security-engines-demo.md

SlopSearX: Security Engines Milestone — Live Demo

Deployed live on bishop.local:8090. 15 new security engine adapters across two PRs.

PR #79 — 6 No-Key Security Engines (merged)

Engine	Type	Description	Demo Status
CRT.sh	API	Certificate Transparency log search	Timeout from network (API reachable, 20s response)
URLhaus	API (POST)	Malware URL/payload tracking	API now requires auth (changed)
FIRST EPSS	API	CVE exploit probability (0-1)	Working
GreyNoise	API	IP noise vs targeted classification	Working (community tier, limited data)
Exploit-DB	Scrape	Public exploit search	Working (health ok, HTML parsable)
MITRE ATT&CK	API	Adversary TTP knowledge base	Working

PR #80 — 9 Key-Based Security Engines (merged)

Engine	Env Variable	Description
Shodan	ENGINE_SHODAN_API_KEY	Internet device search
Censys	ENGINE_CENSYS_API_KEY + _API_SECRET	Internet asset discovery
VirusTotal	ENGINE_VIRUSTOTAL_API_KEY	Multi-engine malware detection
HIBP	ENGINE_HIBP_API_KEY	Breach/credential exposure
AlienVault OTX	ENGINE_OTX_API_KEY	Threat intelligence pulses
AbuseIPDB	ENGINE_ABUSEIPDB_API_KEY	IP reputation database
VulnCheck	ENGINE_VULNCHECK_API_KEY	CVE exploit timeline
IntelX	ENGINE_INTELX_API_KEY	Darknet/OSINT search
DeHashed	ENGINE_DEHASHED_API_KEY	Credential leak search

---

Demo 1: NVD Keyword Search

$ curl -s 'http://bishop.local:8090/search?q=linux+kernel&format=json&engines=nvd'
Results: 10
  CVE-1999-1387: CVSS 7.2 | CWE-Other | Refs: ...
  CVE-1999-1442: Bug in AMD K6 processor on Linux 2.0.x...

---

Demo 2: FIRST EPSS (Exploit Prediction)

$ curl -s 'http://bishop.local:8090/search?q=CVE-2024-3094&format=json&engines=epss'
  CVE-2024-3094 — EPSS 0.84805
  EPSS Score: 0.84805 (High) | Percentile: 0.99 | Date: 2026-06-10

---

Demo 3: MITRE ATT&CK

$ curl -s 'http://bishop.local:8090/search?q=T1059&format=json&engines=mitreattack'
  Command and Scripting Interpreter
  Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries...

Also supports group IDs (G0016 → APT29) and software IDs (S0154 → Cobalt Strike).

---

Demo 4: Category Routing

All security engines route under security and it categories:

$ curl -s 'http://bishop.local:8090/config'
  security: ['crtsh', 'cve', 'epss', 'exploitdb', 'greynoise', 'mitreattack', 'nvd', ...]
  it: ['crtsh', 'cve', 'nvd']
  threat-intel: ['epss', 'greynoise', 'urlhaus']
  exploit: ['exploitdb']

Filter by category: ?categories=security or ?categories=it

---

Demo 5: Health Endpoint

$ curl -s 'http://bishop.local:8090/health'
  cve: ok
  epss: ok
  greynoise: ok
  exploitdb: ok
  hackernews: ok
  huggingface: ok
  nvd: ok
  wikipedia: ok

Key-based engines show error when no API key is configured.

---

Design Decisions

Aspect	Approach
No-key engines	CRT.sh, URLhaus, EPSS, GreyNoise (community), Exploit-DB, MITRE ATT&CK all work with zero configuration
Key-based engines	Return EngineStatus.ERROR with clear message when key is missing
Auth patterns	httpx built-in auth parameter for Basic Auth (Censys, DeHashed); header-based for API keys
Scrape adapters	Exploit-DB and MITRE ATT&CK use lxml + cssselect for HTML parsing
Categories	All engines declare general + security-specific categories; operators can override via env vars