Welcome to Kvasir! Herein these directories lay the groundwork tools for effective data management during a Penetration Test.

Penetration tests can be data management nightmares because of the large amounts of information that is generally obtained. Vulnerability scanners return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for just a few hosts. How easy is it to share all this data with your co-workers?

That's what Kvasir is here to help you with. Here's what you'll need to get started:

• The latest version of web2py (http://www.web2py.com/)
• A database (PostgreSQL known to work)
• A network vulnerability scanner (Nexpose/Nmap supported)
• Additional python libraries

Kvasir is a web2py application and can be installed for each customer or task. This design keeps data separated and from you accidentally attacking or reviewing other customers.

This tool was developed primarily for the Cisco Systems Advanced Services Security Posture Assessment (SPA) team. While not every method used by the SPA team may directly relate we hope that this tool is something that can be molded and adapted to fit almost any working scenario.

Current documentation will be maintained on the Kvasir Github wiki (https://github.com/KvasirSecurity/Kvasir/wiki)

Kvasir was primarily designed for use on short customer-focused engagements. A directory 'application' for each customer would be used allowing for much stronger data separation.

For example lets assume two customers, Foo Widgets and Bar Napkins.

Data for each customer is stored in /opt/data/$CUSTOMERNAME

Install Kvasir in each customer's directory:

• git clone https://github.com/KvasirSecurity/Kvasir /opt/data/foowidgets/kvasir
• git clone https://github.com/KvasirSecurity/Kvasir /opt/data/barnapkins/kvasir

Now symbolically link Kvasir to the web2py application directory:

• ln -s /opt/data/foowidgets/kvasir $WEB2PY_HOME/applications/foowdigets
• ln -s /opt/data/barnapkins/kvasir $WEB2PY_HOME/applications/barnapkins

Create unique databases:

• sudo su - postgres
• createdb -O pguser foowidgets
• createdb -O pguser barnapkins

Copy the kvasir.yaml.sample to kvasir.yaml and change the defaults:

• db->kvasir->uri

You're ready to go!

The web2py scheduler task system is used for long-running tasks such as launching terminals, processing XML report files, etc. The scheduler can run with the main web2py process or started from a separate terminal.

To start as part of the web2py web server process:

cd $WEB2PY_HOME
python web2py.py -a <recycle> -X -K foowidgets,barnapkins

To start as its own process:

cd $WEB2PY_HOME
python web2py.py -K foowidgets,barnapkins

Additional workers may be started by repeating the application name:

cd $WEB2PY_HOME
python web2py.py -K foowidgets,foowidgets,barnapkins,barnapkins

By default the scheduler task logging level is DEBUG. This can get very noisy on a terminal. To change this copy the logging.conf file to the web2py home directory. Modify it as you see fit.

cd $WEB2PY_HOME
cp applications/$APPNAME/logging.conf .