chore: initialize project workspace and install frontend dependencies

2026-07-17 01:11:49 +01:00
commit bfa3a5c54a
29 changed files with 2845 additions and 0 deletions
@@ -0,0 +1,165 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"nucleus/internal/db"
+	"nucleus/internal/models"
+	"nucleus/internal/runner"
+	"nucleus/internal/scheduler"
+)
+
+func RegisterRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("GET /api/targets", getTargets)
+	mux.HandleFunc("POST /api/targets", createTarget)
+	mux.HandleFunc("DELETE /api/targets/{id}", deleteTarget)
+	mux.HandleFunc("POST /api/targets/{id}/scan", triggerScan)
+	mux.HandleFunc("GET /api/scans", getScans)
+	mux.HandleFunc("GET /api/scans/{id}/findings", getFindings)
+}
+
+func getTargets(w http.ResponseWriter, r *http.Request) {
+	rows, err := db.DB.Query("SELECT id, name, address, schedule, last_scan_at, created_at FROM targets ORDER BY created_at DESC")
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	defer rows.Close()
+
+	var targets []models.Target
+	for rows.Next() {
+		var t models.Target
+		rows.Scan(&t.ID, &t.Name, &t.Address, &t.Schedule, &t.LastScanAt, &t.CreatedAt)
+		targets = append(targets, t)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(targets)
+}
+
+func createTarget(w http.ResponseWriter, r *http.Request) {
+	var t models.Target
+	if err := json.NewDecoder(r.Body).Decode(&t); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	res, err := db.DB.Exec("INSERT INTO targets (name, address, schedule) VALUES (?, ?, ?)", t.Name, t.Address, t.Schedule)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	id, _ := res.LastInsertId()
+	t.ID = int(id)
+
+	scheduler.ReloadScheduler()
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(t)
+}
+
+func deleteTarget(w http.ResponseWriter, r *http.Request) {
+	idStr := r.PathValue("id")
+	id, err := strconv.Atoi(idStr)
+	if err != nil {
+		http.Error(w, "invalid id", http.StatusBadRequest)
+		return
+	}
+
+	_, err = db.DB.Exec("DELETE FROM targets WHERE id = ?", id)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	scheduler.ReloadScheduler()
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func triggerScan(w http.ResponseWriter, r *http.Request) {
+	idStr := r.PathValue("id")
+	id, err := strconv.Atoi(idStr)
+	if err != nil {
+		http.Error(w, "invalid id", http.StatusBadRequest)
+		return
+	}
+
+	// Run async
+	go runner.RunScan(id, true)
+
+	w.WriteHeader(http.StatusAccepted)
+	w.Write([]byte(`{"message": "scan triggered"}`))
+}
+
+func getScans(w http.ResponseWriter, r *http.Request) {
+	rows, err := db.DB.Query(`
+		SELECT s.id, s.target_id, t.name, s.status, s.started_at, s.completed_at
+		FROM scans s
+		JOIN targets t ON s.target_id = t.id
+		ORDER BY s.started_at DESC
+		LIMIT 100
+	`)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	defer rows.Close()
+
+	var scans []models.Scan
+	for rows.Next() {
+		var s models.Scan
+		rows.Scan(&s.ID, &s.TargetID, &s.TargetName, &s.Status, &s.StartedAt, &s.CompletedAt)
+		
+		// Query findings counts by severity
+		counts := make(map[string]int)
+		fRows, err := db.DB.Query("SELECT severity, COUNT(*) FROM findings WHERE scan_id = ? GROUP BY severity", s.ID)
+		if err == nil {
+			for fRows.Next() {
+				var sev string
+				var count int
+				fRows.Scan(&sev, &count)
+				counts[sev] = count
+			}
+			fRows.Close()
+		}
+		s.FindingCounts = counts
+
+		scans = append(scans, s)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(scans)
+}
+
+func getFindings(w http.ResponseWriter, r *http.Request) {
+	idStr := r.PathValue("id")
+	id, err := strconv.Atoi(idStr)
+	if err != nil {
+		http.Error(w, "invalid id", http.StatusBadRequest)
+		return
+	}
+
+	rows, err := db.DB.Query("SELECT id, scan_id, template_id, name, severity, host, matched_at, description, detected_at FROM findings WHERE scan_id = ? ORDER BY detected_at DESC", id)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	defer rows.Close()
+
+	var findings []models.Finding
+	for rows.Next() {
+		var f models.Finding
+		rows.Scan(&f.ID, &f.ScanID, &f.TemplateID, &f.Name, &f.Severity, &f.Host, &f.MatchedAt, &f.Description, &f.DetectedAt)
+		findings = append(findings, f)
+	}
+	
+	if findings == nil {
+		findings = []models.Finding{} // return empty array instead of null
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(findings)
+}
@@ -0,0 +1,35 @@
+package db
+
+import (
+	"database/sql"
+	"log"
+
+	_ "github.com/mattn/go-sqlite3"
+)
+
+var DB *sql.DB
+
+func InitDB(filepath string) {
+	var err error
+	DB, err = sql.Open("sqlite3", filepath)
+	if err != nil {
+		log.Fatal("Failed to open database:", err)
+	}
+
+	if err = DB.Ping(); err != nil {
+		log.Fatal("Failed to ping database:", err)
+	}
+
+	_, err = DB.Exec(Schema)
+	if err != nil {
+		log.Fatal("Failed to create schema:", err)
+	}
+	
+	// Enable foreign keys
+	_, err = DB.Exec("PRAGMA foreign_keys = ON;")
+	if err != nil {
+		log.Println("Warning: Failed to enable foreign keys:", err)
+	}
+	
+	log.Println("Database initialized successfully at", filepath)
+}
@@ -0,0 +1,34 @@
+package db
+
+const Schema = `
+CREATE TABLE IF NOT EXISTS targets (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	name TEXT NOT NULL,
+	address TEXT NOT NULL,
+	schedule TEXT NOT NULL,
+	last_scan_at DATETIME,
+	created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS scans (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	target_id INTEGER NOT NULL,
+	status TEXT NOT NULL,
+	started_at DATETIME,
+	completed_at DATETIME,
+	FOREIGN KEY(target_id) REFERENCES targets(id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS findings (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	scan_id INTEGER NOT NULL,
+	template_id TEXT NOT NULL,
+	name TEXT,
+	severity TEXT,
+	host TEXT,
+	matched_at TEXT,
+	description TEXT,
+	detected_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+	FOREIGN KEY(scan_id) REFERENCES scans(id) ON DELETE CASCADE
+);
+`
@@ -0,0 +1,76 @@
+package mailer
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"net/smtp"
+	"os"
+
+	"nucleus/internal/models"
+)
+
+func SendReport(target models.Target, findings []models.Finding) {
+	host := os.Getenv("SMTP_HOST")
+	port := os.Getenv("SMTP_PORT")
+	if host == "" || port == "" {
+		log.Println("SMTP_HOST or SMTP_PORT not set, skipping email report.")
+		return
+	}
+
+	user := os.Getenv("SMTP_USER")
+	pass := os.Getenv("SMTP_PASS")
+	from := os.Getenv("SMTP_FROM")
+	to := os.Getenv("SMTP_TO")
+
+	if from == "" || to == "" {
+		log.Println("SMTP_FROM or SMTP_TO not set, skipping email report.")
+		return
+	}
+
+	var auth smtp.Auth
+	if user != "" && pass != "" {
+		auth = smtp.PlainAuth("", user, pass, host)
+	}
+
+	subject := fmt.Sprintf("Nucleus Scan Report: %s", target.Name)
+
+	var body bytes.Buffer
+	body.WriteString(fmt.Sprintf("To: %s\r\n", to))
+	body.WriteString(fmt.Sprintf("From: %s\r\n", from))
+	body.WriteString(fmt.Sprintf("Subject: %s\r\n", subject))
+	body.WriteString("Content-Type: text/html; charset=UTF-8\r\n\r\n")
+
+	body.WriteString("<html><body style='font-family: sans-serif;'>")
+	body.WriteString(fmt.Sprintf("<h2>Scan Report for %s (%s)</h2>", target.Name, target.Address))
+	body.WriteString("<p>The scheduled Nuclei scan has completed.</p>")
+	
+	if len(findings) == 0 {
+		body.WriteString("<p>No findings were detected.</p>")
+	} else {
+		body.WriteString("<table border='1' cellpadding='5' style='border-collapse: collapse; width: 100%;'>")
+		body.WriteString("<tr style='background-color: #f2f2f2; text-align: left;'><th>Severity</th><th>Name</th><th>Host</th><th>Template</th></tr>")
+		for _, f := range findings {
+			color := "#ffffff"
+			switch f.Severity {
+			case "critical": color = "#ffcccc"
+			case "high": color = "#ffe6cc"
+			case "medium": color = "#ffffcc"
+			case "low": color = "#e6f2ff"
+			case "info": color = "#f2f2f2"
+			}
+			body.WriteString(fmt.Sprintf("<tr style='background-color: %s;'><td><strong>%s</strong></td><td>%s</td><td>%s</td><td>%s</td></tr>", color, f.Severity, f.Name, f.Host, f.TemplateID))
+		}
+		body.WriteString("</table>")
+	}
+
+	body.WriteString("</body></html>")
+
+	addr := fmt.Sprintf("%s:%s", host, port)
+	err := smtp.SendMail(addr, auth, from, []string{to}, body.Bytes())
+	if err != nil {
+		log.Printf("Failed to send email report: %v", err)
+	} else {
+		log.Println("Successfully sent email report for target", target.Name)
+	}
+}
@@ -0,0 +1,47 @@
+package models
+
+import "time"
+
+type Target struct {
+	ID         int        `json:"id"`
+	Name       string     `json:"name"`
+	Address    string     `json:"address"`
+	Schedule   string     `json:"schedule"`
+	LastScanAt *time.Time `json:"last_scan_at"`
+	CreatedAt  time.Time  `json:"created_at"`
+}
+
+type Scan struct {
+	ID          int        `json:"id"`
+	TargetID    int        `json:"target_id"`
+	TargetName  string     `json:"target_name"` // For UI
+	Status      string     `json:"status"`      // "running", "completed", "failed"
+	StartedAt   time.Time  `json:"started_at"`
+	CompletedAt *time.Time `json:"completed_at"`
+	FindingCounts map[string]int `json:"finding_counts,omitempty"` // aggregated by severity
+}
+
+type Finding struct {
+	ID          int       `json:"id"`
+	ScanID      int       `json:"scan_id"`
+	TemplateID  string    `json:"template_id"`
+	Name        string    `json:"name"`
+	Severity    string    `json:"severity"`
+	Host        string    `json:"host"`
+	MatchedAt   string    `json:"matched_at"`
+	Description string    `json:"description"`
+	DetectedAt  time.Time `json:"detected_at"`
+}
+
+// Nuclei JSONL Output Structure (Partial for what we need)
+type NucleiFinding struct {
+	TemplateID string `json:"template-id"`
+	Info       struct {
+		Name        string `json:"name"`
+		Severity    string `json:"severity"`
+		Description string `json:"description"`
+	} `json:"info"`
+	Host      string `json:"host"`
+	MatchedAt string `json:"matched-at"`
+	Timestamp string `json:"timestamp"`
+}
@@ -0,0 +1,100 @@
+package runner
+
+import (
+	"bufio"
+	"encoding/json"
+	"log"
+	"os/exec"
+	"time"
+
+	"nucleus/internal/db"
+	"nucleus/internal/mailer"
+	"nucleus/internal/models"
+)
+
+func RunScan(targetID int, isManual bool) {
+	// 1. Get Target
+	row := db.DB.QueryRow("SELECT id, name, address, schedule FROM targets WHERE id = ?", targetID)
+	var t models.Target
+	err := row.Scan(&t.ID, &t.Name, &t.Address, &t.Schedule)
+	if err != nil {
+		log.Println("Failed to find target for scan:", err)
+		return
+	}
+
+	// 2. Create Scan Record
+	res, err := db.DB.Exec("INSERT INTO scans (target_id, status, started_at) VALUES (?, 'running', ?)", t.ID, time.Now())
+	if err != nil {
+		log.Println("Failed to create scan record:", err)
+		return
+	}
+	scanID, _ := res.LastInsertId()
+
+	// 3. Update target last_scan_at
+	db.DB.Exec("UPDATE targets SET last_scan_at = ? WHERE id = ?", time.Now(), t.ID)
+
+	// 4. Run Nuclei
+	cmd := exec.Command("nuclei", "-target", t.Address, "-jsonl", "-silent")
+	
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		log.Println("Failed to get stdout pipe:", err)
+		db.DB.Exec("UPDATE scans SET status = 'failed', completed_at = ? WHERE id = ?", time.Now(), scanID)
+		return
+	}
+
+	if err := cmd.Start(); err != nil {
+		log.Println("Failed to start nuclei:", err)
+		db.DB.Exec("UPDATE scans SET status = 'failed', completed_at = ? WHERE id = ?", time.Now(), scanID)
+		return
+	}
+
+	var findings []models.Finding
+	hasMediumOrHigher := false
+
+	scanner := bufio.NewScanner(stdout)
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		var nf models.NucleiFinding
+		if err := json.Unmarshal(line, &nf); err == nil {
+			// Insert finding
+			res, err := db.DB.Exec(`
+				INSERT INTO findings (scan_id, template_id, name, severity, host, matched_at, description)
+				VALUES (?, ?, ?, ?, ?, ?, ?)
+			`, scanID, nf.TemplateID, nf.Info.Name, nf.Info.Severity, nf.Host, nf.MatchedAt, nf.Info.Description)
+			
+			if err == nil {
+				fid, _ := res.LastInsertId()
+				f := models.Finding{
+					ID:          int(fid),
+					ScanID:      int(scanID),
+					TemplateID:  nf.TemplateID,
+					Name:        nf.Info.Name,
+					Severity:    nf.Info.Severity,
+					Host:        nf.Host,
+					MatchedAt:   nf.MatchedAt,
+					Description: nf.Info.Description,
+				}
+				findings = append(findings, f)
+				
+				if f.Severity == "critical" || f.Severity == "high" || f.Severity == "medium" {
+					hasMediumOrHigher = true
+				}
+			}
+		}
+	}
+
+	err = cmd.Wait()
+	status := "completed"
+	if err != nil {
+		log.Println("Nuclei finished with error:", err)
+		status = "failed"
+	}
+
+	db.DB.Exec("UPDATE scans SET status = ?, completed_at = ? WHERE id = ?", status, time.Now(), scanID)
+
+	// Send Email Report if manual or has medium+ severity
+	if isManual || hasMediumOrHigher {
+		mailer.SendReport(t, findings)
+	}
+}
@@ -0,0 +1,53 @@
+package scheduler
+
+import (
+	"log"
+
+	"github.com/robfig/cron/v3"
+
+	"nucleus/internal/db"
+	"nucleus/internal/models"
+	"nucleus/internal/runner"
+)
+
+var c *cron.Cron
+
+func InitScheduler() {
+	c = cron.New()
+	
+	// Load all targets
+	rows, err := db.DB.Query("SELECT id, name, address, schedule FROM targets")
+	if err != nil {
+		log.Fatal("Failed to load targets for scheduler:", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var t models.Target
+		if err := rows.Scan(&t.ID, &t.Name, &t.Address, &t.Schedule); err != nil {
+			continue
+		}
+		
+		if t.Schedule != "" && t.Schedule != "manual" {
+			AddJob(t)
+		}
+	}
+
+	c.Start()
+	log.Println("Scheduler started successfully")
+}
+
+func AddJob(t models.Target) {
+	_, err := c.AddFunc(t.Schedule, func() {
+		log.Printf("Triggering scheduled scan for target %s (%s)", t.Name, t.Address)
+		runner.RunScan(t.ID, false)
+	})
+	if err != nil {
+		log.Printf("Failed to schedule target %s: %v", t.Name, err)
+	}
+}
+
+func ReloadScheduler() {
+	c.Stop()
+	InitScheduler()
+}