def setUp(self): self.node = Node(node_id=13, ip=ipaddress.ip_address('127.0.0.5')) self.scan_1 = Scan(start=150421) self.scan_2 = Scan(start=159985) self.port_1 = Port(transport_protocol=TransportProtocol.TCP, number=80, node=self.node) self.port_1.scan = self.scan_1 self.port_scan_1 = PortScan(port=self.port_1, scan=self.scan_1) self.port_2 = Port(transport_protocol=TransportProtocol.UDP, number=19, node=self.node) self.port_2.scan = self.scan_2 self.port_scan_2 = PortScan(port=self.port_2, scan=self.scan_2) self.type = VulnerabilityChangeType.PORTDETECTION self.change_1 = PortDetectionChange(change_time=159986, current_finding=self.port_scan_1, previous_finding=None) self.change_2 = PortDetectionChange(change_time=159911, current_finding=None, previous_finding=self.port_scan_2)
def setUp(self): super(AucoteHttpHeadersTaskTest, self).setUp() HTTPClient._instance = MagicMock() self.port = Port(node=MagicMock(), transport_protocol=None, number=None) self.port.scan = Scan() self.aucote = MagicMock() self.exploit = MagicMock() self.exploit.name = "test" self.config = { 'headers': { 'test': HeaderDefinition(pattern='test_nie', obligatory=True) } } self.custom_headers = { 'Accept-Encoding': 'gzip, deflate', 'User-Agent': 'test' } self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.task = AucoteHttpHeadersTask(port=self.port, context=self.context, exploits=[self.exploit], config=self.config)
def setUp(self): super(NmapToolTest, self).setUp() self.exploit = Exploit(exploit_id=1, name='test_name', risk_level=RiskLevel.NONE) self.exploit2 = Exploit(exploit_id=2, name='test_name', risk_level=RiskLevel.HIGH) self.exploit_conf_args = Exploit(exploit_id=3) self.exploit_conf_args.name = 'test_name2' self.exploit_conf_args.risk_level = RiskLevel.HIGH self.config = { 'scripts': { 'test_name': { 'args': 'test_args' }, 'test_name2': { 'args': MagicMock() } } } self.cfg = { 'tools': { 'nmap': { 'disable_scripts': [], }, 'common': { 'rate': 1337, 'http': { 'useragent': 'test_useragent' } } }, 'config_filename': '' } self.exploits = [self.exploit, self.exploit2] self.port = Port(number=13, transport_protocol=TransportProtocol.TCP, node=Node(node_id=1, ip=ipaddress.ip_address('127.0.0.1'))) self.port.scan = Scan(start=14, end=13) self.port.protocol = 'test_service' self.aucote = MagicMock(storage=Storage(":memory:")) self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.nmap_tool = NmapTool(context=self.context, exploits=self.exploits, port=self.port, config=self.config)
def test_diff_two_last_scans(self, serializer): current_scan = Scan() self.thread.scan = current_scan previous_scan = Scan() node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) self.aucote.storage.get_nodes_by_scan.return_value = [node] port_added = Port(node, transport_protocol=TransportProtocol.TCP, number=88) port_added.row_id = 17 port_removed = Port(node, transport_protocol=TransportProtocol.TCP, number=80) port_removed.row_id = 18 port_unchanged = Port(node, transport_protocol=TransportProtocol.TCP, number=22) port_unchanged.row_id = 19 port_scans_current = [ PortScan(port=port_unchanged, scan=current_scan), PortScan(port=port_added, scan=current_scan) ] port_scans_previous = [ PortScan(port=port_unchanged, scan=previous_scan), PortScan(port=port_removed, scan=previous_scan) ] self.aucote.storage.get_scans_by_node.return_value = [ current_scan, previous_scan ] self.aucote.storage.get_ports_by_scan_and_node.side_effect = ( port_scans_current, port_scans_previous) expected = [ PortDetectionChange(current_finding=port_scans_current[1], previous_finding=None), PortDetectionChange(current_finding=None, previous_finding=port_scans_previous[1]) ] self.thread.diff_with_last_scan() self.aucote.storage.get_nodes_by_scan.assert_called_once_with( scan=current_scan) self.assertEqual(len(self.aucote.storage.save_changes.call_args_list), 1) result = self.aucote.storage.save_changes.call_args[0][0] self.assertCountEqual(result, expected) self.assertCountEqual([ serializer.call_args_list[0][0][0], serializer.call_args_list[1][0][0] ], expected)
def setUp(self): """ Prepare some internal variables: exploit, port, exploits, script, vulnerability, scan_task """ super(NmapPortScanTaskTest, self).setUp() self.aucote = MagicMock() self.exploit = Exploit(exploit_id=1, app='nmap', name='test') self.exploit_vuln_non_exist = Exploit(exploit_id=2, app='nmap', name='test2') self.exploits = Exploits() self.exploits.add(self.exploit) self.node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=None) self.node_ipv6 = Node(ip=ipaddress.ip_address('::1'), node_id=None) self.port = Port(number=22, node=self.node, transport_protocol=TransportProtocol.TCP) self.port.service_name = 'ssh' self.port.scan = Scan() self.port_ipv6 = Port(number=22, node=self.node_ipv6, transport_protocol=TransportProtocol.TCP) self.script = NmapScript(port=self.port, parser=NmapParser(), exploit=self.exploit, name='test', args='test_args') self.script.get_result = MagicMock(return_value='test') self.script2 = NmapScript(port=self.port, parser=NmapInfoParser(), exploit=self.exploit_vuln_non_exist, name='test2') self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.scan_task = NmapPortScanTask( context=self.context, port=self.port, script_classes=[self.script, self.script2], rate=1337) self.scan_task.store_scan_end = MagicMock() future = Future() future.set_result(ElementTree.fromstring(self.XML)) self.scan_task.command.async_call = MagicMock(return_value=future) self.cfg = {'tools': {'nmap': {'scripts_dir': '', 'timeout': 0}}}
def setUp(self): super(CVESearchToolTest, self).setUp() self.aucote = MagicMock() self.exploits = MagicMock() self.port = MagicMock() self.config = MagicMock() self.node = MagicMock() self.scan = Scan() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.tool = CVESearchTool(context=self.context, exploits=self.exploits, port=self.port, node=self.node, config=self.config)
def setUp(self): super(TaskMapperTest, self).setUp() self.executor = Mock() self.exploits = OrderedDict({ 'test': [ Exploit(exploit_id=1, name='test_1'), Exploit(exploit_id=2, name='test_2') ] }) self.exploits.update(test2=[Exploit(exploit_id=3)]) self.executor.exploits.find_all_matching.return_value = self.exploits self.context = ScanContext(aucote=self.executor, scanner=MagicMock(scan=Scan())) self.task_mapper = TaskMapper(context=self.context) self.cfg = { 'portdetection': { '_internal': { 'categories': ['other', 'brute'] } }, 'tools': { 'test': { 'enable': True }, 'test2': { 'enable': True } } }
async def test_get_nodes_for_scanning(self, cfg): cfg._cfg = self.cfg cfg['portdetection.test_name.networks.include'] = [ '127.0.0.2/31', '127.0.0.4/32' ] node_1 = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) node_2 = Node(ip=ipaddress.ip_address('127.0.0.2'), node_id=2) node_3 = Node(ip=ipaddress.ip_address('127.0.0.3'), node_id=3) node_4 = Node(ip=ipaddress.ip_address('127.0.0.4'), node_id=4) nodes = {node_1, node_2, node_3} future = Future() future.set_result(nodes) self.aucote.topdis.get_all_nodes.return_value = future self.aucote.topdis.get_snmp_nodes.return_value = Future() self.aucote.topdis.get_snmp_nodes.return_value.set_result({node_4}) self.thread.storage.get_nodes = MagicMock(return_value=[node_2]) scan = Scan() result = await self.thread._get_nodes_for_scanning(scan) expected = [node_4, node_3] self.assertListEqual(result, expected)
def setUp(self): super(HydraToolTest, self).setUp() self.exploit = Exploit(exploit_id=1, name='hydra', app='hydra', risk_level=RiskLevel.NONE) self.exploit2 = Exploit(exploit_id=2, name='hydra', app='hydra', risk_level=RiskLevel.HIGH) self.config = { 'services': ['ssh', 'vnc'], 'mapper': { 'test': 'ssh' }, 'without-login': '******' } self.exploits = [self.exploit, self.exploit2] self.node = Node(node_id=1, ip=ipaddress.ip_address('127.0.0.1')) self.port = Port(number=12, transport_protocol=TransportProtocol.TCP, node=self.node) self.port.protocol = 'test' self.port.scan = Scan(start=14) self.port_no_login = Port(number=12, transport_protocol=TransportProtocol.TCP, node=self.node) self.port_no_login.protocol = 'vnc' self.port_no_login.scan = Scan(start=14) self.aucote = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.hydra_tool = HydraTool(context=self.context, exploits=self.exploits, port=self.port, config=self.config) self.hydra_tool_without_login = HydraTool(context=self.context, exploits=self.exploits, port=self.port_no_login, config=self.config)
def setUp(self): super(SkipfishToolTest, self).setUp() self.exploit = Exploit(exploit_id=1) self.exploit.name = 'skipfish' self.exploit.risk_level = RiskLevel.NONE self.config = {} self.exploits = [self.exploit] self.port = Port(node=Node(node_id=1, ip=ipaddress.ip_address('127.0.0.1')), number=3, transport_protocol=TransportProtocol.TCP) self.port.scan = Scan(start=13, end=45) self.aucote = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.skipfish_tool = SkipfishTool(context=self.context, exploits=self.exploits, port=self.port, config=self.config)
def test_store_scan(self): self.UDP.scan = Scan(start=25.0) self.task_mapper.store_security_scan( exploits=[self.exploits['test'][0]], port=self.UDP) self.executor.storage.save_security_scans.assert_called_once_with( exploits=[self.exploits['test'][0]], port=self.UDP, scan=self.context.scanner.scan)
def __init__(self, aucote): self._current_scan = [] self._aucote = aucote self.context = None self.scan = Scan(protocol=self.PROTOCOL, scanner=self.NAME, init=False) # ToDo: move it inside self._shutdown_condition = Event() self.status = ScanStatus.IDLE self.run_now = False
def test_serialize_portchange(self, output): output.return_value = 'test_output' scan_1 = Scan(start=1178603, end=17, protocol=TransportProtocol.UDP, scanner='test_name') scan_2 = Scan(start=187213, end=17, protocol=TransportProtocol.UDP, scanner='test_name') node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) port_1 = Port(node, transport_protocol=TransportProtocol.TCP, number=88) port_2 = Port(node, transport_protocol=TransportProtocol.TCP, number=88) previous_finding = PortScan(port=port_1, scan=scan_1, rowid=124) current_finding = PortScan(port=port_2, scan=scan_2, rowid=15) change = PortDetectionChange(current_finding=current_finding, change_time=124445, previous_finding=previous_finding) expected = bytearray(b'\x00\x64\xff\x9b\x00\x00\x00\x00\x00\x00\x00\x00\x7f\x00\x00\x01X\x00\x06\x00\x00' b'\x00\x00\x00\x00\x00\x00H\xe1j\x07\x00\x00\x00\x00\x01\x00\x00\x00\x00\xf8\r@F\x00' b'\x00\x00\x00\xc8\xa4(\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00test_output') result = self.serializer.serialize_vulnerability_change(change)._data self.assertEqual(result, expected)
def setUp(self): self.aucote = MagicMock() self.port = Port(node=MagicMock(), transport_protocol=None, number=MagicMock()) self.exploit = MagicMock() self.scan = Scan() self.context = ScanContext(aucote=self.aucote, scanner=None) self.task = PortTask(context=self.context, port=self.port, exploits=[self.exploit])
def setUp(self): super(CommandTaskTest, self).setUp() self.aucote = MagicMock() self.port = Port(node=MagicMock(), transport_protocol=None, number=None) self.port.scan = Scan() self.command = MagicMock(NAME='test_name') future = Future() self.future_return = MagicMock() future.set_result(self.future_return) self.command.async_call = MagicMock(return_value=future) self.exploit = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.task = CommandTask(context=self.context, port=self.port, command=self.command, exploits=[self.exploit]) self.cfg = {'tools': {'test_name': {'timeout': 0}}}
def setUp(self): super(HydraScriptTaskTest, self).setUp() self.aucote = MagicMock() self.port = Port(node=Node(ip='127.0.0.1', node_id=None), transport_protocol=TransportProtocol.TCP, number=22) self.port.service_name = 'ssh' self.port.scan = Scan() self.exploit = Exploit(exploit_id=1) self.scan = Scan() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.hydra_script_task = HydraScriptTask( exploits=[self.exploit], context=self.context, port=self.port, service=self.port.service_name) self.hydra_script_task.store_scan_end = MagicMock() self.hydra_script_task.aucote.exploits.find.return_value = self.exploit
def test_diff_two_last_scans(self, serializer): exploit = Exploit(exploit_id=1) self.port_info._current_exploits = [self.exploit] scan_2 = Scan() scans = [self.context.scanner.scan, scan_2] self.port_info.storage.get_scans_by_security_scan.return_value = scans vuln_added = Vulnerability(port=self.port, exploit=exploit, subid=3, output='a') vuln_removed = Vulnerability(port=self.port, exploit=exploit, subid=1, output='b') vuln_changed_1 = Vulnerability(port=self.port, exploit=exploit, subid=2, output='c') vuln_changed_2 = Vulnerability(port=self.port, exploit=exploit, subid=2, output='d') vuln_common = Vulnerability(port=self.port, exploit=exploit, subid=5, output='e') self.port_info.storage.get_vulnerabilities.side_effect = ([ vuln_added, vuln_changed_1, vuln_common ], [vuln_removed, vuln_changed_2, vuln_common]) expected = [ VulnerabilityChange(change_time=12, previous_finding=None, current_finding=vuln_added), VulnerabilityChange(change_time=12, previous_finding=vuln_removed, current_finding=None), VulnerabilityChange(change_time=12, previous_finding=vuln_changed_2, current_finding=vuln_changed_1), ] self.port_info.diff_with_last_scan() self.port_info.storage.get_vulnerabilities.assert_has_calls( (call(port=self.port, exploit=self.exploit, scan=self.context.scanner.scan), call(port=self.port, exploit=self.exploit, scan=scan_2)), any_order=True) self.assertCountEqual( self.port_info.storage.save_changes.call_args[0][0], expected) serializer.assert_has_calls((call(vuln) for vuln in expected))
def setUp(self): exploit = Exploit(exploit_id=3) port = Port(node=Node(node_id=2, ip=ipaddress.ip_address('127.0.0.1')), transport_protocol=TransportProtocol.TCP, number=16) self.aucote = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.task = SSLScriptTask(port=port, exploits=[exploit], context=self.context)
def test_store_scan(self): port = Port(node=None, number=80, transport_protocol=TransportProtocol.UDP) port.scan = Scan(end=25.0) exploit = Exploit(exploit_id=5) self.task.store_scan_end(exploits=[exploit], port=port) self.task.aucote.storage.save_security_scans.assert_called_once_with( exploits=[exploit], port=port, scan=self.context.scanner.scan)
def test_vulnerability_serializer_port_only(self): scan = Scan(start=datetime.datetime(2016, 8, 16, 15, 23, 10, 183095, tzinfo=utc).timestamp(), scanner='scanner') result = self.serializer.serialize_vulnerability(Vulnerability(port=self.port, scan=scan))._data expected = bytearray(b'\xe7\xfb\xf2\x93V\x01\x00\x00\x16\x00\x00\x64\xff\x9b\x00\x00\x00\x00\x00\x00\x00\x00' b'\x7f\x00\x00\x01\x01\x00\x00\x00\x03\x00ssh\x00\x00\x00\x00\x06\xe7\xfb\xf2\x93V\x01' b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0`\xd5!\x03\x00\x00\x00\x15\x00' b'test_name_and_version\x05\x00OTHER\x07\x00scanner\x00\x00\x00\x00\x00\x00\x00\x00' b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') self.assertEqual(result, expected)
def setUp(self): super(AucoteHttpHeadersToolTest, self).setUp() self.aucote = MagicMock() self.exploits = MagicMock() self.port = MagicMock() self.config = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.tool = AucoteHttpHeadersTool(context=self.context, exploits=self.exploits, port=self.port, config=self.config)
def setUp(self): """ Set up init variables """ super().setUp() self.executor = MagicMock() self.executor.kudu_queue = MagicMock() self.executor.exploits = MagicMock() self.context = ScanContext(aucote=self.executor, scanner=MagicMock(scan=Scan())) self.task = Task(context=self.context)
def setUp(self): super(WhatWebTaskTest, self).setUp() self.node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) self.port = Port(node=self.node, number=19, transport_protocol=TransportProtocol.UDP) self.port.protocol = 'http' self.aucote = MagicMock() self.exploit = Exploit(app='whatweb', name='whatweb', exploit_id=1) self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.task = WhatWebTask(port=self.port, context=self.context, exploits=[self.exploit])
def test_serialize_vulnchange(self, output): output.return_value = 'test_output' scan_1 = Scan(start=1178603, end=17, protocol=TransportProtocol.UDP, scanner='test_name') scan_2 = Scan(start=187213, end=17, protocol=TransportProtocol.UDP, scanner='test_name') node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) port = Port(node, transport_protocol=TransportProtocol.TCP, number=88) exploit = Exploit(name="exploit_name", app="exploit_app", exploit_id=18) previous_finding = Vulnerability(output="test_output_1", exploit=exploit, port=port, subid=13, vuln_time=13456) previous_finding.scan = scan_1 previous_finding.row_id = 124 current_finding = Vulnerability(output="test_output_2", exploit=exploit, port=port, subid=13, vuln_time=6456345) current_finding.row_id = 15 current_finding.scan = scan_2 change = VulnerabilityChange(current_finding=current_finding, change_time=124445, previous_finding=previous_finding) expected = bytearray(b'\x00\x64\xff\x9b\x00\x00\x00\x00\x00\x00\x00\x00\x7f\x00\x00\x01X\x00\x06\x12\x00' b'\x00\x00\r\x00\x00\x00H\xe1j\x07\x00\x00\x00\x00\x01\x00\x00\x00\x00\x80R\xcd\x00\x00' b'\x00\x00\x00\xa8\x01\xd4\x80\x01\x00\x00\x00\r\x00test_output_1\r\x00test_output_2\x15' b'\x00Vulnerability changed') result = self.serializer.serialize_vulnerability_change(change)._data self.assertEqual(result, expected)
def setUp(self): super().setUp() self.aucote = MagicMock() self.aucote.storage.filename = ":memory:" self.exploits = MagicMock() self.config = MagicMock() self.port = MagicMock() self.scan = Scan() self.context = ScanContext(aucote=self.aucote, scanner=None) self.tool = Tool(context=self.context, exploits=self.exploits, port=self.port, config=self.config)
def setUp(self): self.serializer = Serializer() self.vuln = Vulnerability(subid=15) node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) node.os = MagicMock() node.os.name_with_version = 'test_name_and_version' self.context = ScanContext(aucote=None, scanner=TCPScanner(MagicMock(), MagicMock(), MagicMock(), MagicMock())) self.vuln.context = self.context self.port = Port(node=node, number=22, transport_protocol=TransportProtocol.TCP) self.port.protocol = 'ssh' self.port.scan = Scan() self.port.scan.start = datetime.datetime(2016, 8, 16, 15, 23, 10, 183095, tzinfo=utc).timestamp() self.vuln.port = self.port self.vuln.output = 'Test' self.vuln.scan = Scan(start=datetime.datetime(2016, 8, 16, 15, 23, 10, 183095, tzinfo=utc).timestamp(), scanner='tcp') self.exploit = Exploit(exploit_id=1) self.exploit.app = 'test_app' self.exploit.name = 'test_name' self.exploit.title = 'test_title' self.exploit.description = 'test_description' self.exploit.risk_level = RiskLevel.from_name('High') self.exploit.cve = 'CVE-2018-0001' self.exploit.cvss = 9.8 self.exploit.metric = ExploitMetric.VNC_INFO self.exploit.category = ExploitCategory.VULN self.exploit.tags = {ExploitTag.HTTP, ExploitTag.SSL, ExploitTag.HTTPS} self.vuln.exploit = self.exploit self.vuln.time = datetime.datetime(2016, 8, 16, 15, 23, 10, 183095, tzinfo=utc).timestamp()
def setUp(self): super(WhatWebToolTest, self).setUp() self.aucote = MagicMock() self.exploit = Exploit(exploit_id=1) self.node = Node(ip=ipaddress.ip_address('127.0.0.1'), node_id=1) self.port = Port(node=self.node, transport_protocol=TransportProtocol.UDP, number=87) self.config = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock(scan=Scan())) self.tool = WhatWebTool(context=self.context, exploits=[self.exploit], port=self.port, config=self.config)
def setUp(self, cfg): super(ExecutorTest, self).setUp() cfg._cfg = { 'portdetection': { '_internal': { 'port_period': None, 'broadcast': True } } } self.cfg = cfg self.aucote = MagicMock() self.aucote.storage = MagicMock() self.context = ScanContext(aucote=self.aucote, scanner=MagicMock()) self.context.scanner.scan = Scan() self.executor = Executor(context=self.context)
def _get_special_ports(self): return_value = [] if cfg['service.scans.physical']: interfaces = netifaces.interfaces() for interface in interfaces: addr = netifaces.ifaddresses(interface) if netifaces.AF_INET not in addr: continue port = PhysicalPort() port.interface = interface port.scan = Scan(start=time.time()) return_value.append(port) return return_value
async def _get_nodes(self, url: str) -> set: """ Get nodes from Topdis Returns: set of unique nodes (Node object) """ url = '{0}/{1}'.format(self.api, url) resource = await HTTPClient.instance().get(url) nodes_cfg = ujson.loads(resource.body) timestamp = parse_time_to_timestamp(nodes_cfg['meta']['requestTime']) ip_node = {} for node_struct in nodes_cfg['nodes']: for node_ip in node_struct['ips']: node = Node(ip=ipaddress.ip_address(node_ip), node_id=node_struct['id']) node.name = node_struct['displayName'] node.scan = Scan(start=timestamp) software = node_struct.get('software', {}) os = software.get('os', {}) if os.get('discoveryType') in ( TopisOSDiscoveryType.DIRECT.value, ): node.os.name, node.os.version = os.get('name'), os.get( 'version') try: node.os.cpe = Service.build_cpe( product=node.os.name, version=node.os.version, part=CPEType.OS) except: node.os.cpe = None ip_node[node.ip] = node nodes = set(ip_node.values()) log.debug('Got %i nodes from topdis', len(nodes)) return nodes