Skip to content

ROADMAP.md

Latest commit

 

History

History
190 lines (145 loc) · 6.73 KB

ROADMAP.md

File metadata and controls

190 lines (145 loc) · 6.73 KB

VScanX - After CI Implementation

Completed Tasks ✅

1. Core Fixes (Result Propagation & Consistency)

  • ✅ Implemented ScanResult and Finding dataclasses (core/scan_model.py)
  • ✅ Centralized scan state in the orchestrator: all module results normalized → central findings list
  • ✅ Fixed summary/findings mismatch: summary now derived from ScanResult instead of duplicate state
  • ✅ Added fail-fast validation: aborts report generation if summary claims findings but none exist

2. Report Generation Hardening

  • ✅ Standardized to single HTML template with polished design and required metadata (target, scan type, duration)
  • ✅ Fixed all format exports (HTML, PDF, JSON, CSV, TXT) with proper wiring in CLI
  • ✅ Sanitized filenames to include target and scan type (e.g., vscanx_127.0.0.1_web_YYYYMMDD_HHMMSS.html)
  • ✅ Added directory creation for report paths (avoids missing directory errors)

3. CI/CD Pipeline

  • ✅ GitHub Actions workflow (.github/workflows/ci.yml):
    • Runs pytest on every push/PR to main
    • Starts vulnerable test server
    • Executes CLI smoke scan against local server
    • Verifies all report formats produced
    • Uploads reports/ artifact for inspection
  • ✅ Integration test (tests/test_integration_smoke.py):
    • End-to-end validation of server startup → CLI scan → report generation → cleanup
    • Runs in isolated environment and cleans up automatically
  • ✅ ASCII-safe CLI banner (Windows console compatibility)

4. Tests Added

  • ✅ tests/test_report_exports.py: Smoke tests for all export formats
  • ✅ tests/test_integration_smoke.py: Full pipeline integration test
  • ✅ Sanity checks: validate_results_summary() in core/utils.py

5. Documentation

  • ✅ TESTING.md: Complete guide for running tests locally and understanding CI

What's Realistically Remaining 🔥

Phase 2 Review & Follow-ups

Phase 2 items (SQLi improvements, expanded dir enumeration, and header remediation guidance) have been implemented. Below are recommended follow-ups to harden these features:

1. Harden SQLi Detection

Current: Error- and boolean-based detection implemented; timing-based detection and false-positive reduction pending.
Next:

  • Add timing-based (blind) detection and response delay heuristics
  • Improve payload tuning to reduce false positives and avoid destructive payloads

Effort: 2–4 hours
Value: More accurate SQLi detection with lower noise

2. Expand & Tune Directory Enumeration

Current: Wordlist significantly enlarged and response size/status tracked.
Next:

  • Integrate community wordlists (e.g., SecLists) with optional CLI selection
  • Add response fingerprinting to discriminate custom 404s from real endpoints

Effort: 2–3 hours
Value: Better discovery with fewer false positives

3. Extend HTTP Header Analysis

Current: Missing headers flagged and remediation guidance included.
Next:

  • Add more header rules, severity mapping, and weak-value detection (e.g., permissive CORS)
  • Add small test cases to the vulnerable server for regression testing

Effort: 1–2 hours
Value: Broader coverage and clearer actionable guidance

Phase 3 (Nice-to-Have, Longer-Term)

Plugin Loader & Configurable Pipelines

  • Dynamic module discovery from modules/ folder (no hard-coded imports)
  • Allow users to run custom subsets of modules
  • Define scan "recipes" (quick, balanced, thorough, etc.)

Effort: Half day
Value: Extensibility for custom modules

Freeze JSON Schema

  • Document the exact structure of ScanResult, Finding, and report JSON
  • Add JSON schema validation in tests
  • Publish as part of documentation

Effort: 1–2 hours
Value: Allows third-party tools to consume VScanX JSON reliably

Phase 4 (Future Stretch Goals)

  • GUI: Lightweight Electron or web UI around the CLI
  • Packaging: PyInstaller or briefcase for standalone distribution
  • CI/CD Integration: Example GitHub Actions for running VScanX in workflows

How to Prioritize Next Work

Given typical scanner maturity progression:

  1. Best ROI next: Improve SQLi detection (currently too basic)
  2. Then: Expand directory enumeration (quick win)
  3. Then: Polish header analysis (good UX)
  4. Stretch: Plugin loader if you want community contributions

Immediate Next Steps You Can Take

  1. Run the CI workflow locally (all tests pass):

    pytest -q

  2. Test the CLI against a real target (with permission!):

    python vscanx.py -t https://your-target.com -s web --format html,json

  3. Expand the vulnerable server with more test cases (SQLi, auth, etc.)

  4. Pick one Phase 2 feature and implement it (SQLi is the highest-value)

Repository Structure (Final)

VScanX/
├── .github/
│   └── workflows/
│       └── ci.yml                    # GitHub Actions CI pipeline
├── core/
│   ├── config.py
│   ├── orchestrator.py               # Central scan coordinator (refactored)
│   ├── scan_model.py                 # ScanResult & Finding dataclasses (NEW)
│   ├── request_handler.py
│   └── utils.py                      # Validation helpers (NEW)
├── modules/
│   ├── base_module.py
│   ├── network/
│   │   ├── port_scanner.py
│   │   └── socket_scanner.py
│   └── web/
│       ├── xss_detector.py
│       ├── sqli_detector.py
│       ├── header_analyzer.py
│       ├── cve_checker.py
│       └── dir_enum.py
├── reporting/
│   ├── report_generator.py           # Single canonical template
│   ├── export_formats.py
│   └── templates/
│       └── report.html
├── tests/
│   ├── test_modules.py
│   ├── test_report_exports.py        # Smoke tests (NEW)
│   └── test_integration_smoke.py     # E2E integration test (NEW)
├── reports/                          # Generated scan reports
├── vscanx.py                         # CLI entry point (refactored)
├── vulnerable_server.py              # Test server
├── requirements.txt
├── README.md
└── TESTING.md                        # Testing guide (NEW)

Success Criteria ✅

  • All unit tests pass
  • Integration test passes (server → CLI → reports → cleanup)
  • GitHub Actions workflow runs successfully
  • Reports are generated in all requested formats
  • Summary always matches detailed findings
  • No "No vulnerabilities found" when CLI shows findings

Next recommended action: Pick one Phase 2 feature and open an issue / branch for it. SQLi improvements are the highest-value next step.