def user_add_route():
"""add user"""
form = UserForm()
if form.validate_on_submit():
user = User()
form.populate_obj(user)
if form.new_password.data:
user.password = PWS.hash(form.new_password.data)
db.session.add(user)
db.session.commit()
return redirect(url_for('auth.user_list_route'))
return render_template('auth/user/addedit.html', form=form)
def apikey():
"""yield valid apikey for user in role agent"""
tmp_apikey = PWS.generate_apikey()
db.session.add(User(username='******', apikey=PWS.hash_simple(tmp_apikey), active=True, roles=['agent']))
db.session.commit()
yield tmp_apikey
def add_agent():
"""add new agent"""
apikey = PWS.generate_apikey()
agent = User(username=f'agent_{uuid4()}',
apikey=apikey,
active=True,
roles=['agent'])
db.session.add(agent)
db.session.commit()
print(f'new agent {agent.username} apikey {apikey}')
def client_in_roles(clnt, roles):
"""create user role and login client to role(s)"""
password = PWS.generate()
user = User(username='******', password=PWS.hash(password), active=True, roles=roles)
db.session.add(user)
db.session.commit()
form = clnt.get(url_for('auth.login_route')).form
form['username'] = user.username
form['password'] = password
form.submit()
return clnt
def selenium_in_roles(sclnt, roles):
"""create user role and login selenium to role(s)"""
tmp_password = PWS.generate()
tmp_user = User(username='******', password=PWS.hash(tmp_password), active=True, roles=roles)
db.session.add(tmp_user)
db.session.commit()
sclnt.get(url_for('auth.login_route', _external=True))
sclnt.find_element_by_xpath('//form//input[@name="username"]').send_keys(tmp_user.username)
sclnt.find_element_by_xpath('//form//input[@name="password"]').send_keys(tmp_password)
sclnt.find_element_by_xpath('//form//input[@type="submit"]').click()
webdriver_waituntil(sclnt, EC.presence_of_element_located((By.XPATH, '//a[text()="Logout"]')))
return sclnt
def initdata(): # pylint: disable=too-many-statements
"""put initial data to database"""
# auth test data
db.session.add(
User(username='******',
active=True,
roles=['user', 'operator', 'admin']))
# scheduler test data
db.session.add(
Excl(family=ExclFamily.network,
value='127.66.66.0/26',
comment='blacklist 1'))
db.session.add(
Excl(family=ExclFamily.regex,
value=r'^tcp://.*:22$',
comment='avoid ssh'))
queue = Queue(name='dev dummy',
config=yaml_dump({
'module': 'dummy',
'args': '--dummyparam 1'
}),
group_size=2,
priority=10,
active=True)
db.session.add(queue)
for target in range(3):
db.session.add(Target(target=target, queue=queue))
db.session.add(
Queue(
name='pentest full syn scan',
config=yaml_dump({
'module':
'nmap',
'args':
'-sS -A -p1-65535 -Pn --max-retries 3 --script-timeout 10m --min-hostgroup 20 --min-rate 900 --max-rate 1500'
}),
group_size=20,
priority=10,
))
db.session.add(
Queue(
name='disco syn scan top10000',
config=yaml_dump({
'module': 'nmap',
'args': '-sS --top-ports 10000 -Pn',
'timing_perhost': 4
}),
group_size=1000,
priority=10,
))
db.session.add(
Queue(
name='disco ipv6 dns discover',
config=yaml_dump({
'module': 'six_dns_discover',
'delay': 1
}),
group_size=1000,
priority=10,
))
db.session.add(
Queue(
name='disco ipv6 enum discover',
config=yaml_dump({
'module': 'six_enum_discover',
'rate': 100
}),
group_size=5,
priority=10,
))
db.session.add(
Queue(
name='data version scan basic',
config=yaml_dump({
'module': 'manymap',
'args': '-sV --version-intensity 4 -Pn',
'delay': 5
}),
group_size=50,
priority=15,
))
db.session.add(
Queue(
name='data jarm scan',
config=yaml_dump({
'module': 'jarm',
'delay': 5
}),
group_size=50,
priority=15,
))
db.session.add(
Queue(
name='data script scan basic',
config=yaml_dump({
'module': 'manymap',
'args':
'-sS --script default,http-headers,ldap-rootdse,ssl-cert,ssl-enum-ciphers,ssh-auth-methods --script-timeout 10m -Pn',
'delay': 5
}),
group_size=50,
priority=15,
))
# storage test data host1
aggregable_vuln = {
'name': 'aggregable vuln',
'xtype': 'x.agg',
'severity': SeverityEnum.medium
}
host = Host(address='127.4.4.4',
hostname='testhost.testdomain.test<script>alert(1);</script>',
os='Test Linux 1',
comment='a some unknown service server')
db.session.add(host)
db.session.add(
Service(host=host,
proto='tcp',
port=12345,
state='open:testreason',
name='svcx',
info='testservice banner',
comment='manual testservice comment'))
db.session.add(Vuln(host=host, **aggregable_vuln))
# storage test data host2
host = Host(address='127.3.3.3',
hostname='testhost1.testdomain.test',
os='Test Linux 2',
comment='another server')
db.session.add(host)
db.session.add(
Service(host=host,
proto='tcp',
port=12345,
state='closed:testreason',
name='svcx'))
db.session.add(
Vuln(host=host,
name='test vulnerability',
xtype='testxtype.123',
severity=SeverityEnum.critical,
comment='a test vulnerability comment',
refs=['ref1', 'ref2'],
tags=['tag1', 'tag2']))
db.session.add(
Vuln(host=host,
name='another test vulnerability',
xtype='testxtype.124',
severity=SeverityEnum.high,
comment='another vulnerability comment',
tags=None))
db.session.add(
Vuln(host=host,
name='vulnerability1',
xtype='testxtype.124',
severity=SeverityEnum.medium,
tags=['info']))
db.session.add(
Vuln(host=host,
name='vulnerability2',
xtype='testxtype.124',
severity=SeverityEnum.low,
tags=['report']))
db.session.add(
Vuln(host=host,
name='vulnerability2',
xtype='testxtype.124',
severity=SeverityEnum.info,
tags=['info']))
db.session.add(
Vuln(host=host,
service=Service.query.first(),
name='vulnerability3',
xtype='testxtype.124',
severity=SeverityEnum.unknown,
tags=['report']))
db.session.add(Vuln(host=host, **aggregable_vuln))
db.session.add(
Note(host=host,
xtype='sner.testnote',
data='testnote data',
comment='test note comment'))
db.session.commit()