39 lines
2.4 KiB
Markdown
39 lines
2.4 KiB
Markdown
# SneakyScope — Roadmap (Updated 8-21-25)
|
||
|
||
## Priority 1 – Core Analysis / Stability
|
||
|
||
* Opt-in “fetch external scripts” mode (off by default): on submission, download external script content (size/time limits) and run rules on fetched content.
|
||
* Remove remaining legacy form “flagged\_reasons” plumbing once all equivalent function rules are in place.
|
||
* Unit tests: YAML compilation, function-rule adapters, and per-script/per-form rule cases.
|
||
* SSL/TLS intelligence: for HTTPS targets, pull certificate details from crt.sh (filtering expired); if a subdomain, also resolve the root domain to capture any wildcard certificates; probe the endpoint to enumerate supported TLS versions/ciphers and flag weak/legacy protocols.
|
||
|
||
## Priority 2 – API Layer
|
||
|
||
* API endpoints: `/screenshot`, `/source`, `/analyse`.
|
||
* OpenAPI spec: create `openapi/openapi.yaml` and serve at `/api/openapi.yaml`.
|
||
* Docs UI: Swagger UI or Redoc at `/docs`.
|
||
|
||
## Priority 3 – UI / UX
|
||
|
||
* Front page/input handling: auto-prepend `http://`/`https://`/`www.` for bare domains.
|
||
* Source code viewer: embed page source in an editor view for readability.
|
||
* Scripts table: toggle between “Only suspicious” and “All scripts”.
|
||
* Rules Lab (WYSIWYG tester): paste a rule, validate/compile, run against sample text; lightweight nav entry.
|
||
|
||
## Priority 4 – Artifact Management & Ops
|
||
|
||
* Retention/cleanup policy for old artifacts (age/size thresholds).
|
||
* Make periodic maintenance scripts for storage; cleanup options set in `settings.yaml`.
|
||
* Results caching UX: add “Re-run analysis” vs. “Load from cache” controls in the results UI.
|
||
|
||
## Priority 5 – Extras / Integrations
|
||
|
||
* Bulk URL analysis (batch/queue).
|
||
* Optional: analyst verdict tags and export (CSV/JSON).
|
||
* Domain reputation (local feeds): build and refresh a consolidated domain/URL reputation store from URLHaus database dump and OpenPhish community dataset (scheduled pulls with dedup/normalize).
|
||
* Threat intel connectors (settings-driven): add `settings.yaml` entries for VirusTotal and ThreatFox API keys (plus future providers); when present, enrich lookups and merge results into the unified reputation checks during analysis.
|
||
|
||
## Backlog / Far‑Off Plans
|
||
|
||
* Server profile scan: run a lightweight nmap service/banner scan on common web/alt ports (80, 443, 8000, 8080, 8443, etc.) and SSH; combine with server headers to infer stack (e.g., IIS vs. Linux/\*nix).
|