6bc8ba89d1
Add a complete AI pentest system where Claude autonomously drives security testing via tool-calling. The LLM selects from 16 tools, chains results, and builds an attack chain DAG. Core: - PentestTool trait (dyn-compatible) with PentestToolContext/Result - PentestSession, AttackChainNode, PentestMessage, PentestEvent models - 10 new DastVulnType variants (DNS, DMARC, TLS, cookies, CSP, CORS, etc.) - LLM client chat_with_tools() for OpenAI-compatible tool calling Tools (16 total): - 5 agent wrappers: SQL injection, XSS, auth bypass, SSRF, API fuzzer - 11 new infra tools: DNS checker, DMARC checker, TLS analyzer, security headers, cookie analyzer, CSP analyzer, rate limit tester, console log detector, CORS checker, OpenAPI parser, recon - ToolRegistry for tool lookup and LLM definition generation Orchestrator: - PentestOrchestrator with iterative tool-calling loop (max 50 rounds) - Attack chain node recording per tool invocation - SSE event broadcasting for real-time progress - Strategy-aware system prompts (quick/comprehensive/targeted/aggressive/stealth) API (9 endpoints): - POST/GET /pentest/sessions, GET /pentest/sessions/:id - POST /pentest/sessions/:id/chat, GET /pentest/sessions/:id/stream - GET /pentest/sessions/:id/attack-chain, messages, findings - GET /pentest/stats Dashboard: - Pentest dashboard with stat cards, severity distribution, session list - Chat-based session page with split layout (chat + findings/attack chain) - Inline tool execution indicators, auto-polling, new session modal - Sidebar navigation item Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
446 lines
24 KiB
Rust
446 lines
24 KiB
Rust
use dioxus::prelude::*;
|
|
use dioxus_free_icons::icons::bs_icons::*;
|
|
use dioxus_free_icons::Icon;
|
|
|
|
use crate::app::Route;
|
|
use crate::infrastructure::pentest::{
|
|
fetch_attack_chain, fetch_pentest_findings, fetch_pentest_messages, fetch_pentest_session,
|
|
send_pentest_message,
|
|
};
|
|
|
|
#[component]
|
|
pub fn PentestSessionPage(session_id: String) -> Element {
|
|
let sid = session_id.clone();
|
|
let sid_for_session = session_id.clone();
|
|
let sid_for_findings = session_id.clone();
|
|
let sid_for_chain = session_id.clone();
|
|
|
|
let mut session = use_resource(move || {
|
|
let id = sid_for_session.clone();
|
|
async move { fetch_pentest_session(id).await.ok() }
|
|
});
|
|
let mut messages_res = use_resource(move || {
|
|
let id = sid.clone();
|
|
async move { fetch_pentest_messages(id).await.ok() }
|
|
});
|
|
let mut findings = use_resource(move || {
|
|
let id = sid_for_findings.clone();
|
|
async move { fetch_pentest_findings(id).await.ok() }
|
|
});
|
|
let mut attack_chain = use_resource(move || {
|
|
let id = sid_for_chain.clone();
|
|
async move { fetch_attack_chain(id).await.ok() }
|
|
});
|
|
|
|
let mut input_text = use_signal(String::new);
|
|
let mut sending = use_signal(|| false);
|
|
let mut right_tab = use_signal(|| "findings".to_string());
|
|
|
|
// Auto-poll messages every 3s when session is running
|
|
let session_status = {
|
|
let s = session.read();
|
|
match &*s {
|
|
Some(Some(resp)) => resp
|
|
.data
|
|
.get("status")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("unknown")
|
|
.to_string(),
|
|
_ => "unknown".to_string(),
|
|
}
|
|
};
|
|
|
|
let is_running = session_status == "running";
|
|
|
|
let sid_for_poll = session_id.clone();
|
|
use_effect(move || {
|
|
if is_running {
|
|
let _sid = sid_for_poll.clone();
|
|
spawn(async move {
|
|
#[cfg(feature = "web")]
|
|
gloo_timers::future::TimeoutFuture::new(3_000).await;
|
|
#[cfg(not(feature = "web"))]
|
|
tokio::time::sleep(std::time::Duration::from_secs(3)).await;
|
|
messages_res.restart();
|
|
findings.restart();
|
|
attack_chain.restart();
|
|
session.restart();
|
|
});
|
|
}
|
|
});
|
|
|
|
// Send message handler
|
|
let sid_for_send = session_id.clone();
|
|
let mut do_send = move || {
|
|
let text = input_text.read().trim().to_string();
|
|
if text.is_empty() || *sending.read() {
|
|
return;
|
|
}
|
|
let sid = sid_for_send.clone();
|
|
input_text.set(String::new());
|
|
sending.set(true);
|
|
spawn(async move {
|
|
let _ = send_pentest_message(sid, text).await;
|
|
sending.set(false);
|
|
messages_res.restart();
|
|
});
|
|
};
|
|
|
|
let mut do_send_click = do_send.clone();
|
|
|
|
// Session header info
|
|
let target_name = {
|
|
let s = session.read();
|
|
match &*s {
|
|
Some(Some(resp)) => resp
|
|
.data
|
|
.get("target_name")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("Pentest Session")
|
|
.to_string(),
|
|
_ => "Pentest Session".to_string(),
|
|
}
|
|
};
|
|
|
|
let strategy = {
|
|
let s = session.read();
|
|
match &*s {
|
|
Some(Some(resp)) => resp
|
|
.data
|
|
.get("strategy")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("-")
|
|
.to_string(),
|
|
_ => "-".to_string(),
|
|
}
|
|
};
|
|
|
|
let header_tool_count = {
|
|
let s = session.read();
|
|
match &*s {
|
|
Some(Some(resp)) => resp
|
|
.data
|
|
.get("tool_invocations")
|
|
.and_then(|v| v.as_u64())
|
|
.unwrap_or(0),
|
|
_ => 0,
|
|
}
|
|
};
|
|
|
|
let header_findings_count = {
|
|
let f = findings.read();
|
|
match &*f {
|
|
Some(Some(data)) => data.total.unwrap_or(0),
|
|
_ => 0,
|
|
}
|
|
};
|
|
|
|
let status_style = match session_status.as_str() {
|
|
"running" => "background: #16a34a; color: #fff;",
|
|
"completed" => "background: #2563eb; color: #fff;",
|
|
"failed" => "background: #dc2626; color: #fff;",
|
|
"paused" => "background: #d97706; color: #fff;",
|
|
_ => "background: var(--bg-tertiary); color: var(--text-secondary);",
|
|
};
|
|
|
|
rsx! {
|
|
div { class: "back-nav",
|
|
Link {
|
|
to: Route::PentestDashboardPage {},
|
|
class: "btn btn-ghost btn-back",
|
|
Icon { icon: BsArrowLeft, width: 16, height: 16 }
|
|
"Back to Pentest Dashboard"
|
|
}
|
|
}
|
|
|
|
// Session header
|
|
div { style: "display: flex; align-items: center; justify-content: space-between; margin-bottom: 16px; flex-wrap: wrap; gap: 8px;",
|
|
div {
|
|
h2 { style: "margin: 0 0 4px 0;", "{target_name}" }
|
|
div { style: "display: flex; gap: 8px; align-items: center; flex-wrap: wrap;",
|
|
span { class: "badge", style: "{status_style}", "{session_status}" }
|
|
span { class: "badge", style: "background: var(--bg-tertiary); color: var(--text-secondary);",
|
|
"{strategy}"
|
|
}
|
|
}
|
|
}
|
|
div { style: "display: flex; gap: 16px; font-size: 0.85rem; color: var(--text-secondary);",
|
|
span {
|
|
Icon { icon: BsWrench, width: 14, height: 14 }
|
|
" {header_tool_count} tools"
|
|
}
|
|
span {
|
|
Icon { icon: BsShieldExclamation, width: 14, height: 14 }
|
|
" {header_findings_count} findings"
|
|
}
|
|
}
|
|
}
|
|
|
|
// Split layout: chat left, findings/chain right
|
|
div { style: "display: grid; grid-template-columns: 1fr 380px; gap: 16px; height: calc(100vh - 220px); min-height: 400px;",
|
|
|
|
// Left: Chat area
|
|
div { class: "card", style: "display: flex; flex-direction: column; overflow: hidden;",
|
|
div { class: "card-header", style: "flex-shrink: 0;", "Chat" }
|
|
|
|
// Messages
|
|
div {
|
|
style: "flex: 1; overflow-y: auto; padding: 16px; display: flex; flex-direction: column; gap: 12px;",
|
|
match &*messages_res.read() {
|
|
Some(Some(data)) => {
|
|
let msgs = &data.data;
|
|
if msgs.is_empty() {
|
|
rsx! {
|
|
div { style: "text-align: center; color: var(--text-secondary); padding: 32px;",
|
|
h3 { style: "margin-bottom: 8px;", "Start the conversation" }
|
|
p { "Send a message to guide the pentest agent." }
|
|
}
|
|
}
|
|
} else {
|
|
rsx! {
|
|
for (i, msg) in msgs.iter().enumerate() {
|
|
{
|
|
let role = msg.get("role").and_then(|v| v.as_str()).unwrap_or("assistant").to_string();
|
|
let content = msg.get("content").and_then(|v| v.as_str()).unwrap_or("").to_string();
|
|
let msg_type = msg.get("type").and_then(|v| v.as_str()).unwrap_or("text").to_string();
|
|
let tool_name = msg.get("tool_name").and_then(|v| v.as_str()).unwrap_or("").to_string();
|
|
let tool_status = msg.get("tool_status").and_then(|v| v.as_str()).unwrap_or("").to_string();
|
|
|
|
if msg_type == "tool_call" || msg_type == "tool_result" {
|
|
// Tool invocation indicator
|
|
let tool_icon_style = match tool_status.as_str() {
|
|
"success" => "color: #16a34a;",
|
|
"error" => "color: #dc2626;",
|
|
"running" => "color: #d97706;",
|
|
_ => "color: var(--text-secondary);",
|
|
};
|
|
rsx! {
|
|
div {
|
|
key: "{i}",
|
|
style: "display: flex; align-items: center; gap: 8px; padding: 6px 12px; background: var(--bg-tertiary); border-radius: 6px; font-size: 0.8rem; color: var(--text-secondary);",
|
|
span { style: "{tool_icon_style}",
|
|
Icon { icon: BsWrench, width: 12, height: 12 }
|
|
}
|
|
span { style: "font-family: monospace;", "{tool_name}" }
|
|
if !tool_status.is_empty() {
|
|
span { class: "badge", style: "font-size: 0.7rem;", "{tool_status}" }
|
|
}
|
|
if !content.is_empty() {
|
|
details { style: "margin-left: auto; cursor: pointer;",
|
|
summary { style: "font-size: 0.75rem;", "details" }
|
|
pre { style: "margin-top: 4px; padding: 8px; background: var(--bg-primary); border-radius: 4px; font-size: 0.75rem; overflow-x: auto; max-height: 200px; white-space: pre-wrap;",
|
|
"{content}"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} else if role == "user" {
|
|
// User message - right aligned
|
|
rsx! {
|
|
div {
|
|
key: "{i}",
|
|
style: "display: flex; justify-content: flex-end;",
|
|
div {
|
|
style: "max-width: 80%; padding: 10px 14px; background: #2563eb; color: #fff; border-radius: 12px 12px 2px 12px; font-size: 0.9rem; line-height: 1.5; white-space: pre-wrap;",
|
|
"{content}"
|
|
}
|
|
}
|
|
}
|
|
} else {
|
|
// Assistant message - left aligned
|
|
rsx! {
|
|
div {
|
|
key: "{i}",
|
|
style: "display: flex; gap: 8px; align-items: flex-start;",
|
|
div {
|
|
style: "flex-shrink: 0; width: 28px; height: 28px; border-radius: 50%; background: var(--bg-tertiary); display: flex; align-items: center; justify-content: center;",
|
|
Icon { icon: BsCpu, width: 14, height: 14 }
|
|
}
|
|
div {
|
|
style: "max-width: 80%; padding: 10px 14px; background: var(--bg-tertiary); border-radius: 12px 12px 12px 2px; font-size: 0.9rem; line-height: 1.5; white-space: pre-wrap;",
|
|
"{content}"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
Some(None) => rsx! { p { style: "padding: 16px; color: var(--text-secondary);", "Failed to load messages." } },
|
|
None => rsx! { p { style: "padding: 16px; color: var(--text-secondary);", "Loading messages..." } },
|
|
}
|
|
|
|
if *sending.read() {
|
|
div { style: "display: flex; gap: 8px; align-items: flex-start;",
|
|
div {
|
|
style: "flex-shrink: 0; width: 28px; height: 28px; border-radius: 50%; background: var(--bg-tertiary); display: flex; align-items: center; justify-content: center;",
|
|
Icon { icon: BsCpu, width: 14, height: 14 }
|
|
}
|
|
div {
|
|
style: "padding: 10px 14px; background: var(--bg-tertiary); border-radius: 12px 12px 12px 2px; font-size: 0.9rem; color: var(--text-secondary);",
|
|
"Thinking..."
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Input area
|
|
div { style: "flex-shrink: 0; padding: 12px; border-top: 1px solid var(--border-color); display: flex; gap: 8px;",
|
|
textarea {
|
|
class: "chat-input",
|
|
style: "flex: 1;",
|
|
placeholder: "Guide the pentest agent...",
|
|
value: "{input_text}",
|
|
oninput: move |e| input_text.set(e.value()),
|
|
onkeydown: move |e: Event<KeyboardData>| {
|
|
if e.key() == Key::Enter && !e.modifiers().shift() {
|
|
e.prevent_default();
|
|
do_send();
|
|
}
|
|
},
|
|
}
|
|
button {
|
|
class: "btn btn-primary",
|
|
style: "align-self: flex-end;",
|
|
disabled: *sending.read(),
|
|
onclick: move |_| do_send_click(),
|
|
"Send"
|
|
}
|
|
}
|
|
}
|
|
|
|
// Right: Findings / Attack Chain tabs
|
|
div { class: "card", style: "display: flex; flex-direction: column; overflow: hidden;",
|
|
// Tab bar
|
|
div { style: "display: flex; border-bottom: 1px solid var(--border-color); flex-shrink: 0;",
|
|
button {
|
|
style: if *right_tab.read() == "findings" {
|
|
"flex: 1; padding: 10px; background: none; border: none; border-bottom: 2px solid #2563eb; color: var(--text-primary); cursor: pointer; font-weight: 600;"
|
|
} else {
|
|
"flex: 1; padding: 10px; background: none; border: none; border-bottom: 2px solid transparent; color: var(--text-secondary); cursor: pointer;"
|
|
},
|
|
onclick: move |_| right_tab.set("findings".to_string()),
|
|
Icon { icon: BsShieldExclamation, width: 14, height: 14 }
|
|
" Findings ({header_findings_count})"
|
|
}
|
|
button {
|
|
style: if *right_tab.read() == "chain" {
|
|
"flex: 1; padding: 10px; background: none; border: none; border-bottom: 2px solid #2563eb; color: var(--text-primary); cursor: pointer; font-weight: 600;"
|
|
} else {
|
|
"flex: 1; padding: 10px; background: none; border: none; border-bottom: 2px solid transparent; color: var(--text-secondary); cursor: pointer;"
|
|
},
|
|
onclick: move |_| right_tab.set("chain".to_string()),
|
|
Icon { icon: BsDiagram3, width: 14, height: 14 }
|
|
" Attack Chain"
|
|
}
|
|
}
|
|
|
|
// Tab content
|
|
div { style: "flex: 1; overflow-y: auto; padding: 12px;",
|
|
if *right_tab.read() == "findings" {
|
|
// Findings tab
|
|
match &*findings.read() {
|
|
Some(Some(data)) => {
|
|
let finding_list = &data.data;
|
|
if finding_list.is_empty() {
|
|
rsx! {
|
|
div { style: "text-align: center; color: var(--text-secondary); padding: 24px;",
|
|
p { "No findings yet." }
|
|
}
|
|
}
|
|
} else {
|
|
rsx! {
|
|
div { style: "display: flex; flex-direction: column; gap: 8px;",
|
|
for finding in finding_list {
|
|
{
|
|
let title = finding.get("title").and_then(|v| v.as_str()).unwrap_or("Untitled").to_string();
|
|
let severity = finding.get("severity").and_then(|v| v.as_str()).unwrap_or("info").to_string();
|
|
let vuln_type = finding.get("vulnerability_type").and_then(|v| v.as_str()).unwrap_or("-").to_string();
|
|
let sev_style = match severity.as_str() {
|
|
"critical" => "background: #dc2626; color: #fff;",
|
|
"high" => "background: #ea580c; color: #fff;",
|
|
"medium" => "background: #d97706; color: #fff;",
|
|
"low" => "background: #2563eb; color: #fff;",
|
|
_ => "background: var(--bg-tertiary); color: var(--text-secondary);",
|
|
};
|
|
rsx! {
|
|
div { style: "padding: 10px; background: var(--bg-tertiary); border-radius: 8px;",
|
|
div { style: "display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px;",
|
|
span { style: "font-weight: 600; font-size: 0.85rem;", "{title}" }
|
|
span { class: "badge", style: "{sev_style}", "{severity}" }
|
|
}
|
|
div { style: "font-size: 0.8rem; color: var(--text-secondary);", "{vuln_type}" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
Some(None) => rsx! { p { style: "color: var(--text-secondary);", "Failed to load findings." } },
|
|
None => rsx! { p { style: "color: var(--text-secondary);", "Loading..." } },
|
|
}
|
|
} else {
|
|
// Attack chain tab
|
|
match &*attack_chain.read() {
|
|
Some(Some(data)) => {
|
|
let steps = &data.data;
|
|
if steps.is_empty() {
|
|
rsx! {
|
|
div { style: "text-align: center; color: var(--text-secondary); padding: 24px;",
|
|
p { "No attack chain steps yet." }
|
|
}
|
|
}
|
|
} else {
|
|
rsx! {
|
|
div { style: "display: flex; flex-direction: column; gap: 4px;",
|
|
for (i, step) in steps.iter().enumerate() {
|
|
{
|
|
let step_name = step.get("name").and_then(|v| v.as_str()).unwrap_or("Step").to_string();
|
|
let step_status = step.get("status").and_then(|v| v.as_str()).unwrap_or("pending").to_string();
|
|
let description = step.get("description").and_then(|v| v.as_str()).unwrap_or("").to_string();
|
|
let step_num = i + 1;
|
|
let dot_color = match step_status.as_str() {
|
|
"completed" => "#16a34a",
|
|
"running" => "#d97706",
|
|
"failed" => "#dc2626",
|
|
_ => "var(--text-secondary)",
|
|
};
|
|
rsx! {
|
|
div { style: "display: flex; gap: 10px; padding: 8px 0;",
|
|
div { style: "display: flex; flex-direction: column; align-items: center;",
|
|
div { style: "width: 10px; height: 10px; border-radius: 50%; background: {dot_color}; flex-shrink: 0;" }
|
|
if i < steps.len() - 1 {
|
|
div { style: "width: 2px; flex: 1; background: var(--border-color); margin-top: 4px;" }
|
|
}
|
|
}
|
|
div {
|
|
div { style: "font-size: 0.85rem; font-weight: 600;", "{step_num}. {step_name}" }
|
|
if !description.is_empty() {
|
|
div { style: "font-size: 0.8rem; color: var(--text-secondary); margin-top: 2px;",
|
|
"{description}"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
Some(None) => rsx! { p { style: "color: var(--text-secondary);", "Failed to load attack chain." } },
|
|
None => rsx! { p { style: "color: var(--text-secondary);", "Loading..." } },
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|