@dhruviii/attack-path 1.0.0

package/src/data/data.json

@@ -0,0 +1,530 @@
+{
+    "nodes": [
+        {
+            "id": "source-3",
+            "type": "source",
+            "data": {
+                "label": "Tata",
+                "type": "Source",
+                "sourceType": "domain",
+                "url": "tatachemicals.com"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "source-1",
+            "type": "source",
+            "data": {
+                "label": "CoronaRemedies",
+                "type": "Source",
+                "sourceType": "domain",
+                "url": "coronaremedies.com"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-44",
+            "type": "asset",
+            "data": {
+                "label": "learning.coronaremedies.com",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "https://learning.coronaremedies.com:443",
+                "riskScore": 41.685330347144465,
+                "sources": [
+                    "CoronaRemedies"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-5",
+            "type": "finding",
+            "data": {
+                "label": "Next.js - Server Side Request Forgery (SSRF)",
+                "attackPathCategory": "Attack-Path Candidate",
+                "attackPathClass": "attack_path_candidate",
+                "confidence": "high",
+                "severity": "high",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "learning.coronaremedies.com",
+                "url": "https://learning.coronaremedies.com:443",
+                "scheme": "https",
+                "port": "443",
+                "ip": "52.66.174.151",
+                "profile": "cve",
+                "templateId": "CVE-2024-34351",
+                "description": "Next.Js, inferior to version 14.1.1, have its image optimization built-in component prone to SSRF.\n",
+                "matchedAt": "https://learning.coronaremedies.com:443/_next/image?w=16&q=10&url=https://d9adthf0ar0s1ei9mo70y8icmwrgoufkt.oast.site",
+                "riskScore": 100,
+                "discoveredAt": "2026-07-13"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-45",
+            "type": "asset",
+            "data": {
+                "label": "learning.coronaremedies.com:3000",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "http://learning.coronaremedies.com:3000",
+                "port": 3000,
+                "riskScore": 40.957446808510646,
+                "sources": [
+                    "CoronaRemedies"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-12",
+            "type": "finding",
+            "data": {
+                "label": "Next.js - Server Side Request Forgery (SSRF)",
+                "attackPathCategory": "Attack-Path Candidate",
+                "attackPathClass": "attack_path_candidate",
+                "confidence": "high",
+                "severity": "high",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "learning.coronaremedies.com",
+                "url": "http://learning.coronaremedies.com:3000",
+                "scheme": "http",
+                "port": "3000",
+                "ip": "52.66.174.151",
+                "profile": "cve",
+                "templateId": "CVE-2024-34351",
+                "description": "Next.Js, inferior to version 14.1.1, have its image optimization built-in component prone to SSRF.\n",
+                "matchedAt": "http://learning.coronaremedies.com:3000/_next/image?w=16&q=10&url=https://d9aevev0ar0scukp15c0q8ymqfh1af8jr.oast.site",
+                "riskScore": 98.54423292273238,
+                "discoveredAt": "2026-07-13"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-142",
+            "type": "asset",
+            "data": {
+                "label": "samarthsarathi.tatachemicals.com",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "https://samarthsarathi.tatachemicals.com:443",
+                "riskScore": 23.180291153415453,
+                "sources": [
+                    "Tata"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-59",
+            "type": "finding",
+            "data": {
+                "label": "Missing Cookie SameSite Strict",
+                "attackPathCategory": "Exposure Signal",
+                "attackPathClass": "exposure_signal",
+                "confidence": "medium",
+                "severity": "info",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "samarthsarathi.tatachemicals.com",
+                "url": "https://samarthsarathi.tatachemicals.com:443",
+                "scheme": "https",
+                "port": "443",
+                "ip": "3.6.46.11",
+                "profile": "misconfig",
+                "templateId": "missing-cookie-samesite-strict",
+                "description": "Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.\n",
+                "matchedAt": "https://samarthsarathi.tatachemicals.com:443",
+                "riskScore": 23.180291153415453,
+                "discoveredAt": "2026-07-18"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-133",
+            "type": "asset",
+            "data": {
+                "label": "digitalmark.tatachemicals.com",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "https://digitalmark.tatachemicals.com:443",
+                "riskScore": 23.180291153415453,
+                "sources": [
+                    "Tata"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-54",
+            "type": "finding",
+            "data": {
+                "label": "Missing Cookie SameSite Strict",
+                "attackPathCategory": "Exposure Signal",
+                "attackPathClass": "exposure_signal",
+                "confidence": "medium",
+                "severity": "info",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "digitalmark.tatachemicals.com",
+                "url": "https://digitalmark.tatachemicals.com:443",
+                "scheme": "https",
+                "port": "443",
+                "ip": "13.126.255.216",
+                "profile": "misconfig",
+                "templateId": "missing-cookie-samesite-strict",
+                "description": "Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.\n",
+                "matchedAt": "https://digitalmark.tatachemicals.com:443",
+                "riskScore": 23.180291153415453,
+                "discoveredAt": "2026-07-18"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-146",
+            "type": "asset",
+            "data": {
+                "label": "trucksetu.tatachemicals.com",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "http://trucksetu.tatachemicals.com:80",
+                "riskScore": 23.180291153415453,
+                "sources": [
+                    "Tata"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-51",
+            "type": "finding",
+            "data": {
+                "label": "Missing Cookie SameSite Strict",
+                "attackPathCategory": "Exposure Signal",
+                "attackPathClass": "exposure_signal",
+                "confidence": "medium",
+                "severity": "info",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "trucksetu.tatachemicals.com",
+                "url": "http://trucksetu.tatachemicals.com:80",
+                "scheme": "http",
+                "port": "80",
+                "ip": "43.204.3.183",
+                "profile": "misconfig",
+                "templateId": "missing-cookie-samesite-strict",
+                "description": "Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.\n",
+                "matchedAt": "http://trucksetu.tatachemicals.com:80",
+                "riskScore": 23.180291153415453,
+                "discoveredAt": "2026-07-18"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-132",
+            "type": "asset",
+            "data": {
+                "label": "his.tatachemicals.com",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "http://his.tatachemicals.com:80",
+                "riskScore": 23.180291153415453,
+                "sources": [
+                    "Tata"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-49",
+            "type": "finding",
+            "data": {
+                "label": "Missing Cookie SameSite Strict",
+                "attackPathCategory": "Exposure Signal",
+                "attackPathClass": "exposure_signal",
+                "confidence": "medium",
+                "severity": "info",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "his.tatachemicals.com",
+                "url": "http://his.tatachemicals.com:80",
+                "scheme": "http",
+                "port": "80",
+                "ip": "13.202.38.60",
+                "profile": "misconfig",
+                "templateId": "missing-cookie-samesite-strict",
+                "description": "Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.\n",
+                "matchedAt": "http://his.tatachemicals.com:80",
+                "riskScore": 23.180291153415453,
+                "discoveredAt": "2026-07-18"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "asset-135",
+            "type": "asset",
+            "data": {
+                "label": "digitaltwins.tatachemicals.com",
+                "assetType": "webapp",
+                "type": "Asset",
+                "url": "https://digitaltwins.tatachemicals.com:443",
+                "riskScore": 23.180291153415453,
+                "sources": [
+                    "Tata"
+                ],
+                "sourceTypes": [
+                    "domain"
+                ]
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-24",
+            "type": "finding",
+            "data": {
+                "label": "Missing Cookie SameSite Strict",
+                "attackPathCategory": "Exposure Signal",
+                "attackPathClass": "exposure_signal",
+                "confidence": "medium",
+                "severity": "info",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "digitaltwins.tatachemicals.com",
+                "url": "https://digitaltwins.tatachemicals.com:443",
+                "scheme": "https",
+                "port": "443",
+                "ip": "13.201.244.85",
+                "profile": "misconfig",
+                "templateId": "missing-cookie-samesite-strict",
+                "description": "Identified cookies that lacked the samesite=strict attribute, which prevented enforcement of restrictions on cross-domain cookie transmission.\n",
+                "matchedAt": "https://digitaltwins.tatachemicals.com:443",
+                "riskScore": 23.180291153415453,
+                "discoveredAt": "2026-07-18"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-4",
+            "type": "finding",
+            "data": {
+                "label": "Next.js Middleware Bypass",
+                "attackPathCategory": "Attack-Path Candidate",
+                "attackPathClass": "attack_path_candidate",
+                "confidence": "high",
+                "severity": "critical",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "learning.coronaremedies.com",
+                "url": "https://learning.coronaremedies.com:443",
+                "scheme": "https",
+                "port": "443",
+                "ip": "52.66.174.151",
+                "profile": "cve",
+                "templateId": "CVE-2025-29927",
+                "description": "Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.\nThe vulnerability allows attackers to bypass middleware security controls by sending a specially crafted\n'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.\n",
+                "matchedAt": "https://learning.coronaremedies.com:443",
+                "riskScore": 16.7973124300112,
+                "discoveredAt": "2026-07-13"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        },
+        {
+            "id": "vuln-11",
+            "type": "finding",
+            "data": {
+                "label": "Next.js Middleware Bypass",
+                "attackPathCategory": "Attack-Path Candidate",
+                "attackPathClass": "attack_path_candidate",
+                "confidence": "high",
+                "severity": "critical",
+                "type": "Vulnerability",
+                "findingType": "vulnerability",
+                "host": "learning.coronaremedies.com",
+                "url": "http://learning.coronaremedies.com:3000",
+                "scheme": "http",
+                "port": "3000",
+                "ip": "52.66.174.151",
+                "profile": "cve",
+                "templateId": "CVE-2025-29927",
+                "description": "Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.\nThe vulnerability allows attackers to bypass middleware security controls by sending a specially crafted\n'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.\n",
+                "matchedAt": "http://learning.coronaremedies.com:3000",
+                "riskScore": 16.013437849944008,
+                "discoveredAt": "2026-07-13"
+            },
+            "position": {
+                "x": 0,
+                "y": 0
+            }
+        }
+    ],
+    "edges": [
+        {
+            "id": "e-source-1-asset-44",
+            "source": "source-1",
+            "target": "asset-44",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-44-vuln-5",
+            "source": "asset-44",
+            "target": "vuln-5",
+            "label": "attack_path_candidate"
+        },
+        {
+            "id": "e-source-1-asset-45",
+            "source": "source-1",
+            "target": "asset-45",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-45-vuln-12",
+            "source": "asset-45",
+            "target": "vuln-12",
+            "label": "attack_path_candidate"
+        },
+        {
+            "id": "e-source-3-asset-142",
+            "source": "source-3",
+            "target": "asset-142",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-142-vuln-59",
+            "source": "asset-142",
+            "target": "vuln-59",
+            "label": "exposes"
+        },
+        {
+            "id": "e-source-3-asset-133",
+            "source": "source-3",
+            "target": "asset-133",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-133-vuln-54",
+            "source": "asset-133",
+            "target": "vuln-54",
+            "label": "exposes"
+        },
+        {
+            "id": "e-source-3-asset-146",
+            "source": "source-3",
+            "target": "asset-146",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-146-vuln-51",
+            "source": "asset-146",
+            "target": "vuln-51",
+            "label": "exposes"
+        },
+        {
+            "id": "e-source-3-asset-132",
+            "source": "source-3",
+            "target": "asset-132",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-132-vuln-49",
+            "source": "asset-132",
+            "target": "vuln-49",
+            "label": "exposes"
+        },
+        {
+            "id": "e-source-3-asset-135",
+            "source": "source-3",
+            "target": "asset-135",
+            "label": "accesses"
+        },
+        {
+            "id": "e-asset-135-vuln-24",
+            "source": "asset-135",
+            "target": "vuln-24",
+            "label": "exposes"
+        },
+        {
+            "id": "e-asset-44-vuln-4",
+            "source": "asset-44",
+            "target": "vuln-4",
+            "label": "attack_path_candidate"
+        },
+        {
+            "id": "e-asset-45-vuln-11",
+            "source": "asset-45",
+            "target": "vuln-11",
+            "label": "attack_path_candidate"
+        }
+    ]
+}

package/src/hooks/usePanZoom.ts

@@ -0,0 +1,97 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+
+export interface Transform { x: number; y: number; k: number; }
+const MIN_K = 0.12;
+const MAX_K = 2.6;
+
+export function usePanZoom(initial: Transform = { x: 0, y: 0, k: 1 }) {
+  const [t, setT] = useState<Transform>(initial);
+  const ref = useRef<HTMLDivElement | null>(null);
+  const drag = useRef<{ x: number; y: number; tx: number; ty: number } | null>(null);
+  const [panning, setPanning] = useState(false);
+  const anim = useRef<number | null>(null);
+
+  const onWheel = useCallback((e: WheelEvent) => {
+    if (!ref.current) return;
+    e.preventDefault();
+    const rect = ref.current.getBoundingClientRect();
+    const mx = e.clientX - rect.left, my = e.clientY - rect.top;
+    setT((p) => {
+      const factor = e.deltaY < 0 ? 1.12 : 1 / 1.12;
+      const nk = Math.min(MAX_K, Math.max(MIN_K, p.k * factor));
+      const s = nk / p.k;
+      return { k: nk, x: mx - (mx - p.x) * s, y: my - (my - p.y) * s };
+    });
+  }, []);
+
+  useEffect(() => {
+    const el = ref.current;
+    if (!el) return;
+    el.addEventListener("wheel", onWheel, { passive: false });
+    return () => el.removeEventListener("wheel", onWheel);
+  }, [onWheel]);
+
+  const onPointerDown = useCallback((e: React.PointerEvent) => {
+    if (e.button !== 0) return;
+    if ((e.target as HTMLElement).closest("[data-node]")) return;
+    drag.current = { x: e.clientX, y: e.clientY, tx: t.x, ty: t.y };
+    setPanning(true);
+    (e.target as HTMLElement).setPointerCapture?.(e.pointerId);
+  }, [t.x, t.y]);
+
+  const onPointerMove = useCallback((e: React.PointerEvent) => {
+    const d = drag.current;
+    if (!d) return;
+
+    setT((p) => ({
+      ...p,
+      x: d.tx + (e.clientX - d.x),
+      y: d.ty + (e.clientY - d.y),
+    }));
+  }, []);
+
+  const onPointerUp = useCallback(() => { drag.current = null; setPanning(false); }, []);
+
+  const zoomBy = useCallback((factor: number) => {
+    if (!ref.current) return;
+    const rect = ref.current.getBoundingClientRect();
+    const mx = rect.width / 2, my = rect.height / 2;
+    setT((p) => {
+      const nk = Math.min(MAX_K, Math.max(MIN_K, p.k * factor));
+      const s = nk / p.k;
+      return { k: nk, x: mx - (mx - p.x) * s, y: my - (my - p.y) * s };
+    });
+  }, []);
+
+  const animateTo = useCallback((target: Transform) => {
+    if (anim.current) cancelAnimationFrame(anim.current);
+    const start = performance.now();
+    const dur = 460;
+    let from: Transform;
+    setT((p) => { from = p; return p; });
+    const step = (now: number) => {
+      const p = Math.min(1, (now - start) / dur);
+      const e = 1 - Math.pow(1 - p, 3);
+      setT({ x: from!.x + (target.x - from!.x) * e, y: from!.y + (target.y - from!.y) * e, k: from!.k + (target.k - from!.k) * e });
+      if (p < 1) anim.current = requestAnimationFrame(step);
+    };
+    anim.current = requestAnimationFrame(step);
+  }, []);
+
+  const fitTo = useCallback((b: { minX: number; minY: number; maxX: number; maxY: number }, pad = 80) => {
+    if (!ref.current) return;
+    const rect = ref.current.getBoundingClientRect();
+    const w = b.maxX - b.minX + pad * 2, h = b.maxY - b.minY + pad * 2;
+    const k = Math.min(MAX_K, Math.max(MIN_K, Math.min(rect.width / w, rect.height / h)));
+    animateTo({ k, x: rect.width / 2 - ((b.minX + b.maxX) / 2) * k, y: rect.height / 2 - ((b.minY + b.maxY) / 2) * k });
+  }, [animateTo]);
+
+  const centerOn = useCallback((x: number, y: number, k?: number) => {
+    if (!ref.current) return;
+    const rect = ref.current.getBoundingClientRect();
+    const nk = k ?? Math.max(t.k, 0.9);
+    animateTo({ k: nk, x: rect.width / 2 - x * nk, y: rect.height / 2 - y * nk });
+  }, [animateTo, t.k]);
+
+  return { t, ref, panning, onPointerDown, onPointerMove, onPointerUp, zoomBy, fitTo, centerOn };
+}