From 53d65f7a76f7509542fa8cbd6bef12b499cd4fa3 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 Aug 2026 13:44:51 +0000 Subject: [PATCH] =?UTF-8?q?docs:=20correct=20gap=20analysis=20=E2=80=94=20?= =?UTF-8?q?results=20pipelines=20work,=20frontend=20lacks=20Loot=20viewer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- PLAN.md | 57 +++++++++++++++++++++++++++------------------------------ 1 file changed, 27 insertions(+), 30 deletions(-) diff --git a/PLAN.md b/PLAN.md index bd8175d..5cc5d17 100644 --- a/PLAN.md +++ b/PLAN.md @@ -6,16 +6,15 @@ Rule: remove no features. Only add and fix. ## PHASE 1 — FIX (make everything that exists actually work) -### 1.1 Screenshot pipeline (currently dead) -- **server.js**: add `POST /api/agent/screenshot-result` — receives base64 PNG, stores in `exfiltratedFiles` map with `mime: image/png`, marks command completed, broadcasts. -- Add `GET /api/screenshots` + `GET /api/screenshots/:id` (thumbnail/full). -- **Frontend**: new "Screenshots" section — grid of thumbnails, click to expand, per-node filter, download button. -- Verify agent's `screenshot` action posts to the new endpoint; fix the URL in agent.py if it points at the wrong path. - -### 1.2 Files & Credentials UI (backend exists, zero UI) -- New **Files** section: table of exfiltrated files (node, filename, size, time, download). Per-node filter. -- New **Credentials** section: grouped by node + type, redact-by-default with click-to-reveal, CSV export (endpoint already exists). -- Wire both into the existing WebSocket `NODES_UPDATE` payload so they live-refresh. +### 1.1 Screenshot/Exfil/Harvest results viewer (the real gap — pipelines WORK, results invisible) +Verified: screenshot → `/api/agent/file-result` → `exfiltratedFiles` → `/api/files` ✅ +Verified: harvest → `/api/agent/harvest-result` → `/api/credentials` ✅ +**The frontend has the trigger buttons (Exfil & Harvest tab) but NEVER fetches `/api/files` or `/api/credentials`.** Data lands server-side and goes invisible. +- New **Loot** section in the dashboard: two tabs (Files / Credentials). + - Files: table (node, filename, mime, size, time, download btn). Images (screenshots) get inline thumbnails + lightbox. + - Credentials: grouped by node+type, masked by default, click-to-reveal, copy button, CSV export (endpoint exists). +- Live-update both via the existing WebSocket broadcast (add files/creds summary counts to `NODES_UPDATE` payload, or poll on event). +- "Loot received" toast when a new file/cred batch arrives. ### 1.3 Dashboard auth (currently wide open) - Add session-token middleware to server.js: `NEXUS_AUTH_TOKEN` env var; on first load the UI asks for the token once, stores in localStorage, sends as `Authorization: Bearer`. @@ -81,9 +80,8 @@ Rule: remove no features. Only add and fix. ### 3.1 Scheduled commands - `node-cron` in server: schedule raw/structured commands per node/tag on cron expressions. UI: simple scheduler panel (time picker + action + target). Persisted in SQLite. -### 3.2 Screenshot gallery + live view -- Gallery view (all nodes, timestamped thumbnails). -- "Watch" mode: request screenshot every N seconds from one node, stream into the drawer (pseudo-live). +### 3.2 Screenshot watch mode +- "Watch" mode: request screenshot every N seconds from one node, stream into the drawer (pseudo-live). Gallery itself ships with the Loot viewer in 1.1. ### 3.3 Webhook alerts - Config panel: webhook URL (n8n on .236 / Discord / generic). @@ -114,22 +112,21 @@ Rule: remove no features. Only add and fix. |---|------|-------|--------| | 1 | Server + tunnel systemd units | 1.4 | 15 min | | 2 | Dashboard auth token | 1.3 | 45 min | -| 3 | Screenshot endpoint + UI | 1.1 | 1.5 h | -| 4 | Files & Credentials UI | 1.2 | 1.5 h | -| 5 | WebSocket reconnect | 1.6 | 30 min | -| 6 | Empty state + QR install | 1.8 | 45 min | -| 7 | Atomic saves → SQLite | 1.5 | 2 h | -| 8 | Agent version + capability reporting | 1.7 | 1 h | -| 9 | Design system + node cards + drawer | 2.1–2.2 | 3 h | -| 10 | Command builder + bulk targeting | 2.3 | 2 h | -| 11 | Shortcuts, toasts, skeletons, mobile | 2.4 | 2 h | -| 12 | Scheduled commands | 3.1 | 1.5 h | -| 13 | Webhook alerts | 3.3 | 1 h | -| 14 | Screenshot gallery/watch | 3.2 | 1 h | -| 15 | Tags/groups UI | 3.5 | 1.5 h | -| 16 | Cross-platform binaries | 3.4 | 3 h | -| 17 | Audit/export upgrades | 3.6 | 1 h | -| 18 | Self-watchdog | 3.7 | 30 min | +| 3 | Loot viewer (files + creds + screenshot gallery) | 1.1 | 2 h | +| 4 | WebSocket reconnect | 1.6 | 30 min | +| 5 | Empty state + QR install | 1.8 | 45 min | +| 6 | Atomic saves → SQLite | 1.5 | 2 h | +| 7 | Agent version + capability reporting | 1.7 | 1 h | +| 8 | Design system + node cards + drawer | 2.1–2.2 | 3 h | +| 9 | Command builder + bulk targeting | 2.3 | 2 h | +| 10 | Shortcuts, toasts, skeletons, mobile | 2.4 | 2 h | +| 11 | Scheduled commands | 3.1 | 1.5 h | +| 12 | Webhook alerts | 3.3 | 1 h | +| 13 | Screenshot watch mode (live refresh in drawer) | 3.2 | 1 h | +| 14 | Tags/groups UI | 3.5 | 1.5 h | +| 15 | Cross-platform binaries | 3.4 | 3 h | +| 16 | Audit/export upgrades | 3.6 | 1 h | +| 17 | Self-watchdog | 3.7 | 30 min | -**Ship gate after Phase 1:** every existing feature demonstrably works end-to-end (screenshot round-trip, file exfil → download, creds → UI, auth on, services survive reboot). +**Ship gate after Phase 1:** every existing feature demonstrably works end-to-end (screenshot → visible in Loot, exfil → download, creds → UI, auth on, services survive reboot). **Ship gate after Phase 2:** a stranger could run the dashboard without asking how anything works.