Claude/cybersecurity toolbox p1 axzo m - #1
Merged
Conversation
Sets up a Next.js (App Router) + TypeScript + Tailwind project on a tool-
registry architecture so additional tools can be added by dropping a registry
entry, a UI page, and an API route — no restructuring required.
Misconfig Mapper (OWASP A05) is the first tool. It runs server-side from a
Node runtime API route and reports on:
- Security headers (CSP, HSTS, XFO/frame-ancestors, nosniff, Referrer-
Policy, Permissions-Policy)
- Information-disclosure headers (Server, X-Powered-By, ASP.NET versions)
- Cookie hygiene (Secure, HttpOnly, SameSite)
- File-exposure probes (.git/HEAD, .git/config, .env, .DS_Store,
/server-status)
Safety:
- SSRF guard resolves user-supplied hostnames and rejects loopback,
RFC1918, link-local, CGNAT, multicast, broadcast, AWS metadata, and
IPv6 loopback/ULA/link-local. Redirects are followed manually with the
guard re-applied at every hop.
- Per-IP in-memory rate limit (12/min) on the API route.
- Response bodies capped at 256 KB; per-request timeout 6 s.
A fully client-side JWT decoder + auditor. Tokens never leave the browser:
parsing, analysis, HMAC verification, and the wordlist crack all run via
Web Crypto on the page.
Audit checks (lib/jwt/analyze.ts):
- alg: none / missing / non-standard
- kid injection patterns (path traversal, SQL, NUL, oversized)
- jku / x5u present (external-key trust)
- Embedded jwk in header (key-confusion vector)
- exp / iat / nbf timing
- Long lifetimes (> 24h info, > 30d warn)
- Missing iss / aud / sub
- Sensitive keys in payload (password, secret, ssn, etc.)
Crack (lib/jwt/crack.ts): tries a small embedded wordlist of dev/test
secrets via crypto.subtle HMAC verify against HS256/384/512 tokens.
Verified locally against canonical jwt.io demo (your-256-bit-secret)
and a generated alice/admin token (secret) — both crack in <10ms.
Refactors:
- Lift Finding / Severity / FindingGroup to lib/shared/findings.ts so
every tool uses the same vocabulary.
- Extract FindingsList component; ScanReportView now consumes it.
Tool registry picks up the new tool automatically; the home grid renders
it without further changes.
Sends a battery of Origin probes to a target and classifies the response: - Baseline (no Origin) for reference - Arbitrary cross-origin (reflection check) - Origin: null (sandboxed iframe / file:// spoofable) - Suffix bypass (attacker domain ends with target string) - Prefix bypass (target as subdomain of attacker host) - Subdomain trust (attacker.<target>) - Scheme downgrade (http:// of an https target) - Preflight OPTIONS with Access-Control-Request-Method/Headers Findings highlight the dangerous patterns (reflection + ACAC=true is the critical one that lets any web page read credentialed responses), plus softer hits like Vary: Origin missing on dynamic ACAO. UI shows a probe matrix (sent Origin → received ACAO/ACAC, reflection flag) above the findings list so reviewers can see the raw evidence. Reuses safe-fetch + SSRF guard + rate limiter from prior tools. Verified against httpbin.org (which reflects any Origin with credentials — caught as critical) and rejects RFC1918 targets at the guard.
vercel.json:
- Per-route function maxDuration overrides
- Site-wide security headers — HSTS, XFO=DENY, nosniff,
Referrer-Policy, Permissions-Policy, and a CSP. Pointing Misconfig
Mapper at the deployed site now passes its own checks.
- CSP keeps script-src 'unsafe-inline' because Next.js App Router
injects inline scripts for hydration; nonce-via-middleware is the
follow-up.
TLS / Cert Viewer:
- Two-pass connection: a strict pass with rejectUnauthorized=true
(custom checkServerIdentity to bypass hostname so we can isolate
chain trust) for the trust verdict, and a lenient pass for the
cert chain itself. Earlier rejectUnauthorized=false single-pass
yielded meaningless socket.authorized values.
- Walks the issuerCertificate linked list to materialise the chain.
- Tiny DER parser (lib/tls/der.ts) extracts the signature algorithm
OID (Node's getPeerCertificate doesn't expose it). Maps common
OIDs to readable names (sha256WithRSAEncryption, ecdsa-with-SHA384,
Ed25519, etc.).
- Findings cover chain trust, hostname match (tls.checkServerIdentity),
expiry tiers (<7d fail, <30d warn), weak signature (md5/sha1),
weak RSA (<2048), missing SANs, deprecated TLS versions, and
incomplete chains.
- UI shows leaf/intermediate/root cards with subject, issuer, SANs,
validity, key, signature; trust + hostname-match badges; findings
list.
- Reuses SSRF guard via guardUrl(`https://${host}:${port}`) so the
same private-IP rejections apply.
Verified locally against github.com (TLSv1.3, RSA-2048, sha256, full
chain, trusted) — score 5 pass / 1 warn / 0 fail / 1 info.
Per-tool metadata
- Each tool dir is now a server-component page.tsx that exports
metadata derived from the registry, plus a client-only View.tsx
with the existing UI. Page titles like "JWT Inspector · Cyber
Toolbox" instead of a single global title.
- lib/tools/registry.ts gains SITE constants, baseUrl() (reads
SITE_URL or VERCEL_URL), and toolMetadata(id).
- Layout uses a metadata template so per-page titles compose with
the site name automatically.
CSP nonce via middleware
- middleware.ts issues a per-request 128-bit base64 nonce, sets
Content-Security-Policy on both request and response so Next's
runtime threads it onto inline hydration scripts.
- script-src is now 'self' 'nonce-…' 'strict-dynamic' (plus
'unsafe-eval' in dev for HMR). 'unsafe-inline' is gone.
- vercel.json keeps only the static headers (HSTS, XFO, nosniff,
Referrer-Policy, Permissions-Policy).
SEO + sharing
- app/robots.ts and app/sitemap.ts (force-dynamic so SITE_URL is
read at runtime, not baked at build).
- app/opengraph-image.tsx renders a 1200x630 PNG via Next's edge
ImageResponse — site name, headline, and chips for each live tool.
UX
- Custom 404 page lists live tools.
- CopyButton component on JWT Inspector header / payload / signature
panels — small but high-utility.
- Skip-link to #main anchor for keyboard / SR users.
- Global :focus-visible ring (sky-500 @ 60%).
CI
- .github/workflows/ci.yml: typecheck + lint + build on push and PR.
README
- Documents SITE_URL, the new directory layout, the CSP nonce setup,
and updated "adding a new tool" instructions.
Verified locally: build clean (typecheck + lint + production build),
runtime smoke checks pass (CSP header carries nonce, robots.txt and
sitemap.xml use SITE_URL, OG image serves a 148KB PNG, page titles
compose, custom 404 returns 404).
- Full README rewrite: tools table, Vercel deploy walkthrough (no env
vars required), env var reference, architecture tree, security model
(SSRF guard CIDR list, rate limiter, CSP nonce, body/time caps),
"adding a new tool" recipe, scripts, troubleshooting.
- Add MIT LICENSE.
- engines.node bumped to >=20 to match Vercel's current default
Node runtime.
Pre-flight verified end-to-end against a production build:
- CSP nonce attached to 12/12 inline <script> tags (matches header).
- Misconfig API on example.com → 4 finding groups, score 55.
- CORS API on httpbin.org → 8 probes (correctly fires the critical
reflection-with-credentials finding).
- Cert API on github.com → TLSv1.3, 2-cert chain, authorized=true.
- /jwt-wordlist.json static asset → 200, 1609 bytes.
- /robots.txt and /sitemap.xml → SITE_URL respected at runtime.
- /opengraph-image → 148KB PNG.
- SSRF guard rejects 127.0.0.1 with the expected message.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.