mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-08-25 19:02:43 +02:00

Files

T

CyberSecurityUPandClaude Sonnet 5 7f365b4e88 feat(web): render the attack path as a real node graph, not flat cards

The 'Generative Attack Path Chaining' tab previously showed kill-chain
stages as stacked cards in columns — with 1 finding (the common case
early in a run) it looked like an empty list, nothing like an attack
graph.

Rewritten as an inline SVG node/edge graph on a fixed-dark canvas
(matches attack-graph tools like NodeZero regardless of the app's own
light/dark theme — bright severity colors read better against near-black):
- Root node = the target, always present.
- One node per confirmed finding, positioned in its kill-chain-stage
  column (falls back to a single flat column when no finding has a
  stage yet).
- Edges: from the finding's chains_from parent when the harness set one,
  else fanned directly from root — never invents a specific relationship
  that doesn't exist in the data.
- Per-node icon inferred from title/evidence/cwe/stage (key/shield/
  person/host/db/impact), severity-colored border + corner tick.
- Nodes are clickable — opens the same finding detail modal as the
  findings table (PoC included).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

2026-08-23 15:21:41 -03:00

public

feat(web): render the attack path as a real node graph, not flat cards

2026-08-23 15:21:41 -03:00

API.md

feat(web): require an engagement name before launch

2026-08-23 14:20:34 -03:00

package.json

feat(4.0.0): web console — lead board + live findings + real CLI REPL

2026-08-23 13:59:19 -03:00

README.md

feat(web): engagement wizard, model/auth picker, Auth & Keys menu, attack-path graph

2026-08-23 14:16:46 -03:00

server.js

fix(web): global [hidden] bug, progress bar, F5 persistence, finding detail + PoC

2026-08-23 14:37:28 -03:00

README.md

NeuroSploit v4.0.0 — web console

A browser UI for the neurosploit CLI harness: a 5-step engagement wizard (Asset → Scope & Auth → Leads → Model & Run → Review), a live structured findings view with a generative attack-path graph, run history, an Auth & Keys menu, and a real REPL — all driven by spawning the actual CLI binary, never a reimplementation of harness logic.

Asset — pick black/white/grey-box, host/infra, or AI/LLM, set the target or repo.
Scope & Auth — objective, focus, out-of-scope, and a link into the Auth & Keys menu.
Leads — the categorized agent picker (435 agents auto-classified) + custom leads.
Model & Run — pick a provider/model from the live catalog, API-key vs. subscription auth mode, votes/chain-depth/recon intensity.
Review — confirm the plan, then Start Exploitation spawns the real CLI.
Auth & Keys (one menu, 🔑 in the sidebar) — target auth header + named roles for IDOR/BOLA/BFLA testing, per-provider API keys (kept in server memory only, never on disk), and an explicit creds.yaml path override.
Generative Attack Path Chaining — findings are grouped into kill-chain columns (recon → initial-access → execution → privesc → lateral → exfil → impact) with chained findings linked back to their parent, built live as findings stream in.

cd neurosploit-rs && cargo build --release   # build the CLI once
node web/server.js                            # → http://localhost:4173

Zero npm dependencies (Node ≥18, built-ins only: http, child_process, events, fs).

API reference: API.md.

Layout

web/
├── server.js         backend: static server + agents_md/runs reader + CLI process manager
├── public/
│   ├── index.html     SPA shell
│   ├── style.css       lead-board / live-run / REPL drawer styling
│   └── app.js          client logic (fetch + EventSource, no framework)
├── API.md
└── package.json