0 Fork 0

mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-10-04 06:56:56 +02:00

Files

T

CyberSecurityUPandClaude Opus 4.8 e1350c0c4a fix(web): REPL spawn passed run-only flags as globals, breaking every run

The REPL-backed path (run/whitebox/greybox) spawns `neurosploit` with NO
subcommand, so only global flags are valid in argv — but authArgs() emitted
run-subcommand flags there (--environment, --policy, --in-scope, --budget,
--compliance, --revalidate-poc, --token-limit, --deep-test-limit, --order,
--sample-per-route, --scope-file). clap aborted on the first one
("unexpected argument '--environment'"), so the engagement died at launch and
the live view sat empty. authArgs now emits only the real global flags with
their global names (--session-environment / --session-in-scope / --session-policy,
plus --capability-token/--transport/--oob-*/--sms/--typesafe/--decision-backend/
--intercept/--sandbox); run-only knobs ride the REPL script or defaults.

Also:
- sidebar: a disk run whose status says "running" but has no live job is shown
  as "interrupted", not "running" (no more stale RUNNING entries); brand-new
  in-memory jobs are injected so an engagement appears the moment it starts;
  new "Interrupted" group; clicking a running/interrupted row attaches the live
  stream or offers resume.
- stop: robust now — graceful /stop then SIGTERM/SIGKILL fallback, a second
  press escalates, a job whose child already exited is marked done so the UI
  stops showing it as running.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-10-03 01:08:57 -03:00

public

fix(web): REPL spawn passed run-only flags as globals, breaking every run

2026-10-03 01:08:57 -03:00

API.md

feat(mobile): binary/APK/IPA testing mode + 12 RE skills — v4.2.0

2026-09-20 21:08:14 -03:00

package.json

release: v4.1.0 — assurance layer, TypeSafe, hardening + benchmark

2026-09-20 12:25:23 -03:00

README.md

feat(mobile): binary/APK/IPA testing mode + 12 RE skills — v4.2.0

2026-09-20 21:08:14 -03:00

server.js

fix(web): REPL spawn passed run-only flags as globals, breaking every run

2026-10-03 01:08:57 -03:00

README.md

NeuroSploit v4.2.0 — web console

A browser UI for the neurosploit CLI harness: a 5-step engagement wizard (Asset → Scope & Auth → Leads → Model & Run → Review), a live structured findings view with a generative attack-path graph, run history, an Auth & Keys menu, and a real terminal — all driven by spawning the actual CLI binary, never a reimplementation of harness logic.

Asset — pick black/white/grey-box, host/infra, or AI/LLM, set the target or repo.
Scope & Auth — objective, focus, out-of-scope, and a link into the Auth & Keys menu.
Leads — the categorized agent picker (435 agents auto-classified) + custom leads.
Model & Run — pick a provider/model from the live catalog, API-key vs. subscription auth mode, votes/chain-depth/recon intensity.
Review — confirm the plan, then Start Exploitation spawns the real CLI.
Auth & Keys (one menu, 🔑 in the sidebar) — target auth header + named roles for IDOR/BOLA/BFLA testing, per-provider API keys (kept in server memory only, never on disk), and an explicit creds.yaml path override.
Generative Attack Path Chaining — findings are grouped into kill-chain columns (recon → initial-access → execution → privesc → lateral → exfil → impact) with chained findings linked back to their parent, built live as findings stream in.
Terminal dock (xterm.js) — ❭_ in the sidebar, the topbar button, or Ctrl+\`` opens a docked terminal running a real neurosploitREPL session. Its stdout is streamed **unstripped**, so the harness's own colour and box-drawn panels render as they do in a local shell. Line editing (echo, ←/→, history,Tabslash-command completion,Ctrl+C/L/U/A/E`) is local because the child is spawned over a pipe, not a PTY, and therefore never echoes. The target picker in its header switches between a standalone session and the running engagement, so mid-run instructions go to the same process that is doing the testing.
Real REPL underneath run/whitebox/greybox — the wizard scripts an actual interactive neurosploit session instead of a one-shot CLI call, so it keeps reading stdin while the engagement streams. The Activity log tab grows a ❭ prompt box to send /status, /stop, /continue, or a plain-language instruction mid-run. host/aitest/skills stay one-shot (their onboarding scope picker can't be scripted over piped stdin).

cd neurosploit-rs && cargo build --release   # build the CLI once
node web/server.js                            # → http://localhost:4173

Zero npm dependencies (Node ≥18, built-ins only: http, child_process, events, fs).

API reference: API.md.

Layout

web/
├── server.js         backend: static server + agents_md/runs reader + CLI process manager
├── public/
│   ├── index.html     SPA shell
│   ├── style.css       lead-board / live-run / terminal-dock styling
│   ├── app.js          client logic (fetch + EventSource + terminal, no framework)
│   └── vendor/         xterm.js + fit addon (vendored; nothing is fetched at runtime)
├── API.md
└── package.json