do next: + +- Open the **Findings** tab inside the runner to triage what was discovered. Use the severity filter to start with Criticals/Highs. +- Switch to the **Sitemap** view to see the URL map of the target. +- Switch to the **Infrastructure** force graph to see exposed assets and their relationships. +- Look at the **Suggestions** tab on the workspace — if AI suggestions are enabled, follow-up scans / new targets to add are proposed automatically based on what was found (see [AI suggestions](ai-suggestions.md)). +- When you are happy with the results, build a client-ready deliverable from *Reports → Create report*. + +> [!warning] +> Always confirm you have written authorization to scan a target before running anything. The legal checkbox is not a formality — it is your audit trail. diff --git a/ui/reports.md b/ui/reports.md new file mode 100644 index 0000000..2063137 --- /dev/null +++ b/ui/reports.md @@ -0,0 +1,30 @@ +# Reports + +Reports turn your findings into a deliverable for your client. + +![Reports list](../.gitbook/assets/ui-screenshots/18-app-reports.png) + +### Report list + +- View, search, sort, paginate all reports in your workspace. +- **Create report** opens the editor. +- **Edit**, **delete**, **preview**, and **download** are available from the row actions. + +### Report editor + +Build the report by selecting what to include: + +- **Workspace** — Pick the source workspace. +- **Report name** and **company name** — Free text. +- **Description / executive summary** — Rich text areas with editable templates. +- **Findings selection** — Multi-select per finding type: + - Vulnerabilities + - Hosts / targets + - Ports + - Tags + - Subdomains +- **Live preview** — A formatted preview is shown using the same styling as the exported document. +- **Save / Update** — Stores the report so you can keep iterating. +- **Delete** — Removes the report. + +The rendered report includes a company header, severity breakdown, finding counts, and detailed sections per finding (description, evidence, screenshots, remediation). diff --git a/ui/runners.md b/ui/runners.md new file mode 100644 index 0000000..1cf0d46 --- /dev/null +++ b/ui/runners.md @@ -0,0 +1,126 @@ +# Runners + +The **Runners** page combines all three layers of automation in a unified table; the **Tasks**, **Workflows**, and **Scans** pages show only their own type. See [Platform overview](platform-overview.md) for the conceptual differences and [Available scans](available-scans.md) / [Available workflows](available-workflows.md) for the full catalog. + +![Runners list](../.gitbook/assets/ui-screenshots/12-app-runners.png) + +### List page (per type, or unified) + +- **Run a [task / workflow / scan]** button opens the create form. +- **Table view** with dynamic columns, sortable headers, advanced filters, pagination, status badges, target chips, and an options summary. +- Click a status tag to filter the list by that status. +- Click a row to open the runner details. + +### Create / Run page + +![Create a runner — picker grid with 47 tasks, 15 workflows, 5 scans](../.gitbook/assets/ui-screenshots/16-app-tasks-run.png) + +Configure the run before launching: + +1. **Workspace** — Required dropdown. +2. **Type** — If not pre-selected, pick Task / Workflow / Scan. +3. **Targets** — Multi-select with autocomplete from the workspace's existing targets. +4. **Raw HTTP request** (optional) — Paste a request; the parser will extract method, URL, headers, and body for tools that need one. +5. **Profiles** — Apply presets such as *aggressive*, *passive*, or *stealth* that adjust option groups in bulk. Recommended profiles are highlighted. + +> [!tip] +> Pick `passive` first when scoping a new client engagement: it only queries third-party datasets (Wayback, Common Crawl, certificate transparency, …) and never sends a packet to the target. `aggressive` is for when you have full authorization and a lab/staging environment — it consumes [run hours](glossary.md#g-run-hours) much faster. + +#### Available profiles + +13 profiles ship with the platform. Pick the one whose intent matches your engagement; you can also **stack multiple profiles** (their options merge — later picks override earlier picks where they collide). + +| Profile | Category | What it changes | +|---|---|---| +| **passive** | General | Pure passive — only queries external datasets (Wayback, Common Crawl, cert transparency). No packet ever leaves to the target. | +| **active** | General | The opposite of `passive` — disables passive sources and runs only active probes. | +| **full** | General | Turns on every optional feature (screenshots, secret hunting, headless browsing, deep crawls). | +| **aggressive** | Speed | High rate limits (`10 000 req/s`), no delay, short timeouts. Lab / staging only. | +| **insane** | Speed | LAN / stress profile (`100 000 req/s`). Extreme. | +| **polite** | Speed | Caps at 100 req/s, allows 5 retries, 10 s timeout — safe for production targets. | +| **paranoid** | Speed | Maximum stealth: 5 req/s, 5 s delay between probes. | +| **stealth** | Evasion | TCP SYN stealth scan (nmap `-sS`), no full handshake. | +| **sneaky** | Evasion | Packet fragmentation to evade IDS/IPS signatures. | +| **tor** | Evasion | Routes the scan through Tor (proxy auto-selection). | +| **all_ports** | Network | Scans **all 65 535 TCP ports** instead of the default top-1000. | +| **http_record** | Network | Stores every HTTP request/response and takes a screenshot of each page (requires Chromium). | +| **http_headless** | Network | Headless browser fetch — useful for JS-heavy apps where plain HTTP misses content. | +| **hunt_secrets** | Content | Enables `trufflehog` over HTTP responses across every applicable workflow. | + +**Profile combination rule:** options come from the runner's defaults → then each selected profile is merged in order → then your manual edits in the Options panel override everything. If you tweak an option that a profile set, your value wins; if you uncheck the profile later, only the options you did **not** touch revert. + +**Profile recipes** — typical engagement combos: + +| Engagement goal | Profile combo | +|---|---| +| Quick sanity check on a fresh asset | `passive` | +| Stealth recon during business hours | `passive` + `polite` | +| Anonymous recon (Tor exit) | `passive` + `tor` | +| Authorized vuln scan with screenshots & request records | `aggressive` + `http_record` | +| Full attack-surface mapping (every TCP port + secrets) | `active` + `all_ports` + `hunt_secrets` | +| IDS/IPS-evading red team probe | `stealth` + `sneaky` + `paranoid` | +| Modern JS-heavy app crawl | `active` + `http_headless` | +| Production scan with safe rate limits | `polite` + `passive` | + +> [!caution] +> The `http_record`, `http_headless` and `full` profiles need Chromium installed on the worker host. Without it, every task that triggers a screenshot fails with *"the chrome browser is not installed"*. Pick a different profile or ask your administrator to install Chromium on the worker. + +6. **Options** — A dynamic form generated from the chosen runner. Inputs include text fields, dropdowns, toggles, and file pickers. Each option has a tooltip with its description. The most useful ones are listed below. +7. **Options summary** — A compact card at the bottom of the form shows the final command being prepared. +8. **Terms of use** — Confirm the legal checkbox if the run targets new assets. +9. **Run** — Launch the runner and jump to its details page. + +#### Common run options + +The Options panel is auto-generated from the runner's YAML config, so the exact fields change per tool. The ones below appear on most runners and are worth knowing about: + +| Option | What it does | When to use | +|---|---|---| +| **Rate limit** | Caps requests per second sent by the underlying tool. | Production targets; respecting a client's WAF; saving [run hours](glossary.md#g-run-hours). | +| **Threads** | Concurrent workers inside a single tool (e.g. number of parallel HTTP probes for `httpx`). | Faster scans on cooperative targets; lower it to be polite. | +| **Match codes** | Keep only HTTP responses whose status matches this list (e.g. `200,301,401`). | Triage during URL fuzzing — without it the table fills with 404s. | +| **Filter codes** | Drop HTTP responses whose status is in this list. | Noise reduction — exclude 404 / 403 from a directory bruteforce. | +| **Match regex / Filter regex** | Same idea but matched against the response body. | Detecting *content* fingerprints (login forms, error pages). | +| **User agent** | Custom `User-Agent` header for every request. | Bypass UA-based blocks; identify yourself in client logs. | +| **Headers** | Arbitrary HTTP headers (auth tokens, custom hosts, cookies). | Authenticated scans; testing virtual hosts. | +| **Depth** | Max recursion depth for crawlers. | Bound a passive crawl that would otherwise spider an entire SaaS app. | +| **Ports** | Comma-separated TCP ports for `nmap` / `naabu`. | Skip the default *top-1000* sweep — point at `80,443,8080,8443` for a web-only check. | +| **Top ports** | Use nmap's pre-curated *top N* most common ports. | Faster than scanning all 65 535. | +| **All ports** (`-` literal) | Scan every TCP port. | Full surface mapping; same as the `all_ports` profile. | +| **Skip host discovery** (`-Pn`) | Tell nmap to assume the target is up and skip the ping/ARP probe. | When the host blocks ICMP — without this nmap may report *"host down"* and abort. | +| **Timeout** | Per-task wall-time cap. | Run-hours protection on slow / unstable targets. | +| **Retries** | Re-send failed requests up to N times. | Lossy networks, rate-limited APIs. | + +> [!tip] +> Several of these (rate-limit, retries, fragment, top-ports, …) are also bundled into [profiles](runners.md#available-profiles). When in doubt, pick the matching profile (`polite`, `paranoid`, `all_ports`, `stealth`) instead of editing each option by hand — same result, less risk of typos. + +#### Scheduling a run + +Every runner form has a **Scheduling** tab next to *Config* and *Workspace*. Pick how the run should repeat: + +| Schedule | What happens | +|---|---| +| **Once** *(default)* | Run is launched immediately and never repeats. | +| **Every hour** | Recurs at the top of every hour after launch. | +| **Every day** | Daily at the same time of day. | +| **Every week** | Same day-of-week, same time. | +| **Every month** | Same day-of-month, same time. | +| **Custom…** | Free-text natural-language schedule (e.g. *"every Monday at 9am"*, *"every 6 hours"*). The platform parses it into a cron expression. | + +Picking anything other than **Once** turns the runner into a [chore](glossary.md#g-chore) — visible on the *Chores* page once an owner has enabled the chore feature for that workspace ([Chores & owner features](chores.md)). Each scheduled run still respects the workspace's [run hours](glossary.md#g-run-hours) cap and [scope](glossary.md#g-scope). + +### Runner details + +![Workflow detail — Overview, charts and audit trail](../.gitbook/assets/ui-screenshots/22-app-workflow-detail.png) + +Live monitoring and exploration of a run: + +- **Header** with the runner name, type badge, status, and timestamps. +- **Run metrics** — Elapsed time, completed tasks, resource usage charts. +- **Findings tabs** — All findings produced by this runner, browsable by type just like the workspace findings page. +- **Timeline charts** — Vulnerabilities discovered over time, broken down by severity. +- **Logs** — Streaming logs while the run is in progress; expandable history afterward. +- **Task tree** (workflows / scans) — Hierarchical view of every task with its status, duration, and output. Click a task to inspect it. +- **Auto-refresh** — Every 20 seconds while running; stops when the run completes. + +Runner actions in the header let you stop, restart, duplicate, or delete the run depending on its state. diff --git a/ui/sign-in.md b/ui/sign-in.md new file mode 100644 index 0000000..dbe6357 --- /dev/null +++ b/ui/sign-in.md @@ -0,0 +1,12 @@ +# Sign in & first login + +![Authentication screen](../.gitbook/assets/ui-screenshots/01-cloud-auth.png) + +Open the app and you will be redirected to the authentication page. You can sign in with: + +- **Email + password** — Sign up the first time, then log in. +- **Google** or **GitHub** — Single sign-on through your provider. + +After signing up by email, you may be asked to verify your address. Click the link in the verification email to continue. If the email does not arrive, check your spam folder or use the *Resend* button on the verification screen. + +If you have no workspace yet, the dashboard will prompt you to **Create your first workspace**. A workspace is the unit that contains targets, runs, findings, and reports. diff --git a/ui/targets.md b/ui/targets.md new file mode 100644 index 0000000..9d5e53f --- /dev/null +++ b/ui/targets.md @@ -0,0 +1,18 @@ +# Targets + +Targets are what you scan: a domain, subdomain, IP, CIDR, URL, or other asset. They live inside a workspace. + +From the workspace's **Targets** tab you can: + +- **Add target** — Open the form, choose the workspace, name the target, pick a type (domain, IP, URL, CIDR, …), and **confirm legal authorization** to scan it (required checkbox). +- **Edit target** — Click a row to update name, type, or tags. +- **Delete target** — From the action column, with confirmation. +- **Filter** by type, status, and tags. +- **Sort** by name or creation date. +- **Search** by name. +- **Paginate** through long lists. + +A dedicated target detail page (`Target details`) is available by clicking a row — it shows the full asset profile and lets you drill into related findings. + +> [!warning] +> The legal authorization checkbox on every target form is mandatory and creates an audit trail. Scanning an asset you do not own or have written permission to test can be illegal in most jurisdictions. diff --git a/ui/workspaces.md b/ui/workspaces.md new file mode 100644 index 0000000..3a1810c --- /dev/null +++ b/ui/workspaces.md @@ -0,0 +1,54 @@ +# Workspaces + +A workspace groups everything related to one engagement: targets, runs, findings, reports, and the team that can see them. + +![Workspaces list](../.gitbook/assets/ui-screenshots/11-app-workspaces.png) + +### Workspace list + +- View all workspaces you have access to in a paginated, sortable, searchable table. +- **Create workspace** opens a side sheet to set the name, description, and default options. +- Click a row to open the workspace details. Use the action menu to **edit** or **delete** a workspace. + +### Workspace details + +![Workspace details — Overview tab](../.gitbook/assets/ui-screenshots/20-app-workspace-detail.png) + +Workspace details are organized in tabs: + +#### Overview + +- See the workspace metadata, owner, and member avatars. +- **Run** button — jumps to the *Create runner* page pre-filled with this workspace. +- **Actions** menu — Manage targets, Import data, Open settings. + +> [!tip] +> **Import data** lets you bulk-load assets and previous findings into the workspace without running a scan. Drop a JSON / CSV / TXT file produced by a previous secator run, or by another tool whose output format is supported, and the platform will deduplicate against existing items. Useful when continuing an engagement that started outside the platform, or when seeding a workspace with a target list from an Excel sheet. +- Vulnerability charts: count over time by severity, breakdown, top CVEs, top tags. +- **Infrastructure Graph** — 3D force-directed graph of domains, IPs, ports, certificates, and targets. + +#### Suggestions + +AI-powered recommendations for next scans, workflows, or targets based on your existing findings. See [AI suggestions](ai-suggestions.md) for the full reference. + +#### Targets + +The list of in-scope assets for this workspace. From here you can **add**, **edit**, **delete**, **filter** (by type, tags, status), **sort**, **paginate**, and **search** targets. See [Targets](targets.md) for details. + +#### History + +Activity timeline for the workspace. Shows runner counts (Scans, Workflows, Tasks) and a chronological view of when each runner was started. + +#### Findings + +The full Findings browser, scoped to this workspace. See [Findings](findings.md). + +### Workspace settings + +Open from the workspace's *Actions* menu. Settings are split into tabs: + +- **General** — Name, description, *AI suggestions* toggle, *Monitor attack surface* toggle and frequency. +- **Users** — Invite a member by email, remove members. Available only for existing workspaces. +- **Notifications** — Per-event channels: vulnerability alerts (with severity threshold), scan / workflow / task started or finished, target added. +- **Display** — Reorder finding sections (move up/down) and toggle which finding types appear in the workspace: Exploits, Vulnerabilities, Subdomains, IPs, Ports, Records, User Accounts, Certificates, URLs, Domains, Tags. +- **Scope** — Manage the **allowlist** and **denylist** as plain patterns or regular expressions. Add, edit, and remove entries; existing targets in the workspace are shown alongside for reference.