avuko / kathe

A GUI/REST interface to find similarities in large sets (think: binaries). Based on ssdeep.

Hi there 👋

• 🔭 I’m currently working on learning Rust while (re)building https://github.com/avuko/kathe
• 🌱 I’m currently learning Rust
• 👯 I’m looking to collaborate on https://github.com/avuko/kathe
• 💬 Ask me about coffee
• 📫 How to reach me: infosec.exchange/@avuko
• 😄 Pronouns: he/him
• ⚡ Fun fact: coffee is a psychoactive drug.

kathe's Issues

bootstrap grid the gui

The graph results in an issue with a scrollbar, and the info blocks need to go under the search at smaller widths.

fill a separate DB with info about the files, so it can easily be pulled up

Add the info into the DB while parsing the file the first time, would save lot of going back to the samples.
Additionally, there would probably be a lot of contexts to pivot on.

On hovering over the edges, when zoomed in, the ssdeep_compare values are not correct.

rewrite manual (README.md)

TODO:

• Document all endpoints of the app
• add image and gif of interface
• document json format
• explain building and running as a docker app
• explain running app.py as stand-alone
• include pyramid-of-pain
• include information from the ECSP article.

UI usability & looks could be improved

Current interface is quite utilitarian. Slapping on some more CSS might improve usability and make Kathe prettier.

ADD addition endpoint

Create a way to upload data as JSON via a POST request.

zincrby in newer verions of pip redis seems to have a different format/value set.

I seem to remember this is why we pinned an older version.
I'll look into it.

Store the result "graphs" in a native format

This is only necessary if it makes the retrieval fast(er). The idea is that it might additionally facilitate incremental updates to the graph as results come in.

check API response for possible cleanups/tweaks, including the ADD endpoint.

Needs to be stable before release.

Add secrets.py sample

Explain the values and where they are used.
This hooks in with kathe-cli.py and fillit.sh

change kathe.py to use the REST api, instead of loading directly.

Needs testing to verify correctness and speed.

Make contexts better pivotable

Create a way to see how many hits there are on a context outside of the current subset (this counter is already in the dataset).
I think it would be wise to stop adding hashes to contexts if there is no filename: this just takes extra space and creates noise in the context fields.