3e8b3e80fd
docs(toolbox): implementation plan — #ads aggregate MITM stats (ref #755 )
2026-06-27 08:54:57 +02:00
fc8248b854
docs(toolbox-ng): implementation plan — targeted SW-neuter (ref #753 )
2026-06-27 08:19:59 +02:00
b3c1db9380
docs(toolbox-ng): design spec — targeted SW-neuter for the R3 banner (ref #753 )
2026-06-27 08:13:13 +02:00
5c12063ca7
docs(cookies): implementation plan — cross-site tracker detection (ref #749 )
2026-06-26 18:04:01 +02:00
11a0bbef66
docs(cookies): design spec — cross-site tracker detection surface (ref #749 )
2026-06-26 17:58:36 +02:00
c6d6eb5c75
Merge #744 : sbxwaf Go WAF engine + shared internal/ core
...
License Headers / check (push) Waiting to run
# Conflicts:
# packages/secubox-toolbox-ng/cmd/sbxmitm/compress_test.go
# packages/secubox-toolbox-ng/cmd/sbxmitm/cosmetic_test.go
# packages/secubox-toolbox-ng/cmd/sbxmitm/gzip.go
# packages/secubox-toolbox-ng/cmd/sbxmitm/gzip_test.go
2026-06-26 16:02:35 +02:00
ccf6d45a08
docs(plan): WAF→Go sbxwaf implementation plan, 10 phases TDD (ref #744 )
2026-06-26 12:04:25 +02:00
6ec92bd29d
docs(spec): WAF→Go bench targets to >5×/p99<⅓, blocking go/no-go (ref #744 )
2026-06-26 11:52:44 +02:00
c01f10c474
docs(wiki): refonte 126 modules — snapshots WebUI déterministes + READMEs 4 langues (ref #742 )
...
Capture des 126 dashboards authentifiés (JWT minté serveur, injection localStorage)
avec attente de COMPLÉTION d'affichage déterministe (sentinelles de chargement
purgées + réseau calmé, plafond --delay) au lieu d'un sleep fixe. 126/126 OK.
- capture-screenshots.py: _wait_content_ready déterministe, mode --token (bypass
login), goto domcontentloaded (plus de stall networkidle sur dashboards live)
- generate-docs.py: 23 modules jusqu'ici non documentés ajoutés (descriptions
réelles depuis debian/control, EN/FR/DE/ZH), licence MIT→LicenseRef-CMSD-1.0,
images wiki en URL raw.githubusercontent absolue (relatif = 404 sur GitHub wiki)
- 126 snapshots + thumbnails régénérés
- 126 READMEs paquet succincts + pages wiki MODULES/CATEGORIES ×4 langues
Gap modules documentés vs découverts: 23 → 0.
2026-06-26 10:14:14 +02:00
0b2094f43f
docs(spec): WAF→Go sbxwaf host-native replacement design (ref #744 )
...
Brainstorming-validated design: perf-driven complete replacement of the WAF
mitmproxy/mitmdump inspection layer by a dedicated host-native Go binary sbxwaf,
sharing an extracted core with sbxmitm. Covers architecture, component isolation,
full feature port (routing/rules/ban/CrowdSec/cookie-audit/media-cache/error
pages), host-native hardening, and shadow→parity→cutover→rollback migration.
2026-06-26 09:31:59 +02:00
6cc3546dc2
docs: tracking + wiki for DPI exfil engine + Netrunner report (2026-06-22)
...
HISTORY/WIP/TODO checkpoint for the session (#687 DPI pipeline, #707 Netrunner
report HTML+PDF, #689/#697 sbxmitm fixes; all merged & live). New wiki page
docs/wiki/DPI-Exfiltration.md + sidebar links (kbin ToolBoX, DPI Exfil + Report).
2026-06-22 13:02:19 +02:00
a870eb380e
feat(toolbox): kbin Tor egress quick-switch — switch + tunnel, DARK (ref #683 )
...
Routes the R3 mitm-wg worker uid's upstream egress + DNS through Tor
(TransPort 9040 / DNSPort 5353) via an nft owner-match table, so MITM
inspection (ad-block/poison/banner/safe-browsing) is fully preserved —
only the exit IP + network identity change. Ships default-OFF, fail-closed.
- filters: tor_mode / tor_preset flags (validated)
- api: GET/POST /admin/tor/{state,on,off,newnym,check-leaks} (kbin-gated)
- tor_ctl.py: reuses secubox-tor control-port logic (status/NEWNYM), no JWT
- tunnel: conf/nft-toolbox-tor.nft (fail-closed kill-switch + v6 drop) +
torrc drop-in + root path-triggered reconciler (portal stays
NoNewPrivileges=true; nft loaded before tor = no clearnet window)
- WebUI: 🧅 Tor tab (badge, toggle, NEWNYM, leak probe)
- packaging: Depends jq; Recommends tor, python3-socksio; postinst adds
secubox-toolbox to debian-tor group; prerm disarms on real removal
- 166 tests green (10 new); toolbox 2.7.1
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-19 12:19:52 +02:00
4c6777dc68
chore(toolbox): 2.7.0 middle release — kbin milestone + Tor chapter (ref #683 )
...
License Headers / check (push) Waiting to run
kbin (public ToolBoX portal) framed as the first tool of the CyberMind
Swiss-army cyber kit: transparent perf, full-encrypted MITM inspection,
ad poison/smog injection, adware-ban banner, safe browsing.
- secubox-toolbox 2.6.59 -> 2.7.0 (caps 2.6.x, opens kbin chapter)
- docs: wiki Kbin-Toolbox.md, FAQ-KBIN-TOR.md, README blurb
- plan #683 : kbin Tor endpoint (outbound egress quick-switch) — design spec
- WIP/TODO/HISTORY updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-19 11:48:32 +02:00
381eb3b8f5
docs: WAF engine migration feasibility analysis (Coraza+CRS via HAProxy SPOA) (ref #662 )
License Headers / check (push) Waiting to run
2026-06-18 22:31:12 +02:00
ca9b38b175
feat( #662 Phase 2b): parallel handshake bench — Go core scales 3.4x at 4 cores (multi-core gate settled)
2026-06-18 17:23:23 +02:00
8a4996d14c
docs( #662 ): Phase 2 bench results — Go PoC proven on arm64 (CA-compat/204/inject/JA4/12MB); throughput gate deferred to controlled bench
2026-06-18 17:19:01 +02:00
6daacb1987
feat( #662 Phase 1): MITM-engine migration analysis + phased plan + compiled/tested Go forging-MITM PoC
...
Analysis: gomitmproxy (unmaintained, dropped) vs martian/goproxy (Go) vs hudsucker
(Rust) vs Squid+ICAP, mapped to the 18-addon capability set. Recommendation: Go
hot-path core + retained Python analysis sidecars. Phased plan with shadow-run +
nft-DNAT-flip rollback (no big-bang cutover). Phase-1 PoC (packages/secubox-toolbox-ng,
stdlib-only): forge from ca-wg CA, 204-block, body-inject, SNI-splice, ClientHello/JA4
capture — go vet clean, tests green, arm64 cross-compile OK. NOT wired to live R3.
2026-06-18 17:07:48 +02:00
3dfe85f547
docs: implementation plan for Ad Intelligence ( #656 )
2026-06-18 13:06:26 +02:00
221abd94a2
docs: spec for Ad Intelligence — learn/act/measure + #ads tab ( #656 )
2026-06-18 13:04:53 +02:00
09e16f35a1
docs: implementation plan for toolbox selective SNI-splice ( #649 )
2026-06-18 11:09:02 +02:00
7834a29724
docs: spec for toolbox selective SNI-splice (Lever A, #649 )
2026-06-18 11:04:26 +02:00
7dd39d52a4
docs: spec + plan for hub dashboard latency fix (ref #644 )
2026-06-18 08:45:31 +02:00
ea19e80685
docs: #642 social IP-literal fix design + plan (ref #642 )
2026-06-17 16:58:28 +02:00
765de07ac8
docs: #clients reset-all + emojis implementation plan (ref #634 , #635 )
2026-06-17 16:01:03 +02:00
c687225e1b
docs: #clients reset-all ( #634 ) + device/geo emojis ( #635 ) design (ref #634 )
2026-06-17 15:58:46 +02:00
bd54d82ae2
docs: anti-tracking v2 design — layered block/poison/anonymize
2026-06-17 15:15:28 +02:00
30eeedf86e
Merge remote-tracking branch 'origin/master' into fix/636-toolbox-r3-banner-stream-inject-loader-b
...
# Conflicts:
# packages/secubox-toolbox/debian/changelog
2026-06-17 15:13:36 +02:00
555176fef5
docs: Anti-Track v2 Plan 2d implementation plan (ref #633 )
2026-06-17 14:46:32 +02:00
572caab035
docs: Anti-Track v2 Plan 2d #social top-5 design (ref #633 )
2026-06-17 14:45:36 +02:00
6694860779
docs: #636 implementation plan (CSP fallback + bundle cache key) (ref #636 )
2026-06-17 14:33:50 +02:00
876becec0a
docs: #636 amend — retract Bug2 (R3 report-url correct); real residual is bundle cache key (ref #636 )
2026-06-17 14:32:49 +02:00
644996b9f5
docs: #636 R3 banner CSP-fallback + report-url fix design (ref #636 )
2026-06-17 14:30:43 +02:00
abc5dd47cb
docs: Anti-Track v2 Plan 2c implementation plan (ref #633 )
2026-06-17 14:01:21 +02:00
aac1ae58d9
docs: amend Plan 2c spec — missing /list endpoint is the real bug; seed exists inline (ref #633 )
2026-06-17 13:59:08 +02:00
fea1147bf6
docs: Anti-Track v2 Plan 2b-DNS implementation plan (ref #633 )
2026-06-17 13:41:59 +02:00
31dc83f696
docs: Anti-Track v2 Plan 2b-DNS design (unbound NXDOMAIN, live-verified topology) (ref #633 )
2026-06-17 13:39:57 +02:00
cfdb1c418c
docs: Anti-Track v2 Plan 2c bypass-seed design (ref #633 )
2026-06-17 13:33:56 +02:00
78a049c4b2
docs: Anti-Track v2 Plan 2b IP-drop implementation plan (ref #633 )
2026-06-17 12:52:41 +02:00
ee3a9aee4d
docs: Anti-Track v2 Plan 2b enforcement design (DNS-refuse + exclusive-IP nft-drop) (ref #633 )
2026-06-17 12:49:21 +02:00
01715363aa
docs: Anti-Track v2 Plan 2a implementation plan (ref #633 )
2026-06-17 12:08:03 +02:00
76cc96eff5
docs: Anti-Track v2 Plan 2a learning design (cookie-xsite + pure-promote) (ref #633 )
2026-06-17 12:04:41 +02:00
2e2ab3995f
docs: Anti-Track v2 core implementation plan (ref #633 )
2026-06-17 10:57:26 +02:00
9d1b0abade
docs: spec for HAProxy complete dynamic vhost auto-discovery (landed for later)
2026-06-17 08:49:29 +02:00
CyberMind
0c57960fd3
Merge pull request #621 from CyberMind-FR/feature/620-toolbox-ttfb-perf-stream-inject-async-pe
...
toolbox: TTFB perf — stream-inject + async per-host decision bundle (replace full-body HTML buffering)
2026-06-17 07:08:13 +02:00
6899b18ff8
docs: toolbox TTFB stream-inject design spec (ref #620 )
2026-06-16 21:46:16 +02:00
3e487adf2c
docs: security-posture v2 rewrite design spec (ref #617 )
2026-06-16 14:25:57 +02:00
e1f22b6dda
docs(cspn): draft CSPN test matrix (criteria → runnable tests)
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-15 10:14:40 +02:00
7a56b8de35
docs: Mistral.ai handover prompt (reprise code + analyse projet)
...
License Headers / check (push) Waiting to run
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-15 09:37:48 +02:00
2b1d2173c0
docs: add Cartographie sociale 'You Have Been Tracked' README section + poster brief (ref #502 )
...
License Headers / check (push) Waiting to run
- README: new VILLAGE3B subsection for the Phase 11 social mapping
feature (per-client /social/me, d3 graph, RGPD wipe, operator tab).
- docs/marketing/POSTER-you-have-been-tracked.md: poster brief with
the real kbin metrics (218 trackers, 142 sites, 234 JA4, 83693
connexions) + doctrine guardrails + declension variants.
2026-06-10 12:52:36 +02:00
3d2ecd574f
feat(secubox-toolbox): 3 QR code endpoints + splash QR display + 9th dashboard widget (device fingerprint) + README poster integration (ref #495 #497 )
...
## QR endpoints (python-qrcode)
GET /qr/splash.png → QR encodes the splash URL (Cabine join)
GET /qr/cert.png → QR encodes /ca/mobileconfig (iOS profile)
GET /qr/webclip.png → QR encodes /ca/webclip-cabine.mobileconfig
GET /qr/{target}.png → generic : maps splash/cert/webclip/report/
fingerprint to fixed URLs, or encodes literal
PNG output, Cache-Control: public, max-age=3600.
Verified : 232x232 1-bit grayscale, 384-553 bytes each.
debian/control adds python3-qrcode dependency.
## Splash QR card
The cert install card on the splash now shows 3 QR codes (① SPLASH,
② CERT iPHONE, ③ WEBCLIP HOME) on a white background grid below the
test button. Scannable from another device for cross-installation
(useful at the cabine : user shows QR to others without typing URLs).
## Dashboard hero : 9th widget (device fingerprint)
Mirroring the poster layout, added a full-width 9th widget below the
2 rows of 4 KPI widgets :
┌─────────────────────────────────────────────────────────┐
│ 📱 📱 Empreinte device │
│ iPhone iOS 26.3 · 🟢 Chrome 148 │
│ 21 UAs distincts observés │
└─────────────────────────────────────────────────────────┘
Now matches the 9-widget metrics layout from the public poster :
🌐 connexions · 📡 hôtes · ✅ OK 2xx · 🔒 cert-pin
📺 apps · 🍪 trackers · 🌍 pays · 🎯 score
📱 device (full-width)
## README + assets/poster integration (#497 )
- README.md : new section at top with poster image embed + 3 doc links
- docs/assets/poster/README.md : print specs + variants list + license
- Placeholder docs/assets/poster/village3b-A2.png expected (user provides)
Wiki integration pending : will be added via gh wiki API once issue #497
phase 2 launches.
## Rebase
Branch was rebased onto master (which now has all PR #493 Phase 3
commits). control merged : Phase 3 fonts + Phase 5 lxc deps + new
python3-qrcode in one cohesive Depends block.
2026-06-05 11:24:03 +02:00
