# Sitemap

The Sitemap builds a structured map of the target application from everything WonderSuite has seen. Every host, directory, page, API endpoint, and asset that passes through the proxy is folded into a tree automatically — no manual crawling step.

Open it with <kbd>Ctrl+7</kbd>.

The module has two top-level tabs: **Site Map** and **Code Audit**. See [Code Audit](page:code-audit) for the full source-analysis reference.

## How it's built

The Sitemap listens to proxy traffic live. As requests flow through, each URL is broken into host → path and slotted into the tree. Repeated hits on the same path are grouped, so one node can hold many traffic entries.

Nodes are typed by extension and MIME, each with its own icon: **host**, **directory**, **file** (page), **JS**, **CSS**, **font**, **image**, **API endpoint**, and **media**.

## View modes

Three ways to look at the same data, switched from the toolbar:

- **Tree View** — the classic collapsible host/path tree.
- **Flow Map** — an interactive node graph showing how the site links together.
- **Mermaid** — the structure rendered as a Mermaid diagram, with the diagram source available to copy.

## Filtering and the blacklist

- The **filter box** narrows the tree to matching paths.
- The **Blacklist** keeps noise out permanently — add URL patterns (wildcards supported) and matching nodes are excluded from the Sitemap. The blacklist persists across sessions. Manage entries from the blacklist panel.

## Multi-select

Two ways to build a selection without entering Delete mode:

### Ctrl+click
Hold <kbd>Ctrl</kbd> (or <kbd>Cmd</kbd> on macOS) while clicking nodes to build an additive selection (highlighted in a distinct accent colour). A plain click clears the selection.

### Drag-to-select (rubber band)
Hold the left mouse button and drag over **empty space** in the tree to draw a selection rectangle. All visible nodes whose rows overlap the rectangle are selected when you release the mouse. Works well for selecting a contiguous block of paths under a host.

> Drags shorter than 5 px are treated as missed clicks so accidental micro-drags don't interfere with normal navigation.

### Selection action bar
Whenever one or more nodes are selected (via either method above), a bar appears at the bottom of the tree:

| Button | Action |
|---|---|
| **Clear** | Deselects everything |
| **Blacklist (N)** | Adds all selected URLs to the blacklist and removes them from the tree |
| **Delete (N)** | Removes all selected nodes from the tree (current session only) |

## Delete mode

Toggle **Select & Delete** to get a checkbox on every node. Mark the nodes you don't want and confirm — useful for pruning analytics, CDN, and third-party noise. From the delete bar you can either **Delete** (removes from the current tree only) or **Blacklist** (persists the pattern so those URLs never appear again). You can also delete a single node from its right-click menu.

## The detail pane

Select any node to inspect its captured traffic. The detail pane has four tabs:

- **Overview** — method, status, size, timing, content type, TLS.
- **Request** — the raw request, with syntax highlighting.
- **Response** — the raw response body, syntax-highlighted by language (JS, CSS, JSON, HTML, XML); image responses are previewed inline.
- **Headers** — request/response headers, with security headers, sensitive headers, and content-type colour-coded.

A **Format** toggle beautifies minified JS/CSS/JSON/HTML in place, and every view has a **Copy** button.

## Export & context menu

Click the **Download** icon to export the Sitemap structure. Available formats:

| Format | Contents |
|---|---|
| JSON | Full tree with per-endpoint request/response bodies |
| CSV | One row per endpoint: method, URL, status, MIME, size, time |
| XML Sitemap | Standard `<urlset>` format for `sitemap.xml` |
| HAR | HTTP Archive 1.2 — import into Burp, Chrome DevTools, Charles |
| Markdown | Human-readable outline of the site structure |
| URLs | Plain-text list of every captured URL |

Right-click any node for the shared context menu — send the request to [Repeater](page:repeater), [Intruder](page:intruder), [Scanner](page:scanner), and more.

## Code Audit tab

The **Code Audit** tab (next to Site Map in the header) performs passive source-level analysis on every asset captured by the proxy. See the full [Code Audit](page:code-audit) documentation.
