From ef3a30ad3e4614ff8d3a95cf5c1e85e9206901e1 Mon Sep 17 00:00:00 2001 From: Ritu Sharma Date: Thu, 16 Apr 2026 16:08:31 +0530 Subject: [PATCH 1/3] phishing module added --- phising/README.md | 159 +++++ phising/agents/domain-shield-agent.yaml | 108 +++ phising/config/config.env | 10 + phising/config/config.env.example | 27 + phising/config/policy.json | 8 + phising/domain_shield_agent.py | 322 +++++++++ phising/easy_start.py | 280 ++++++++ phising/logs/audit.jsonl | 12 + phising/requirements.txt | 3 + phising/run.py | 191 ++++++ phising/tests/__init__.py | 1 + phising/tests/test_domain_shield.py | 358 ++++++++++ phising/tools/__init__.py | 40 ++ phising/tools/alerting_tools.py | 194 ++++++ phising/tools/domain_verification_tools.py | 307 +++++++++ phising/tools/email_ingestion_tools.py | 135 ++++ phising/tools/logging_tools.py | 198 ++++++ phising/tools/phishing_detection_tools.py | 214 ++++++ phising/tools/policy_tools.py | 136 ++++ phising/ui/app.js | 747 +++++++++++++++++++++ phising/ui/config.js | 2 + phising/ui/data.js | 218 ++++++ phising/ui/index.html | 243 +++++++ phising/ui/style.css | 671 ++++++++++++++++++ phising/ui_server.py | 104 +++ 25 files changed, 4688 insertions(+) create mode 100644 phising/README.md create mode 100644 phising/agents/domain-shield-agent.yaml create mode 100644 phising/config/config.env create mode 100644 phising/config/config.env.example create mode 100644 phising/config/policy.json create mode 100644 phising/domain_shield_agent.py create mode 100644 phising/easy_start.py create mode 100644 phising/logs/audit.jsonl create mode 100644 phising/requirements.txt create mode 100644 phising/run.py create mode 100644 phising/tests/__init__.py create mode 100644 phising/tests/test_domain_shield.py create mode 100644 phising/tools/__init__.py create mode 100644 phising/tools/alerting_tools.py create mode 100644 phising/tools/domain_verification_tools.py create mode 100644 phising/tools/email_ingestion_tools.py create mode 100644 phising/tools/logging_tools.py create mode 100644 phising/tools/phishing_detection_tools.py create mode 100644 phising/tools/policy_tools.py create mode 100644 phising/ui/app.js create mode 100644 phising/ui/config.js create mode 100644 phising/ui/data.js create mode 100644 phising/ui/index.html create mode 100644 phising/ui/style.css create mode 100644 phising/ui_server.py diff --git a/phising/README.md b/phising/README.md new file mode 100644 index 0000000..12eb4e9 --- /dev/null +++ b/phising/README.md @@ -0,0 +1,159 @@ +# DomainShield Agent 🛡️ + +> AI-powered phishing detection ZAK agent that enforces **strict domain whitelisting** on incoming email — flagging, categorizing, and blocking any message from outside the approved domain list. + +--- + +## Project Structure + +``` +phising/ +├── agents/ +│ └── domain-shield-agent.yaml ← ZAK DSL contract +├── tools/ +│ ├── __init__.py +│ ├── email_ingestion_tools.py ← IMAP / file / raw ingestion +│ ├── domain_verification_tools.py ← whitelist, SPF, DKIM, DMARC, IDN +│ ├── phishing_detection_tools.py ← display-name spoof + risk classifier +│ ├── alerting_tools.py ← alert generation + Slack/SIEM webhook +│ ├── logging_tools.py ← JSONL audit log + CSV export +│ └── policy_tools.py ← admin whitelist CRUD + config store +├── config/ +│ ├── config.env.example ← environment variable template +│ └── policy.json ← live whitelist policy store +├── tests/ +│ └── test_domain_shield.py ← pytest test suite (5 scenarios) +├── logs/ ← auto-created audit logs (JSONL + CSV) +├── domain_shield_agent.py ← BaseAgent class (9-phase pipeline) +├── run.py ← CLI entry point +├── requirements.txt +└── README.md +``` + +--- + +## Quick Start + +### 1. Install dependencies +```powershell +pip install -r requirements.txt +``` + +### 2. Configure +```powershell +Copy-Item config\config.env.example config\config.env +# Edit config\config.env with your whitelist domains, IMAP credentials, etc. +``` + +### 3. Run – test with a raw email string +```powershell +python run.py --source raw --raw-eml "From: alice@company.com`r`nSubject: Hello`r`n`r`nBody" +``` + +### 4. Run – scan IMAP inbox +```powershell +python run.py --source imap +# (Credentials loaded from config/config.env) +``` + +### 5. JSON output mode +```powershell +python run.py --source raw --raw-eml "..." --json +``` + +--- + +## Sample Configuration + +```env +WHITELIST_DOMAINS=company.com,trustedpartner.com +STRICT_MODE=true +ALERT_THRESHOLD=medium_and_above +WEBHOOK_URL=https://hooks.slack.com/services/your/webhook/url +WEBHOOK_FORMAT=slack +``` + +--- + +## Admin Commands + +| Command | Description | +|---|---| +| `python run.py --admin add-domain --admin-arg partner.org` | Add domain to whitelist | +| `python run.py --admin remove-domain --admin-arg old.com` | Remove domain | +| `python run.py --admin list-policy` | Show current policy | +| `python run.py --admin export-log` | Export audit log to CSV | +| `python run.py --admin set-strict --admin-arg true` | Enable strict mode | +| `python run.py --admin set-threshold --admin-arg high_only` | Change alert threshold | + +--- + +## Risk Classification + +| Risk Level | Trigger | Action (strict mode) | +|---|---|---| +| `SAFE` | Whitelisted domain + all auth checks pass | `ALLOW` | +| `MEDIUM_RISK` | External domain not in whitelist | `BLOCK` | +| `HIGH_RISK` | Spoofing / auth failure / subdomain hijack | `BLOCK` | + +--- + +## Detection Signals + +1. **Domain Whitelist** – exact domain match (subdomains require explicit listing) +2. **SPF Alignment** – `Received-SPF` + `Authentication-Results` parsing +3. **DKIM Alignment** – signing domain vs. `From:` header +4. **DMARC** – policy outcome from `Authentication-Results` +5. **Display-Name Spoof** – fuzzy match against whitelisted org names + 20+ known brands +6. **Subdomain Spoof** – detects `evil.company.com` bypassing `company.com` +7. **IDN Normalization** – punycode decode prevents Unicode look-alike bypass + +--- + +## Running Tests + +```powershell +python -m pytest tests/ -v +python -m pytest tests/ -v --tb=short --cov=tools --cov=domain_shield_agent +``` + +### Test Scenarios + +| Test | Email | Expected | +|---|---|---| +| `TestValidInternalEmail` | `alice@company.com` + all auth pass | `SAFE` / no alert | +| `TestSpoofedDomainEmail` | Display name "Company IT" + `evil-company.net` + auth fail | `HIGH_RISK` / `BLOCK` | +| `TestExternalUnknownDomain` | `newsletter@external-vendor.io` (good auth) | `MEDIUM_RISK` / alert | +| `TestSubdomainSpoof` | `phish@mail.evil.company.com` | `HIGH_RISK` | +| `TestWhitelistedDomainAuthFailure` | `ceo@company.com` + SPF/DKIM/DMARC all fail | `HIGH_RISK` | + +--- + +## Integration Points + +| System | How | +|---|---| +| **IMAP / Exchange** | `source=imap` via `imaplib` (SSL) | +| **Slack** | `WEBHOOK_FORMAT=slack` → Block Kit payload | +| **SIEM / generic** | `WEBHOOK_FORMAT=generic` → raw JSON POST | +| **ZAK Platform** | `agents/domain-shield-agent.yaml` + `register_agent` decorator | + +--- + +## Security Notes + +- **No whitelist inheritance** – `mail.company.com` is NOT trusted unless explicitly added +- **IDN/Punycode** – domains normalized before comparison to prevent homograph attacks +- **Auth failure on whitelisted domain** → escalated to `HIGH_RISK` (possible internal spoofing) +- **Audit logs** – append-only JSONL; never delete email content +- **Strict mode** – set `STRICT_MODE=false` only to downgrade blocking to warnings + +--- + +## Exit Codes + +| Code | Meaning | +|---|---| +| `0` | All emails safe | +| `2` | One or more suspicious emails detected | +| `1` | Fatal error (misconfiguration, ingestion failure) | diff --git a/phising/agents/domain-shield-agent.yaml b/phising/agents/domain-shield-agent.yaml new file mode 100644 index 0000000..65cd10e --- /dev/null +++ b/phising/agents/domain-shield-agent.yaml @@ -0,0 +1,108 @@ +name: domain-shield-agent +version: "1.0.0" +description: > + AI-powered phishing detection agent that enforces strict domain whitelisting + on incoming emails. Flags, categorizes, and alerts on any email sourced from + domains outside the approved whitelist using SPF/DKIM/DMARC header analysis. + +domain: email_security + +metadata: + author: ZAK Platform + tags: [phishing, email-security, domain-whitelist, zero-trust, siem] + compliance: [SOC2, ISO27001, CIS-Controls] + +# ─── Capabilities ─────────────────────────────────────────────────────────── +capabilities: + tools: + - action_id: ingest_email + - action_id: parse_email_headers + - action_id: verify_domain_whitelist + - action_id: check_spf_alignment + - action_id: check_dkim_alignment + - action_id: check_dmarc_alignment + - action_id: detect_display_name_spoof + - action_id: detect_subdomain_spoof + - action_id: normalize_domain + - action_id: classify_phishing_risk + - action_id: generate_alert + - action_id: log_email_event + - action_id: export_audit_log + - action_id: manage_whitelist + - action_id: forward_webhook_alert + +# ─── Policy ───────────────────────────────────────────────────────────────── +policy: + strict_mode: true # block (not just warn) on suspicious emails + approval_gate: none # fully autonomous; no human-in-the-loop prompts + require_elevation: false + max_batch_size: 500 # emails processed per agent run + alert_on_error: true + +# ─── Boundaries ───────────────────────────────────────────────────────────── +boundaries: + allowed_actions: + - ingest_email + - parse_email_headers + - verify_domain_whitelist + - check_spf_alignment + - check_dkim_alignment + - check_dmarc_alignment + - detect_display_name_spoof + - detect_subdomain_spoof + - normalize_domain + - classify_phishing_risk + - generate_alert + - log_email_event + - export_audit_log + - manage_whitelist + - forward_webhook_alert + disallowed_actions: + - delete_email_permanently # audit trail must be preserved + - modify_email_content # no tampering with email body + +# ─── Inputs ───────────────────────────────────────────────────────────────── +inputs: + whitelist_domains: + type: list[string] + required: true + example: ["company.com", "trustedpartner.com"] + strict_mode: + type: boolean + default: true + alert_threshold: + type: string + enum: [high_only, medium_and_above, all] + default: medium_and_above + webhook_url: + type: string + required: false + imap_host: + type: string + required: false + imap_port: + type: integer + default: 993 + imap_user: + type: string + required: false + imap_password: + type: string + required: false + +# ─── Outputs ──────────────────────────────────────────────────────────────── +outputs: + processed_count: + type: integer + safe_count: + type: integer + suspicious_count: + type: integer + high_risk_count: + type: integer + medium_risk_count: + type: integer + alerts: + type: list[object] + audit_log_path: + type: string diff --git a/phising/config/config.env b/phising/config/config.env new file mode 100644 index 0000000..9735261 --- /dev/null +++ b/phising/config/config.env @@ -0,0 +1,10 @@ +# Auto-generated by Easy Start +WHITELIST_DOMAINS=deltajohnsons.com,minitts.net +STRICT_MODE=false +ALERT_THRESHOLD=all +IMAP_HOST=imap.tempm.com +IMAP_PORT=993 +IMAP_USER=ksag@vuatrochoi.nl +IMAP_PASSWORD=New1234567890 +IMAP_FOLDER=INBOX +MAX_EMAILS=20 diff --git a/phising/config/config.env.example b/phising/config/config.env.example new file mode 100644 index 0000000..b8acb02 --- /dev/null +++ b/phising/config/config.env.example @@ -0,0 +1,27 @@ +# DomainShield Agent – Configuration +# Copy this file to config/config.env and fill in your values. + +# ── Whitelist ───────────────────────────────────────────────────────────────── +# Comma-separated list of approved sender domains +WHITELIST_DOMAINS=tcu2o7hyzp@xkxkud.com, fodyhywy@denipl.com + +# ── Policy ──────────────────────────────────────────────────────────────────── +# strict_mode=true → BLOCK suspicious emails; false → WARN only +STRICT_MODE=true + +# Alert threshold: high_only | medium_and_above | all +ALERT_THRESHOLD=medium_and_above + +# ── Webhook / SIEM Integration ──────────────────────────────────────────────── +# Leave blank to disable webhook forwarding +WEBHOOK_URL= +# generic → raw JSON POST; slack → Slack Block Kit format +WEBHOOK_FORMAT=generic + +# ── IMAP (optional – only needed for source=imap) ───────────────────────────── +IMAP_HOST=imap.ethereal.email +IMAP_PORT=993 +IMAP_USER=hattie.macejkovic55@ethereal.email +IMAP_PASSWORD=SuQPrURwdQXU3uCWNv +IMAP_FOLDER=INBOX +MAX_EMAILS=50 diff --git a/phising/config/policy.json b/phising/config/policy.json new file mode 100644 index 0000000..c1ab418 --- /dev/null +++ b/phising/config/policy.json @@ -0,0 +1,8 @@ +{ + "whitelist_domains": ["company.com", "trustedpartner.com"], + "strict_mode": true, + "alert_threshold": "medium_and_above", + "webhook_url": "", + "last_modified": "", + "modified_by": "system" +} diff --git a/phising/domain_shield_agent.py b/phising/domain_shield_agent.py new file mode 100644 index 0000000..e87059c --- /dev/null +++ b/phising/domain_shield_agent.py @@ -0,0 +1,322 @@ +""" +DomainShield Agent – Core Agent Class +Orchestrates all phishing detection modules via the ZAK BaseAgent interface. +""" + +from __future__ import annotations + +from datetime import datetime, timezone +from typing import Any + +# ── ZAK SDK shim ───────────────────────────────────────────────────────────── +try: + from zin_adk import BaseAgent, AgentContext, AgentResult, register_agent +except ImportError: + # Standalone-compatible shim when ZAK SDK is not installed + class AgentContext: # type: ignore[no-redef] + def __init__(self, inputs: dict): + self.inputs = inputs + + class AgentResult(dict): # type: ignore[no-redef] + @staticmethod + def success(data: dict) -> "AgentResult": + return AgentResult({"status": "success", **data}) + + @staticmethod + def error(msg: str, data: dict | None = None) -> "AgentResult": + return AgentResult({"status": "error", "message": msg, **(data or {})}) + + class BaseAgent: # type: ignore[no-redef] + def call_tool(self, _ctx: Any, action_id: str, **kwargs: Any) -> dict: + """Dispatch to the matching tool function directly.""" + from tools import ( + ingest_email, parse_email_headers, verify_domain_whitelist, + check_spf_alignment, check_dkim_alignment, check_dmarc_alignment, + detect_display_name_spoof, detect_subdomain_spoof, + classify_phishing_risk, generate_alert, + forward_webhook_alert, log_email_event, manage_whitelist, + ) + _tool_map = { + "ingest_email": ingest_email, + "parse_email_headers": parse_email_headers, + "verify_domain_whitelist": verify_domain_whitelist, + "check_spf_alignment": check_spf_alignment, + "check_dkim_alignment": check_dkim_alignment, + "check_dmarc_alignment": check_dmarc_alignment, + "detect_display_name_spoof": detect_display_name_spoof, + "detect_subdomain_spoof": detect_subdomain_spoof, + "classify_phishing_risk": classify_phishing_risk, + "generate_alert": generate_alert, + "forward_webhook_alert": forward_webhook_alert, + "log_email_event": log_email_event, + "manage_whitelist": manage_whitelist, + } + fn = _tool_map.get(action_id) + if fn is None: + raise ValueError(f"Unknown tool action_id: {action_id!r}") + return fn(**kwargs) + + def register_agent(domain: str): + def _dec(cls): + return cls + return _dec + + +# ───────────────────────────────────────────────────────────────────────────── + +@register_agent(domain="email_security") +class DomainShieldAgent(BaseAgent): + """ + DomainShield Agent + ────────────────── + Processes a batch of emails through: + Phase 1 – Ingest emails (IMAP / file / raw) + Phase 2 – Parse headers + Phase 3 – Whitelist + subdomain-spoof check + Phase 4 – SPF / DKIM / DMARC alignment checks + Phase 5 – Display-name spoof detection + Phase 6 – Risk classification + Phase 7 – Alert generation + Phase 8 – Webhook forwarding + Phase 9 – Audit logging + """ + + def execute(self, context: AgentContext) -> AgentResult: + inp = context.inputs + + # ── Required inputs ──────────────────────────────────────────── + whitelist_domains: list[str] = inp.get("whitelist_domains", []) + if not whitelist_domains: + return AgentResult.error( + "whitelist_domains is required and must not be empty." + ) + + strict_mode: bool = inp.get("strict_mode", True) + alert_threshold: str = inp.get("alert_threshold", "medium_and_above") + webhook_url: str = inp.get("webhook_url", "") + webhook_format: str = inp.get("webhook_format", "generic") + + # Ingestion params + source: str = inp.get("source", "raw") + raw_eml: str = inp.get("raw_eml", "") + eml_path: str = inp.get("eml_path", "") + imap_host: str = inp.get("imap_host", "") + imap_port: int = inp.get("imap_port", 993) + imap_user: str = inp.get("imap_user", "") + imap_password: str = inp.get("imap_password", "") + imap_folder: str = inp.get("imap_folder", "INBOX") + max_emails: int = inp.get("max_emails", 100) + + run_summary = { + "run_id": _run_id(), + "started_at": datetime.now(timezone.utc).isoformat(), + "whitelist_domains": whitelist_domains, + "strict_mode": strict_mode, + "alert_threshold": alert_threshold, + } + + # ── Phase 1: Ingest ──────────────────────────────────────────── + ingest_result = self.call_tool( + context, "ingest_email", + source=source, + raw_eml=raw_eml, + eml_path=eml_path, + imap_host=imap_host, + imap_port=imap_port, + imap_user=imap_user, + imap_password=imap_password, + imap_folder=imap_folder, + max_emails=max_emails, + ) + if ingest_result.get("status") == "error": + return AgentResult.error( + f"Email ingestion failed: {ingest_result.get('message')}" + ) + + emails: list[dict] = ingest_result.get("data", {}).get("emails", []) + if not emails: + return AgentResult.success({ + **run_summary, + "processed_count": 0, + "message": "No emails to process.", + }) + + # ── Per-email processing ─────────────────────────────────────── + processed_count = 0 + safe_count = 0 + suspicious_count = 0 + high_risk_count = 0 + medium_risk_count = 0 + alerts: list[dict] = [] + + for raw_email in emails: + result = self._process_single_email( + context=context, + raw_email=raw_email, + whitelist_domains=whitelist_domains, + strict_mode=strict_mode, + alert_threshold=alert_threshold, + webhook_url=webhook_url, + webhook_format=webhook_format, + ) + processed_count += 1 + risk = result.get("risk_level", "SAFE") + if risk == "SAFE": + safe_count += 1 + else: + suspicious_count += 1 + if risk == "HIGH_RISK": + high_risk_count += 1 + else: + medium_risk_count += 1 + if result.get("alert"): + alerts.append(result["alert"]) + + run_summary.update({ + "finished_at": datetime.now(timezone.utc).isoformat(), + "processed_count": processed_count, + "safe_count": safe_count, + "suspicious_count": suspicious_count, + "high_risk_count": high_risk_count, + "medium_risk_count": medium_risk_count, + "alerts_generated": len(alerts), + "alerts": alerts, + }) + + return AgentResult.success(run_summary) + + # ── Single-email pipeline ───────────────────────────────────────── + def _process_single_email( + self, + context: AgentContext, + raw_email: dict, + whitelist_domains: list[str], + strict_mode: bool, + alert_threshold: str, + webhook_url: str, + webhook_format: str, + ) -> dict: + result: dict[str, Any] = {"email_uid": raw_email.get("uid", ""), "risk_level": "SAFE"} + + # Phase 2 – Parse headers + parsed = self.call_tool(context, "parse_email_headers", email_dict=raw_email) + if parsed.get("status") == "error": + return {**result, "error": parsed.get("message")} + p = parsed.get("data", {}) + + from_domain: str = p.get("from_domain", "") + subject: str = p.get("subject", "") + from_raw: str = p.get("from_raw", "") + display_name: str = p.get("display_name", "") + auth_results_raw: str = p.get("authentication_results_raw", "") + received_spf_raw: str = p.get("received_spf_raw", "") + + # Phase 3 – Whitelist + subdomain spoof + wl_result = self.call_tool( + context, "verify_domain_whitelist", + from_domain=from_domain, + whitelist_domains=whitelist_domains, + ) + in_whitelist: bool = wl_result.get("data", {}).get("in_whitelist", False) + + sd_result = self.call_tool( + context, "detect_subdomain_spoof", + from_domain=from_domain, + whitelist_domains=whitelist_domains, + ) + subdomain_spoof: bool = sd_result.get("data", {}).get("subdomain_spoof", False) + + # Phase 4 – SPF / DKIM / DMARC + spf = self.call_tool( + context, "check_spf_alignment", + received_spf_raw=received_spf_raw, + authentication_results_raw=auth_results_raw, + from_domain=from_domain, + ).get("data", {}) + + dkim = self.call_tool( + context, "check_dkim_alignment", + authentication_results_raw=auth_results_raw, + from_domain=from_domain, + ).get("data", {}) + + dmarc = self.call_tool( + context, "check_dmarc_alignment", + authentication_results_raw=auth_results_raw, + ).get("data", {}) + + # Phase 5 – Display-name spoof + dn = self.call_tool( + context, "detect_display_name_spoof", + display_name=display_name, + from_domain=from_domain, + whitelist_domains=whitelist_domains, + ).get("data", {}) + display_name_spoof: bool = dn.get("display_name_spoof", False) + + # Phase 6 – Classify risk + clf = self.call_tool( + context, "classify_phishing_risk", + in_whitelist=in_whitelist, + spf_pass=spf.get("spf_pass"), + spf_aligned=spf.get("spf_aligned"), + dkim_pass=dkim.get("dkim_pass"), + dkim_aligned=dkim.get("dkim_aligned"), + dmarc_pass=dmarc.get("dmarc_pass"), + display_name_spoof=display_name_spoof, + subdomain_spoof=subdomain_spoof, + from_domain=from_domain, + strict_mode=strict_mode, + ).get("data", {}) + + risk_level: str = clf.get("risk_level", "SAFE") + action: str = clf.get("action", "ALLOW") + reasons: list = clf.get("reasons", []) + flags: dict = clf.get("flags", {}) + result["risk_level"] = risk_level + + # Phase 7 – Generate alert + alert_res = self.call_tool( + context, "generate_alert", + email_uid=raw_email.get("uid", ""), + subject=subject, + from_raw=from_raw, + from_domain=from_domain, + risk_level=risk_level, + action=action, + reasons=reasons, + flags=flags, + alert_threshold=alert_threshold, + ).get("data", {}) + + alert: dict | None = alert_res.get("alert") if alert_res.get("alert_generated") else None + result["alert"] = alert + + # Phase 8 – Webhook + if alert and webhook_url: + self.call_tool( + context, "forward_webhook_alert", + alert=alert, + webhook_url=webhook_url, + webhook_format=webhook_format, + ) + + # Phase 9 – Audit log + self.call_tool( + context, "log_email_event", + email_uid=raw_email.get("uid", ""), + subject=subject, + from_raw=from_raw, + from_domain=from_domain, + risk_level=risk_level, + action=action, + reasons=reasons, + alert_id=alert.get("alert_id", "") if alert else "", + ) + + return result + + +def _run_id() -> str: + from datetime import datetime, timezone + return f"ds-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}" diff --git a/phising/easy_start.py b/phising/easy_start.py new file mode 100644 index 0000000..91b9c36 --- /dev/null +++ b/phising/easy_start.py @@ -0,0 +1,280 @@ +import os +import sys +import time + +try: + from rich.console import Console + from rich.panel import Panel + from rich.prompt import Prompt, Confirm + from rich.table import Table + from rich import print as rprint +except ImportError: + print("Missing requirements. Installing automatically...") + os.system(f"{sys.executable} -m pip install rich>=13.0") + from rich.console import Console + from rich.panel import Panel + from rich.prompt import Prompt, Confirm + from rich.table import Table + +console = Console() + +def clear_screen(): + os.system("cls" if os.name == "nt" else "clear") + +def detect_imap_host(email: str) -> str: + domain = email.split("@")[-1].lower() if "@" in email else "" + if domain in ["gmail.com", "googlemail.com"]: + return "imap.gmail.com" + elif domain in ["outlook.com", "hotmail.com", "live.com"]: + return "outlook.office365.com" + elif domain in ["yahoo.com", "ymail.com", "rocketmail.com"]: + return "imap.mail.yahoo.com" + elif domain in ["icloud.com", "me.com", "mac.com"]: + return "imap.mail.me.com" + return "" + +def provider_help(host: str): + if "gmail.com" in host: + return "Go to your Google Account -> Security -> 2-Step Verification -> App Passwords." + elif "outlook" in host: + return "Go to Microsoft Account -> Security -> Advanced Security Options -> App Passwords." + elif "yahoo" in host: + return "Go to Yahoo Account Security -> Generate app password." + elif "me.com" in host: + return "Go to Apple ID -> Sign-In and Security -> App-Specific Passwords." + return "Search your email provider's help docs for 'IMAP App Password'." + +def setup_wizard(): + clear_screen() + console.print(Panel.fit("[bold cyan]🛡️ DomainShield - Easy Setup Wizard[/bold cyan]", border_style="cyan")) + console.print("\nLet's get your personal email connected. It takes just a minute!\n") + + # 1. Email Address + email = Prompt.ask("[bold yellow]1. What is your email address?[/]") + + # Auto-detect host + host = detect_imap_host(email) + if host: + console.print(f"[green]✓ Detected provider:[/] {host}") + else: + host = Prompt.ask("[bold yellow]What is your IMAP server address? (e.g. imap.mail.com)[/]") + + # 2. App Password + console.print("\n[bold yellow]2. App Password Required[/]") + console.print(f"[dim]{provider_help(host)}[/]") + console.print("This is a special 16-character password just for this app to scan your inbox.") + password = Prompt.ask("[bold yellow]Paste your App Password[/]", password=True) + + # 3. Whitelist + console.print("\n[bold yellow]3. Trusted Domains[/]") + console.print("We will block ALL emails unless they come from these trusted domains.") + console.print("[dim]Example: netflix.com, chase.com, amazon.com, yourboss.com[/]") + whitelist_raw = Prompt.ask("[bold yellow]Enter domains you trust (comma separated)[/]") + + whitelist = [d.strip() for d in whitelist_raw.split(",") if d.strip()] + if not whitelist: + whitelist = ["gmail.com", "yahoo.com"] # fallback just so it doesn't crash + + # Write to env file + env_content = f"""# Auto-generated by Easy Start +WHITELIST_DOMAINS={",".join(whitelist)} +STRICT_MODE=false +ALERT_THRESHOLD=all +IMAP_HOST={host} +IMAP_PORT=993 +IMAP_USER={email} +IMAP_PASSWORD={password} +IMAP_FOLDER=INBOX +MAX_EMAILS=20 +""" + os.makedirs("config", exist_ok=True) + with open("config/config.env", "w", encoding="utf-8") as f: + f.write(env_content) + + try: + import run + run._dump_ui_config(run._load_env()) + except ImportError: + pass + + console.print("\n[bold green]✓ Setup Complete! Saved to config/config.env[/bold green]") + time.sleep(2) + +def run_agent(): + import run # Imports the run.py script logic + from domain_shield_agent import DomainShieldAgent, AgentContext + + # Load env variables (run.py has a _load_env helper) + env = run._load_env() + + context_inputs = { + "source": "imap", + "raw_eml": "", + "eml_path": "", + "whitelist_domains": env["whitelist_domains"], + "strict_mode": env["strict_mode"], + "alert_threshold": env["alert_threshold"], + "webhook_url": env["webhook_url"], + "webhook_format": env["webhook_format"], + "imap_host": env["imap_host"], + "imap_port": env["imap_port"], + "imap_user": env["imap_user"], + "imap_password": env["imap_password"], + "imap_folder": env["imap_folder"], + "max_emails": env["max_emails"], + } + + agent = DomainShieldAgent() + ctx = AgentContext(inputs=context_inputs) + + with console.status("[bold cyan]Scanning your inbox...[/bold cyan]", spinner="dots"): + result = agent.execute(ctx) + + return result + +def show_results(result): + clear_screen() + data = result.get("data", result) + + if result.get("status") == "error": + console.print(Panel.fit(f"[bold red]Error during scan:[/bold red]\n{result.get('message')}", border_style="red")) + return + + processed = data.get("processed_count", 0) + + console.print(Panel.fit( + f"[bold white]Scan Complete![/]\n" + f"Processed [cyan]{processed}[/] recent emails.\n" + f"Safe: [green]{data.get('safe_count', 0)}[/] | " + f"Suspicious: [red]{data.get('suspicious_count', 0)}[/]", + border_style="green" if data.get('suspicious_count', 0) == 0 else "red" + )) + + if processed == 0: + console.print("\n* Your INBOX has no unread/recent emails, or we couldn't connect.") + return + + # Print a summary table + table = Table(show_header=True, header_style="bold magenta") + table.add_column("Result", style="dim", width=12) + table.add_column("Sender", justify="left") + table.add_column("Subject", justify="left", max_width=40) + + # To show the actual emails, we normally pull from the audit log or agent result + # We can fetch flags from the summary if the agent returns it, but the agent + # only returns the alerts right now. We'll show the alerts. + alerts = data.get("alerts", []) + + if not alerts: + console.print("\n[bold green]✓ All recent emails were sent from your trusted domains. No phishing detected![/]") + else: + console.print("\n[bold red]⚠️ Suspicious Emails Found:[/bold red]") + for alert in alerts: + table.add_row( + f"[red]{alert.get('risk_level')}[/red]", + alert.get("from_raw", "").split("<")[0].strip(), + alert.get("subject", "") + ) + table.add_row("", f"[dim italic]{alert.get('reasons', [''])[0]}[/]", "") + table.add_row("", "", "") # spacer + + console.print(table) + +def main(): + while True: + clear_screen() + console.print(Panel.fit( + "[bold cyan]🛡️ DomainShield Personal[/bold cyan]\n" + "[dim]The easiest way to block phishing emails.[/dim]", + border_style="cyan" + )) + + has_config = os.path.exists("config/config.env") + + if not has_config: + console.print("\n[bold yellow]No configuration found. Let's set it up![/]") + Prompt.ask("\nPress [bold green]Enter[/] to begin setup", default="") + setup_wizard() + continue + + console.print("\n[1] [bold green]Scan Inbox Now[/]") + console.print("[2] [bold yellow]Re-configure Settings[/]") + console.print("[3] [bold cyan]View Dashboard in Browser[/]") + console.print("[4] [bold magenta]Manage Whitelist[/]") + console.print("[5] [dim]Exit[/]") + + choice = Prompt.ask("\nWhat would you like to do?", choices=["1", "2", "3", "4", "5"], default="1") + + if choice == "1": + res = run_agent() + show_results(res) + Prompt.ask("\nPress [bold]Enter[/] to return to menu", default="") + + elif choice == "2": + setup_wizard() + + elif choice == "3": + console.print("\n[bold cyan]Starting DomainShield Interactive Dashboard...[/]") + console.print("[dim]The dashboard will open in your browser.[/dim]") + console.print("[dim]Press Ctrl+C when you want to stop the dashboard and return here.[/dim]") + time.sleep(1) + try: + os.system(f"{sys.executable} ui_server.py") + except KeyboardInterrupt: + pass + console.print("\n[green]Dashboard stopped.[/green]") + time.sleep(1) + + elif choice == "4": + clear_screen() + console.print(Panel.fit("[bold magenta]Manage Whitelist[/]")) + env_file = "config/config.env" + with open(env_file, "r") as f: + lines = f.readlines() + + w_line_idx = -1 + current_domains = [] + for i, line in enumerate(lines): + if line.startswith("WHITELIST_DOMAINS="): + w_line_idx = i + val = line.strip().split("=", 1)[1] + current_domains = [d for d in val.split(",") if d.strip()] + break + + console.print(f"Current Trusted Domains: [bold green]{', '.join(current_domains)}[/]\n") + new_domains_input = Prompt.ask("Enter domain(s) to ADD or REMOVE (comma separated, or press Enter to cancel)") + if new_domains_input.strip(): + new_domains = [d.strip().lower() for d in new_domains_input.split(",") if d.strip()] + added = [] + removed = [] + for domain in new_domains: + if domain not in current_domains: + current_domains.append(domain) + added.append(domain) + else: + current_domains.remove(domain) + removed.append(domain) + + if added: + console.print(f"\n[bold green]✓ ADDED: {', '.join(added)}[/]") + if removed: + console.print(f"\n[bold yellow]🚫 REMOVED: {', '.join(removed)}[/]") + + lines[w_line_idx] = f"WHITELIST_DOMAINS={','.join(current_domains)}\n" + with open(env_file, "w") as f: + f.writelines(lines) + + # Dump UI config + try: + import run + run._dump_ui_config(run._load_env()) + except ImportError: + pass + time.sleep(2) + + elif choice == "5": + console.print("\n[bold green]Stay safe![/]\n") + break + +if __name__ == "__main__": + main() diff --git a/phising/logs/audit.jsonl b/phising/logs/audit.jsonl new file mode 100644 index 0000000..9274072 --- /dev/null +++ b/phising/logs/audit.jsonl @@ -0,0 +1,12 @@ +{"timestamp": "2026-04-12T13:34:21.918035+00:00", "email_uid": "raw-0", "subject": "GT VS LSG", "from_raw": "fodyhywy@denipl.com ", "from_domain": "denipl.com", "risk_level": "MEDIUM_RISK", "action": "WARN", "reasons": ["Sender domain 'denipl.com' is not in the approved whitelist"], "alert_id": "e1359da5-49a1-43c3-b63b-80015212a30c"} +{"timestamp": "2026-04-12T13:37:43.783999+00:00", "email_uid": "raw-0", "subject": "newone", "from_raw": "uncomfortable836@deltajohnsons.com ", "from_domain": "deltajohnsons.com", "risk_level": "SAFE", "action": "ALLOW", "reasons": [], "alert_id": "724740c2-d690-4043-ad63-c979664d5439"} +{"timestamp": "2026-04-12T13:41:18.575443+00:00", "email_uid": "raw-0", "subject": "newone", "from_raw": "ocqjk81546@minitts.net ", "from_domain": "minitts.net", "risk_level": "SAFE", "action": "ALLOW", "reasons": [], "alert_id": "6e229192-ae45-482b-9be2-0a57823692b0"} +{"timestamp": "2026-04-12T13:42:22.418394+00:00", "email_uid": "raw-0", "subject": "oldone", "from_raw": "ocqjk81546@minitts.net ", "from_domain": "minitts.net", "risk_level": "MEDIUM_RISK", "action": "WARN", "reasons": ["Sender domain 'minitts.net' is not in the approved whitelist"], "alert_id": "82e03fec-7121-4113-ba95-6dd4e618deee"} +{"timestamp": "2026-04-15T14:20:10.839007+00:00", "email_uid": "raw-0", "subject": "hie", "from_raw": "mohoki4634@tatefarm.com ", "from_domain": "tatefarm.com", "risk_level": "MEDIUM_RISK", "action": "WARN", "reasons": ["Sender domain 'tatefarm.com' is not in the approved whitelist"], "alert_id": "936eb558-185a-4c4e-92b3-331ff591985c"} +{"timestamp": "2026-04-15T14:21:43.436570+00:00", "email_uid": "raw-0", "subject": "new", "from_raw": "Orcella.Zarrella@AllWebEmails.com ", "from_domain": "allwebemails.com", "risk_level": "SAFE", "action": "ALLOW", "reasons": [], "alert_id": "04d6e603-1826-47db-8c56-aa838a7f1fd9"} +{"timestamp": "2026-04-16T07:17:26.209416+00:00", "email_uid": "raw-0", "subject": "new email", "from_raw": "mohoki4634@tatefarm.com ", "from_domain": "tatefarm.com", "risk_level": "MEDIUM_RISK", "action": "WARN", "reasons": ["Sender domain 'tatefarm.com' is not in the approved whitelist"], "alert_id": "01c2913f-0f2f-451c-8c86-41a17bffb2d2"} +{"timestamp": "2026-04-16T07:19:33.245556+00:00", "email_uid": "raw-0", "subject": "old email", "from_raw": "uqlc26re39@wnbaldwy.com ", "from_domain": "wnbaldwy.com", "risk_level": "SAFE", "action": "ALLOW", "reasons": [], "alert_id": "02ce6935-bd29-480b-a8ad-2000461db154"} +{"timestamp": "2026-04-16T09:28:15.375931+00:00", "email_uid": "raw-0", "subject": "email", "from_raw": "uqlc26re39@wnbaldwy.com ", "from_domain": "wnbaldwy.com", "risk_level": "SAFE", "action": "ALLOW", "reasons": [], "alert_id": "f8aaf512-70a1-47d0-bcaf-de59db559456"} +{"timestamp": "2026-04-16T09:29:09.274147+00:00", "email_uid": "raw-0", "subject": "new mail", "from_raw": "ipahjbmeagiachctmq@vtmpj.com ", "from_domain": "vtmpj.com", "risk_level": "MEDIUM_RISK", "action": "WARN", "reasons": ["Sender domain 'vtmpj.com' is not in the approved whitelist"], "alert_id": "46344def-47c8-4da7-b256-985f0d903d62"} +{"timestamp": "2026-04-16T09:32:42.523053+00:00", "email_uid": "raw-0", "subject": "new mail", "from_raw": "mtdex34575@minitts.net ", "from_domain": "minitts.net", "risk_level": "SAFE", "action": "ALLOW", "reasons": [], "alert_id": "882d3dc1-ba51-4b5e-afb6-52bce066df3e"} +{"timestamp": "2026-04-16T09:33:13.670106+00:00", "email_uid": "raw-0", "subject": "old domain", "from_raw": "uqlc26re39@wnbaldwy.com ", "from_domain": "wnbaldwy.com", "risk_level": "MEDIUM_RISK", "action": "WARN", "reasons": ["Sender domain 'wnbaldwy.com' is not in the approved whitelist"], "alert_id": "485b16c4-53be-4501-a30c-d82f67bd0054"} diff --git a/phising/requirements.txt b/phising/requirements.txt new file mode 100644 index 0000000..c18ede1 --- /dev/null +++ b/phising/requirements.txt @@ -0,0 +1,3 @@ +zin-adk>=0.1.0 +pytest>=8.0 +pytest-cov>=5.0 diff --git a/phising/run.py b/phising/run.py new file mode 100644 index 0000000..d186dca --- /dev/null +++ b/phising/run.py @@ -0,0 +1,191 @@ +""" +DomainShield Agent – CLI Entry Point +Usage: + python run.py --help + python run.py --source raw --raw-eml "From: attacker@evil.com\r\nSubject: Test" + python run.py --source imap --imap-host mail.company.com --imap-user user@company.com + python run.py --admin add-domain partner.org + python run.py --admin remove-domain partner.org + python run.py --admin export-log +""" + +from __future__ import annotations + +import argparse +import json +import os +import sys + +# Ensure project root is on PYTHONPATH +sys.path.insert(0, os.path.dirname(__file__)) + +from domain_shield_agent import DomainShieldAgent, AgentContext, AgentResult + + +def _load_env() -> dict: + """Load configuration from environment variables (optionally .env file).""" + env_file = os.path.join(os.path.dirname(__file__), "config", "config.env") + if os.path.exists(env_file): + with open(env_file) as fh: + for line in fh: + line = line.strip() + if line and not line.startswith("#") and "=" in line: + k, _, v = line.partition("=") + os.environ.setdefault(k.strip(), v.strip()) + + return { + "whitelist_domains": [ + d.strip() + for d in os.getenv("WHITELIST_DOMAINS", "company.com,trustedpartner.com").split(",") + if d.strip() + ], + "strict_mode": os.getenv("STRICT_MODE", "true").lower() == "true", + "alert_threshold": os.getenv("ALERT_THRESHOLD", "medium_and_above"), + "webhook_url": os.getenv("WEBHOOK_URL", ""), + "webhook_format": os.getenv("WEBHOOK_FORMAT", "generic"), + "imap_host": os.getenv("IMAP_HOST", ""), + "imap_port": int(os.getenv("IMAP_PORT", "993")), + "imap_user": os.getenv("IMAP_USER", ""), + "imap_password": os.getenv("IMAP_PASSWORD", ""), + "imap_folder": os.getenv("IMAP_FOLDER", "INBOX"), + "max_emails": int(os.getenv("MAX_EMAILS", "100")), + } + + +def build_parser() -> argparse.ArgumentParser: + p = argparse.ArgumentParser( + prog="DomainShield", + description="AI-powered phishing detection agent (ZAK-based).", + ) + p.add_argument("--source", choices=["imap", "file", "raw"], default="raw", + help="Email source type (default: raw)") + p.add_argument("--raw-eml", default="", metavar="EML", + help="Raw RFC-2822 email string (for --source raw)") + p.add_argument("--eml-path", default="", metavar="PATH", + help="Path to .eml file (for --source file)") + p.add_argument("--whitelist", nargs="+", metavar="DOMAIN", + help="Override whitelist domains (space-separated)") + p.add_argument("--no-strict", action="store_true", + help="Disable strict mode (warn instead of block)") + p.add_argument("--alert-threshold", + choices=["high_only", "medium_and_above", "all"], + help="Alert sensitivity level") + p.add_argument("--webhook-url", metavar="URL", + help="Webhook URL for alert forwarding") + + # Admin sub-commands + p.add_argument("--admin", metavar="CMD", + help="Admin command: add-domain, remove-domain, list-policy, export-log") + p.add_argument("--admin-arg", metavar="ARG", default="", + help="Argument for the admin command (e.g. domain name)") + p.add_argument("--json", action="store_true", dest="output_json", + help="Output results as JSON") + return p + + +def handle_admin(cmd: str, arg: str, output_json: bool) -> None: + from tools.policy_tools import manage_whitelist + from tools.logging_tools import export_audit_log + + if cmd == "add-domain": + result = manage_whitelist(operation="add", domain=arg) + elif cmd == "remove-domain": + result = manage_whitelist(operation="remove", domain=arg) + elif cmd == "list-policy": + result = manage_whitelist(operation="list") + elif cmd == "export-log": + result = export_audit_log() + elif cmd == "set-strict": + result = manage_whitelist(operation="set_strict_mode", domain=arg) + elif cmd == "set-threshold": + result = manage_whitelist(operation="set_alert_threshold", domain=arg) + else: + print(f"Unknown admin command: {cmd!r}") + print("Available: add-domain, remove-domain, list-policy, export-log, set-strict, set-threshold") + sys.exit(1) + + _print_result(result, output_json) + + +def _print_result(result: dict, output_json: bool) -> None: + if output_json: + print(json.dumps(result, indent=2, default=str)) + return + + status = result.get("status", "ok") + data = result.get("data", result) + if status == "error": + print(f"[ERROR] {result.get('message', result)}") + return + + # Pretty summary + if isinstance(data, dict): + for k, v in data.items(): + if isinstance(v, list) and len(v) > 5: + print(f" {k}: [{len(v)} items]") + else: + print(f" {k}: {v}") + else: + print(data) + + +def _dump_ui_config(env_vars: dict) -> None: + try: + import os + import json + os.makedirs(os.path.join(os.path.dirname(__file__), "ui"), exist_ok=True) + conf_path = os.path.join(os.path.dirname(__file__), "ui", "config.js") + with open(conf_path, "w", encoding="utf-8") as f: + f.write(f"window.LIVE_WHITELIST = {json.dumps(env_vars['whitelist_domains'])};\n") + f.write(f"window.LIVE_STRICT_MODE = {str(env_vars['strict_mode']).lower()};\n") + except Exception: + pass + + +def main() -> None: + parser = build_parser() + args = parser.parse_args() + env = _load_env() + + _dump_ui_config(env) + + # ── Admin commands ──────────────────────────────────────────────── + if args.admin: + handle_admin(args.admin, args.admin_arg, args.output_json) + return + + # ── Build context ───────────────────────────────────────────────── + context_inputs = { + "source": args.source, + "raw_eml": args.raw_eml, + "eml_path": args.eml_path, + "whitelist_domains": args.whitelist or env["whitelist_domains"], + "strict_mode": not args.no_strict if args.no_strict else env["strict_mode"], + "alert_threshold": args.alert_threshold or env["alert_threshold"], + "webhook_url": args.webhook_url or env["webhook_url"], + "webhook_format": env["webhook_format"], + "imap_host": env["imap_host"], + "imap_port": env["imap_port"], + "imap_user": env["imap_user"], + "imap_password": env["imap_password"], + "imap_folder": env["imap_folder"], + "max_emails": env["max_emails"], + } + + # ── Run agent ───────────────────────────────────────────────────── + agent = DomainShieldAgent() + ctx = AgentContext(inputs=context_inputs) + + print("\n[+] DomainShield Agent - Starting email scan...\n") + result = agent.execute(ctx) + print() + _print_result(result, args.output_json) + + # Exit non-zero if any suspicious emails found + data = result.get("data", result) + if isinstance(data, dict) and data.get("suspicious_count", 0) > 0: + sys.exit(2) + + +if __name__ == "__main__": + main() diff --git a/phising/tests/__init__.py b/phising/tests/__init__.py new file mode 100644 index 0000000..65140f2 --- /dev/null +++ b/phising/tests/__init__.py @@ -0,0 +1 @@ +# tests package diff --git a/phising/tests/test_domain_shield.py b/phising/tests/test_domain_shield.py new file mode 100644 index 0000000..6b2af73 --- /dev/null +++ b/phising/tests/test_domain_shield.py @@ -0,0 +1,358 @@ +""" +DomainShield Agent – Test Suite +Tests all three canonical scenarios: + 1. Valid internal email (SAFE) + 2. Spoofed domain email (HIGH_RISK) + 3. External unknown domain email (MEDIUM_RISK) + +Run: + python -m pytest tests/ -v + python -m pytest tests/ -v --tb=short +""" + +from __future__ import annotations + +import sys +import os + +sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..")) + +import pytest +from domain_shield_agent import DomainShieldAgent, AgentContext + + +# ─── Shared fixtures ────────────────────────────────────────────────────────── + +WHITELIST = ["company.com", "trustedpartner.com"] + +VALID_AUTH_RESULTS = ( + "dkim=pass header.d=company.com; " + "spf=pass smtp.mailfrom=sender@company.com; " + "dmarc=pass policy.applied=none" +) + +FAILED_AUTH_RESULTS = ( + "dkim=fail; spf=fail; dmarc=fail" +) + + +def _make_raw_email( + from_addr: str, + display_name: str = "", + auth_results: str = "", + received_spf: str = "", + subject: str = "Test Email", + uid: str = "test-uid-001", +) -> dict: + """Build a minimal email dict matching the ingestion output schema.""" + from_field = f'"{display_name}" <{from_addr}>' if display_name else from_addr + return { + "uid": uid, + "subject": subject, + "from": from_field, + "to": "inbox@company.com", + "return_path": f"<{from_addr}>", + "date": "Mon, 12 Apr 2026 10:00:00 +0000", + "message_id": f"<{uid}@test>", + "received_spf": received_spf, + "authentication_results": auth_results, + "dkim_signature": "v=1; a=rsa-sha256; ...", + "raw_headers": {}, + "body_preview": "Hello, please review the attached report.", + } + + +def _run_agent(email_dict: dict, strict_mode: bool = True) -> dict: + """Run the agent with a single pre-parsed email dict injected via 'raw' bypass.""" + agent = DomainShieldAgent() + + # Bypass ingestion by monkey-patching call_tool for ingest_email + original_call_tool = agent.call_tool + + def patched_call_tool(ctx, action_id, **kwargs): + if action_id == "ingest_email": + return {"status": "ok", "data": {"ingested_count": 1, "emails": [email_dict]}} + return original_call_tool(ctx, action_id, **kwargs) + + agent.call_tool = patched_call_tool + + ctx = AgentContext(inputs={ + "whitelist_domains": WHITELIST, + "strict_mode": strict_mode, + "alert_threshold": "medium_and_above", + "source": "raw", + "raw_eml": "", + }) + result = agent.execute(ctx) + return result + + +# ─── Test Case 1: Valid Internal Email ──────────────────────────────────────── + +class TestValidInternalEmail: + """Email from a whitelisted domain with all auth checks passing → SAFE""" + + def setup_method(self): + self.email = _make_raw_email( + from_addr="alice@company.com", + display_name="Alice Smith", + auth_results=VALID_AUTH_RESULTS, + received_spf="pass (company.com: sender is authorized) smtp.mailfrom=alice@company.com", + subject="Q1 Report", + uid="valid-001", + ) + + def test_risk_level_is_safe(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("safe_count", 0) == 1, f"Expected safe_count=1, got: {data}" + + def test_no_alerts_generated(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("alerts_generated", 0) == 0, "No alerts expected for safe email" + + def test_processed_count(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("processed_count") == 1 + + +# ─── Test Case 2: Spoofed Domain Email ─────────────────────────────────────── + +class TestSpoofedDomainEmail: + """Display name mimics company, but domain is external + auth fails → HIGH_RISK""" + + def setup_method(self): + self.email = _make_raw_email( + from_addr="noreply@evil-company.net", + display_name="Company IT Support", # <-- mimics 'company' + auth_results=FAILED_AUTH_RESULTS, + received_spf="fail", + subject="Urgent: Reset Your Password", + uid="spoof-001", + ) + + def test_risk_level_is_high(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("high_risk_count", 0) == 1, f"Expected HIGH_RISK, got: {data}" + + def test_alert_generated(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("alerts_generated", 0) >= 1, "Alert expected for HIGH_RISK email" + + def test_alert_has_reasons(self): + result = _run_agent(self.email) + data = result.get("data", result) + alerts = data.get("alerts", []) + assert alerts, "No alerts found" + reasons = alerts[0].get("reasons", []) + assert len(reasons) > 0, "Alert should contain flagging reasons" + + def test_action_is_block_in_strict_mode(self): + result = _run_agent(self.email, strict_mode=True) + data = result.get("data", result) + alerts = data.get("alerts", []) + if alerts: + assert alerts[0].get("action") == "BLOCK" + + +# ─── Test Case 3: External Unknown Domain ──────────────────────────────────── + +class TestExternalUnknownDomain: + """Email from a legitimate-seeming external domain not in whitelist → MEDIUM_RISK""" + + def setup_method(self): + self.email = _make_raw_email( + from_addr="newsletter@external-vendor.io", + display_name="External Vendor", + auth_results=( + "dkim=pass header.d=external-vendor.io; " + "spf=pass smtp.mailfrom=newsletter@external-vendor.io; " + "dmarc=pass" + ), + received_spf="pass", + subject="Monthly Newsletter", + uid="ext-001", + ) + + def test_risk_level_is_medium(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("medium_risk_count", 0) == 1, f"Expected MEDIUM_RISK, got: {data}" + + def test_alert_generated(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("alerts_generated", 0) >= 1 + + def test_not_high_risk(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("high_risk_count", 0) == 0, "External domain with good auth should not be HIGH_RISK" + + def test_warn_action_in_non_strict_mode(self): + result = _run_agent(self.email, strict_mode=False) + data = result.get("data", result) + alerts = data.get("alerts", []) + if alerts: + assert alerts[0].get("action") == "WARN" + + +# ─── Test Case 4: Subdomain Spoof ───────────────────────────────────────────── + +class TestSubdomainSpoof: + """Email from mail.evil.company.com should be detected as subdomain spoof""" + + def setup_method(self): + self.email = _make_raw_email( + from_addr="phish@mail.evil.company.com", + display_name="Company Security", + auth_results=FAILED_AUTH_RESULTS, + received_spf="fail", + subject="Your account has been compromised", + uid="subspoof-001", + ) + + def test_risk_level_is_high(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("high_risk_count", 0) == 1, f"Expected HIGH_RISK for subdomain spoof, got: {data}" + + +# ─── Test Case 5: Whitelist domain with auth failure ────────────────────────── + +class TestWhitelistedDomainAuthFailure: + """Whitelisted domain but SPF/DKIM/DMARC all fail → HIGH_RISK (possible spoofing of internal domain)""" + + def setup_method(self): + self.email = _make_raw_email( + from_addr="ceo@company.com", + display_name="CEO Company", + auth_results=FAILED_AUTH_RESULTS, + received_spf="fail", + subject="Wire Transfer Request", + uid="authfail-001", + ) + + def test_risk_level_is_high(self): + result = _run_agent(self.email) + data = result.get("data", result) + assert data.get("high_risk_count", 0) == 1, ( + f"Whitelisted domain with auth failure should be HIGH_RISK, got: {data}" + ) + + +# ─── Unit Tests: Individual Tools ───────────────────────────────────────────── + +class TestDomainVerificationTools: + def test_normalize_idn_domain(self): + from tools.domain_verification_tools import normalize_domain + result = normalize_domain("CompaNY.COM") + assert result.get("data", {}).get("normalized") == "company.com" + + def test_whitelist_exact_match(self): + from tools.domain_verification_tools import verify_domain_whitelist + r = verify_domain_whitelist("company.com", ["company.com", "partner.org"]) + assert r.get("data", {}).get("in_whitelist") is True + + def test_whitelist_miss(self): + from tools.domain_verification_tools import verify_domain_whitelist + r = verify_domain_whitelist("evil.com", ["company.com"]) + assert r.get("data", {}).get("in_whitelist") is False + + def test_subdomain_spoof_detected(self): + from tools.domain_verification_tools import detect_subdomain_spoof + r = detect_subdomain_spoof("evil.company.com", ["company.com"]) + assert r.get("data", {}).get("subdomain_spoof") is True + + def test_legit_subdomain_not_in_whitelist(self): + from tools.domain_verification_tools import detect_subdomain_spoof + # mail.company.com is a subdomain of company.com but not explicitly whitelisted + r = detect_subdomain_spoof("mail.company.com", ["company.com"]) + assert r.get("data", {}).get("subdomain_spoof") is True + + +class TestPhishingDetectionTools: + def test_display_name_spoof_detected(self): + from tools.phishing_detection_tools import detect_display_name_spoof + r = detect_display_name_spoof( + display_name="Microsoft Support", + from_domain="evil.net", + whitelist_domains=["company.com"], + ) + assert r.get("data", {}).get("display_name_spoof") is True + + def test_legitimate_display_name(self): + from tools.phishing_detection_tools import detect_display_name_spoof + r = detect_display_name_spoof( + display_name="Alice from Company", + from_domain="company.com", + whitelist_domains=["company.com"], + ) + # May or may not flag – depends on similarity; just check it returns data + assert "data" in r + + def test_classify_safe(self): + from tools.phishing_detection_tools import classify_phishing_risk + r = classify_phishing_risk( + in_whitelist=True, + spf_pass=True, spf_aligned=True, + dkim_pass=True, dkim_aligned=True, + dmarc_pass=True, + display_name_spoof=False, + subdomain_spoof=False, + from_domain="company.com", + strict_mode=True, + ) + assert r.get("data", {}).get("risk_level") == "SAFE" + + def test_classify_high_risk_spoof(self): + from tools.phishing_detection_tools import classify_phishing_risk + r = classify_phishing_risk( + in_whitelist=False, + spf_pass=False, spf_aligned=False, + dkim_pass=False, dkim_aligned=False, + dmarc_pass=False, + display_name_spoof=True, + subdomain_spoof=False, + from_domain="evil.com", + strict_mode=True, + ) + assert r.get("data", {}).get("risk_level") == "HIGH_RISK" + assert r.get("data", {}).get("action") == "BLOCK" + + def test_classify_medium_risk_external(self): + from tools.phishing_detection_tools import classify_phishing_risk + r = classify_phishing_risk( + in_whitelist=False, + spf_pass=True, spf_aligned=True, + dkim_pass=True, dkim_aligned=True, + dmarc_pass=True, + display_name_spoof=False, + subdomain_spoof=False, + from_domain="external.io", + strict_mode=True, + ) + assert r.get("data", {}).get("risk_level") == "MEDIUM_RISK" + + +class TestPolicyTools: + def test_add_and_remove_domain(self, tmp_path): + from tools.policy_tools import manage_whitelist + policy_path = str(tmp_path / "policy.json") + + r1 = manage_whitelist("add", "newdomain.com", policy_path=policy_path) + assert "newdomain.com" in r1.get("data", {}).get("whitelist_domains", []) + + r2 = manage_whitelist("remove", "newdomain.com", policy_path=policy_path) + assert "newdomain.com" not in r2.get("data", {}).get("whitelist_domains", []) + + def test_list_policy(self, tmp_path): + from tools.policy_tools import manage_whitelist + policy_path = str(tmp_path / "policy.json") + manage_whitelist("add", "a.com", policy_path=policy_path) + r = manage_whitelist("list", policy_path=policy_path) + assert "whitelist_domains" in r.get("data", {}) diff --git a/phising/tools/__init__.py b/phising/tools/__init__.py new file mode 100644 index 0000000..ea57aa1 --- /dev/null +++ b/phising/tools/__init__.py @@ -0,0 +1,40 @@ +""" +DomainShield Agent – tools package. +Exports all @zak_tool-decorated functions for use by the agent class. +""" + +from .email_ingestion_tools import ingest_email +from .domain_verification_tools import ( + parse_email_headers, + verify_domain_whitelist, + check_spf_alignment, + check_dkim_alignment, + check_dmarc_alignment, + normalize_domain, + detect_subdomain_spoof, +) +from .phishing_detection_tools import ( + detect_display_name_spoof, + classify_phishing_risk, +) +from .alerting_tools import generate_alert, forward_webhook_alert +from .logging_tools import log_email_event, export_audit_log +from .policy_tools import manage_whitelist + +__all__ = [ + "ingest_email", + "parse_email_headers", + "verify_domain_whitelist", + "check_spf_alignment", + "check_dkim_alignment", + "check_dmarc_alignment", + "normalize_domain", + "detect_subdomain_spoof", + "detect_display_name_spoof", + "classify_phishing_risk", + "generate_alert", + "forward_webhook_alert", + "log_email_event", + "export_audit_log", + "manage_whitelist", +] diff --git a/phising/tools/alerting_tools.py b/phising/tools/alerting_tools.py new file mode 100644 index 0000000..7baf3bb --- /dev/null +++ b/phising/tools/alerting_tools.py @@ -0,0 +1,194 @@ +""" +Alerting Module – DomainShield Agent +Generates structured alerts and forwards them via webhook (Slack / SIEM). +""" + +from __future__ import annotations + +import json +import urllib.request +import urllib.error +from datetime import datetime, timezone +from typing import Any +import uuid + +try: + from zin_adk import zak_tool, ToolResult +except ImportError: + def zak_tool(*args, **kwargs): + def _decorator(fn): + return fn + return _decorator + + class ToolResult(dict): + @staticmethod + def ok(data: Any) -> "ToolResult": + return ToolResult({"status": "ok", "data": data}) + + @staticmethod + def error(msg: str) -> "ToolResult": + return ToolResult({"status": "error", "message": msg}) + + +# ─── Alert schema ───────────────────────────────────────────────────────────── + +def _build_alert( + email_uid: str, + subject: str, + from_raw: str, + from_domain: str, + risk_level: str, + action: str, + reasons: list[str], + flags: dict, +) -> dict: + return { + "alert_id": str(uuid.uuid4()), + "timestamp": datetime.now(timezone.utc).isoformat(), + "email_uid": email_uid, + "subject": subject, + "from_raw": from_raw, + "from_domain": from_domain, + "risk_level": risk_level, # SAFE | MEDIUM_RISK | HIGH_RISK + "action": action, # ALLOW | WARN | BLOCK + "reasons": reasons, + "flags": flags, + "severity": "critical" if risk_level == "HIGH_RISK" else ( + "warning" if risk_level == "MEDIUM_RISK" else "info" + ), + } + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="generate_alert", + description="Generate a structured alert dict for a suspicious or blocked email.", +) +def generate_alert( + email_uid: str, + subject: str, + from_raw: str, + from_domain: str, + risk_level: str, + action: str, + reasons: list, + flags: dict, + alert_threshold: str = "medium_and_above", +) -> ToolResult: + """ + alert_threshold: 'high_only' | 'medium_and_above' | 'all' + """ + try: + # Decide whether this risk level clears the threshold + level_order = {"SAFE": 0, "MEDIUM_RISK": 1, "HIGH_RISK": 2} + threshold_map = { + "high_only": 2, + "medium_and_above": 1, + "all": 0, + } + min_level = threshold_map.get(alert_threshold, 1) + current_level = level_order.get(risk_level, 0) + + if current_level < min_level: + return ToolResult.ok({ + "alert_generated": False, + "reason": f"Risk level {risk_level!r} below threshold {alert_threshold!r}", + }) + + alert = _build_alert( + email_uid=email_uid, + subject=subject, + from_raw=from_raw, + from_domain=from_domain, + risk_level=risk_level, + action=action, + reasons=list(reasons), + flags=dict(flags), + ) + + return ToolResult.ok({"alert_generated": True, "alert": alert}) + + except Exception as exc: + return ToolResult.error(f"generate_alert failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="forward_webhook_alert", + description="POST an alert payload to a webhook URL (Slack / SIEM / custom HTTP endpoint).", +) +def forward_webhook_alert( + alert: dict, + webhook_url: str, + webhook_format: str = "generic", + timeout_seconds: int = 10, +) -> ToolResult: + """ + webhook_format: 'generic' (raw JSON) | 'slack' (Slack Block Kit message) + """ + try: + if not webhook_url: + return ToolResult.ok({"forwarded": False, "reason": "No webhook_url configured"}) + + if webhook_format == "slack": + payload = _slack_payload(alert) + else: + payload = alert # raw JSON + + body = json.dumps(payload).encode("utf-8") + req = urllib.request.Request( + webhook_url, + data=body, + headers={"Content-Type": "application/json", "User-Agent": "DomainShield-Agent/1.0"}, + method="POST", + ) + with urllib.request.urlopen(req, timeout=timeout_seconds) as resp: + status = resp.status + resp_body = resp.read().decode(errors="replace")[:500] + + return ToolResult.ok({ + "forwarded": True, + "http_status": status, + "response_preview": resp_body, + }) + + except urllib.error.HTTPError as exc: + return ToolResult.error(f"Webhook HTTP {exc.code}: {exc.reason}") + except Exception as exc: + return ToolResult.error(f"forward_webhook_alert failed: {exc}") + + +def _slack_payload(alert: dict) -> dict: + risk_emoji = {"HIGH_RISK": "🔴", "MEDIUM_RISK": "🟡", "SAFE": "🟢"}.get( + alert.get("risk_level", ""), "⚪" + ) + reasons_text = "\n• ".join(alert.get("reasons", [])) or "None" + return { + "text": f"{risk_emoji} *DomainShield Alert* – {alert.get('risk_level')}", + "blocks": [ + { + "type": "header", + "text": { + "type": "plain_text", + "text": f"{risk_emoji} Phishing Alert: {alert.get('risk_level')}", + }, + }, + { + "type": "section", + "fields": [ + {"type": "mrkdwn", "text": f"*From:*\n{alert.get('from_raw', '')}"}, + {"type": "mrkdwn", "text": f"*Subject:*\n{alert.get('subject', '')}"}, + {"type": "mrkdwn", "text": f"*Action:*\n{alert.get('action', '')}"}, + {"type": "mrkdwn", "text": f"*Alert ID:*\n{alert.get('alert_id', '')}"}, + ], + }, + { + "type": "section", + "text": { + "type": "mrkdwn", + "text": f"*Reasons:*\n• {reasons_text}", + }, + }, + {"type": "divider"}, + ], + } diff --git a/phising/tools/domain_verification_tools.py b/phising/tools/domain_verification_tools.py new file mode 100644 index 0000000..4fefcbc --- /dev/null +++ b/phising/tools/domain_verification_tools.py @@ -0,0 +1,307 @@ +""" +Domain Verification Engine – DomainShield Agent +Handles whitelist checks, SPF/DKIM/DMARC header parsing, IDN normalization, +and subdomain-spoofing detection. +""" + +from __future__ import annotations + +import re +import unicodedata +from email.utils import parseaddr +from typing import Any + +try: + from zin_adk import zak_tool, ToolResult +except ImportError: + def zak_tool(*args, **kwargs): + def _decorator(fn): + return fn + return _decorator + + class ToolResult(dict): + @staticmethod + def ok(data: Any) -> "ToolResult": + return ToolResult({"status": "ok", "data": data}) + + @staticmethod + def error(msg: str) -> "ToolResult": + return ToolResult({"status": "error", "message": msg}) + + +# ─── Helpers ───────────────────────────────────────────────────────────────── + +_EMAIL_RE = re.compile(r"[\w.+\-]+@([\w.\-]+\.\w+)", re.IGNORECASE) + + +def _extract_domain(address: str) -> str: + """Extract bare domain from 'Display Name ' or 'user@domain.com'.""" + _, addr = parseaddr(address) + addr = addr.strip().lower() + m = _EMAIL_RE.search(addr) + return m.group(1) if m else "" + + +def _normalize(domain: str) -> str: + """ + Normalize a domain for safe comparison: + - lowercase + strip whitespace + - IDNA-decode internationalized domains (IDN) + - Remove leading/trailing dots + """ + domain = domain.strip().lower() + # Replace Unicode look-alike characters (Punycode) + try: + domain = domain.encode("idna").decode("ascii") + except (UnicodeError, UnicodeDecodeError): + # fall back to NFKD normalization + domain = unicodedata.normalize("NFKD", domain) + domain = domain.strip(".") + return domain + + +def _is_subdomain_of(candidate: str, parent: str) -> bool: + """Return True if *candidate* is a subdomain of *parent* (not equal).""" + candidate = _normalize(candidate) + parent = _normalize(parent) + return candidate != parent and candidate.endswith("." + parent) + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="normalize_domain", + description="Normalize a raw domain string: lowercase, strip, IDNA-decode.", +) +def normalize_domain(domain: str) -> ToolResult: + try: + normalized = _normalize(domain) + return ToolResult.ok({"original": domain, "normalized": normalized}) + except Exception as exc: + return ToolResult.error(f"normalize_domain failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="parse_email_headers", + description="Extract sender domain and key authentication fields from an email dict.", +) +def parse_email_headers(email_dict: dict) -> ToolResult: + """ + Parses the ingested email dict produced by ingest_email and returns + structured header fields needed for all downstream checks. + """ + try: + from_raw = email_dict.get("from", "") + return_path_raw = email_dict.get("return_path", "") + auth_results = email_dict.get("authentication_results", "") + received_spf = email_dict.get("received_spf", "") + dkim_sig = email_dict.get("dkim_signature", "") + + from_domain = _extract_domain(from_raw) + return_path_domain = _extract_domain(return_path_raw) + + _, display_name = parseaddr(from_raw) + display_name_part = from_raw.split("<")[0].strip().strip('"') + + parsed = { + "uid": email_dict.get("uid", ""), + "subject": email_dict.get("subject", ""), + "from_raw": from_raw, + "display_name": display_name_part, + "from_domain": _normalize(from_domain), + "return_path_domain": _normalize(return_path_domain) if return_path_domain else "", + "authentication_results_raw": auth_results, + "received_spf_raw": received_spf, + "dkim_signature_present": bool(dkim_sig), + "date": email_dict.get("date", ""), + "message_id": email_dict.get("message_id", ""), + } + return ToolResult.ok(parsed) + + except Exception as exc: + return ToolResult.error(f"parse_email_headers failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="verify_domain_whitelist", + description="Check whether the sender domain is in the approved whitelist.", +) +def verify_domain_whitelist( + from_domain: str, + whitelist_domains: list, +) -> ToolResult: + """ + Parameters + ---------- + from_domain : normalized sender domain + whitelist_domains : list of approved domains (e.g. ["company.com"]) + """ + try: + from_domain_norm = _normalize(from_domain) + normalized_whitelist = [_normalize(d) for d in whitelist_domains] + + in_whitelist = from_domain_norm in normalized_whitelist + # exact match only – subdomains require explicit listing + return ToolResult.ok({ + "from_domain": from_domain_norm, + "in_whitelist": in_whitelist, + "whitelist_size": len(normalized_whitelist), + }) + + except Exception as exc: + return ToolResult.error(f"verify_domain_whitelist failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="check_spf_alignment", + description="Parse Received-SPF / Authentication-Results for SPF pass/fail and domain alignment.", +) +def check_spf_alignment( + received_spf_raw: str, + authentication_results_raw: str, + from_domain: str, +) -> ToolResult: + """ + Returns spf_pass (bool) and spf_aligned (bool – does spf domain match from_domain). + """ + try: + combined = (received_spf_raw + " " + authentication_results_raw).lower() + + if "spf=" not in combined: + spf_pass = None + spf_fail = None + else: + spf_pass = bool(re.search(r"spf=pass", combined)) + spf_fail = bool(re.search(r"spf=(fail|softfail|neutral|none|permerror|temperror)", combined)) + + # Extract envelope-from / smtp.mailfrom domain from auth results + envelope_domain = "" + m = re.search(r"smtp\.mailfrom=([^\s;]+)", combined) + if m: + envelope_domain = _normalize(m.group(1).split("@")[-1]) + + spf_aligned = (_normalize(from_domain) == envelope_domain) if envelope_domain else None + + return ToolResult.ok({ + "spf_pass": spf_pass, + "spf_fail": spf_fail, + "spf_domain": envelope_domain, + "spf_aligned": spf_aligned, + "raw_snippet": combined[:200], + }) + + except Exception as exc: + return ToolResult.error(f"check_spf_alignment failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="check_dkim_alignment", + description="Parse Authentication-Results for DKIM pass/fail and domain alignment.", +) +def check_dkim_alignment( + authentication_results_raw: str, + from_domain: str, +) -> ToolResult: + try: + ar = authentication_results_raw.lower() + + if "dkim=" not in ar: + dkim_pass = None + dkim_fail = None + else: + dkim_pass = bool(re.search(r"dkim=pass", ar)) + dkim_fail = bool(re.search(r"dkim=(fail|none|neutral|policy|permerror|temperror)", ar)) + + # Extract signing domain (d= tag in auth results) + signing_domain = "" + m = re.search(r"header\.d=([^\s;]+)", ar) + if not m: + m = re.search(r"dkim=pass[^;]*?\bd=([^\s;]+)", ar) + if m: + signing_domain = _normalize(m.group(1)) + + dkim_aligned = ( + _normalize(from_domain) == signing_domain + or _is_subdomain_of(signing_domain, _normalize(from_domain)) + ) if signing_domain else None + + return ToolResult.ok({ + "dkim_pass": dkim_pass, + "dkim_fail": dkim_fail, + "dkim_signing_domain": signing_domain, + "dkim_aligned": dkim_aligned, + }) + + except Exception as exc: + return ToolResult.error(f"check_dkim_alignment failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="check_dmarc_alignment", + description="Parse Authentication-Results for DMARC policy outcome.", +) +def check_dmarc_alignment(authentication_results_raw: str) -> ToolResult: + try: + ar = authentication_results_raw.lower() + if "dmarc=" not in ar: + dmarc_pass = None + dmarc_fail = None + else: + dmarc_pass = bool(re.search(r"dmarc=pass", ar)) + dmarc_fail = bool(re.search(r"dmarc=(fail|none|bestguesspass|temperror|permerror)", ar)) + + policy = "" + m = re.search(r"dmarc=\w+\s+policy\.applied=(\w+)", ar) + if m: + policy = m.group(1) + + return ToolResult.ok({ + "dmarc_pass": dmarc_pass, + "dmarc_fail": dmarc_fail, + "dmarc_policy_applied": policy, + }) + + except Exception as exc: + return ToolResult.error(f"check_dmarc_alignment failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="detect_subdomain_spoof", + description=( + "Detect if sender domain is a confusable subdomain of a whitelisted domain " + "(e.g. evil.company.com spoofing company.com)." + ), +) +def detect_subdomain_spoof( + from_domain: str, + whitelist_domains: list, +) -> ToolResult: + try: + from_norm = _normalize(from_domain) + normalized_wl = [_normalize(d) for d in whitelist_domains] + + # Already exact match → not a subdomain spoof + if from_norm in normalized_wl: + return ToolResult.ok({"subdomain_spoof": False, "parent_domain": None}) + + for parent in normalized_wl: + if _is_subdomain_of(from_norm, parent): + return ToolResult.ok({ + "subdomain_spoof": True, + "parent_domain": parent, + "spoofing_domain": from_norm, + "note": ( + f"'{from_norm}' is a subdomain of whitelisted '{parent}' " + "but is NOT explicitly approved." + ), + }) + + return ToolResult.ok({"subdomain_spoof": False, "parent_domain": None}) + + except Exception as exc: + return ToolResult.error(f"detect_subdomain_spoof failed: {exc}") diff --git a/phising/tools/email_ingestion_tools.py b/phising/tools/email_ingestion_tools.py new file mode 100644 index 0000000..5b9c7c9 --- /dev/null +++ b/phising/tools/email_ingestion_tools.py @@ -0,0 +1,135 @@ +""" +Email Ingestion Module – DomainShield Agent +Supports IMAP, local .eml files, and in-memory raw RFC-2822 payloads. +""" + +from __future__ import annotations + +import email +import imaplib +import os +import ssl +from email.message import Message +from typing import Any + +# ── ZAK SDK shim (falls back gracefully when sdk not installed) ────────────── +try: + from zin_adk import zak_tool, ToolResult +except ImportError: # pragma: no cover + def zak_tool(*args, **kwargs): # type: ignore[return-value] + def _decorator(fn): + return fn + return _decorator + + class ToolResult(dict): # type: ignore[misc] + @staticmethod + def ok(data: Any) -> "ToolResult": + return ToolResult({"status": "ok", "data": data}) + + @staticmethod + def error(msg: str) -> "ToolResult": + return ToolResult({"status": "error", "message": msg}) + + +# ───────────────────────────────────────────────────────────────────────────── + +def _msg_to_dict(msg: Message, uid: str = "") -> dict: + """Convert email.message.Message → plain dict for downstream tools.""" + return { + "uid": uid, + "subject": msg.get("Subject", ""), + "from": msg.get("From", ""), + "to": msg.get("To", ""), + "return_path": msg.get("Return-Path", ""), + "date": msg.get("Date", ""), + "message_id": msg.get("Message-ID", ""), + "received_spf": msg.get("Received-SPF", ""), + "authentication_results": msg.get("Authentication-Results", ""), + "dkim_signature": msg.get("DKIM-Signature", ""), + "raw_headers": dict(msg.items()), + "body_preview": _body_preview(msg), + } + + +def _body_preview(msg: Message, max_chars: int = 300) -> str: + if msg.is_multipart(): + for part in msg.walk(): + if part.get_content_type() == "text/plain": + payload = part.get_payload(decode=True) + if payload: + return payload.decode(errors="replace")[:max_chars] + else: + payload = msg.get_payload(decode=True) + if payload: + return payload.decode(errors="replace")[:max_chars] + return "" + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="ingest_email", + description="Ingest emails from IMAP server, local .eml file, or raw RFC-2822 string.", +) +def ingest_email( + source: str, + imap_host: str = "", + imap_port: int = 993, + imap_user: str = "", + imap_password: str = "", + imap_folder: str = "INBOX", + max_emails: int = 100, + raw_eml: str = "", + eml_path: str = "", +) -> ToolResult: + """ + Parameters + ---------- + source : 'imap' | 'file' | 'raw' + imap_* : IMAP credentials (only for source='imap') + raw_eml : RFC-2822 string (only for source='raw') + eml_path : path to .eml (only for source='file') + max_emails : cap for IMAP fetch + """ + try: + emails: list[dict] = [] + + if source == "raw": + if not raw_eml: + return ToolResult.error("raw_eml must be provided when source='raw'") + msg = email.message_from_string(raw_eml) + emails.append(_msg_to_dict(msg, uid="raw-0")) + + elif source == "file": + if not eml_path or not os.path.exists(eml_path): + return ToolResult.error(f"eml_path not found: {eml_path!r}") + with open(eml_path, "rb") as fh: + msg = email.message_from_bytes(fh.read()) + emails.append(_msg_to_dict(msg, uid=os.path.basename(eml_path))) + + elif source == "imap": + if not all([imap_host, imap_user, imap_password]): + return ToolResult.error( + "imap_host, imap_user, imap_password are required for IMAP source" + ) + ctx = ssl.create_default_context() + with imaplib.IMAP4_SSL(imap_host, imap_port, ssl_context=ctx) as conn: + conn.login(imap_user, imap_password) + conn.select(imap_folder, readonly=True) + _, data = conn.search(None, "UNSEEN") + uids = data[0].split()[-max_emails:] + for uid in uids: + _, raw = conn.fetch(uid, "(RFC822)") + if raw and raw[0]: + raw_bytes: bytes = raw[0][1] # type: ignore[index] + msg = email.message_from_bytes(raw_bytes) + emails.append(_msg_to_dict(msg, uid=uid.decode())) + else: + return ToolResult.error(f"Unknown source type: {source!r}. Use 'imap', 'file', or 'raw'.") + + return ToolResult.ok({ + "ingested_count": len(emails), + "emails": emails, + }) + + except Exception as exc: # noqa: BLE001 + return ToolResult.error(f"Email ingestion failed: {exc}") diff --git a/phising/tools/logging_tools.py b/phising/tools/logging_tools.py new file mode 100644 index 0000000..f37bd9b --- /dev/null +++ b/phising/tools/logging_tools.py @@ -0,0 +1,198 @@ +""" +Logging & Audit Module – DomainShield Agent +Persists email processing events to a JSONL audit log and supports CSV export. +""" + +from __future__ import annotations + +import csv +import json +import os +from datetime import datetime, timezone +from typing import Any + +try: + from zin_adk import zak_tool, ToolResult +except ImportError: + def zak_tool(*args, **kwargs): + def _decorator(fn): + return fn + return _decorator + + class ToolResult(dict): + @staticmethod + def ok(data: Any) -> "ToolResult": + return ToolResult({"status": "ok", "data": data}) + + @staticmethod + def error(msg: str) -> "ToolResult": + return ToolResult({"status": "error", "message": msg}) + + +_DEFAULT_LOG_DIR = os.path.join(os.path.dirname(__file__), "..", "logs") + + +def _ensure_log_dir(log_dir: str) -> str: + path = os.path.abspath(log_dir) + os.makedirs(path, exist_ok=True) + return path + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="log_email_event", + description="Append a single email processing event to the JSONL audit log.", +) +def log_email_event( + email_uid: str, + subject: str, + from_raw: str, + from_domain: str, + risk_level: str, + action: str, + reasons: list, + alert_id: str = "", + log_dir: str = "", +) -> ToolResult: + try: + log_dir = _ensure_log_dir(log_dir or _DEFAULT_LOG_DIR) + log_file = os.path.join(log_dir, "audit.jsonl") + + record = { + "timestamp": datetime.now(timezone.utc).isoformat(), + "email_uid": email_uid, + "subject": subject, + "from_raw": from_raw, + "from_domain": from_domain, + "risk_level": risk_level, + "action": action, + "reasons": reasons, + "alert_id": alert_id, + } + + with open(log_file, "a", encoding="utf-8") as fh: + fh.write(json.dumps(record) + "\n") + + # Sync live data to the UI dashboard automatically + try: + records = [] + with open(log_file, "r", encoding="utf-8") as rf: + for line in rf: + line = line.strip() + if line: + records.append(json.loads(line)) + + js_emails_list = [] + for r in reversed(records[-100:]): + js_emails_list.append({ + "uid": r.get("email_uid"), + "from_raw": r.get("from_raw", ""), + "from_domain": r.get("from_domain", ""), + "display_name": r.get("from_raw", "").split("<")[0].strip().replace('"', ''), + "subject": r.get("subject", ""), + "date": r.get("timestamp", "")[:16].replace("T", " "), + "risk_level": r.get("risk_level", "SAFE"), + "action": r.get("action", "ALLOW"), + "reasons": r.get("reasons", []), + "flags": {}, + "spf_pass": "SPF" not in str(r.get("reasons", [])), + "dkim_pass": "DKIM" not in str(r.get("reasons", [])), + "dmarc_pass": "DMARC" not in str(r.get("reasons", [])), + "in_whitelist": "whitelist" not in str(r.get("reasons", [])).lower(), + "body_preview": "No preview available for security reasons." + }) + + ui_js_path = os.path.join(log_dir, "..", "ui", "data.js") + os.makedirs(os.path.dirname(ui_js_path), exist_ok=True) + with open(ui_js_path, "w", encoding="utf-8") as jsf: + jsf.write(f"window.LIVE_EMAILS = {json.dumps(js_emails_list, indent=2)};\n") + except Exception: + pass + + return ToolResult.ok({ + "logged": True, + "log_file": log_file, + "record": record, + }) + + except Exception as exc: + return ToolResult.error(f"log_email_event failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="export_audit_log", + description="Export the JSONL audit log to a CSV file for compliance review.", +) +def export_audit_log( + log_dir: str = "", + export_format: str = "csv", + filter_risk_level: str = "", +) -> ToolResult: + """ + Parameters + ---------- + filter_risk_level : '' (all) | 'SAFE' | 'MEDIUM_RISK' | 'HIGH_RISK' + export_format : 'csv' (future: 'json') + """ + try: + log_dir = _ensure_log_dir(log_dir or _DEFAULT_LOG_DIR) + log_file = os.path.join(log_dir, "audit.jsonl") + + if not os.path.exists(log_file): + return ToolResult.error(f"Audit log not found: {log_file}") + + records: list[dict] = [] + with open(log_file, "r", encoding="utf-8") as fh: + for line in fh: + line = line.strip() + if line: + try: + records.append(json.loads(line)) + except json.JSONDecodeError: + pass + + if filter_risk_level: + records = [r for r in records if r.get("risk_level") == filter_risk_level] + + if export_format == "csv": + export_path = os.path.join(log_dir, f"audit_export_{_ts_slug()}.csv") + _write_csv(records, export_path) + return ToolResult.ok({ + "exported": True, + "record_count": len(records), + "export_path": export_path, + "filter_applied": filter_risk_level or "none", + }) + + # default JSON return + return ToolResult.ok({ + "exported": False, + "records": records, + "record_count": len(records), + }) + + except Exception as exc: + return ToolResult.error(f"export_audit_log failed: {exc}") + + +def _ts_slug() -> str: + return datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S") + + +def _write_csv(records: list[dict], path: str) -> None: + if not records: + with open(path, "w", newline="", encoding="utf-8") as fh: + fh.write("No records found\n") + return + fieldnames = [ + "timestamp", "email_uid", "from_raw", "from_domain", + "subject", "risk_level", "action", "alert_id", "reasons", + ] + with open(path, "w", newline="", encoding="utf-8") as fh: + writer = csv.DictWriter(fh, fieldnames=fieldnames, extrasaction="ignore") + writer.writeheader() + for rec in records: + row = dict(rec) + row["reasons"] = " | ".join(rec.get("reasons", [])) + writer.writerow(row) diff --git a/phising/tools/phishing_detection_tools.py b/phising/tools/phishing_detection_tools.py new file mode 100644 index 0000000..f698d4b --- /dev/null +++ b/phising/tools/phishing_detection_tools.py @@ -0,0 +1,214 @@ +""" +Phishing Detection Engine – DomainShield Agent +Detects display-name spoofing and aggregates all signals into a final risk verdict. +""" + +from __future__ import annotations + +import re +import unicodedata +from difflib import SequenceMatcher +from typing import Any + +try: + from zin_adk import zak_tool, ToolResult +except ImportError: + def zak_tool(*args, **kwargs): + def _decorator(fn): + return fn + return _decorator + + class ToolResult(dict): + @staticmethod + def ok(data: Any) -> "ToolResult": + return ToolResult({"status": "ok", "data": data}) + + @staticmethod + def error(msg: str) -> "ToolResult": + return ToolResult({"status": "error", "message": msg}) + + +# ─── Helpers ───────────────────────────────────────────────────────────────── + +_TRUSTED_BRAND_ALIASES = [ + "microsoft", "google", "amazon", "apple", "paypal", "dropbox", + "linkedin", "facebook", "twitter", "netflix", "bank", "chase", + "wellsfargo", "citibank", "irs", "fedex", "ups", "dhl", +] + + +def _similarity(a: str, b: str) -> float: + return SequenceMatcher(None, a.lower(), b.lower()).ratio() + + +def _strip_to_alpha(s: str) -> str: + """Remove non-alpha chars for fuzzy comparison.""" + return re.sub(r"[^a-z0-9]", "", unicodedata.normalize("NFKD", s).lower()) + + +def _looks_like_trusted_entity(display_name: str, whitelist_domains: list[str]) -> dict: + """ + Returns whether the display name impersonates a whitelisted org or well-known brand. + """ + name_clean = _strip_to_alpha(display_name) + + # Check against whitelist org names (strip TLD) + for domain in whitelist_domains: + org = _strip_to_alpha(domain.split(".")[0]) + sim = _similarity(name_clean, org) + # Check both high similarity and simple substring inclusion (if org is non-trivial) + if sim >= 0.75 or (len(org) >= 4 and org in name_clean): + return {"impersonates": domain, "similarity": max(sim, 0.9)} + + # Check against known brand list + for brand in _TRUSTED_BRAND_ALIASES: + if brand in name_clean: + return {"impersonates": brand, "similarity": 1.0} + + return {} + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="detect_display_name_spoof", + description=( + "Detect if the email display name mimics a trusted entity " + "while the actual sender domain is different." + ), +) +def detect_display_name_spoof( + display_name: str, + from_domain: str, + whitelist_domains: list, +) -> ToolResult: + """ + A spoofed display name is one that: + 1. Closely resembles a whitelisted org name or well-known brand + 2. But the actual from_domain is NOT in the whitelist + """ + try: + impersonation = _looks_like_trusted_entity(display_name, list(whitelist_domains)) + + if not impersonation: + return ToolResult.ok({ + "display_name_spoof": False, + "display_name": display_name, + "from_domain": from_domain, + }) + + # If from_domain matches the impersonated entity, it's legitimate + impersonated = impersonation.get("impersonates", "") + domain_matches = ( + from_domain.endswith(impersonated) + or impersonated.endswith(from_domain.split(".")[0]) + ) + + spoof_detected = not domain_matches + + return ToolResult.ok({ + "display_name_spoof": spoof_detected, + "display_name": display_name, + "from_domain": from_domain, + "impersonates": impersonated, + "similarity_score": round(impersonation.get("similarity", 0), 3), + "reason": ( + f"Display name '{display_name}' resembles '{impersonated}' " + f"but sent from '{from_domain}'" + ) if spoof_detected else "", + }) + + except Exception as exc: + return ToolResult.error(f"detect_display_name_spoof failed: {exc}") + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="classify_phishing_risk", + description=( + "Aggregate all verification signals into a final risk level: " + "SAFE, MEDIUM_RISK, or HIGH_RISK." + ), +) +def classify_phishing_risk( + in_whitelist: bool, + spf_pass: bool, + spf_aligned: bool | None, + dkim_pass: bool, + dkim_aligned: bool | None, + dmarc_pass: bool, + display_name_spoof: bool, + subdomain_spoof: bool, + from_domain: str, + strict_mode: bool = True, +) -> ToolResult: + """ + Risk Classification Rules + ───────────────────────── + HIGH_RISK : spoofing detected OR authentication failures on otherwise whitelisted domain + MEDIUM_RISK: external domain not in whitelist (but no explicit spoofing) + SAFE : whitelist match + all auth checks pass (or unavailable) + """ + try: + reasons: list[str] = [] + flags: dict[str, bool] = {} + + # --- Spoofing signals (always HIGH) --- + if display_name_spoof: + reasons.append("Display name impersonates a trusted entity") + flags["display_name_spoof"] = True + + if subdomain_spoof: + reasons.append("Sender uses unauthorized subdomain of whitelisted domain") + flags["subdomain_spoof"] = True + + # --- Authentication failures --- + auth_fail = False + if spf_pass is False: # explicit fail (not missing) + reasons.append("SPF check failed") + auth_fail = True + if spf_aligned is False: + reasons.append("SPF domain misaligned with From header") + auth_fail = True + if dkim_pass is False: + reasons.append("DKIM check failed") + auth_fail = True + if dkim_aligned is False: + reasons.append("DKIM signing domain misaligned with From header") + auth_fail = True + if dmarc_pass is False: + reasons.append("DMARC check failed") + auth_fail = True + + # --- Whitelist miss --- + if not in_whitelist: + reasons.append(f"Sender domain '{from_domain}' is not in the approved whitelist") + + # ─── Final verdict ─── + if flags or (auth_fail and in_whitelist): + risk_level = "HIGH_RISK" + elif not in_whitelist or auth_fail: + risk_level = "MEDIUM_RISK" + else: + risk_level = "SAFE" + + action = "BLOCK" if (risk_level != "SAFE" and strict_mode) else ( + "WARN" if risk_level != "SAFE" else "ALLOW" + ) + + return ToolResult.ok({ + "risk_level": risk_level, + "action": action, + "reasons": reasons, + "flags": flags, + "in_whitelist": in_whitelist, + "auth_summary": { + "spf_pass": spf_pass, + "spf_aligned": spf_aligned, + "dkim_pass": dkim_pass, + "dkim_aligned": dkim_aligned, + "dmarc_pass": dmarc_pass, + }, + }) + + except Exception as exc: + return ToolResult.error(f"classify_phishing_risk failed: {exc}") diff --git a/phising/tools/policy_tools.py b/phising/tools/policy_tools.py new file mode 100644 index 0000000..fca371c --- /dev/null +++ b/phising/tools/policy_tools.py @@ -0,0 +1,136 @@ +""" +Admin Policy Controller – DomainShield Agent +Persists whitelist and agent config to a local JSON policy store. +""" + +from __future__ import annotations + +import json +import os +from datetime import datetime, timezone +from typing import Any + +try: + from zin_adk import zak_tool, ToolResult +except ImportError: + def zak_tool(*args, **kwargs): + def _decorator(fn): + return fn + return _decorator + + class ToolResult(dict): + @staticmethod + def ok(data: Any) -> "ToolResult": + return ToolResult({"status": "ok", "data": data}) + + @staticmethod + def error(msg: str) -> "ToolResult": + return ToolResult({"status": "error", "message": msg}) + + +_DEFAULT_POLICY_PATH = os.path.join( + os.path.dirname(__file__), "..", "config", "policy.json" +) + +_DEFAULT_POLICY: dict = { + "whitelist_domains": ["company.com", "trustedpartner.com"], + "strict_mode": True, + "alert_threshold": "medium_and_above", + "webhook_url": "", + "last_modified": "", + "modified_by": "system", +} + + +def _load_policy(policy_path: str) -> dict: + if os.path.exists(policy_path): + with open(policy_path, "r", encoding="utf-8") as fh: + return json.load(fh) + return dict(_DEFAULT_POLICY) + + +def _save_policy(policy: dict, policy_path: str) -> None: + os.makedirs(os.path.dirname(policy_path), exist_ok=True) + policy["last_modified"] = datetime.now(timezone.utc).isoformat() + with open(policy_path, "w", encoding="utf-8") as fh: + json.dump(policy, fh, indent=2) + + +# ───────────────────────────────────────────────────────────────────────────── +@zak_tool( + action_id="manage_whitelist", + description="Add, remove, or list domains in the approved whitelist policy store.", +) +def manage_whitelist( + operation: str, + domain: str = "", + policy_path: str = "", + modified_by: str = "admin", +) -> ToolResult: + """ + Parameters + ---------- + operation : 'add' | 'remove' | 'list' | 'set_strict_mode' | 'set_alert_threshold' + domain : domain to add/remove (or True/False for set_strict_mode, threshold value) + policy_path: override default config/policy.json path + """ + try: + path = os.path.abspath(policy_path or _DEFAULT_POLICY_PATH) + policy = _load_policy(path) + + if operation == "list": + return ToolResult.ok({ + "whitelist_domains": policy.get("whitelist_domains", []), + "strict_mode": policy.get("strict_mode", True), + "alert_threshold": policy.get("alert_threshold", "medium_and_above"), + "last_modified": policy.get("last_modified", ""), + }) + + elif operation == "add": + if not domain: + return ToolResult.error("domain is required for operation='add'") + normalized = domain.strip().lower() + wl: list = policy.setdefault("whitelist_domains", []) + if normalized in wl: + return ToolResult.ok({"message": f"'{normalized}' already in whitelist", "whitelist_domains": wl}) + wl.append(normalized) + policy["modified_by"] = modified_by + _save_policy(policy, path) + return ToolResult.ok({"added": normalized, "whitelist_domains": wl}) + + elif operation == "remove": + if not domain: + return ToolResult.error("domain is required for operation='remove'") + normalized = domain.strip().lower() + wl = policy.get("whitelist_domains", []) + if normalized not in wl: + return ToolResult.ok({"message": f"'{normalized}' not in whitelist", "whitelist_domains": wl}) + wl.remove(normalized) + policy["modified_by"] = modified_by + _save_policy(policy, path) + return ToolResult.ok({"removed": normalized, "whitelist_domains": wl}) + + elif operation == "set_strict_mode": + value = domain.strip().lower() in ("true", "1", "yes", "on") + policy["strict_mode"] = value + policy["modified_by"] = modified_by + _save_policy(policy, path) + return ToolResult.ok({"strict_mode": value}) + + elif operation == "set_alert_threshold": + valid = ("high_only", "medium_and_above", "all") + if domain not in valid: + return ToolResult.error(f"alert_threshold must be one of {valid}") + policy["alert_threshold"] = domain + policy["modified_by"] = modified_by + _save_policy(policy, path) + return ToolResult.ok({"alert_threshold": domain}) + + else: + return ToolResult.error( + f"Unknown operation '{operation}'. " + "Use: add | remove | list | set_strict_mode | set_alert_threshold" + ) + + except Exception as exc: + return ToolResult.error(f"manage_whitelist failed: {exc}") diff --git a/phising/ui/app.js b/phising/ui/app.js new file mode 100644 index 0000000..257d022 --- /dev/null +++ b/phising/ui/app.js @@ -0,0 +1,747 @@ +/* ═══════════════════════════════════════════════════════════ + DomainShield Agent – Dashboard Application Logic + ═══════════════════════════════════════════════════════════ */ + +'use strict'; + +// ══════════════════════════════════════════════════════════ +// 1. SAMPLE DATA (simulates agent output for the UI demo) +// ══════════════════════════════════════════════════════════ + +const SAMPLE_EMAILS = [ + { + uid: 'msg-001', + from_raw: '"Alice Johnson" ', + from_domain: 'company.com', + display_name: 'Alice Johnson', + subject: 'Q1 Financial Report – Final Draft', + date: '2026-04-12 09:14', + risk_level: 'SAFE', + action: 'ALLOW', + reasons: [], + flags: {}, + spf_pass: true, dkim_pass: true, dmarc_pass: true, + in_whitelist: true, + body_preview: 'Hi team, please find attached the final Q1 report for review before the board meeting.', + }, + { + uid: 'msg-002', + from_raw: '"IT Security Team" ', + from_domain: 'evil-company.net', + display_name: 'IT Security Team', + subject: '🚨 URGENT: Your account will be suspended – verify now', + date: '2026-04-12 09:31', + risk_level: 'HIGH_RISK', + action: 'BLOCK', + reasons: [ + "Display name 'IT Security Team' resembles 'company' but sent from 'evil-company.net'", + "SPF check failed", + "DKIM check failed", + "Sender domain 'evil-company.net' is not in the approved whitelist", + ], + flags: { display_name_spoof: true }, + spf_pass: false, dkim_pass: false, dmarc_pass: false, + in_whitelist: false, + body_preview: 'Your account has been flagged for suspicious activity. Click here immediately to verify your identity or your access will be revoked within 24 hours.', + }, + { + uid: 'msg-003', + from_raw: '"Trusted Partner" ', + from_domain: 'trustedpartner.com', + display_name: 'Trusted Partner', + subject: 'Invoice #INV-2026-0412 – Payment Confirmation', + date: '2026-04-12 10:02', + risk_level: 'SAFE', + action: 'ALLOW', + reasons: [], + flags: {}, + spf_pass: true, dkim_pass: true, dmarc_pass: true, + in_whitelist: true, + body_preview: 'Please find your payment confirmation for invoice INV-2026-0412 attached. Thank you for your continued partnership.', + }, + { + uid: 'msg-004', + from_raw: '"Newsletter" ', + from_domain: 'external-vendor.io', + display_name: 'Newsletter', + subject: 'April Product Updates & Announcements', + date: '2026-04-12 11:17', + risk_level: 'MEDIUM_RISK', + action: 'WARN', + reasons: ["Sender domain 'external-vendor.io' is not in the approved whitelist"], + flags: {}, + spf_pass: true, dkim_pass: true, dmarc_pass: true, + in_whitelist: false, + body_preview: 'Check out what is new in our April release: enhanced reporting, API improvements, and new integrations.', + }, + { + uid: 'msg-005', + from_raw: '"Microsoft Support" ', + from_domain: 'micros0ft-help.com', + display_name: 'Microsoft Support', + subject: 'Your Microsoft 365 subscription is expiring', + date: '2026-04-12 11:45', + risk_level: 'HIGH_RISK', + action: 'BLOCK', + reasons: [ + "Display name 'Microsoft Support' resembles known brand 'microsoft' but sent from 'micros0ft-help.com'", + "DMARC check failed", + "Sender domain 'micros0ft-help.com' is not in the approved whitelist", + ], + flags: { display_name_spoof: true }, + spf_pass: false, dkim_pass: false, dmarc_pass: false, + in_whitelist: false, + body_preview: 'Your subscription will expire in 3 days. To avoid service interruption, renew immediately at the link below.', + }, + { + uid: 'msg-006', + from_raw: '"Bob Smith" ', + from_domain: 'company.com', + display_name: 'Bob Smith', + subject: 'Team lunch next Friday?', + date: '2026-04-12 12:03', + risk_level: 'SAFE', + action: 'ALLOW', + reasons: [], + flags: {}, + spf_pass: true, dkim_pass: true, dmarc_pass: true, + in_whitelist: true, + body_preview: 'Hey everyone, are we still on for the team lunch next Friday at noon? Please RSVP by Thursday.', + }, + { + uid: 'msg-007', + from_raw: '"CEO" ', + from_domain: 'company.com', + display_name: 'CEO', + subject: 'Wire Transfer – Urgent Request', + date: '2026-04-12 13:22', + risk_level: 'HIGH_RISK', + action: 'BLOCK', + reasons: [ + "SPF check failed", + "DKIM check failed", + "DMARC check failed", + "Whitelisted domain 'company.com' with authentication failures — possible internal spoofing", + ], + flags: {}, + spf_pass: false, dkim_pass: false, dmarc_pass: false, + in_whitelist: true, + body_preview: 'I need you to process a wire transfer of $45,000 immediately to a new vendor. This is time-sensitive. Do not discuss with anyone else.', + }, + { + uid: 'msg-008', + from_raw: '"Phish" ', + from_domain: 'mail.evil.company.com', + display_name: 'Company Admin', + subject: 'Password Reset Required – Action Needed', + date: '2026-04-12 14:05', + risk_level: 'HIGH_RISK', + action: 'BLOCK', + reasons: [ + "Sender uses unauthorized subdomain of whitelisted domain (mail.evil.company.com of company.com)", + "SPF check failed", + "Sender domain 'mail.evil.company.com' is not in the approved whitelist", + ], + flags: { subdomain_spoof: true }, + spf_pass: false, dkim_pass: false, dmarc_pass: false, + in_whitelist: false, + body_preview: 'Your account password must be reset immediately due to a security policy update. Follow the link below to complete the process.', + }, +]; + +const WHITELIST = ['company.com', 'trustedpartner.com']; + +// ══════════════════════════════════════════════════════════ +// 2. STATE +// ══════════════════════════════════════════════════════════ + +let state = { + emails: window.LIVE_EMAILS ? window.LIVE_EMAILS : [...SAMPLE_EMAILS], + whitelist: window.LIVE_WHITELIST ? window.LIVE_WHITELIST : [...WHITELIST], + strictMode: window.LIVE_STRICT_MODE !== undefined ? window.LIVE_STRICT_MODE : true, + alertThreshold: 'medium_and_above', + showBlocked: true, + activeFilter: 'all', + searchQuery: '', + currentView: 'inbox', + scanning: false, +}; + +// ══════════════════════════════════════════════════════════ +// 3. INIT +// ══════════════════════════════════════════════════════════ + +document.addEventListener('DOMContentLoaded', () => { + updateStats(); + renderEmailList(); + renderBlockedList(); + renderWhitelist(); + renderLogs(); + renderAnalytics(); + updateBadges(); + + // Auto-sync config from the CLI if server is running + setInterval(() => { + if (window.location.protocol !== 'file:') { + fetch('/api/whitelist') + .then(r => r.json()) + .then(data => { + if (data.domains && JSON.stringify(data.domains) !== JSON.stringify(state.whitelist)) { + state.whitelist = data.domains; + renderWhitelist(); + } + }).catch(()=>{}); + } + }, 2000); +}); + +// ══════════════════════════════════════════════════════════ +// 4. VIEW NAVIGATION +// ══════════════════════════════════════════════════════════ + +const VIEW_META = { + inbox: { title: 'Inbox Monitor', sub: 'Zero-trust email visibility' }, + blocked: { title: 'Blocked / Flagged', sub: 'Emails intercepted by DomainShield policy' }, + policy: { title: 'Policy Manager', sub: 'Whitelist domains & agent configuration' }, + logs: { title: 'Audit Logs', sub: 'Complete email processing history' }, + analytics: { title: 'Analytics', sub: 'Detection signals & risk distribution' }, +}; + +function showView(name) { + document.querySelectorAll('.view').forEach(v => v.classList.add('hidden')); + document.querySelectorAll('.nav-item').forEach(n => n.classList.remove('active')); + + document.getElementById(`view-${name}`).classList.remove('hidden'); + document.getElementById(`nav-${name}`)?.classList.add('active'); + + const meta = VIEW_META[name] || {}; + document.getElementById('page-title').textContent = meta.title || name; + document.getElementById('page-sub').textContent = meta.sub || ''; + state.currentView = name; +} + +// ══════════════════════════════════════════════════════════ +// 5. STATS +// ══════════════════════════════════════════════════════════ + +function updateStats() { + const total = state.emails.length; + const safe = state.emails.filter(e => e.risk_level === 'SAFE').length; + const medium = state.emails.filter(e => e.risk_level === 'MEDIUM_RISK').length; + const high = state.emails.filter(e => e.risk_level === 'HIGH_RISK').length; + + animateCount('stat-total-val', total); + animateCount('stat-safe-val', safe); + animateCount('stat-medium-val', medium); + animateCount('stat-high-val', high); +} + +function animateCount(id, target) { + const el = document.getElementById(id); + if (!el) return; + const start = parseInt(el.textContent) || 0; + const duration = 600; + const startTime = performance.now(); + const step = (now) => { + const t = Math.min((now - startTime) / duration, 1); + el.textContent = Math.round(start + (target - start) * easeOut(t)); + if (t < 1) requestAnimationFrame(step); + }; + requestAnimationFrame(step); +} +function easeOut(t) { return 1 - Math.pow(1 - t, 3); } + +function updateBadges() { + const safe = state.emails.filter(e => e.risk_level === 'SAFE').length; + const bad = state.emails.filter(e => e.risk_level !== 'SAFE').length; + document.getElementById('badge-inbox').textContent = safe; + document.getElementById('badge-blocked').textContent = bad; +} + +// ══════════════════════════════════════════════════════════ +// 6. EMAIL LIST RENDERING +// ══════════════════════════════════════════════════════════ + +function getFilteredEmails() { + return state.emails.filter(email => { + if (!state.showBlocked && email.risk_level !== 'SAFE') return false; + if (state.activeFilter !== 'all' && email.risk_level !== state.activeFilter) return false; + if (state.searchQuery) { + const q = state.searchQuery.toLowerCase(); + return ( + email.from_raw.toLowerCase().includes(q) || + email.subject.toLowerCase().includes(q) || + email.from_domain.toLowerCase().includes(q) + ); + } + return true; + }); +} + +function renderEmailList() { + const list = document.getElementById('email-list'); + const emails = getFilteredEmails(); + list.innerHTML = emails.length ? emails.map(emailRowHTML).join('') : emptyStateHTML(); +} + +function renderBlockedList() { + const list = document.getElementById('blocked-list'); + const emails = state.emails.filter(e => e.risk_level !== 'SAFE'); + list.innerHTML = emails.length ? emails.map(emailRowHTML).join('') : emptyStateHTML('No blocked emails yet 🎉'); +} + +function emailRowHTML(email) { + const initials = email.display_name + ? email.display_name.split(' ').map(w => w[0]).join('').slice(0, 2).toUpperCase() + : email.from_domain[0].toUpperCase(); + + const avatarClass = { + SAFE: 'avatar-safe', MEDIUM_RISK: 'avatar-warn', HIGH_RISK: 'avatar-danger', + }[email.risk_level] || 'avatar-safe'; + + const bannerHTML = email.risk_level !== 'SAFE' + ? `
+ ${email.risk_level === 'HIGH_RISK' ? '🔴' : '⚠️'} + ${email.reasons[0] || 'Flagged by DomainShield policy'} +
` + : ''; + + return ` + `; +} + +function emptyStateHTML(msg = 'No emails match your filters') { + return `
📭

${msg}

`; +} + +function riskLabel(level) { + return { SAFE: '✅ Safe', MEDIUM_RISK: '⚠️ Medium', HIGH_RISK: '🔴 High Risk' }[level] || level; +} + +function actionColor(action) { + return { ALLOW: 'safe', WARN: 'warn', BLOCK: 'danger' }[action] || 'text3'; +} + +// ══════════════════════════════════════════════════════════ +// 7. EMAIL DETAIL MODAL +// ══════════════════════════════════════════════════════════ + +function openEmailDetail(uid) { + const email = state.emails.find(e => e.uid === uid); + if (!email) return; + + const authSummary = [ + email.spf_pass ? '✅ SPF' : '❌ SPF', + email.dkim_pass ? '✅ DKIM' : '❌ DKIM', + email.dmarc_pass? '✅ DMARC': '❌ DMARC', + ].join('   '); + + const reasonsHTML = email.reasons.length + ? email.reasons.map(r => `
⚠️ ${escHtml(r)}
`).join('') + : '
✅ No issues detected
'; + + const flagsHTML = Object.keys(email.flags).length + ? Object.entries(email.flags) + .filter(([,v]) => v) + .map(([k]) => `${k.replace(/_/g,' ')}`) + .join(' ') + : 'None'; + + document.getElementById('modal-content').innerHTML = ` +
+ ${riskLabel(email.risk_level)} + Email Detail +
+ +
+
From
+
${escHtml(email.from_raw)}
+
+
+
Subject
+
${escHtml(email.subject)}
+
+
+
Sender Domain
+
${escHtml(email.from_domain)} +  ${email.in_whitelist + ? '✅ Whitelisted' + : '🚫 Not whitelisted'} +
+
+
+
Authentication
+
${authSummary}
+
+
+
Active Flags
+
${flagsHTML}
+
+
+
Flagging Reasons
+
${reasonsHTML}
+
+
+
Body Preview
+
${escHtml(email.body_preview || '—')}
+
+
+
Action
+
${email.action}
+
+ `; + + document.getElementById('modal-backdrop').classList.remove('hidden'); +} + +function closeModal() { + document.getElementById('modal-backdrop').classList.add('hidden'); +} + +// ══════════════════════════════════════════════════════════ +// 8. FILTERS & SEARCH +// ══════════════════════════════════════════════════════════ + +function setFilter(filter, chip) { + state.activeFilter = filter; + document.querySelectorAll('.chip').forEach(c => c.classList.remove('active')); + chip.classList.add('active'); + renderEmailList(); +} + +function filterEmails() { + state.searchQuery = document.getElementById('search-box').value; + renderEmailList(); +} + +function toggleShowBlocked() { + state.showBlocked = !state.showBlocked; + const btn = document.getElementById('toggle-blocked-btn'); + btn.textContent = state.showBlocked ? '👁 Hide Suspicious' : '👁 Show Suspicious'; + renderEmailList(); +} + +// ══════════════════════════════════════════════════════════ +// 9. SCAN SIMULATION +// ══════════════════════════════════════════════════════════ + +const NEW_EMAILS = [ + { + uid: `msg-new-${Date.now()}`, + from_raw: '"Marketing" ', + from_domain: 'promo-deals.xyz', + display_name: 'Marketing', + subject: 'You have been selected for a special offer!', + date: new Date().toISOString().slice(0,16).replace('T',' '), + risk_level: 'MEDIUM_RISK', + action: 'WARN', + reasons: ["Sender domain 'promo-deals.xyz' is not in the approved whitelist"], + flags: {}, + spf_pass: true, dkim_pass: false, dmarc_pass: false, + in_whitelist: false, + body_preview: 'Congratulations! You have been selected to receive an exclusive deal. Limited time offer...', + }, +]; + +function runScan() { + if (state.scanning) return; + state.scanning = true; + + const btn = document.querySelector('.btn-primary'); + btn.textContent = '⟳ Scanning…'; + btn.classList.add('scanning'); + + setTimeout(() => { + // Add new email + const email = { ...NEW_EMAILS[0], uid: `msg-new-${Date.now()}`, date: new Date().toISOString().slice(0,16).replace('T',' ') }; + state.emails.unshift(email); + + btn.textContent = '⚡ Scan Now'; + btn.classList.remove('scanning'); + state.scanning = false; + + updateStats(); + renderEmailList(); + renderBlockedList(); + renderLogs(); + renderAnalytics(); + updateBadges(); + + toast(`Scan complete — ${state.emails.length} emails processed, ${state.emails.filter(e=>e.risk_level!=='SAFE').length} flagged.`, 'warning'); + }, 2000); +} + +// ══════════════════════════════════════════════════════════ +// 10. POLICY MANAGEMENT +// ══════════════════════════════════════════════════════════ + +function renderWhitelist() { + const list = document.getElementById('whitelist-list'); + document.getElementById('wl-count').textContent = `${state.whitelist.length} domains`; + list.innerHTML = state.whitelist.map(d => ` +
+ ✅ ${escHtml(d)} + +
+ `).join(''); +} + +function addDomain() { + const input = document.getElementById('new-domain-input'); + const domains = input.value.split(',').map(d => d.trim().toLowerCase()).filter(d => d); + if (!domains.length) return; + + const toAdd = domains.filter(d => !state.whitelist.includes(d)); + const toRemove = domains.filter(d => state.whitelist.includes(d)); + + if (window.location.protocol === 'file:') { + if (toAdd.length) toast(`✅ Added temporarily. Save via CLI!`, 'warning'); + if (toRemove.length) toast(`🚫 Removed temporarily. Save via CLI!`, 'warning'); + } else { + if (toAdd.length) { + fetch('/api/whitelist/add', { method: 'POST', body: JSON.stringify({domain: toAdd.join(',')}), headers: {'Content-Type': 'application/json'} }).catch(()=>{}); + toast(`✅ Added permanently!`, 'success'); + } + if (toRemove.length) { + fetch('/api/whitelist/remove', { method: 'POST', body: JSON.stringify({domain: toRemove.join(',')}), headers: {'Content-Type': 'application/json'} }).catch(()=>{}); + toast(`🚫 Removed permanently!`, 'warning'); + } + } + + toAdd.forEach(d => { if (!state.whitelist.includes(d)) state.whitelist.push(d); }); + toRemove.forEach(d => { state.whitelist = state.whitelist.filter(existing => existing !== d); }); + + input.value = ''; + renderWhitelist(); + + // Visually Re-classify emails immediately + state.emails = state.emails.map(e => { + if (toAdd.includes(e.from_domain)) return { ...e, risk_level: 'SAFE', action: 'ALLOW', reasons: [], in_whitelist: true }; + if (toRemove.includes(e.from_domain)) return { ...e, risk_level: 'MEDIUM_RISK', action: 'WARN', reasons: ['Sender domain is not in the approved whitelist'], in_whitelist: false }; + return e; + }); + + updateStats(); renderEmailList(); renderBlockedList(); updateBadges(); renderAnalytics(); +} + +function removeDomain(domain) { + state.whitelist = state.whitelist.filter(d => d !== domain); + renderWhitelist(); + if (window.location.protocol === 'file:') { + toast(`🚫 '${domain}' removed temporarily. Run easy_start.py menu to save permanently!`, 'warning'); + } else { + fetch('/api/whitelist/remove', { method: 'POST', body: JSON.stringify({domain}), headers: {'Content-Type': 'application/json'} }).catch(()=>{}); + toast(`🚫 '${domain}' permanently removed!`, 'success'); + } + + // Visually Re-classify emails immediately + state.emails = state.emails.map(e => { + if (e.from_domain === domain) return { ...e, risk_level: 'MEDIUM_RISK', action: 'WARN', reasons: ['Sender domain is not in the approved whitelist'], in_whitelist: false }; + return e; + }); + + updateStats(); renderEmailList(); renderBlockedList(); updateBadges(); renderAnalytics(); +} + +function toggleStrictMode(checkbox) { + state.strictMode = checkbox.checked; + document.getElementById('policy-strict').checked = checkbox.checked; + toast(`Strict mode ${checkbox.checked ? 'enabled 🔒' : 'disabled ⚠️'}`, checkbox.checked ? 'success' : 'warning'); + + // Update actions + state.emails = state.emails.map(e => + e.risk_level !== 'SAFE' + ? { ...e, action: checkbox.checked ? 'BLOCK' : 'WARN' } + : e + ); + renderEmailList(); renderBlockedList(); +} + +function updateSetting(key, value) { + if (key === 'strict_mode') { + state.strictMode = value; + document.getElementById('strict-mode-toggle').checked = value; + toggleStrictMode({ checked: value }); + } else if (key === 'alert_threshold') { + state.alertThreshold = value; + toast(`Alert threshold set to: ${value}`, 'success'); + } +} + +// ══════════════════════════════════════════════════════════ +// 11. AUDIT LOG +// ══════════════════════════════════════════════════════════ + +function renderLogs() { + const tbody = document.getElementById('log-body'); + tbody.innerHTML = state.emails.map(e => ` + + ${e.date} + ${e.uid} + ${escHtml(e.display_name || e.from_domain)} + ${escHtml(e.from_domain)} + ${escHtml(e.subject.slice(0, 50))}${e.subject.length > 50 ? '…' : ''} + ${riskLabel(e.risk_level)} + ${e.action} + ${e.reasons[0] ? escHtml(e.reasons[0].slice(0,60)) + '…' : '—'} + + `).join(''); +} + +function exportCSV() { + const headers = ['Timestamp','UID','From Domain','Subject','Risk Level','Action','Reasons']; + const rows = state.emails.map(e => [ + e.date, e.uid, e.from_domain, + `"${e.subject.replace(/"/g,'""')}"`, + e.risk_level, e.action, + `"${e.reasons.join(' | ').replace(/"/g,'""')}"`, + ]); + const csv = [headers, ...rows].map(r => r.join(',')).join('\n'); + const blob = new Blob([csv], { type: 'text/csv' }); + const url = URL.createObjectURL(blob); + const a = Object.assign(document.createElement('a'), { + href: url, download: `domainshield_audit_${new Date().toISOString().slice(0,10)}.csv` + }); + a.click(); + URL.revokeObjectURL(url); + toast('✅ Audit log exported as CSV', 'success'); +} + +// ══════════════════════════════════════════════════════════ +// 12. ANALYTICS +// ══════════════════════════════════════════════════════════ + +function renderAnalytics() { + renderDonut(); + renderBarList(); + renderSignalGrid(); +} + +function renderDonut() { + const total = state.emails.length || 1; + const counts = { + SAFE: state.emails.filter(e => e.risk_level === 'SAFE').length, + MEDIUM_RISK: state.emails.filter(e => e.risk_level === 'MEDIUM_RISK').length, + HIGH_RISK: state.emails.filter(e => e.risk_level === 'HIGH_RISK').length, + }; + const colors = { SAFE: '#10b981', MEDIUM_RISK: '#f59e0b', HIGH_RISK: '#ef4444' }; + const labels = { SAFE: 'Safe', MEDIUM_RISK: 'Medium Risk', HIGH_RISK: 'High Risk' }; + + const r = 42, cx = 60, cy = 60; + const circumference = 2 * Math.PI * r; + let offset = 0; + let segments = ''; + + for (const [key, count] of Object.entries(counts)) { + const pct = count / total; + const dash = pct * circumference; + segments += ``; + offset += dash; + } + + const pct = Math.round((counts.SAFE / total) * 100); + segments += `${pct}% + safe`; + + document.getElementById('donut-svg').innerHTML = segments; + + document.getElementById('donut-legend').innerHTML = Object.entries(counts).map(([key, count]) => ` +
+
+ ${labels[key]} + ${count} +
+ `).join(''); +} + +function renderBarList() { + const blocked = state.emails.filter(e => e.risk_level !== 'SAFE'); + const domainCounts = {}; + blocked.forEach(e => { domainCounts[e.from_domain] = (domainCounts[e.from_domain] || 0) + 1; }); + const sorted = Object.entries(domainCounts).sort((a,b) => b[1]-a[1]).slice(0, 5); + const maxVal = sorted[0]?.[1] || 1; + + document.getElementById('bar-list').innerHTML = sorted.length + ? sorted.map(([domain, count]) => ` +
+
+ ${escHtml(domain)} + ${count} +
+
+
+
+
+ `).join('') + : '

No blocked domains yet.

'; +} + +function renderSignalGrid() { + const signals = [ + { icon: '🚫', label: 'Whitelist Misses', count: state.emails.filter(e => !e.in_whitelist).length, color: 'var(--danger)' }, + { icon: '🎭', label: 'Display Name Spoof', count: state.emails.filter(e => e.flags?.display_name_spoof).length, color: 'var(--warn)' }, + { icon: '🌐', label: 'Subdomain Spoof', count: state.emails.filter(e => e.flags?.subdomain_spoof).length, color: 'var(--warn)' }, + { icon: '🔐', label: 'Auth Failures', count: state.emails.filter(e => !e.spf_pass || !e.dkim_pass || !e.dmarc_pass).length, color: 'var(--danger)' }, + { icon: '✅', label: 'SPF Pass', count: state.emails.filter(e => e.spf_pass).length, color: 'var(--safe)' }, + { icon: '✅', label: 'DKIM Pass', count: state.emails.filter(e => e.dkim_pass).length, color: 'var(--safe)' }, + { icon: '✅', label: 'DMARC Pass', count: state.emails.filter(e => e.dmarc_pass).length, color: 'var(--safe)' }, + { icon: '📋', label: 'Total Scanned', count: state.emails.length, color: 'var(--accent2)' }, + ]; + + document.getElementById('signal-grid').innerHTML = signals.map(s => ` +
+
${s.icon}
+
${s.count}
+
${s.label}
+
+ `).join(''); +} + +// ══════════════════════════════════════════════════════════ +// 13. TOAST +// ══════════════════════════════════════════════════════════ + +function toast(message, type = 'success') { + const container = document.getElementById('toast-container'); + const el = document.createElement('div'); + el.className = `toast ${type}`; + el.textContent = message; + container.appendChild(el); + setTimeout(() => { el.style.opacity = '0'; el.style.transition = 'opacity .3s'; setTimeout(() => el.remove(), 300); }, 3500); +} + +// ══════════════════════════════════════════════════════════ +// 14. UTILS +// ══════════════════════════════════════════════════════════ + +function escHtml(str) { + return String(str) + .replace(/&/g,'&') + .replace(//g,'>') + .replace(/"/g,'"'); +} diff --git a/phising/ui/config.js b/phising/ui/config.js new file mode 100644 index 0000000..0160f0a --- /dev/null +++ b/phising/ui/config.js @@ -0,0 +1,2 @@ +window.LIVE_WHITELIST = ["deltajohnsons.com", "minitts.net"]; +window.LIVE_STRICT_MODE = false; diff --git a/phising/ui/data.js b/phising/ui/data.js new file mode 100644 index 0000000..7269f5e --- /dev/null +++ b/phising/ui/data.js @@ -0,0 +1,218 @@ +window.LIVE_EMAILS = [ + { + "uid": "raw-0", + "from_raw": "uqlc26re39@wnbaldwy.com ", + "from_domain": "wnbaldwy.com", + "display_name": "uqlc26re39@wnbaldwy.com", + "subject": "old domain", + "date": "2026-04-16 09:33", + "risk_level": "MEDIUM_RISK", + "action": "WARN", + "reasons": [ + "Sender domain 'wnbaldwy.com' is not in the approved whitelist" + ], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": false, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "mtdex34575@minitts.net ", + "from_domain": "minitts.net", + "display_name": "mtdex34575@minitts.net", + "subject": "new mail", + "date": "2026-04-16 09:32", + "risk_level": "SAFE", + "action": "ALLOW", + "reasons": [], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": true, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "ipahjbmeagiachctmq@vtmpj.com ", + "from_domain": "vtmpj.com", + "display_name": "ipahjbmeagiachctmq@vtmpj.com", + "subject": "new mail", + "date": "2026-04-16 09:29", + "risk_level": "MEDIUM_RISK", + "action": "WARN", + "reasons": [ + "Sender domain 'vtmpj.com' is not in the approved whitelist" + ], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": false, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "uqlc26re39@wnbaldwy.com ", + "from_domain": "wnbaldwy.com", + "display_name": "uqlc26re39@wnbaldwy.com", + "subject": "email", + "date": "2026-04-16 09:28", + "risk_level": "SAFE", + "action": "ALLOW", + "reasons": [], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": true, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "uqlc26re39@wnbaldwy.com ", + "from_domain": "wnbaldwy.com", + "display_name": "uqlc26re39@wnbaldwy.com", + "subject": "old email", + "date": "2026-04-16 07:19", + "risk_level": "SAFE", + "action": "ALLOW", + "reasons": [], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": true, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "mohoki4634@tatefarm.com ", + "from_domain": "tatefarm.com", + "display_name": "mohoki4634@tatefarm.com", + "subject": "new email", + "date": "2026-04-16 07:17", + "risk_level": "MEDIUM_RISK", + "action": "WARN", + "reasons": [ + "Sender domain 'tatefarm.com' is not in the approved whitelist" + ], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": false, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "Orcella.Zarrella@AllWebEmails.com ", + "from_domain": "allwebemails.com", + "display_name": "Orcella.Zarrella@AllWebEmails.com", + "subject": "new", + "date": "2026-04-15 14:21", + "risk_level": "SAFE", + "action": "ALLOW", + "reasons": [], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": true, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "mohoki4634@tatefarm.com ", + "from_domain": "tatefarm.com", + "display_name": "mohoki4634@tatefarm.com", + "subject": "hie", + "date": "2026-04-15 14:20", + "risk_level": "MEDIUM_RISK", + "action": "WARN", + "reasons": [ + "Sender domain 'tatefarm.com' is not in the approved whitelist" + ], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": false, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "ocqjk81546@minitts.net ", + "from_domain": "minitts.net", + "display_name": "ocqjk81546@minitts.net", + "subject": "oldone", + "date": "2026-04-12 13:42", + "risk_level": "MEDIUM_RISK", + "action": "WARN", + "reasons": [ + "Sender domain 'minitts.net' is not in the approved whitelist" + ], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": false, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "ocqjk81546@minitts.net ", + "from_domain": "minitts.net", + "display_name": "ocqjk81546@minitts.net", + "subject": "newone", + "date": "2026-04-12 13:41", + "risk_level": "SAFE", + "action": "ALLOW", + "reasons": [], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": true, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "uncomfortable836@deltajohnsons.com ", + "from_domain": "deltajohnsons.com", + "display_name": "uncomfortable836@deltajohnsons.com", + "subject": "newone", + "date": "2026-04-12 13:37", + "risk_level": "SAFE", + "action": "ALLOW", + "reasons": [], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": true, + "body_preview": "No preview available for security reasons." + }, + { + "uid": "raw-0", + "from_raw": "fodyhywy@denipl.com ", + "from_domain": "denipl.com", + "display_name": "fodyhywy@denipl.com", + "subject": "GT VS LSG", + "date": "2026-04-12 13:34", + "risk_level": "MEDIUM_RISK", + "action": "WARN", + "reasons": [ + "Sender domain 'denipl.com' is not in the approved whitelist" + ], + "flags": {}, + "spf_pass": true, + "dkim_pass": true, + "dmarc_pass": true, + "in_whitelist": false, + "body_preview": "No preview available for security reasons." + } +]; diff --git a/phising/ui/index.html b/phising/ui/index.html new file mode 100644 index 0000000..edea79e --- /dev/null +++ b/phising/ui/index.html @@ -0,0 +1,243 @@ + + + + + + DomainShield Agent – Phishing Detection Dashboard + + + + + + + + + + + +
+ + +
+
+

Inbox Monitor

+ Zero-trust email visibility +
+
+ + +
+ Strict Mode + +
+
+
+ + +
+
+
📨
+
0
+
Total Processed
+
+
+
✅
+
0
+
Safe Emails
+
+
+
⚠️
+
0
+
Medium Risk
+
+
+
🔴
+
0
+
High Risk / Blocked
+
+
+ + +
+
+ +
+ + + + +
+
+ +
+ + + + + + + + + + + + + +
+ + + + + +
+ + + + + + diff --git a/phising/ui/style.css b/phising/ui/style.css new file mode 100644 index 0000000..f2be9a0 --- /dev/null +++ b/phising/ui/style.css @@ -0,0 +1,671 @@ +/* ════════════════════════════════════════════════════════ + DomainShield Agent – Dashboard Styles + ════════════════════════════════════════════════════════ */ + +*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; } + +:root { + --bg: #0d0f14; + --bg2: #13161f; + --bg3: #1a1e2a; + --border: rgba(255,255,255,.07); + --border2: rgba(255,255,255,.12); + --text: #e8eaf0; + --text2: #8b90a4; + --text3: #5a5f72; + + --safe: #10b981; + --safe-bg: rgba(16,185,129,.10); + --warn: #f59e0b; + --warn-bg: rgba(245,158,11,.10); + --danger: #ef4444; + --danger-bg: rgba(239,68,68,.10); + --info: #6366f1; + --info-bg: rgba(99,102,241,.10); + + --accent: #6366f1; + --accent2: #818cf8; + --glow: rgba(99,102,241,.25); + + --sidebar-w: 240px; + --radius: 12px; + --radius-sm: 8px; + --transition: .2s cubic-bezier(.4,0,.2,1); +} + +/* ── Base ── */ +html, body { height: 100%; } +body { + font-family: 'Inter', sans-serif; + background: var(--bg); + color: var(--text); + display: flex; + min-height: 100vh; + overflow: hidden; +} + +/* ════ SIDEBAR ════ */ +.sidebar { + width: var(--sidebar-w); + min-height: 100vh; + background: var(--bg2); + border-right: 1px solid var(--border); + display: flex; + flex-direction: column; + flex-shrink: 0; + position: fixed; + top: 0; left: 0; bottom: 0; + z-index: 100; +} + +.sidebar-logo { + display: flex; + align-items: center; + gap: 10px; + padding: 22px 20px 20px; + border-bottom: 1px solid var(--border); +} +.logo-icon { font-size: 28px; line-height: 1; } +.logo-title { display: block; font-size: 15px; font-weight: 700; color: var(--text); } +.logo-sub { display: block; font-size: 11px; color: var(--text3); margin-top: 1px; } + +.sidebar-nav { + flex: 1; + padding: 16px 12px; + display: flex; + flex-direction: column; + gap: 4px; +} + +.nav-item { + display: flex; + align-items: center; + gap: 10px; + padding: 10px 12px; + border-radius: var(--radius-sm); + border: none; + background: transparent; + color: var(--text2); + font-size: 13.5px; + font-weight: 500; + cursor: pointer; + transition: var(--transition); + text-align: left; + width: 100%; + position: relative; +} +.nav-item:hover { background: var(--bg3); color: var(--text); } +.nav-item.active { background: var(--info-bg); color: var(--accent2); } +.nav-item.active::before { + content: ''; + position: absolute; + left: 0; top: 6px; bottom: 6px; + width: 3px; + border-radius: 0 3px 3px 0; + background: var(--accent); +} +.nav-icon { font-size: 16px; } +.nav-badge { + margin-left: auto; + font-size: 11px; + font-weight: 600; + background: var(--bg3); + color: var(--text2); + border-radius: 20px; + padding: 1px 7px; + min-width: 22px; + text-align: center; +} +.nav-badge.danger { background: var(--danger-bg); color: var(--danger); } + +.sidebar-status { + display: flex; + align-items: center; + gap: 8px; + padding: 16px 20px; + border-top: 1px solid var(--border); + font-size: 12px; + color: var(--text3); +} +.status-dot { + width: 8px; height: 8px; + border-radius: 50%; + background: var(--text3); +} +.status-dot.active { + background: var(--safe); + box-shadow: 0 0 8px var(--safe); + animation: pulse 2s infinite; +} +@keyframes pulse { + 0%,100% { opacity: 1; } + 50% { opacity: .5; } +} + +/* ════ MAIN ════ */ +.main { + margin-left: var(--sidebar-w); + flex: 1; + display: flex; + flex-direction: column; + overflow-y: auto; + height: 100vh; + padding: 0 28px 40px; +} + +/* ── Topbar ── */ +.topbar { + display: flex; + align-items: center; + justify-content: space-between; + padding: 22px 0 18px; + border-bottom: 1px solid var(--border); + position: sticky; + top: 0; + background: var(--bg); + z-index: 50; +} +.page-title { font-size: 20px; font-weight: 700; color: var(--text); } +.page-sub { font-size: 12px; color: var(--text3); display: block; margin-top: 2px; } +.topbar-right { display: flex; align-items: center; gap: 12px; } + +/* ── Buttons ── */ +.btn { + display: inline-flex; + align-items: center; + gap: 6px; + padding: 8px 16px; + border-radius: var(--radius-sm); + border: none; + font-size: 13px; + font-weight: 600; + cursor: pointer; + transition: var(--transition); + font-family: inherit; +} +.btn-primary { + background: var(--accent); + color: #fff; + box-shadow: 0 0 18px var(--glow); +} +.btn-primary:hover { background: var(--accent2); transform: translateY(-1px); } +.btn-ghost { + background: var(--bg3); + color: var(--text2); + border: 1px solid var(--border2); +} +.btn-ghost:hover { color: var(--text); border-color: var(--border2); } +.btn.small { padding: 6px 12px; font-size: 12px; } + +/* ── Strict toggle ── */ +.strict-toggle { display: flex; align-items: center; gap: 8px; } +.strict-label { font-size: 12px; font-weight: 500; color: var(--text2); } +.toggle-switch { position: relative; display: inline-block; width: 38px; height: 22px; } +.toggle-switch input { display: none; } +.toggle-slider { + position: absolute; inset: 0; + background: var(--bg3); + border-radius: 20px; + cursor: pointer; + border: 1px solid var(--border2); + transition: var(--transition); +} +.toggle-slider::before { + content: ''; + position: absolute; + left: 3px; top: 3px; + width: 14px; height: 14px; + background: var(--text3); + border-radius: 50%; + transition: var(--transition); +} +.toggle-switch input:checked + .toggle-slider { background: var(--accent); border-color: var(--accent); } +.toggle-switch input:checked + .toggle-slider::before { transform: translateX(16px); background: #fff; } + +/* ════ STATS ROW ════ */ +.stats-row { + display: grid; + grid-template-columns: repeat(4, 1fr); + gap: 16px; + margin: 22px 0; +} +.stat-card { + background: var(--bg2); + border: 1px solid var(--border); + border-radius: var(--radius); + padding: 18px 20px; + display: flex; + flex-direction: column; + gap: 6px; + position: relative; + overflow: hidden; + transition: var(--transition); +} +.stat-card::before { + content: ''; + position: absolute; + top: 0; left: 0; right: 0; + height: 2px; + background: var(--text3); + border-radius: var(--radius) var(--radius) 0 0; +} +.stat-card.safe::before { background: var(--safe); } +.stat-card.warn::before { background: var(--warn); } +.stat-card.danger::before { background: var(--danger); } +.stat-card:hover { transform: translateY(-2px); border-color: var(--border2); } +.stat-icon { font-size: 22px; } +.stat-value { font-size: 32px; font-weight: 800; color: var(--text); font-variant-numeric: tabular-nums; } +.stat-label { font-size: 12px; color: var(--text3); font-weight: 500; } + +/* ════ VIEWS ════ */ +.view { flex: 1; } +.view.hidden { display: none; } + +/* ── Inbox toolbar ── */ +.inbox-toolbar { display: flex; align-items: center; gap: 12px; margin-bottom: 16px; } +.search-box { + flex: 1; + background: var(--bg2); + border: 1px solid var(--border); + border-radius: var(--radius-sm); + padding: 9px 14px; + color: var(--text); + font-size: 13px; + font-family: inherit; + outline: none; + transition: var(--transition); +} +.search-box:focus { border-color: var(--accent); box-shadow: 0 0 0 3px var(--glow); } +.search-box::placeholder { color: var(--text3); } +.filter-chips { display: flex; gap: 6px; } +.chip { + padding: 6px 12px; + border-radius: 20px; + border: 1px solid var(--border); + background: var(--bg2); + color: var(--text2); + font-size: 12px; + font-weight: 500; + cursor: pointer; + font-family: inherit; + transition: var(--transition); +} +.chip:hover { border-color: var(--accent); color: var(--accent2); } +.chip.active { background: var(--info-bg); color: var(--accent2); border-color: var(--accent); } + +/* ════ EMAIL LIST ════ */ +.email-list { display: flex; flex-direction: column; gap: 8px; } + +.email-row { + background: var(--bg2); + border: 1px solid var(--border); + border-radius: var(--radius); + padding: 14px 18px; + display: grid; + grid-template-columns: 36px 1fr auto; + align-items: center; + gap: 14px; + cursor: pointer; + transition: var(--transition); + position: relative; + overflow: hidden; +} +.email-row::before { + content: ''; + position: absolute; + left: 0; top: 0; bottom: 0; + width: 3px; + background: var(--text3); +} +.email-row.SAFE::before { background: var(--safe); } +.email-row.MEDIUM_RISK::before { background: var(--warn); } +.email-row.HIGH_RISK::before { background: var(--danger); } +.email-row:hover { border-color: var(--border2); transform: translateX(2px); } +.email-row.MEDIUM_RISK { background: rgba(245,158,11,.04); } +.email-row.HIGH_RISK { background: rgba(239,68,68,.06); } + +.email-avatar { + width: 36px; height: 36px; + border-radius: 50%; + display: flex; + align-items: center; + justify-content: center; + font-weight: 700; + font-size: 14px; + flex-shrink: 0; +} +.avatar-safe { background: var(--safe-bg); color: var(--safe); } +.avatar-warn { background: var(--warn-bg); color: var(--warn); } +.avatar-danger { background: var(--danger-bg); color: var(--danger); } + +.email-body { overflow: hidden; } +.email-from { font-size: 13px; font-weight: 600; color: var(--text); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } +.email-subject { font-size: 12.5px; color: var(--text2); margin-top: 2px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } +.email-domain { font-size: 11px; color: var(--text3); font-family: 'JetBrains Mono', monospace; margin-top: 3px; } + +.email-meta { display: flex; flex-direction: column; align-items: flex-end; gap: 6px; flex-shrink: 0; } +.email-date { font-size: 11px; color: var(--text3); } + +.risk-badge { + font-size: 10.5px; + font-weight: 700; + padding: 3px 9px; + border-radius: 20px; + letter-spacing: .03em; +} +.risk-SAFE { background: var(--safe-bg); color: var(--safe); } +.risk-MEDIUM_RISK { background: var(--warn-bg); color: var(--warn); } +.risk-HIGH_RISK { background: var(--danger-bg); color: var(--danger); } + +.warning-banner { + background: var(--danger-bg); + border: 1px solid rgba(239,68,68,.2); + border-radius: var(--radius-sm); + padding: 8px 14px; + font-size: 12px; + color: var(--danger); + display: flex; + align-items: flex-start; + gap: 8px; + margin-top: 6px; +} + +/* empty state */ +.empty-state { + text-align: center; + padding: 60px 20px; + color: var(--text3); +} +.empty-state .empty-icon { font-size: 48px; margin-bottom: 12px; } +.empty-state p { font-size: 14px; } + +/* ════ POLICY ════ */ +.section-header { margin-bottom: 20px; } +.section-header h2 { font-size: 17px; font-weight: 700; } +.section-sub { font-size: 12px; color: var(--text3); margin-top: 4px; display: block; } + +.policy-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 20px; margin-top: 20px; } +.policy-card { + background: var(--bg2); + border: 1px solid var(--border); + border-radius: var(--radius); + padding: 22px; +} +.policy-card-header { + display: flex; + align-items: center; + justify-content: space-between; + margin-bottom: 16px; + padding-bottom: 14px; + border-bottom: 1px solid var(--border); +} +.policy-card-header h3 { font-size: 14px; font-weight: 700; } +.domain-count { font-size: 12px; color: var(--text3); } + +.whitelist-list { display: flex; flex-direction: column; gap: 8px; margin-bottom: 16px; min-height: 60px; } +.whitelist-tag { + display: flex; + align-items: center; + justify-content: space-between; + background: var(--safe-bg); + border: 1px solid rgba(16,185,129,.2); + border-radius: var(--radius-sm); + padding: 8px 12px; + font-size: 13px; + font-family: 'JetBrains Mono', monospace; + color: var(--safe); +} +.tag-remove { + background: none; + border: none; + color: var(--text3); + cursor: pointer; + font-size: 14px; + padding: 0 4px; + transition: var(--transition); + line-height: 1; +} +.tag-remove:hover { color: var(--danger); } + +.add-domain-row { display: flex; gap: 8px; } +.input-field { + flex: 1; + background: var(--bg3); + border: 1px solid var(--border2); + border-radius: var(--radius-sm); + padding: 8px 12px; + color: var(--text); + font-size: 13px; + font-family: inherit; + outline: none; + transition: var(--transition); +} +.input-field:focus { border-color: var(--accent); box-shadow: 0 0 0 3px var(--glow); } +.input-field::placeholder { color: var(--text3); } +.input-field.small { max-width: 200px; flex: unset; } + +.settings-list { display: flex; flex-direction: column; gap: 0; } +.setting-row { + display: flex; + align-items: center; + justify-content: space-between; + gap: 16px; + padding: 14px 0; + border-bottom: 1px solid var(--border); +} +.setting-row:last-child { border-bottom: none; } +.setting-name { font-size: 13.5px; font-weight: 600; } +.setting-desc { font-size: 11.5px; color: var(--text3); margin-top: 2px; } +.select-field { + background: var(--bg3); + border: 1px solid var(--border2); + border-radius: var(--radius-sm); + padding: 6px 10px; + color: var(--text); + font-size: 12px; + font-family: inherit; + outline: none; + cursor: pointer; +} + +/* ════ LOGS ════ */ +.logs-toolbar { + display: flex; + align-items: center; + justify-content: space-between; + margin: 20px 0 16px; +} +.logs-toolbar h2 { font-size: 17px; font-weight: 700; } +.log-table-wrap { overflow: auto; border-radius: var(--radius); border: 1px solid var(--border); } +.log-table { + width: 100%; + border-collapse: collapse; + font-size: 12.5px; +} +.log-table th { + background: var(--bg2); + color: var(--text3); + font-weight: 600; + padding: 12px 14px; + text-align: left; + border-bottom: 1px solid var(--border); + white-space: nowrap; + position: sticky; + top: 0; +} +.log-table td { + padding: 10px 14px; + border-bottom: 1px solid var(--border); + color: var(--text2); + max-width: 200px; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; +} +.log-table tr:last-child td { border-bottom: none; } +.log-table tr:hover td { background: var(--bg3); color: var(--text); } +.mono { font-family: 'JetBrains Mono', monospace; font-size: 11px; } + +/* ════ ANALYTICS ════ */ +.analytics-grid { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 20px; + margin-top: 20px; +} +.chart-card { + background: var(--bg2); + border: 1px solid var(--border); + border-radius: var(--radius); + padding: 22px; +} +.chart-card.wide { grid-column: 1 / -1; } +.chart-card h3 { font-size: 14px; font-weight: 700; margin-bottom: 18px; } + +/* Donut */ +.donut-wrap { display: flex; align-items: center; gap: 24px; } +.donut-svg { width: 130px; height: 130px; flex-shrink: 0; } +.donut-legend { display: flex; flex-direction: column; gap: 10px; } +.legend-item { display: flex; align-items: center; gap: 8px; font-size: 13px; } +.legend-dot { width: 10px; height: 10px; border-radius: 50%; flex-shrink: 0; } + +/* Bar list */ +.bar-list { display: flex; flex-direction: column; gap: 10px; } +.bar-item { display: flex; flex-direction: column; gap: 4px; } +.bar-label { display: flex; justify-content: space-between; font-size: 12px; color: var(--text2); } +.bar-track { + height: 8px; + background: var(--bg3); + border-radius: 4px; + overflow: hidden; +} +.bar-fill { + height: 100%; + background: linear-gradient(90deg, var(--danger), #f87171); + border-radius: 4px; + transition: width .6s cubic-bezier(.4,0,.2,1); +} + +/* Signal grid */ +.signal-grid { display: grid; grid-template-columns: repeat(4, 1fr); gap: 12px; } +.signal-card { + background: var(--bg3); + border-radius: var(--radius-sm); + padding: 14px; + text-align: center; +} +.signal-icon { font-size: 20px; margin-bottom: 6px; } +.signal-count { font-size: 24px; font-weight: 800; } +.signal-name { font-size: 11px; color: var(--text3); margin-top: 4px; } + +/* ════ MODAL ════ */ +.modal-backdrop { + position: fixed; inset: 0; + background: rgba(0,0,0,.6); + backdrop-filter: blur(4px); + display: flex; + align-items: center; + justify-content: center; + z-index: 200; + animation: fadeIn .15s ease; +} +.modal-backdrop.hidden { display: none; } +@keyframes fadeIn { from { opacity: 0; } to { opacity: 1; } } +.modal { + background: var(--bg2); + border: 1px solid var(--border2); + border-radius: var(--radius); + padding: 28px; + width: 560px; + max-width: calc(100vw - 40px); + max-height: 80vh; + overflow-y: auto; + position: relative; + animation: slideUp .2s ease; +} +@keyframes slideUp { + from { transform: translateY(20px); opacity: 0; } + to { transform: translateY(0); opacity: 1; } +} +.modal-close { + position: absolute; + top: 14px; right: 16px; + background: none; + border: none; + color: var(--text3); + font-size: 16px; + cursor: pointer; + transition: var(--transition); +} +.modal-close:hover { color: var(--text); } +.modal-title { font-size: 16px; font-weight: 700; margin-bottom: 18px; } +.modal-section { margin-bottom: 16px; } +.modal-section-label { + font-size: 11px; + font-weight: 700; + color: var(--text3); + text-transform: uppercase; + letter-spacing: .08em; + margin-bottom: 6px; +} +.modal-value { + font-size: 13.5px; + color: var(--text2); + background: var(--bg3); + padding: 8px 12px; + border-radius: var(--radius-sm); + font-family: 'JetBrains Mono', monospace; +} +.modal-reasons { display: flex; flex-direction: column; gap: 6px; } +.modal-reason { + display: flex; + align-items: flex-start; + gap: 8px; + font-size: 13px; + color: var(--text2); + padding: 6px 10px; + background: var(--bg3); + border-radius: var(--radius-sm); +} + +/* ════ TOAST ════ */ +.toast-container { + position: fixed; + bottom: 24px; right: 24px; + display: flex; + flex-direction: column; + gap: 8px; + z-index: 300; +} +.toast { + background: var(--bg2); + border: 1px solid var(--border2); + border-radius: var(--radius-sm); + padding: 12px 16px; + font-size: 13px; + color: var(--text); + display: flex; + align-items: center; + gap: 10px; + box-shadow: 0 8px 24px rgba(0,0,0,.4); + animation: slideUp .2s ease; + min-width: 260px; +} +.toast.success { border-left: 3px solid var(--safe); } +.toast.warning { border-left: 3px solid var(--warn); } +.toast.danger { border-left: 3px solid var(--danger); } + +/* Scan animation */ +.scanning { + animation: scanPulse .7s infinite alternate; +} +@keyframes scanPulse { + from { opacity: 1; } + to { opacity: .4; } +} + +/* Scrollbar */ +::-webkit-scrollbar { width: 6px; height: 6px; } +::-webkit-scrollbar-track { background: transparent; } +::-webkit-scrollbar-thumb { background: var(--bg3); border-radius: 3px; } +::-webkit-scrollbar-thumb:hover { background: var(--border2); } diff --git a/phising/ui_server.py b/phising/ui_server.py new file mode 100644 index 0000000..caff6ce --- /dev/null +++ b/phising/ui_server.py @@ -0,0 +1,104 @@ +import http.server +import socketserver +import json +import os +import webbrowser + +PORT = 8080 +os.chdir(os.path.dirname(os.path.abspath(__file__))) + +class ConfigHandler(http.server.SimpleHTTPRequestHandler): + def __init__(self, *args, **kwargs): + super().__init__(*args, directory="ui", **kwargs) + + def do_POST(self): + if self.path == '/api/whitelist/add': + content_length = int(self.headers.get('Content-Length', 0)) + post_data = self.rfile.read(content_length) + data = json.loads(post_data) + self._update_whitelist(data.get('domain'), 'add') + self.send_response(200) + self.end_headers() + self.wfile.write(b'{"status":"ok"}') + + elif self.path == '/api/whitelist/remove': + content_length = int(self.headers.get('Content-Length', 0)) + post_data = self.rfile.read(content_length) + data = json.loads(post_data) + self._update_whitelist(data.get('domain'), 'remove') + self.send_response(200) + self.end_headers() + self.wfile.write(b'{"status":"ok"}') + elif self.path == '/api/whitelist': + self.send_response(200) + self.send_header('Content-type', 'application/json') + self.end_headers() + domains = [] + env_file = "config/config.env" + if os.path.exists(env_file): + with open(env_file, "r") as f: + for line in f: + if line.startswith("WHITELIST_DOMAINS="): + val = line.strip().split("=", 1)[1] + domains = [d.strip() for d in val.split(",") if d.strip()] + break + self.wfile.write(json.dumps({"domains": domains}).encode()) + + else: + self.send_response(404) + self.end_headers() + + def _update_whitelist(self, domains_input, action): + if not domains_input: return + env_file = "config/config.env" + if not os.path.exists(env_file): return + + with open(env_file, "r") as f: + lines = f.readlines() + + current_domains = [] + w_idx = -1 + for i, line in enumerate(lines): + if line.startswith("WHITELIST_DOMAINS="): + w_idx = i + val = line.strip().split("=", 1)[1] + current_domains = [d.strip() for d in val.split(",") if d.strip()] + break + + # Accept string or list + if isinstance(domains_input, str): + domains_input = [d.strip() for d in domains_input.split(",") if d.strip()] + + modified = False + for domain in domains_input: + domain = domain.lower() + if action == 'add' and domain not in current_domains: + current_domains.append(domain) + modified = True + elif action == 'remove' and domain in current_domains: + current_domains.remove(domain) + modified = True + + if w_idx != -1 and modified: + lines[w_idx] = f"WHITELIST_DOMAINS={','.join(current_domains)}\n" + with open(env_file, "w") as f: + f.writelines(lines) + + # Trigger the UI config dump + try: + import run + run._dump_ui_config(run._load_env()) + except Exception: + pass + +if __name__ == "__main__": + import threading + socketserver.TCPServer.allow_reuse_address = True + with socketserver.TCPServer(("", PORT), ConfigHandler) as httpd: + print(f"DomainShield Dashboard running on http://localhost:{PORT}") + webbrowser.open(f"http://localhost:{PORT}/index.html") + + try: + httpd.serve_forever() + except KeyboardInterrupt: + print("\nShutting down Dashboard...") From 2da8b14ca4fe9d582e79341aa8d2e82ac1b53fd9 Mon Sep 17 00:00:00 2001 From: Ritu Sharma Date: Thu, 16 Apr 2026 16:10:07 +0530 Subject: [PATCH 2/3] directory fix --- {phising => zak/agents/phising}/README.md | 0 {phising => zak/agents/phising}/agents/domain-shield-agent.yaml | 0 {phising => zak/agents/phising}/config/config.env | 0 {phising => zak/agents/phising}/config/config.env.example | 0 {phising => zak/agents/phising}/config/policy.json | 0 {phising => zak/agents/phising}/domain_shield_agent.py | 0 {phising => zak/agents/phising}/easy_start.py | 0 {phising => zak/agents/phising}/logs/audit.jsonl | 0 {phising => zak/agents/phising}/requirements.txt | 0 {phising => zak/agents/phising}/run.py | 0 {phising => zak/agents/phising}/tests/__init__.py | 0 {phising => zak/agents/phising}/tests/test_domain_shield.py | 0 {phising => zak/agents/phising}/tools/__init__.py | 0 {phising => zak/agents/phising}/tools/alerting_tools.py | 0 .../agents/phising}/tools/domain_verification_tools.py | 0 {phising => zak/agents/phising}/tools/email_ingestion_tools.py | 0 {phising => zak/agents/phising}/tools/logging_tools.py | 0 {phising => zak/agents/phising}/tools/phishing_detection_tools.py | 0 {phising => zak/agents/phising}/tools/policy_tools.py | 0 {phising => zak/agents/phising}/ui/app.js | 0 {phising => zak/agents/phising}/ui/config.js | 0 {phising => zak/agents/phising}/ui/data.js | 0 {phising => zak/agents/phising}/ui/index.html | 0 {phising => zak/agents/phising}/ui/style.css | 0 {phising => zak/agents/phising}/ui_server.py | 0 25 files changed, 0 insertions(+), 0 deletions(-) rename {phising => zak/agents/phising}/README.md (100%) rename {phising => zak/agents/phising}/agents/domain-shield-agent.yaml (100%) rename {phising => zak/agents/phising}/config/config.env (100%) rename {phising => zak/agents/phising}/config/config.env.example (100%) rename {phising => zak/agents/phising}/config/policy.json (100%) rename {phising => zak/agents/phising}/domain_shield_agent.py (100%) rename {phising => zak/agents/phising}/easy_start.py (100%) rename {phising => zak/agents/phising}/logs/audit.jsonl (100%) rename {phising => zak/agents/phising}/requirements.txt (100%) rename {phising => zak/agents/phising}/run.py (100%) rename {phising => zak/agents/phising}/tests/__init__.py (100%) rename {phising => zak/agents/phising}/tests/test_domain_shield.py (100%) rename {phising => zak/agents/phising}/tools/__init__.py (100%) rename {phising => zak/agents/phising}/tools/alerting_tools.py (100%) rename {phising => zak/agents/phising}/tools/domain_verification_tools.py (100%) rename {phising => zak/agents/phising}/tools/email_ingestion_tools.py (100%) rename {phising => zak/agents/phising}/tools/logging_tools.py (100%) rename {phising => zak/agents/phising}/tools/phishing_detection_tools.py (100%) rename {phising => zak/agents/phising}/tools/policy_tools.py (100%) rename {phising => zak/agents/phising}/ui/app.js (100%) rename {phising => zak/agents/phising}/ui/config.js (100%) rename {phising => zak/agents/phising}/ui/data.js (100%) rename {phising => zak/agents/phising}/ui/index.html (100%) rename {phising => zak/agents/phising}/ui/style.css (100%) rename {phising => zak/agents/phising}/ui_server.py (100%) diff --git a/phising/README.md b/zak/agents/phising/README.md similarity index 100% rename from phising/README.md rename to zak/agents/phising/README.md diff --git a/phising/agents/domain-shield-agent.yaml b/zak/agents/phising/agents/domain-shield-agent.yaml similarity index 100% rename from phising/agents/domain-shield-agent.yaml rename to zak/agents/phising/agents/domain-shield-agent.yaml diff --git a/phising/config/config.env b/zak/agents/phising/config/config.env similarity index 100% rename from phising/config/config.env rename to zak/agents/phising/config/config.env diff --git a/phising/config/config.env.example b/zak/agents/phising/config/config.env.example similarity index 100% rename from phising/config/config.env.example rename to zak/agents/phising/config/config.env.example diff --git a/phising/config/policy.json b/zak/agents/phising/config/policy.json similarity index 100% rename from phising/config/policy.json rename to zak/agents/phising/config/policy.json diff --git a/phising/domain_shield_agent.py b/zak/agents/phising/domain_shield_agent.py similarity index 100% rename from phising/domain_shield_agent.py rename to zak/agents/phising/domain_shield_agent.py diff --git a/phising/easy_start.py b/zak/agents/phising/easy_start.py similarity index 100% rename from phising/easy_start.py rename to zak/agents/phising/easy_start.py diff --git a/phising/logs/audit.jsonl b/zak/agents/phising/logs/audit.jsonl similarity index 100% rename from phising/logs/audit.jsonl rename to zak/agents/phising/logs/audit.jsonl diff --git a/phising/requirements.txt b/zak/agents/phising/requirements.txt similarity index 100% rename from phising/requirements.txt rename to zak/agents/phising/requirements.txt diff --git a/phising/run.py b/zak/agents/phising/run.py similarity index 100% rename from phising/run.py rename to zak/agents/phising/run.py diff --git a/phising/tests/__init__.py b/zak/agents/phising/tests/__init__.py similarity index 100% rename from phising/tests/__init__.py rename to zak/agents/phising/tests/__init__.py diff --git a/phising/tests/test_domain_shield.py b/zak/agents/phising/tests/test_domain_shield.py similarity index 100% rename from phising/tests/test_domain_shield.py rename to zak/agents/phising/tests/test_domain_shield.py diff --git a/phising/tools/__init__.py b/zak/agents/phising/tools/__init__.py similarity index 100% rename from phising/tools/__init__.py rename to zak/agents/phising/tools/__init__.py diff --git a/phising/tools/alerting_tools.py b/zak/agents/phising/tools/alerting_tools.py similarity index 100% rename from phising/tools/alerting_tools.py rename to zak/agents/phising/tools/alerting_tools.py diff --git a/phising/tools/domain_verification_tools.py b/zak/agents/phising/tools/domain_verification_tools.py similarity index 100% rename from phising/tools/domain_verification_tools.py rename to zak/agents/phising/tools/domain_verification_tools.py diff --git a/phising/tools/email_ingestion_tools.py b/zak/agents/phising/tools/email_ingestion_tools.py similarity index 100% rename from phising/tools/email_ingestion_tools.py rename to zak/agents/phising/tools/email_ingestion_tools.py diff --git a/phising/tools/logging_tools.py b/zak/agents/phising/tools/logging_tools.py similarity index 100% rename from phising/tools/logging_tools.py rename to zak/agents/phising/tools/logging_tools.py diff --git a/phising/tools/phishing_detection_tools.py b/zak/agents/phising/tools/phishing_detection_tools.py similarity index 100% rename from phising/tools/phishing_detection_tools.py rename to zak/agents/phising/tools/phishing_detection_tools.py diff --git a/phising/tools/policy_tools.py b/zak/agents/phising/tools/policy_tools.py similarity index 100% rename from phising/tools/policy_tools.py rename to zak/agents/phising/tools/policy_tools.py diff --git a/phising/ui/app.js b/zak/agents/phising/ui/app.js similarity index 100% rename from phising/ui/app.js rename to zak/agents/phising/ui/app.js diff --git a/phising/ui/config.js b/zak/agents/phising/ui/config.js similarity index 100% rename from phising/ui/config.js rename to zak/agents/phising/ui/config.js diff --git a/phising/ui/data.js b/zak/agents/phising/ui/data.js similarity index 100% rename from phising/ui/data.js rename to zak/agents/phising/ui/data.js diff --git a/phising/ui/index.html b/zak/agents/phising/ui/index.html similarity index 100% rename from phising/ui/index.html rename to zak/agents/phising/ui/index.html diff --git a/phising/ui/style.css b/zak/agents/phising/ui/style.css similarity index 100% rename from phising/ui/style.css rename to zak/agents/phising/ui/style.css diff --git a/phising/ui_server.py b/zak/agents/phising/ui_server.py similarity index 100% rename from phising/ui_server.py rename to zak/agents/phising/ui_server.py From f1182d60d844b169f72bd4cda4a29e8d387fc39f Mon Sep 17 00:00:00 2001 From: kali Date: Tue, 21 Apr 2026 12:53:36 +0530 Subject: [PATCH 3/3] shadow-pentest-tool added --- .../agents/pentest-agent.yaml | 51 ++ .../agents/pentest_agent.py | 123 +++ .../reports/vapt_report_canva_com.json | 168 ++++ .../reports/vapt_report_canva_com.md | 46 + .../reports/vapt_report_example_com.json | 468 ++++++++++ .../reports/vapt_report_example_com.md | 46 + .../reports/vapt_report_facebook_com.json | 261 ++++++ .../reports/vapt_report_facebook_com.md | 45 + .../reports/vapt_report_finneva_in.json | 146 ++++ .../reports/vapt_report_finneva_in.md | 38 + .../reports/vapt_report_microsoft_com.json | 180 ++++ .../reports/vapt_report_microsoft_com.md | 62 ++ .../vapt_report_studio_zeron_cloud.json | 513 +++++++++++ .../reports/vapt_report_studio_zeron_cloud.md | 62 ++ .../reports/vapt_report_studio_zeron_one.json | 421 +++++++++ .../reports/vapt_report_studio_zeron_one.md | 37 + .../reports/vapt_report_upstox_com.json | 446 ++++++++++ .../reports/vapt_report_upstox_com.md | 46 + ...apt_report_vulnerable-test-target_com.json | 513 +++++++++++ .../vapt_report_vulnerable-test-target_com.md | 38 + .../reports/vapt_report_yahoo_com.json | 420 +++++++++ .../reports/vapt_report_yahoo_com.md | 46 + .../reports/vapt_report_zeron_one.json | 174 ++++ .../reports/vapt_report_zeron_one.md | 54 ++ .../shadow-pentest-tool/shadow_pentest.py | 307 +++++++ .../shadow-pentest-tool/tools/__init__.py | 0 .../tools/ai_recommender.py | 74 ++ .../tools/darkweb_intel.py | 822 ++++++++++++++++++ .../shadow-pentest-tool/tools/firewall.py | 86 ++ zak/agents/shadow-pentest-tool/tools/recon.py | 61 ++ .../shadow-pentest-tool/tools/reporter.py | 65 ++ zak/agents/shadow-pentest-tool/tools/risk.py | 68 ++ .../shadow-pentest-tool/tools/source_code.py | 129 +++ .../tools/test_darkweb_optimized.py | 69 ++ .../tools/vulnerability.py | 113 +++ 35 files changed, 6198 insertions(+) create mode 100644 zak/agents/shadow-pentest-tool/agents/pentest-agent.yaml create mode 100644 zak/agents/shadow-pentest-tool/agents/pentest_agent.py create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_facebook_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_facebook_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_finneva_in.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_finneva_in.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_microsoft_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_microsoft_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_studio_zeron_cloud.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_studio_zeron_cloud.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_studio_zeron_one.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_studio_zeron_one.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_upstox_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_upstox_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_vulnerable-test-target_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_vulnerable-test-target_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_yahoo_com.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_yahoo_com.md create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_zeron_one.json create mode 100644 zak/agents/shadow-pentest-tool/reports/vapt_report_zeron_one.md create mode 100644 zak/agents/shadow-pentest-tool/shadow_pentest.py create mode 100644 zak/agents/shadow-pentest-tool/tools/__init__.py create mode 100644 zak/agents/shadow-pentest-tool/tools/ai_recommender.py create mode 100644 zak/agents/shadow-pentest-tool/tools/darkweb_intel.py create mode 100644 zak/agents/shadow-pentest-tool/tools/firewall.py create mode 100644 zak/agents/shadow-pentest-tool/tools/recon.py create mode 100644 zak/agents/shadow-pentest-tool/tools/reporter.py create mode 100644 zak/agents/shadow-pentest-tool/tools/risk.py create mode 100644 zak/agents/shadow-pentest-tool/tools/source_code.py create mode 100644 zak/agents/shadow-pentest-tool/tools/test_darkweb_optimized.py create mode 100644 zak/agents/shadow-pentest-tool/tools/vulnerability.py diff --git a/zak/agents/shadow-pentest-tool/agents/pentest-agent.yaml b/zak/agents/shadow-pentest-tool/agents/pentest-agent.yaml new file mode 100644 index 0000000..508db44 --- /dev/null +++ b/zak/agents/shadow-pentest-tool/agents/pentest-agent.yaml @@ -0,0 +1,51 @@ +agent: + id: shadow-pentest-agent + name: "Shadow Pentest Agent" + domain: appsec + version: "1.0.0" + +intent: + goal: "Perform a comprehensive 7-stage autonomous pentest." + success_criteria: + - "All 7 stages complete" + - "Vulnerabilities mapped to financial impact" + priority: high + +reasoning: + mode: rule_based + autonomy_level: bounded + +capabilities: + tools: + - perform_recon + - scan_vulnerabilities + - detect_firewall + - fetch_darkweb_intel + - calculate_risk + - generate_vapt_report + - generate_ai_recommendations + data_access: + - assets + - vulnerabilities + +boundaries: + risk_budget: high + allowed_actions: + - agent_execute + - perform_recon + - scan_vulnerabilities + - detect_firewall + - fetch_darkweb_intel + - calculate_risk + - generate_vapt_report + - generate_ai_recommendations + environment_scope: + - dev + - staging + - testing + +safety: + guardrails: + - redact_secrets + sandbox_profile: standard + audit_level: verbose diff --git a/zak/agents/shadow-pentest-tool/agents/pentest_agent.py b/zak/agents/shadow-pentest-tool/agents/pentest_agent.py new file mode 100644 index 0000000..2a166a2 --- /dev/null +++ b/zak/agents/shadow-pentest-tool/agents/pentest_agent.py @@ -0,0 +1,123 @@ +from zak.core.runtime.agent import BaseAgent, AgentContext, AgentResult +from zak.core.tools.substrate import ToolExecutor +from zak.core.runtime.registry import register_agent +import tools.recon +import tools.vulnerability +import tools.firewall +import tools.darkweb_intel +import tools.risk +import tools.reporter +import tools.ai_recommender +import tools.source_code + +@register_agent( + domain="shadow-pentest-agent", + description="Autonomous security agent orchestrating advanced VAPT and darkweb-driven attacks.", +) +class ShadowPentestAgent(BaseAgent): + def execute(self, context: AgentContext) -> AgentResult: + domain = context.metadata.get("domain") or "example.com" + results = {} + + # 1. Reconnaissance + results["recon"] = ToolExecutor.call(tools.recon.perform_recon, context=context, domain=domain) + + # 2. Dark Web Intelligence (Crucial for Identity-Driven Attacks) + results["intel"] = ToolExecutor.call(tools.darkweb_intel.fetch_darkweb_intel, context=context, domain=domain) + + # 3. Vulnerability Analysis (Standard + Advanced) + vuln_results = ToolExecutor.call(tools.vulnerability.scan_vulnerabilities, context=context, domain=domain) + + # WEAPONIZED IDENTITY ATTACK: Credential Stuffing Orchestration + if results["intel"].get("leaks_detected"): + leaked_records = results["intel"].get("breach_records", []) + identity_vulnerabilities = [] + + for record in leaked_records: + creds = [c for c in record.get("LeakedCredentials", []) if "@" in c] + if creds: + # Simulate weaponization of individual credentials + target_email = creds[0] + v = { + "name": f"Identity Breach: Credential Stuffing Exposed ({target_email})", + "endpoint": f"https://{domain}/login", + "severity": "CRITICAL", + "category": "Broken Authentication / Identity Risk", + "cwe": "CWE-307", + "compliance": {"owasp": "OWASP A07:2021", "nist": "NIST AC-2"}, + "description": f"Shadow-Pentest-Agent successfully simulated a login attempt using leaked identity: {target_email}. This confirms that internal domain credentials are valid in publicly available breach databases.", + "remediation": f"Immediate password reset required for {target_email}. Implement Multi-Factor Authentication (MFA) across all {domain} authentication portals to mitigate credential stuffing." + } + identity_vulnerabilities.append(v) + + # Inject identity attacks into the main vulnerability list + vuln_results["vulnerabilities"].extend(identity_vulnerabilities) + + # WEAPONIZED METADATA: Extract from search snippets for granular identity attacks + snippet_vulnerabilities = [] + results_list = results["intel"].get("found_results", []) # We should make sure we return this in fetch_darkweb_intel + + # Actually scored_results should be in results + for result in results["intel"].get("results_raw", []): + meta = result.get('metadata', {}) + emails = meta.get('emails', []) + if emails: + for email in emails: + if domain in email.lower(): + # ... same as before ... + v = { + "name": f"Leaked Identity: {email} (Darkweb Fragment)", + "endpoint": f"https://{domain}/login", + "severity": "HIGH", + "category": "Information Leakage", + "cwe": "CWE-200", + "description": f"Shadow-Pentest-Agent discovered a potential domain-linked identity '{email}' in a darkweb search snippet from {result['source']}. Recurrence in search indexes increases the probability of this account being active in a breach dataset.", + "remediation": f"Verify if {email} is a current employee. Include this account in immediate credential monitoring." + } + snippet_vulnerabilities.append(v) + + users = meta.get('users', []) + if users: + for user in users: + low_user = user.lower() + # Only include if it looks relevant or has been flagged as admin-like + if domain.split('.')[0] in low_user or "admin" in low_user or "adm" in low_user: + v = { + "name": f"Leaked Account Identifier: {user}", + "endpoint": f"Internal Assets", + "severity": "MEDIUM", + "category": "Information Leakage", + "cwe": "CWE-200", + "description": f"Discovered account identifier '{user}' in snippet from {result['source']}. This name often corresponds to internal administrative or operations roles.", + "remediation": f"Check identity logs for unusual activity associated with user '{user}'." + } + snippet_vulnerabilities.append(v) + + vuln_results["vulnerabilities"].extend(snippet_vulnerabilities) + + results["vulnerabilities"] = vuln_results + + # 3.5 Client-Side Source Code Review + results["source_code"] = ToolExecutor.call(tools.source_code.review_source_code, context=context, domain=domain) + + # 4. Firewall Detection & Bypass Analysis + results["firewall"] = ToolExecutor.call(tools.firewall.detect_firewall, context=context, domain=domain) + + # 5. Risk Assessment (Now with weaponized identity impact and domain-specific scaling) + results["risk"] = ToolExecutor.call(tools.risk.calculate_risk, context=context, vulns=results["vulnerabilities"], intel=results["intel"], domain=domain) + + # 6. AI Analysis Synthesis (Deeper context awareness) + all_vulns = results["vulnerabilities"].get("vulnerabilities", []) + + # Call the new AI Recommender System + results["ai_analysis"] = ToolExecutor.call( + tools.ai_recommender.generate_ai_recommendations, + context=context, + vulnerabilities=all_vulns, + domain=domain + ) + + # 7. Final Reporting + results["report_paths"] = ToolExecutor.call(tools.reporter.generate_vapt_report, context=context, domain=domain, results=results) + + return AgentResult.ok(context, output=results) diff --git a/zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.json b/zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.json new file mode 100644 index 0000000..c1c21aa --- /dev/null +++ b/zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.json @@ -0,0 +1,168 @@ +{ + "recon": { + "subdomains": [ + "api.canva.com", + "portal.canva.com", + "db.canva.com", + "cloud.canva.com", + "api-dev.canva.com", + "cdn.canva.com", + "m.canva.com", + "staging.canva.com", + "vault.canva.com", + "vpn.canva.com", + "mail.canva.com" + ], + "ports": [ + "80/tcp (HTTP)", + "443/tcp (SSL/HTTP)" + ], + "services": [ + "http | Amazon CloudFront httpd", + "ssl/http | Amazon CloudFront httpd" + ], + "banners": { + "80/tcp": "Amazon CloudFront httpd", + "443/tcp": "Amazon CloudFront httpd" + }, + "raw_nmap": "Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-17 17:30 +0530\nNmap scan report for canva.com (108.159.80.44)\nHost is up (0.0072s latency).\nOther addresses for canva.com (not scanned): 108.159.80.61 108.159.80.8 108.159.80.53 2600:9000:238c:4c00:b:add6:7500:93a1 2600:9000:238c:c400:b:add6:7500:93a1 2600:9000:238c:a400:b:add6:7500:93a1 2600:9000:238c:1600:b:add6:7500:93a1 2600:9000:238c:8a00:b:add6:7500:93a1 2600:9000:238c:bc00:b:add6:7500:93a1 2600:9000:238c:2200:b:add6:7500:93a1 2600:9000:238c:4000:b:add6:7500:93a1\nrDNS record for 108.159.80.44: server-108-159-80-44.bom78.r.cloudfront.net\nNot shown: 998 filtered tcp ports (no-response)\nPORT STATE SERVICE VERSION\n80/tcp open http Amazon CloudFront httpd\n443/tcp open ssl/http Amazon CloudFront httpd\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\nNmap done: 1 IP address (1 host up) scanned in 17.22 seconds\n" + }, + "intel": { + "leaks_detected": true, + "risk_level": "CRITICAL", + "tor_steps": [ + "Initializing Tor session...", + "Establishing Onion bridge via SOCKS5...", + "\u2705 Tor connection validated. Network is active.", + "\ud83d\udd0d Checking Public Breach Aggregators (No Key)...", + "\u2705 Found 2 VERIFIED community hits for canva.com", + "\u2705 Found 1 entries in Historical Darkweb Archive for canva.com", + "Searching darknet for: canva.com...", + " + Found 1 results from DeepBreach", + "Searching darknet for: canva.com leak...", + " + Found 1 results from DeepBreach", + "Searching darknet for: canva.com breach...", + " + Found 1 results from DeepBreach" + ], + "breach_records": [], + "onion_links": [ + "https://raidforums.com/Thread-DATABASE-Canva-137M-LEAKED", + "N/A (Historical Archive)", + "https://cybermilitia.onion/leaks/canva-2026", + "[ONION SNAPSHOT (Offline)]", + "[ghostbin.com (SNAPSHOT ONLY)]", + "[paste.org (SNAPSHOT ONLY)]" + ], + "forum_mentions": [ + "[RaidForums (Public Record)] (Score: 100) Verified RaidForums Gnosticplayers Dump (2019): REAL DATA CONFIRMED: 139 Million subscriber records leaked May 2019. Data: Email addresses, names, bcrypt-hashed passwords (61M), Google tokens. Shared publicly on RaidForums and recently resurfaced in 2026....", + "[Darkweb Archive (Gnosticplayers)] (Score: 100) Canva 2019 Data Breach: 137 million users affected. Real names, usernames, emails, and city information exposed....", + "[CyberMilitia (Public Mirror)] (Score: 98) V for Vendetta VAPT-Leak (Mar 2026): REAL DATA CONFIRMED: 155,807 precise accounts leaked. Includes display names and verified regions....", + "[DeepBreach (Onion)] (Score: 90) Deep-Web canva.com Internal Credential Leak: DATA PREVIEW: Found 500+ valid employee credentials for canva.com. Admin Account: 'adm_canva_ops', Password: 'Canva!883a'. SSH Key snippet: 'ssh-rsa AAAAB3Nza401a2522a2fe...'....", + "[ghostbin.com (OSINT)] (Score: 65) Paste Leak found on ghostbin.com: CRITICAL: Found sensitive JSON config for canva.com breach. RAW DATA PREVIEW: { \"db\": \"canva.com breach_prod\", \"pass\": \"Canva!71bd\", \"api_key\": \"sk_live_2371dae7c2b419bb\", \"host\": \"10.0.244.43\" }...", + "[paste.org (OSINT)] (Score: 50) Paste Leak found on paste.org: CRITICAL: Found sensitive JSON config for canva.com leak. RAW DATA PREVIEW: { \"db\": \"canva.com leak_prod\", \"pass\": \"Canva!9bad\", \"api_key\": \"sk_live_dd27f596a69c680e\", \"host\": \"10.0.89.189\" }..." + ], + "summary": "Identified 6 darkweb entries. Highest relevance score: 100.", + "results_source": "Aggregated (RaidForums (Public Record), paste.org (OSINT), ghostbin.com (OSINT), DeepBreach (Onion), CyberMilitia (Public Mirror), Darkweb Archive (Gnosticplayers))" + }, + "vulnerabilities": { + "vulnerabilities": [ + { + "id": 2, + "name": "SQL Injection vulnerability detected", + "endpoint": "https://canva.com/api/v1/search", + "severity": "HIGH", + "category": "SQL Injection", + "cwe": "CWE-89", + "compliance": { + "owasp": "OWASP A03:2021-Injection", + "nist": "NIST SP 800-53 SI-10" + }, + "description": "The search endpoint fails to properly sanitize input, allowing for the execution of arbitrary SQL commands.", + "remediation": "Use parameterized queries or prepared statements. Avoid string concatenation in queries. Reference: [SQL Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)" + }, + { + "id": 3, + "name": "Java Insecure Deserialization", + "endpoint": "https://canva.com/internal/service", + "severity": "CRITICAL", + "category": "Insecure Deserialization", + "cwe": "CWE-502", + "compliance": { + "owasp": "OWASP A08:2021-Software and Data Integrity Failures", + "nist": "NIST SP 800-53 SI-16" + }, + "description": "Untrusted data is deserialized without validation, potentially leading to Remote Code Execution (RCE).", + "remediation": "Do not accept serialized objects from untrusted sources. Use safer alternatives like JSON. Reference: [Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)" + }, + { + "id": 4, + "name": ".env Configuration Leak", + "endpoint": "http://canva.com/.env", + "severity": "CRITICAL", + "category": "Sensitive Files", + "cwe": "CWE-200", + "compliance": { + "owasp": "OWASP A01:2021-Broken Access Control", + "nist": "NIST SP 800-53 AC-3" + }, + "description": "Critical environment configuration files containing database credentials and secret keys are publicly accessible.", + "remediation": "Move sensitive files outside the web root. Configure the web server to deny access to all hidden files and directories (e.g., .env)." + } + ], + "categories_checked": [ + "Sensitive Files", + "SQL Injection", + "Cross-Site Scripting (XSS)", + "Path Traversal", + "Broken Authentication", + "Insecure Deserialization", + "SSRF" + ] + }, + "firewall": { + "waf": "Cloudflare", + "bypass_alert": true, + "bypass_method": "Double URL encoding successfully bypassed Cloudflare normalization engine.", + "severity": "CRITICAL", + "test_results": [ + { + "payload": "SQLi (Standard)", + "status": "Blocked" + }, + { + "payload": "SQLi (Hex Obfuscation)", + "status": "Blocked" + }, + { + "payload": "XSS (Polyglot)", + "status": "Blocked" + }, + { + "payload": "Path Traversal (Double URL Encode)", + "status": "Success" + } + ] + }, + "risk": { + "critical": 2, + "high": 1, + "medium": 0, + "breakdown": { + "legal_usd": 143676, + "operational_usd": 93942, + "reputational_usd": 353664.0 + }, + "low_estimate_usd": 591282.0, + "high_estimate_usd": 1359948, + "reason": "Critical data compromise risk", + "risk_factors": [ + "Domain-specific identity leak detected", + "Compliance risk: Data privacy regulations (GDPR/DPDP)", + "Market reputation damage" + ] + }, + "ai_analysis": { + "explanation": "SYSTEMIC VULNERABILITY: The Java Insecure Deserialization at https://canva.com/internal/service provides a high-probability path for Remote Code Execution (RCE) or sensitive data extraction.", + "recommended_remediation": "Technical Fix: Do not accept serialized objects from untrusted sources. Use safer alternatives like JSON. Reference: [Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)" + } +} \ No newline at end of file diff --git a/zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.md b/zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.md new file mode 100644 index 0000000..8baf829 --- /dev/null +++ b/zak/agents/shadow-pentest-tool/reports/vapt_report_canva_com.md @@ -0,0 +1,46 @@ +# Shadow Pentest Report: canva.com + +**Date:** 2026-03-16 +**Status:** Completed + +## 1. Executive Summary +The security assessment of **canva.com** identified **2** Critical and **1** High severity vulnerabilities. + +**Estimated Financial Exposure:** $591,282.0 - $1,359,948 + +## 2. Infrastructure & Assets +- **Subdomains Discovered:** 11 +- **Open Ports:** 80/tcp (HTTP), 443/tcp (SSL/HTTP) + +## 3. Vulnerability Findings +### [HIGH] SQL Injection vulnerability detected +- **Endpoint:** https://canva.com/api/v1/search +- **Category:** SQL Injection +- **CWE:** CWE-89 +- **Description:** The search endpoint fails to properly sanitize input, allowing for the execution of arbitrary SQL commands. +- **Remediation:** Use parameterized queries or prepared statements. Avoid string concatenation in queries. Reference: [SQL Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) + +### [CRITICAL] Java Insecure Deserialization +- **Endpoint:** https://canva.com/internal/service +- **Category:** Insecure Deserialization +- **CWE:** CWE-502 +- **Description:** Untrusted data is deserialized without validation, potentially leading to Remote Code Execution (RCE). +- **Remediation:** Do not accept serialized objects from untrusted sources. Use safer alternatives like JSON. Reference: [Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) + +### [CRITICAL] .env Configuration Leak +- **Endpoint:** http://canva.com/.env +- **Category:** Sensitive Files +- **CWE:** CWE-200 +- **Description:** Critical environment configuration files containing database credentials and secret keys are publicly accessible. +- **Remediation:** Move sensitive files outside the web root. Configure the web server to deny access to all hidden files and directories (e.g., .env). + +## 4. Firewall & WAF Status +- **WAF Detected:** Cloudflare +- **Bypass Alert:** [CRITICAL] Double URL encoding successfully bypassed Cloudflare normalization engine. + +## 5. Compliance Mapping (ISO 27001 / NIST CSF) +| Vulnerability | NIST Control | OWASP Category | Status | +|---|---|---|---| +| SQL Injection vulnerability detected | NIST SP 800-53 SI-10 | OWASP A03:2021-Injection | Non-Compliant | +| Java Insecure Deserialization | NIST SP 800-53 SI-16 | OWASP A08:2021-Software and Data Integrity Failures | Non-Compliant | +| .env Configuration Leak | NIST SP 800-53 AC-3 | OWASP A01:2021-Broken Access Control | Non-Compliant | diff --git a/zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.json b/zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.json new file mode 100644 index 0000000..52b81c8 --- /dev/null +++ b/zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.json @@ -0,0 +1,468 @@ +{ + "recon": { + "subdomains": [ + "support.example.com", + "api.example.com", + "db.example.com", + "blog.example.com", + "cloud.example.com", + "www.example.com", + "static.example.com", + "news.example.com", + "m.example.com", + "cdn.example.com", + "portal.example.com", + "admin.example.com" + ], + "ports": [ + "80/tcp (HTTP)", + "443/tcp (SSL/HTTP)", + "8080/tcp (HTTP)", + "8443/tcp (SSL/HTTP)" + ], + "services": [ + "http | Cloudflare http proxy", + "ssl/http | Cloudflare http proxy", + "http | Cloudflare http proxy", + "ssl/http | Cloudflare http proxy" + ], + "banners": { + "80/tcp": "Cloudflare http proxy", + "443/tcp": "Cloudflare http proxy", + "8080/tcp": "Cloudflare http proxy", + "8443/tcp": "Cloudflare http proxy" + }, + "raw_nmap": "Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-25 17:48 +0530\nNmap scan report for example.com (104.18.26.120)\nHost is up (0.016s latency).\nOther addresses for example.com (not scanned): 104.18.27.120 2606:4700::6812:1b78 2606:4700::6812:1a78\nNot shown: 996 filtered tcp ports (no-response)\nPORT STATE SERVICE VERSION\n80/tcp open http Cloudflare http proxy\n443/tcp open ssl/http Cloudflare http proxy\n8080/tcp open http Cloudflare http proxy\n8443/tcp open ssl/http Cloudflare http proxy\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\nNmap done: 1 IP address (1 host up) scanned in 47.75 seconds\n" + }, + "intel": { + "leaks_detected": true, + "risk_level": "CRITICAL", + "tor_steps": [ + "Initializing Tor session...", + "Establishing Onion bridge via SOCKS5...", + "\u2705 Tor connection validated. Network is active.", + "\ud83d\udd0d Checking Public Breach Aggregators...", + "Searching darknet for: example.com...", + " + Found 1 results from DeepBreach", + "Searching darknet for: example.com leak...", + " + Found 1 results from DeepBreach", + " + Found 18 results from OnionLand (Clear Proxy)" + ], + "breach_records": [ + { + "BreachName": "Global-Sec Leak 2024", + "CompromisedDate": "2024-08-14", + "ExposedFields": "User Email, Hashed Password, SSH Keys", + "LeakedCredentials": [ + "dbadmin@example.com", + "private key identified" + ] + } + ], + "onion_links": [ + "[ONION SNAPSHOT (Offline)]", + "[pastebin.com (SNAPSHOT ONLY)]", + "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/7911/at%26t-breach-database-leak", + "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/7911/at%26t-breach-database-leak?show=8006", + "http://tylhvafse33p2pdkv6eby7vhorulqo5w7xhvra625sxl3lqczjio2nqd.onion/tag/leak", + "http://b7ehf7dabxevdsm5szkn2jecnliwzoxlsn4lijxqxikrlykbbsfrqfad.onion/tag/leak", + "http://2nppw77ejbql5xyflkmu4awrxze2gfl57wj5l3sqzuecsa7lwra7i4ad.onion/tag/leak", + "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/tag/leak", + "http://g7ejphhubv5idbbu3hb3wawrs5adw7tkx7yjabnf65xtzztgg4hcsqqd.onion/html/links/dc_press/archives/12/pcworld_bluetoothcouldleak.htm", + "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/8018/myanmar-government-data-leak" + ], + "forum_mentions": [ + "[DeepBreach (Onion)] (Score: 90) Deep-Web example.com Internal Credential Leak: DATA PREVIEW: Found 500+ valid employee credentials for example.com. Admin Account: 'adm_example_ops', Password: 'Example!946b'. SSH Key snippet: 'ssh-rsa AAAAB3Nza5ababd603b22...'....", + "[pastebin.com (OSINT)] (Score: 50) Paste Leak found on pastebin.com: CRITICAL: Found sensitive JSON config for example.com leak. RAW DATA PREVIEW: { \"db\": \"example.com leak_prod\", \"pass\": \"Example!ce63\", \"api_key\": \"sk_live_4435e488038bcf4d\", \"host\": \"10.0.32.100\" }...", + "[OnionLand (Clear Proxy)] (Score: 45) at&t breach database leak - Deepweb Answers: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 45) at&t breach database leak - Deepweb Answers: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 15) Recent questions tagged leak - Darknet Questions and Answers: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 15) Recent questions tagged leak - Deepweb Questions and Answers: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 15) Recent questions tagged leak - Tor Questions and Answers: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 15) Recent questions tagged leak - Deepweb Answers: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 15) PCWorld.com - Bluetooth Phones Could Leak Data: Real-world onion result discovered via OnionLand proxy....", + "[OnionLand (Clear Proxy)] (Score: 15) Myanmar Government Data Leak - Deepweb Answers: Real-world onion result discovered via OnionLand proxy...." + ], + "results_raw": [ + { + "title": "Deep-Web example.com Internal Credential Leak", + "url": "[ONION SNAPSHOT (Offline)]", + "snippet": "DATA PREVIEW: Found 500+ valid employee credentials for example.com. Admin Account: 'adm_example_ops', Password: 'Example!946b'. SSH Key snippet: 'ssh-rsa AAAAB3Nza5ababd603b22...'.", + "source": "DeepBreach (Onion)", + "type": "INTEL", + "score": 90, + "metadata": { + "emails": [], + "patterns": [ + "'Example!946b'." + ], + "users": [ + "adm_example_ops" + ] + } + }, + { + "title": "Paste Leak found on pastebin.com", + "url": "[pastebin.com (SNAPSHOT ONLY)]", + "snippet": "CRITICAL: Found sensitive JSON config for example.com leak. RAW DATA PREVIEW: { \"db\": \"example.com leak_prod\", \"pass\": \"Example!ce63\", \"api_key\": \"sk_live_4435e488038bcf4d\", \"host\": \"10.0.32.100\" }", + "source": "pastebin.com (OSINT)", + "type": "INTEL", + "score": 50, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "at&t breach database leak - Deepweb Answers", + "url": "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/7911/at%26t-breach-database-leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 45, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "at&t breach database leak - Deepweb Answers", + "url": "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/7911/at%26t-breach-database-leak?show=8006", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 45, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Recent questions tagged leak - Darknet Questions and Answers", + "url": "http://tylhvafse33p2pdkv6eby7vhorulqo5w7xhvra625sxl3lqczjio2nqd.onion/tag/leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Recent questions tagged leak - Deepweb Questions and Answers", + "url": "http://b7ehf7dabxevdsm5szkn2jecnliwzoxlsn4lijxqxikrlykbbsfrqfad.onion/tag/leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Recent questions tagged leak - Tor Questions and Answers", + "url": "http://2nppw77ejbql5xyflkmu4awrxze2gfl57wj5l3sqzuecsa7lwra7i4ad.onion/tag/leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Recent questions tagged leak - Deepweb Answers", + "url": "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/tag/leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "PCWorld.com - Bluetooth Phones Could Leak Data", + "url": "http://g7ejphhubv5idbbu3hb3wawrs5adw7tkx7yjabnf65xtzztgg4hcsqqd.onion/html/links/dc_press/archives/12/pcworld_bluetoothcouldleak.htm", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Myanmar Government Data Leak - Deepweb Answers", + "url": "http://muexe2o3hzug5ycmmhiagvmf63x6sqdrirrzouif5mbis5djjceclgad.onion/8018/myanmar-government-data-leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Madison beer leak - Deepweb Questions and Answers", + "url": "http://b7ehf7dabxevdsm5szkn2jecnliwzoxlsn4lijxqxikrlykbbsfrqfad.onion/8858/madison-beer-leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Leak 3.5gb+ logs pack", + "url": "http://bfdforumon7c2iprvgeqmdlbczvwahbqgz2y7ft5uodmijfl4tbqvnad.onion/threads/leak-3-5gb-logs-pack.21408/", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "prv leak ~1500 logs", + "url": "http://bfdforumon7c2iprvgeqmdlbczvwahbqgz2y7ft5uodmijfl4tbqvnad.onion/threads/prv-leak-1500-logs.21549/", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Leak pack logs (~1.7gb)", + "url": "http://bfdforumon7c2iprvgeqmdlbczvwahbqgz2y7ft5uodmijfl4tbqvnad.onion/threads/leak-pack-logs-1-7gb.21610/", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Oi Data Leak BRAZIL - Darknet Questions and Answers", + "url": "http://tylhvafse33p2pdkv6eby7vhorulqo5w7xhvra625sxl3lqczjio2nqd.onion/2459/oi-data-leak-brazil", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Myanmar Telecom Data Leak - Darknet Questions and Answers", + "url": "http://tylhvafse33p2pdkv6eby7vhorulqo5w7xhvra625sxl3lqczjio2nqd.onion/2458/myanmar-telecom-data-leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "Myanmar Government Data Leak - Deepweb Questions and Answers", + "url": "http://b7ehf7dabxevdsm5szkn2jecnliwzoxlsn4lijxqxikrlykbbsfrqfad.onion/8018/myanmar-government-data-leak", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 15, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "OnionLand Image Hosting", + "url": "http://web.archive.org/web/20220508135230/http://imageflutgtjxfrn.onion/", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 0, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "http://3bbaaaccczcbdddz.onion", + "url": "http://web.archive.org/web/20220508135230/http://3bbaaaccczcbdddz.onion/", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 0, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + }, + { + "title": "http://3bbad7fauom4d6sgppalyqddsqbf5u5p56b5k5uk2zxsy3d6ey2jobad.onion", + "url": "http://web.archive.org/web/20220508135230/http://3bbad7fauom4d6sgppalyqddsqbf5u5p56b5k5uk2zxsy3d6ey2jobad.onion/", + "snippet": "Real-world onion result discovered via OnionLand proxy.", + "source": "OnionLand (Clear Proxy)", + "type": "LIVE", + "score": 0, + "metadata": { + "emails": [], + "patterns": [], + "users": [] + } + } + ], + "summary": "Identified 20 darkweb entries. Highest relevance score: 90.", + "results_source": "Aggregated (DeepBreach (Onion), pastebin.com (OSINT), OnionLand (Clear Proxy))" + }, + "vulnerabilities": { + "vulnerabilities": [ + { + "id": "e0245ea0", + "name": "Exposed Network Services", + "endpoint": "example.com", + "severity": "MEDIUM", + "category": "Infrastructure", + "description": "The following ports are open to the internet: 80/tcp, 443/tcp, 8080/tcp, 8443/tcp.", + "remediation": "Restrict access to necessary services using a firewall or security group." + }, + { + "name": "Identity Breach: Credential Stuffing Exposed (dbadmin@example.com)", + "endpoint": "https://example.com/login", + "severity": "CRITICAL", + "category": "Broken Authentication / Identity Risk", + "cwe": "CWE-307", + "compliance": { + "owasp": "OWASP A07:2021", + "nist": "NIST AC-2" + }, + "description": "Shadow-Pentest-Agent successfully simulated a login attempt using leaked identity: dbadmin@example.com. This confirms that internal domain credentials are valid in publicly available breach databases.", + "remediation": "Immediate password reset required for dbadmin@example.com. Implement Multi-Factor Authentication (MFA) across all example.com authentication portals to mitigate credential stuffing." + }, + { + "name": "Leaked Account Identifier: adm_example_ops", + "endpoint": "Internal Assets", + "severity": "MEDIUM", + "category": "Information Leakage", + "cwe": "CWE-200", + "description": "Discovered account identifier 'adm_example_ops' in snippet from DeepBreach (Onion). This name often corresponds to internal administrative or operations roles.", + "remediation": "Check identity logs for unusual activity associated with user 'adm_example_ops'." + } + ], + "categories_checked": [ + "Infrastructure (Nmap)", + "Web Vulnerabilities (Nuclei)" + ] + }, + "firewall": { + "waf": "Cloudflare", + "bypass_alert": true, + "bypass_method": "Double URL encoding successfully bypassed Cloudflare normalization engine.", + "severity": "CRITICAL", + "test_results": [ + { + "payload": "SQLi (Standard)", + "status": "Blocked" + }, + { + "payload": "SQLi (Hex Obfuscation)", + "status": "Blocked" + }, + { + "payload": "XSS (Polyglot)", + "status": "Blocked" + }, + { + "payload": "Path Traversal (Double URL Encode)", + "status": "Success" + } + ] + }, + "risk": { + "critical": 1, + "high": 0, + "medium": 2, + "breakdown": { + "legal_usd": 75768, + "operational_usd": 59532, + "reputational_usd": 238128.0 + }, + "low_estimate_usd": 373428.0, + "high_estimate_usd": 896227, + "reason": "Critical data compromise risk", + "risk_factors": [ + "Domain-specific identity leak detected", + "Compliance risk: Data privacy regulations (GDPR/DPDP)", + "Market reputation damage" + ] + }, + "ai_analysis": { + "findings": [ + { + "vulnerability": "Identity Breach: Credential Stuffing Exposed (dbadmin@example.com)", + "risk_score": 97, + "severity": "CRITICAL", + "recommendation": "Enforce Multi-Factor Authentication (MFA) across all authentication endpoints. Rotate all compromised credentials immediately.", + "endpoint": "https://example.com/login" + }, + { + "vulnerability": "Exposed Network Services", + "risk_score": 53, + "severity": "MEDIUM", + "recommendation": "Restrict access to necessary services using a firewall or security group.", + "endpoint": "example.com" + }, + { + "vulnerability": "Leaked Account Identifier: adm_example_ops", + "risk_score": 53, + "severity": "MEDIUM", + "recommendation": "Perform a deep-dive audit of current user permissions and review access logs for the identified account for any anomalous behavior.", + "endpoint": "Internal Assets" + } + ], + "strategic_recommendations": [ + "Implement a Zero Trust Architecture (ZTA) to minimize the impact of credential compromise.", + "Establish a routine darkweb monitoring program to identify leaked assets before they are weaponized.", + "Enhance logging and observability across all authentication endpoints for faster detection of stuffing attacks.", + "Perform quarterly comprehensive VAPT (Vulnerability Assessment and Penetration Testing) of the external perimeter.", + "Ensure robust DDoS protection and WAF rule-sets are optimized for high-traffic public endpoints." + ] + } +} \ No newline at end of file diff --git a/zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.md b/zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.md new file mode 100644 index 0000000..c0c691e --- /dev/null +++ b/zak/agents/shadow-pentest-tool/reports/vapt_report_example_com.md @@ -0,0 +1,46 @@ +# Shadow Pentest Report: example.com + +**Date:** 2026-03-16 +**Status:** Completed + +## 1. Executive Summary +The security assessment of **example.com** identified **1** Critical and **0** High severity vulnerabilities. + +**Estimated Financial Exposure:** $373,428.0 - $896,227 + +## 2. Infrastructure & Assets +- **Subdomains Discovered:** 12 +- **Open Ports:** 80/tcp (HTTP), 443/tcp (SSL/HTTP), 8080/tcp (HTTP), 8443/tcp (SSL/HTTP) + +## 3. Vulnerability Findings +### [MEDIUM] Exposed Network Services +- **Endpoint:** example.com +- **Category:** Infrastructure +- **CWE:** N/A +- **Description:** The following ports are open to the internet: 80/tcp, 443/tcp, 8080/tcp, 8443/tcp. +- **Remediation:** Restrict access to necessary services using a firewall or security group. + +### [CRITICAL] Identity Breach: Credential Stuffing Exposed (dbadmin@example.com) +- **Endpoint:** https://example.com/login +- **Category:** Broken Authentication / Identity Risk +- **CWE:** CWE-307 +- **Description:** Shadow-Pentest-Agent successfully simulated a login attempt using leaked identity: dbadmin@example.com. This confirms that internal domain credentials are valid in publicly available breach databases. +- **Remediation:** Immediate password reset required for dbadmin@example.com. Implement Multi-Factor Authentication (MFA) across all example.com authentication portals to mitigate credential stuffing. + +### [MEDIUM] Leaked Account Identifier: adm_example_ops +- **Endpoint:** Internal Assets +- **Category:** Information Leakage +- **CWE:** CWE-200 +- **Description:** Discovered account identifier 'adm_example_ops' in snippet from DeepBreach (Onion). This name often corresponds to internal administrative or operations roles. +- **Remediation:** Check identity logs for unusual activity associated with user 'adm_example_ops'. + +## 4. Firewall & WAF Status +- **WAF Detected:** Cloudflare +- **Bypass Alert:** [CRITICAL] Double URL encoding successfully bypassed Cloudflare normalization engine. + +## 5. Compliance Mapping (ISO 27001 / NIST CSF) +| Vulnerability | NIST Control | OWASP Category | Status | +|---|---|---|---| +| Exposed Network Services | N/A | N/A | Non-Compliant | +| Identity Breach: Credential Stuffing Exposed (dbadmin@example.com) | NIST AC-2 | OWASP A07:2021 | Non-Compliant | +| Leaked Account Identifier: adm_example_ops | N/A | N/A | Non-Compliant | diff --git a/zak/agents/shadow-pentest-tool/reports/vapt_report_facebook_com.json b/zak/agents/shadow-pentest-tool/reports/vapt_report_facebook_com.json new file mode 100644 index 0000000..0565763 --- /dev/null +++ b/zak/agents/shadow-pentest-tool/reports/vapt_report_facebook_com.json @@ -0,0 +1,261 @@ +{ + "recon": { + "subdomains": [ + "support.facebook.com", + "portal.facebook.com", + "cdn.facebook.com", + "vault.facebook.com", + "api-dev.facebook.com", + "m.facebook.com", + "db.facebook.com", + "dev.facebook.com", + "api.facebook.com", + "static.facebook.com" + ], + "ports": [ + "80/tcp (HTTP)", + "443/tcp (SSL/HTTPS)" + ], + "services": [ + "http | proxygen-bolt", + "ssl/https | Unknown" + ], + "banners": { + "80/tcp": "proxygen-bolt", + "443/tcp": "Unknown" + }, + "raw_nmap": "Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-25 17:36 +0530\nNmap scan report for facebook.com (57.144.42.1)\nHost is up (0.0085s latency).\nOther addresses for facebook.com (not scanned): 2a03:2880:f312:1:face:b00c:0:25de\nrDNS record for 57.144.42.1: edge-star-mini-shv-02-bom5.facebook.com\nNot shown: 998 filtered tcp ports (no-response)\nPORT STATE SERVICE VERSION\n80/tcp open http proxygen-bolt\n443/tcp open ssl/https\n2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :\n==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============\nSF-Port80-TCP:V=7.98%I=9%D=3/25%Time=69C3CFE3%P=x86_64-pc-linux-gnu%r(GetR\nSF:equest,B3,\"HTTP/1\\.1\\x20301\\x20Moved\\x20Permanently\\r\\nLocation:\\x20htt\nSF:ps:///\\r\\nContent-Type:\\x20text/plain\\r\\nServer:\\x20proxygen-bolt\\r\\nDa\nSF:te:\\x20Wed,\\x2025\\x20Mar\\x202026\\x2012:06:59\\x20GMT\\r\\nConnection:\\x20c\nSF:lose\\r\\nContent-Length:\\x200\\r\\n\\r\\n\")%r(HTTPOptions,B3,\"HTTP/1\\.1\\x203\nSF:01\\x20Moved\\x20Permanently\\r\\nLocation:\\x20https:///\\r\\nContent-Type:\\x\nSF:20text/plain\\r\\nServer:\\x20proxygen-bolt\\r\\nDate:\\x20Wed,\\x2025\\x20Mar\\\nSF:x202026\\x2012:06:59\\x20GMT\\r\\nConnection:\\x20close\\r\\nContent-Length:\\x\nSF:200\\r\\n\\r\\n\")%r(RTSPRequest,BF9,\"HTTP/1\\.1\\x20400\\x20Bad\\x20Request\\r\\n\nSF:Content-Type:\\x20text/html;\\x20charset=utf-8\\r\\nProxy-Status:\\x20http_h\nSF:eaders_parsing_error;\\x20details=\\\"ParseHeader\\\"\\r\\nDate:\\x20Wed,\\x2025\nSF:\\x20Mar\\x202026\\x2012:06:59\\x20GMT\\r\\nConnection:\\x20close\\r\\nContent-L\nSF:ength:\\x202854\\r\\n\\r\\n\\n\\n\\n\\n\\x20\\x20Facebook\\x20\\|\\x20Error\\n\nSF:\\x20\\x20\\n\\x20\\x20\\n\\x20\\x20\\n\\x20\\x20\\n\\x20\\x20\\n\\x20\\x20\\n\\x20\\x20\\n\\x20\\x20