types

type App ¶

type App interface {
	Run()
	RegisterNotificationHandler(Notifier)
	GetTemplateData() map[string]string
	Reload() error
}

type BaseEvent ¶

type BaseEvent struct {
	RemoteAddr       string
	RemotePortNumber int
	UserAgentString  string
	RawData          []byte
}

func (e *BaseEvent) Data() string

func (e *BaseEvent) Details() string

func (e *BaseEvent) Dispatch(cc chan InteractionEvent)

func (e *BaseEvent) FilterString() string

func (e *BaseEvent) RemoteIP() string

func (e *BaseEvent) RemotePort() int

func (e *BaseEvent) UserAgent() string

type ConfigAware ¶ added in v0.1.3

type ConfigAware interface {
	SetConfigOps(ConfigOps)
}

ConfigAware is implemented by handlers that expose a config management API. The app injects a ConfigOps after construction.

type ConfigFile ¶ added in v0.1.3

type ConfigFile struct {
	Defaults  map[string]string   `yaml:"defaults"  json:"defaults"`
	Handlers  []map[string]string `yaml:"handlers"  json:"handlers"`
	Notifiers []map[string]string `yaml:"notifiers" json:"notifiers"`
	Workers   []map[string]string `yaml:"workers"   json:"workers"`
}

ConfigFile is the deserialized YAML config. It lives in types so packages on both sides of the handler↔app boundary can reference it without cycles.

type ConfigOps ¶ added in v0.1.3

type ConfigOps interface {
	FilePath() string
	Read() (*ConfigFile, error)
	Write(cf *ConfigFile) error
	Validate(cf *ConfigFile) []string
	HandlerNames() []string
	NotifierNames() []string
	WorkerNames() []string
}

ConfigOps provides config file operations to handlers that expose a management API (the HTTPX admin console). Implemented by the xodbox package and injected into the handler at construction time.

type CurlProvider ¶ added in v0.0.24

type CurlProvider interface {
	CurlCommand() string
}

CurlProvider is an optional interface implemented by events that can render a curl command reproducing the captured request (currently HTTP). Notifiers type-assert to it to append a copy-pasteable replay command — useful for turning an SSRF callback into a request you can re-run from the CLI. Events that don't implement it are simply rendered without one.

type FilterBypasser ¶ added in v0.1.6

type FilterBypasser interface {
	BypassFilter() bool
}

FilterBypasser is an optional interface implemented by events that should skip the notifier's regex filter. Sink-hit events implement this because the user explicitly opted in by enabling notifications on the sink — the notifier filter is for routing the general event stream, not for gating explicit opt-in delivery.

type Handler ¶

type Handler interface {
	Name() string
	Start(App, chan InteractionEvent) error
	Stop(ctx context.Context) error
}

Handler is a listening protocol implementation (HTTP, SMTP, DNS, ...). Start blocks serving requests; Stop should release the listening socket and any goroutines the handler owns. ctx provides a deadline for in-flight requests to drain. Stop must be safe to call even if Start was never invoked or has already returned.

type InteractionEvent ¶

type InteractionEvent interface {
	Details() string
	RemoteIP() string
	RemotePort() int
	UserAgent() string
	Data() string
	// FilterString returns the canonical, handler-labelled string a
	// notifier's Filter regex is matched against. It has the shape
	// "HANDLER ACTION DETAIL from IP[,IP...]" (e.g. "SMB Auth CORP\\alice
	// from 10.0.0.5"), so a single regex can select across every handler
	// (e.g. "^SMB Auth", "^DNS (A|AAAA) .*\\.evil\\.com"). The trailing IP
	// list is the unique source chain (X-Forwarded-For + peer for HTTP).
	FilterString() string
	Dispatch(cc chan InteractionEvent)
}

type Notifier ¶

type Notifier interface {
	Name() string
	Send(InteractionEvent) error
	Filter() *regexp.Regexp
}

type NotifierBase ¶

type NotifierBase struct {
	Name   string
	Filter string
}

type NotifierChat ¶

type NotifierChat struct {
	NotifierWebhook
	Channel   string
	User      string
	UserImage string
}

type NotifierWebhook ¶

type NotifierWebhook struct {
	NotifierBase
	URL string
}

type NotifySuppressor ¶ added in v0.1.0

type NotifySuppressor interface {
	NotifySuppressed() bool
}

NotifySuppressor is implemented by events that should still be persisted but skip notifier delivery. httpx uses this to suppress suspected bots (high request volume): the traffic is still recorded in the DB / Events log, but notifiers stay quiet so a scanner doesn't flood Slack/webhooks.

type Persistable ¶ added in v0.1.0

type Persistable interface {
	Interaction() *model.Interaction
}

Persistable is implemented by interaction events that can be stored as a model.Interaction. The application's event loop persists every event that implements this interface (see pkg/xodbox), so a handler only has to build the record — it never touches the database directly. Returning nil skips persistence for that particular event.

type Seeder ¶ added in v0.0.22

type Seeder interface {
	Seed() error
}

Seeder is an optional interface implemented by handlers that need to populate their own database state (e.g. payload templates) before any requests are served. App.Run calls Seed on each implementing handler exactly once, after the DB is connected and before any Start. Seed must be idempotent.

type SinkHitProvider ¶ added in v0.1.5

type SinkHitProvider interface {
	SinkSlug() string
	SinkDescription() string
	SinkLink() string
}

SinkHitProvider is an optional interface implemented by events that represent a sink hit — an inbound interaction matching a notify-enabled sink. Notifiers type-assert to it for enriched formatting (sink slug, description, and a link to the sink).

type Worker ¶ added in v0.1.3

type Worker interface {
	Name() string
	Schedule() string
	Run(ctx context.Context) error
}

Worker is a periodic background job managed by the workflow engine. Schedule is a robfig/cron v3 expression: standard 5-field cron ("0 2 * * *"), shorthand ("@daily"), or interval ("@every 1h"). Run is called once per tick; ctx is cancelled on shutdown. An error is logged but does not stop future ticks.