secureCodeBox / secureCodeBox/secureCodeBox

Integrate interaction server as active service into SCB

Open
#995 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation enhancement
Dominant language
Go
Stars
988
Forks
184
Avg merge
1d 23h
Merged PRs (30d)
42

Description

➹ New Feature implementation request

Integrate an interaction server like interactsh into the SCB

Is your feature request related to a problem?

Some scanners (e.g., Nuclei) require an interaction server to validate their findings. As a user, I may not want to use an external interaction service, as this will disclose my vulnerabilities to the operator of that server.

Describe the solution you'd like

Integrate an interaction server like interactsh into the secureCodeBox, which can be run as a service alongside the scans.

Describe alternatives you've considered

Not have an interaction service and rely on people running it themselves :(

Additional context

Considerations for a deployment which may inform the design:

  • Ideally, we'd probably want a single interaction service per operator, not one per namespace, as I think each interaction server needs a domain to itself
  • Consider what happens if kubernetes network policies are in place to separate namespaces.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the interactsh project and secureCodeBox’s scan deployment and service entry points, then trace how Nuclei scans are configured. Define how one operator-scoped interaction service, its domain, and Kubernetes network-policy considerations should work; done means scans can use the integrated service without an external interaction provider.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.