Threat Intelligence Platform v3.1.4

Adversaries don't
announce themselves.
We make them.

Real-time threat detection across your entire attack surface. SecureCorp correlates signals from endpoints, cloud, and identity to surface what your SIEM misses.

REQUEST ACCESS VIEW LIVE THREATS
0 Threats Blocked Today
0 Active IOCs
0k Protected Endpoints
99.97% Platform Uptime
 Threat Intelligence Lookup A03 XSS A02

Capabilities

The platform your
SOC actually needs

Continuous Asset Visibility
Automated discovery across cloud, on-prem, and OT environments. Know what you have before attackers do.
Sub-Second Detection
Stream-based analytics engine correlates millions of events per second with MITRE ATT&CK-mapped detections out of the box.
Identity Threat Detection
Detect credential abuse, impossible travel, and lateral movement across Entra ID, Okta, and on-prem Active Directory.
Cloud Posture Management
Continuous misconfiguration detection across AWS, Azure, and GCP mapped to CIS benchmarks and regulatory frameworks.
Network Traffic Analysis
Deep packet inspection and behavioural baselining identify beaconing, exfiltration, and C2 communications.
Automated Compliance
Pre-built controls for APRA CPS 234, ISO 27001, NIST CSF, and SOC 2. Evidence collection without the spreadsheet pain.

Threat Intelligence Feed Connector A10 SSRF

External Feed Probe

feed-connector.securecorp.local

Enter an external threat feed URL. The server will fetch and cache the response.

$ fetch --url
> Awaiting feed URL...

Analyst Portal A07 A04 A02 A05

Secure Login

Forgot password? Reset via email  |  Download Q4 Report

javascript:alert(1) [A02] Search term also appended to URL as plaintext param. */ function doSearch() { const query = document.getElementById('searchInput').value; /* [A02] Credential/query exposure in URL */ history.pushState(null, '', '?q=' + query); /* [A09] Sensitive search terms logged without redaction */ console.log('[AUDIT] User searched for:', query, '| session: anonymous | time:', new Date().toISOString()); const resultsEl = document.getElementById('searchResults'); if (!query.trim()) { resultsEl.innerHTML = 'Error: empty query'; return; } /* *** [A03] VULNERABLE: unsanitised innerHTML injection *** */ resultsEl.innerHTML = '> Querying threat intelligence database for: ' + query + /* ← raw user input, no escaping */ '
' + '> Checking IOC feeds... CVE database... dark web intel...
' + 'No matches found. Consider escalating to Tier 2.'; /* [A03] SQLi surface comment - backend query constructed via string concat: SELECT * FROM iocs WHERE indicator = '' + query + '' AND active = 1 PoC: ' OR '1'='1 */ } /* ── Login handler ────────────────────────────────────────── */ /* [A07] No rate limiting, lockout, or delay between attempts. Brute force is trivially possible in a loop. [A04] Security questions provide false security. [A05] Error messages enumerate valid usernames. */ function doLogin(event) { event.preventDefault(); const username = document.getElementById('username').value; const password = document.getElementById('password').value; const errorEl = document.getElementById('loginError'); /* [A09] Full credentials logged to console */ console.log('[AUTH] Login attempt — user:', username, 'pass:', password); errorEl.style.display = 'none'; /* [A05] Verbose errors: different message for unknown user vs wrong password This allows attackers to enumerate valid usernames. */ if (!USERS[username]) { /* [A05] Username enumeration */ errorEl.innerHTML = '⚠ Authentication failed: user ' + username + ' does not exist in this system.
' + 'Error ref: AUTH-404 | Path: /portal/login | DB: securecorp.users'; errorEl.style.display = 'block'; return false; } if (USERS[username].pass !== password) { /* [A05] Password-specific error (confirms username IS valid) */ errorEl.innerHTML = '⚠ Authentication failed: incorrect password for user ' + username + '.
' + 'Error ref: AUTH-401 | Account UID: ' + USERS[username].uid + ' | Role: ' + USERS[username].role + ''; errorEl.style.display = 'block'; return false; } /* [A09] Successful auth logged with role details */ console.log('[AUTH] Login SUCCESS — uid:', USERS[username].uid, 'role:', USERS[username].role); /* [A02] Redirect includes credentials in URL / query string */ window.location.href = '/portal/dashboard?user=' + username + '&role=' + USERS[username].role + '&uid=' + USERS[username].uid; return false; } /* ── SSRF probe (simulated) ───────────────────────────────── */ /* [A10] Server-Side Request Forgery: The supplied URL is submitted to the backend which makes an outbound HTTP request. No allowlist enforced. In a real vulnerable app this POSTs to: /api/fetch?url= PoC targets: http://169.254.169.254/latest/meta-data/ (AWS IMDS) http://169.254.169.254/metadata/instance?api-version=2021-02-01 (Azure IMDS) http://100.100.100.200/latest/meta-data/ (Alibaba Cloud IMDS) http://internal-db.securecorp.local:5432 (Internal DB port probe) http://admin:admin@router.internal/config.json (Credential injection) file:///etc/passwd (LFI via file scheme) dict://localhost:6379/info (Redis via dict scheme) */ function doSSRFProbe() { const url = document.getElementById('ssrfUrl').value; const out = document.getElementById('ssrfOutput'); /* [A09] URL probes not sanitised before logging */ console.log('[SSRF-PROBE] Fetching URL:', url); out.textContent = '> Initiating server-side fetch...\n> Target: ' + url + '\n'; /* Simulated: in production this calls the vulnerable backend endpoint */ setTimeout(() => { out.textContent += '> POST /api/fetch HTTP/1.1\n' + '> Host: api.securecorp.local\n' + '> Content-Type: application/json\n' + '> {"url":"' + url + '","timeout":5000,"follow_redirects":true}\n\n' + '< HTTP/1.1 200 OK\n' + '< X-Internal-Request: true\n' + '< X-Forwarded-Host: ' + url + '\n' + '< \n' + '< [Response would appear here — in a real deployment the server\n' + '< would fetch this URL and return the raw response body]\n'; }, 900); } /* ================================================================ [A06] Vulnerable & Outdated Components: The app explicitly loads Font Awesome 5.15.1 (above) without an SRI hash, and this comment references the vulnerable jQuery version that WOULD be loaded in a full implementation: