Initial commit: Talos edge-facing scan orchestrator.
CI / skip-ci-check (push) Successful in 8s
CI / secret-scan (push) Successful in 7s
CI / python-ci (push) Failing after 19s

FastAPI + Kali tools UI for authorized scans of levkin.ca / LAN targets.
Gitignore local data/.env; add pytest + gitleaks CI.
This commit is contained in:
2026-07-12 11:46:54 -04:00
commit 12a6e2b6bc
29 changed files with 3075 additions and 0 deletions
+323
View File
@@ -0,0 +1,323 @@
const $ = (id) => document.getElementById(id);
let currentScanId = null;
let currentBulkId = null;
let bulkPollTimer = null;
let ws = null;
let consoleLines = [];
let scanMode = "single";
const MAX_LINES = 5000;
function api(path, opts = {}) {
return fetch(path, opts).then((r) => {
if (!r.ok) return r.json().then((e) => Promise.reject(e));
const ct = r.headers.get("content-type") || "";
if (ct.includes("json")) return r.json();
return r.text();
});
}
function parseBulkTargets(raw) {
return raw
.split(/\r?\n/)
.map((line) => line.trim())
.filter((line) => line && !line.startsWith("#"));
}
function updateBulkCount() {
const count = parseBulkTargets($("targets-bulk").value || "").length;
$("bulk-count").textContent = count === 1 ? "1 target" : `${count} targets`;
updateLaunchLabel();
}
function updateLaunchLabel() {
if (!$("authorized").checked) {
$("launch").textContent = "Launch scan";
return;
}
if (scanMode === "bulk") {
const count = parseBulkTargets($("targets-bulk").value || "").length;
$("launch").textContent = count > 0 ? `Launch ${count} scan${count === 1 ? "" : "s"}` : "Launch scan";
return;
}
$("launch").textContent = "Launch scan";
}
function setScanMode(mode) {
scanMode = mode;
$("mode-single").classList.toggle("active", mode === "single");
$("mode-bulk").classList.toggle("active", mode === "bulk");
$("single-target").classList.toggle("hidden", mode !== "single");
$("bulk-target").classList.toggle("hidden", mode !== "bulk");
updateLaunchLabel();
}
function scanOptions() {
return {
include_web: $("opt-web").checked,
include_ssl: $("opt-ssl").checked,
include_brute: $("opt-brute").checked,
};
}
function setBulkProgress(visible, text) {
$("bulk-progress").classList.toggle("hidden", !visible);
if (text) $("bulk-progress-text").textContent = text;
}
function stopBulkPoll() {
if (bulkPollTimer) {
clearInterval(bulkPollTimer);
bulkPollTimer = null;
}
}
function pollBulkProgress(bulkId) {
stopBulkPoll();
const tick = () => {
api(`/api/bulks/${bulkId}`)
.then((d) => {
const b = d.bulk || {};
const line = `Bulk ${bulkId.slice(0, 8)}… · ${b.complete || 0}/${b.total || 0} complete`
+ (b.running ? ` · ${b.running} running` : "")
+ (b.queued ? ` · ${b.queued} queued` : "")
+ (b.failed ? ` · ${b.failed} failed` : "");
setBulkProgress(true, line);
if (b.status === "complete") {
stopBulkPoll();
logLine(`bulk finished: ${b.complete}/${b.total} complete`);
$("export-cursor").disabled = false;
}
})
.catch(() => {});
};
tick();
bulkPollTimer = setInterval(tick, 5000);
}
function resetScanView() {
consoleLines = [];
$("phases").innerHTML = "";
$("findings").innerHTML = "";
stopBulkPoll();
setBulkProgress(false);
currentBulkId = null;
$("export-cursor").classList.add("hidden");
$("export-cursor").disabled = true;
}
function setHealth() {
api("/api/health").then((h) => {
$("ollama-badge").textContent = `Ollama: ${h.ollama}`;
$("ollama-badge").className = `badge ${h.ollama === "ok" ? "ok" : "down"}`;
const toolsOk = Object.values(h.tools || {}).every((v) => v === "ok");
$("tools-badge").textContent = `Tools: ${toolsOk ? "ok" : "degraded"}`;
$("tools-badge").className = `badge ${toolsOk ? "ok" : "down"}`;
}).catch(() => {
$("ollama-badge").textContent = "Ollama: down";
$("tools-badge").textContent = "Tools: unknown";
});
}
function logLine(line) {
consoleLines.push(line);
if (consoleLines.length > MAX_LINES) consoleLines = consoleLines.slice(-MAX_LINES);
const el = $("console");
el.textContent = consoleLines.join("\n");
if (!$("pause-scroll").checked) el.scrollTop = el.scrollHeight;
}
function renderPhases(phases) {
const ul = $("phases");
ul.innerHTML = "";
(phases || []).forEach((p) => {
const li = document.createElement("li");
const name = p.phase || p.name;
const status = p.status || "pending";
li.innerHTML = `<span>${name}</span><span class="phase-${status}">${status}</span>`;
ul.appendChild(li);
});
}
function renderFinding(f) {
const div = document.createElement("div");
div.className = "finding-card";
div.innerHTML = `
<span class="severity-chip sev-${f.severity}">${f.severity}</span>
<strong>${f.title}</strong>
<p>${f.description}</p>
<p><em>Confidence:</em> ${f.confidence}</p>
<p class="evidence"><code>${(f.evidence || "").slice(0, 500)}</code></p>
<p><strong>Fix:</strong> ${f.recommendation}</p>
`;
div.addEventListener("click", () => div.classList.toggle("open"));
$("findings").prepend(div);
}
function loadRecent() {
api("/api/scans").then((scans) => {
const ul = $("recent-list");
ul.innerHTML = "";
scans.forEach((s) => {
const li = document.createElement("li");
li.textContent = `${s.target} · ${s.profile} · ${s.status}`;
li.dataset.id = s.id;
li.addEventListener("click", () => openScan(s.id));
ul.appendChild(li);
});
});
}
function openScan(id) {
currentScanId = id;
$("export-md").disabled = false;
$("export-json").disabled = false;
$("cancel").disabled = false;
api(`/api/scans/${id}`).then((d) => {
consoleLines = [];
logLine(`loaded scan ${id}${d.scan.target}`);
renderPhases(d.phases.map((p) => ({ name: p.name, status: p.status })));
$("findings").innerHTML = "";
d.findings.forEach(renderFinding);
connectWs(id);
});
}
function connectWs(id) {
if (ws) ws.close();
const proto = location.protocol === "https:" ? "wss" : "ws";
ws = new WebSocket(`${proto}://${location.host}/ws/scans/${id}`);
ws.onmessage = (ev) => {
const msg = JSON.parse(ev.data);
if (msg.type === "log") logLine(msg.line);
if (msg.type === "phase") {
const ul = $("phases");
let li = [...ul.children].find((c) => c.textContent.startsWith(msg.phase));
if (!li) {
li = document.createElement("li");
ul.appendChild(li);
}
li.innerHTML = `<span>${msg.phase}</span><span class="phase-${msg.status}">${msg.status}</span>`;
}
if (msg.type === "finding") renderFinding(msg.finding);
if (msg.type === "done") {
logLine(`scan ${msg.status}`);
$("cancel").disabled = true;
loadRecent();
}
if (msg.type === "error") logLine(`ERROR: ${msg.message}`);
};
}
function launchSingle() {
const body = {
target: $("target").value.trim(),
profile: $("profile").value,
authorized: $("authorized").checked,
options: scanOptions(),
};
resetScanView();
api("/api/scans", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(body),
})
.then((r) => {
currentScanId = r.scan_id;
logLine(`scan queued: ${r.scan_id}`);
$("export-md").disabled = false;
$("export-json").disabled = false;
$("cancel").disabled = false;
connectWs(r.scan_id);
loadRecent();
})
.catch((e) => logLine(`launch failed: ${e.detail || JSON.stringify(e)}`));
}
function launchBulk() {
const targets = parseBulkTargets($("targets-bulk").value || "");
if (!targets.length) {
logLine("bulk launch failed: add at least one target");
return;
}
const body = {
targets,
profile: $("profile").value,
authorized: $("authorized").checked,
options: scanOptions(),
};
resetScanView();
logLine(`bulk launch: ${targets.length} target${targets.length === 1 ? "" : "s"}`);
api("/api/scans/bulk", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(body),
})
.then((r) => {
const queued = r.queued || [];
const rejected = r.rejected || [];
currentBulkId = r.bulk_id || null;
if (currentBulkId) {
$("export-cursor").classList.remove("hidden");
$("export-cursor").disabled = false;
pollBulkProgress(currentBulkId);
logLine(`bulk id: ${currentBulkId} (${queued.length} targets queued)`);
}
queued.forEach((q) => logLine(`scan queued: ${q.scan_id} (${q.target})`));
rejected.forEach((rej) => logLine(`skipped: ${rej.target}${rej.reason}`));
logLine(`bulk submitted: ${queued.length} queued, ${rejected.length} skipped`);
if (queued.length) {
currentScanId = queued[0].scan_id;
$("export-md").disabled = false;
$("export-json").disabled = false;
$("cancel").disabled = false;
connectWs(queued[0].scan_id);
logLine(`watching first scan: ${queued[0].target}`);
}
loadRecent();
})
.catch((e) => logLine(`bulk launch failed: ${e.detail || JSON.stringify(e)}`));
}
$("mode-single").addEventListener("click", () => setScanMode("single"));
$("mode-bulk").addEventListener("click", () => setScanMode("bulk"));
$("targets-bulk").addEventListener("input", updateBulkCount);
$("authorized").addEventListener("change", () => {
$("launch").disabled = !$("authorized").checked;
updateLaunchLabel();
});
$("launch").addEventListener("click", () => {
if (scanMode === "bulk") launchBulk();
else launchSingle();
});
$("cancel").addEventListener("click", () => {
if (!currentScanId) return;
api(`/api/scans/${currentScanId}/cancel`, { method: "POST" }).then(() => logLine("cancel requested"));
});
$("export-md").addEventListener("click", () => {
if (!currentScanId) return;
window.open(`/api/scans/${currentScanId}/export?format=md`, "_blank");
});
$("export-json").addEventListener("click", () => {
if (!currentScanId) return;
window.open(`/api/scans/${currentScanId}/export?format=json`, "_blank");
});
$("export-cursor").addEventListener("click", () => {
if (!currentBulkId) return;
window.open(`/api/bulks/${currentBulkId}/export?format=cursor`, "_blank");
});
$("clear").addEventListener("click", () => {
consoleLines = [];
$("console").textContent = "talos@scan:~$";
$("phases").innerHTML = "";
$("findings").innerHTML = "";
});
setScanMode("single");
updateBulkCount();
setHealth();
setInterval(setHealth, 30000);
loadRecent();
+5
View File
@@ -0,0 +1,5 @@
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" role="img" aria-label="TALOS">
<rect width="32" height="32" rx="7" fill="#0d0f12"/>
<path d="M16 4L6 8v8c0 6.2 4.3 12 10 14 5.7-2 10-7.8 10-14V8L16 4z" fill="#e8500a"/>
<path d="M16 9v14M11 14h10" stroke="#0d0f12" stroke-width="2.2" stroke-linecap="round"/>
</svg>

After

Width:  |  Height:  |  Size: 331 B

+110
View File
@@ -0,0 +1,110 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>TALOS</title>
<link rel="icon" href="/static/favicon.svg" type="image/svg+xml" />
<link rel="apple-touch-icon" href="/static/favicon.svg" />
<link rel="preconnect" href="https://fonts.googleapis.com" />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600&family=JetBrains+Mono:wght@400;700&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="/static/styles.css" />
</head>
<body class="talos-body">
<header class="header-bar">
<div class="brand">
<img src="/static/favicon.svg" alt="" class="brand-icon" width="28" height="28" />
<div class="logo">TALOS</div>
</div>
<div class="health-badges">
<span id="ollama-badge" class="badge">Ollama: …</span>
<span id="tools-badge" class="badge">Tools: …</span>
</div>
</header>
<div class="layout">
<aside class="sidebar">
<section class="panel">
<h2>New scan</h2>
<div class="scan-mode" role="tablist" aria-label="Scan mode">
<button type="button" id="mode-single" class="mode-btn active" data-mode="single">Single</button>
<button type="button" id="mode-bulk" class="mode-btn" data-mode="bulk">Bulk</button>
</div>
<div id="single-target" class="target-panel">
<label for="target">Target</label>
<input id="target" type="text" placeholder="IP, hostname, or URL" />
</div>
<div id="bulk-target" class="target-panel hidden">
<div class="bulk-label-row">
<label for="targets-bulk">Targets</label>
<span id="bulk-count" class="bulk-count">0 targets</span>
</div>
<textarea
id="targets-bulk"
rows="7"
spellcheck="false"
placeholder="example.com&#10;https://app.example.com&#10;1.2.3.4&#10;# lines starting with # are ignored"
></textarea>
<p class="bulk-hint">One target per line. Blank lines and <code>#</code> comments are ignored.</p>
</div>
<label for="profile">Profile</label>
<select id="profile">
<option value="passive">Passive Recon</option>
<option value="standard" selected>Standard Pentest</option>
<option value="redteam">Full Red Team</option>
</select>
<label class="checkbox-row">
<input type="checkbox" id="opt-web" checked /> Web tools
</label>
<label class="checkbox-row">
<input type="checkbox" id="opt-ssl" checked /> SSL (testssl)
</label>
<label class="checkbox-row">
<input type="checkbox" id="opt-brute" /> SSH brute (red team)
</label>
<label class="auth-row">
<input type="checkbox" id="authorized" />
I confirm I own this target or have written authorization to test it. Unauthorized testing is a crime.
</label>
<button id="launch" class="btn-launch" disabled>Launch scan</button>
</section>
<section class="panel recent">
<h2>Recent scans</h2>
<ul id="recent-list"></ul>
</section>
</aside>
<main class="main">
<div class="console-wrap panel">
<div class="console-header">
<span>Live Console</span>
<label class="checkbox-row"><input type="checkbox" id="pause-scroll" /> Pause autoscroll</label>
</div>
<pre id="console" class="console"><span class="prompt">talos@scan:~$</span> waiting…</pre>
</div>
<div class="panel">
<h2>Phases</h2>
<ul id="phases" class="phases-list"></ul>
</div>
<div class="panel">
<h2>Findings</h2>
<div id="severity-tabs" class="severity-tabs"></div>
<div id="findings"></div>
</div>
<div id="bulk-progress" class="bulk-progress hidden">
<span id="bulk-progress-text">Bulk: —</span>
</div>
<div class="actions">
<button id="export-md" class="btn-secondary" disabled>Export MD</button>
<button id="export-json" class="btn-secondary" disabled>Export JSON</button>
<button id="export-cursor" class="btn-secondary hidden" disabled>Export for Cursor</button>
<button id="cancel" class="btn-danger" disabled>Cancel</button>
<button id="clear" class="btn-secondary">Clear</button>
</div>
</main>
</div>
<script src="/static/app.js"></script>
</body>
</html>
+240
View File
@@ -0,0 +1,240 @@
:root {
--bg: #0d0f12;
--surface: #131619;
--accent: #e8500a;
--text: #e8eaed;
--muted: #9ca3af;
--critical: #e83a3a;
--high: #ff6420;
--medium: #e8b20a;
--low: #3db87a;
--info: #6b7280;
--code-bg: #0a0c0f;
--code-text: #a6e22e;
}
* { box-sizing: border-box; }
body.talos-body {
margin: 0;
background: var(--bg);
color: var(--text);
font-family: Inter, system-ui, sans-serif;
min-height: 100vh;
}
h1, h2, .logo, .console, code { font-family: "JetBrains Mono", monospace; }
.header-bar {
display: flex;
justify-content: space-between;
align-items: center;
padding: 0.75rem 1.5rem;
background: var(--surface);
border-bottom: 1px solid #1f2429;
}
.brand {
display: flex;
align-items: center;
gap: 0.6rem;
}
.brand-icon { display: block; }
.logo { font-weight: 700; color: var(--accent); letter-spacing: 0.08em; }
.badge { margin-left: 1rem; font-size: 0.85rem; color: var(--muted); }
.badge.ok { color: var(--low); }
.badge.down { color: var(--critical); }
.layout { display: flex; min-height: calc(100vh - 52px); }
.sidebar {
width: 340px;
flex-shrink: 0;
padding: 1rem;
border-right: 1px solid #1f2429;
overflow-y: auto;
}
.main { flex: 1; padding: 1rem; overflow-y: auto; }
.panel {
background: var(--surface);
border-radius: 8px;
padding: 1rem;
margin-bottom: 1rem;
border: 1px solid #1f2429;
}
.panel h2 { font-size: 0.9rem; margin: 0 0 0.75rem; color: var(--accent); }
label { display: block; font-size: 0.8rem; color: var(--muted); margin: 0.5rem 0 0.25rem; }
input[type="text"],
select,
textarea {
width: 100%;
background: var(--code-bg);
border: 1px solid #2a3038;
color: var(--text);
padding: 0.5rem;
border-radius: 4px;
font-family: "JetBrains Mono", monospace;
font-size: 0.8rem;
}
input[type="text"]:focus,
select:focus,
textarea:focus {
outline: none;
border-color: var(--accent);
box-shadow: 0 0 0 1px rgba(232, 80, 10, 0.35);
}
textarea {
min-height: 8.5rem;
resize: vertical;
line-height: 1.45;
}
textarea::placeholder,
input::placeholder {
color: #5f6672;
}
.checkbox-row, .auth-row { display: flex; gap: 0.5rem; align-items: flex-start; font-size: 0.75rem; color: var(--muted); margin-top: 0.5rem; }
.auth-row { color: #f0ad4e; }
.btn-launch {
width: 100%;
margin-top: 1rem;
padding: 0.75rem;
background: var(--accent);
border: none;
color: #fff;
font-weight: 700;
border-radius: 6px;
cursor: pointer;
}
.btn-launch:disabled { opacity: 0.4; cursor: not-allowed; }
.btn-secondary, .btn-danger {
padding: 0.5rem 1rem;
border-radius: 4px;
border: 1px solid #2a3038;
background: var(--surface);
color: var(--text);
cursor: pointer;
margin-right: 0.5rem;
}
.btn-danger { border-color: var(--critical); color: var(--critical); }
.actions { margin-top: 0.5rem; }
.console-wrap { min-height: 220px; }
.console-header { display: flex; justify-content: space-between; margin-bottom: 0.5rem; font-size: 0.85rem; }
.console {
background: var(--code-bg);
border-left: 3px solid var(--accent);
color: var(--code-text);
padding: 0.75rem;
max-height: 320px;
overflow-y: auto;
font-size: 0.75rem;
white-space: pre-wrap;
margin: 0;
}
.prompt { color: var(--accent); }
.phases-list { list-style: none; padding: 0; margin: 0; }
.phases-list li {
display: flex;
justify-content: space-between;
padding: 0.35rem 0;
border-bottom: 1px solid #1f2429;
font-size: 0.85rem;
}
.phase-running { color: var(--medium); }
.phase-complete { color: var(--low); }
.phase-failed { color: var(--critical); }
.phase-blocked { color: var(--info); }
.phase-inconclusive { color: var(--info); }
.scan-mode {
display: grid;
grid-template-columns: 1fr 1fr;
gap: 0.35rem;
margin: 0.25rem 0 0.75rem;
padding: 0.25rem;
background: var(--code-bg);
border: 1px solid #2a3038;
border-radius: 6px;
}
.mode-btn {
border: none;
background: transparent;
color: var(--muted);
padding: 0.45rem 0.5rem;
border-radius: 4px;
font-size: 0.8rem;
font-weight: 600;
cursor: pointer;
transition: background 0.15s, color 0.15s;
}
.mode-btn:hover { color: var(--text); }
.mode-btn.active {
background: var(--accent);
color: #fff;
}
.target-panel.hidden { display: none; }
.bulk-label-row {
display: flex;
justify-content: space-between;
align-items: baseline;
gap: 0.5rem;
}
.bulk-label-row label { margin-top: 0; }
.bulk-count {
font-size: 0.72rem;
color: var(--accent);
font-family: "JetBrains Mono", monospace;
white-space: nowrap;
}
.bulk-hint {
margin: 0.35rem 0 0;
font-size: 0.72rem;
color: var(--muted);
line-height: 1.4;
}
.bulk-hint code {
font-family: "JetBrains Mono", monospace;
color: var(--code-text);
font-size: 0.7rem;
}
.bulk-progress {
margin: 0 0 0.75rem;
padding: 0.55rem 0.75rem;
border: 1px solid #2a3138;
border-radius: 6px;
font-family: "JetBrains Mono", monospace;
font-size: 0.78rem;
color: var(--accent);
background: #12161a;
}
.bulk-progress.hidden { display: none; }
#recent-list { list-style: none; padding: 0; margin: 0; }
#recent-list li {
padding: 0.4rem 0;
cursor: pointer;
font-size: 0.8rem;
border-bottom: 1px solid #1f2429;
}
#recent-list li:hover { color: var(--accent); }
.finding-card {
border: 1px solid #2a3038;
border-radius: 6px;
padding: 0.75rem;
margin-bottom: 0.5rem;
}
.severity-chip {
display: inline-block;
font-size: 0.7rem;
font-weight: 700;
padding: 0.15rem 0.5rem;
border-radius: 4px;
text-transform: uppercase;
margin-bottom: 0.35rem;
}
.sev-critical { background: var(--critical); color: #fff; }
.sev-high { background: var(--high); color: #fff; }
.sev-medium { background: var(--medium); color: #111; }
.sev-low { background: var(--low); color: #111; }
.sev-info { background: var(--info); color: #fff; }
.evidence { font-size: 0.75rem; color: var(--muted); margin-top: 0.5rem; display: none; }
.finding-card.open .evidence { display: block; }