🛡️ DEXIS

Digital Exposure Intelligence System

Map your digital attack surface. Quantify identity risk. Simulate real-world compromise.

Features • Screenshots • Architecture • Getting Started • API Reference • Tech Stack

---

🎯 What is DEXIS?

DEXIS is a cybersecurity SaaS platform that treats your digital identity as an interconnected attack surface. Instead of looking at services in isolation, DEXIS maps the dependency chains between your accounts — Google, GitHub, AWS, banking, Slack, and more — to reveal how a single compromised credential can cascade into full identity takeover.

Try it instantly — the demo mode loads with 8 pre-configured services, real threat data, and full attack simulation. No signup required.

---

✨ Features

🗺️ Attack Surface Mapping

Interactive dependency graph powered by React Flow. Visualize how your Google Account connects to GitHub, which connects to AWS, which holds your infrastructure. Every node shows risk level, exposed data points, and compromise status.

📊 Risk Score Engine

Quantified risk scoring (0–100) calculated from service dependencies, exposure categories, and attack chain analysis. The engine evaluates:

• Identity exposure — primary identity provider risk (+25)
• Financial linkage — banking services tied to primary identity (+15)
• Cloud sprawl — number of cloud services connected (+5 each, max 15)
• Communication channels — SSO-linked messaging platforms (+8)
• Attack chains — dangerous combinations like GitHub + AWS (+3)

⚡ Attack Simulation

Simulate real-world compromise scenarios starting from your primary identity. DEXIS generates multi-hop attack paths with step-by-step breakdowns:

Google Account → GitHub (SSO bypass) → Scan repos for secrets → AWS Console (stolen IAM keys) → S3 data exfiltration

Each simulation calculates:

• Total compromised services and blast radius
• Estimated time to full compromise (< 4 hours typical)
• Financial exposure ($50K–$250K for banking-linked identities)
• Data records at risk (~12,400 for a typical 8-service footprint)

🔍 Vulnerability Scanner

Automated scanning across all connected services. Detects:

• Reused passwords across services
• Exposed IAM access keys in public repositories
• Weak 2FA configurations (email-only)
• Stale OAuth tokens with broad scopes
• Public profile data exposure
• Workspace tokens in localStorage

🎯 Threat Intelligence

Real-time threat feed with severity-tagged alerts:

• CRITICAL — Credential stuffing attacks, IAM key exposure, financial account takeover vectors
• HIGH — OAuth token hijacking, spear phishing via LinkedIn, supply chain attack vectors
• MEDIUM — Session token theft, external page sharing, public profile exposure

📋 Security Recommendations

Prioritized, actionable remediation steps:

• Enable 2FA on all services (currently 2/8)
• Revoke 9 unused OAuth tokens (90+ days stale)
• Rotate AWS access keys (180+ days without rotation)
• Remove .env files from 3 public GitHub repos
• Upgrade banking 2FA from email to hardware token

👤 Profile & Settings

Manage your account, view scan history, track risk score trends, and configure your organization details.

---

📸 Screenshots

Dashboard	Attack Surface

Simulation	Security Scan

Login	Landing Page

Note: Add your own screenshots to docs/screenshots/ after running the application.

---

🏗️ Architecture

┌─────────────────────────────────────────────────────────┐
│                      Frontend (React)                    │
│                                                          │
│  Landing ─── Login ─── Dashboard ─── Attack Surface      │
│                          │              │                 │
│                     Simulation ──── Scan ──── Profile     │
│                                                          │
│  Components: Sidebar, Header, RiskScoreCard,             │
│              AttackGraphCard, SimulationCard              │
│                                                          │
│  Services: api.js (Axios + JWT interceptor)              │
└──────────────────────┬──────────────────────────────────┘
                       │ Vite Proxy (/api → :5001)
┌──────────────────────▼──────────────────────────────────┐
│                    Backend (Express 5)                    │
│                                                          │
│  Routes:                                                 │
│    /api/auth ──────── Google OAuth + Demo login           │
│    /api/user ──────── Unified data endpoint               │
│    /api/risk-score ── Risk calculation                    │
│    /api/simulate ──── Attack simulation                   │
│    /api/scan ──────── Vulnerability scanning              │
│                                                          │
│  Services:                                               │
│    riskEngine.js ──── Quantified risk scoring             │
│    attackSimulator.js ── Multi-hop attack path generation │
│                                                          │
│  Middleware: JWT auth (7-day tokens)                      │
└──────────────────────┬──────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────┐
│                   MongoDB (Mongoose 9)                    │
│                                                          │
│  Collections:                                            │
│    users ──── name, email, riskScore, org, role           │
│    accounts ── serviceName, riskLevel, dependencyType,    │
│                exposedData[], connectedSince              │
└─────────────────────────────────────────────────────────┘

---

🚀 Getting Started

Prerequisites

• Node.js 18+ (or Bun)
• MongoDB — local instance or MongoDB Atlas connection string
• Google OAuth Client ID (optional, for Google login)

1. Clone the repository

git clone https://github.com/your-username/dexis.git
cd dexis

2. Backend setup

cd Backend
npm install

Create a .env file:

PORT=5001
MONGO_URI=mongodb://localhost:27017/dexis
JWT_SECRET=your-secret-key-here
GOOGLE_CLIENT_ID=your-google-client-id-here

Start the backend:

npm run dev

3. Frontend setup

cd Frontend/dexis
npm install
npm run dev

The frontend runs on http://localhost:5173 with API requests proxied to http://localhost:5001.

4. Try the demo

Open http://localhost:5173 → Click Try Demo → Explore the full dashboard with pre-loaded threat data.

---

📡 API Reference

Method	Endpoint	Auth	Description
POST	/api/auth/google	—	Authenticate with Google OAuth credential
POST	/api/auth/demo	—	Create/login demo account with sample data
GET	/api/user	JWT	Get user profile, accounts, threats, recommendations, exposure
PUT	/api/user/profile	JWT	Update user name, organization, role
GET	/api/risk-score	JWT	Calculate risk score with breakdown
POST	/api/simulate-attack	JWT	Run attack simulation, get paths and blast radius
POST	/api/scan	JWT	Run security scan, get findings and service status
GET	/health	—	Health check

Authentication

All protected endpoints require a Bearer token in the Authorization header:

Authorization: Bearer <jwt_token>

Tokens are valid for 7 days.

---

🛠️ Tech Stack

Frontend

Technology	Version	Purpose
React	19.2	UI framework
Vite	7.3	Build tool and dev server
React Router	7.13	Client-side routing
Tailwind CSS	4.2	Utility-first styling
Framer Motion	12.34	Animations and transitions
React Flow	12.10	Interactive graph visualization
Axios	1.13	HTTP client with interceptors

Backend

Technology	Version	Purpose
Express	5.2	HTTP server framework
Mongoose	9.2	MongoDB ODM
jsonwebtoken	9.0	JWT authentication
google-auth-library	10.5	Google OAuth verification
cors	2.8	Cross-origin resource sharing
dotenv	17.3	Environment variable management

---

📁 Project Structure

dexis/
├── Backend/
│   ├── middleware/
│   │   └── auth.js              # JWT generation & verification
│   ├── models/
│   │   ├── User.js              # User schema
│   │   └── Account.js           # Connected service schema
│   ├── routes/
│   │   ├── auth.js              # Google OAuth + demo login
│   │   ├── user.js              # User data + profile updates
│   │   ├── risk.js              # Risk score calculation
│   │   ├── simulation.js        # Attack simulation
│   │   └── scan.js              # Vulnerability scanning
│   ├── services/
│   │   ├── riskEngine.js        # Risk scoring algorithm
│   │   └── attackSimulator.js   # Attack path generation
│   ├── server.js                # Express app entry point
│   └── package.json
│
├── Frontend/dexis/
│   ├── src/
│   │   ├── components/
│   │   │   ├── AttackGraphCard.jsx   # React Flow graph
│   │   │   ├── DashboardLayout.jsx   # Layout with sidebar
│   │   │   ├── Header.jsx           # Page header
│   │   │   ├── RiskScoreCard.jsx     # Circular risk gauge
│   │   │   ├── Sidebar.jsx          # Navigation sidebar
│   │   │   └── SimulationCard.jsx    # Simulation results
│   │   ├── pages/
│   │   │   ├── Landing.jsx      # Public landing page
│   │   │   ├── Login.jsx        # Authentication page
│   │   │   ├── Dashboard.jsx    # Main dashboard
│   │   │   ├── AttackSurface.jsx # Service dependency map
│   │   │   ├── Simulation.jsx   # Attack simulation
│   │   │   ├── Scan.jsx         # Security scanner
│   │   │   ├── Profile.jsx      # User profile
│   │   │   └── Settings.jsx     # Account settings
│   │   ├── services/
│   │   │   └── api.js           # Axios instance + API methods
│   │   ├── App.jsx              # Router configuration
│   │   ├── main.jsx             # React entry point
│   │   └── index.css            # Global styles + theme
│   ├── vite.config.js           # Vite + proxy config
│   └── package.json
│
└── README.md

---

🔐 Demo Mode

The demo account comes pre-loaded with:

Service	Risk Level	Dependency Type	Exposed Data Points
🔑 Google Account	HIGH	Primary	7 (email, name, photo, recovery phone, apps, calendar, contacts)
🐙 GitHub	HIGH	Cloud	6 (source code, API keys, SSH keys, org access, CI/CD secrets, emails)
💼 LinkedIn	MEDIUM	Professional	6 (employment, network, email, phone, location, skills)
📦 Dropbox	MEDIUM	Cloud	5 (documents, tax returns, shared folders, metadata, links)
🏦 Banking Service	CRITICAL	Financial	6 (account numbers, transactions, routing, cards, beneficiaries, statements)
💬 Slack	HIGH	Communication	6 (messages, files, history, DMs, tokens, directory)
☁️ AWS Console	CRITICAL	Cloud	6 (infrastructure, S3, IAM, billing, databases, Lambda)
📝 Notion	LOW	Cloud	5 (docs, meeting notes, roadmaps, wiki, API tokens)

Demo risk score: 78/100 (CRITICAL)

---

📄 License

This project is for educational and demonstration purposes.

---

_{Built with ☕ and a healthy paranoia about digital security.}