72 lines
2.2 KiB
Markdown
72 lines
2.2 KiB
Markdown
|
||
## Priority 1 – Core Functionality / Stability
|
||
|
||
**Permissions / Storage Paths**
|
||
|
||
* ✅ `/data` and other mounted volumes setup handled by `sandbox.sh`
|
||
* ✅ Downloads, screenshots, and HTML artifacts are written correctly (`safe_write` in `io_helpers.py`)
|
||
|
||
---
|
||
|
||
## Priority 2 – Data Accuracy / Enrichment
|
||
|
||
**WHOIS & GeoIP Enhancements**
|
||
|
||
* ✅ Implemented Python-based WHOIS parsing with fallback to raw WHOIS text
|
||
* ✅ Default `"Possible Privacy"` or `"N/A"` for missing WHOIS fields
|
||
* ✅ GeoIP + ASN + ISP info displayed per IP in **accordion tables**
|
||
* ✅ Cache WHOIS and GeoIP results to reduce repeated queries
|
||
|
||
**Suspicious Scripts & Forms**
|
||
|
||
* [ ] Expand flagged script and form output with reasons for analysts
|
||
* [ ] Show each check and if it triggered flags (pass/fail for each check)
|
||
|
||
**Add Suspicious BEC words**
|
||
|
||
* ✅ Look for things like `"reset password"`
|
||
* ✅ Make configurable via a config file (yaml doc with rules)
|
||
|
||
---
|
||
|
||
## Priority 3 – User Interface / UX
|
||
|
||
**Front Page / Input Handling**
|
||
|
||
* [ ] Automatically prepend `http://`, `https://`, and/or `www.` if a user only enters a domain
|
||
|
||
**Result Templates / Cards**
|
||
* [ ] load sourcecode for webpage in a code editor view or code block on page so that it's easier to read
|
||
* [ ] Update result cards with clear, analyst-friendly explanations
|
||
* [ ] Include flagged logic and reason lists for scripts and forms
|
||
* ✅ Display GeoIP results in accordion tables (✅ done)
|
||
|
||
---
|
||
|
||
## Priority 4 – API Layer
|
||
|
||
**API Endpoints**
|
||
|
||
* [ ] Add `/screenshot` endpoint
|
||
* [ ] Add `/source` endpoint
|
||
* [ ] Add `/analyse` endpoint
|
||
|
||
**OpenAPI + Docs**
|
||
|
||
* [ ] Create initial `openapi/openapi.yaml` spec file
|
||
* [ ] Serve spec at `/api/openapi.yaml`
|
||
* [ ] Wire up Swagger UI or Redoc at `/docs` for interactive API exploration
|
||
|
||
---
|
||
|
||
## Priority 5 – Optional / Cleanup
|
||
|
||
**Artifact Management**
|
||
* [ ] Implement saving of results from a UUID as "results.json" so we don't rerun all the rules and just load from cache.
|
||
* [ ] Implement cleanup or retention policy for old artifacts
|
||
* [ ] Optional: Add periodic maintenance scripts for storage
|
||
|
||
**Extra Features**
|
||
|
||
* [ ] Placeholder for additional features (e.g., bulk URL analysis, alerting, integrations)
|